Vendor import of Unbound 1.6.6.vendor/unbound/1.6.6

587 files changed, 17311 insertions, 3678 deletions

diff --git a/Makefile.in b/Makefile.in
index 033b026cc911..1c33070336ef 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -426,7 +426,7 @@ libunbound/python/libunbound_wrap.c:	$(srcdir)/libunbound/python/libunbound.i un
 
 # Pyunbound python unbound wrapper
 _unbound.la:	libunbound_wrap.lo libunbound.la
-	$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -module -avoid-version -no-undefined -shared -o $@ libunbound_wrap.lo -rpath $(PYTHON_SITE_PKG) L. -L.libs -lunbound
+	$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -module -avoid-version -no-undefined -shared -o $@ libunbound_wrap.lo -rpath $(PYTHON_SITE_PKG) -L. -L.libs -lunbound
 
 util/config_file.c:	util/configparser.h
 util/configlexer.c:  $(srcdir)/util/configlexer.lex util/configparser.h
@@ -735,9 +735,9 @@ iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/i
  $(srcdir)/sldns/str2wire.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/rbtree.h  $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
@@ -749,8 +749,8 @@ localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/serv
  $(srcdir)/util/as112.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h \
@@ -777,12 +777,12 @@ view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(s
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h 
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
-  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h  $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
@@ -830,7 +830,7 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
  $(srcdir)/validator/val_secalgo.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
@@ -851,8 +851,8 @@ locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdi
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h
@@ -860,8 +860,8 @@ module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(s
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
@@ -876,7 +876,7 @@ net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_he
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
@@ -897,19 +897,19 @@ slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/uti
 timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehist.h $(srcdir)/util/log.h
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
 ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
@@ -1040,7 +1040,9 @@ checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/u
  $(srcdir)/testcode/checklocks.h
 dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/storage/lookup3.h
 ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h $(srcdir)/ipsecmod/ipsecmod.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
@@ -1174,9 +1176,10 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
   $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/validator/val_kcache.h
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
   $(srcdir)/daemon/remote.h \
@@ -1207,16 +1210,15 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/rbtree.h \
- $(srcdir)/testcode/fake_event.h $(srcdir)/daemon/remote.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \
+ $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
@@ -1266,17 +1268,19 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
   $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/validator/val_kcache.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/dnscrypt/cert.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
+ $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/rrdef.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
@@ -1309,7 +1313,8 @@ unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/view.h $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h $(PYTHONMOD_HEADER)
+ $(srcdir)/services/view.h $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h $(PYTHONMOD_HEADER) \
+ $(srcdir)/edns-subnet/subnet-whitelist.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index a6c174f1c421..8eccc15b0d80 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -688,8 +688,8 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 # check if -lwsock32 or -lgdi32 are needed.	
                 BAKLIBS="$LIBS"
                 BAKSSLLIBS="$LIBSSL_LIBS"
-                LIBS="$LIBS -lgdi32"
-                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
+		LIBS="$LIBS -lgdi32 -lws2_32"
+		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
                     int HMAC_Update(void);
@@ -839,7 +839,11 @@ dnl see if on windows
 if test "$ac_cv_header_windows_h" = "yes"; then
 	AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
 	USE_WINSOCK="1"
-	LIBS="$LIBS -lws2_32"
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
+		:
+	else
+		LIBS="$LIBS -lws2_32"
+	fi
 fi
 ],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index 9a63101edee3..f5f6937eeeed 100644
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -61,6 +61,8 @@
 /** the unit test testframe for cachedb, its module state contains
  * a cache for a couple queries (in memory). */
 struct testframe_moddata {
+	/** lock for mutex */
+	lock_basic_type lock;
 	/** key for single stored data element, NULL if none */
 	char* stored_key;
 	/** data for single stored data element, NULL if none */
@@ -72,14 +74,18 @@ struct testframe_moddata {
 static int
 testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
 {
+	struct testframe_moddata* d;
 	(void)env;
 	verbose(VERB_ALGO, "testframe_init");
-	cachedb_env->backend_data = (void*)calloc(1,
+	d = (struct testframe_moddata*)calloc(1,
 		sizeof(struct testframe_moddata));
+	cachedb_env->backend_data = (void*)d;
 	if(!cachedb_env->backend_data) {
 		log_err("out of memory");
 		return 0;
 	}
+	lock_basic_init(&d->lock);
+	lock_protect(&d->lock, d, sizeof(*d));
 	return 1;
 }
 
@@ -92,6 +98,7 @@ testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
 	verbose(VERB_ALGO, "testframe_deinit");
 	if(!d)
 		return;
+	lock_basic_destroy(&d->lock);
 	free(d->stored_key);
 	free(d->stored_data);
 	free(d);
@@ -105,17 +112,22 @@ testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 		cachedb_env->backend_data;
 	(void)env;
 	verbose(VERB_ALGO, "testframe_lookup of %s", key);
+	lock_basic_lock(&d->lock);
 	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
-		if(d->stored_datalen > sldns_buffer_capacity(result_buffer))
+		if(d->stored_datalen > sldns_buffer_capacity(result_buffer)) {
+			lock_basic_unlock(&d->lock);
 			return 0; /* too large */
+		}
 		verbose(VERB_ALGO, "testframe_lookup found %d bytes",
 			(int)d->stored_datalen);
 		sldns_buffer_clear(result_buffer);
 		sldns_buffer_write(result_buffer, d->stored_data,
 			d->stored_datalen);
 		sldns_buffer_flip(result_buffer);
+		lock_basic_unlock(&d->lock);
 		return 1;
 	}
+	lock_basic_unlock(&d->lock);
 	return 0;
 }
 
@@ -126,6 +138,7 @@ testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
 	struct testframe_moddata* d = (struct testframe_moddata*)
 		cachedb_env->backend_data;
 	(void)env;
+	lock_basic_lock(&d->lock);
 	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);
 
 	/* free old data element (if any) */
@@ -137,6 +150,7 @@ testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
 
 	d->stored_data = memdup(data, data_len);
 	if(!d->stored_data) {
+		lock_basic_unlock(&d->lock);
 		log_err("out of memory");
 		return;
 	}
@@ -146,8 +160,10 @@ testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
 		free(d->stored_data);
 		d->stored_data = NULL;
 		d->stored_datalen = 0;
+		lock_basic_unlock(&d->lock);
 		return;
 	}
+	lock_basic_unlock(&d->lock);
 	/* (key,data) successfully stored */
 }
 
@@ -170,16 +186,17 @@ cachedb_find_backend(const char* str)
 static int
 cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
 {
-	const char* backend_str = "testframe"; /* TODO get from cfg */
-	(void)cfg;     /* need this until the TODO is implemented */
-	if(backend_str && backend_str[0]) {
-		cachedb_env->backend = cachedb_find_backend(backend_str);
-		if(!cachedb_env->backend) {
-			log_err("cachedb: cannot find backend name '%s",
-				backend_str);
-			return 0;
-		}
+	const char* backend_str = cfg->cachedb_backend;
+
+	/* If unspecified we use the in-memory test DB. */
+	if(!backend_str)
+		backend_str = "testframe";
+	cachedb_env->backend = cachedb_find_backend(backend_str);
+	if(!cachedb_env->backend) {
+		log_err("cachedb: cannot find backend name '%s'", backend_str);
+		return 0;
 	}
+
 	/* TODO see if more configuration needs to be applied or not */
 	return 1;
 }
@@ -277,9 +294,10 @@ calc_hash(struct module_qstate* qstate, char* buf, size_t len)
 	size_t clen = 0;
 	uint8_t hash[CACHEDB_HASHSIZE/8];
 	const char* hex = "0123456789ABCDEF";
-	const char* secret = "default"; /* TODO: from qstate->env->cfg */
+	const char* secret = qstate->env->cfg->cachedb_secret ?
+		qstate->env->cfg->cachedb_secret : "default";
 	size_t i;
-	
+
 	/* copy the hash info into the clear buffer */
 	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
 		memmove(clear+clen, qstate->qinfo.qname,
diff --git a/config.h.in b/config.h.in
index 04aa762c58a9..16a7b0281a1f 100644
--- a/config.h.in
+++ b/config.h.in
@@ -296,6 +296,9 @@
 /* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
 #undef HAVE_NETTLE_DSA_COMPAT_H
 
+/* Define to 1 if you have the <nettle/eddsa.h> header file. */
+#undef HAVE_NETTLE_EDDSA_H
+
 /* Use libnss for crypto */
 #undef HAVE_NSS
 
diff --git a/configure b/configure
index 9b8496c4b859..2821d3209fbd 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.6.5.
+# Generated by GNU Autoconf 2.69 for unbound 1.6.6.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.6.5'
-PACKAGE_STRING='unbound 1.6.5'
+PACKAGE_VERSION='1.6.6'
+PACKAGE_STRING='unbound 1.6.6'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -1437,7 +1437,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.6.5 to adapt to many kinds of systems.
+\`configure' configures unbound 1.6.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1502,7 +1502,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.6.5:";;
+     short | recursive ) echo "Configuration of unbound 1.6.6:";;
    esac
   cat <<\_ACEOF
 
@@ -1714,7 +1714,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.6.5
+unbound configure 1.6.6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2423,7 +2423,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.6.5, which was
+It was created by unbound $as_me 1.6.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2775,11 +2775,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=6
 
-UNBOUND_VERSION_MICRO=5
+UNBOUND_VERSION_MICRO=6
 
 
 LIBUNBOUND_CURRENT=7
-LIBUNBOUND_REVISION=4
+LIBUNBOUND_REVISION=5
 LIBUNBOUND_AGE=5
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2835,6 +2835,7 @@ LIBUNBOUND_AGE=5
 # 1.6.3 had 7:2:5
 # 1.6.4 had 7:3:5
 # 1.6.5 had 7:4:5
+# 1.6.6 had 7:5:5
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -16464,7 +16465,9 @@ if test x"$ax_pthread_ok" = xyes; then
 
 $as_echo "#define HAVE_PTHREAD 1" >>confdefs.h
 
-		LIBS="$PTHREAD_LIBS $LIBS"
+		if test -n "$PTHREAD_LIBS"; then
+		  LIBS="$PTHREAD_LIBS $LIBS"
+		fi
 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 		CC="$PTHREAD_CC"
 		ub_have_pthreads=yes
@@ -16894,8 +16897,16 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 $as_echo "#define HAVE_PYTHON 1" >>confdefs.h
 
-      LIBS="$PYTHON_LDFLAGS $LIBS"
-      CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
+      if test -n "$LIBS"; then
+        LIBS="$PYTHON_LDFLAGS $LIBS"
+      else
+        LIBS="$PYTHON_LDFLAGS"
+      fi
+      if test -n "$CPPFLAGS"; then
+        CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
+      else
+        CPPFLAGS="$PYTHON_CPPFLAGS"
+      fi
       ub_have_python=yes
       PC_PY_DEPENDENCY="python"
 
@@ -17250,8 +17261,8 @@ $as_echo "no" >&6; }
                 # check if -lwsock32 or -lgdi32 are needed.
                 BAKLIBS="$LIBS"
                 BAKSSLLIBS="$LIBSSL_LIBS"
-                LIBS="$LIBS -lgdi32"
-                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
+		LIBS="$LIBS -lgdi32 -lws2_32"
+		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -lgdi32" >&5
 $as_echo_n "checking if -lcrypto needs -lgdi32... " >&6; }
                 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -18053,6 +18064,7 @@ case "$enable_dsa" in
       ;;
     *)
       # detect if DSA is supported, and turn it off if not.
+      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
       ac_fn_c_check_func "$LINENO" "DSA_SIG_new" "ac_cv_func_DSA_SIG_new"
 if test "x$ac_cv_func_DSA_SIG_new" = xyes; then :
 
@@ -18067,6 +18079,13 @@ else
                fi
 fi
 
+      else
+
+cat >>confdefs.h <<_ACEOF
+#define USE_DSA 1
+_ACEOF
+
+      fi
       ;;
 esac
 
@@ -18096,11 +18115,6 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 if test $ac_have_decl = 1; then :
 
-
-cat >>confdefs.h <<_ACEOF
-#define USE_ED25519 1
-_ACEOF
-
       		use_ed25519="yes"
 
 else
@@ -18109,6 +18123,28 @@ else
 fi
 
       fi
+      if test $USE_NETTLE = "yes"; then
+		for ac_header in nettle/eddsa.h
+do :
+  ac_fn_c_check_header_compile "$LINENO" "nettle/eddsa.h" "ac_cv_header_nettle_eddsa_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_nettle_eddsa_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_NETTLE_EDDSA_H 1
+_ACEOF
+ use_ed25519="yes"
+fi
+
+done
+
+      fi
+      if test $use_ed25519 = "yes"; then
+
+cat >>confdefs.h <<_ACEOF
+#define USE_ED25519 1
+_ACEOF
+
+      fi
       ;;
 esac
 
@@ -18621,7 +18657,12 @@ if test x_$enable_static_exe = x_yes; then
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
 		# for static compile, include gdi32 and zlib here.
-		LIBS="$LIBS -lgdi32 -lz"
+		if echo $LIBS | grep 'lgdi32' >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -lgdi32"
+		fi
+		LIBS="$LIBS -lz"
 	fi
 fi
 
@@ -18979,7 +19020,11 @@ if test "$ac_cv_header_windows_h" = "yes"; then
 $as_echo "#define USE_WINSOCK 1" >>confdefs.h
 
 	USE_WINSOCK="1"
-	LIBS="$LIBS -lws2_32"
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
+		:
+	else
+		LIBS="$LIBS -lws2_32"
+	fi
 fi
 
 else
@@ -20633,7 +20678,12 @@ $as_echo "#define OMITTED__D_LARGEFILE_SOURCE_1 1" >>confdefs.h
   fi
 
 
-LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
+if test -n "$LATE_LDFLAGS"; then
+  LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
+fi
+# remove start spaces
+LDFLAGS=`echo "$LDFLAGS"|sed -e 's/^ *//'`
+LIBS=`echo "$LIBS"|sed -e 's/^ *//'`
 
 
 cat >>confdefs.h <<_ACEOF
@@ -20643,7 +20693,7 @@ _ACEOF
 
 
 
-version=1.6.5
+version=1.6.6
 
 date=`date +'%b %e, %Y'`
 
@@ -21162,7 +21212,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.6.5, which was
+This file was extended by unbound $as_me 1.6.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -21228,7 +21278,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.6.5
+unbound config.status 1.6.6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index ccbb33d49c41..23a318ee5b77 100644
--- a/configure.ac
+++ b/configure.ac
@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[6])
-m4_define([VERSION_MICRO],[5])
+m4_define([VERSION_MICRO],[6])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=7
-LIBUNBOUND_REVISION=4
+LIBUNBOUND_REVISION=5
 LIBUNBOUND_AGE=5
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -74,6 +74,7 @@ LIBUNBOUND_AGE=5
 # 1.6.3 had 7:2:5
 # 1.6.4 had 7:3:5
 # 1.6.5 had 7:4:5
+# 1.6.6 had 7:5:5
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -456,7 +457,9 @@ ub_have_pthreads=no
 if test x_$withval != x_no; then
 	AX_PTHREAD([
 		AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.])
-		LIBS="$PTHREAD_LIBS $LIBS"
+		if test -n "$PTHREAD_LIBS"; then
+		  LIBS="$PTHREAD_LIBS $LIBS"
+		fi
 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 		CC="$PTHREAD_CC"
 		ub_have_pthreads=yes
@@ -558,8 +561,16 @@ if test x_$ub_test_python != x_no; then
       AC_SUBST(PY_MAJOR_VERSION)
       # Have Python
       AC_DEFINE(HAVE_PYTHON,1,[Define if you have Python libraries and header files.])
-      LIBS="$PYTHON_LDFLAGS $LIBS"
-      CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
+      if test -n "$LIBS"; then
+        LIBS="$PYTHON_LDFLAGS $LIBS"
+      else
+        LIBS="$PYTHON_LDFLAGS"
+      fi
+      if test -n "$CPPFLAGS"; then
+        CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
+      else
+        CPPFLAGS="$PYTHON_CPPFLAGS"
+      fi
       ub_have_python=yes
       PC_PY_DEPENDENCY="python"
       AC_SUBST(PC_PY_DEPENDENCY)
@@ -912,10 +923,14 @@ case "$enable_dsa" in
       ;;
     *)
       # detect if DSA is supported, and turn it off if not.
+      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
       AC_CHECK_FUNC(DSA_SIG_new, [
       AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
       ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
                fi ])
+      else
+      AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
+      fi
       ;;
 esac
 
@@ -927,13 +942,18 @@ case "$enable_ed25519" in
     *)
       if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 	      AC_CHECK_DECLS([NID_ED25519], [
-      		AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
       		use_ed25519="yes"
 	      ], [ if test "x$enable_ed25519" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support ED25519 and you used --enable-ed25519.])
 	      	fi ], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 	      ])
       fi
+      if test $USE_NETTLE = "yes"; then
+		AC_CHECK_HEADERS([nettle/eddsa.h], use_ed25519="yes",, [AC_INCLUDES_DEFAULT])
+      fi
+      if test $use_ed25519 = "yes"; then
+      		AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
+      fi
       ;;
 esac
 
@@ -1106,7 +1126,12 @@ if test x_$enable_static_exe = x_yes; then
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
 		# for static compile, include gdi32 and zlib here.
-		LIBS="$LIBS -lgdi32 -lz"
+		if echo $LIBS | grep 'lgdi32' >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -lgdi32"
+		fi
+		LIBS="$LIBS -lz"
 	fi
 fi
 
@@ -1448,7 +1473,12 @@ AC_SUBST(ALLTARGET)
 AC_SUBST(INSTALLTARGET)
 
 ACX_STRIP_EXT_FLAGS
-LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
+if test -n "$LATE_LDFLAGS"; then
+  LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
+fi
+# remove start spaces 
+LDFLAGS=`echo "$LDFLAGS"|sed -e 's/^ *//'`
+LIBS=`echo "$LIBS"|sed -e 's/^ *//'`
 
 AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [10240], [Define to the maximum message length to pass to syslog.])
 
diff --git a/contrib/fastrpz.patch b/contrib/fastrpz.patch
index aa8c1ece0e20..362e07cc6a8d 100644
--- a/contrib/fastrpz.patch
+++ b/contrib/fastrpz.patch
@@ -3263,15 +3263,15 @@ diff -u --unidirectional-new-file -r1.1 ./util/configparser.y
  %token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
  %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
  %token VAR_DISABLE_DNSSEC_LAME_CHECK
-@@ -150,7 +151,7 @@
+@@ -153,7 +154,7 @@
  toplevelvar: serverstart contents_server | stubstart contents_stub |
  	forwardstart contents_forward | pythonstart contents_py | 
  	rcstart contents_rc | dtstart contents_dt | viewstart 
 -	contents_view |
 +	contents_view | rpzstart contents_rpz |
- 	dnscstart contents_dnsc
+ 	dnscstart contents_dnsc |
+ 	cachedbstart contents_cachedb
  	;
- 
 @@ -2160,6 +2161,50 @@
  			(strcmp($2, "yes")==0);
  	}
diff --git a/daemon/daemon.c b/daemon/daemon.c
index dad9f86b344e..7411fabe7573 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -221,7 +221,9 @@ daemon_init(void)
 #  ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
 #  endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	ERR_load_SSL_strings();
+#endif
 #  ifdef USE_GOST
 	(void)sldns_key_EVP_load_gost_id();
 #  endif
@@ -239,7 +241,7 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(0, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -421,8 +423,8 @@ daemon_create_workers(struct daemon* daemon)
 		daemon->rand = ub_initstate(seed, NULL);
 		if(!daemon->rand)
 			fatal_exit("could not init random generator");
+		hash_set_raninit((uint32_t)ub_random(daemon->rand));
 	}
-	hash_set_raninit((uint32_t)ub_random(daemon->rand));
 	shufport = (int*)calloc(65536, sizeof(int));
 	if(!shufport)
 		fatal_exit("out of memory during daemon init");
@@ -691,6 +693,9 @@ daemon_cleanup(struct daemon* daemon)
 #ifdef USE_DNSTAP
 	dt_delete(daemon->dtenv);
 #endif
+#ifdef USE_DNSCRYPT
+	dnsc_delete(daemon->dnscenv);
+#endif
 	daemon->cfg = NULL;
 }
 
diff --git a/daemon/remote.c b/daemon/remote.c
index bb41cc5df2db..243d94c49aa1 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -229,42 +229,10 @@ daemon_remote_create(struct config_file* cfg)
 		free(rc);
 		return NULL;
 	}
-	/* no SSLv2, SSLv3 because has defects */
-	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
-		!= SSL_OP_NO_SSLv2){
-		log_crypto_err("could not set SSL_OP_NO_SSLv2");
+	if(!listen_sslctx_setup(rc->ctx)) {
 		daemon_remote_delete(rc);
 		return NULL;
 	}
-	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
-		!= SSL_OP_NO_SSLv3){
-		log_crypto_err("could not set SSL_OP_NO_SSLv3");
-		daemon_remote_delete(rc);
-		return NULL;
-	}
-#if defined(SSL_OP_NO_TLSv1) && defined(SSL_OP_NO_TLSv1_1)
-	/* if we have tls 1.1 disable 1.0 */
-	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1)
-		!= SSL_OP_NO_TLSv1){
-		log_crypto_err("could not set SSL_OP_NO_TLSv1");
-		daemon_remote_delete(rc);
-		return NULL;
-	}
-#endif
-#if defined(SSL_OP_NO_TLSv1_1) && defined(SSL_OP_NO_TLSv1_2)
-	/* if we have tls 1.2 disable 1.1 */
-	if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1)
-		!= SSL_OP_NO_TLSv1_1){
-		log_crypto_err("could not set SSL_OP_NO_TLSv1_1");
-		daemon_remote_delete(rc);
-		return NULL;
-	}
-#endif
-#if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA)
-	/* if we have sha256, set the cipher list to have no known vulns */
-	if(!SSL_CTX_set_cipher_list(rc->ctx, "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
-		log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
-#endif
 
 	if (cfg->remote_control_use_cert == 0) {
 		/* No certificates are requested */
@@ -314,23 +282,7 @@ daemon_remote_create(struct config_file* cfg)
 		log_crypto_err("Error in SSL_CTX check_private_key");
 		goto setup_error;
 	}
-#if HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
-	if(!SSL_CTX_set_ecdh_auto(rc->ctx,1)) {
-		log_crypto_err("Error in SSL_CTX_ecdh_auto, not enabling ECDHE");
-	}
-#elif defined(USE_ECDSA)
-	if(1) {
-		EC_KEY *ecdh = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1);
-		if (!ecdh) {
-			log_crypto_err("could not find p256, not enabling ECDHE");
-		} else {
-			if (1 != SSL_CTX_set_tmp_ecdh (rc->ctx, ecdh)) {
-				log_crypto_err("Error in SSL_CTX_set_tmp_ecdh, not enabling ECDHE");
-			}
-			EC_KEY_free (ecdh);
-		}
-	}
-#endif
+	listen_sslctx_setup_2(rc->ctx);
 	if(!SSL_CTX_load_verify_locations(rc->ctx, s_cert, NULL)) {
 		log_crypto_err("Error setting up SSL_CTX verify locations");
 	setup_error:
@@ -415,7 +367,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 			if (cfg->username && cfg->username[0] &&
 				cfg_uid != (uid_t)-1) {
 				if(chown(ip, cfg_uid, cfg_gid) == -1)
-					log_err("cannot chown %u.%u %s: %s",
+					verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
 					  (unsigned)cfg_uid, (unsigned)cfg_gid,
 					  ip, strerror(errno));
 			}
@@ -841,7 +793,7 @@ print_stats(SSL* ssl, const char* nm, struct ub_stats_info* s)
 static int
 print_thread_stats(SSL* ssl, int i, struct ub_stats_info* s)
 {
-	char nm[16];
+	char nm[32];
 	snprintf(nm, sizeof(nm), "thread%d", i);
 	nm[sizeof(nm)-1]=0;
 	return print_stats(ssl, nm, s);
@@ -873,6 +825,9 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 #ifdef USE_IPSECMOD
 	size_t ipsecmod = 0;
 #endif /* USE_IPSECMOD */
+#ifdef USE_DNSCRYPT
+	size_t dnscrypt_shared_secret = 0;
+#endif /* USE_DNSCRYPT */
 	msg = slabhash_get_mem(daemon->env->msg_cache);
 	rrset = slabhash_get_mem(&daemon->env->rrset_cache->table);
 	val = mod_get_mem(&worker->env, "validator");
@@ -884,6 +839,12 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 #ifdef USE_IPSECMOD
 	ipsecmod = mod_get_mem(&worker->env, "ipsecmod");
 #endif /* USE_IPSECMOD */
+#ifdef USE_DNSCRYPT
+	if(daemon->dnscenv) {
+		dnscrypt_shared_secret = slabhash_get_mem(
+			daemon->dnscenv->shared_secrets_cache);
+	}
+#endif /* USE_DNSCRYPT */
 
 	if(!print_longnum(ssl, "mem.cache.rrset"SQ, rrset))
 		return 0;
@@ -903,6 +864,11 @@ print_mem(SSL* ssl, struct worker* worker, struct daemon* daemon)
 	if(!print_longnum(ssl, "mem.mod.ipsecmod"SQ, ipsecmod))
 		return 0;
 #endif /* USE_IPSECMOD */
+#ifdef USE_DNSCRYPT
+	if(!print_longnum(ssl, "mem.cache.dnscrypt_shared_secret"SQ,
+			dnscrypt_shared_secret))
+		return 0;
+#endif /* USE_DNSCRYPT */
 	return 1;
 }
 
@@ -1065,6 +1031,9 @@ print_ext(SSL* ssl, struct ub_stats_info* s)
 		if(!ssl_printf(ssl, "num.answer.rcode.nodata"SQ"%lu\n", 
 			(unsigned long)s->svr.ans_rcode_nodata)) return 0;
 	}
+	/* iteration */
+	if(!ssl_printf(ssl, "num.query.ratelimited"SQ"%lu\n", 
+		(unsigned long)s->svr.queries_ratelimited)) return 0;
 	/* validation */
 	if(!ssl_printf(ssl, "num.answer.secure"SQ"%lu\n", 
 		(unsigned long)s->svr.ans_secure)) return 0;
@@ -1086,6 +1055,12 @@ print_ext(SSL* ssl, struct ub_stats_info* s)
 		(unsigned)s->svr.infra_cache_count)) return 0;
 	if(!ssl_printf(ssl, "key.cache.count"SQ"%u\n",
 		(unsigned)s->svr.key_cache_count)) return 0;
+#ifdef USE_DNSCRYPT
+	if(!ssl_printf(ssl, "dnscrypt_shared_secret.cache.count"SQ"%u\n",
+		(unsigned)s->svr.shared_secret_cache_count)) return 0;
+	if(!ssl_printf(ssl, "num.query.dnscrypt.shared_secret.cachemiss"SQ"%lu\n",
+		(unsigned long)s->svr.num_query_dnscrypt_secret_missed_cache)) return 0;
+#endif /* USE_DNSCRYPT */
 	return 1;
 }
 
@@ -2389,10 +2364,16 @@ dump_infra_host(struct lruhash_entry* e, void* arg)
 	struct infra_data* d = (struct infra_data*)e->data;
 	char ip_str[1024];
 	char name[257];
+	int port;
 	if(a->ssl_failed)
 		return;
 	addr_to_str(&k->addr, k->addrlen, ip_str, sizeof(ip_str));
 	dname_str(k->zonename, name);
+	port = (int)ntohs(((struct sockaddr_in*)&k->addr)->sin_port);
+	if(port != UNBOUND_DNS_PORT) {
+		snprintf(ip_str+strlen(ip_str), sizeof(ip_str)-strlen(ip_str),
+			"@%d", port);
+	}
 	/* skip expired stuff (only backed off) */
 	if(d->ttl < a->now) {
 		if(d->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
diff --git a/daemon/stats.c b/daemon/stats.c
index 599f39bcddda..1058556be7c2 100644
--- a/daemon/stats.c
+++ b/daemon/stats.c
@@ -56,6 +56,7 @@
 #include "util/timehist.h"
 #include "util/net_help.h"
 #include "validator/validator.h"
+#include "iterator/iterator.h"
 #include "sldns/sbuffer.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
@@ -123,7 +124,7 @@ void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
 
 /** get rrsets bogus number from validator */
 static size_t
-get_rrset_bogus(struct worker* worker)
+get_rrset_bogus(struct worker* worker, int reset)
 {
 	int m = modstack_find(&worker->env.mesh->mods, "validator");
 	struct val_env* ve;
@@ -133,12 +134,48 @@ get_rrset_bogus(struct worker* worker)
 	ve = (struct val_env*)worker->env.modinfo[m];
 	lock_basic_lock(&ve->bogus_lock);
 	r = ve->num_rrset_bogus;
-	if(!worker->env.cfg->stat_cumulative)
+	if(reset && !worker->env.cfg->stat_cumulative)
 		ve->num_rrset_bogus = 0;
 	lock_basic_unlock(&ve->bogus_lock);
 	return r;
 }
 
+/** get number of ratelimited queries from iterator */
+static size_t
+get_queries_ratelimit(struct worker* worker, int reset)
+{
+	int m = modstack_find(&worker->env.mesh->mods, "iterator");
+	struct iter_env* ie;
+	size_t r;
+	if(m == -1)
+		return 0;
+	ie = (struct iter_env*)worker->env.modinfo[m];
+	lock_basic_lock(&ie->queries_ratelimit_lock);
+	r = ie->num_queries_ratelimited;
+	if(reset && !worker->env.cfg->stat_cumulative)
+		ie->num_queries_ratelimited = 0;
+	lock_basic_unlock(&ie->queries_ratelimit_lock);
+	return r;
+}
+
+#ifdef USE_DNSCRYPT
+/** get the number of shared secret cache miss */
+static size_t
+get_dnscrypt_cache_miss(struct worker* worker, int reset)
+{
+	size_t r;
+	struct dnsc_env* de = worker->daemon->dnscenv;
+	if(!de) return 0;
+
+	lock_basic_lock(&de->shared_secrets_cache_lock);
+	r = de->num_query_dnscrypt_secret_missed_cache;
+	if(reset && !worker->env.cfg->stat_cumulative)
+		de->num_query_dnscrypt_secret_missed_cache = 0;
+	lock_basic_unlock(&de->shared_secrets_cache_lock);
+	return r;
+}
+#endif /* USE_DNSCRYPT */
+
 void
 server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 {
@@ -169,7 +206,10 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
 
 	/* get and reset validator rrset bogus number */
-	s->svr.rrset_bogus = (long long)get_rrset_bogus(worker);
+	s->svr.rrset_bogus = (long long)get_rrset_bogus(worker, reset);
+
+	/* get and reset iterator query ratelimit number */
+	s->svr.queries_ratelimited = (long long)get_queries_ratelimit(worker, reset);
 
 	/* get cache sizes */
 	s->svr.msg_cache_count = (long long)count_slabhash_entries(worker->env.msg_cache);
@@ -179,6 +219,21 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		s->svr.key_cache_count = (long long)count_slabhash_entries(worker->env.key_cache->slab);
 	else	s->svr.key_cache_count = 0;
 
+#ifdef USE_DNSCRYPT
+	if(worker->daemon->dnscenv) {
+		s->svr.num_query_dnscrypt_secret_missed_cache =
+			(long long)get_dnscrypt_cache_miss(worker, reset);
+		s->svr.shared_secret_cache_count = (long long)count_slabhash_entries(
+			worker->daemon->dnscenv->shared_secrets_cache);
+	} else {
+		s->svr.num_query_dnscrypt_secret_missed_cache = 0;
+		s->svr.shared_secret_cache_count = 0;
+	}
+#else
+	s->svr.num_query_dnscrypt_secret_missed_cache = 0;
+	s->svr.shared_secret_cache_count = 0;
+#endif /* USE_DNSCRYPT */
+
 	/* get tcp accept usage */
 	s->svr.tcp_accept_usage = 0;
 	for(lp = worker->front->cps; lp; lp = lp->next) {
@@ -240,7 +295,7 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		a->svr.num_query_dnscrypt_cleartext;
 	total->svr.num_query_dnscrypt_crypted_malformed += \
 		a->svr.num_query_dnscrypt_crypted_malformed;
-#endif
+#endif /* USE_DNSCRYPT */
 	/* the max size reached is upped to higher of both */
 	if(a->svr.max_query_list_size > total->svr.max_query_list_size)
 		total->svr.max_query_list_size = a->svr.max_query_list_size;
@@ -266,7 +321,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
-		total->svr.rrset_bogus += a->svr.rrset_bogus;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
 		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
diff --git a/daemon/unbound.c b/daemon/unbound.c
index ba7337d8907a..070a824d6734 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -128,6 +128,9 @@ static void usage(void)
 	for(m = module_list_avail(); *m; m++)
 		printf(" %s", *m);
 	printf("\n");
+#ifdef USE_DNSCRYPT
+	printf("DNSCrypt feature available\n");
+#endif
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 	ub_event_base_free(base);
@@ -400,7 +403,7 @@ detach(void)
 /** daemonize, drop user priviliges and chroot if needed */
 static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
-	const char** cfgfile)
+	const char** cfgfile, int need_pidfile)
 {
 #ifdef HAVE_KILL
 	int pidinchroot;
@@ -444,13 +447,13 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 #ifdef HAVE_KILL
 	/* true if pidfile is inside chrootdir, or nochroot */
-	pidinchroot = !(cfg->chrootdir && cfg->chrootdir[0]) ||
+	pidinchroot = need_pidfile && (!(cfg->chrootdir && cfg->chrootdir[0]) ||
 				(cfg->chrootdir && cfg->chrootdir[0] &&
 				strncmp(cfg->pidfile, cfg->chrootdir,
-				strlen(cfg->chrootdir))==0);
+				strlen(cfg->chrootdir))==0));
 
 	/* check old pid file before forking */
-	if(cfg->pidfile && cfg->pidfile[0]) {
+	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
 		/* calculate position of pidfile */
 		if(cfg->pidfile[0] == '/')
 			daemon->pidfile = strdup(cfg->pidfile);
@@ -469,7 +472,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 
 	/* write new pidfile (while still root, so can be outside chroot) */
 #ifdef HAVE_KILL
-	if(cfg->pidfile && cfg->pidfile[0]) {
+	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
 		writepid(daemon->pidfile, getpid());
 		if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
 			pidinchroot) {
@@ -484,6 +487,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	}
 #else
 	(void)daemon;
+	(void)need_pidfile;
 #endif /* HAVE_KILL */
 
 	/* Set user context */
@@ -600,9 +604,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
  * @param log_default_identity: Default identity to report in logs
+ * @param need_pidfile: if false, no pidfile is checked or created.
  */
 static void 
-run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity)
+run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity, int need_pidfile)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
@@ -632,7 +637,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char*
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_setup) { 
-			perform_setup(daemon, cfg, debug_mode, &cfgfile);
+			perform_setup(daemon, cfg, debug_mode, &cfgfile, need_pidfile);
 			done_setup = 1; 
 		} else {
 			/* reopen log after HUP to facilitate log rotation */
@@ -682,6 +687,8 @@ main(int argc, char* argv[])
 	const char* log_ident_default;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
+	int need_pidfile = 1;
+
 #ifdef UB_ON_WINDOWS
 	int cmdline_cfg = 0;
 #endif
@@ -690,7 +697,7 @@ main(int argc, char* argv[])
 	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
 	log_ident_set(log_ident_default);
 	/* parse the options */
-	while( (c=getopt(argc, argv, "c:dhvw:")) != -1) {
+	while( (c=getopt(argc, argv, "c:dhpvw:")) != -1) {
 		switch(c) {
 		case 'c':
 			cfgfile = optarg;
@@ -702,6 +709,9 @@ main(int argc, char* argv[])
 			cmdline_verbose++;
 			verbosity++;
 			break;
+		case 'p':
+			need_pidfile = 0;
+			break;
 		case 'd':
 			debug_mode++;
 			break;
@@ -732,7 +742,7 @@ main(int argc, char* argv[])
 		return 1;
 	}
 
-	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default);
+	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default, need_pidfile);
 	log_init(NULL, 0, NULL); /* close logfile */
 	return 0;
 }
diff --git a/daemon/worker.c b/daemon/worker.c
index 2c4cf5ba6c0a..683f93169117 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -1009,6 +1009,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct query_info* lookup_qinfo = &qinfo;
 	struct query_info qinfo_tmp; /* placeholdoer for lookup_qinfo */
 	struct respip_client_info* cinfo = NULL, cinfo_tmp;
+	memset(&qinfo, 0, sizeof(qinfo));
 
 	if(error != NETEVENT_NOERROR) {
 		/* some bad tcp query DNS formats give these error calls */
@@ -1111,6 +1112,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	if(!query_info_parse(&qinfo, c->buffer)) {
 		verbose(VERB_ALGO, "worker parse request: formerror.");
 		log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
+		memset(&qinfo, 0, sizeof(qinfo)); /* zero qinfo.qname */
 		if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
 			comm_point_drop_reply(repinfo);
 			return 0;
@@ -1355,6 +1357,10 @@ lookup_cache:
 					lock_rw_unlock(&e->lock);
 					regional_free_all(worker->scratchpad);
 					goto send_reply;
+				} else {
+					/* Note that we've already released the
+					 * lock if we're here after prefetch. */
+					lock_rw_unlock(&e->lock);
 				}
 				/* We've found a partial reply ending with an
 				 * alias.  Replace the lookup qinfo for the
@@ -1362,7 +1368,6 @@ lookup_cache:
 				 * (possibly) complete the reply.  As we're
 				 * passing the "base" reply, there will be no
 				 * more alias chasing. */
-				lock_rw_unlock(&e->lock);
 				memset(&qinfo_tmp, 0, sizeof(qinfo_tmp));
 				get_cname_target(alias_rrset, &qinfo_tmp.qname,
 					&qinfo_tmp.qname_len);
@@ -1669,7 +1674,17 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	worker->env.send_query = &worker_send_query;
 	worker->env.alloc = &worker->alloc;
 	worker->env.rnd = worker->rndstate;
-	worker->env.scratch = worker->scratchpad;
+	/* If case prefetch is triggered, the corresponding mesh will clear
+	 * the scratchpad for the module env in the middle of request handling.
+	 * It would be prone to a use-after-free kind of bug, so we avoid
+	 * sharing it with worker's own scratchpad at the cost of having
+	 * one more pad per worker. */
+	worker->env.scratch = regional_create_custom(cfg->msg_buffer_size);
+	if(!worker->env.scratch) {
+		log_err("malloc failure");
+		worker_delete(worker);
+		return 0;
+	}
 	worker->env.mesh = mesh_create(&worker->daemon->mods, &worker->env);
 	worker->env.detach_subs = &mesh_detach_subs;
 	worker->env.attach_sub = &mesh_attach_sub;
@@ -1758,6 +1773,7 @@ worker_delete(struct worker* worker)
 	comm_base_delete(worker->base);
 	ub_randfree(worker->rndstate);
 	alloc_clear(&worker->alloc);
+	regional_destroy(worker->env.scratch);
 	regional_destroy(worker->scratchpad);
 	free(worker);
 }
diff --git a/dns64/dns64.c b/dns64/dns64.c
index b3e3ab852bca..2f2d1255d6ff 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -540,6 +540,7 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		case module_event_new:
 			/* Tag this query as being new and fall through. */
 			qstate->minfo[id] = (void*)DNS64_NEW_QUERY;
+  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
 			break;
diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 9e858c3fb061..db054df9d680 100644
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -12,6 +12,8 @@
 #include "util/net_help.h"
 #include "util/netevent.h"
 #include "util/log.h"
+#include "util/storage/slabhash.h"
+#include "util/storage/lookup3.h"
 
 #include "dnscrypt/cert.h"
 #include "dnscrypt/dnscrypt.h"
@@ -19,13 +21,15 @@
 
 #include <ctype.h>
 
+
 /**
  * \file
  * dnscrypt functions for encrypting DNS packets.
  */
 
 #define DNSCRYPT_QUERY_BOX_OFFSET \
-    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + crypto_box_HALF_NONCEBYTES)
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + \
+    crypto_box_HALF_NONCEBYTES)
 
 //  8 bytes: magic header (CERT_MAGIC_HEADER)
 // 12 bytes: the client's nonce
@@ -33,13 +37,110 @@
 // 16 bytes: Poly1305 MAC (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES)
 
 #define DNSCRYPT_REPLY_BOX_OFFSET \
-    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES + crypto_box_HALF_NONCEBYTES)
+    (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES + \
+    crypto_box_HALF_NONCEBYTES)
+
+
+/**
+ * Shared secret cache key length.
+ * secret key.
+ * 1 byte: ES_VERSION[1]
+ * 32 bytes: client crypto_box_PUBLICKEYBYTES
+ * 32 bytes: server crypto_box_SECRETKEYBYTES
+ */
+#define DNSCRYPT_SHARED_SECRET_KEY_LENGTH \
+    (1 + crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES)
+
+
+struct shared_secret_cache_key {
+    /** the hash table key */
+    uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH];
+    /** the hash table entry, data is uint8_t pointer of size crypto_box_BEFORENMBYTES which contains the shared secret. */
+    struct lruhash_entry entry;
+};
+
+
+/**
+ * Generate a key suitable to find shared secret in slabhash.
+ * \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
+ * \param[in] esversion: The es version least significant byte.
+ * \param[in] pk: The public key of the client. uint8_t pointer of size
+ * crypto_box_PUBLICKEYBYTES.
+ * \param[in] sk: The secret key of the server matching the magic query number.
+ * uint8_t pointer of size crypto_box_SECRETKEYBYTES.
+ * \return the hash of the key.
+ */
+static uint32_t
+dnsc_shared_secrets_cache_key(uint8_t* key,
+                              uint8_t esversion,
+                              uint8_t* pk,
+                              uint8_t* sk)
+{
+    key[0] = esversion;
+    memcpy(key + 1, pk, crypto_box_PUBLICKEYBYTES);
+    memcpy(key + 1 + crypto_box_PUBLICKEYBYTES, sk, crypto_box_SECRETKEYBYTES);
+    return hashlittle(key, DNSCRYPT_SHARED_SECRET_KEY_LENGTH, 0);
+}
+
+/**
+ * Inserts a shared secret into the shared_secrets_cache slabhash.
+ * The shared secret is copied so the caller can use it freely without caring
+ * about the cache entry being evicted or not.
+ * \param[in] cache: the slabhash in which to look for the key.
+ * \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
+ * which contains the key of the shared secret.
+ * \param[in] hash: the hash of the key.
+ * \param[in] nmkey: a uint8_t pointer of size crypto_box_BEFORENMBYTES which
+ * contains the shared secret.
+ */
+static void
+dnsc_shared_secret_cache_insert(struct slabhash *cache,
+                                uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH],
+                                uint32_t hash,
+                                uint8_t nmkey[crypto_box_BEFORENMBYTES])
+{
+    struct shared_secret_cache_key* k =
+        (struct shared_secret_cache_key*)calloc(1, sizeof(*k));
+    uint8_t* d = malloc(crypto_box_BEFORENMBYTES);
+    if(!k || !d) {
+        free(k);
+        free(d);
+        return;
+    }
+    memcpy(d, nmkey, crypto_box_BEFORENMBYTES);
+    lock_rw_init(&k->entry.lock);
+    memcpy(k->key, key, DNSCRYPT_SHARED_SECRET_KEY_LENGTH);
+    k->entry.hash = hash;
+    k->entry.key = k;
+    k->entry.data = d;
+    slabhash_insert(cache,
+                    hash, &k->entry,
+                    d,
+                    NULL);
+}
+
+/**
+ * Lookup a record in shared_secrets_cache.
+ * \param[in] cache: a pointer to shared_secrets_cache slabhash.
+ * \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
+ * containing the key to look for.
+ * \param[in] hash: a hash of the key.
+ * \return a pointer to the locked cache entry or NULL on failure.
+ */
+static struct lruhash_entry*
+dnsc_shared_secrets_lookup(struct slabhash* cache,
+                           uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH],
+                           uint32_t hash)
+{
+    return slabhash_lookup(cache, hash, key, 0);
+}
 
 /**
  * Decrypt a query using the dnsccert that was found using dnsc_find_cert.
  * The client nonce will be extracted from the encrypted query and stored in
  * client_nonce, a shared secret will be computed and stored in nmkey and the
  * buffer will be decrypted inplace.
+ * \param[in] env the dnscrypt environment.
  * \param[in] cert the cert that matches this encrypted query.
  * \param[in] client_nonce where the client nonce will be stored.
  * \param[in] nmkey where the shared secret key will be written.
@@ -47,7 +148,8 @@
  * \return 0 on success.
  */
 static int
-dnscrypt_server_uncurve(const dnsccert *cert,
+dnscrypt_server_uncurve(struct dnsc_env* env,
+                        const dnsccert *cert,
                         uint8_t client_nonce[crypto_box_HALF_NONCEBYTES],
                         uint8_t nmkey[crypto_box_BEFORENMBYTES],
                         struct sldns_buffer* buffer)
@@ -56,27 +158,55 @@ dnscrypt_server_uncurve(const dnsccert *cert,
     uint8_t *const buf = sldns_buffer_begin(buffer);
     uint8_t nonce[crypto_box_NONCEBYTES];
     struct dnscrypt_query_header *query_header;
+    // shared secret cache
+    uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH];
+    struct lruhash_entry* entry;
+    uint32_t hash;
 
     if (len <= DNSCRYPT_QUERY_HEADER_SIZE) {
         return -1;
     }
 
     query_header = (struct dnscrypt_query_header *)buf;
-    memcpy(nmkey, query_header->publickey, crypto_box_PUBLICKEYBYTES);
-    if(cert->es_version[1] == 2) {
+    hash = dnsc_shared_secrets_cache_key(key,
+                                         cert->es_version[1],
+                                         query_header->publickey,
+                                         cert->keypair->crypt_secretkey);
+    entry = dnsc_shared_secrets_lookup(env->shared_secrets_cache,
+                                       key,
+                                       hash);
+
+    if(!entry) {
+        lock_basic_lock(&env->shared_secrets_cache_lock);
+        env->num_query_dnscrypt_secret_missed_cache++;
+        lock_basic_unlock(&env->shared_secrets_cache_lock);
+        if(cert->es_version[1] == 2) {
 #ifdef USE_DNSCRYPT_XCHACHA20
-        if (crypto_box_curve25519xchacha20poly1305_beforenm(
-                nmkey, nmkey, cert->keypair->crypt_secretkey) != 0) {
-            return -1;
-        }
+            if (crypto_box_curve25519xchacha20poly1305_beforenm(
+                        nmkey, query_header->publickey,
+                        cert->keypair->crypt_secretkey) != 0) {
+                return -1;
+            }
 #else
-        return -1;
+            return -1;
 #endif
     } else {
-        if (crypto_box_beforenm(nmkey, nmkey, cert->keypair->crypt_secretkey) != 0) {
+        if (crypto_box_beforenm(nmkey,
+                                query_header->publickey,
+                                cert->keypair->crypt_secretkey) != 0) {
             return -1;
         }
     }
+    // Cache the shared secret we just computed.
+    dnsc_shared_secret_cache_insert(env->shared_secrets_cache,
+                                    key,
+                                    hash,
+                                    nmkey);
+    } else {
+        /* copy shared secret and unlock entry */
+        memcpy(nmkey, entry->data, crypto_box_BEFORENMBYTES);
+        lock_rw_unlock(&entry->lock);
+    }
 
     memcpy(nonce, query_header->nonce, crypto_box_HALF_NONCEBYTES);
     memset(nonce + crypto_box_HALF_NONCEBYTES, 0, crypto_box_HALF_NONCEBYTES);
@@ -106,7 +236,7 @@ dnscrypt_server_uncurve(const dnsccert *cert,
     len -= DNSCRYPT_QUERY_HEADER_SIZE;
 
     while (*sldns_buffer_at(buffer, --len) == 0)
-	    ;
+        ;
 
     if (*sldns_buffer_at(buffer, len) != 0x80) {
         return -1;
@@ -172,7 +302,7 @@ dnscrypt_hrtime(void)
     if (ret == 0) {
         ts = (uint64_t)tv.tv_sec * 1000000U + (uint64_t)tv.tv_usec;
     } else {
-	log_err("gettimeofday: %s", strerror(errno));
+        log_err("gettimeofday: %s", strerror(errno));
     }
     return ts;
 }
@@ -223,7 +353,8 @@ dnscrypt_server_curve(const dnsccert *cert,
                       size_t max_udp_size)
 {
     size_t dns_reply_len = sldns_buffer_limit(buffer);
-    size_t max_len = dns_reply_len + DNSCRYPT_MAX_PADDING + DNSCRYPT_REPLY_HEADER_SIZE;
+    size_t max_len = dns_reply_len + DNSCRYPT_MAX_PADDING \
+        + DNSCRYPT_REPLY_HEADER_SIZE;
     size_t max_reply_size = max_udp_size - 20U - 8U;
     uint8_t nonce[crypto_box_NONCEBYTES];
     uint8_t *boxed;
@@ -268,8 +399,14 @@ dnscrypt_server_curve(const dnsccert *cert,
         }
     }
 
-    sldns_buffer_write_at(buffer, 0, DNSCRYPT_MAGIC_RESPONSE, DNSCRYPT_MAGIC_HEADER_LEN);
-    sldns_buffer_write_at(buffer, DNSCRYPT_MAGIC_HEADER_LEN, nonce, crypto_box_NONCEBYTES);
+    sldns_buffer_write_at(buffer,
+                          0,
+                          DNSCRYPT_MAGIC_RESPONSE,
+                          DNSCRYPT_MAGIC_HEADER_LEN);
+    sldns_buffer_write_at(buffer,
+                          DNSCRYPT_MAGIC_HEADER_LEN,
+                          nonce,
+                          crypto_box_NONCEBYTES);
     sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
     return 0;
 }
@@ -284,17 +421,17 @@ dnscrypt_server_curve(const dnsccert *cert,
 static int
 dnsc_read_from_file(char *fname, char *buf, size_t count)
 {
-	int fd;
-	fd = open(fname, O_RDONLY);
-	if (fd == -1) {
-		return -1;
-	}
-	if (read(fd, buf, count) != (ssize_t)count) {
-		close(fd);
-		return -2;
-	}
-	close(fd);
-	return 0;
+    int fd;
+    fd = open(fname, O_RDONLY);
+    if (fd == -1) {
+        return -1;
+    }
+    if (read(fd, buf, count) != (ssize_t)count) {
+        close(fd);
+        return -2;
+    }
+    close(fd);
+    return 0;
 }
 
 /**
@@ -308,12 +445,12 @@ dnsc_read_from_file(char *fname, char *buf, size_t count)
 static char *
 dnsc_chroot_path(struct config_file *cfg, char *path)
 {
-	char *nm;
-	nm = path;
-	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
-		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
-		nm += strlen(cfg->chrootdir);
-	return nm;
+    char *nm;
+    nm = path;
+    if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
+        cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
+        nm += strlen(cfg->chrootdir);
+    return nm;
 }
 
 /**
@@ -379,7 +516,7 @@ dnsc_key_to_fingerprint(char fingerprint[80U], const uint8_t * const key)
 
 /**
  * Find the cert matching a DNSCrypt query.
- * \param[in] dnscenv The DNSCrypt enviroment, which contains the list of certs
+ * \param[in] dnscenv The DNSCrypt environment, which contains the list of certs
  * supported by the server.
  * \param[in] buffer The encrypted DNS query.
  * \return a dnsccert * if we found a cert matching the magic_number of the
@@ -450,6 +587,7 @@ dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)
                 snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\\%03d", c);
             }
         }
+        verbose(VERB_OPS, "DNSCrypt: adding local data to config: %s", rr);
         snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\"");
         cfg_strlist_insert(&cfg->local_data, strdup(rr));
         free(rr);
@@ -502,7 +640,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 
 	env->keypairs = sodium_allocarray(env->keypairs_count,
 		sizeof *env->keypairs);
-	env->certs = sodium_allocarray(env->signed_certs_count, 
+	env->certs = sodium_allocarray(env->signed_certs_count,
 		sizeof *env->certs);
 
 	cert_id = 0U;
@@ -584,7 +722,8 @@ dnsc_handle_curved_request(struct dnsc_env* dnscenv,
     // to serve the certificate.
     verbose(VERB_ALGO, "handle request called on DNSCrypt socket");
     if ((repinfo->dnsc_cert = dnsc_find_cert(dnscenv, c->buffer)) != NULL) {
-        if(dnscrypt_server_uncurve(repinfo->dnsc_cert,
+        if(dnscrypt_server_uncurve(dnscenv,
+                                   repinfo->dnsc_cert,
                                    repinfo->client_nonce,
                                    repinfo->nmkey,
                                    c->buffer) != 0){
@@ -629,23 +768,93 @@ dnsc_create(void)
 		fatal_exit("dnsc_create: could not initialize libsodium.");
 	}
 	env = (struct dnsc_env *) calloc(1, sizeof(struct dnsc_env));
+	lock_basic_init(&env->shared_secrets_cache_lock);
+	lock_protect(&env->shared_secrets_cache_lock,
+				 &env->num_query_dnscrypt_secret_missed_cache,
+				 sizeof(env->num_query_dnscrypt_secret_missed_cache));
 	return env;
 }
 
 int
 dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
 {
-	if(dnsc_parse_certs(env, cfg) <= 0) {
-		fatal_exit("dnsc_apply_cfg: no cert file loaded");
-	}
-	if(dnsc_parse_keys(env, cfg) <= 0) {
-		fatal_exit("dnsc_apply_cfg: no key file loaded");
-	}
-	randombytes_buf(env->hash_key, sizeof env->hash_key);
-	env->provider_name = cfg->dnscrypt_provider;
+    if(dnsc_parse_certs(env, cfg) <= 0) {
+        fatal_exit("dnsc_apply_cfg: no cert file loaded");
+    }
+    if(dnsc_parse_keys(env, cfg) <= 0) {
+        fatal_exit("dnsc_apply_cfg: no key file loaded");
+    }
+    randombytes_buf(env->hash_key, sizeof env->hash_key);
+    env->provider_name = cfg->dnscrypt_provider;
+
+    if(dnsc_load_local_data(env, cfg) <= 0) {
+        fatal_exit("dnsc_apply_cfg: could not load local data");
+    }
+    env->shared_secrets_cache = slabhash_create(
+        cfg->dnscrypt_shared_secret_cache_slabs,
+        HASH_DEFAULT_STARTARRAY,
+        cfg->dnscrypt_shared_secret_cache_size,
+        dnsc_shared_secrets_sizefunc,
+        dnsc_shared_secrets_compfunc,
+        dnsc_shared_secrets_delkeyfunc,
+        dnsc_shared_secrets_deldatafunc,
+        NULL
+    );
+    if(!env->shared_secrets_cache){
+        fatal_exit("dnsc_apply_cfg: could not create shared secrets cache.");
+    }
+    return 0;
+}
 
-	if(dnsc_load_local_data(env, cfg) <= 0) {
-		fatal_exit("dnsc_apply_cfg: could not load local data");
+void
+dnsc_delete(struct dnsc_env *env)
+{
+	if(!env) {
+		return;
 	}
-	return 0;
+	verbose(VERB_OPS, "DNSCrypt: Freeing environment.");
+	sodium_free(env->signed_certs);
+	sodium_free(env->certs);
+	sodium_free(env->keypairs);
+	slabhash_delete(env->shared_secrets_cache);
+	lock_basic_destroy(&env->shared_secrets_cache_lock);
+	free(env);
+}
+
+/**
+ * #########################################################
+ * ############# Shared secrets cache functions ############
+ * #########################################################
+ */
+
+size_t
+dnsc_shared_secrets_sizefunc(void *k, void* ATTR_UNUSED(d))
+{
+    struct shared_secret_cache_key* ssk = (struct shared_secret_cache_key*)k;
+    size_t key_size = sizeof(struct shared_secret_cache_key)
+        + lock_get_mem(&ssk->entry.lock);
+    size_t data_size = crypto_box_BEFORENMBYTES;
+    (void)ssk; /* otherwise ssk is unused if no threading, or fixed locksize */
+    return key_size + data_size;
+}
+
+int
+dnsc_shared_secrets_compfunc(void *m1, void *m2)
+{
+    return sodium_memcmp(m1, m2, DNSCRYPT_SHARED_SECRET_KEY_LENGTH);
+}
+
+void
+dnsc_shared_secrets_delkeyfunc(void *k, void* ATTR_UNUSED(arg))
+{
+    struct shared_secret_cache_key* ssk = (struct shared_secret_cache_key*)k;
+    lock_rw_destroy(&ssk->entry.lock);
+    free(ssk);
+}
+
+void
+dnsc_shared_secrets_deldatafunc(void* d, void* ATTR_UNUSED(arg))
+{
+    uint8_t* data = (uint8_t*)d;
+    free(data);
 }
diff --git a/dnscrypt/dnscrypt.h b/dnscrypt/dnscrypt.h
index 26c2bb21d6b6..dde36d6675d1 100644
--- a/dnscrypt/dnscrypt.h
+++ b/dnscrypt/dnscrypt.h
@@ -26,6 +26,7 @@
 
 #include "config.h"
 #include "dnscrypt/cert.h"
+#include "util/locks.h"
 
 #define DNSCRYPT_QUERY_HEADER_SIZE \
     (DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + crypto_box_HALF_NONCEBYTES + crypto_box_MACBYTES)
@@ -38,6 +39,7 @@
 struct sldns_buffer;
 struct config_file;
 struct comm_reply;
+struct slabhash;
 
 typedef struct KeyPair_ {
     uint8_t crypt_publickey[crypto_box_PUBLICKEYBYTES];
@@ -52,7 +54,7 @@ typedef struct cert_ {
 
 struct dnsc_env {
 	struct SignedCert *signed_certs;
-    dnsccert *certs;
+	dnsccert *certs;
 	size_t signed_certs_count;
 	uint8_t provider_publickey[crypto_sign_ed25519_PUBLICKEYBYTES];
 	uint8_t provider_secretkey[crypto_sign_ed25519_SECRETKEYBYTES];
@@ -61,6 +63,11 @@ struct dnsc_env {
 	uint64_t nonce_ts_last;
 	unsigned char hash_key[crypto_shorthash_KEYBYTES];
 	char * provider_name;
+	struct slabhash *shared_secrets_cache;
+	/** lock on shared secret cache counters */
+	lock_basic_type shared_secrets_cache_lock;
+	/** number of misses from shared_secrets_cache */
+	size_t num_query_dnscrypt_secret_missed_cache;
 };
 
 struct dnscrypt_query_header {
@@ -71,7 +78,7 @@ struct dnscrypt_query_header {
 };
 
 /**
- * Initialize DNSCrypt enviroment.
+ * Initialize DNSCrypt environment.
  * Initialize sodium library and allocate the dnsc_env structure.
  * \return an uninitialized struct dnsc_env.
  */
@@ -89,6 +96,12 @@ struct dnsc_env * dnsc_create(void);
 int dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg);
 
 /**
+ * Delete DNSCrypt environment
+ *
+ */
+void dnsc_delete(struct dnsc_env *env);
+
+/**
  * handle a crypted dnscrypt request.
  * Determine wether or not a query is coming over the dnscrypt listener and
  * attempt to uncurve it or detect if it is a certificate query.
@@ -105,5 +118,26 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
  */
 
 int dnsc_handle_uncurved_request(struct comm_reply *repinfo);
+
+/**
+ * Computes the size of the shared secret cache entry.
+ */
+size_t dnsc_shared_secrets_sizefunc(void *k, void *d);
+
+/**
+ * Compares two shared secret cache keys.
+ */
+int dnsc_shared_secrets_compfunc(void *m1, void *m2);
+
+/**
+ * Function to delete a shared secret cache key.
+ */
+void dnsc_shared_secrets_delkeyfunc(void *k, void* arg);
+
+/**
+ * Function to delete a share secret cache value.
+ */
+void dnsc_shared_secrets_deldatafunc(void* d, void* arg);
+
 #endif /* USE_DNSCRYPT */
 #endif
diff --git a/dnscrypt/testdata/gencert.sh b/dnscrypt/testdata/gencert.sh
new file mode 100755
index 000000000000..ae0b2311e428
--- /dev/null
+++ b/dnscrypt/testdata/gencert.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+CERT_EXPIRE_DAYS="$(( 365 * 15 ))"
+DIR="$(dirname "$0")"
+
+
+if [[ "$PWD" != *tdir ]]
+then
+    echo "You should run this script with a .tdir directory"
+    exit 1
+fi
+
+for i in 1 2
+do
+    # Ephemeral key
+    rm -f "${i}.key"
+    dnscrypt-wrapper --gen-crypt-keypair \
+        --crypt-secretkey-file="${i}.key"  \
+        --provider-publickey-file="${DIR}/keys${i}/public.key" \
+        --provider-secretkey-file="${DIR}/keys${i}/secret.key"
+    # Cert file
+    for cipher in salsa chacha
+    do
+        rm -f "${i}_${cipher}.cert"
+        extraarg=""
+        if [ "${cipher}" == "chacha" ]
+        then
+             extraarg="-x"
+        fi
+
+        dnscrypt-wrapper ${extraarg} --gen-cert-file \
+            --provider-cert-file="${i}_${cipher}.cert" \
+            --crypt-secretkey-file="${i}.key" \
+            --provider-publickey-file="${DIR}/keys${i}/public.key" \
+            --provider-secretkey-file="${DIR}/keys${i}/secret.key" \
+            --cert-file-expire-days="${CERT_EXPIRE_DAYS}"
+    done
+done
diff --git a/dnscrypt/testdata/keys1/public.key b/dnscrypt/testdata/keys1/public.key
new file mode 100644
index 000000000000..45e6aadc3076
--- /dev/null
+++ b/dnscrypt/testdata/keys1/public.key
@@ -0,0 +1 @@
+¸_A¡O#÷ÛÈfó—ÌoD¶_�eŶ)|'T¦éÜòO�
\ No newline at end of file
diff --git a/dnscrypt/testdata/keys1/secret.key b/dnscrypt/testdata/keys1/secret.key
new file mode 100644
index 000000000000..7672c979bbe1
--- /dev/null
+++ b/dnscrypt/testdata/keys1/secret.key
@@ -0,0 +1 @@
+-&ç6\Uùõñh`^"…ºz/C9‚
óˆ¸_A¡O#÷ÛÈfó—ÌoD¶_�eŶ)|'T¦éÜòO�
\ No newline at end of file
diff --git a/dnscrypt/testdata/keys2/public.key b/dnscrypt/testdata/keys2/public.key
new file mode 100644
index 000000000000..036b04aab23b
--- /dev/null
+++ b/dnscrypt/testdata/keys2/public.key
@@ -0,0 +1 @@
+ÃR òÒýeµô{ölˆÁKË€Î:5r\±}KÓçƒ
\ No newline at end of file
diff --git a/dnscrypt/testdata/keys2/secret.key b/dnscrypt/testdata/keys2/secret.key
new file mode 100644
index 000000000000..687302956fca
--- /dev/null
+++ b/dnscrypt/testdata/keys2/secret.key
@@ -0,0 +1 @@
+
çi
%‚ 5fÍ™–íÉûŒíBnêͯ.º“ÃR òÒýeµô{ölˆÁKË€Î:5r\±}KÓçƒ
\ No newline at end of file
diff --git a/doc/Changelog b/doc/Changelog
index a72f99606e13..39a3a2b7f4aa 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,8 +1,150 @@
-21 Aug 2017: Wouter
+13 September 2017: Wouter
+	- tag 1.6.6rc2
+
+12 September 2017: Wouter
+	- Add dns64 for client-subnet in unbound-checkconf.
+
+4 September 2017: Ralph
+	- Fix #1412: QNAME minimisation strict mode not honored
+	- Fix #1434: Fix windows openssl 1.1.0 linking.
+
+4 September 2017: Wouter
+	- tag 1.6.6rc1
+	- makedist fix for windows binaries, with openssl 1.1.0 windres fix,
+	  and expat 2.2.4 install target fix.
+
+1 September 2017: Wouter
+	- Recommend 1472 buffer size in unbound.conf
+
+31 August 2017: Wouter
+	- Fix #1424: cachedb:testframe is not thread safe.
+	- For #1417: escape ; in dnscrypt tests.
+	- but reverted that, tests fails with that escape.
+	- Fix #1417: [dnscrypt] shared secret cache counters, and works when
+	  dnscrypt is not enabled.  And cache size configuration option.
+	- make depend
+	- Fix #1418: [ip ratelimit] initialize slabhash using
+	  ip-ratelimit-slabs.
+
+30 August 2017: Wouter
+	- updated contrib/fastrpz.patch to apply with configparser changes.
+	- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
+
+29 August 2017: Wouter
+	- Fix #1414: fix segfault on parse failure and log_replies.
+	- zero qinfo in handle_request, this zeroes local_alias and also the
+	  qname member.
+	- new keys and certs for dnscrypt tests.
+	- fixup WKS test on buildhost without servicebyname.
+
+28 August 2017: Wouter
+	- Fix #1415: patch to free dnscrypt environment on reload.
+	- iana portlist update
+	- Fix #1415: [dnscrypt] shared secret cache, patch from
+	  Manu Bretelle.
+	- Small fixes for the shared secret cache patch.
+	- Fix WKS records on kvm autobuild host, with default protobyname
+	  entries for udp and tcp.
+
+23 August 2017: Wouter
+	- Fix #1407: Add ECS options check to unbound-checkconf.
+	- make depend
+	- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
+	  allocation failure.
+
+22 August 2017: Wouter
 	- Fix install of trust anchor when two anchors are present, makes both
-	  valid.  Checks hash of DS but not signature of new key.  This fixes
-	  installs between sep11 and oct11 2017.
-	- Tag 1.6.5
+	  valid. Checks hash of DS but not signature of new key. This fixes
+	  the root.key file if created when unbound is installed between
+	  sep11 and oct11 2017.
+	- tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
+	- trunk version 1.6.6 in development.
+	- Fix issue on macOX 10.10 where TCP fast open is detected but not
+	  implemented causing TCP to fail. The fix allows fallback to regular
+	  TCP in this case and is also more robust for cases where connectx()
+	  fails for some reason.
+	- Fix #1402: squelch invalid argument error for fd_set_block on windows.
+
+10 August 2017: Wouter
+	- Patch to show DNSCrypt status in help output, from Carsten
+	  Strotmann.
+
+8 August 2017: Wouter
+	- Fix #1398: make cachedb secret configurable.
+	- Remove spaces from Makefile.
+
+7 August 2017: Wouter
+	- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
+
+3 August 2017: Ralph
+	- Remove unused iter_env member (ip6arpa_dname)
+	- Do not reset rrset.bogus stats when called using stats_noreset.
+	- Added stats for queries that have been ratelimited by domain
+	  recursion.
+	- Do not add rrset_bogus and query ratelimiting stats per thread, these
+	  module stats are global.
+
+3 August 2017: Wouter
+	- Fix #1394: mix of serve-expired and response-ip could cause a crash.
+
+24 July 2017: Wouter
+	- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
+	  config.sub(2016-09-05).
+	- annotate case statement fallthrough for gcc 7.1.1.
+	- flex output from flex 2.6.1.
+	- snprintf of thread number does not warn about truncated string.
+	- squelch TCP fast open error on FreeBSD when kernel has it disabled,
+	  unless verbosity is high.
+	- remove warning from windows compile.
+	- Fix compile with libnettle
+	- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
+	- Fix #1365: Add Ed25519 support using libnettle.
+	- iana portlist update
+
+17 July 2017: Wouter
+	- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
+	- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
+	  With the -p option unbound does not create a pidfile.
+
+11 July 2017: Wouter
+	- Fix #1344: RFC6761-reserved domains: test. and invalid.
+	- Redirect all localhost names to localhost address for RFC6761.
+
+6 July 2017: Wouter
+	- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
+	- Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..
+
+4 July 2017: Wouter
+	- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
+
+3 July 2017: Wouter
+	- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
+	  on.
+	- Fix #1331: libunbound segfault in threaded mode when context is
+	  deleted.
+	- Fix pythonmod link line option flag.
+	- Fix openssl 1.1.0 load of ssl error strings from ssl init.
+
+29 June 2017: Wouter
+	- Fix python example0 return module wait instead of error for pass.
+	- iana portlist update
+	- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
+	  security settings.
+
+27 June 2017: Wouter
+	- Tag 1.6.4 is created with the 1.6.4rc2 contents.
+	- Trunk contains 1.6.5, with changes from 26, 27 june.
+	- Remove signed unsigned warning from authzone.
+	- Fix that infra cache host hash does not change after reconfig.
+
+26 June 2017: Wouter
+	- (for 1.6.5)
+	  Better fixup of dnscrypt_cert_chacha test for different escapes.
+	- First fix for zero b64 and hex text zone format in sldns.
+	- unbound-control dump_infra prints port number for address if not 53.
+
+23 June 2017: Wouter
+	- (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
 
 22 June 2017: Wouter
 	- Tag 1.6.4rc2
diff --git a/doc/README b/doc/README
index 6c4b28537703..d0c0bf34f3fb 100644
--- a/doc/README
+++ b/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.6.5
+README for Unbound 1.6.6
 Copyright 2007 NLnet Labs
 http://unbound.net
 
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 481f2e0c214b..e7978b79c898 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.6.5.
+# See unbound.conf(5) man page, version 1.6.6.
 #
 # this is a comment.
 
@@ -116,7 +116,7 @@ server:
 	# ip-freebind: no
 
 	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
-	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
+	# is set with msg-buffer-size). 1472 can solve fragmentation (timeouts)
 	# edns-buffer-size: 4096
 
 	# Maximum UDP response size (not applied to TCP response).
@@ -563,6 +563,8 @@ server:
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
 	# local-zone: "onion." nodefault
+	# local-zone: "test." nodefault
+	# local-zone: "invalid." nodefault
 	# local-zone: "10.in-addr.arpa." nodefault
 	# local-zone: "16.172.in-addr.arpa." nodefault
 	# local-zone: "17.172.in-addr.arpa." nodefault
@@ -838,3 +840,13 @@ remote-control:
 #     dnscrypt-secret-key: /path/unbound-conf/keys2/1.key
 #     dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert
 #     dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert
+
+# CacheDB
+# Enable external backend DB as auxiliary cache.  Specify the backend name
+# (default is "testframe", which has no use other than for debugging and
+# testing) and backend-specific options.  The 'cachedb' module must be
+# included in module-config.
+# cachedb:
+#     backend: "testframe"
+#     # secret seed string to calculate hashed keys
+#     secret-seed: "default"
diff --git a/doc/libunbound.3.in b/doc/libunbound.3.in
index 40f3ba20def5..fbf3cd832af6 100644
--- a/doc/libunbound.3.in
+++ b/doc/libunbound.3.in
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "libunbound" "3" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -43,7 +43,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.6.5 functions.
+\- Unbound DNS validating resolver 1.6.6 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in
index 8436c3cd5f5e..a008e0c0e262 100644
--- a/doc/unbound-anchor.8.in
+++ b/doc/unbound-anchor.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound-anchor" "8" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
diff --git a/doc/unbound-checkconf.8.in b/doc/unbound-checkconf.8.in
index 9778ebddee16..2e38e76b9979 100644
--- a/doc/unbound-checkconf.8.in
+++ b/doc/unbound-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound-checkconf" "8" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 5b220d664dd0..66ea690390a0 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound-control" "8" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
@@ -493,6 +493,10 @@ number of queries that had an EDNS OPT record present.
 number of queries that had an EDNS OPT record with the DO (DNSSEC OK) bit set.
 These queries are also included in the num.query.edns.present number.
 .TP
+.I num.query.ratelimited
+The number of queries that are turned away from being send to nameserver due to
+ratelimiting.
+.TP
 .I num.answer.rcode.NXDOMAIN
 The number of answers to queries, from cache or from recursion, that had the
 return code NXDOMAIN. Also printed for the other return codes.
diff --git a/doc/unbound-host.1.in b/doc/unbound-host.1.in
index 5a088b606f78..de8f0bdd052c 100644
--- a/doc/unbound-host.1.in
+++ b/doc/unbound-host.1.in
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound\-host" "1" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
diff --git a/doc/unbound.8.in b/doc/unbound.8.in
index 87f1b6ef0123..24959ba26cec 100644
--- a/doc/unbound.8.in
+++ b/doc/unbound.8.in
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound" "8" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,11 +9,12 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.6.5.
+\- Unbound DNS validating resolver 1.6.6.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
 .RB [ \-d ]
+.RB [ \-p ]
 .RB [ \-v ]
 .RB [ \-c
 .IR cfgfile ]
@@ -67,6 +68,11 @@ the thread\-spawn time, so that most config and setup errors appear on
 stderr. If given twice or more, logging does not switch to the log file
 or to syslog, but the log messages are printed to stderr all the time.
 .TP
+.B \-p
+Don't use a pidfile.  This argument should only be used by supervision
+systems which can ensure that only one instance of unbound will run
+concurrently.
+.TP
 .B \-v
 Increase verbosity. If given multiple times, more information is logged.
 This is in addition to the verbosity (if any) from the config file.
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 2acf2622c5da..f48ef9214afa 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Aug 21, 2017" "NLnet Labs" "unbound 1.6.5"
+.TH "unbound.conf" "5" "Sep 18, 2017" "NLnet Labs" "unbound 1.6.6"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -197,7 +197,7 @@ This is the value put into datagrams over UDP towards peers.  The actual
 buffer size is determined by msg\-buffer\-size (both for TCP and UDP).  Do
 not set higher than that value.  Default is 4096 which is RFC recommended.
 If you have fragmentation reassembly problems, usually seen as timeouts,
-then a value of 1480 can fix it.  Setting to 512 bypasses even the most
+then a value of 1472 can fix it.  Setting to 512 bypasses even the most
 stringent path MTU problems, but is seen as extreme, since the amount
 of TCP fallback generated is excessive (probably also for this resolver,
 consider tuning the outgoing tcp number).
@@ -1048,19 +1048,19 @@ has no other effect than turning off default contents for the
 given zone.  Use \fInodefault\fR if you use exactly that zone, if you want to
 use a subzone, use \fItransparent\fR.
 .P
-The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and
-the AS112 zones. The AS112 zones are reverse DNS zones for private use and
-reserved IP addresses for which the servers on the internet cannot provide
-correct answers. They are configured by default to give nxdomain (no reverse
-information) answers. The defaults can be turned off by specifying your
-own local\-zone of that name, or using the 'nodefault' type. Below is a
-list of the default zone contents.
+The default zones are localhost, reverse 127.0.0.1 and ::1, the onion, test,
+invalid and the AS112 zones. The AS112 zones are reverse DNS zones for
+private use and reserved IP addresses for which the servers on the internet
+cannot provide correct answers. They are configured by default to give
+nxdomain (no reverse information) answers. The defaults can be turned off
+by specifying your own local\-zone of that name, or using the 'nodefault'
+type. Below is a list of the default zone contents.
 .TP 10
 \h'5'\fIlocalhost\fR
 The IP4 and IP6 localhost information is given. NS and SOA records are provided
 for completeness and to satisfy some DNS update tools. Default content:
 .nf
-local\-zone: "localhost." static
+local\-zone: "localhost." redirect
 local\-data: "localhost. 10800 IN NS localhost."
 local\-data: "localhost. 10800 IN
     SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
@@ -1104,6 +1104,24 @@ local\-data: "onion. 10800 IN
     SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
 .fi
 .TP 10
+\h'5'\fItest (RFC 7686)\fR
+Default content:
+.nf
+local\-zone: "test." static
+local\-data: "test. 10800 IN NS localhost."
+local\-data: "test. 10800 IN
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+.fi
+.TP 10
+\h'5'\fIinvalid (RFC 7686)\fR
+Default content:
+.nf
+local\-zone: "invalid." static
+local\-data: "invalid. 10800 IN NS localhost."
+local\-data: "invalid. 10800 IN
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+.fi
+.TP 10
 \h'5'\fIreverse RFC1918 local use zones\fR
 Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to
 31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
@@ -1461,7 +1479,7 @@ despite the presence of actual AAAA records.
 .LP
 The
 .B dnscrypt:
-clause give the settings of the dnscrypt channel. While those options are
+clause gives the settings of the dnscrypt channel. While those options are
 available, they are only meaningful if unbound was compiled with
 \fB\-\-enable\-dnscrypt\fR.
 Currently certificate and secret/public keys cannot be generated by unbound.
@@ -1489,6 +1507,17 @@ times.
 .B dnscrypt\-provider\-cert: \fI<path to cert file>\fR
 Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs.
 This option may be specified multiple times.
+.TP
+.B dnscrypt\-shared\-secret\-cache\-size: \fI<memory size>
+Give the size of the data structure in which the shared secret keys are kept
+in.  Default 4m.  In bytes or use m(mega), k(kilo), g(giga).
+The shared secret cache is used when a same client is making multiple queries
+using the same public key. It saves a substantial amount of CPU.
+.TP
+.B dnscrypt\-shared\-secret\-cache\-slabs: \fI<number>
+Give power of 2 number of slabs, this is used to reduce lock contention
+in the dnscrypt shared secrets cache.  Close to the number of cpus is
+a fairly good setting.
 .SS "EDNS Client Subnet Module Options"
 .LP
 The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
@@ -1603,6 +1632,37 @@ A/AAAA query will be SERVFAIL.  Mainly used for testing.  Defaults to no.
 Whitelist the domain so that the module logic will be executed.  Can
 be given multiple times, for different domains.  If the option is not
 specified, all domains are treated as being whitelisted (default).
+.SS "Cache DB Module Options"
+.LP
+The Cache DB module must be configured in the \fBmodule\-config:\fR
+"validator cachedb iterator" directive and be compiled into the daemon
+with \fB\-\-enable\-cachedb\fR.
+If this module is enabled and configured, the specified backend database
+works as a second level cache:
+When Unbound cannot find an answer to a query in its built-in in-memory
+cache, it consults the specified backend.
+If it finds a valid answer in the backend, Unbound uses it to respond
+to the query without performing iterative DNS resolution.
+If Unbound cannot even find an answer in the backend, it resolves the
+query as usual, and stores the answer in the backend.
+The
+.B cachedb:
+clause gives custom settings of the cache DB module.
+.TP
+.B backend: \fI<backend name>\fR
+Specify the backend database name.
+Currently, only the in-memory "testframe" backend is supported.
+As the name suggests this backend is not of any practical use.
+This option defaults to "testframe".
+.TP
+.B secret-seed: \fI<"secret string">\fR
+Specify a seed to calculate a hash value from query information.
+This value will be used as the key of the corresponding answer for the
+backend database and can be customized if the hash should not be predictable
+operationally.
+If the backend database is shared by multiple Unbound instances,
+all instances must use the same secret seed.
+This option defaults to "default".
 .SH "MEMORY CONTROL EXAMPLE"
 In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 205ab0d15407..01ac883e81e8 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -78,6 +78,12 @@ iter_init(struct module_env* env, int id)
 		return 0;
 	}
 	env->modinfo[id] = (void*)iter_env;
+
+	lock_basic_init(&iter_env->queries_ratelimit_lock);
+	lock_protect(&iter_env->queries_ratelimit_lock,
+			&iter_env->num_queries_ratelimited,
+		sizeof(iter_env->num_queries_ratelimited));
+
 	if(!iter_apply_cfg(iter_env, env->cfg)) {
 		log_err("iterator: could not apply configuration settings.");
 		return 0;
@@ -103,6 +109,7 @@ iter_deinit(struct module_env* env, int id)
 	if(!env || !env->modinfo[id])
 		return;
 	iter_env = (struct iter_env*)env->modinfo[id];
+	lock_basic_destroy(&iter_env->queries_ratelimit_lock);
 	free(iter_env->target_fetch_policy);
 	priv_delete(iter_env->priv);
 	donotq_delete(iter_env->donotq);
@@ -1276,6 +1283,9 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 					"delegation point", iq->dp->name,
 					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
 			} else {
+				lock_basic_lock(&ie->queries_ratelimit_lock);
+				ie->num_queries_ratelimited++;
+				lock_basic_unlock(&ie->queries_ratelimit_lock);
 				log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
 					"delegation point", iq->dp->name,
 					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
@@ -2064,6 +2074,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
 		if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
 			iq->dp->namelen, *qstate->env->now)) {
+			lock_basic_lock(&ie->queries_ratelimit_lock);
+			ie->num_queries_ratelimited++;
+			lock_basic_unlock(&ie->queries_ratelimit_lock);
 			verbose(VERB_ALGO, "query exceeded ratelimits");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
@@ -2156,7 +2169,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}
 	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
-		iq->minimise_timeout_count++;
 		if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
 			/* Do not increment qname, continue incrementing next 
 			 * iteration */
@@ -2197,6 +2209,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
 		    infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
 			iq->dp->namelen, *qstate->env->now);
+		if(qstate->env->cfg->qname_minimisation)
+			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
 	outbound_list_insert(&iq->outlist, outq);
@@ -2246,8 +2260,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(iq->response == NULL) {
 		/* Don't increment qname when QNAME minimisation is enabled */
-		if(qstate->env->cfg->qname_minimisation)
+		if(qstate->env->cfg->qname_minimisation) {
+			iq->minimise_timeout_count++;
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
+		}
 		iq->chase_to_rd = 0;
 		iq->dnssec_lame_query = 0;
 		verbose(VERB_ALGO, "query response was timeout");
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 37b0ab0dc24a..75aafee475e2 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -130,8 +130,10 @@ struct iter_env {
 	 */
 	int* target_fetch_policy;
 
-	/** ip6.arpa dname in wireformat, used for qname-minimisation */
-	uint8_t* ip6arpa_dname;
+	/** lock on ratelimit counter */
+	lock_basic_type queries_ratelimit_lock;
+	/** number of queries that have been ratelimited */
+	size_t num_queries_ratelimited;
 };
 
 /**
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index b42ba0bd8e78..f6a1d1d1c47b 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -294,6 +294,7 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 			log_err("unknown command for bg worker %d", 
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
+			/* fallthrough */
 		case UB_LIBCMD_QUIT:
 			free(msg);
 			comm_base_exit(w->base);
@@ -749,7 +750,7 @@ libworker_bg_done_cb(void* arg, int rcode, sldns_buffer* buf, enum sec_status s,
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
 
-	if(q->cancelled) {
+	if(q->cancelled || q->w->back->want_to_quit) {
 		if(q->w->is_bg_thread) {
 			/* delete it now */
 			struct ub_ctx* ctx = q->w->ctx;
diff --git a/libunbound/unbound.h b/libunbound/unbound.h
index d7667d104a0e..ac747a7cc6cc 100644
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@@ -622,6 +622,7 @@ struct ub_shm_stat_info {
 		long long subnet;
 		long long ipsecmod;
 		long long respip;
+		long long dnscrypt_shared_secret;
 	} mem;
 };
 
@@ -704,6 +705,8 @@ struct ub_server_stats {
 	long long ans_bogus;
 	/** rrsets marked bogus by validator */
 	long long rrset_bogus;
+	/** number of queries that have been ratelimited by domain recursion. */
+	long long queries_ratelimited;
 	/** unwanted traffic received on server-facing ports */
 	long long unwanted_replies;
 	/** unwanted traffic received on client-facing ports */
@@ -735,6 +738,10 @@ struct ub_server_stats {
 	long long num_query_dnscrypt_cleartext;
 	/** number of malformed encrypted queries */
 	long long num_query_dnscrypt_crypted_malformed;
+	/** number of queries which did not have a shared secret in cache */
+	long long num_query_dnscrypt_secret_missed_cache;
+	/** number of dnscrypt shared secret cache entries */
+	long long shared_secret_cache_count;
 };
 
 /** 
diff --git a/pythonmod/doc/examples/example0-1.py b/pythonmod/doc/examples/example0-1.py
index 3b234f1e099c..5ae48d16674a 100644
--- a/pythonmod/doc/examples/example0-1.py
+++ b/pythonmod/doc/examples/example0-1.py
@@ -24,7 +24,7 @@ def operate(id, event, qstate, qdata):
 
    if event == MODULE_EVENT_PASS:
       log_info("pythonmod: event_pass")
-      qstate.ext_state[id] = MODULE_ERROR 
+      qstate.ext_state[id] = MODULE_WAIT_MODULE 
       return True
 
    log_err("pythonmod: BAD event")
diff --git a/pythonmod/doc/examples/example0.rst b/pythonmod/doc/examples/example0.rst
index 80eca5ea6ebb..8fff41f33c72 100644
--- a/pythonmod/doc/examples/example0.rst
+++ b/pythonmod/doc/examples/example0.rst
@@ -109,7 +109,7 @@ Script file must contain four compulsory functions:
          return True
 
       if event == MODULE_EVENT_PASS:
-         qstate.ext_state[id] = MODULE_ERROR 
+         qstate.ext_state[id] = MODULE_WAIT_MODULE 
          return True
 
       log_err("pythonmod: BAD event")
diff --git a/services/authzone.c b/services/authzone.c
index 75dd4fc60736..88beddbf9229 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -628,7 +628,7 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 		d->rr_len[d->count-1] = rdatalen;
 	else	d->rr_len[total-1] = rdatalen;
 	packed_rrset_ptr_fixup(d);
-	if(rr_ttl < d->ttl)
+	if((time_t)rr_ttl < d->ttl)
 		d->ttl = rr_ttl;
 
 	/* copy old values into new array */
diff --git a/services/cache/dns.c b/services/cache/dns.c
index 764205e53cbe..da43c504dfa3 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -99,6 +99,9 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 				}
 			}
 			/* no break: also copy key item */
+			/* the line below is matched by gcc regex and silences
+			 * the fallthrough warning */
+			/* fallthrough */
 		case 1: /* ref updated, item inserted */
                         rep->rrsets[i] = rep->ref[i].key;
 		}
diff --git a/services/cache/infra.c b/services/cache/infra.c
index ca1102ef5f7f..734b7969e7a2 100644
--- a/services/cache/infra.c
+++ b/services/cache/infra.c
@@ -249,7 +249,7 @@ infra_create(struct config_file* cfg)
 		name_tree_init_parents(&infra->domain_limits);
 	}
 	infra_ip_ratelimit = cfg->ip_ratelimit;
-	infra->client_ip_rates = slabhash_create(cfg->ratelimit_slabs,
+	infra->client_ip_rates = slabhash_create(cfg->ip_ratelimit_slabs,
 	    INFRA_HOST_STARTSIZE, cfg->ip_ratelimit_size, &ip_rate_sizefunc,
 	    &ip_rate_compfunc, &ip_rate_delkeyfunc, &ip_rate_deldatafunc, NULL);
 	if(!infra->client_ip_rates) {
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 0341f3067489..3b53676d0e06 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -792,7 +792,12 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #endif
 	if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, 
 		  sizeof(qlen))) == -1 ) {
-		log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
+#ifdef ENOPROTOOPT
+		/* squelch ENOPROTOOPT: freebsd server mode with kernel support
+		   disabled, except when verbosity enabled for debugging */
+		if(errno != ENOPROTOOPT || verbosity >= 3)
+#endif
+		  log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
 	}
 #endif
 	return s;
diff --git a/services/localzone.c b/services/localzone.c
index a19b5252643f..6bde432e8d09 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -260,7 +260,8 @@ rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
 
 /** return name and class of rr; parses string */
 static int
-get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass)
+get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass,
+	uint16_t* dtype)
 {
 	uint8_t rr[LDNS_RR_BUF_SIZE];
 	size_t len = sizeof(rr), dname_len = 0;
@@ -274,6 +275,7 @@ get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass)
 	}
 	*nm = memdup(rr, dname_len);
 	*dclass = sldns_wirerr_get_class(rr, len, dname_len);
+	*dtype = sldns_wirerr_get_type(rr, len, dname_len);
 	if(!*nm) {
 		log_err("out of memory");
 		return 0;
@@ -522,18 +524,18 @@ static int
 lz_enter_rr_str(struct local_zones* zones, const char* rr)
 {
 	uint8_t* rr_name;
-	uint16_t rr_class;
+	uint16_t rr_class, rr_type;
 	size_t len;
 	int labs;
 	struct local_zone* z;
 	int r;
-	if(!get_rr_nameclass(rr, &rr_name, &rr_class)) {
+	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
 		log_err("bad rr %s", rr);
 		return 0;
 	}
 	labs = dname_count_size_labels(rr_name, &len);
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		fatal_exit("internal error: no zone for rr %s", rr);
@@ -719,9 +721,9 @@ lz_nodefault(struct config_file* cfg, const char* name)
 	return 0;
 }
 
-/** enter AS112 default zone */
+/** enter (AS112) empty default zone */
 static int
-add_as112_default(struct local_zones* zones, struct config_file* cfg,
+add_empty_default(struct local_zones* zones, struct config_file* cfg,
         const char* name)
 {
 	struct local_zone* z;
@@ -762,7 +764,7 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
 		!lz_nodefault(cfg, "localhost.")) {
-		if(!(z=lz_enter_zone(zones, "localhost.", "static", 
+		if(!(z=lz_enter_zone(zones, "localhost.", "redirect", 
 			LDNS_RR_CLASS_IN)) ||
 		   !lz_enter_rr_into_zone(z,
 			"localhost. 10800 IN NS localhost.") ||
@@ -816,26 +818,24 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 		lock_rw_unlock(&z->lock);
 	}
 	/* onion. zone (RFC 7686) */
-	if(!lz_exists(zones, "onion.") &&
-		!lz_nodefault(cfg, "onion.")) {
-		if(!(z=lz_enter_zone(zones, "onion.", "static", 
-			LDNS_RR_CLASS_IN)) ||
-		   !lz_enter_rr_into_zone(z,
-			"onion. 10800 IN NS localhost.") ||
-		   !lz_enter_rr_into_zone(z,
-			"onion. 10800 IN SOA localhost. nobody.invalid. "
-			"1 3600 1200 604800 10800")) {
-			log_err("out of memory adding default zone");
-			if(z) { lock_rw_unlock(&z->lock); }
-			return 0;
-		}
-		lock_rw_unlock(&z->lock);
+	if(!add_empty_default(zones, cfg, "onion.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* test. zone (RFC 7686) */
+	if(!add_empty_default(zones, cfg, "test.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* invalid. zone (RFC 7686) */
+	if(!add_empty_default(zones, cfg, "invalid.")) {
+		log_err("out of memory adding default zone");
+		return 0;
 	}
-
 	/* block AS112 zones, unless asked not to */
 	if(!cfg->unblock_lan_zones) {
 		for(zstr = as112_zones; *zstr; zstr++) {
-			if(!add_as112_default(zones, cfg, *zstr)) {
+			if(!add_empty_default(zones, cfg, *zstr)) {
 				log_err("out of memory adding default zone");
 				return 0;
 			}
@@ -913,16 +913,17 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 	init_parents(zones); /* to enable local_zones_lookup() */
 	for(p = cfg->local_data; p; p = p->next) {
 		uint8_t* rr_name;
-		uint16_t rr_class;
+		uint16_t rr_class, rr_type;
 		size_t len;
 		int labs;
-		if(!get_rr_nameclass(p->str, &rr_name, &rr_class)) {
+		if(!get_rr_nameclass(p->str, &rr_name, &rr_class, &rr_type)) {
 			log_err("Bad local-data RR %s", p->str);
 			return 0;
 		}
 		labs = dname_count_size_labels(rr_name, &len);
 		lock_rw_rdlock(&zones->lock);
-		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class)) {
+		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
+			rr_type)) {
 			if(!have_name) {
 				dclass = rr_class;
 				nm = rr_name;
@@ -1053,21 +1054,26 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 
 struct local_zone* 
 local_zones_lookup(struct local_zones* zones,
-        uint8_t* name, size_t len, int labs, uint16_t dclass)
+        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
 {
 	return local_zones_tags_lookup(zones, name, len, labs,
-		dclass, NULL, 0, 1);
+		dclass, dtype, NULL, 0, 1);
 }
 
 struct local_zone* 
 local_zones_tags_lookup(struct local_zones* zones,
-        uint8_t* name, size_t len, int labs, uint16_t dclass,
+        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
 	uint8_t* taglist, size_t taglen, int ignoretags)
 {
 	rbnode_type* res = NULL;
 	struct local_zone *result;
 	struct local_zone key;
 	int m;
+	/* for type DS use a zone higher when on a zonecut */
+	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
+		dname_remove_label(&name, &len);
+		labs--;
+	}
 	key.node.key = &key;
 	key.dclass = dclass;
 	key.name = name;
@@ -1583,7 +1589,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		if(view->local_zones &&
 			(z = local_zones_lookup(view->local_zones,
 			qinfo->qname, qinfo->qname_len, labs,
-			qinfo->qclass))) {
+			qinfo->qclass, qinfo->qtype))) {
 			verbose(VERB_ALGO, 
 				"using localzone from view: %s", 
 				view->name);
@@ -1600,8 +1606,8 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		/* try global local_zones tree */
 		lock_rw_rdlock(&zones->lock);
 		if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
-			qinfo->qname_len, labs, qinfo->qclass, taglist,
-			taglen, 0))) {
+			qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
+			taglist, taglen, 0))) {
 			lock_rw_unlock(&zones->lock);
 			return 0;
 		}
@@ -1756,19 +1762,19 @@ int
 local_zones_add_RR(struct local_zones* zones, const char* rr)
 {
 	uint8_t* rr_name;
-	uint16_t rr_class;
+	uint16_t rr_class, rr_type;
 	size_t len;
 	int labs;
 	struct local_zone* z;
 	int r;
-	if(!get_rr_nameclass(rr, &rr_name, &rr_class)) {
+	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
 		return 0;
 	}
 	labs = dname_count_size_labels(rr_name, &len);
 	/* could first try readlock then get writelock if zone does not exist,
 	 * but we do not add enough RRs (from multiple threads) to optimize */
 	lock_rw_wrlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
 			local_zone_transparent);
@@ -1820,14 +1826,47 @@ del_empty_term(struct local_zone* z, struct local_data* d,
 	}
 }
 
+/** find and remove type from list in domain struct */
+static void
+del_local_rrset(struct local_data* d, uint16_t dtype)
+{
+	struct local_rrset* prev=NULL, *p=d->rrsets;
+	while(p && ntohs(p->rrset->rk.type) != dtype) {
+		prev = p;
+		p = p->next;
+	}
+	if(!p) 
+		return; /* rrset type not found */
+	/* unlink it */
+	if(prev) prev->next = p->next;
+	else d->rrsets = p->next;
+	/* no memory recycling for zone deletions ... */
+}
+
 void local_zones_del_data(struct local_zones* zones, 
 	uint8_t* name, size_t len, int labs, uint16_t dclass)
 {
 	/* find zone */
 	struct local_zone* z;
 	struct local_data* d;
+
+	/* remove DS */
+	lock_rw_rdlock(&zones->lock);
+	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
+	if(z) {
+		lock_rw_wrlock(&z->lock);
+		d = lz_find_node(z, name, len, labs);
+		if(d) {
+			del_local_rrset(d, LDNS_RR_TYPE_DS);
+			del_empty_term(z, d, name, len, labs);
+		}
+		lock_rw_unlock(&z->lock);
+	}
+	lock_rw_unlock(&zones->lock);
+
+	/* remove other types */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass);
+	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
 	if(!z) {
 		/* no such zone, we're done */
 		lock_rw_unlock(&zones->lock);
diff --git a/services/localzone.h b/services/localzone.h
index fcdad41666d2..0a8759268bb2 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -235,6 +235,7 @@ void local_zone_delete(struct local_zone* z);
  * @param len: length of name.
  * @param labs: labelcount of name.
  * @param dclass: class to lookup.
+ * @param dtype: type to lookup, if type DS a zone higher is used for zonecuts.
  * @param taglist: taglist to lookup.
  * @param taglen: lenth of taglist.
  * @param ignoretags: lookup zone by name and class, regardless the
@@ -242,7 +243,7 @@ void local_zone_delete(struct local_zone* z);
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass, 
+	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
 	uint8_t* taglist, size_t taglen, int ignoretags);
 
 /**
@@ -253,10 +254,12 @@ struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
  * @param len: length of name.
  * @param labs: labelcount of name.
  * @param dclass: class to lookup.
+ * @param dtype: type of the record, if type DS then a zone higher up is found
+ *   pass 0 to just plain find a zone for a name.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_lookup(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass);
+	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);
 
 /**
  * Debug helper. Print all zones 
diff --git a/services/outside_network.c b/services/outside_network.c
index 9b1490e643f8..fe2b55b1ac17 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -268,6 +268,13 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,  
 	             CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
 	             NULL, 0, NULL, NULL) == -1) {
+		/* if fails, failover to connect for OSX 10.10 */
+#ifdef EINPROGRESS
+		if(errno != EINPROGRESS) {
+#else
+		if(1) {
+#endif
+			if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
 #else /* USE_OSX_MSG_FASTOPEN*/
 #ifdef USE_MSG_FASTOPEN
 	pend->c->tcp_do_fastopen = 1;
@@ -302,6 +309,10 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
 #ifdef USE_MSG_FASTOPEN
 	}
 #endif /* USE_MSG_FASTOPEN */
+#ifdef USE_OSX_MSG_FASTOPEN
+		}
+	}
+#endif /* USE_OSX_MSG_FASTOPEN */
 	if(w->outnet->sslctx && w->ssl_upstream) {
 		pend->c->ssl = outgoing_ssl_fd(w->outnet->sslctx, s);
 		if(!pend->c->ssl) {
diff --git a/sldns/parseutil.c b/sldns/parseutil.c
index 32717616aa4a..769987c64777 100644
--- a/sldns/parseutil.c
+++ b/sldns/parseutil.c
@@ -402,10 +402,12 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 
 		/* ........ ........ ....4444 4....... ........ */
 			 c =  src[3]         >> 7 ;
+		/* fallthrough */
 	case 3: dst[4] = b32[(src[2] & 0x0f) << 1 | c];
 
 		/* ........ .......3 3333.... ........ ........ */
 			 c =  src[2]         >> 4 ;
+		/* fallthrough */
 	case 2:	dst[3] = b32[(src[1] & 0x01) << 4 | c];
 
 		/* ........ ..22222. ........ ........ ........ */
@@ -413,6 +415,7 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 
 		/* .....111 11...... ........ ........ ........ */
 			 c =  src[1]         >> 6 ;
+		/* fallthrough */
 	case 1:	dst[1] = b32[(src[0] & 0x07) << 2 | c];
 
 		/* 00000... ........ ........ ........ ........ */
@@ -423,9 +426,12 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 		switch (src_sz) {
 			case 1: dst[2] = '=';
 				dst[3] = '=';
+				/* fallthrough */
 			case 2: dst[4] = '=';
+				/* fallthrough */
 			case 3: dst[5] = '=';
 				dst[6] = '=';
+				/* fallthrough */
 			case 4: dst[7] = '=';
 		}
 	}
@@ -537,15 +543,18 @@ sldns_b32_pton_base(const char* src, size_t src_sz, uint8_t* dst, size_t dst_sz,
 			/* ........ ........ ........ .55555.. ........ */
 			/* ........ ........ ....4444 4....... ........ */
 			dst[3] = buf[4] << 7 | buf[5] << 2 | buf[6] >> 3;
+			/* fallthrough */
 
 		case 5: /* ........ ........ ....4444 4....... ........ */
 			/* ........ .......3 3333.... ........ ........ */
 			dst[2] = buf[3] << 4 | buf[4] >> 1;
+			/* fallthrough */
 
 		case 4: /* ........ .......3 3333.... ........ ........ */
 			/* ........ ..22222. ........ ........ ........ */
 			/* .....111 11...... ........ ........ ........ */
 			dst[1] = buf[1] << 6 | buf[2] << 1 | buf[3] >> 4;
+			/* fallthrough */
 
 		case 2: /* .....111 11...... ........ ........ ........ */
 			/* 00000... ........ ........ ........ ........ */
diff --git a/sldns/str2wire.c b/sldns/str2wire.c
index b4f84faf9b3b..f84d7d6b823b 100644
--- a/sldns/str2wire.c
+++ b/sldns/str2wire.c
@@ -1190,6 +1190,10 @@ int sldns_str2wire_b64_buf(const char* str, uint8_t* rd, size_t* len)
 {
 	size_t sz = sldns_b64_pton_calculate_size(strlen(str));
 	int n;
+	if(strcmp(str, "0") == 0) {
+		*len = 0;
+		return LDNS_WIREPARSE_ERR_OK;
+	}
 	if(*len < sz)
 		return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL;
 	n = sldns_b64_pton(str, rd, *len);
@@ -1223,6 +1227,10 @@ int sldns_str2wire_hex_buf(const char* str, uint8_t* rd, size_t* len)
 			s++;
 			continue;
 		}
+		if(dlen == 0 && *s == '0' && *(s+1) == 0) {
+			*len = 0;
+			return LDNS_WIREPARSE_ERR_OK;
+		}
 		if(!isxdigit((unsigned char)*s))
 			return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_HEX, s-str);
 		if(*len < dlen/2 + 1)
@@ -1685,12 +1693,15 @@ int sldns_str2wire_wks_buf(const char* str, uint8_t* rd, size_t* len)
 			struct protoent *p = getprotobyname(token);
 			have_proto = 1;
 			if(p) rd[0] = (uint8_t)p->p_proto;
+			else if(strcasecmp(token, "tcp")==0) rd[0]=6;
+			else if(strcasecmp(token, "udp")==0) rd[0]=17;
 			else rd[0] = (uint8_t)atoi(token);
 			(void)strlcpy(proto_str, token, sizeof(proto_str));
 		} else {
 			int serv_port;
 			struct servent *serv = getservbyname(token, proto_str);
 			if(serv) serv_port=(int)ntohs((uint16_t)serv->s_port);
+			else if(strcasecmp(token, "domain")==0) serv_port=53;
 			else {
 				serv_port = atoi(token);
 				if(serv_port == 0 && strcmp(token, "0") != 0) {
diff --git a/sldns/wire2str.c b/sldns/wire2str.c
index ef505780f454..52b1ed0c2aa9 100644
--- a/sldns/wire2str.c
+++ b/sldns/wire2str.c
@@ -1220,11 +1220,17 @@ static int sldns_wire2str_b64_scan_num(uint8_t** d, size_t* dl, char** s,
 
 int sldns_wire2str_b64_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
 {
+	if(*dl == 0) {
+		return sldns_str_print(s, sl, "0");
+	}
 	return sldns_wire2str_b64_scan_num(d, dl, s, sl, *dl);
 }
 
 int sldns_wire2str_hex_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
 {
+	if(*dl == 0) {
+		return sldns_str_print(s, sl, "0");
+	}
 	return print_remainder_hex("", d, dl, s, sl);
 }
 
@@ -1465,6 +1471,10 @@ int sldns_wire2str_wks_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
 	if(protocol && (protocol->p_name != NULL)) {
 		w += sldns_str_print(s, sl, "%s", protocol->p_name);
 		proto_name = protocol->p_name;
+	} else if(protocol_nr == 6) {
+		w += sldns_str_print(s, sl, "tcp");
+	} else if(protocol_nr == 17) {
+		w += sldns_str_print(s, sl, "udp");
 	} else	{
 		w += sldns_str_print(s, sl, "%u", (unsigned)protocol_nr);
 	}
diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
index 19ee85b1aaaa..c060ad394c1d 100644
--- a/smallapp/unbound-anchor.c
+++ b/smallapp/unbound-anchor.c
@@ -2326,7 +2326,9 @@ int main(int argc, char* argv[])
 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
 #endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	ERR_load_SSL_strings();
+#endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
 #else
@@ -2337,7 +2339,7 @@ int main(int argc, char* argv[])
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(0, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(dolist) do_list_builtin();
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 11df4415c5c5..7e9cb4740ae3 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -71,6 +71,9 @@
 #ifdef WITH_PYTHONMODULE
 #include "pythonmod/pythonmod.h"
 #endif
+#ifdef CLIENT_SUBNET
+#include "edns-subnet/subnet-whitelist.h"
+#endif
 
 /** Give checkconf usage, and exit (1). */
 static void
@@ -345,6 +348,20 @@ check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
 	}
 }
 
+#ifdef CLIENT_SUBNET
+/** check ECS configuration */
+static void
+ecs_conf_checks(struct config_file* cfg)
+{
+	struct ecs_whitelist* whitelist = NULL;
+	if(!(whitelist = ecs_whitelist_create()))
+		fatal_exit("Could not create ednssubnet whitelist: out of memory");
+        if(!ecs_whitelist_apply_cfg(whitelist, cfg))
+		fatal_exit("Could not setup ednssubnet whitelist");
+	ecs_whitelist_delete(whitelist);
+}
+#endif /* CLIENT_SUBNET */
+
 /** check configuration for errors */
 static void
 morechecks(struct config_file* cfg, const char* fname)
@@ -427,8 +444,11 @@ morechecks(struct config_file* cfg, const char* fname)
 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
 		cfg->chrootdir, cfg);
 #ifdef USE_IPSECMOD
-	check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook, cfg->chrootdir,
-		cfg);
+	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
+		/* only check hook if enabled */
+		check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
+			cfg->chrootdir, cfg);
+	}
 #endif
 	/* remove chroot setting so that modules are not stripping pathnames*/
 	free(cfg->chrootdir);
@@ -474,6 +494,8 @@ morechecks(struct config_file* cfg, const char* fname)
 #ifdef CLIENT_SUBNET
 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
+		&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
+		&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
 		&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
@@ -524,6 +546,9 @@ morechecks(struct config_file* cfg, const char* fname)
 
 	localzonechecks(cfg);
 	view_and_respipchecks(cfg);
+#ifdef CLIENT_SUBNET
+	ecs_conf_checks(cfg);
+#endif
 }
 
 /** check forwards */
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index aa2db4a61dfb..4b3efc134dc0 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -207,7 +207,7 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
     PR_UL_NM("num.dnscrypt.cleartext", s->svr.num_query_dnscrypt_cleartext);
     PR_UL_NM("num.dnscrypt.malformed",
              s->svr.num_query_dnscrypt_crypted_malformed);
-#endif
+#endif /* USE_DNSCRYPT */
 	printf("%s.requestlist.avg"SQ"%g\n", nm,
 		(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
 			(double)s->svr.sum_query_list_size/
@@ -251,6 +251,10 @@ static void print_mem(struct ub_shm_stat_info* shm_stat)
 #ifdef USE_IPSECMOD
 	PR_LL("mem.mod.ipsecmod", shm_stat->mem.ipsecmod);
 #endif
+#ifdef USE_DNSCRYPT
+	PR_LL("mem.cache.dnscrypt_shared_secret",
+		shm_stat->mem.dnscrypt_shared_secret);
+#endif
 }
 
 /** print histogram */
@@ -337,6 +341,8 @@ static void print_extended(struct ub_stats_info* s)
 	if(!inhibit_zero || s->svr.ans_rcode_nodata) {
 		PR_UL("num.answer.rcode.nodata", s->svr.ans_rcode_nodata);
 	}
+	/* iteration */
+	PR_UL("num.query.ratelimited", s->svr.queries_ratelimited);
 	/* validation */
 	PR_UL("num.answer.secure", s->svr.ans_secure);
 	PR_UL("num.answer.bogus", s->svr.ans_bogus);
@@ -349,6 +355,12 @@ static void print_extended(struct ub_stats_info* s)
 	PR_UL("rrset.cache.count", s->svr.rrset_cache_count);
 	PR_UL("infra.cache.count", s->svr.infra_cache_count);
 	PR_UL("key.cache.count", s->svr.key_cache_count);
+#ifdef USE_DNSCRYPT
+	PR_UL("dnscrypt_shared_secret.cache.count",
+			 s->svr.shared_secret_cache_count);
+	PR_UL("num.query.dnscrypt.shared_secret.cachemiss",
+			 s->svr.num_query_dnscrypt_secret_missed_cache);
+#endif /* USE_DNSCRYPT */
 }
 
 /** print statistics out of memory structures */
@@ -356,7 +368,7 @@ static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats,
 	struct ub_shm_stat_info* shm_stat)
 {
 	int i;
-	char nm[16];
+	char nm[32];
 	for(i=0; i<cfg->num_threads; i++) {
 		snprintf(nm, sizeof(nm), "thread%d", i);
 		pr_stats(nm, &stats[i+1]);
@@ -763,7 +775,9 @@ int main(int argc, char* argv[])
 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
 #endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	ERR_load_SSL_strings();
+#endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
 #else
@@ -774,7 +788,7 @@ int main(int argc, char* argv[])
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(0, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(!RAND_status()) {
diff --git a/testcode/do-tests.sh b/testcode/do-tests.sh
index dcf93907e388..5439f0f285e6 100755
--- a/testcode/do-tests.sh
+++ b/testcode/do-tests.sh
@@ -1,15 +1,15 @@
 #!/usr/bin/env bash
 . testdata/common.sh
 
-NEED_SPLINT='00-lint.tpkg'
-NEED_DOXYGEN='01-doc.tpkg'
-NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
-NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
-NEED_CURL='06-ianaports.tpkg root_anchor.tpkg'
-NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg edns_cache.tpkg'
-NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
-NEED_DNSCRYPT_PROXY='dnscrypt_queries.tpkg dnscrypt_queries_chacha.tpkg'
+NEED_SPLINT='00-lint.tdir'
+NEED_DOXYGEN='01-doc.tdir'
+NEED_XXD='fwd_compress_c00c.tdir fwd_zero.tdir'
+NEED_NC='fwd_compress_c00c.tdir fwd_zero.tdir'
+NEED_CURL='06-ianaports.tdir root_anchor.tdir'
+NEED_WHOAMI='07-confroot.tdir'
+NEED_IPV6='fwd_ancil.tdir fwd_tcp_tc6.tdir stub_udp6.tdir edns_cache.tdir'
+NEED_NOMINGW='tcp_sigpipe.tdir 07-confroot.tdir 08-host-lib.tdir fwd_ancil.tdir'
+NEED_DNSCRYPT_PROXY='dnscrypt_queries.tdir dnscrypt_queries_chacha.tdir'
 
 # test if dig and ldns-testns are available.
 test_tool_avail "dig"
@@ -30,9 +30,9 @@ else
 fi
 
 cd testdata;
-sh ../testcode/mini_tpkg.sh clean
+sh ../testcode/mini_tdir.sh clean
 rm -f .perfstats.txt
-for test in `ls *.tpkg`; do
+for test in `ls -d *.tdir`; do
 	SKIP=0
 	skip_if_in_list $test "$NEED_SPLINT" "splint"
 	skip_if_in_list $test "$NEED_DOXYGEN" "doxygen"
@@ -54,10 +54,10 @@ for test in `ls *.tpkg`; do
 	fi
 	if test $SKIP -eq 0; then
 		echo $test
-		sh ../testcode/mini_tpkg.sh -a ../.. exe $test
+		sh ../testcode/mini_tdir.sh -a ../.. exe $test
 	else
 		echo "skip $test"
 	fi
 done
-sh ../testcode/mini_tpkg.sh report
+sh ../testcode/mini_tdir.sh report
 cat .perfstats.txt
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 154013a8c8e3..cd23b8feb49a 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -1331,7 +1331,7 @@ int serviced_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 	return 0;
 }
 
-/* timers in testbound for autotrust. statistics tested in tpkg. */
+/* timers in testbound for autotrust. statistics tested in tdir. */
 struct comm_timer* comm_timer_create(struct comm_base* base, 
 	void (*cb)(void*), void* cb_arg)
 {
diff --git a/testcode/mini_tdir.sh b/testcode/mini_tdir.sh
new file mode 100755
index 000000000000..96745515e3e4
--- /dev/null
+++ b/testcode/mini_tdir.sh
@@ -0,0 +1,171 @@
+# tdir that only exes the files.
+args="../.."
+if test "$1" = "-a"; then
+	args=$2
+	shift
+	shift
+fi
+	
+if test "$1" = "clean"; then
+	echo "rm -f result.* .done* .tdir.var.master .tdir.var.test"
+	rm -f result.* .done* .tdir.var.master .tdir.var.test
+	exit 0
+fi
+if test "$1" = "fake"; then
+	echo "minitdir fake $2"
+	echo "fake" > .done-`basename $2 .tdir`
+	exit 0
+fi
+if test "$1" = "-f" && test "$2" = "report"; then
+	echo "Minitdir Long Report"
+	pass=0
+	fail=0
+	skip=0
+	echo "   STATUS    ELAPSED TESTNAME TESTDESCRIPTION"
+	for result in *.tdir; do
+		name=`basename $result .tdir`
+		timelen="     "
+		desc=""
+		if test -f "result.$name"; then
+			timestart=`grep ^DateRunStart: "result.$name" | sed -e 's/DateRunStart: //'`
+			timeend=`grep ^DateRunEnd: "result.$name" | sed -e 's/DateRunEnd: //'`
+			timesec=`expr $timeend - $timestart`
+			timelen=`printf %4ds $timesec`
+			if test $? -ne 0; then
+				timelen="$timesec""s"
+			fi
+			desc=`grep ^Description: "result.$name" | sed -e 's/Description: //'`
+		fi
+		if test -f ".done-$name"; then
+			if test "$1" != "-q"; then
+				echo "** PASSED ** $timelen $name: $desc"
+				pass=`expr $pass + 1`
+			fi
+		else
+			if test -f "result.$name"; then
+				echo "!! FAILED !! $timelen $name: $desc"
+				fail=`expr $fail + 1`
+			else
+				echo ".> SKIPPED<< $timelen $name: $desc"
+				skip=`expr $skip + 1`
+			fi
+		fi
+	done
+	echo ""
+	if test "$skip" = "0"; then
+		echo "$pass pass, $fail fail"
+	else
+		echo "$pass pass, $fail fail, $skip skip"
+	fi
+	echo ""
+	exit 0
+fi
+if test "$1" = "report" || test "$2" = "report"; then
+	echo "Minitdir Report"
+	for result in *.tdir; do
+		name=`basename $result .tdir`
+		if test -f ".done-$name"; then
+			if test "$1" != "-q"; then
+				echo "** PASSED ** : $name"
+			fi
+		else
+			if test -f "result.$name"; then
+				echo "!! FAILED !! : $name"
+			else
+				echo ">> SKIPPED<< : $name"
+			fi
+		fi
+	done
+	exit 0
+fi
+
+if test "$1" != 'exe'; then
+	# usage
+	echo "mini tdir. Reduced functionality for old shells."
+	echo "	tdir exe <file>"
+	echo "	tdir fake <file>"
+	echo "	tdir clean"
+	echo "	tdir [-q|-f] report"
+	exit 1
+fi
+shift
+
+# do not execute if the disk is too full
+#DISKLIMIT=100000
+# This check is not portable (to Solaris 10).
+#avail=`df . | tail -1 | awk '{print $4}'`
+#if test "$avail" -lt "$DISKLIMIT"; then
+	#echo "minitdir: The disk is too full! Only $avail."
+	#exit 1
+#fi
+
+name=`basename $1 .tdir`
+dir=$name.$$
+result=result.$name
+done=.done-$name
+success="no"
+if test -x "`which bash`"; then
+	shell="bash"
+else
+	shell="sh"
+fi
+
+# check already done
+if test -f .done-$name; then
+	echo "minitdir .done-$name exists. skip test."
+	exit 0
+fi
+
+# Copy
+echo "minitdir copy $1 to $dir"
+mkdir $dir
+cp -a $name.tdir/* $dir/
+cd $dir
+
+# EXE
+echo "minitdir exe $name" > $result
+grep "Description:" $name.dsc >> $result 2>&1
+echo "DateRunStart: "`date "+%s" 2>/dev/null` >> $result
+if test -f $name.pre; then
+	echo "minitdir exe $name.pre"
+	echo "minitdir exe $name.pre" >> $result
+	$shell $name.pre $args >> $result
+	if test $? -ne 0; then
+		echo "Warning: $name.pre did not exit successfully"
+	fi
+fi
+if test -f $name.test; then
+	echo "minitdir exe $name.test"
+	echo "minitdir exe $name.test" >> $result
+	$shell $name.test $args >>$result 2>&1
+	if test $? -ne 0; then
+		echo "$name: FAILED" >> $result
+		echo "$name: FAILED"
+		success="no"
+	else
+		echo "$name: PASSED" >> $result
+		echo "$name: PASSED" > ../.done-$name
+		echo "$name: PASSED"
+		success="yes"
+	fi
+fi
+if test -f $name.post; then
+	echo "minitdir exe $name.post"
+	echo "minitdir exe $name.post" >> $result
+	$shell $name.post $args >> $result
+	if test $? -ne 0; then
+		echo "Warning: $name.post did not exit successfully"
+	fi
+fi
+echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result
+
+mv $result ..
+cd ..
+rm -rf $dir
+# compat for windows where deletion may not succeed initially (files locked
+# by processes that still have to exit).
+if test $? -eq 1; then
+	echo "minitdir waiting for processes to terminate"
+	sleep 2 # some time to exit, and try again
+	rm -rf $dir
+fi
diff --git a/testcode/petal.c b/testcode/petal.c
index b30549365f51..1c26fa700346 100644
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -643,7 +643,9 @@ int main(int argc, char* argv[])
 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
 	ERR_load_crypto_strings();
 #endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	ERR_load_SSL_strings();
+#endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 	OpenSSL_add_all_algorithms();
 #else
@@ -654,7 +656,7 @@ int main(int argc, char* argv[])
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(0, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	do_service(addr, port, key, cert);
diff --git a/testcode/run_vm.sh b/testcode/run_vm.sh
index 78649f07a941..d4c2a2e11dda 100755
--- a/testcode/run_vm.sh
+++ b/testcode/run_vm.sh
@@ -1,7 +1,7 @@
 #!/usr/local/bin/bash
-# run tpkg tests from within a VM.  Looks for loopback addr.
+# run tdir tests from within a VM.  Looks for loopback addr.
 # if run not from within a VM, runs the tests as usual.
-# with one argument: run that tpkg, otherwise, run all tpkgs.
+# with one argument: run that tdir, otherwise, run all tdirs.
 
 get_lo0_ip4() {
         if test -x /sbin/ifconfig
@@ -23,12 +23,12 @@ else
         ALT_LOOPBACK=true
 fi
 cd testdata
-TPKG=../testcode/mini_tpkg.sh
-#RUNLIST=`(ls -1 *.tpkg|grep -v '^0[016]')`
-RUNLIST=`(ls -1 *.tpkg)`
+TPKG=../testcode/mini_tdir.sh
+#RUNLIST=`(ls -1d *.tdir|grep -v '^0[016]')`
+RUNLIST=`(ls -1d *.tdir)`
 if test "$#" = "1"; then RUNLIST="$1"; fi
 
-# fix up tpkg that was edited on keyboard interrupt.
+# fix up tdir that was edited on keyboard interrupt.
 cleanup() {
 	echo cleanup
 	if test -f "$t.bak"; then mv "$t.bak" "$t"; fi
@@ -44,16 +44,15 @@ do
 		continue
 	fi
 	# We have alternative 127.0.0.1 number
-	if ( echo $t | grep '6\.tpkg$' ) # skip IPv6 tests
+	if ( echo $t | grep '6\.tdir$' ) # skip IPv6 tests
 	then
 		continue
-       	elif test "$t" = "edns_cache.tpkg" # This one is IPv6 too!
+       	elif test "$t" = "edns_cache.tdir" # This one is IPv6 too!
 	then
 		continue
 	fi
-	cp -p "$t" "$t.bak"
-	tar xzf $t
-	find "${t%.tpkg}.dir" -type f \
+	cp -ap "$t" "$t.bak"
+	find "${t}" -type f \
 		-exec grep -q -e '127\.0\.0\.1' -e '@localhost' {} \; -print | {
 		while read f
 		do
@@ -63,15 +62,14 @@ do
 			mv "$f._" "$f"
 		done
 	}
-	find "${t%.tpkg}.dir" -type d -name "127.0.0.1" -print | {
+	find "${t}" -type d -name "127.0.0.1" -print | {
 		while read d
 		do
 			mv -v "$d" "${d%127.0.0.1}${LO0_IP4}"
 		done
 	}
-	tar czf $t "${t%.tpkg}.dir"
-	rm -fr "${t%.tpkg}.dir"
 	$TPKG exe $t
+	rm -fr "${t}"
 	mv "$t.bak" "$t"
 done
 # get out of testdata/
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index f5eb8fc48b1d..b494507def26 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -410,7 +410,9 @@ int main(int argc, char** argv)
 		return 1;
 	}
 	if(usessl) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		ERR_load_SSL_strings();
+#endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
 		OpenSSL_add_all_algorithms();
 #else
@@ -421,7 +423,7 @@ int main(int argc, char** argv)
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(0, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 	}
 	send_em(svr, udp, usessl, noanswer, argc, argv);
diff --git a/testcode/unitverify.c b/testcode/unitverify.c
index e5e5b0f7bacb..e421d90bca56 100644
--- a/testcode/unitverify.c
+++ b/testcode/unitverify.c
@@ -299,6 +299,7 @@ verifytest_file(const char* fname, const char* at_date)
 	struct module_env env;
 	struct val_env ve;
 	time_t now = time(NULL);
+	unit_show_func("signature verify", fname);
 
 	if(!list)
 		fatal_exit("could not read %s: %s", fname, strerror(errno));
@@ -341,6 +342,7 @@ dstest_file(const char* fname)
 	struct entry* e;
 	struct entry* list = read_datafile(fname, 1);
 	struct module_env env;
+	unit_show_func("DS verify", fname);
 
 	if(!list)
 		fatal_exit("could not read %s: %s", fname, strerror(errno));
@@ -474,6 +476,7 @@ nsec3_hash_test(const char* fname)
 	sldns_buffer* buf = sldns_buffer_new(65535);
 	struct entry* e;
 	struct entry* list = read_datafile(fname, 1);
+	unit_show_func("NSEC3 hash", fname);
 
 	if(!list)
 		fatal_exit("could not read %s: %s", fname, strerror(errno));
diff --git a/testdata/00-lint.tdir/00-lint.dsc b/testdata/00-lint.tdir/00-lint.dsc
new file mode 100644
index 000000000000..4778f7a81ba5
--- /dev/null
+++ b/testdata/00-lint.tdir/00-lint.dsc
@@ -0,0 +1,16 @@
+BaseName: 00-lint
+Version: 1.0
+Description: Put source into lint.
+CreationDate: Wed Jan  3 14:12:02 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 00-lint.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/00-lint.tdir/00-lint.test b/testdata/00-lint.tdir/00-lint.test
new file mode 100644
index 000000000000..e40dce7d6234
--- /dev/null
+++ b/testdata/00-lint.tdir/00-lint.test
@@ -0,0 +1,11 @@
+# #-- 00-lint.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+. ../common.sh
+PRE="../.."
+get_make
+
+(cd $PRE ; $MAKE lint)
+
diff --git a/testdata/00-lint.tpkg b/testdata/00-lint.tpkg
deleted file mode 100644
index 89e44966d8b6..000000000000
--- a/testdata/00-lint.tpkg
+++ /dev/null
diff --git a/testdata/01-doc.tdir/01-doc.dsc b/testdata/01-doc.tdir/01-doc.dsc
new file mode 100644
index 000000000000..a9282c70171d
--- /dev/null
+++ b/testdata/01-doc.tdir/01-doc.dsc
@@ -0,0 +1,16 @@
+BaseName: 01-doc
+Version: 1.0
+Description: Check documentation
+CreationDate: Wed Jan  3 15:15:01 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 01-doc.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/01-doc.tdir/01-doc.test b/testdata/01-doc.tdir/01-doc.test
new file mode 100644
index 000000000000..6a78a9cd356d
--- /dev/null
+++ b/testdata/01-doc.tdir/01-doc.test
@@ -0,0 +1,47 @@
+# #-- 01-doc.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+. ../common.sh
+
+set_doxygen_path
+
+PRE="../.."
+get_make
+(cd $PRE ; $MAKE doc) > mylog 2>&1
+
+bad=0
+if grep -e "Warning" -e "warning" -e "Error" -e "error" mylog >/dev/null 2>&1;
+then
+	cat mylog
+	bad=1
+else
+	# "doxygen ok"
+	cat mylog
+fi
+
+(cd $PRE; find . -name "*.h" -print) >hlist
+(cd $PRE; find . -name "*.c" -print) >>hlist
+# filter out config.h
+fgrep -v -e "config.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configparser" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configlexer" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configyyrename" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/locks.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/storage/lookup3.c" hlist > ilist; mv ilist hlist
+fgrep -v -e "ldns-src/" hlist > ilist; mv ilist hlist
+fgrep -v -e "libunbound/python/libunbound_wrap.c" hlist > ilist; mv ilist hlist
+fgrep -v -e "pythonmod/interface.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "dnstap" hlist > ilist; mv ilist hlist
+# filter out compat
+fgrep -v -e "compat/" hlist > ilist; mv ilist hlist
+for h in `cat hlist`; do
+	if fgrep "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
+		: # ok
+	else
+		echo "Warning: $h has no documentation."
+		bad=1
+	fi
+done
+exit $bad
diff --git a/testdata/01-doc.tpkg b/testdata/01-doc.tpkg
deleted file mode 100644
index 6502bdc14e25..000000000000
--- a/testdata/01-doc.tpkg
+++ /dev/null
diff --git a/testdata/02-unittest.tdir/02-unittest.dsc b/testdata/02-unittest.tdir/02-unittest.dsc
new file mode 100644
index 000000000000..b30695a2a846
--- /dev/null
+++ b/testdata/02-unittest.tdir/02-unittest.dsc
@@ -0,0 +1,16 @@
+BaseName: 02-unittest
+Version: 1.0
+Description: Unit tests.
+CreationDate: Thu Jan  4 16:32:42 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 02-unittest.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/02-unittest.tdir/02-unittest.test b/testdata/02-unittest.tdir/02-unittest.test
new file mode 100644
index 000000000000..898cd3dcc124
--- /dev/null
+++ b/testdata/02-unittest.tdir/02-unittest.test
@@ -0,0 +1,26 @@
+# #-- 02-unittest.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+PRE="../.."
+get_make
+(cd $PRE ; $MAKE unittest; $MAKE lock-verify)
+
+if (cd $PRE; ./unittest); then
+	echo "unit test worked."
+else
+	echo "unit test failed."
+	exit 1
+fi
+if test -f $PRE/ublocktrace.0; then
+	if (cd $PRE; ./lock-verify ublocktrace.*); then
+		echo "lock-verify test worked."
+	else
+		echo "lock-verify test failed."
+		exit 1
+	fi
+fi
+exit 0
diff --git a/testdata/02-unittest.tpkg b/testdata/02-unittest.tpkg
deleted file mode 100644
index 4618ae30e6a1..000000000000
--- a/testdata/02-unittest.tpkg
+++ /dev/null
diff --git a/testdata/03-testbound.tdir/03-testbound.dsc b/testdata/03-testbound.tdir/03-testbound.dsc
new file mode 100644
index 000000000000..40cd9f9baf6a
--- /dev/null
+++ b/testdata/03-testbound.tdir/03-testbound.dsc
@@ -0,0 +1,16 @@
+BaseName: 03-testbound
+Version: 1.0
+Description: Run testbound event replay scenarios.
+CreationDate: Tue Feb 13 16:36:18 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 03-testbound.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/03-testbound.tdir/03-testbound.test b/testdata/03-testbound.tdir/03-testbound.test
new file mode 100644
index 000000000000..e23151c41657
--- /dev/null
+++ b/testdata/03-testbound.tdir/03-testbound.test
@@ -0,0 +1,123 @@
+# #-- 03-testbound.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+PRE="../.."
+get_make
+(cd $PRE ; $MAKE testbound)
+exitval=0
+# quiet="" to make verbose
+
+do_valgrind=no
+# valgrind mode for debug
+#if grep "staticexe=-static" $PRE/Makefile >/dev/null 2>&1; then
+#	if test -x "`which valgrind`"; then
+#		do_valgrind=yes
+#	fi
+#fi
+
+# self-test (unit test of testbound)
+if test $do_valgrind = "yes"; then
+	if (valgrind $PRE/testbound -s >tmpout 2>&1;); then
+		echo "selftest   OK  "
+	else
+		echo "selftest FAILED"
+		exit 1
+	fi
+	if grep "All heap blocks were freed -- no leaks are possible." tmpout >/dev/null 2>&1; then
+		:  # clean
+	else
+		echo "Memory leaked in selftest"
+		grep "in use at exit" tmpout
+		exit 1
+	fi
+else
+	if ($PRE/testbound -s >/dev/null 2>&1;); then
+		echo "selftest   OK  "
+	else
+		echo "selftest FAILED"
+		exit 1
+	fi
+fi
+
+
+# the .crpl are not always supported and need checking for SHA256 and GOST
+# support.
+# the .rpl should work on any system (portable).
+for input in $PRE/testdata/*.rpl $PRE/testdata/*.crpl; do
+	header=`grep SCENARIO_BEGIN $input | head -1 | sed -e 's/SCENARIO_BEGIN //'`
+	cleaninput=`echo $input | sed -e "s?$PRE/testdata/??"`
+
+	# detect if SHA256 is needed
+	if echo $cleaninput | grep sha2 >/dev/null 2>&1; then
+		if $PRE/testbound -2 >/dev/null 2>&1; then
+			: # the SHA256 is supported
+		else
+			continue
+		fi
+	fi
+
+	# detect if GOST is needed
+	if echo $cleaninput | grep gost >/dev/null 2>&1; then
+		if $PRE/testbound -g >/dev/null 2>&1; then
+			: # GOST is supported
+		else
+			continue
+		fi
+	fi
+
+	# detect if CLIENT_SUBNET is needed
+	if echo $cleaninput | grep subnet >/dev/null 2>&1; then
+		if $PRE/testbound -c >/dev/null 2>&1; then
+			: # CLIENT_SUBNET is supported
+		else
+			continue
+		fi
+	fi
+
+	# detect if IPSECMOD is needed
+	if echo $cleaninput | grep ipsecmod >/dev/null 2>&1; then
+		if $PRE/testbound -i >/dev/null 2>&1; then
+			: # IPSECMOD is supported
+		else
+			continue
+		fi
+	fi
+
+	if test $do_valgrind = "yes"; then
+		if (valgrind $PRE/testbound -p $input >tmpout 2>&1;); then
+			echo "  OK   $cleaninput: $header"
+		else
+			echo "FAILED $cleaninput: $header"
+			exitval=1
+		fi
+		if grep "All heap blocks were freed -- no leaks are possible." tmpout >/dev/null 2>&1; then
+			:  # clean
+		else
+			echo "Memory leaked in $cleaninput"
+			grep "in use at exit" tmpout
+			exitval=1
+		fi
+	else
+		# do valgrind=no
+		if ($PRE/testbound -p $input >/dev/null 2>&1;); then
+			echo "  OK   $cleaninput: $header"
+		else
+			echo "FAILED $cleaninput: $header"
+			exitval=1
+		fi
+	fi
+	if test -f ublocktrace.0; then
+        	if $PRE/lock-verify ublocktrace.*; then
+                	#echo "lock-verify test $input worked."
+			i=i
+        	else
+                	echo "lock-verify test $input failed."
+			exitval=1
+        	fi
+	fi
+done
+exit $exitval
diff --git a/testdata/03-testbound.tpkg b/testdata/03-testbound.tpkg
deleted file mode 100644
index 5db2b7731336..000000000000
--- a/testdata/03-testbound.tpkg
+++ /dev/null
diff --git a/testdata/04-checkconf.tdir/04-checkconf.dsc b/testdata/04-checkconf.tdir/04-checkconf.dsc
new file mode 100644
index 000000000000..6d307fb88595
--- /dev/null
+++ b/testdata/04-checkconf.tdir/04-checkconf.dsc
@@ -0,0 +1,16 @@
+BaseName: 04-checkconf
+Version: 1.0
+Description: Test configuration checker.
+CreationDate: Fri Sep 28 15:46:27 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 04-checkconf.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/04-checkconf.tdir/04-checkconf.test b/testdata/04-checkconf.tdir/04-checkconf.test
new file mode 100644
index 000000000000..a2396fef7608
--- /dev/null
+++ b/testdata/04-checkconf.tdir/04-checkconf.test
@@ -0,0 +1,72 @@
+# #-- 04-checkconf.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# test that failed exit code is used
+$PRE/unbound-checkconf bla bla bla>/dev/null
+if test $? != 1; then
+	echo "exit code for usage wrong"
+	exit 1
+fi
+$PRE/unbound-checkconf -h >/dev/null
+if test $? != 1; then
+	echo "exit code for usage wrong"
+	exit 1
+fi
+$PRE/unbound-checkconf notexist_file 
+if test $? != 1; then
+	echo "exit code for nofile wrong"
+	exit 1
+fi
+
+# detect windows
+if grep "define UB_ON_WINDOWS 1" ../../config.h; then
+	onwin=1
+else
+	onwin=0
+fi
+
+# test check of config files.
+for f in bad.*; do
+	echo
+	echo $PRE/unbound-checkconf $f
+	if test $f = "bad.user" -a $onwin -eq 1; then
+		echo "skipped on windows"
+		continue
+	fi
+
+	$PRE/unbound-checkconf $f
+	if test $? != 1; then
+		echo "exit code case $f wrong"
+		exit 1
+	fi
+done
+for f in good.*; do
+	echo
+	echo $PRE/unbound-checkconf $f
+	$PRE/unbound-checkconf $f
+	if test $? != 0; then
+		echo "exit code case $f wrong"
+		exit 1
+	fi
+done
+
+echo $PRE/unbound-checkconf warn.algo
+$PRE/unbound-checkconf warn.algo > outfile 2>&1
+if test $? != 0; then
+	cat outfile
+	echo "wrong exit code, warning should not fail with error"
+	exit 1
+fi
+cat outfile
+if grep "unsupported algo" outfile; then
+	echo "OK"
+else
+	echo "Failed, should print warning"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/04-checkconf.tdir/bad.badfwd b/testdata/04-checkconf.tdir/bad.badfwd
new file mode 100644
index 000000000000..27d58c5ea048
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.badfwd
@@ -0,0 +1,8 @@
+server:
+	# to make sure the check doesn't fail on username or chrootdir.
+	username: ""	
+	chroot: ""
+
+forward-zone:
+	name: "example.com"
+	forward-addr: 123.123.AAAA.123
diff --git a/testdata/04-checkconf.tdir/bad.badif b/testdata/04-checkconf.tdir/bad.badif
new file mode 100644
index 000000000000..ea261fc2dbdb
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.badif
@@ -0,0 +1,17 @@
+# bad host and interface lines.
+server:
+	username: ""
+	interface: 127.0.0.1
+	interface: 127.0.0.1
+	interface: 127.0.0.1
+	outgoing-interface: ::1
+	outgoing-interface: ::1
+	outgoing-interface: ::1
+	
+forward-zone:
+	name: root.
+	forward-host: 127.0.0.1
+
+stub-zone:
+	name: com.
+	stub-host: ::3
diff --git a/testdata/04-checkconf.tdir/bad.badip b/testdata/04-checkconf.tdir/bad.badip
new file mode 100644
index 000000000000..74b2b7eb27a7
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.badip
@@ -0,0 +1,2 @@
+server:
+	interface: 123.AAAA.123.123
diff --git a/testdata/04-checkconf.tdir/bad.bind b/testdata/04-checkconf.tdir/bad.bind
new file mode 100644
index 000000000000..863d566e9ef8
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.bind
@@ -0,0 +1,35 @@
+# test daemon
+options {
+	directory "/home/wouter/bla";
+	version "test BIND 24";
+	pid-file "/home/wouter/named_24.pid";
+	dnssec-enable yes;
+	listen-on-v6 { any; };
+};
+
+// logging clause
+logging {
+	channel mainlog {
+		file "named_24.log" size 10m;
+		severity info;
+	};
+	category default {
+		mainlog;
+	};
+};
+
+zone "." IN {
+	type hint;
+	file "root.servers";
+};
+
+zone "localhost" IN {
+	type master;
+	file "localhost.zone";
+	allow-update { none; };
+};
+zone "0.0.127.in-addr.arpa" IN {
+	type master;
+	file "localhost.rev";
+	allow-update { none; };
+};
diff --git a/testdata/04-checkconf.tdir/bad.user b/testdata/04-checkconf.tdir/bad.user
new file mode 100644
index 000000000000..40631abb4f79
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.user
@@ -0,0 +1,2 @@
+server:
+	username: blabla_noexist_user
diff --git a/testdata/04-checkconf.tdir/good.all b/testdata/04-checkconf.tdir/good.all
new file mode 100644
index 000000000000..33ebaf014abf
--- /dev/null
+++ b/testdata/04-checkconf.tdir/good.all
@@ -0,0 +1,246 @@
+# To test, all options are used.
+#
+# Example configuration file.
+#
+# See unbound.conf(5) man page.
+#
+# this is a comment.
+
+#Use this to include other text into the file.
+#include: "otherfile.conf"
+
+# The server clause sets the main parameters. 
+server:
+	# whitespace is not necessary, but looks cleaner.
+
+	# verbosity number, 0 is least verbose. 1 is default.
+	verbosity: 2
+	
+	# number of threads to create. 1 disables threading.
+	num-threads: 1
+
+	# specify the interfaces to answer queries from by ip-address.
+	# If you give none the default (all) interface is used.
+	# specify every interface on a new 'interface:' labelled line.
+	interface: 192.0.2.153
+	interface: 192.0.2.154
+	interface: 2001:DB8::5
+
+	# port to answer queries from
+	port: 53
+
+	# number of port to allocate per thread, determines the size of the
+	# port range. A larger port range gives more resistance to certain
+	# spoof attacks, as it gets harder to guess which port is used. 
+	# But also takes more system resources (for open sockets).
+	outgoing-range: 16
+
+	outgoing-port-permit: 1000-1020
+	outgoing-port-avoid: 2000-2048
+	outgoing-port-avoid: 3000
+
+	# number of outgoing simultaneous tcp buffers to hold per thread.
+	outgoing-num-tcp: 10
+
+	# number of incoming simultaneous tcp buffers to hold per thread.
+	incoming-num-tcp: 10
+	
+	# buffer size for handling DNS data. No messages larger than this
+	# size can be sent or received, by UDP or TCP. In bytes.
+	msg-buffer-size: 65552
+
+	# the amount of memory to use for the message cache.
+	# in bytes. default is 4 Mb
+	msg-cache-size: 4194304
+
+	# the number of slabs to use for the message cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	msg-cache-slabs: 4
+
+	# the number of queries that a thread gets to service.
+	num-queries-per-thread: 1024
+
+	# the amount of memory to use for the RRset cache.
+	# in bytes. default is 4 Mb
+	rrset-cache-size: 4194304
+
+	# the number of slabs to use for the RRset cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	rrset-cache-slabs: 4
+
+	# the time to live (TTL) value for cached roundtrip times and
+	# EDNS version information for hosts. In seconds.
+	infra-host-ttl: 900
+
+	# the time to live (TTL) value for cached lame delegations. In sec.
+	infra-lame-ttl: 900
+
+	# the number of slabs to use for the Infrastructure cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	infra-cache-slabs: 4
+
+	# the maximum number of hosts that are cached (roundtrip times, EDNS).
+	infra-cache-numhosts: 10000
+
+	# the maximum size of the lame zones cached per host. in bytes.
+	infra-cache-lame-size: 10240
+
+	# Enable IPv4, "yes" or "no".
+	do-ip4: yes
+
+	# Enable IPv6, "yes" or "no".
+	do-ip6: yes
+
+	# Enable UDP, "yes" or "no".
+	do-udp: yes
+
+	# Enable TCP, "yes" or "no".
+	do-tcp: yes
+
+	# if given, a chroot(2) is done to the given directory.
+	# i.e. you can chroot to the working directory, for example,
+	# for extra security, but make sure all files are in that directory.
+	chroot: ""
+
+	# if given, user privileges are dropped (after binding port),
+	# and the given username is assumed. Default is nothing "".
+	username: "nobody"
+
+	# the working directory.
+	directory: "."
+
+	# the log file, "" means log to stderr. 
+	# Use of this option sets use-syslog to "no".
+	logfile: ""
+	
+	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
+	# log to, with identity "unbound". If yes, it overrides the logfile.
+	use-syslog: no 
+
+	# the pid file.
+	pidfile: "unbound.pid"
+	
+	# enable to not answer id.server and hostname.bind queries.
+	hide-identity: no
+	
+	# enable to not answer version.server and version.bind queries.
+	hide-version: no
+	
+	# the identity to report. Leave "" or default to return hostname.
+	identity: ""
+	
+	# the version to report. Leave "" or default to return package version.
+	version: ""
+	
+	# the target fetch policy.
+	# series of integers describing the policy per dependency depth. 
+	# The number of values in the list determines the maximum dependency 
+	# depth the recursor will pursue before giving up. Each integer means:
+	# 	-1 : fetch all targets opportunistically,
+	# 	0: fetch on demand,
+	#	positive value: fetch that many targets opportunistically.
+	# Enclose the list of numbers between quotes ("").
+	target-fetch-policy: "3 2 1 0 0"
+	
+	# Harden against very small EDNS buffer sizes. 
+	harden-short-bufsize: yes
+	
+	# Harden against unseemly large queries.
+	harden-large-queries: yes
+	
+	# Harden against out of zone rrsets, to avoid spoofing attempts. 
+	harden-glue: yes
+	
+	# Do not query the following addresses. No DNS queries are sent there.
+	# List one address per entry. To block other ports than the default
+	# DNS port, use "1.2.3.4@123" to block port 123 for 1.2.3.4.
+	do-not-query-address: 127.0.0.1
+	do-not-query-address: 127.0.0.2
+	do-not-query-address: 127.255.255.255
+	do-not-query-address: ::1
+	
+	# module configuration of the server. A string with identifiers
+	# separated by spaces. "iterator" or "validator iterator"
+	module-config: "validator iterator"
+	
+	# File with trusted keys for validation. Specify more than one file
+	# with several entries, one file per entry.
+	# Zone file format, with DS and DNSKEY entries.
+	trust-anchor-file: ""
+	
+	# Trusted key for validation. DS or DNSKEY. specify the RR on a
+	# single line, surrounded by "". TTL is ignored. class is IN default.
+	# (These examples are from August 2007 and may not be valid anymore).
+	trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
+	trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"
+
+	# File with trusted keys for validation. Specify more than one file
+	# with several entries, one file per entry. Like trust-anchor-file
+	# but has a different file format. Format is BIND-9 style format, 
+	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
+	trusted-keys-file: ""
+
+	# Override the date for validation with a specific fixed date.
+	# Do not set this unless you are debugging signature inception
+	# and expiration. "" or "0" turns the feature off. 
+	val-override-date: ""
+	
+	# The time to live for bogus data, rrsets and messages. This avoids
+	# some of the revalidation, until the time interval expires. in secs.
+	val-bogus-ttl: 900
+	
+	# Should additional section of secure message also be kept clean of
+	# unsecure data. Useful to shield the users of this validator from
+	# potential bogus data in the additional section. All unsigned data 
+	# in the additional section is removed from secure messages.
+	val-clean-additional: yes
+	
+	# Turn permissive mode on to permit bogus messages. Thus, messages
+	# for which security checks failed will be returned to clients,
+	# instead of SERVFAIL. It still performs the security checks, which
+	# result in interesting log files and possibly the AD bit in
+	# replies if the message is found secure. The default is off.
+	val-permissive-mode: no
+	
+	# It is possible to configure NSEC3 maximum iteration counts per
+	# keysize. Keep this table very short, as linear search is done.
+	# A message with an NSEC3 with larger count is marked insecure.
+	# List in ascending order the keysize and count values.
+	val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
+
+	# the amount of memory to use for the key cache.
+	# in bytes. default is 4 Mb
+	key-cache-size: 4194304
+
+	# the number of slabs to use for the key cache.
+	# the number of slabs must be a power of 2.
+	# more slabs reduce lock contention, but fragment memory usage.
+	key-cache-slabs: 4
+
+
+# Stub zones.
+# Create entries like below, to make all queries for 'example.com' and 
+# 'example.org' go to the given list of nameservers. list zero or more 
+# nameservers by hostname or by ipaddress.
+stub-zone:
+	name: "example.com"
+	stub-addr: 192.0.2.68
+stub-zone:
+	name: "example.org"
+	stub-host: ns.example.com.
+
+# Forward zones
+# Create entries like below, to make all queries for 'example.com' and
+# 'example.org' go to the given list of servers. These servers have to handle
+# recursion to other nameservers. List zero or more nameservers by hostname
+# or by ipaddress. Use an entry with name "." to forward all queries.
+forward-zone:
+ 	name: "example.com"
+ 	forward-addr: 192.0.2.68
+ 	forward-addr: 192.0.2.73@5355  # forward to port 5355.
+forward-zone:
+ 	name: "example.org"
+ 	forward-host: fwd.example.com
diff --git a/testdata/04-checkconf.tdir/good.ifport b/testdata/04-checkconf.tdir/good.ifport
new file mode 100644
index 000000000000..1aa59d1b701f
--- /dev/null
+++ b/testdata/04-checkconf.tdir/good.ifport
@@ -0,0 +1,23 @@
+#
+# bug301 : unbound-checkconf cannot parse interface '0.0.0.0@5353'
+
+#Use this to include other text into the file.
+#include: "otherfile.conf"
+
+# The server clause sets the main parameters. 
+server:
+	# specify the interfaces to answer queries from by ip-address.
+	# If you give none the default (all) interface is used.
+	# specify every interface on a new 'interface:' labelled line.
+	interface: 192.0.2.153
+	interface: 192.0.2.154
+	interface: 2001:DB8::5
+	interface: 0.0.0.0@5353
+
+	# config
+	chroot: ""
+	username: "nobody"
+	directory: "."
+	logfile: ""
+	use-syslog: no 
+	pidfile: "unbound.pid"
diff --git a/testdata/04-checkconf.tdir/good.include b/testdata/04-checkconf.tdir/good.include
new file mode 100644
index 000000000000..49e742d75d81
--- /dev/null
+++ b/testdata/04-checkconf.tdir/good.include
@@ -0,0 +1,6 @@
+# include some file to test include functionality.
+
+include: "good.all"
+
+server:
+	identity: "my identity"
diff --git a/testdata/04-checkconf.tdir/warn.algo b/testdata/04-checkconf.tdir/warn.algo
new file mode 100644
index 000000000000..dcd1a9073366
--- /dev/null
+++ b/testdata/04-checkconf.tdir/warn.algo
@@ -0,0 +1,9 @@
+server:
+	chroot: ""
+	directory: ""
+	pidfile: ""
+	username: ""
+	logfile: ""
+
+	trust-anchor: "jelte.nlnetlabs.nl. DS 42860 2000 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A" 
+
diff --git a/testdata/04-checkconf.tpkg b/testdata/04-checkconf.tpkg
deleted file mode 100644
index c100355de7ba..000000000000
--- a/testdata/04-checkconf.tpkg
+++ /dev/null
diff --git a/testdata/05-asynclook.tdir/05-asynclook.dsc b/testdata/05-asynclook.tdir/05-asynclook.dsc
new file mode 100644
index 000000000000..59ada05b1d51
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.dsc
@@ -0,0 +1,16 @@
+BaseName: 05-asynclook
+Version: 1.0
+Description: Test async lookup using libunbound
+CreationDate: Fri Jan 25 09:50:35 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: 05-asynclook.pre
+Post: 05-asynclook.post
+Test: 05-asynclook.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/05-asynclook.tdir/05-asynclook.hosts b/testdata/05-asynclook.tdir/05-asynclook.hosts
new file mode 100644
index 000000000000..fa5e5482e72f
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.hosts
@@ -0,0 +1,12 @@
+# Host Database
+#
+# This file should contain the addresses and aliases for local hosts that
+# share this file.  Replace 'my.domain' below with the domainname of your
+# machine.
+#
+::1                     localhost localhost.my.domain
+127.0.0.1               localhost localhost.my.domain
+# Imaginary network.
+10.0.0.2               myname.my.domain myname
+10.0.0.3               myfriend.my.domain myfriend
+10.20.30.40		virtual.virtual.virtual.local
diff --git a/testdata/05-asynclook.tdir/05-asynclook.post b/testdata/05-asynclook.tdir/05-asynclook.post
new file mode 100644
index 000000000000..a4620f6f412e
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.post
@@ -0,0 +1,10 @@
+# #-- 05-asynclook.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+. ../common.sh
+kill_pid $FWD_PID
diff --git a/testdata/05-asynclook.tdir/05-asynclook.pre b/testdata/05-asynclook.tdir/05-asynclook.pre
new file mode 100644
index 000000000000..708f7f6e2d3e
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.pre
@@ -0,0 +1,20 @@
+# #-- 05-asynclook.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+FWD_PORT=$(($RND_PORT + 1))
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT 05-asynclook.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+
+wait_ldns_testns_up fwd.log
diff --git a/testdata/05-asynclook.tdir/05-asynclook.test b/testdata/05-asynclook.tdir/05-asynclook.test
new file mode 100644
index 000000000000..28a054d1aba3
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.test
@@ -0,0 +1,198 @@
+# #-- 05-asynclook.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# test if fwder is up
+echo "> dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile"
+dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile
+if grep "10.20.30.40" outfile; then
+	echo "fwder is up"
+else
+	cat fwd.log
+	echo "fwder not up"
+	exit 1
+fi
+rm outfile
+
+# create asynclook
+get_make
+echo "> (cd $PRE ; $MAKE asynclook)"
+(cd $PRE ; $MAKE asynclook)
+if test ! -x $PRE/asynclook; then
+	echo "cannot build asynclook test program"
+	exit 1
+fi
+(cd $PRE ; $MAKE lock-verify)
+
+# check the locks.
+function locktest() {
+	if test -x $PRE/lock-verify -a -f ublocktrace.0; then
+		$PRE/lock-verify ublocktrace.*
+		if test $? -ne 0; then
+			echo "lock-verify error"
+			exit 1
+		fi
+	fi
+}
+
+# detect if there is forking on this system.
+HAVE_FORK=yes
+if grep "undef HAVE_FORK" $PRE/config.h >/dev/null 2>&1; then
+	HAVE_FORK=no
+fi
+
+if test $HAVE_FORK = yes; then
+# test hosts reading (directed at local auth info)
+echo '> $PRE/asynclook -H 05-asynclook.hosts virtual.virtual.virtual.local 2>&1 | tee outfile'
+$PRE/asynclook -H 05-asynclook.hosts virtual.virtual.virtual.local 2>&1 | tee outfile
+if grep "virtual.virtual.virtual.local: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+# test async lookups (directed at testns)
+echo '> $PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com 2>&1 | tee outfile'
+$PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo '> $PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+fi #HAVE_FORK
+
+echo '> $PRE/asynclook -t -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+if test $HAVE_FORK = yes; then
+# test cancellation
+echo '> $PRE/asynclook -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+fi #HAVE_FORK
+
+echo '> $PRE/asynclook -t -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+if test $HAVE_FORK = yes; then
+# test blocking mode
+echo '> $PRE/asynclook -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+fi #HAVE_FORK
+
+echo '> $PRE/asynclook -t -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo "> cat logfiles"
+cat fwd.log 
+exit 0
diff --git a/testdata/05-asynclook.tdir/05-asynclook.testns b/testdata/05-asynclook.tdir/05-asynclook.testns
new file mode 100644
index 000000000000..6245ae164172
--- /dev/null
+++ b/testdata/05-asynclook.tdir/05-asynclook.testns
@@ -0,0 +1,35 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+; for priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+@	IN	NS
+SECTION ANSWER
+@	IN	NS	127.0.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/05-asynclook.tpkg b/testdata/05-asynclook.tpkg
deleted file mode 100644
index e13476ab297c..000000000000
--- a/testdata/05-asynclook.tpkg
+++ /dev/null
diff --git a/testdata/06-ianaports.tdir/06-ianaports.dsc b/testdata/06-ianaports.tdir/06-ianaports.dsc
new file mode 100644
index 000000000000..6eb91e3e668d
--- /dev/null
+++ b/testdata/06-ianaports.tdir/06-ianaports.dsc
@@ -0,0 +1,16 @@
+BaseName: 06-ianaports
+Version: 1.0
+Description: check if iana assigned ports have changed.
+CreationDate: Thu Apr 10 12:42:40 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 06-ianaports.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/06-ianaports.tdir/06-ianaports.test b/testdata/06-ianaports.tdir/06-ianaports.test
new file mode 100644
index 000000000000..1c51218a853b
--- /dev/null
+++ b/testdata/06-ianaports.tdir/06-ianaports.test
@@ -0,0 +1,27 @@
+# #-- 06-ianaports.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+mkdir util
+get_make
+echo "> $MAKE -f $PRE/Makefile iana_update"
+$MAKE -f $PRE/Makefile iana_update
+if test $? -ne 0; then
+	echo "cannot iana update"
+	exit 1
+fi
+
+diff -u $PRE/util/iana_ports.inc util/iana_ports.inc
+if test $? -ne 0; then
+	echo "IANA assigned ports have updated, make iana_update and commit"
+	echo "cp util/iana_ports.inc $PRE/util/iana_ports.inc"
+	cp util/iana_ports.inc $PRE/util/iana_ports.inc
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/06-ianaports.tpkg b/testdata/06-ianaports.tpkg
deleted file mode 100644
index 98020a0a5eb1..000000000000
--- a/testdata/06-ianaports.tpkg
+++ /dev/null
diff --git a/testdata/07-confroot.tdir/07-confroot.dsc b/testdata/07-confroot.tdir/07-confroot.dsc
new file mode 100644
index 000000000000..f1cbe6e7da2e
--- /dev/null
+++ b/testdata/07-confroot.tdir/07-confroot.dsc
@@ -0,0 +1,16 @@
+BaseName: 07-confroot
+Version: 1.0
+Description: test checkconf with chroot dir.
+CreationDate: Mon Apr 14 14:54:59 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: 07-confroot.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/07-confroot.tdir/07-confroot.test b/testdata/07-confroot.tdir/07-confroot.test
new file mode 100644
index 000000000000..5238435167a8
--- /dev/null
+++ b/testdata/07-confroot.tdir/07-confroot.test
@@ -0,0 +1,287 @@
+# #-- 07-confroot.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+if uname | grep "MINGW" >/dev/null; then
+	# no chroot, no need to test.
+	# (test fails on / en \ comparisons, by the way).
+	echo "no chroot on windows, end test"
+	exit 0
+fi
+
+# create config file
+cwd=`pwd -P`
+subdir=$cwd/subdir
+user=`whoami`
+mkdir subdir
+if test $? -ne 0; then
+	echo "could not create subdir"
+	exit 1
+fi
+
+cat > test.conf <<EOF
+server:
+	chroot: $cwd
+	directory: $subdir
+	username: $user
+
+	pidfile: "/unbound.pid"
+	root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "/subdir/trustanchor.conf"
+	trust-anchor-file: "trustanchor.conf"
+
+	trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+# fake root file
+echo ". NS a.root-servers.net." > subdir/root.ca
+echo "a.root-servers.net. IN A 127.0.0.1" >> subdir/root.ca
+echo ". CH NS b.root-servers.net." > subdir/root.cb
+echo "b.root-servers.net. CH A 127.0.0.1" >> subdir/root.cb
+echo ". HS NS c.root-servers.net." > subdir/root.cc
+echo "c.root-servers.net. HS A 127.0.0.1" >> subdir/root.cc
+echo "" > subdir/trustkeys.conf
+echo "" > subdir/trustkeys2.conf
+echo "" > subdir/trustkeys3.conf
+echo "" > subdir/trustanchor.conf
+echo "" > subdir/trustanchor2.conf
+echo "" > subdir/trustanchor3.conf
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 1"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: $cwd
+	directory: "subdir"
+	username: $user
+
+	pidfile: "/unbound.pid"
+	root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "/subdir/trustanchor.conf"
+	trust-anchor-file: "trustanchor.conf"
+
+	trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 2"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: $cwd
+	directory: "/subdir"
+	username: $user
+
+	pidfile: "/unbound.pid"
+	root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "/subdir/trustanchor.conf"
+	trust-anchor-file: "trustanchor.conf"
+
+	trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 3"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: "."
+	directory: "./subdir"
+	username: $user
+
+	pidfile: "/unbound.pid"
+	root-hints: "root.ca"
+	#root-hints: "$subdir/root.cb"
+	root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	#trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "/subdir/trustanchor.conf"
+	trust-anchor-file: "trustanchor.conf"
+
+	trusted-keys-file: "trustkeys.conf"
+	#trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 1; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 4"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: ""
+	directory: "subdir"
+	username: $user
+
+	pidfile: "/unbound.pid"
+	root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	#root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	#trust-anchor-file: "/subdir/trustanchor.conf"
+	trust-anchor-file: "trustanchor.conf"
+
+	trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	#trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 5"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: ""
+	directory: ""
+	username: $user
+
+	pidfile: "/unbound.pid"
+	#root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	root-hints: "subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "subdir/trustanchor.conf"
+	#trust-anchor-file: "trustanchor.conf"
+
+	#trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 6"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: "."
+	directory: ""
+	username: $user
+
+	pidfile: "/nosubdir/unbound.pid"
+	#root-hints: "root.ca"
+	#root-hints: "$subdir/root.cb"
+	root-hints: "subdir/root.cc"
+
+	logfile: "output.log"
+
+	#trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "subdir/trustanchor.conf"
+	#trust-anchor-file: "trustanchor.conf"
+
+	#trusted-keys-file: "trustkeys.conf"
+	#trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 1; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 7"
+
+### NEXT TEST
+
+cat > test.conf <<EOF
+server:
+	chroot: $cwd
+	directory: ""
+	username: $user
+
+	pidfile: "/unbound.pid"
+	#root-hints: "root.ca"
+	root-hints: "$subdir/root.cb"
+	root-hints: "/subdir/root.cc"
+
+	logfile: "output.log"
+
+	trust-anchor-file: "$subdir/trustanchor.conf"
+	trust-anchor-file: "/subdir/trustanchor.conf"
+	#trust-anchor-file: "trustanchor.conf"
+
+	#trusted-keys-file: "trustkeys.conf"
+	trusted-keys-file: "$subdir/trustkeys2.conf"
+	trusted-keys-file: "/subdir/trustkeys3.conf"
+EOF
+
+$PRE/unbound-checkconf test.conf
+if test $? -ne 0; then
+	echo "Checkconf of config with chroot inside it failed"
+	exit 1
+fi
+echo "OK 8"
+
+
+exit 0
diff --git a/testdata/07-confroot.tpkg b/testdata/07-confroot.tpkg
deleted file mode 100644
index 705c7087661b..000000000000
--- a/testdata/07-confroot.tpkg
+++ /dev/null
diff --git a/testdata/08-host-lib.tdir/08-host-lib.dsc b/testdata/08-host-lib.tdir/08-host-lib.dsc
new file mode 100644
index 000000000000..c7c18b41bcaf
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.dsc
@@ -0,0 +1,16 @@
+BaseName: 08-host-lib
+Version: 1.0
+Description: Test async lookup using libunbound
+CreationDate: Fri May 16 13:21:58 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: 08-host-lib.pre
+Post: 08-host-lib.post
+Test: 08-host-lib.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/08-host-lib.tdir/08-host-lib.hosts b/testdata/08-host-lib.tdir/08-host-lib.hosts
new file mode 100644
index 000000000000..fa5e5482e72f
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.hosts
@@ -0,0 +1,12 @@
+# Host Database
+#
+# This file should contain the addresses and aliases for local hosts that
+# share this file.  Replace 'my.domain' below with the domainname of your
+# machine.
+#
+::1                     localhost localhost.my.domain
+127.0.0.1               localhost localhost.my.domain
+# Imaginary network.
+10.0.0.2               myname.my.domain myname
+10.0.0.3               myfriend.my.domain myfriend
+10.20.30.40		virtual.virtual.virtual.local
diff --git a/testdata/08-host-lib.tdir/08-host-lib.post b/testdata/08-host-lib.tdir/08-host-lib.post
new file mode 100644
index 000000000000..26b046ada5d2
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.post
@@ -0,0 +1,10 @@
+# #-- 08-host-lib.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+. ../common.sh
+kill_pid $FWD_PID
diff --git a/testdata/08-host-lib.tdir/08-host-lib.pre b/testdata/08-host-lib.tdir/08-host-lib.pre
new file mode 100644
index 000000000000..84817891ff93
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.pre
@@ -0,0 +1,19 @@
+# #-- 08-host-lib.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+FWD_PORT=$(($RND_PORT + 1))
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT 08-host-lib.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
diff --git a/testdata/08-host-lib.tdir/08-host-lib.test b/testdata/08-host-lib.tdir/08-host-lib.test
new file mode 100644
index 000000000000..8de897776209
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.test
@@ -0,0 +1,194 @@
+# #-- 08-host-lib.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+if grep FORK $PRE/config.h | grep "define" >/dev/null 2>&1; then
+	# nothing
+	:
+else
+	echo "forking is not available; test skipped."
+	exit 0
+fi
+
+# test if fwder is up
+echo "> dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile"
+dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile
+if grep "10.20.30.40" outfile; then
+	echo "fwder is up"
+else
+	cat fwd.log
+	echo "fwder not up"
+	exit 1
+fi
+rm outfile
+
+# create asynclook
+get_make
+echo "> (cd $PRE ; $MAKE asynclook)"
+(cd $PRE ; $MAKE asynclook)
+if test ! -x $PRE/asynclook; then
+	echo "cannot build asynclook test program"
+	exit 1
+fi
+(cd $PRE ; $MAKE lock-verify)
+
+# check the locks.
+function locktest() {
+	if test -x $PRE/lock-verify -a -f ublocktrace.0; then
+		$PRE/lock-verify ublocktrace.*
+		if test $? -ne 0; then
+			echo "lock-verify error"
+			exit 1
+		fi
+	fi
+}
+
+# test hosts reading (directed at local auth info)
+echo '> $PRE/asynclook -H 08-host-lib.hosts virtual.virtual.virtual.local 2>&1 | tee outfile'
+$PRE/asynclook -H 08-host-lib.hosts virtual.virtual.virtual.local 2>&1 | tee outfile
+if grep "virtual.virtual.virtual.local: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+# test async lookups (directed at testns)
+echo '> $PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com 2>&1 | tee outfile'
+$PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo '> $PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo '> $PRE/asynclook -t -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+# test cancellation
+echo '> $PRE/asynclook -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo '> $PRE/asynclook -t -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -c -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: cancelled" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+# test blocking mode
+echo '> $PRE/asynclook -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo '> $PRE/asynclook -t -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile'
+$PRE/asynclook -t -b -f "127.0.0.1@"$FWD_PORT www.example.com www2.example.com 2>&1 | tee outfile
+if grep "www.example.com: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+if grep "www2.example.com: 10.20.30.42" outfile; then
+	echo "OK"
+else
+	cat fwd.log
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo "> cat logfiles"
+cat fwd.log 
+exit 0
diff --git a/testdata/08-host-lib.tdir/08-host-lib.testns b/testdata/08-host-lib.tdir/08-host-lib.testns
new file mode 100644
index 000000000000..6245ae164172
--- /dev/null
+++ b/testdata/08-host-lib.tdir/08-host-lib.testns
@@ -0,0 +1,35 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+; for priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+@	IN	NS
+SECTION ANSWER
+@	IN	NS	127.0.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/08-host-lib.tpkg b/testdata/08-host-lib.tpkg
deleted file mode 100644
index 818ed5bca19a..000000000000
--- a/testdata/08-host-lib.tpkg
+++ /dev/null
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.conf b/testdata/09-unbound-control.tdir/09-unbound-control.conf
new file mode 100644
index 000000000000..ba55e34e8869
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.conf
@@ -0,0 +1,24 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.dsc b/testdata/09-unbound-control.tdir/09-unbound-control.dsc
new file mode 100644
index 000000000000..7b4436789e41
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.dsc
@@ -0,0 +1,16 @@
+BaseName: 09-unbound-control
+Version: 1.0
+Description: 09 test unbound-control remote control tool
+CreationDate: Mon Sep 15 11:14:08 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: 09-unbound-control.pre
+Post: 09-unbound-control.post
+Test: 09-unbound-control.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.post b/testdata/09-unbound-control.tdir/09-unbound-control.post
new file mode 100644
index 000000000000..4269fee1b5da
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.post
@@ -0,0 +1,13 @@
+# #-- 09-unbound-control.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+# it was stopped with unbound-control (if the test succeeded)
+kill $UNBOUND_PID >/dev/null 2>&1
+kill $UNBOUND_PID >/dev/null 2>&1
+exit 0
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.pre b/testdata/09-unbound-control.tdir/09-unbound-control.pre
new file mode 100644
index 000000000000..479e4a90bc0f
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.pre
@@ -0,0 +1,33 @@
+# #-- 09-unbound-control.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+CONTROL_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT 09-unbound-control.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < 09-unbound-control.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.test b/testdata/09-unbound-control.tdir/09-unbound-control.test
new file mode 100644
index 000000000000..f683bf41758c
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.test
@@ -0,0 +1,406 @@
+# #-- 09-unbound-control.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# exit value is 1 on usage
+$PRE/unbound-control -h
+if test $? -ne 1; then
+	echo "wrong exit value for usage."
+	exit 1
+else
+	echo "exit value for usage: OK"
+fi
+
+# use lock-verify if possible
+
+# test if the server is up.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# exit value is 1 when a bad command is given.
+echo "$PRE/unbound-control -c ub.conf blablargh"
+$PRE/unbound-control -c ub.conf blablargh
+if test $? -ne 1; then
+	echo "wrong exit value on error."
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.lo
+	exit 1
+else
+	echo "correct exit value on error"
+fi
+
+# reload the server. test if the server came up by putting a new
+# local-data element in the server.
+echo "server: local-data: 'afterreload. IN A 5.6.7.8'" >> ub.conf
+echo "$PRE/unbound-control -c ub.conf reload"
+$PRE/unbound-control -c ub.conf reload
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "> dig afterreload."
+dig @127.0.0.1 -p $UNBOUND_PORT afterreload. | tee outfile
+echo "> check answer"
+if grep "5.6.7.8" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# must have had queries now.  1 since reload.
+echo "$PRE/unbound-control -c ub.conf stats"
+$PRE/unbound-control -c ub.conf stats > tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+if grep "^total.num.queries=[1-9][0-9]*$" tmp.$$; then
+	echo "OK"
+else
+	echo "bad stats"
+	cat tmp.$$
+	exit 1
+fi
+
+# verbosity
+echo "$PRE/unbound-control -c ub.conf verbosity 2"
+$PRE/unbound-control -c ub.conf verbosity 2
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# check syntax error in parse 
+echo "$PRE/unbound-control -c ub.conf verbosity jkdf"
+$PRE/unbound-control -c ub.conf verbosity jkdf
+if test $? -ne 1; then
+	echo "wrong exit value after failure"
+	exit 1
+fi
+
+# check bad credentials
+cp ub.conf bad.conf
+echo "remote-control:" >> bad.conf
+echo "	server-key-file: bad_server.key" >> bad.conf
+echo "	server-cert-file: bad_server.pem" >> bad.conf
+echo "	control-key-file: bad_control.key" >> bad.conf
+echo "	control-cert-file: bad_control.pem" >> bad.conf
+echo "$PRE/unbound-control -c bad.conf verbosity 2"
+$PRE/unbound-control -c bad.conf verbosity 2
+if test $? -ne 1; then
+	echo "wrong exit value after failure"
+	exit 1
+fi
+
+# check spoofedclient credentials
+rm -f bad.conf
+cp ub.conf bad.conf
+echo "remote-control:" >> bad.conf
+echo "	server-key-file: unbound_server.key" >> bad.conf
+echo "	server-cert-file: unbound_server.pem" >> bad.conf
+echo "	control-key-file: bad_control.key" >> bad.conf
+echo "	control-cert-file: bad_control.pem" >> bad.conf
+echo "$PRE/unbound-control -c bad.conf verbosity 2"
+$PRE/unbound-control -c bad.conf verbosity 2
+if test $? -ne 1; then
+	echo "wrong exit value after failure"
+	exit 1
+fi
+
+# create a new local zone
+echo "> test of local zone"
+echo "$PRE/unbound-control -c ub.conf local_zone example.net static"
+$PRE/unbound-control -c ub.conf local_zone example.net static
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1"
+$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# check that www.example.net exists
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# check that mail.example.net has nxdomain
+echo "> dig mail.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT mail.example.net. | tee outfile
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# remove www.example.net - check it gets nxdomain
+echo "$PRE/unbound-control -c ub.conf local_data_remove www.example.net"
+$PRE/unbound-control -c ub.conf local_data_remove www.example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# remove nonexistent name - check bug#287(segfault) does not happen.
+echo "$PRE/unbound-control -c ub.conf local_data_remove test.example.net"
+$PRE/unbound-control -c ub.conf local_data_remove test.example.net
+# if crash then then we get: error: could not SSL_read from unbound-control
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# remove example.net - check its gone.
+echo "$PRE/unbound-control -c ub.conf local_zone_remove example.net"
+$PRE/unbound-control -c ub.conf local_zone_remove example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# dump the cache
+echo "> test cache dump"
+# fillup cache
+echo "dig www.example.com"
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com.
+echo "$PRE/unbound-control -c ub.conf dump_cache"
+$PRE/unbound-control -c ub.conf dump_cache > tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+cat tmp.$$
+if grep 10.20.30.40 tmp.$$; then
+	echo "OK example.com is in cache dump"
+else
+	echo "Not OK cache dump"
+	exit 1
+fi
+
+# test lookup 
+echo "$PRE/unbound-control -c ub.conf lookup www.example.com"
+$PRE/unbound-control -c ub.conf lookup www.example.com
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+# answer to lookup is meaningless because of use a forwarder, oh well.
+
+# load the cache dump.
+echo "$PRE/unbound-control -c ub.conf load_cache < tmp.$$"
+$PRE/unbound-control -c ub.conf load_cache < tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# load local-zones from file
+echo "$PRE/unbound-control -c ub.conf local_zones < local_zones"
+$PRE/unbound-control -c ub.conf local_zones < local_zones
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig localzonefromfile."
+dig @127.0.0.1 -p $UNBOUND_PORT localzonefromfile | tee outfile
+echo "> check answer"
+if grep "REFUSED" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# load local-data from file
+echo "$PRE/unbound-control -c ub.conf local_datas < local_data"
+$PRE/unbound-control -c ub.conf local_datas < local_data
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig localdatafromfile."
+dig @127.0.0.1 -p $UNBOUND_PORT -t txt localdatafromfile | tee outfile
+echo "> check answer"
+if grep "local data from file OK" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# remove local-zone and local-data from file
+echo "$PRE/unbound-control -c ub.conf local_zones_remove < local_zones_remove"
+$PRE/unbound-control -c ub.conf local_zones_remove < local_zones_remove
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "$PRE/unbound-control -c ub.conf local_datas_remove < local_data_remove"
+$PRE/unbound-control -c ub.conf local_datas_remove < local_data_remove
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> check zone and data removal list_local_zones"
+$PRE/unbound-control -c ub.conf list_local_zones | tee outfile
+if grep "localzonefromfile" outfile; then
+	echo "Not OK"
+	exit 1
+fi
+if grep "local data from file OK" outfile; then
+	echo "Not OK"
+	exit 1
+fi
+if grep "otherlocalzone" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# flushing
+echo "$PRE/unbound-control -c ub.conf flush www.example.net"
+$PRE/unbound-control -c ub.conf flush www.example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "$PRE/unbound-control -c ub.conf flush_type www.example.net TXT"
+$PRE/unbound-control -c ub.conf flush_type www.example.net TXT
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "$PRE/unbound-control -c ub.conf flush_zone example.net"
+$PRE/unbound-control -c ub.conf flush_zone example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# now stop the server
+echo "$PRE/unbound-control -c ub.conf stop"
+$PRE/unbound-control -c ub.conf stop
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+# see if the server has really exited.
+TRY_MAX=20
+for (( try=0 ; try <= $TRY_MAX ; try++ )) ; do
+	if kill -0 $UNBOUND_PID 2>&1 | tee tmp.$$; then
+		echo "not stopped yet, waiting"
+		sleep 1
+	else
+		echo "stopped OK; break"
+		break;
+	fi
+	if grep "No such process" tmp.$$; then
+		echo "stopped OK; break"
+		break;
+	fi
+done
+if kill -0 $UNBOUND_PID; then
+	echo "still up!"
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "not stopped, failure"
+	exit 1
+else
+	echo "stopped OK"
+
+        if test -f ublocktrace.0; then
+		if $PRE/lock-verify ublocktrace.*; then
+			echo "lock-verify test worked."
+		else
+			echo "lock-verify test failed."
+			cat fwd.log 
+			cat unbound.log
+			exit 1
+		fi
+	fi
+fi
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> OK"
+exit 0
diff --git a/testdata/09-unbound-control.tdir/09-unbound-control.testns b/testdata/09-unbound-control.tdir/09-unbound-control.testns
new file mode 100644
index 000000000000..0c911ca5b30e
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/09-unbound-control.testns
@@ -0,0 +1,22 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA SERVFAIL
+ADJUST copy_id
+SECTION QUESTION
+www.example.net.	IN	A
+ENTRY_END
+
diff --git a/testdata/09-unbound-control.tdir/bad_control.key b/testdata/09-unbound-control.tdir/bad_control.key
new file mode 100644
index 000000000000..d29cdbc91b37
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/bad_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
+SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
+DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
+AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
+PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
+PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
+IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
+GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
+q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
+neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
+IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
+ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
+RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/bad_control.pem b/testdata/09-unbound-control.tdir/bad_control.pem
new file mode 100644
index 000000000000..e06b847208e3
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/bad_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
+i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
+UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
+nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
+4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
+5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
+-----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/bad_server.key b/testdata/09-unbound-control.tdir/bad_server.key
new file mode 100644
index 000000000000..0dbb134b5be7
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/bad_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
+1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
+UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
+AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
+3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
+FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
+Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
+i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
+2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
+LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
+CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
+/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
+2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/bad_server.pem b/testdata/09-unbound-control.tdir/bad_server.pem
new file mode 100644
index 000000000000..983247ac73bd
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/bad_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
+RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
+DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
+Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
+zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
+O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
+oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
+-----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/local_data b/testdata/09-unbound-control.tdir/local_data
new file mode 100644
index 000000000000..54e6e93b4dd9
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/local_data
@@ -0,0 +1 @@
+localdatafromfile 3600 TXT "local data from file OK"
diff --git a/testdata/09-unbound-control.tdir/local_data_remove b/testdata/09-unbound-control.tdir/local_data_remove
new file mode 100644
index 000000000000..fcb8239589e3
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/local_data_remove
@@ -0,0 +1 @@
+localdatafromfile
diff --git a/testdata/09-unbound-control.tdir/local_zones b/testdata/09-unbound-control.tdir/local_zones
new file mode 100644
index 000000000000..4c65f712fbb2
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/local_zones
@@ -0,0 +1,2 @@
+localzonefromfile refuse
+otherlocalzone	static
diff --git a/testdata/09-unbound-control.tdir/local_zones_remove b/testdata/09-unbound-control.tdir/local_zones_remove
new file mode 100644
index 000000000000..1d215585515a
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/local_zones_remove
@@ -0,0 +1 @@
+localzonefromfile
diff --git a/testdata/09-unbound-control.tdir/unbound_control.key b/testdata/09-unbound-control.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/unbound_control.pem b/testdata/09-unbound-control.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/unbound_server.key b/testdata/09-unbound-control.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/unbound_server.pem b/testdata/09-unbound-control.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/09-unbound-control.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tpkg b/testdata/09-unbound-control.tpkg
deleted file mode 100644
index d5b11b77f044..000000000000
--- a/testdata/09-unbound-control.tpkg
+++ /dev/null
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.conf b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.conf
new file mode 100644
index 000000000000..bb125c0d5c55
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.conf
@@ -0,0 +1,8 @@
+# test config to direct traffic to testns.
+server:
+	do-not-query-localhost: no
+	fake-sha1: yes
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.dsc b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.dsc
new file mode 100644
index 000000000000..869dfafe4310
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.dsc
@@ -0,0 +1,16 @@
+BaseName: 10-unbound-anchor
+Version: 1.0
+Description: Test unbound-anchor for 5011 and cert update.
+CreationDate: Thu Sep 30 15:35:09 CEST 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: 10-unbound-anchor.pre
+Post: 10-unbound-anchor.post
+Test: 10-unbound-anchor.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.post b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.post
new file mode 100644
index 000000000000..b1112940456b
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.post
@@ -0,0 +1,10 @@
+# #-- 10-unbound-anchor.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $PETAL_PID
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.pre b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.pre
new file mode 100644
index 000000000000..acf223277514
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.pre
@@ -0,0 +1,33 @@
+# #-- 10-unbound-anchor.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+PRE="../.."
+get_random_port 2
+PETAL_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "PETAL_PORT=$PETAL_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+get_make
+(cd $PRE; $MAKE petal)
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT 10-unbound-anchor.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start https daemon
+$PRE/petal -v -a "127.0.0.1" -p $PETAL_PORT >petal.log 2>&1 &
+PETAL_PID=$!
+echo "PETAL_PID=$PETAL_PID" >> .tpkg.var.test
+cat .tpkg.var.test
+sed -e "s/@TOPORT@/$FWD_PORT/" < 10-unbound-anchor.conf > ub.conf
+
+wait_ldns_testns_up fwd.log
+wait_petal_up petal.log
+
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.test b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.test
new file mode 100644
index 000000000000..46cea626cb00
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.test
@@ -0,0 +1,162 @@
+# #-- 10-unbound-anchor.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+OPTS="-u 127.0.0.1 -P $PETAL_PORT -C ub.conf -v -a root.key -c root.pem -n petal"
+DS=`cat K.+005+37348.ds`
+
+# check that the root.key file works.
+function check_works() {
+	if $PRE/unbound-host -C ub.conf -f root.key -t DNSKEY -v . | grep "(secure)" >/dev/null; then
+		echo OK
+	else
+		echo "not OK"
+		cat fwd.log
+		cat petal.log
+		exit 1
+	fi
+}
+
+# check that the root.key file works, but insecurely.
+function check_insecure() {
+	if $PRE/unbound-host -C ub.conf -f root.key -t DNSKEY -v . | grep "(insecure)" >/dev/null; then
+		echo OK
+	else
+		echo "not OK"
+		cat fwd.log
+		cat petal.log
+		exit 1
+	fi
+}
+
+# test with good start key, and must do 5011 (no URL possible)
+echo "*** TEST 1 ***"
+echo $DS > root.key
+$PRE/unbound-anchor -x "notexist.xml" -s "notexist.p7s" $OPTS
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+check_works
+# save for test 5
+cp root.key root.key.probed
+
+# force update with the cert.
+echo "*** TEST 2 ***"
+cp test_cert.pem root.pem
+$PRE/unbound-anchor -F -x "root.xml" -s "root.p7s" $OPTS
+if test $? != 1; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+check_works
+
+# 5011 fails
+echo "*** TEST 3 ***"
+echo ".	IN DS 37000 5 1 b00000000000000000000100f0000000000000b2" > root.key
+$PRE/unbound-anchor -x "root.xml" -s "root.p7s" $OPTS
+if test $? != 1; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+check_works
+
+# cert fails (bad p7s).
+echo "*** TEST 4 ***"
+echo ".	IN DS 44444 5 1 b00000000000000000000100f0000000000000b2" > root.key
+$PRE/unbound-anchor -F -x "bad.xml" -s "bad.p7s" $OPTS
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+if grep "DS 44444" root.key >/dev/null ; then
+	echo OK
+else
+	echo "keyfile changed"
+	exit 1
+fi
+
+# cert fails (bad name).
+echo "*** TEST 4b ***"
+echo ".	IN DS 44444 5 1 b00000000000000000000100f0000000000000b2" > root.key
+$PRE/unbound-anchor -F -x "bad.xml" -s "bad.p7s" $OPTS -n "not-it"
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+if grep "DS 44444" root.key >/dev/null ; then
+	echo OK
+else
+	echo "keyfile changed"
+	exit 1
+fi
+
+# 5011 fails, and probe-time too recent.
+echo "*** TEST 5 ***"
+# break the probed key.
+sed -e 's/bp0KIK3J3/b00KIK0J0/' < root.key.probed > root.key
+$PRE/unbound-anchor -x "notexist.xml" -s "notexist.p7s" $OPTS
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+if grep "b00KIK0J0" root.key >/dev/null ; then
+	echo OK
+else
+	echo "keyfile changed"
+	exit 1
+fi
+
+# 5011 fails, and probe time is very, very old.
+echo "*** TEST 6 ***"
+mv root.key bla.key
+# last probe was Sun Sep  9 03:46:40 2001
+sed -e 's/;;last_success: .*$/;;last_success: 1000000000/' < bla.key > root.key
+rm bla.key
+$PRE/unbound-anchor -x "root.xml" -s "root.p7s" $OPTS
+if test $? != 1; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+check_works
+
+# 5011 update probe is only needed.
+echo "*** TEST 7 ***"
+$PRE/unbound-anchor -x "notexist.xml" -s "notexist.p7s" $OPTS
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+check_works
+
+# root goes to insecure (0 anchors).
+echo "*** TEST 8 ***"
+$PRE/unbound-anchor -F -x "no_more_keys.xml" -s "no_more_keys.p7s" $OPTS
+if test $? != 1; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+if grep ";;REVOKED" root.key >/dev/null; then echo "REVOKED"; else
+	echo "not revoked"; exit 1; fi
+check_insecure
+
+# insecure input file
+echo "*** TEST 9 ***"
+$PRE/unbound-anchor -x "notexist.xml" -s "notexist.p7s" $OPTS
+if test $? != 0; then
+	echo "Exitcode not OK"
+	exit 1
+fi
+if grep ";;REVOKED" root.key >/dev/null; then echo "REVOKED"; else
+	echo "not revoked"; exit 1; fi
+check_insecure
+
+
+echo "logs"
+cat fwd.log
+cat petal.log
+
+exit 0
diff --git a/testdata/10-unbound-anchor.tdir/10-unbound-anchor.testns b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.testns
new file mode 100644
index 000000000000..9aaf75bc06ac
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/10-unbound-anchor.testns
@@ -0,0 +1,17 @@
+; nameserver test file
+$ORIGIN .
+$TTL 3600
+
+; for easy test: valid until 2030.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+.	IN	DNSKEY
+SECTION ANSWER
+.       3600    IN      DNSKEY  257 3 5 AwEAAcjV/I6yYY0LGBEqBFZS0K6zcbCVAfarbOoCKBUEfsR/nVdy3pwMydXopUVhg4Z07tTu8w2gYTPALPv5E6EJFJebA34R0OcvTPRDr3671zVwZO9HyQK+RuT/0d7G/pdCeJX2gHHiVrG796nf078O/agtojZ8+HJ1V3oLnDZYBSDWv2oL2LB2Mpj+610W7RrmEmQQm2KaMP6aX3YMbAyBIrDjVzJTir4/WwJEHRHq59Xw91egJkS2bp0KIK3J3tQFqw== ;{id = 37348 (ksk), size = 1536b}
+.	3600	IN	RRSIG	DNSKEY 5 0 3600 20300930162500 20100530162500 37348 . tjIVLqaVr2o1pLYxNbozR8OxPnGnCJN/rROZoIVzjEgvofyHx24hGMXak6lIlLHZ9GSmOxUM/71MeunhSdMqfjsoktc7MkpB8eR6ATePjdaPTdRH519wHH7qEkHj5WJNKvJOvG7Q9xs6O3KANErr+iotHjOJYpgbmZFoENJvLzqj4FVJ0bIglgD+SZGJGv9/qA+eWAK7WuWSe+ulMU/WH/SnxB/NKDjSAa//TyjzLhlIRR5UTjLIUymWxG4D3TbJ ;{id = 37348}
+
+ENTRY_END
+
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.p7s
new file mode 100644
index 000000000000..afbdb1b91388
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.p7s
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.xml b/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.xml
new file mode 100644
index 000000000000..48abe26f5408
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<TrustAnchor id="AD42165F-3B1A-4778-8F42-D34A1D41FD93" source="http://data.iana.org/root-anchors/root-anchors.xml">
+<Zone>.</Zone>
+<KeyDigest id="Kjqmt7v" validFrom="2010-07-15T00:00:00+00:00">
+<KeyTag>37348</KeyTag>
+<Algorithm>5</Algorithm>
+<DigestType>1</DigestType>
+<Digest>b56a31943f14faa31224d147f8b1107b78590000</Digest>
+</KeyDigest>
+</TrustAnchor>
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s
new file mode 100644
index 000000000000..c76b5b6e4754
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.xml b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.xml
new file mode 100644
index 000000000000..ac5cd48af7e2
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<TrustAnchor id="AD42165F-3B1A-4778-8F42-D34A1D41FD93" source="http://data.iana.org/root-anchors/root-anchors.xml">
+<Zone>.</Zone>
+<KeyDigest id="Kjqmt7v" validFrom="2010-07-15T00:00:00+00:00" validUntil="2010-07-16T00:00:00+00:00">
+<KeyTag>37348</KeyTag>
+<Algorithm>5</Algorithm>
+<DigestType>1</DigestType>
+<Digest>b56a31943f14faa31224d147f8b1107b78598eb2</Digest>
+</KeyDigest>
+<KeyDigest id="Kjqmt7v" validFrom="2010-07-18T00:00:00+00:00" validUntil="2010-07-19T00:00:00+00:00">
+<KeyTag>37348</KeyTag>
+<Algorithm>5</Algorithm>
+<DigestType>1</DigestType>
+<Digest>b56a31943f14faa31224d147f8b1107b78598eb2</Digest>
+</KeyDigest>
+</TrustAnchor>
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s
new file mode 100644
index 000000000000..afbdb1b91388
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/root.xml b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.xml
new file mode 100644
index 000000000000..d330d1a31dc9
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<TrustAnchor id="AD42165F-3B1A-4778-8F42-D34A1D41FD93" source="http://data.iana.org/root-anchors/root-anchors.xml">
+<Zone>.</Zone>
+<KeyDigest id="Kjqmt7v" validFrom="2010-07-15T00:00:00+00:00">
+<KeyTag>37348</KeyTag>
+<Algorithm>5</Algorithm>
+<DigestType>1</DigestType>
+<Digest>b56a31943f14faa31224d147f8b1107b78598eb2</Digest>
+</KeyDigest>
+</TrustAnchor>
diff --git a/testdata/10-unbound-anchor.tdir/K.+005+37348.ds b/testdata/10-unbound-anchor.tdir/K.+005+37348.ds
new file mode 100644
index 000000000000..1b98f044f475
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/K.+005+37348.ds
@@ -0,0 +1 @@
+.	3600	IN	DS	37348 5 1 b56a31943f14faa31224d147f8b1107b78598eb2 ; xotek-pusin-gezoc-gevep-feged-gigyg-livor-cagil-riveh-nafar-duxix
diff --git a/testdata/10-unbound-anchor.tdir/K.+005+37348.key b/testdata/10-unbound-anchor.tdir/K.+005+37348.key
new file mode 100644
index 000000000000..65506139333a
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/K.+005+37348.key
@@ -0,0 +1 @@
+.	3600	IN	DNSKEY	257 3 5 AwEAAcjV/I6yYY0LGBEqBFZS0K6zcbCVAfarbOoCKBUEfsR/nVdy3pwMydXopUVhg4Z07tTu8w2gYTPALPv5E6EJFJebA34R0OcvTPRDr3671zVwZO9HyQK+RuT/0d7G/pdCeJX2gHHiVrG796nf078O/agtojZ8+HJ1V3oLnDZYBSDWv2oL2LB2Mpj+610W7RrmEmQQm2KaMP6aX3YMbAyBIrDjVzJTir4/WwJEHRHq59Xw91egJkS2bp0KIK3J3tQFqw== ;{id = 37348 (ksk), size = 1536b}
diff --git a/testdata/10-unbound-anchor.tdir/K.+005+37348.private b/testdata/10-unbound-anchor.tdir/K.+005+37348.private
new file mode 100644
index 000000000000..1e4f9c51f410
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/K.+005+37348.private
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: yNX8jrJhjQsYESoEVlLQrrNxsJUB9qts6gIoFQR+xH+dV3LenAzJ1eilRWGDhnTu1O7zDaBhM8As+/kToQkUl5sDfhHQ5y9M9EOvfrvXNXBk70fJAr5G5P/R3sb+l0J4lfaAceJWsbv3qd/Tvw79qC2iNnz4cnVXegucNlgFINa/agvYsHYymP7rXRbtGuYSZBCbYpow/ppfdgxsDIEisONXMlOKvj9bAkQdEern1fD3V6AmRLZunQogrcne1AWr
+PublicExponent: AQAB
+PrivateExponent: XKH2f4rfW8LGMwSCQ56nCi1SPvQ7l56x+a1M94S/Q7row7ED5E4xuiw4LqwvkhDVJ/meuaZDry7wkLftydT6XoLtNXTaOgejIvclNvtE5C0XIRanLFC/OliUYIDAZNwPGVCYX8ZIfcbi1Sp5Ng9EofCb1haSGn/Wnar31knaweRdTrAUIPl49+QhJmaHCrTtHVuYEOZjIaOPSGIBvxZAk//3yF6FXY3RVRaNRTcELWvLclSdtt52etVV0/SEWhjh
+Prime1: 4wEpv8UVvqOkOKSxeu1ao42FWHwqzwUdFyNeKrUxg3E7ad5i9V0aaFhqbJKzQtVUreeEtoXsSRvjvbWJ4wSCwEay1qVD4xEJ4UFtasESxQvv1iVsBQ7zEywRkwSIT46/
+Prime2: 4n0h+1TXflSEqdxC4lPiwyIC/z+1iyq0kFru70SB395S44HAynbQBdsapZX29msfl+/tiu2DncIXe1oVaDDqPpbrOT5NZMH9xQnZDSCbM8l7Gyx5UB3MsbT+71J2VrAV
+Exponent1: p81LTDvmyAZ1NX3gyCq+TpolkPQwPNnd2CXHzTAlirFgJvFCG3gYNjvtZ5bFtki2ENtMShQTRzO7lJemds71zCY2ut5toWMN95oCxOA1/LzHLHh7Mf4MBwcTcqbuEElH
+Exponent2: w0ZyWxkuZxyF+VIQVMVQuT+E6ABNDX03i1LruV4OwC8WtlM0HxxLhREBK41eDd4UslJKM8NO/GDRECh+VoP+IxLKImPGJL5hh1ZTTs8zIXZw7t/shJf82acdOsiVgW51
+Coefficient: 10OZvNAPHe/wBO2+AO49EUohPksOxFy9dwspB1XUjlPB9zv93dUfZdou3pjZq1EkxnRChaAwmRMYxks3UiTmDuybMNzKlaFQajyB+UowjA1dStFYbDFpVrIqv6H0q7W2
diff --git a/testdata/10-unbound-anchor.tdir/keys/test_cert.key b/testdata/10-unbound-anchor.tdir/keys/test_cert.key
new file mode 100644
index 000000000000..b860b1b298e6
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/test_cert.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfAIBAAKBwQC48GhhmIU66TZKc3QiyF4L5bsm8Aly/y2SzLP+GACepK0OcOtD
+i2sXrTtoJDvGOPZ9ICqmIy8u/Q/cK26txNEeZFcClLcYF/U+NaqjEwrwkHEIgc3g
+8qnKrhzM61I8foAWVT7cqxFHDKYuClNITXk1i//Yzpnf9wvVKQ51W9UOtm/WA7g4
+IDHCuAjocyyNC3B7XqYawFDOsdMI4ZW7hC0hIRQOvBkvbvY8WxmsSkdd30u1KmoI
+Sg4y6OvnikrEEQkCAwEAAQKBwQC3hQlv37RF82sGkm8qnP6Ge+AuEYCu9v44cJ4k
+hZkH1I5OiEtN6anKAwOyolIWsCwZmrP3zW5jCIiWiRr5oReLOzMEwqK2a//XTdYY
+oSr38b3ZHUY59VP8Zq75woMGuNed35kAmGxzDRP1gI/TmvTvaHlqYyvxBtxnZJij
+Za1CrT+a9JvR6hI8xXrE33CF0T6JO1v3v0HeBuve5+83cCHKo+GyqIBjL3FJgefZ
+EsPz6rGnPDKTYgMyaljFV3LI5ikCYQDlaBnyiWk1C7tYO5x3CRoHoiuiiREZCncK
+QkSxjiDoSP0rc+3BQp2kG3yy6S9mN4qMQPELEtBa6bORogxNK+Pxg8TRI/+xgeFt
+bod5Bd4pfl6Y5hXm21JwELFlOzPI3PMCYQDOYK6Z7vegiOJyyAJXMjcI07H8S0Gr
+SZW8f4tHRzO+RrRpR5ANzarELX7nF/Qj5mPXiZNiiMDGocxqkNzIa5HFLOqBhRkv
+o7yC1Cj582dUBFHyEbsZxR6UMTPLdE3UaRMCYACC1Nv3dmaJ2ib+KwEQ4h/2Ooao
+K4OUxGMfdqu2l1gtIXNBVNxDW7qL3SFA57wgj4x0cJUHu7MYJjBC3igl2uIk2wFk
+RSOOGIR35JFec/o/r9JDYPUcs/hP8TU6hokCBQJgHbH/rZqa+vh3TPjGjXFmRdjg
+JWNWwaTG7OaVTd5K7bgSwYtQiQvs5Gl/dxUVRg0ilKLxGB6BTpN9bGAHxLbltK9v
+1s8l/praxyBr/PsvBQHSILi4aU7ZxY0G3OGRSV0NAmBx28Msdgc0yHh3qSkbwVEr
+gr7av1iOH73ee+o4CmMWXYUBHOMW5Su0s0QHjNGDMiRiRoCvzYqdLcJj9/sFJxOT
+CM35WGGeKDMNubX7C6YroQ91q7kUmhi7HHY3QOyhCDU=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/test_cert.pem b/testdata/10-unbound-anchor.tdir/keys/test_cert.pem
new file mode 100644
index 000000000000..6e588a4abc8f
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/test_cert.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICWTCCAYKgAwIBAgIJAN5YIkuCvJf5MA0GCSqGSIb3DQEBBQUAMCYxDjAMBgNV
+BAMTBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0xMzAxMTcxMTUyNDVa
+Fw0zMjEwMDQxMTUyNDVaMCYxDjAMBgNVBAMTBXBldGFsMRQwEgYJKoZIhvcNAQkB
+FgVwZXRhbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEAuPBoYZiFOuk2SnN0
+IsheC+W7JvAJcv8tksyz/hgAnqStDnDrQ4trF607aCQ7xjj2fSAqpiMvLv0P3Ctu
+rcTRHmRXApS3GBf1PjWqoxMK8JBxCIHN4PKpyq4czOtSPH6AFlU+3KsRRwymLgpT
+SE15NYv/2M6Z3/cL1SkOdVvVDrZv1gO4OCAxwrgI6HMsjQtwe16mGsBQzrHTCOGV
+u4QtISEUDrwZL272PFsZrEpHXd9LtSpqCEoOMujr54pKxBEJAgMBAAGjDzANMAsG
+A1UdDwQEAwIChDANBgkqhkiG9w0BAQUFAAOBwQCaA3ys5hDPMNV1oXIxH6u2KfAX
+C9tYJId/SR0x8whsZuNaSEZAgImdM5dnyWdjey8Pio772E9/F2aUBGFkdadZx4My
+d7hBfEi/NECEKs86k9g0ijbin41NKtnajb6GwyNQ9vDx7Z5FS8BZ3CD0BZIdCQUE
+gKuDSWBROQU3tqrjdk2QTwGQkj2mgzT871Jn1MwZw0mczPjS1y469Ejym8wi3uCd
+EboDOoGBCpmUQbxBv6JI75cUCdmNNEwjQjZ0XQw=
+-----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup b/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup
new file mode 100755
index 000000000000..3e593119909c
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup
@@ -0,0 +1,167 @@
+#!/bin/sh
+#
+# unbound-control-setup.sh - set up SSL certificates for unbound-control
+#
+# Copyright (c) 2008, NLnet Labs. All rights reserved.
+#
+# This software is open source.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 
+# Redistributions of source code must retain the above copyright notice,
+# this list of conditions and the following disclaimer.
+# 
+# Redistributions in binary form must reproduce the above copyright notice,
+# this list of conditions and the following disclaimer in the documentation
+# and/or other materials provided with the distribution.
+# 
+# Neither the name of the NLNET LABS nor the names of its contributors may
+# be used to endorse or promote products derived from this software without
+# specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+# settings:
+
+# directory for files
+DESTDIR=/usr/local/etc/unbound
+
+# issuer and subject name for certificates
+SERVERNAME=petal
+CLIENTNAME=unbound-anchor
+
+# validity period for certificates
+DAYS=7200
+
+# size of keys in bits
+BITS=1536
+
+# hash algorithm
+HASH=sha1
+
+# base name for unbound server keys
+SVR_BASE=test_cert
+
+# base name for unbound-control keys
+CTL_BASE=unbound_control
+
+# we want -rw-r--- access (say you run this as root: grp=yes (server), all=no).
+umask 0026
+
+# end of options
+
+# functions:
+error ( ) {
+	echo "$0 fatal error: $1"
+	exit 1
+}
+
+# check arguments:
+while test $# -ne 0; do
+	case $1 in
+	-d)
+	if test $# -eq 1; then error "need argument for -d"; fi
+	DESTDIR="$2"
+	shift
+	;;
+	*)
+	echo "unbound-control-setup.sh - setup SSL keys for unbound-control"
+	echo "	-d dir	use directory to store keys and certificates."
+	echo "		default: $DESTDIR"
+	echo "please run this command using the same user id that the "
+	echo "unboun daemon uses, it needs read privileges."
+	exit 1
+	;;
+	esac
+	shift
+done
+
+# go!:
+echo "setup in directory $DESTDIR"
+cd "$DESTDIR" || error "could not cd to $DESTDIR"
+
+# create certificate keys; do not recreate if they already exist.
+if test -f $SVR_BASE.key; then
+	echo "$SVR_BASE.key exists"
+else
+	echo "generating $SVR_BASE.key"
+	openssl genrsa -out $SVR_BASE.key $BITS || error "could not genrsa"
+fi
+if test -f $CTL_BASE.key; then
+	echo "$CTL_BASE.key exists"
+else
+	echo "generating $CTL_BASE.key"
+	openssl genrsa -out $CTL_BASE.key $BITS || error "could not genrsa"
+fi
+
+# create self-signed cert for server
+cat >request.cfg <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+x509_extensions=v3_ca
+
+[req_distinguished_name]
+commonName=$SERVERNAME
+emailAddress=$SERVERNAME
+
+[v3_ca]
+keyUsage=digitalSignature, keyCertSign
+EOF
+test -f request.cfg || error "could not create request.cfg"
+
+echo "create $SVR_BASE.pem (self signed certificate)"
+openssl req -key $SVR_BASE.key -config request.cfg  -new -x509 -days $DAYS -out $SVR_BASE.pem || error "could not create $SVR_BASE.pem"
+# create trusted usage pem
+openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"
+
+# create client request and sign it, piped
+cat >request.cfg <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+
+[req_distinguished_name]
+commonName=$CLIENTNAME
+EOF
+test -f request.cfg || error "could not create request.cfg"
+
+echo "create $CTL_BASE.pem (signed client certificate)"
+openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
+test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem"
+# create trusted usage pem
+# openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"
+
+# see details with openssl x509 -noout -text < $SVR_BASE.pem
+# echo "create $CTL_BASE""_browser.pfx (web client certificate)"
+# echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
+# echo "preferences - advanced - encryption - view certificates - your certs"
+# echo "empty password is used, simply click OK on the password dialog box."
+# openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate"
+
+# remove unused permissions
+chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key
+
+# remove crap
+rm -f request.cfg
+rm -f $CTL_BASE"_trust.pem" $SVR_BASE"_trust.pem" $SVR_BASE"_trust.srl"
+
+echo "Setup success. Certificates created. Enable in unbound.conf file to use"
+
+exit 0
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_control.key b/testdata/10-unbound-anchor.tdir/keys/unbound_control.key
new file mode 100644
index 000000000000..47d15dd3707f
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_control.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfAIBAAKBwQC2p0MTVVEfvOpaWlI6rLKGxaHfw/4JUxXCwDHRkkyB0hkISRMx
+8imB+io0aY2Uck9zl0BTgPaKtFeA0+lukZk75keOuATPFZwbCGs+6Tx5AoN4+NzI
+aVay5AuO8E1u6AVdmcAqByP+R92yz5f3T93/cSsYzqPZ6Y1wO9sabtrkGTYwnfMg
+nSttyvlBIhRDWbEO+rWL2CCi0JtrnpiK8sa2ysQCq9Y6ZiGjT9PEWIZwkxQ6y5TI
+WVtyitoknpDheZcCAwEAAQKBwAgeXSPh2e5ANmZ3t0n2XSUSacSJcKQ3djMm2dAH
+4bCvhv9QSDMjIWcumGul+W4Muq1XnrtXcx3tMCqAwNJyVE5OSQX19fjCbCLjd+je
+8xop23AoF6As1nazHjRnR/nTBD7QNx2xbaW8RNbaGpTe2G2lpdbg9myRpyqiB8Pk
+73x/AQcPqm4SHBJS+kU/Q9k9yZRHGQ/PhYlvAmY0SCndew28Pcs+IdCI32k7e/aP
+SCEQvVqKeIiSJ0Zj8RSk8Pz1cQJhANtNsvcEa2V8NxI9yL2zwvBXwoBuU+d9Pszt
+Ooqc/kmvU0FV06HgiIPtTSoHLI7Zh9h5Xn4DFGmtS8WeGhwSVCN1iwcW9F2ldgAw
+LXcoXjEK21KXYFNAYeo07vul/Ly/yQJhANU3lM8hAqq7FB4R5zgUCcp08FOVA8tl
+kEK1JoAdfp6Wv4M2xGJ6tmKcf92r0F8zBDV6oZX/dtPwFzWhBZUi+zaA8PcEqbwt
+CJtmM5ycoX6kkkIfXtAVNZiTIYHn01beXwJgQBFA+V03KtzREeku3gzIJILe9bpF
+lNlIIYIkmh4nQ8uOnQW/4AjCmRgYdPDHmav/PcSnUFUB/6V6/26i3hSUtA9A4H9a
+QIl4IbHxdmA6tEUhsc07fNbQRCXWs3nYjiPRAmEAjDe4MhsYYOUUzs2hTFzJL46F
+ucHGtA0/uM7e2eQLsAmdOpJaxhTDOsiGwmXKa8DmJLFX8IgHQkujR850GGbf5DEZ
+xqkXYrwO6/tjN7w97EYYNUniFV/NVmBz6bVmY7trAmAvvg7MoBlb/o6nwoCQqnUM
+QyjIy9A0t8+KHNMFSQwUldG+HIwiU4/7y2zCqBYJg8NOjrdj/3+73A24rP8wRp15
+zqQCS7mLLWmYx7pWE1ZHN8eY3xGoHmr7LzlB+dzYG+w=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem b/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem
new file mode 100644
index 000000000000..ec7cd7e7814d
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICNjCCAV8CCQCbt2WrJa/ewzANBgkqhkiG9w0BAQUFADAmMQ4wDAYDVQQDEwVw
+ZXRhbDEUMBIGCSqGSIb3DQEJARYFcGV0YWwwHhcNMTMwMTE3MTE1MjQ1WhcNMzIx
+MDA0MTE1MjQ1WjAZMRcwFQYDVQQDEw51bmJvdW5kLWFuY2hvcjCB3zANBgkqhkiG
+9w0BAQEFAAOBzQAwgckCgcEAtqdDE1VRH7zqWlpSOqyyhsWh38P+CVMVwsAx0ZJM
+gdIZCEkTMfIpgfoqNGmNlHJPc5dAU4D2irRXgNPpbpGZO+ZHjrgEzxWcGwhrPuk8
+eQKDePjcyGlWsuQLjvBNbugFXZnAKgcj/kfdss+X90/d/3ErGM6j2emNcDvbGm7a
+5Bk2MJ3zIJ0rbcr5QSIUQ1mxDvq1i9ggotCba56YivLGtsrEAqvWOmYho0/TxFiG
+cJMUOsuUyFlbcoraJJ6Q4XmXAgMBAAEwDQYJKoZIhvcNAQEFBQADgcEAhc3wYcbD
+Uu9Osbu3bhbxLCkhedq/3weEO8RDU3AyB8diioAikagIOb99UeVE3WIds+JIPD6J
+mK5UvS+lPR8SEOMRd0H91bEEp1Zn+gHAS/Z7k/x9t38Xk1N0jOnElc6n4vl42KLO
+z2laJWcte7YXjzFjaNxP9fsGgEx1vRxcjtpXQWSY+oj+RVm5kRs5WKX5MCyD/p+y
+Xitg7/a0ITKbW1GpVwaX6nPaeoze68m3qmy64l080XCna3igbhi3h2ay
+-----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_server.key b/testdata/10-unbound-anchor.tdir/keys/unbound_server.key
new file mode 100644
index 000000000000..6614e498fcd2
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_server.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
+RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
+QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
+O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
+J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
+Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
+mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
+qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
+6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
+lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
+Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
+XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
+Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
+C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
+EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
+3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
+F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
+kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
+berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem b/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem
new file mode 100644
index 000000000000..19c8b895ba86
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
+ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
+BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
+OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
+/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
+67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
+PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
+9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
+ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
+mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
+bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
+q7miNnkO8vd0maw=
+-----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/petal.key b/testdata/10-unbound-anchor.tdir/petal.key
new file mode 100644
index 000000000000..6614e498fcd2
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/petal.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
+RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
+QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
+O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
+J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
+Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
+mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
+qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
+6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
+lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
+Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
+XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
+Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
+C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
+EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
+3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
+F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
+kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
+berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/petal.pem b/testdata/10-unbound-anchor.tdir/petal.pem
new file mode 100644
index 000000000000..19c8b895ba86
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/petal.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
+ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
+BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
+OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
+/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
+67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
+PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
+9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
+ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
+mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
+bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
+q7miNnkO8vd0maw=
+-----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/signit b/testdata/10-unbound-anchor.tdir/signit
new file mode 100644
index 000000000000..dd60205223fb
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/signit
@@ -0,0 +1,10 @@
+# PKCS7 sign it
+#infile=127.0.0.1/no_more_keys.xml
+#outfile=127.0.0.1/no_more_keys.p7s
+infile=127.0.0.1/root.xml
+outfile=127.0.0.1/root.p7s
+set -v
+
+openssl smime -sign -in $infile -out $outfile -inkey test_cert.key -signer test_cert.pem -outform DER -binary || echo "could not sign"
+openssl smime -verify -content $infile -in $outfile -inform DER -CAfile test_cert.pem || echo "could not verify"
+openssl pkcs7 -print_certs -inform der -in $outfile -text
diff --git a/testdata/10-unbound-anchor.tdir/test_cert.key b/testdata/10-unbound-anchor.tdir/test_cert.key
new file mode 100644
index 000000000000..b860b1b298e6
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/test_cert.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfAIBAAKBwQC48GhhmIU66TZKc3QiyF4L5bsm8Aly/y2SzLP+GACepK0OcOtD
+i2sXrTtoJDvGOPZ9ICqmIy8u/Q/cK26txNEeZFcClLcYF/U+NaqjEwrwkHEIgc3g
+8qnKrhzM61I8foAWVT7cqxFHDKYuClNITXk1i//Yzpnf9wvVKQ51W9UOtm/WA7g4
+IDHCuAjocyyNC3B7XqYawFDOsdMI4ZW7hC0hIRQOvBkvbvY8WxmsSkdd30u1KmoI
+Sg4y6OvnikrEEQkCAwEAAQKBwQC3hQlv37RF82sGkm8qnP6Ge+AuEYCu9v44cJ4k
+hZkH1I5OiEtN6anKAwOyolIWsCwZmrP3zW5jCIiWiRr5oReLOzMEwqK2a//XTdYY
+oSr38b3ZHUY59VP8Zq75woMGuNed35kAmGxzDRP1gI/TmvTvaHlqYyvxBtxnZJij
+Za1CrT+a9JvR6hI8xXrE33CF0T6JO1v3v0HeBuve5+83cCHKo+GyqIBjL3FJgefZ
+EsPz6rGnPDKTYgMyaljFV3LI5ikCYQDlaBnyiWk1C7tYO5x3CRoHoiuiiREZCncK
+QkSxjiDoSP0rc+3BQp2kG3yy6S9mN4qMQPELEtBa6bORogxNK+Pxg8TRI/+xgeFt
+bod5Bd4pfl6Y5hXm21JwELFlOzPI3PMCYQDOYK6Z7vegiOJyyAJXMjcI07H8S0Gr
+SZW8f4tHRzO+RrRpR5ANzarELX7nF/Qj5mPXiZNiiMDGocxqkNzIa5HFLOqBhRkv
+o7yC1Cj582dUBFHyEbsZxR6UMTPLdE3UaRMCYACC1Nv3dmaJ2ib+KwEQ4h/2Ooao
+K4OUxGMfdqu2l1gtIXNBVNxDW7qL3SFA57wgj4x0cJUHu7MYJjBC3igl2uIk2wFk
+RSOOGIR35JFec/o/r9JDYPUcs/hP8TU6hokCBQJgHbH/rZqa+vh3TPjGjXFmRdjg
+JWNWwaTG7OaVTd5K7bgSwYtQiQvs5Gl/dxUVRg0ilKLxGB6BTpN9bGAHxLbltK9v
+1s8l/praxyBr/PsvBQHSILi4aU7ZxY0G3OGRSV0NAmBx28Msdgc0yHh3qSkbwVEr
+gr7av1iOH73ee+o4CmMWXYUBHOMW5Su0s0QHjNGDMiRiRoCvzYqdLcJj9/sFJxOT
+CM35WGGeKDMNubX7C6YroQ91q7kUmhi7HHY3QOyhCDU=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/test_cert.pem b/testdata/10-unbound-anchor.tdir/test_cert.pem
new file mode 100644
index 000000000000..6e588a4abc8f
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/test_cert.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICWTCCAYKgAwIBAgIJAN5YIkuCvJf5MA0GCSqGSIb3DQEBBQUAMCYxDjAMBgNV
+BAMTBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0xMzAxMTcxMTUyNDVa
+Fw0zMjEwMDQxMTUyNDVaMCYxDjAMBgNVBAMTBXBldGFsMRQwEgYJKoZIhvcNAQkB
+FgVwZXRhbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEAuPBoYZiFOuk2SnN0
+IsheC+W7JvAJcv8tksyz/hgAnqStDnDrQ4trF607aCQ7xjj2fSAqpiMvLv0P3Ctu
+rcTRHmRXApS3GBf1PjWqoxMK8JBxCIHN4PKpyq4czOtSPH6AFlU+3KsRRwymLgpT
+SE15NYv/2M6Z3/cL1SkOdVvVDrZv1gO4OCAxwrgI6HMsjQtwe16mGsBQzrHTCOGV
+u4QtISEUDrwZL272PFsZrEpHXd9LtSpqCEoOMujr54pKxBEJAgMBAAGjDzANMAsG
+A1UdDwQEAwIChDANBgkqhkiG9w0BAQUFAAOBwQCaA3ys5hDPMNV1oXIxH6u2KfAX
+C9tYJId/SR0x8whsZuNaSEZAgImdM5dnyWdjey8Pio772E9/F2aUBGFkdadZx4My
+d7hBfEi/NECEKs86k9g0ijbin41NKtnajb6GwyNQ9vDx7Z5FS8BZ3CD0BZIdCQUE
+gKuDSWBROQU3tqrjdk2QTwGQkj2mgzT871Jn1MwZw0mczPjS1y469Ejym8wi3uCd
+EboDOoGBCpmUQbxBv6JI75cUCdmNNEwjQjZ0XQw=
+-----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tpkg b/testdata/10-unbound-anchor.tpkg
deleted file mode 100644
index db8680a647aa..000000000000
--- a/testdata/10-unbound-anchor.tpkg
+++ /dev/null
diff --git a/testdata/common.sh b/testdata/common.sh
index 2a8ec7bb34bf..f6d72c2f046a 100755
--- a/testdata/common.sh
+++ b/testdata/common.sh
@@ -6,7 +6,7 @@
 # 2011-02-18: ports check on BSD,Solaris. wait_nsd_up.
 # 2011-02-11: first version.
 #
-# include this file from a tpkg script with
+# include this file from a tdir script with
 #   . ../common.sh
 #
 # overview of functions available:
diff --git a/testdata/ctrl_itr.tdir/bad_control.key b/testdata/ctrl_itr.tdir/bad_control.key
new file mode 100644
index 000000000000..d29cdbc91b37
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/bad_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
+SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
+DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
+AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
+PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
+PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
+IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
+GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
+q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
+neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
+IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
+ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
+RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/bad_control.pem b/testdata/ctrl_itr.tdir/bad_control.pem
new file mode 100644
index 000000000000..e06b847208e3
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/bad_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
+i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
+UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
+nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
+4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
+5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tdir/bad_server.key b/testdata/ctrl_itr.tdir/bad_server.key
new file mode 100644
index 000000000000..0dbb134b5be7
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/bad_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
+1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
+UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
+AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
+3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
+FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
+Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
+i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
+2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
+LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
+CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
+/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
+2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/bad_server.pem b/testdata/ctrl_itr.tdir/bad_server.pem
new file mode 100644
index 000000000000..983247ac73bd
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/bad_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
+RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
+DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
+Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
+zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
+O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
+oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.conf b/testdata/ctrl_itr.tdir/ctrl_itr.conf
new file mode 100644
index 000000000000..8ee1dffb73eb
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.conf
@@ -0,0 +1,26 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	# disabled validator
+	module-config: "iterator"
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.dsc b/testdata/ctrl_itr.tdir/ctrl_itr.dsc
new file mode 100644
index 000000000000..246ae60d3572
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.dsc
@@ -0,0 +1,16 @@
+BaseName: ctrl_itr
+Version: 1.0
+Description: iterator only test unbound-control
+CreationDate: Thu Jan 16 14:08:12 CET 2014
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: ctrl_itr.pre
+Post: ctrl_itr.post
+Test: ctrl_itr.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.post b/testdata/ctrl_itr.tdir/ctrl_itr.post
new file mode 100644
index 000000000000..6c6d35d4a3e2
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.post
@@ -0,0 +1,13 @@
+# #-- ctrl_itr.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+# it was stopped with unbound-control (if the test succeeded)
+kill $UNBOUND_PID >/dev/null 2>&1
+kill $UNBOUND_PID >/dev/null 2>&1
+exit 0
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.pre b/testdata/ctrl_itr.tdir/ctrl_itr.pre
new file mode 100644
index 000000000000..0ce1b653a460
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.pre
@@ -0,0 +1,33 @@
+# #-- ctrl_itr.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+CONTROL_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT ctrl_itr.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < ctrl_itr.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.test b/testdata/ctrl_itr.tdir/ctrl_itr.test
new file mode 100644
index 000000000000..dadd365826d3
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.test
@@ -0,0 +1,39 @@
+# #-- ctrl_itr.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# exit value is 1 on usage
+$PRE/unbound-control -c ub.conf forward_add +i bla bla
+if test $? -ne 0; then
+	echo "wrong exit value."
+	cat fwd.log 
+	cat unbound.log
+	exit 1
+else
+	echo "exit value: OK"
+fi
+
+
+# test if the server is up.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> OK"
+exit 0
diff --git a/testdata/ctrl_itr.tdir/ctrl_itr.testns b/testdata/ctrl_itr.tdir/ctrl_itr.testns
new file mode 100644
index 000000000000..0c911ca5b30e
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/ctrl_itr.testns
@@ -0,0 +1,22 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA SERVFAIL
+ADJUST copy_id
+SECTION QUESTION
+www.example.net.	IN	A
+ENTRY_END
+
diff --git a/testdata/ctrl_itr.tdir/unbound_control.key b/testdata/ctrl_itr.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/unbound_control.pem b/testdata/ctrl_itr.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tdir/unbound_server.key b/testdata/ctrl_itr.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/unbound_server.pem b/testdata/ctrl_itr.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/ctrl_itr.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tpkg b/testdata/ctrl_itr.tpkg
deleted file mode 100644
index dadf0a307c9f..000000000000
--- a/testdata/ctrl_itr.tpkg
+++ /dev/null
diff --git a/testdata/ctrl_pipe.tdir/._bad_control.key b/testdata/ctrl_pipe.tdir/._bad_control.key
new file mode 100644
index 000000000000..a2faa6f81771
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._bad_control.key
diff --git a/testdata/ctrl_pipe.tdir/._bad_control.pem b/testdata/ctrl_pipe.tdir/._bad_control.pem
new file mode 100644
index 000000000000..2d09cd410113
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._bad_control.pem
diff --git a/testdata/ctrl_pipe.tdir/._bad_server.key b/testdata/ctrl_pipe.tdir/._bad_server.key
new file mode 100644
index 000000000000..0a2ee41f724a
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._bad_server.key
diff --git a/testdata/ctrl_pipe.tdir/._bad_server.pem b/testdata/ctrl_pipe.tdir/._bad_server.pem
new file mode 100644
index 000000000000..cf59a782f5b9
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._bad_server.pem
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.conf b/testdata/ctrl_pipe.tdir/._ctrl_pipe.conf
new file mode 100644
index 000000000000..e588caa9e75f
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.conf
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.dsc b/testdata/ctrl_pipe.tdir/._ctrl_pipe.dsc
new file mode 100644
index 000000000000..e2ab56651f6a
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.dsc
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.post b/testdata/ctrl_pipe.tdir/._ctrl_pipe.post
new file mode 100644
index 000000000000..d3208b6f365e
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.post
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.pre b/testdata/ctrl_pipe.tdir/._ctrl_pipe.pre
new file mode 100644
index 000000000000..6e1c42c83888
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.pre
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.test b/testdata/ctrl_pipe.tdir/._ctrl_pipe.test
new file mode 100644
index 000000000000..bc0ab5a70460
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.test
diff --git a/testdata/ctrl_pipe.tdir/._ctrl_pipe.testns b/testdata/ctrl_pipe.tdir/._ctrl_pipe.testns
new file mode 100644
index 000000000000..89263e353937
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._ctrl_pipe.testns
diff --git a/testdata/ctrl_pipe.tdir/._unbound_control.key b/testdata/ctrl_pipe.tdir/._unbound_control.key
new file mode 100644
index 000000000000..474e6f1a3321
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._unbound_control.key
diff --git a/testdata/ctrl_pipe.tdir/._unbound_control.pem b/testdata/ctrl_pipe.tdir/._unbound_control.pem
new file mode 100644
index 000000000000..6eafa2b1748d
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._unbound_control.pem
diff --git a/testdata/ctrl_pipe.tdir/._unbound_server.key b/testdata/ctrl_pipe.tdir/._unbound_server.key
new file mode 100644
index 000000000000..9096da07aa24
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._unbound_server.key
diff --git a/testdata/ctrl_pipe.tdir/._unbound_server.pem b/testdata/ctrl_pipe.tdir/._unbound_server.pem
new file mode 100644
index 000000000000..0bd1053ef994
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/._unbound_server.pem
diff --git a/testdata/ctrl_pipe.tdir/bad_control.key b/testdata/ctrl_pipe.tdir/bad_control.key
new file mode 100644
index 000000000000..d29cdbc91b37
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/bad_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
+SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
+DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
+AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
+PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
+PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
+IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
+GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
+q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
+neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
+IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
+ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
+RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/bad_control.pem b/testdata/ctrl_pipe.tdir/bad_control.pem
new file mode 100644
index 000000000000..e06b847208e3
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/bad_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
+i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
+UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
+nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
+4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
+5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tdir/bad_server.key b/testdata/ctrl_pipe.tdir/bad_server.key
new file mode 100644
index 000000000000..0dbb134b5be7
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/bad_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
+1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
+UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
+AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
+3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
+FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
+Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
+i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
+2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
+LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
+CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
+/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
+2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/bad_server.pem b/testdata/ctrl_pipe.tdir/bad_server.pem
new file mode 100644
index 000000000000..983247ac73bd
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/bad_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
+RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
+DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
+Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
+zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
+O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
+oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.conf b/testdata/ctrl_pipe.tdir/ctrl_pipe.conf
new file mode 100644
index 000000000000..d7c68197ce53
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.conf
@@ -0,0 +1,23 @@
+server:
+	verbosity: 4
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+remote-control:
+	control-enable: yes
+	control-interface: @PATH@/controlpipe.@PID@
+	control-use-cert: no
+	#server-key-file: "unbound_server.key"
+	#server-cert-file: "unbound_server.pem"
+	#control-key-file: "unbound_control.key"
+	#control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.dsc b/testdata/ctrl_pipe.tdir/ctrl_pipe.dsc
new file mode 100644
index 000000000000..c618f1d67313
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.dsc
@@ -0,0 +1,16 @@
+BaseName: ctrl_pipe
+Version: 1.0
+Description: unix pipe test unbound-control
+CreationDate: Fri 16 Jan 13:25:48 CET 2015
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: ctrl_pipe.pre
+Post: ctrl_pipe.post
+Test: ctrl_pipe.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.post b/testdata/ctrl_pipe.tdir/ctrl_pipe.post
new file mode 100644
index 000000000000..5e3cc6dacc52
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.post
@@ -0,0 +1,15 @@
+# #-- ctrl_pipe.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+# it was stopped with unbound-control (if the test succeeded)
+kill $UNBOUND_PID >/dev/null 2>&1
+kill $UNBOUND_PID >/dev/null 2>&1
+
+rm -f $CONTROL_PATH/controlpipe.$CONTROL_PID
+exit 0
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.pre b/testdata/ctrl_pipe.tdir/ctrl_pipe.pre
new file mode 100644
index 000000000000..e9f2124b1880
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.pre
@@ -0,0 +1,35 @@
+# #-- ctrl_pipe.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT ctrl_pipe.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+CONTROL_PATH=/tmp
+CONTROL_PID=$$
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's?@PATH\@?'$CONTROL_PATH'?' -e 's/@PID@/'$CONTROL_PID'/' < ctrl_pipe.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+echo "CONTROL_PATH=$CONTROL_PATH" >> .tpkg.var.test
+echo "CONTROL_PID=$CONTROL_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.test b/testdata/ctrl_pipe.tdir/ctrl_pipe.test
new file mode 100644
index 000000000000..70dfdcac47f0
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.test
@@ -0,0 +1,61 @@
+# #-- ctrl_pipe.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# exit value is 1 on usage
+$PRE/unbound-control -c ub.conf status
+if test $? -ne 0; then
+	echo "wrong exit value."
+	cat fwd.log 
+	cat unbound.log
+	exit 1
+else
+	echo "exit value: OK"
+fi
+$PRE/unbound-control -c ub.conf local_data froob.example.net A 192.0.2.1
+if test $? -ne 0; then
+	echo "wrong exit value."
+	cat fwd.log 
+	cat unbound.log
+	exit 1
+else
+	echo "exit value: OK"
+fi
+
+
+# test if the server is up.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig froob.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT froob.example.net. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> OK"
+exit 0
diff --git a/testdata/ctrl_pipe.tdir/ctrl_pipe.testns b/testdata/ctrl_pipe.tdir/ctrl_pipe.testns
new file mode 100644
index 000000000000..0c911ca5b30e
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/ctrl_pipe.testns
@@ -0,0 +1,22 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA SERVFAIL
+ADJUST copy_id
+SECTION QUESTION
+www.example.net.	IN	A
+ENTRY_END
+
diff --git a/testdata/ctrl_pipe.tdir/unbound_control.key b/testdata/ctrl_pipe.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_control.pem b/testdata/ctrl_pipe.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_server.key b/testdata/ctrl_pipe.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_server.pem b/testdata/ctrl_pipe.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/ctrl_pipe.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tpkg b/testdata/ctrl_pipe.tpkg
deleted file mode 100644
index 877fcf9010d9..000000000000
--- a/testdata/ctrl_pipe.tpkg
+++ /dev/null
diff --git a/testdata/dnscrypt_cert.tdir/1.cert b/testdata/dnscrypt_cert.tdir/1.cert
new file mode 100644
index 000000000000..fbc529bfa3ab
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/1.cert
diff --git a/testdata/dnscrypt_cert.tdir/1.key b/testdata/dnscrypt_cert.tdir/1.key
new file mode 100644
index 000000000000..165262c86e53
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/1.key
@@ -0,0 +1 @@
+®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_cert.tdir/1_chacha.cert b/testdata/dnscrypt_cert.tdir/1_chacha.cert
new file mode 100644
index 000000000000..3da5c612d060
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/1_chacha.cert
diff --git a/testdata/dnscrypt_cert.tdir/1_salsa.cert b/testdata/dnscrypt_cert.tdir/1_salsa.cert
new file mode 100644
index 000000000000..17e447fc339b
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/1_salsa.cert
diff --git a/testdata/dnscrypt_cert.tdir/2.cert b/testdata/dnscrypt_cert.tdir/2.cert
new file mode 100644
index 000000000000..ebf8ac108d14
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/2.cert
diff --git a/testdata/dnscrypt_cert.tdir/2.key b/testdata/dnscrypt_cert.tdir/2.key
new file mode 100644
index 000000000000..c299f550ae95
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/2.key
@@ -0,0 +1 @@
+m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_cert.tdir/2_chacha.cert b/testdata/dnscrypt_cert.tdir/2_chacha.cert
new file mode 100644
index 000000000000..ed4ec26065a6
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/2_chacha.cert
diff --git a/testdata/dnscrypt_cert.tdir/2_salsa.cert b/testdata/dnscrypt_cert.tdir/2_salsa.cert
new file mode 100644
index 000000000000..6e71fe97864d
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/2_salsa.cert
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.conf b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.conf
new file mode 100644
index 000000000000..355d4ff13595
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.conf
@@ -0,0 +1,26 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+    interface: 0.0.0.0
+    interface: 0.0.0.0@@DNSCRYPT_PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+dnscrypt:
+    dnscrypt-enable: yes
+    dnscrypt-port: @DNSCRYPT_PORT@
+    dnscrypt-provider: 2.dnscrypt-cert.example.com.
+    dnscrypt-secret-key: 1.key
+    dnscrypt-secret-key: 2.key
+    dnscrypt-provider-cert: 1_salsa.cert
+    dnscrypt-provider-cert: 2_salsa.cert
+
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.dsc b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.dsc
new file mode 100644
index 000000000000..f0ec882f2b84
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.dsc
@@ -0,0 +1,16 @@
+BaseName: dnscrypt_cert
+Version: 1.0
+Description: dnscrypt cert retrieval.
+CreationDate: Fri Mar 03 10:08:08 CEST 2017
+Maintainer: Emmanuel Bretelle
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: dnscrypt_cert.pre
+Post: dnscrypt_cert.post
+Test: dnscrypt_cert.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post
new file mode 100644
index 000000000000..0346d3f84a61
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post
@@ -0,0 +1,16 @@
+# #-- dnscrypt_cert.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre
new file mode 100644
index 000000000000..bee9e8ac63ca
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre
@@ -0,0 +1,38 @@
+# #-- dnscrypt_cert.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+DNSCRYPT_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT dnscrypt_cert.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
+    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_cert.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test
new file mode 100644
index 000000000000..f09753792696
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test
@@ -0,0 +1,108 @@
+# #-- dnscrypt_cert.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+# do the test
+
+# Query plain request over DNSCrypt channel get closed
+# We use TCP to avoid hanging on waiting for UDP.
+# We expect `outfile` to contain no DNS payload
+echo "> dig TCP www.example.com. DNSCrypt port"
+dig +tcp @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "QUESTION SECTION" outfile; then
+	echo "NOK"
+	exit 1
+else
+	echo "OK"
+fi
+
+
+# Plaintext query on unbound port works correctly.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# Plaintext query on unbound port works correctly with TCP.
+echo "> dig TCP www.example.com."
+dig +tcp @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+for opt in '' '+tcp'
+do
+    # Plaintext query on dnscrypt port returns cert when asking for providername/TXT.
+    # Check that it returns 1.cert.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. DNSCrypt plaintext ${opt}"
+    dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "Not OK"
+        exit 1
+    fi
+
+    # Plaintext query on dnscrypt port returns cert when asking for providername/TXT.
+    # Check that it returns 2.cert.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 2_salsa.CERT. DNSCrypt plaintext ${opt}"
+    dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000AX\031\201\243\201LI<-\146]LU\247LY\2376\014K\194$D\151&\008\236\008\220\143We\029\227\030\233\015[4\\\146\174\166`{}\161W\209\228\215\002\205|\207*\011\162$\175\210[\006\245\243W\191\189Z\216\210x\025\204\247\173\227t\138\018\162~\152\253\211\031z\\\002m5\008\254\2244\245\243W\191\189Z\216\210Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "NOK"
+        exit 1
+    fi
+
+    # Certificates are local-data for unbound. We can also retrieve them from unbound
+    # port.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. Unbound ${opt}"
+    dig ${opt} @127.0.0.1 -p $UNBOUND_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "Not OK"
+        exit 1
+    fi
+done
+
+exit 0
diff --git a/testdata/dnscrypt_cert.tdir/dnscrypt_cert.testns b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.testns
new file mode 100644
index 000000000000..0af820e01deb
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/dnscrypt_cert.testns
@@ -0,0 +1,26 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA TC NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname TCP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/dnscrypt_cert.tdir/precheck.sh b/testdata/dnscrypt_cert.tdir/precheck.sh
new file mode 100644
index 000000000000..00fa4bc76067
--- /dev/null
+++ b/testdata/dnscrypt_cert.tdir/precheck.sh
@@ -0,0 +1,16 @@
+# dnscrypt precheck.sh
+
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+# if no xchacha20 support in unbound; exit
+if grep "define USE_DNSCRYPT_XCHACHA20 1" $PRE/config.h; then
+        xchacha20=1
+else
+        xchacha20=0
+fi
diff --git a/testdata/dnscrypt_cert.tpkg b/testdata/dnscrypt_cert.tpkg
deleted file mode 100644
index 4263b9347e08..000000000000
--- a/testdata/dnscrypt_cert.tpkg
+++ /dev/null
diff --git a/testdata/dnscrypt_cert_chacha.tdir/1.cert b/testdata/dnscrypt_cert_chacha.tdir/1.cert
new file mode 100644
index 000000000000..fbc529bfa3ab
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/1.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/1.key b/testdata/dnscrypt_cert_chacha.tdir/1.key
new file mode 100644
index 000000000000..165262c86e53
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/1.key
@@ -0,0 +1 @@
+®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert b/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert
new file mode 100644
index 000000000000..3da5c612d060
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert b/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert
new file mode 100644
index 000000000000..17e447fc339b
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/2.cert b/testdata/dnscrypt_cert_chacha.tdir/2.cert
new file mode 100644
index 000000000000..ebf8ac108d14
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/2.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/2.key b/testdata/dnscrypt_cert_chacha.tdir/2.key
new file mode 100644
index 000000000000..c299f550ae95
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/2.key
@@ -0,0 +1 @@
+m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert b/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert
new file mode 100644
index 000000000000..ed4ec26065a6
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert b/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert
new file mode 100644
index 000000000000..6e71fe97864d
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf
new file mode 100644
index 000000000000..44b0ca880c6b
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf
@@ -0,0 +1,27 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+    interface: 0.0.0.0
+    interface: 0.0.0.0@@DNSCRYPT_PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+dnscrypt:
+    dnscrypt-enable: yes
+    dnscrypt-port: @DNSCRYPT_PORT@
+    dnscrypt-provider: 2.dnscrypt-cert.example.com.
+    dnscrypt-secret-key: 1.key
+    dnscrypt-secret-key: 2.key
+    dnscrypt-provider-cert: 1_salsa.cert
+    dnscrypt-provider-cert: 2_chacha.cert
+    dnscrypt-provider-cert: 2_salsa.cert
+
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc
new file mode 100644
index 000000000000..a5ed1da0da2d
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc
@@ -0,0 +1,16 @@
+BaseName: dnscrypt_cert_chacha
+Version: 1.0
+Description: dnscrypt cert retrieval.
+CreationDate: Fri Mar 03 10:08:08 CEST 2017
+Maintainer: Emmanuel Bretelle
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: dnscrypt_cert_chacha.pre
+Post: dnscrypt_cert_chacha.post
+Test: dnscrypt_cert_chacha.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post
new file mode 100644
index 000000000000..54337df67d55
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post
@@ -0,0 +1,17 @@
+# #-- dnscrypt_cert_chacha.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+kill_pid $FWD_PID
+if [ $xchacha20 -ne 0 ]; then
+    kill_pid $UNBOUND_PID
+fi
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre
new file mode 100644
index 000000000000..c77290a8ab7d
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre
@@ -0,0 +1,43 @@
+# #-- dnscrypt_cert_chacha.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+DNSCRYPT_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT dnscrypt_cert_chacha.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
+    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_cert_chacha.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+if [ $xchacha20 -eq 0 ]; then
+    # no xchacha20 support, we expect unbound to exit with an error message.
+    wait_server_up unbound.log "Certificate for XChacha20 but libsodium does not support it"
+else
+    wait_unbound_up unbound.log
+fi
+
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test
new file mode 100644
index 000000000000..4ef6942be6fb
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test
@@ -0,0 +1,130 @@
+# #-- dnscrypt_cert_chacha.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# Check if we can run the test.
+. ./precheck.sh
+
+# do the test
+
+if [ $xchacha20 -eq 0 ]; then
+    # Unbound would exit before we can attempt any tests.
+    echo "OK"
+    exit 0
+fi
+
+# Query plain request over DNSCrypt channel get closed
+# We use TCP to avoid hanging on waiting for UDP.
+# We expect `outfile` to contain no DNS payload
+echo "> dig TCP www.example.com. DNSCrypt port"
+dig +tcp @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "QUESTION SECTION" outfile; then
+	echo "NOK"
+	exit 1
+else
+	echo "OK"
+fi
+
+
+# Plaintext query on unbound port works correctly.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# Plaintext query on unbound port works correctly with TCP.
+echo "> dig TCP www.example.com."
+dig +tcp @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
+echo "> cat logfiles"
+cat fwd.log
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+for opt in '' '+tcp'
+do
+    # Plaintext query on dnscrypt port returns cert when asking for providername/TXT.
+    # Check that it returns 1.cert.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. DNSCrypt plaintext ${opt}"
+    dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "Not OK"
+        exit 1
+    fi
+
+    # Plaintext query on dnscrypt port returns cert when asking for providername/TXT.
+    # Check that it returns 2.cert.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 2_salsa.CERT. DNSCrypt plaintext ${opt}"
+    dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000AX\031\201\243\201LI<-\146]LU\247LY\2376\014K\194$D\151&\008\236\008\220\143We\029\227\030\233\015[4\\\146\174\166`{}\161W\209\228\215\002\205|\207*\011\162$\175\210[\006\245\243W\191\189Z\216\210x\025\204\247\173\227t\138\018\162~\152\253\211\031z\\\002m5\008\254\2244\245\243W\191\189Z\216\210Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "NOK"
+        exit 1
+    fi
+
+    # Plaintext query on dnscrypt port returns cert when asking for providername/TXT.
+    # Check that it returns 2_chacha.cert
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 2_CHACHA.CERT. DNSCrypt plaintext ${opt}"
+    dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    grep -F 'DNSC\000\002\000\000\1716\226\255*\244\002L\177g\025_\127tR\151\246R\203\178\153\248\006\137\"\138\173|G/,\160\152\015\010\172\184\220`\175\217\255,\162\018\178-d\007\246k0\003I[\205w\026)\204B\002\161\010\245\243W\191\189Z\216\210x\025\204\247\173\227t\138\018\162~\152\253\211\031z\\\002m5\008\254\2244\246\243W\191\189Z\216\210Y\160\2158Y\160\2158u\210\219\184' outfile
+    cert_found=$?
+    if [ \( $cert_found -eq 0 -a $xchacha20 -eq 1 \)  -o \( $cert_found -ne 0 -a $xchacha20 -eq 0 \) ]; then
+        echo "OK"
+    else
+        echo "Not OK"
+        exit 1
+    fi
+
+    # Certificates are local-data for unbound. We can also retrieve them from unbound
+    # port.
+    echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. Unbound ${opt}"
+    dig ${opt} @127.0.0.1 -p $UNBOUND_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile
+    echo "> cat logfiles"
+    cat fwd.log
+    cat unbound.log
+    echo "> check answer"
+    if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then
+        echo "OK"
+    else
+        echo "Not OK"
+        exit 1
+    fi
+done
+
+exit 0
diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns
new file mode 100644
index 000000000000..0af820e01deb
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns
@@ -0,0 +1,26 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA TC NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname TCP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/dnscrypt_cert_chacha.tdir/precheck.sh b/testdata/dnscrypt_cert_chacha.tdir/precheck.sh
new file mode 100644
index 000000000000..00fa4bc76067
--- /dev/null
+++ b/testdata/dnscrypt_cert_chacha.tdir/precheck.sh
@@ -0,0 +1,16 @@
+# dnscrypt precheck.sh
+
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+# if no xchacha20 support in unbound; exit
+if grep "define USE_DNSCRYPT_XCHACHA20 1" $PRE/config.h; then
+        xchacha20=1
+else
+        xchacha20=0
+fi
diff --git a/testdata/dnscrypt_cert_chacha.tpkg b/testdata/dnscrypt_cert_chacha.tpkg
deleted file mode 100644
index 4df461f03eac..000000000000
--- a/testdata/dnscrypt_cert_chacha.tpkg
+++ /dev/null
diff --git a/testdata/dnscrypt_queries.tdir/1.cert b/testdata/dnscrypt_queries.tdir/1.cert
new file mode 100644
index 000000000000..fbc529bfa3ab
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/1.cert
diff --git a/testdata/dnscrypt_queries.tdir/1.key b/testdata/dnscrypt_queries.tdir/1.key
new file mode 100644
index 000000000000..165262c86e53
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/1.key
@@ -0,0 +1 @@
+®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries.tdir/1_chacha.cert b/testdata/dnscrypt_queries.tdir/1_chacha.cert
new file mode 100644
index 000000000000..3da5c612d060
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/1_chacha.cert
diff --git a/testdata/dnscrypt_queries.tdir/1_salsa.cert b/testdata/dnscrypt_queries.tdir/1_salsa.cert
new file mode 100644
index 000000000000..17e447fc339b
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/1_salsa.cert
diff --git a/testdata/dnscrypt_queries.tdir/2.cert b/testdata/dnscrypt_queries.tdir/2.cert
new file mode 100644
index 000000000000..ebf8ac108d14
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/2.cert
diff --git a/testdata/dnscrypt_queries.tdir/2.key b/testdata/dnscrypt_queries.tdir/2.key
new file mode 100644
index 000000000000..c299f550ae95
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/2.key
@@ -0,0 +1 @@
+m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries.tdir/2_chacha.cert b/testdata/dnscrypt_queries.tdir/2_chacha.cert
new file mode 100644
index 000000000000..ed4ec26065a6
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/2_chacha.cert
diff --git a/testdata/dnscrypt_queries.tdir/2_salsa.cert b/testdata/dnscrypt_queries.tdir/2_salsa.cert
new file mode 100644
index 000000000000..6e71fe97864d
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/2_salsa.cert
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf
new file mode 100644
index 000000000000..355d4ff13595
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf
@@ -0,0 +1,26 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+    interface: 0.0.0.0
+    interface: 0.0.0.0@@DNSCRYPT_PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+dnscrypt:
+    dnscrypt-enable: yes
+    dnscrypt-port: @DNSCRYPT_PORT@
+    dnscrypt-provider: 2.dnscrypt-cert.example.com.
+    dnscrypt-secret-key: 1.key
+    dnscrypt-secret-key: 2.key
+    dnscrypt-provider-cert: 1_salsa.cert
+    dnscrypt-provider-cert: 2_salsa.cert
+
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc
new file mode 100644
index 000000000000..e1e653e57117
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc
@@ -0,0 +1,16 @@
+BaseName: dnscrypt_queries
+Version: 1.0
+Description: dnscrypt queries.
+CreationDate: Fri Mar 03 10:08:08 CEST 2017
+Maintainer: Emmanuel Bretelle
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: dnscrypt_queries.pre
+Post: dnscrypt_queries.post
+Test: dnscrypt_queries.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post
new file mode 100644
index 000000000000..b61480616892
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post
@@ -0,0 +1,20 @@
+# #-- dnscrypt_queries.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+kill_pid $PROXY_PID
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre
new file mode 100644
index 000000000000..288a66541a34
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre
@@ -0,0 +1,53 @@
+# #-- dnscrypt_queries.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+get_random_port 4
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+DNSCRYPT_PORT=$(($RND_PORT + 2))
+PROXY_PORT=$(($RND_PORT + 3))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
+echo "PROXY_PORT=$PROXY_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT dnscrypt_queries.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+dnscrypt-proxy --local-address=127.0.0.1:${PROXY_PORT} \
+    --resolver-address=127.0.0.1:${DNSCRYPT_PORT} \
+    --provider-name=2.dnscrypt-cert.example.com \
+    --provider-key=B85F:41A1:4F23:F7DB:C866:F397:CC6F:44B6:5F9D:65C5:B629:7C27:5403:A6E9:DCF2:4F9D \
+    -m 32 \
+    >dnscryptproxy.log 2>&1 &
+PROXY_PID=$!
+echo "PROXY_PID=$PROXY_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
+    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_queries.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+wait_server_up dnscryptproxy.log "Proxying from"
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test
new file mode 100644
index 000000000000..5614a444da05
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test
@@ -0,0 +1,107 @@
+# #-- dnscrypt_queries.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+
+# do the test
+for opt in '' '+tcp'
+do
+    echo "> do queries ${opt}"
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www1.example.com. >outfile1 &
+    digpid1=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www2.example.com. >outfile2 &
+    digpid2=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www3.example.com. >outfile3 &
+    digpid3=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www4.example.com. >outfile4 &
+    digpid4=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www5.example.com. >outfile5 &
+    digpid5=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www6.example.com. >outfile6 &
+    digpid6=$!
+    sleep 1
+    kill -9 $digpid1
+    kill -9 $digpid2
+    kill -9 $digpid3
+    kill -9 $digpid4
+    kill -9 $digpid5
+    kill -9 $digpid6
+
+    echo "> cat outfile1"
+    cat outfile1 
+    echo "> cat outfile2"
+    cat outfile2 
+    echo "> cat outfile3"
+    cat outfile3
+    echo "> cat outfile4"
+    cat outfile4
+    echo "> cat outfile5"
+    cat outfile5
+    echo "> cat outfile6"
+    cat outfile6
+    echo "> cat logfiles"
+    cat fwd.log 
+    cat unbound.log
+
+    echo "> check for ID bit collisions"
+    grep "pending reply" unbound.log > ids
+    numsend=`cat ids | wc -l`
+    cat ids | awk '{print $8};' | sort -u > ids2
+    numuniq=`cat ids2 | wc -l`
+    if test $numuniq -ne $numsend; then
+        echo "got a ID number clash. could not do test, sorry"
+        exit 0
+    fi
+
+    echo "> check answers for queries"
+    if grep "10.20.30.40" outfile1; then
+        echo "1 is OK"
+    else
+        echo "1 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.50" outfile2; then
+        echo "2 is OK"
+    else
+        echo "2 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.60" outfile3; then
+        echo "3 is OK"
+    else
+        echo "3 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.70" outfile4; then
+        echo "4 is OK"
+    else
+        echo "4 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.80" outfile5; then
+        echo "5 is OK"
+    else
+        echo "5 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.90" outfile6; then
+        echo "6 is OK"
+    else
+        echo "6 is not OK"
+        exit 1
+    fi
+done
+
+exit 0
diff --git a/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns
new file mode 100644
index 000000000000..f03c15f764ca
--- /dev/null
+++ b/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns
@@ -0,0 +1,63 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www4	IN	A
+SECTION ANSWER
+www4	IN	A	10.20.30.70
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www5	IN	A
+SECTION ANSWER
+www5	IN	A	10.20.30.80
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www6	IN	A
+SECTION ANSWER
+www6	IN	A	10.20.30.90
+ENTRY_END
diff --git a/testdata/dnscrypt_queries.tpkg b/testdata/dnscrypt_queries.tpkg
deleted file mode 100644
index c856303cd284..000000000000
--- a/testdata/dnscrypt_queries.tpkg
+++ /dev/null
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1.key b/testdata/dnscrypt_queries_chacha.tdir/1.key
new file mode 100644
index 000000000000..165262c86e53
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/1.key
@@ -0,0 +1 @@
+®öÝìK¬‡#‘€4ùsŽ	pèÖôÁæÀx!¹»AŠ"mM
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert b/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert
new file mode 100644
index 000000000000..3da5c612d060
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert b/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert
new file mode 100644
index 000000000000..17e447fc339b
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2.key b/testdata/dnscrypt_queries_chacha.tdir/2.key
new file mode 100644
index 000000000000..c299f550ae95
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/2.key
@@ -0,0 +1 @@
+m7Ÿñâƒx;‘%׸õ�é*•ÜR¯äÓ¯¹mDªñ
\ No newline at end of file
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert b/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert
new file mode 100644
index 000000000000..ed4ec26065a6
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert b/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert
new file mode 100644
index 000000000000..6e71fe97864d
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf
new file mode 100644
index 000000000000..9e269ba60ce3
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf
@@ -0,0 +1,24 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+    interface: 0.0.0.0
+    interface: 0.0.0.0@@DNSCRYPT_PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+dnscrypt:
+    dnscrypt-enable: yes
+    dnscrypt-port: @DNSCRYPT_PORT@
+    dnscrypt-provider: 2.dnscrypt-cert.example.com.
+    dnscrypt-secret-key: 2.key
+    dnscrypt-provider-cert: 2_salsa.cert
+    dnscrypt-provider-cert: 2_chacha.cert
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc
new file mode 100644
index 000000000000..372126bc3e41
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc
@@ -0,0 +1,16 @@
+BaseName: dnscrypt_queries_chacha
+Version: 1.0
+Description: dnscrypt queries using xchacha
+CreationDate: Thu Jun 01 10:08:08 CEST 2017
+Maintainer: Emmanuel Bretelle
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: dnscrypt_queries_chacha.pre
+Post: dnscrypt_queries_chacha.post
+Test: dnscrypt_queries_chacha.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post
new file mode 100644
index 000000000000..1ca6a7e3f1de
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post
@@ -0,0 +1,17 @@
+# #-- dnscrypt_queries_chacha.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+
+# Check if we can run the test.
+. ./precheck.sh
+
+
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+kill_pid $PROXY_PID
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre
new file mode 100644
index 000000000000..6474c540dd6e
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre
@@ -0,0 +1,52 @@
+# #-- dnscrypt_queries_chacha.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# Check if we can run the test.
+. ./precheck.sh
+
+get_random_port 4
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+DNSCRYPT_PORT=$(($RND_PORT + 2))
+PROXY_PORT=$(($RND_PORT + 3))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test
+echo "PROXY_PORT=$PROXY_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT dnscrypt_queries_chacha.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+dnscrypt-proxy --local-address=127.0.0.1:${PROXY_PORT} \
+    --resolver-address=127.0.0.1:${DNSCRYPT_PORT} \
+    --provider-name=2.dnscrypt-cert.example.com \
+    --provider-key=C352:1F20:F2D2:FD65:B5F4:7BF6:6C1A:88C1:4BCB:80CE:1E3A:3572:5CB1:7D4B:12D3:E783 \
+    -m 32 \
+    >dnscryptproxy.log 2>&1 &
+PROXY_PID=$!
+echo "PROXY_PID=$PROXY_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \
+    -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_queries_chacha.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+wait_server_up dnscryptproxy.log "Proxying from"
+if ! grep 'Using version 2.0 of the DNSCrypt protocol' dnscryptproxy.log; then
+    echo "Failed to select xchacha cert"
+    exit 1
+fi
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test
new file mode 100644
index 000000000000..455c506a0d49
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test
@@ -0,0 +1,101 @@
+# #-- dnscrypt_queries_chacha.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# Check if we can run the test.
+. ./precheck.sh
+
+# do the test
+for opt in '' '+tcp'
+do
+    echo "> do queries ${opt}"
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www1.example.com. >outfile1 &
+    digpid1=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www2.example.com. >outfile2 &
+    digpid2=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www3.example.com. >outfile3 &
+    digpid3=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www4.example.com. >outfile4 &
+    digpid4=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www5.example.com. >outfile5 &
+    digpid5=$!
+    dig @127.0.0.1 ${opt} -p $PROXY_PORT www6.example.com. >outfile6 &
+    digpid6=$!
+    sleep 1
+    kill -9 $digpid1
+    kill -9 $digpid2
+    kill -9 $digpid3
+    kill -9 $digpid4
+    kill -9 $digpid5
+    kill -9 $digpid6
+
+    echo "> cat outfile1"
+    cat outfile1 
+    echo "> cat outfile2"
+    cat outfile2 
+    echo "> cat outfile3"
+    cat outfile3
+    echo "> cat outfile4"
+    cat outfile4
+    echo "> cat outfile5"
+    cat outfile5
+    echo "> cat outfile6"
+    cat outfile6
+    echo "> cat logfiles"
+    cat fwd.log 
+    cat unbound.log
+
+    echo "> check for ID bit collisions"
+    grep "pending reply" unbound.log > ids
+    numsend=`cat ids | wc -l`
+    cat ids | awk '{print $8};' | sort -u > ids2
+    numuniq=`cat ids2 | wc -l`
+    if test $numuniq -ne $numsend; then
+        echo "got a ID number clash. could not do test, sorry"
+        exit 0
+    fi
+
+    echo "> check answers for queries"
+    if grep "10.20.30.40" outfile1; then
+        echo "1 is OK"
+    else
+        echo "1 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.50" outfile2; then
+        echo "2 is OK"
+    else
+        echo "2 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.60" outfile3; then
+        echo "3 is OK"
+    else
+        echo "3 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.70" outfile4; then
+        echo "4 is OK"
+    else
+        echo "4 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.80" outfile5; then
+        echo "5 is OK"
+    else
+        echo "5 is not OK"
+        exit 1
+    fi
+    if grep "10.20.30.90" outfile6; then
+        echo "6 is OK"
+    else
+        echo "6 is not OK"
+        exit 1
+    fi
+done
+
+exit 0
diff --git a/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns
new file mode 100644
index 000000000000..f03c15f764ca
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns
@@ -0,0 +1,63 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www4	IN	A
+SECTION ANSWER
+www4	IN	A	10.20.30.70
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www5	IN	A
+SECTION ANSWER
+www5	IN	A	10.20.30.80
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www6	IN	A
+SECTION ANSWER
+www6	IN	A	10.20.30.90
+ENTRY_END
diff --git a/testdata/dnscrypt_queries_chacha.tdir/precheck.sh b/testdata/dnscrypt_queries_chacha.tdir/precheck.sh
new file mode 100644
index 000000000000..8288d9516eb1
--- /dev/null
+++ b/testdata/dnscrypt_queries_chacha.tdir/precheck.sh
@@ -0,0 +1,27 @@
+# dnscrypt precheck.sh
+
+# if no dnscrypt; exit
+if grep "define USE_DNSCRYPT 1" $PRE/config.h; then
+        echo "have dnscrypt"
+else
+        echo "no dnscrypt"
+        exit 0
+fi
+
+# if no xchacha20 support in unbound; exit
+if grep "define USE_DNSCRYPT_XCHACHA20 1" $PRE/config.h; then
+        echo "have xchacha20"
+        xchacha20=1
+else
+        echo "no xchacha20"
+        xchacha20=0
+        exit 0
+fi
+
+# if dnscrypt-proxy does not support xchacha20; exit
+if (dnscrypt-proxy -h 2>&1 | grep -q 'XChaCha20-Poly1305 cipher: present'); then
+		echo "dnscrypt-proxy has xchacha20"
+else
+		echo "dnscrypt-proxy does not have xchacha20"
+		exit 0
+fi
diff --git a/testdata/dnscrypt_queries_chacha.tpkg b/testdata/dnscrypt_queries_chacha.tpkg
deleted file mode 100644
index 8cb39dc2c2f5..000000000000
--- a/testdata/dnscrypt_queries_chacha.tpkg
+++ /dev/null
diff --git a/testdata/edns_cache.tdir/edns_cache.conf b/testdata/edns_cache.tdir/edns_cache.conf
new file mode 100644
index 000000000000..101b9751ffc6
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.conf
@@ -0,0 +1,21 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: ::1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+stub-zone:
+	name: "example.net"
+	stub-addr: "127.0.0.1@@STUB2_PORT@"
+stub-zone:
+	name: "example.com"
+	stub-addr: "127.0.0.1@@STUB2_PORT@"
+# a k a root hints
+stub-zone:
+	name: "."
+	stub-addr: "::1@@STUB1_PORT@"
diff --git a/testdata/edns_cache.tdir/edns_cache.dsc b/testdata/edns_cache.tdir/edns_cache.dsc
new file mode 100644
index 000000000000..57f47dc0dc3d
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.dsc
@@ -0,0 +1,16 @@
+BaseName: edns_cache
+Version: 1.0
+Description: Server does not support EDNS and cache this.
+CreationDate: Tue Nov 30 12:34:37 CET 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: edns_cache.pre
+Post: edns_cache.post
+Test: edns_cache.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/edns_cache.tdir/edns_cache.post b/testdata/edns_cache.tdir/edns_cache.post
new file mode 100644
index 000000000000..0c3ed4ca7895
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.post
@@ -0,0 +1,11 @@
+# #-- edns_cache.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $STUB1_PID
+kill_pid $STUB2_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/edns_cache.tdir/edns_cache.pre b/testdata/edns_cache.tdir/edns_cache.pre
new file mode 100644
index 000000000000..93d521362209
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.pre
@@ -0,0 +1,43 @@
+# #-- edns_cache.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+STUB1_PORT=$(($RND_PORT + 1))
+STUB2_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "STUB1_PORT=$STUB1_PORT" >> .tpkg.var.test
+echo "STUB2_PORT=$STUB2_PORT" >> .tpkg.var.test
+
+# start stub1
+get_ldns_testns
+$LDNS_TESTNS -6 -p $STUB1_PORT edns_cache.stub1 >stub1.log 2>&1 &
+STUB1_PID=$!
+echo "STUB1_PID=$STUB1_PID" >> .tpkg.var.test
+
+# start stub2
+$LDNS_TESTNS -p $STUB2_PORT edns_cache.stub2 >stub2.log 2>&1 &
+STUB2_PID=$!
+echo "STUB2_PID=$STUB2_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@STUB1_PORT\@/'$STUB1_PORT'/' -e 's/@STUB2_PORT\@/'$STUB2_PORT'/' < edns_cache.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+
+# wait for stubs to come up
+wait_ldns_testns_up stub1.log
+wait_ldns_testns_up stub2.log
+
+# wait for unbound to come up
+wait_unbound_up unbound.log
+
diff --git a/testdata/edns_cache.tdir/edns_cache.stub1 b/testdata/edns_cache.tdir/edns_cache.stub1
new file mode 100644
index 000000000000..23653c3b3d53
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.stub1
@@ -0,0 +1,43 @@
+; nameserver test file
+; this is ::1 and the EDNS working server.
+$ORIGIN .
+$TTL 3600
+
+; root prime
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+.	IN	NS
+SECTION ANSWER
+. 	IN 	NS 	root.server.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+root.server.	IN	A	127.0.0.1
+ENTRY_END
+
+; referral to example.com
+ENTRY_BEGIN
+MATCH opcode subdomain
+REPLY QR NOERROR
+ADJUST copy_id copy_query
+SECTION QUESTION
+example.com.	IN	A
+SECTION AUTHORITY
+example.com.	IN 	NS	netdns.example.net.
+ENTRY_END
+
+; referral to example.net
+ENTRY_BEGIN
+MATCH opcode subdomain
+REPLY QR NOERROR
+ADJUST copy_id copy_query
+SECTION QUESTION
+example.net.	IN	A
+SECTION AUTHORITY
+example.net.	IN 	NS	netdns.example.net.
+SECTION ADDITIONAL
+netdns.example.net. IN A 127.0.0.1
+ENTRY_END
+
diff --git a/testdata/edns_cache.tdir/edns_cache.stub2 b/testdata/edns_cache.tdir/edns_cache.stub2
new file mode 100644
index 000000000000..f70eb98e7456
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.stub2
@@ -0,0 +1,33 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname noedns
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www.example.com.	IN	A
+SECTION ANSWER
+www.example.com.	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname noedns
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+netdns.example.net.	IN	A
+SECTION ANSWER
+netdns.example.net.	IN	A	127.0.0.1
+ENTRY_END
+
+; fail EDNS queries for netdns.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA FORMERR
+ADJUST copy_id
+SECTION QUESTION
+netdns.example.net.	IN	A
+ENTRY_END
+
diff --git a/testdata/edns_cache.tdir/edns_cache.test b/testdata/edns_cache.tdir/edns_cache.test
new file mode 100644
index 000000000000..53931ded2eb7
--- /dev/null
+++ b/testdata/edns_cache.tdir/edns_cache.test
@@ -0,0 +1,30 @@
+# #-- edns_cache.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+# notice that we use one stub server on IPv6 ::1 that supports EDNS that
+# gives referrals to the other server on IPv4 127.0.0.1 that is nonEDNS.
+
+PRE="../.."
+# do the test
+echo "> dig netdns.example.net."
+dig @::1 -p $UNBOUND_PORT netdns.example.net. | tee outfile
+echo "> dig www.example.com."
+dig @::1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat stub1.log"
+cat stub1.log 
+echo "> cat stub2.log"
+cat stub2.log 
+echo "> cat unbound.log"
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/edns_cache.tpkg b/testdata/edns_cache.tpkg
deleted file mode 100644
index 63756410856c..000000000000
--- a/testdata/edns_cache.tpkg
+++ /dev/null
diff --git a/testdata/edns_lame.tdir/edns_lame.conf b/testdata/edns_lame.tdir/edns_lame.conf
new file mode 100644
index 000000000000..9cd19c0d9d1c
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/edns_lame.tdir/edns_lame.dsc b/testdata/edns_lame.tdir/edns_lame.dsc
new file mode 100644
index 000000000000..83f972562b6b
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.dsc
@@ -0,0 +1,16 @@
+BaseName: edns_lame
+Version: 1.0
+Description: Forward UDP but EDNS packets time out
+CreationDate: Mon Sep 29 16:39:15 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: edns_lame.pre
+Post: edns_lame.post
+Test: edns_lame.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/edns_lame.tdir/edns_lame.post b/testdata/edns_lame.tdir/edns_lame.post
new file mode 100644
index 000000000000..f71e3c4246e6
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.post
@@ -0,0 +1,10 @@
+# #-- edns_lame.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/edns_lame.tdir/edns_lame.pre b/testdata/edns_lame.tdir/edns_lame.pre
new file mode 100644
index 000000000000..d8c2c076f470
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.pre
@@ -0,0 +1,30 @@
+# #-- edns_lame.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -v edns_lame.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < edns_lame.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -vvvv -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
diff --git a/testdata/edns_lame.tdir/edns_lame.test b/testdata/edns_lame.tdir/edns_lame.test
new file mode 100644
index 000000000000..92d669267402
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.test
@@ -0,0 +1,24 @@
+# #-- edns_lame.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/edns_lame.tdir/edns_lame.testns b/testdata/edns_lame.tdir/edns_lame.testns
new file mode 100644
index 000000000000..cd248c3b37eb
--- /dev/null
+++ b/testdata/edns_lame.tdir/edns_lame.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname noedns
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/edns_lame.tpkg b/testdata/edns_lame.tpkg
deleted file mode 100644
index 643fe0c61298..000000000000
--- a/testdata/edns_lame.tpkg
+++ /dev/null
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.conf b/testdata/fwd_ancil.tdir/fwd_ancil.conf
new file mode 100644
index 000000000000..022e10f717c4
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 1
+	# num-threads: 1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	interface-automatic: yes
+	access-control: 0.0.0.0/0 allow
+	access-control: ::0/0 allow
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.dsc b/testdata/fwd_ancil.tdir/fwd_ancil.dsc
new file mode 100644
index 000000000000..eac1c8f12b08
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_ancil
+Version: 1.0
+Description: Test if ip6 ancillary recvmsg and sendmsg work.
+CreationDate: Tue Jan 15 10:47:37 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_ancil.pre
+Post: fwd_ancil.post
+Test: fwd_ancil.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.post b/testdata/fwd_ancil.tdir/fwd_ancil.post
new file mode 100644
index 000000000000..a74ba856e3b6
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.post
@@ -0,0 +1,18 @@
+# #-- fwd_ancil.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+if test `hostname`"" = "dicht.nlnetlabs.nl"; then
+	echo "In jail, no ::1, skip test"
+	exit 0
+fi
+
+kill_pid $FWD_PID
+if fgrep "service stopped" unbound.log; then
+	exit 0
+fi      
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.pre b/testdata/fwd_ancil.tdir/fwd_ancil.pre
new file mode 100644
index 000000000000..e1ce37a7fcca
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.pre
@@ -0,0 +1,44 @@
+# #-- fwd_ancil.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+. ../common.sh
+
+if test `hostname`"" = "dicht.nlnetlabs.nl"; then
+	echo "In jail, no ::1, skip test"
+	exit 0
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_ancil.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_ancil.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+
+wait_ldns_testns_up fwd.log
+
+# wait for unbound to come up
+# string 'Start of service' in log.
+wait_server_up_or_fail unbound.log "start of service" "disable interface-automatic"
+if fgrep "disable interface-automatic" unbound.log; then
+	echo "skip test"
+	exit 1
+fi
+
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.test b/testdata/fwd_ancil.tdir/fwd_ancil.test
new file mode 100644
index 000000000000..b90360fb8b4d
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.test
@@ -0,0 +1,101 @@
+# #-- fwd_ancil.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+if test `hostname`"" = "dicht.nlnetlabs.nl"; then
+	echo "In jail, no ::1, skip test"
+	exit 0
+fi
+
+if fgrep "disable interface-automatic" unbound.log; then
+	echo "skip test"
+	exit 0
+fi
+
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+# detect platform support first
+echo "> streamtcp -n -u -f 127.0.0.1 www.example.com. A IN"
+$PRE/streamtcp -n -u -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+sleep 2
+echo "> check answer"
+if ! grep "Please disable interface-automatic" unbound.log; then
+	echo "OK"
+else
+	echo "No platform support for ancillary data"
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK - but ignore test"
+	exit 0
+fi
+rm outfile
+
+
+# do the test
+echo "> streamtcp -f 127.0.0.1 www.example.com. A IN"
+$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+rm outfile
+
+echo "> streamtcp -f ::1 www.example.com. A IN"
+$PRE/streamtcp -f ::1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+rm outfile
+
+echo "> streamtcp -u -f ::1 www.example.com. A IN"
+$PRE/streamtcp -u -f ::1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+rm outfile
+
+echo "> streamtcp -u -f 127.0.0.1 www.example.com. A IN"
+$PRE/streamtcp -u -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+rm outfile
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+exit 0
diff --git a/testdata/fwd_ancil.tdir/fwd_ancil.testns b/testdata/fwd_ancil.tdir/fwd_ancil.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/fwd_ancil.tdir/fwd_ancil.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_ancil.tpkg b/testdata/fwd_ancil.tpkg
deleted file mode 100644
index 34021180e7a9..000000000000
--- a/testdata/fwd_ancil.tpkg
+++ /dev/null
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.conf b/testdata/fwd_bogus.tdir/fwd_bogus.conf
new file mode 100644
index 000000000000..04ec5aacd559
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.conf
@@ -0,0 +1,26 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	fake-sha1: yes
+remote-control:
+        control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.dsc b/testdata/fwd_bogus.tdir/fwd_bogus.dsc
new file mode 100644
index 000000000000..a578d22af2bd
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_bogus
+Version: 1.0
+Description: Forward and check bogus TTL in the cache.
+CreationDate: Thu Sep 10 10:14:57 CEST 2009
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_bogus.pre
+Post: fwd_bogus.post
+Test: fwd_bogus.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.post b/testdata/fwd_bogus.tdir/fwd_bogus.post
new file mode 100644
index 000000000000..ec91bc7cad11
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.post
@@ -0,0 +1,10 @@
+# #-- fwd_bogus.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.pre b/testdata/fwd_bogus.tdir/fwd_bogus.pre
new file mode 100644
index 000000000000..b4cf2a0fd1b0
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.pre
@@ -0,0 +1,32 @@
+# #-- fwd_bogus.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+CONTROL_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_bogus.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < fwd_bogus.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.test b/testdata/fwd_bogus.tdir/fwd_bogus.test
new file mode 100644
index 000000000000..743b4e66a694
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.test
@@ -0,0 +1,48 @@
+# #-- fwd_bogus.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+# servfail.
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# now check the cache.
+$PRE/unbound-control -c ub.conf dump_cache > cachedump
+if test $? -ne 0; then
+	echo "unbound-control failed"
+	cat cachedump
+	exit 1
+else
+	echo "unbound-control ok"
+fi
+
+# bad cache entry looks like this
+# msg www.example.com. IN A 32896 1 1252576696 1 1 0 0
+cat cachedump
+
+ttl=`grep "msg www.example.com" cachedump | awk '{print $7}'`
+echo TTL $ttl
+# must be smaller than bogus ttl of 60.
+if test $ttl -gt 61; then
+	echo "failed: TTL too big!"
+	exit 1
+else
+	echo "TTL OK"
+fi
+
+exit 0
diff --git a/testdata/fwd_bogus.tdir/fwd_bogus.testns b/testdata/fwd_bogus.tdir/fwd_bogus.testns
new file mode 100644
index 000000000000..258c0e938f20
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/fwd_bogus.testns
@@ -0,0 +1,25 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+; give unsigned answers!
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+@	IN	DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_bogus.tdir/unbound_control.key b/testdata/fwd_bogus.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/fwd_bogus.tdir/unbound_control.pem b/testdata/fwd_bogus.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/fwd_bogus.tdir/unbound_server.key b/testdata/fwd_bogus.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/fwd_bogus.tdir/unbound_server.pem b/testdata/fwd_bogus.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/fwd_bogus.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/fwd_bogus.tpkg b/testdata/fwd_bogus.tpkg
deleted file mode 100644
index 3a49d1f7558d..000000000000
--- a/testdata/fwd_bogus.tpkg
+++ /dev/null
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.conf b/testdata/fwd_capsid.tdir/fwd_capsid.conf
new file mode 100644
index 000000000000..dbb2eb8887fc
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 4
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: yes
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.dsc b/testdata/fwd_capsid.tdir/fwd_capsid.dsc
new file mode 100644
index 000000000000..0899dc5e2d53
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_capsid
+Version: 1.0
+Description: Forward and check 0x20 bits.
+CreationDate: Mon Oct  6 16:25:09 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_capsid.pre
+Post: fwd_capsid.post
+Test: fwd_capsid.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.post b/testdata/fwd_capsid.tdir/fwd_capsid.post
new file mode 100644
index 000000000000..6ecf9125547d
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.post
@@ -0,0 +1,10 @@
+# #-- fwd_capsid.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.pre b/testdata/fwd_capsid.tdir/fwd_capsid.pre
new file mode 100644
index 000000000000..16365a46e872
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.pre
@@ -0,0 +1,31 @@
+# #-- fwd_capsid.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_capsid.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_capsid.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.test b/testdata/fwd_capsid.tdir/fwd_capsid.test
new file mode 100644
index 000000000000..8b49691e5fd5
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.test
@@ -0,0 +1,22 @@
+# #-- fwd_capsid.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_capsid.tdir/fwd_capsid.testns b/testdata/fwd_capsid.tdir/fwd_capsid.testns
new file mode 100644
index 000000000000..8bb1b9deb22b
--- /dev/null
+++ b/testdata/fwd_capsid.tdir/fwd_capsid.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id copy_query
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_capsid.tpkg b/testdata/fwd_capsid.tpkg
deleted file mode 100644
index 3f50639cb215..000000000000
--- a/testdata/fwd_capsid.tpkg
+++ /dev/null
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.conf b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.conf
new file mode 100644
index 000000000000..dbb2eb8887fc
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 4
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: yes
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.dsc b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.dsc
new file mode 100644
index 000000000000..3b873458210b
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_capsid_fallback
+Version: 1.0
+Description: Forward and do 0x20 fallback.
+CreationDate: Mon Oct  6 16:30:15 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_capsid_fallback.pre
+Post: fwd_capsid_fallback.post
+Test: fwd_capsid_fallback.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.post b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.post
new file mode 100644
index 000000000000..81c334a74cc2
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.post
@@ -0,0 +1,10 @@
+# #-- fwd_capsid_fallback.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.pre b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.pre
new file mode 100644
index 000000000000..0558bea5e05e
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.pre
@@ -0,0 +1,30 @@
+# #-- fwd_capsid_fallback.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_capsid_fallback.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_capsid_fallback.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.test b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.test
new file mode 100644
index 000000000000..eba834f14dfd
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.test
@@ -0,0 +1,22 @@
+# #-- fwd_capsid_fallback.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.testns b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.testns
new file mode 100644
index 000000000000..f0d809e06ca5
--- /dev/null
+++ b/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.testns
@@ -0,0 +1,15 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+; WEIRD CAPS! ; probably not the query!
+WwWabcdefghijklmnopqrstuvwxyzWwW.ExAMPLE.CoM. 	IN	A
+SECTION ANSWER
+wWwABCDEFGHIJKLMNopqrstuvwxyzWwW.ExAMPLE.CoM.	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_capsid_fallback.tpkg b/testdata/fwd_capsid_fallback.tpkg
deleted file mode 100644
index fed74134cfb4..000000000000
--- a/testdata/fwd_capsid_fallback.tpkg
+++ /dev/null
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.conf b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.conf
new file mode 100644
index 000000000000..8d077d13629c
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 4
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: yes
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+	forward-addr: "127.0.0.1@@TOPORT2@"
+
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.dsc b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.dsc
new file mode 100644
index 000000000000..b40a5403f36d
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_capsid_strip
+Version: 1.0
+Description: Forward and do 0x20 fallback that needs stripping.
+CreationDate: Fri 30 Jan 10:41:33 CET 2015
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_capsid_strip.pre
+Post: fwd_capsid_strip.post
+Test: fwd_capsid_strip.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.post b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.post
new file mode 100644
index 000000000000..7ca39f5547a6
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.post
@@ -0,0 +1,11 @@
+# #-- fwd_capsid_strip.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $FWD_PID2
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.pre b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.pre
new file mode 100644
index 000000000000..e761d11b51c0
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.pre
@@ -0,0 +1,38 @@
+# #-- fwd_capsid_strip.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+FWD2_PORT=$(($FWD_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "FWD2_PORT=$FWD2_PORT" >> .tpkg.var.test
+
+# start forwarder 1
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_capsid_strip.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start forwarder 2
+$LDNS_TESTNS -p $FWD2_PORT fwd_capsid_strip.testns2 >fwd2.log 2>&1 &
+FWD_PID2=$!
+echo "FWD_PID2=$FWD_PID2" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@TOPORT2\@/'$FWD2_PORT'/' < fwd_capsid_strip.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_ldns_testns_up fwd2.log
+wait_unbound_up unbound.log
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.test b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.test
new file mode 100644
index 000000000000..a74f89f79af2
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.test
@@ -0,0 +1,23 @@
+# #-- fwd_capsid_strip.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat fwd2.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns
new file mode 100644
index 000000000000..e1d82a038f9b
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns
@@ -0,0 +1,20 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+; WEIRD CAPS! ; probably not the query!
+WwWabcdefghijklmnopqrstuvwxyzWwW.ExAMPLE.CoM. 	IN	A
+SECTION ANSWER
+wWwABCDEFGHIJKLMNopqrstuvwxyzWwW.ExAMPLE.CoM.	IN	A	10.20.30.40
+SECTION AUTHORITY
+example.com. IN NS ns1.example.com.
+example.com. IN NS ns2.example.com.
+SECTION ADDITIONAL
+ns1.example.com. IN A 1.2.3.4
+ENTRY_END
+
diff --git a/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns2 b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns2
new file mode 100644
index 000000000000..77213abc22fd
--- /dev/null
+++ b/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns2
@@ -0,0 +1,18 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+; WEIRD CAPS! ; probably not the query!
+WwWabcdefghijklmnopqrstuvwxyzWwW.ExAMPLE.CoM. 	IN	A
+SECTION ANSWER
+wWwABCDEFGHIJKLMNopqrstuvwxyzWwW.ExAMPLE.CoM.	IN	A	10.20.30.40
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns2.example.com. IN A 1.2.3.5
+ENTRY_END
+
diff --git a/testdata/fwd_capsid_strip.tpkg b/testdata/fwd_capsid_strip.tpkg
deleted file mode 100644
index c0be8a3c5dd6..000000000000
--- a/testdata/fwd_capsid_strip.tpkg
+++ /dev/null
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.conf b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.conf
new file mode 100644
index 000000000000..65552c85bd68
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.conf
@@ -0,0 +1,18 @@
+server:
+	verbosity: 4
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: yes
+	caps-whitelist: "example.com"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+	forward-addr: "127.0.0.1@@TOPORT2@"
+
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.dsc b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.dsc
new file mode 100644
index 000000000000..3c9f042e8f47
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_capsid_white
+Version: 1.0
+Description: Forward and and test 0x20 whitelist.
+CreationDate: Fri  1 May 14:25:04 CEST 2015
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_capsid_white.pre
+Post: fwd_capsid_white.post
+Test: fwd_capsid_white.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.post b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.post
new file mode 100644
index 000000000000..c68987276e47
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.post
@@ -0,0 +1,11 @@
+# #-- fwd_capsid_white.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $FWD_PID2
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.pre b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.pre
new file mode 100644
index 000000000000..18e801c18207
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.pre
@@ -0,0 +1,38 @@
+# #-- fwd_capsid_white.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+FWD2_PORT=$(($FWD_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "FWD2_PORT=$FWD2_PORT" >> .tpkg.var.test
+
+# start forwarder 1
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_capsid_white.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start forwarder 2
+$LDNS_TESTNS -p $FWD2_PORT fwd_capsid_white.testns2 >fwd2.log 2>&1 &
+FWD_PID2=$!
+echo "FWD_PID2=$FWD_PID2" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@TOPORT2\@/'$FWD2_PORT'/' < fwd_capsid_white.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_ldns_testns_up fwd2.log
+wait_unbound_up unbound.log
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.test b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.test
new file mode 100644
index 000000000000..d287259e045b
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.test
@@ -0,0 +1,23 @@
+# #-- fwd_capsid_white.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat fwd2.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns
new file mode 100644
index 000000000000..f0d809e06ca5
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns
@@ -0,0 +1,15 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+; WEIRD CAPS! ; probably not the query!
+WwWabcdefghijklmnopqrstuvwxyzWwW.ExAMPLE.CoM. 	IN	A
+SECTION ANSWER
+wWwABCDEFGHIJKLMNopqrstuvwxyzWwW.ExAMPLE.CoM.	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns2 b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns2
new file mode 100644
index 000000000000..766043596241
--- /dev/null
+++ b/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns2
@@ -0,0 +1,17 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+; WEIRD CAPS! ; probably not the query!
+WwWabcdefghijklmnopqrstuvwxyzWwW.ExAMPLE.CoM. 	IN	A
+SECTION ANSWER
+wWwABCDEFGHIJKLMNopqrstuvwxyzWwW.ExAMPLE.CoM.	IN	A	10.20.30.44
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
diff --git a/testdata/fwd_capsid_white.tpkg b/testdata/fwd_capsid_white.tpkg
deleted file mode 100644
index 199befb56871..000000000000
--- a/testdata/fwd_capsid_white.tpkg
+++ /dev/null
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
new file mode 100644
index 000000000000..39bd9f5cb23d
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.dsc b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.dsc
new file mode 100644
index 000000000000..6446e612f807
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_compress_c00c
+Version: 1.0
+Description: Forward and check compression of answer to query name.
+CreationDate: Mon Oct 15 15:57:03 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_compress_c00c.pre
+Post: fwd_compress_c00c.post
+Test: fwd_compress_c00c.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.good b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.good
new file mode 100644
index 000000000000..527895a560d8
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.good
@@ -0,0 +1,7 @@
+0000000: 006c eb41 8180 0001 0001 0003 0000 0a6f  .l.A...........o
+0000010: 7665 7265 696e 6465 7203 6e65 7400 0001  vereinder.net...
+0000020: 0001 c00c 0001 0001 0000 0384 0004 5038  ..............P8
+0000030: dfcd c00c 0002 0001 0001 5180 0010 0161  ..........Q....a
+0000040: 026e 7305 6a6f 6b65 7203 636f 6d00 c00c  .ns.joker.com...
+0000050: 0002 0001 0001 5180 0004 0162 c03e c00c  ......Q....b.>..
+0000060: 0002 0001 0001 5180 0004 0163 c03e       ......Q....c.>
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.post b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.post
new file mode 100644
index 000000000000..e6dda048d77d
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.post
@@ -0,0 +1,10 @@
+# #-- fwd_compress_c00c.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.pre b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.pre
new file mode 100644
index 000000000000..48dc75794192
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.pre
@@ -0,0 +1,31 @@
+# #-- fwd_compress_c00c.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_compress_c00c.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_compress_c00c.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test
new file mode 100644
index 000000000000..67354d014fff
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test
@@ -0,0 +1,49 @@
+# #-- fwd_compress_c00c.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+# check what sort of netcat we have
+if nc -h 2>&1 | grep "q secs"; then
+	ncopt="-q 3 -w 2"
+else
+	ncopt="-w 2"
+fi
+
+PRE="../.."
+# do the test
+echo "> query overeinder.net | nc $ncopt tcp | xxd."
+echo "0020eb41010000010000000000000a6f76657265696e646572036e65740000010001" | xxd -r -p | nc $ncopt 127.0.0.1 $UNBOUND_PORT | xxd | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> cat outfile"
+cat outfile
+echo "> check answer"
+if grep "0000000: 007a" outfile; then
+	echo "too big!"
+	exit 1
+fi
+if grep "0000000: 006c" outfile; then
+	echo "OK"
+else	
+	echo "bad size, not OK"
+	exit 1
+fi
+
+if grep "^00000000: 006c" outfile; then
+	echo "fixup xxd with long file positions"
+	sed -e 's/^0//' < outfile > outfile2
+	mv outfile2 outfile
+	cat outfile
+fi
+
+if diff fwd_compress_c00c.good outfile; then
+	echo "Diff OK"
+else
+	echo "Diff in output"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.testns b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.testns
new file mode 100644
index 000000000000..e9574a6ee87e
--- /dev/null
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.testns
@@ -0,0 +1,18 @@
+; nameserver test file
+$ORIGIN overeinder.net.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+overeinder.net.      IN      A
+SECTION ANSWER
+overeinder.net. 900     IN      A       80.56.223.205
+SECTION AUTHORITY
+overeinder.net. 86400   IN      NS      a.ns.joker.com.
+overeinder.net. 86400   IN      NS      b.ns.joker.com.
+overeinder.net. 86400   IN      NS      c.ns.joker.com.
+ENTRY_END
+
diff --git a/testdata/fwd_compress_c00c.tpkg b/testdata/fwd_compress_c00c.tpkg
deleted file mode 100644
index a75a56a7d6e6..000000000000
--- a/testdata/fwd_compress_c00c.tpkg
+++ /dev/null
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.conf b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.conf
new file mode 100644
index 000000000000..b4d62a2f6e91
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.conf
@@ -0,0 +1,23 @@
+server:
+	verbosity: 5
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: UPORT
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	# key +005+30899
+	trust-anchor: "example.com.	3600	IN	DS	30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512"
+	# validation time
+	val-override-date: "20100406005004"
+	fake-sha1: yes
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@TOPORT"
+stub-zone:
+	name: "example.com"
+	stub-addr: "127.0.0.1@TOPORT"
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.dsc b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.dsc
new file mode 100644
index 000000000000..7a2727588cec
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_edns_bksec
+Version: 1.0
+Description: Forward EDNS backoff for DNSSEC domain
+CreationDate: Tue Apr  6 08:45:57 CEST 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_edns_bksec.pre
+Post: fwd_edns_bksec.post
+Test: fwd_edns_bksec.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.post b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.post
new file mode 100644
index 000000000000..c43b038679be
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.post
@@ -0,0 +1,10 @@
+# #-- fwd_edns_bksec.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.pre b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.pre
new file mode 100644
index 000000000000..d24f92d73a10
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.pre
@@ -0,0 +1,31 @@
+# #-- fwd_edns_bksec.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -v -p $FWD_PORT fwd_edns_bksec.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/UPORT/'$UNBOUND_PORT'/' -e 's/TOPORT/'$FWD_PORT'/' < fwd_edns_bksec.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.test b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.test
new file mode 100644
index 000000000000..4acd01e88dd1
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.test
@@ -0,0 +1,42 @@
+# #-- fwd_edns_bksec.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+#
+# First the nasty name.
+# The server should not have performed EDNS fallback and cached it.
+echo "> dig nasty.example.com."
+dig @localhost -p $UNBOUND_PORT nasty.example.com. | tee outfile
+
+# no answer possible for it.
+echo "> check backed-off"
+if grep "10.20.30.77" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# Then the www name.
+# See if we can still get the EDNS data.
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.testns b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.testns
new file mode 100644
index 000000000000..d54f2b0bec0b
--- /dev/null
+++ b/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.testns
@@ -0,0 +1,73 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+; DNSKEY lookup works.
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+example.com.	IN	DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20100429005004 20100401005004 30899 example.com. CcIIAhvwMsSnPzJdT1onlMK8jgQnKzYoklOsm8ab644jhQfWo/BIXyJ1l9ImK4J2+quIHdrXESTMHJ5KNRs2Sw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+example.com.	IN	DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+;example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20100429005004 20100401005004 30899 example.com. CcIIAhvwMsSnPzJdT1onlMK8jgQnKzYoklOsm8ab644jhQfWo/BIXyJ1l9ImK4J2+quIHdrXESTMHJ5KNRs2Sw== ;{id = 30899}
+ENTRY_END
+
+; the first part has nasty having a 'timeout'.
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR FORMERR
+ADJUST copy_id
+SECTION QUESTION
+nasty	IN	A
+ENTRY_END
+
+; the next part has nasty recover (with timing to be exactly during noEDNS).
+; therefore we return the signature to make our test run fast.
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+nasty	IN	A
+SECTION ANSWER
+nasty	IN	A	10.20.30.77
+nasty.example.com.	3600	IN	RRSIG	A 5 3 3600 20100429005004 20100401005004 30899 example.com. nV1rzF6ow8sp5k315hczuO1xRQT5MrS14BEZ0Md71/EoCfVtjD+WK63w2MnPzqLIw3YRyfC1S/bMc3B7cVZv5A== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20100429005004 20100401005004 30899 example.com. gM9dI2Ew/zsRMD8ZrqetGo4xYts51quV4/CaOemUPAx8LOvGNJMGrHpJ1Q+CW7CWTauqNscFLlgUcmUQ2+RIlA== ;{id = 30899}
+ENTRY_END
+
+; fake answer so we can distinguish it
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_edns_bksec.tpkg b/testdata/fwd_edns_bksec.tpkg
deleted file mode 100644
index dc8ac739d626..000000000000
--- a/testdata/fwd_edns_bksec.tpkg
+++ /dev/null
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.conf b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.conf
new file mode 100644
index 000000000000..4756b4bbb3bd
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.conf
@@ -0,0 +1,14 @@
+server:
+	verbosity: 5
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: UPORT
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@TOPORT"
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.dsc b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.dsc
new file mode 100644
index 000000000000..17a102c55ef7
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_edns_probe
+Version: 1.0
+Description: Forward with EDNS probing
+CreationDate: Wed Jan  6 09:45:50 CET 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_edns_probe.pre
+Post: fwd_edns_probe.post
+Test: fwd_edns_probe.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.post b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.post
new file mode 100644
index 000000000000..0f66815231a5
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.post
@@ -0,0 +1,10 @@
+# #-- fwd_edns_probe.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.pre b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.pre
new file mode 100644
index 000000000000..fe31c8fddf74
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.pre
@@ -0,0 +1,31 @@
+# #-- fwd_edns_probe.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_edns_probe.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/UPORT/'$UNBOUND_PORT'/' -e 's/TOPORT/'$FWD_PORT'/' < fwd_edns_probe.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.test b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.test
new file mode 100644
index 000000000000..225120421cb0
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.test
@@ -0,0 +1,42 @@
+# #-- fwd_edns_probe.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+#
+# First the nasty name.
+# The server should not have performed EDNS fallback and cached it.
+echo "> dig nasty.example.com."
+dig @localhost -p $UNBOUND_PORT nasty.example.com. | tee outfile
+
+# no answer possible for it.
+echo "> check no-answer"
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# Then the www name.
+# See if we can still get the EDNS data.
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_edns_probe.tdir/fwd_edns_probe.testns b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.testns
new file mode 100644
index 000000000000..5197eafe8c55
--- /dev/null
+++ b/testdata/fwd_edns_probe.tdir/fwd_edns_probe.testns
@@ -0,0 +1,42 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR FORMERR
+ADJUST copy_id
+SECTION QUESTION
+nasty	IN	A
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR FORMERR
+ADJUST copy_id
+SECTION QUESTION
+nasty	IN	A
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_edns_probe.tpkg b/testdata/fwd_edns_probe.tpkg
deleted file mode 100644
index c92689797df8..000000000000
--- a/testdata/fwd_edns_probe.tpkg
+++ /dev/null
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.conf b/testdata/fwd_malformed.tdir/fwd_malformed.conf
new file mode 100644
index 000000000000..50cf6404f34d
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 5
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: yes
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.dsc b/testdata/fwd_malformed.tdir/fwd_malformed.dsc
new file mode 100644
index 000000000000..b778c564dba2
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_malformed
+Version: 1.0
+Description: Check authority that returns malformed packet.
+CreationDate: Tue 13 Jun 09:35:40 CEST 2017
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_malformed.pre
+Post: fwd_malformed.post
+Test: fwd_malformed.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.post b/testdata/fwd_malformed.tdir/fwd_malformed.post
new file mode 100644
index 000000000000..690b04cf0953
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.post
@@ -0,0 +1,10 @@
+# #-- fwd_malformed.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.pre b/testdata/fwd_malformed.tdir/fwd_malformed.pre
new file mode 100644
index 000000000000..dec7e0c5a7b2
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.pre
@@ -0,0 +1,31 @@
+# #-- fwd_malformed.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_malformed.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_malformed.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.test b/testdata/fwd_malformed.tdir/fwd_malformed.test
new file mode 100644
index 000000000000..621605daeee8
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.test
@@ -0,0 +1,22 @@
+# #-- fwd_malformed.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_malformed.tdir/fwd_malformed.testns b/testdata/fwd_malformed.tdir/fwd_malformed.testns
new file mode 100644
index 000000000000..52b4cfa8a5e7
--- /dev/null
+++ b/testdata/fwd_malformed.tdir/fwd_malformed.testns
@@ -0,0 +1,23 @@
+; malformed packet created
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id
+HEX_ANSWER_BEGIN
+        03b8 0800 4500 0042 b40d 0000 
+	e4c2 d1e3 d2f8 d48c b5df  
+        1b93 0800 4500           
+HEX_ANSWER_END
+ENTRY_END
+
+; malformed packet from reporter
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id
+HEX_ANSWER_BEGIN
+        03b8 0800 4500 0042 b40d 0000 7211 548a  ; ....E..B....r.T.
+        8ccd 5119 d857 89d5 0035 6b80 002e 0000  ; ..Q..W...5k.....
+        cdb2 8015 0001 0000 0000 0001 0558 7a6a  ; .............Xzj
+        7051 0378 797a e4c2 d1e3 d2f8 d48c b5df  ; pQ.xyz..........
+        1b93 0800 4500                           ; ....E.
+HEX_ANSWER_END
+ENTRY_END
diff --git a/testdata/fwd_malformed.tpkg b/testdata/fwd_malformed.tpkg
deleted file mode 100644
index 82a11ac23d88..000000000000
--- a/testdata/fwd_malformed.tpkg
+++ /dev/null
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.conf b/testdata/fwd_no_edns.tdir/fwd_no_edns.conf
new file mode 100644
index 000000000000..9367e282a376
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.conf
@@ -0,0 +1,14 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: UPORT
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@TOPORT"
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.dsc b/testdata/fwd_no_edns.tdir/fwd_no_edns.dsc
new file mode 100644
index 000000000000..167d358394e9
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_no_edns
+Version: 1.0
+Description: Forward retry with no EDNS
+CreationDate: Tue May 22 15:17:45 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_no_edns.pre
+Post: fwd_no_edns.post
+Test: fwd_no_edns.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.post b/testdata/fwd_no_edns.tdir/fwd_no_edns.post
new file mode 100644
index 000000000000..c88b8f5b70ad
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.post
@@ -0,0 +1,11 @@
+# #-- fwd_no_edns.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.pre b/testdata/fwd_no_edns.tdir/fwd_no_edns.pre
new file mode 100644
index 000000000000..1d775b48d478
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.pre
@@ -0,0 +1,31 @@
+# #-- fwd_no_edns.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_no_edns.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/UPORT/'$UNBOUND_PORT'/' -e 's/TOPORT/'$FWD_PORT'/' < fwd_no_edns.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.test b/testdata/fwd_no_edns.tdir/fwd_no_edns.test
new file mode 100644
index 000000000000..bc209ea09c50
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.test
@@ -0,0 +1,22 @@
+# #-- fwd_no_edns.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_no_edns.tdir/fwd_no_edns.testns b/testdata/fwd_no_edns.tdir/fwd_no_edns.testns
new file mode 100644
index 000000000000..b3742e4a89f1
--- /dev/null
+++ b/testdata/fwd_no_edns.tdir/fwd_no_edns.testns
@@ -0,0 +1,26 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP DO
+REPLY QR AA FORMERR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/fwd_no_edns.tpkg b/testdata/fwd_no_edns.tpkg
deleted file mode 100644
index 9de545d164d0..000000000000
--- a/testdata/fwd_no_edns.tpkg
+++ /dev/null
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.conf b/testdata/fwd_oneport.tdir/fwd_oneport.conf
new file mode 100644
index 000000000000..f3427fece2c5
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.conf
@@ -0,0 +1,18 @@
+server:
+	verbosity: 4
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	outgoing-range: 2
+	outgoing-port-avoid: 0-65535
+	outgoing-port-permit: 20675
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	num-queries-per-thread: 1024
+	use-syslog: no
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.dsc b/testdata/fwd_oneport.tdir/fwd_oneport.dsc
new file mode 100644
index 000000000000..566aed9a7ba6
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_oneport
+Version: 1.0
+Description: Forward udp over one port with 2 fds
+CreationDate: Mon Apr 14 10:39:27 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_oneport.pre
+Post: fwd_oneport.post
+Test: fwd_oneport.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.post b/testdata/fwd_oneport.tdir/fwd_oneport.post
new file mode 100644
index 000000000000..8aafab7ca9bd
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.post
@@ -0,0 +1,18 @@
+# #-- fwd_oneport.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+
+# find all extra forked testns and kill them.
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+for p in $pidlist; do
+	kill_pid $p
+done
+
+# kill unbound
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.pre b/testdata/fwd_oneport.tdir/fwd_oneport.pre
new file mode 100644
index 000000000000..eeb5238a9334
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.pre
@@ -0,0 +1,31 @@
+# #-- fwd_oneport.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -f 9 fwd_oneport.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_oneport.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.test b/testdata/fwd_oneport.tdir/fwd_oneport.test
new file mode 100644
index 000000000000..f6dfcea91f71
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.test
@@ -0,0 +1,111 @@
+# #-- fwd_oneport.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+
+# skip the single query test
+# so that all three queries get timeouts during the later test.
+#
+#echo "> dig www1.example.com."
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
+#echo "> cat logfiles"
+#cat fwd.log 
+#cat unbound.log
+#echo "> check answer for single query"
+#if grep "10.20.30.40" outfile; then
+	#echo "OK"
+#else
+	#echo "Not OK"
+	#exit 1
+#fi
+
+echo "> do queries"
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
+digpid1=$!
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
+digpid2=$!
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
+digpid3=$!
+dig @localhost -p $UNBOUND_PORT www4.example.com. >outfile4 &
+digpid4=$!
+dig @localhost -p $UNBOUND_PORT www5.example.com. >outfile5 &
+digpid5=$!
+dig @localhost -p $UNBOUND_PORT www6.example.com. >outfile6 &
+digpid6=$!
+sleep 6
+kill -9 $digpid1
+kill -9 $digpid2
+kill -9 $digpid3
+kill -9 $digpid4
+kill -9 $digpid5
+kill -9 $digpid6
+
+echo "> cat outfile1"
+cat outfile1 
+echo "> cat outfile2"
+cat outfile2 
+echo "> cat outfile3"
+cat outfile3
+echo "> cat outfile4"
+cat outfile4
+echo "> cat outfile5"
+cat outfile5
+echo "> cat outfile6"
+cat outfile6
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+
+echo "> check for ID bit collisions"
+grep "pending reply" unbound.log > ids
+numsend=`cat ids | wc -l`
+cat ids | awk '{print $8};' | sort -u > ids2
+numuniq=`cat ids2 | wc -l`
+if test $numuniq -ne $numsend; then
+	echo "got a ID number clash. could not do test, sorry"
+	exit 0
+fi
+
+echo "> check answers for queries"
+if grep "10.20.30.40" outfile1; then
+	echo "1 is OK"
+else
+	echo "1 is not OK"
+	exit 1
+fi
+if grep "10.20.30.50" outfile2; then
+	echo "2 is OK"
+else
+	echo "2 is not OK"
+	exit 1
+fi
+if grep "10.20.30.60" outfile3; then
+	echo "3 is OK"
+else
+	echo "3 is not OK"
+	exit 1
+fi
+if grep "10.20.30.70" outfile4; then
+	echo "4 is OK"
+else
+	echo "4 is not OK"
+	exit 1
+fi
+if grep "10.20.30.80" outfile5; then
+	echo "5 is OK"
+else
+	echo "5 is not OK"
+	exit 1
+fi
+if grep "10.20.30.90" outfile6; then
+	echo "6 is OK"
+else
+	echo "6 is not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.testns b/testdata/fwd_oneport.tdir/fwd_oneport.testns
new file mode 100644
index 000000000000..e6ce8824af9a
--- /dev/null
+++ b/testdata/fwd_oneport.tdir/fwd_oneport.testns
@@ -0,0 +1,64 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www4	IN	A
+SECTION ANSWER
+www4	IN	A	10.20.30.70
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www5	IN	A
+SECTION ANSWER
+www5	IN	A	10.20.30.80
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www6	IN	A
+SECTION ANSWER
+www6	IN	A	10.20.30.90
+ENTRY_END
+
diff --git a/testdata/fwd_oneport.tpkg b/testdata/fwd_oneport.tpkg
deleted file mode 100644
index 02f5182d39bf..000000000000
--- a/testdata/fwd_oneport.tpkg
+++ /dev/null
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.conf b/testdata/fwd_tcp.tdir/fwd_tcp.conf
new file mode 100644
index 000000000000..2b900640e764
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.conf
@@ -0,0 +1,14 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.dsc b/testdata/fwd_tcp.tdir/fwd_tcp.dsc
new file mode 100644
index 000000000000..cf024b60cbe3
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_tcp
+Version: 1.0
+Description: Forward a TCP packet and return reply.
+CreationDate: Thu Feb  8 12:57:38 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_tcp.pre
+Post: fwd_tcp.post
+Test: fwd_tcp.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.post b/testdata/fwd_tcp.tdir/fwd_tcp.post
new file mode 100644
index 000000000000..28477b01a7ef
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.post
@@ -0,0 +1,10 @@
+# #-- fwd_tcp.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.pre b/testdata/fwd_tcp.tdir/fwd_tcp.pre
new file mode 100644
index 000000000000..96279b3d2489
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.pre
@@ -0,0 +1,31 @@
+# #-- fwd_tcp.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_tcp.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_tcp.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.test b/testdata/fwd_tcp.tdir/fwd_tcp.test
new file mode 100644
index 000000000000..9ecc5df153e9
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.test
@@ -0,0 +1,22 @@
+# #-- fwd_tcp.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost +vc -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_tcp.tdir/fwd_tcp.testns b/testdata/fwd_tcp.tdir/fwd_tcp.testns
new file mode 100644
index 000000000000..2ca3c1533314
--- /dev/null
+++ b/testdata/fwd_tcp.tdir/fwd_tcp.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_tcp.tpkg b/testdata/fwd_tcp.tpkg
deleted file mode 100644
index e85b93b90334..000000000000
--- a/testdata/fwd_tcp.tpkg
+++ /dev/null
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.conf b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.conf
new file mode 100644
index 000000000000..ad0a1a9cabd1
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.dsc b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.dsc
new file mode 100644
index 000000000000..4e729dd2fb7a
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_tcp_tc
+Version: 1.0
+Description: Forward retry in TCP mode
+CreationDate: Wed May  9 09:11:32 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_tcp_tc.pre
+Post: fwd_tcp_tc.post
+Test: fwd_tcp_tc.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.post b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.post
new file mode 100644
index 000000000000..9906e374c16a
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.post
@@ -0,0 +1,11 @@
+# #-- fwd_tcp_tc.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.pre b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.pre
new file mode 100644
index 000000000000..f316faf3762b
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.pre
@@ -0,0 +1,31 @@
+# #-- fwd_tcp_tc.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_tcp_tc.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_tcp_tc.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.test b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.test
new file mode 100644
index 000000000000..1a8f9edc1e64
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.test
@@ -0,0 +1,22 @@
+# #-- fwd_tcp_tc.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.testns b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.testns
new file mode 100644
index 000000000000..0af820e01deb
--- /dev/null
+++ b/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.testns
@@ -0,0 +1,26 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA TC NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname TCP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/fwd_tcp_tc.tpkg b/testdata/fwd_tcp_tc.tpkg
deleted file mode 100644
index 3f2c423385ca..000000000000
--- a/testdata/fwd_tcp_tc.tpkg
+++ /dev/null
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.conf b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.conf
new file mode 100644
index 000000000000..53871fbec0b2
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+	use-syslog: no
+	do-ip4: no
+	do-ip6: yes
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "::1@@TOPORT@"
+
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.dsc b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.dsc
new file mode 100644
index 000000000000..896e38141359
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_tcp_tc6
+Version: 1.0
+Description: Forward retry in TCP IP6 mode.
+CreationDate: Mon Oct 15 10:08:08 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_tcp_tc6.pre
+Post: fwd_tcp_tc6.post
+Test: fwd_tcp_tc6.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.post b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.post
new file mode 100644
index 000000000000..8d7a6e2b5cdb
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.post
@@ -0,0 +1,11 @@
+# #-- fwd_tcp_tc6.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.pre b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.pre
new file mode 100644
index 000000000000..618b55ac7c66
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.pre
@@ -0,0 +1,31 @@
+# #-- fwd_tcp_tc6.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -6 fwd_tcp_tc6.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_tcp_tc6.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.test b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.test
new file mode 100644
index 000000000000..81dbea6c2419
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.test
@@ -0,0 +1,26 @@
+# #-- fwd_tcp_tc6.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+# do the test
+echo "> streamtcp www.example.com."
+$PRE/streamtcp -u -f ::1@$UNBOUND_PORT www.example.com. A IN | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.testns b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.testns
new file mode 100644
index 000000000000..0af820e01deb
--- /dev/null
+++ b/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.testns
@@ -0,0 +1,26 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname UDP
+REPLY QR AA TC NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname TCP
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+www	IN	A	10.20.30.41
+www	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/fwd_tcp_tc6.tpkg b/testdata/fwd_tcp_tc6.tpkg
deleted file mode 100644
index 44348201894b..000000000000
--- a/testdata/fwd_tcp_tc6.tpkg
+++ /dev/null
diff --git a/testdata/fwd_three.tdir/fwd_three.conf b/testdata/fwd_three.tdir/fwd_three.conf
new file mode 100644
index 000000000000..f25ceb54ce63
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 4 # old 2
+	num-threads: 5
+	interface: 127.0.0.1
+	port: @PORT@
+	outgoing-range: 2
+	outgoing-num-tcp: 2
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	num-queries-per-thread: 1
+	use-syslog: no
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_three.tdir/fwd_three.dsc b/testdata/fwd_three.tdir/fwd_three.dsc
new file mode 100644
index 000000000000..804697dd4886
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_three
+Version: 1.0
+Description: Forward three queries at once, using threads.
+CreationDate: Tue Feb 27 14:11:44 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_three.pre
+Post: fwd_three.post
+Test: fwd_three.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_three.tdir/fwd_three.post b/testdata/fwd_three.tdir/fwd_three.post
new file mode 100644
index 000000000000..7b2971d625f6
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.post
@@ -0,0 +1,21 @@
+# #-- fwd_three.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+. ../common.sh
+# kill fwder
+kill_pid $FWD_PID
+
+# find all extra forked testns and kill them.
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+for p in $pidlist; do
+	kill_pid $p
+done
+
+# kill unbound
+kill_pid $UNBOUND_PID
+exit 0
diff --git a/testdata/fwd_three.tdir/fwd_three.pre b/testdata/fwd_three.tdir/fwd_three.pre
new file mode 100644
index 000000000000..7d522d958d89
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.pre
@@ -0,0 +1,31 @@
+# #-- fwd_three.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -f 9 fwd_three.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_three.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_three.tdir/fwd_three.test b/testdata/fwd_three.tdir/fwd_three.test
new file mode 100644
index 000000000000..962d0bf1c12b
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.test
@@ -0,0 +1,63 @@
+# #-- fwd_three.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www1.example.com."
+dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer for single query"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> do three queries"
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www1.example.com. >outfile1 &
+digpid1=$!
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www2.example.com. >outfile2 &
+digpid2=$!
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www3.example.com. >outfile3 &
+digpid3=$!
+sleep 5
+kill -9 $digpid1
+kill -9 $digpid2
+kill -9 $digpid3
+
+echo "> cat outfile1"
+cat outfile1 
+echo "> cat outfile2"
+cat outfile2 
+echo "> cat outfile3"
+cat outfile3
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answers for three queries"
+if grep "10.20.30.40" outfile1; then
+	echo "1 is OK"
+else
+	echo "1 is not OK"
+	exit 1
+fi
+if grep "10.20.30.50" outfile2; then
+	echo "2 is OK"
+else
+	echo "2 is not OK"
+	exit 1
+fi
+if grep "10.20.30.60" outfile3; then
+	echo "3 is OK"
+else
+	echo "3 is not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_three.tdir/fwd_three.testns b/testdata/fwd_three.tdir/fwd_three.testns
new file mode 100644
index 000000000000..b0b5e748bd53
--- /dev/null
+++ b/testdata/fwd_three.tdir/fwd_three.testns
@@ -0,0 +1,34 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
diff --git a/testdata/fwd_three.tpkg b/testdata/fwd_three.tpkg
deleted file mode 100644
index 24771698daf1..000000000000
--- a/testdata/fwd_three.tpkg
+++ /dev/null
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.conf b/testdata/fwd_three_service.tdir/fwd_three_service.conf
new file mode 100644
index 000000000000..05fafe015c49
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 2
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	outgoing-range: 2
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	num-queries-per-thread: 1024
+	use-syslog: no
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.dsc b/testdata/fwd_three_service.tdir/fwd_three_service.dsc
new file mode 100644
index 000000000000..039e9631acc8
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_three_service
+Version: 1.0
+Description: Forward three queries at once, using one thread.
+CreationDate: Wed Mar 28 15:26:21 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_three_service.pre
+Post: fwd_three_service.post
+Test: fwd_three_service.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.post b/testdata/fwd_three_service.tdir/fwd_three_service.post
new file mode 100644
index 000000000000..1d7a8daaebe0
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.post
@@ -0,0 +1,20 @@
+# #-- fwd_three_service.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+
+# kill fwder
+kill_pid $FWD_PID
+
+# find all extra forked testns and kill them.
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+for p in $pidlist; do
+	kill_pid $p
+done
+
+# kill unbound
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.pre b/testdata/fwd_three_service.tdir/fwd_three_service.pre
new file mode 100644
index 000000000000..9c6a3edf0827
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.pre
@@ -0,0 +1,31 @@
+# #-- fwd_three_service.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -f 9 fwd_three_service.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_three_service.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.test b/testdata/fwd_three_service.tdir/fwd_three_service.test
new file mode 100644
index 000000000000..6c5e34a7c305
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.test
@@ -0,0 +1,63 @@
+# #-- fwd_three_service.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www1.example.com."
+dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer for single query"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> do three queries"
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
+digpid1=$!
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
+digpid2=$!
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
+digpid3=$!
+sleep 5
+kill -9 $digpid1
+kill -9 $digpid2
+kill -9 $digpid3
+
+echo "> cat outfile1"
+cat outfile1 
+echo "> cat outfile2"
+cat outfile2 
+echo "> cat outfile3"
+cat outfile3
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answers for three queries"
+if grep "10.20.30.40" outfile1; then
+	echo "1 is OK"
+else
+	echo "1 is not OK"
+	exit 1
+fi
+if grep "10.20.30.50" outfile2; then
+	echo "2 is OK"
+else
+	echo "2 is not OK"
+	exit 1
+fi
+if grep "10.20.30.60" outfile3; then
+	echo "3 is OK"
+else
+	echo "3 is not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_three_service.tdir/fwd_three_service.testns b/testdata/fwd_three_service.tdir/fwd_three_service.testns
new file mode 100644
index 000000000000..787e25f608c2
--- /dev/null
+++ b/testdata/fwd_three_service.tdir/fwd_three_service.testns
@@ -0,0 +1,34 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
diff --git a/testdata/fwd_three_service.tpkg b/testdata/fwd_three_service.tpkg
deleted file mode 100644
index 949cdcefa232..000000000000
--- a/testdata/fwd_three_service.tpkg
+++ /dev/null
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.conf b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.conf
new file mode 100644
index 000000000000..9cd19c0d9d1c
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.dsc b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.dsc
new file mode 100644
index 000000000000..da67fda12144
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_ttlexpire
+Version: 1.0
+Description: forward UDP and TTL expires in the cache
+CreationDate: Wed May  9 11:08:02 CEST 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_ttlexpire.pre
+Post: fwd_ttlexpire.post
+Test: fwd_ttlexpire.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.post b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.post
new file mode 100644
index 000000000000..3cc0061c8f2a
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.post
@@ -0,0 +1,11 @@
+# #-- fwd_ttlexpire.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.pre b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.pre
new file mode 100644
index 000000000000..99e096ca5a2e
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.pre
@@ -0,0 +1,31 @@
+# #-- fwd_ttlexpire.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_ttlexpire.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_ttlexpire.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.test b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.test
new file mode 100644
index 000000000000..41ea3953ccb6
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.test
@@ -0,0 +1,35 @@
+# #-- fwd_ttlexpire.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+# wait for query to expire.
+sleep 4
+# query again
+rm outfile
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+
+exit 0
diff --git a/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.testns b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.testns
new file mode 100644
index 000000000000..38fbfa58ced1
--- /dev/null
+++ b/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	2	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_ttlexpire.tpkg b/testdata/fwd_ttlexpire.tpkg
deleted file mode 100644
index 1111d8e52aee..000000000000
--- a/testdata/fwd_ttlexpire.tpkg
+++ /dev/null
diff --git a/testdata/fwd_udp.tdir/fwd_udp.conf b/testdata/fwd_udp.tdir/fwd_udp.conf
new file mode 100644
index 000000000000..781eebc29c2f
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 5
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_udp.tdir/fwd_udp.dsc b/testdata/fwd_udp.tdir/fwd_udp.dsc
new file mode 100644
index 000000000000..741ad3480186
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_udp
+Version: 1.0
+Description: Forward an UDP packet and return reply.
+CreationDate: Wed Feb  7 09:01:25 CET 2007
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_udp.pre
+Post: fwd_udp.post
+Test: fwd_udp.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_udp.tdir/fwd_udp.post b/testdata/fwd_udp.tdir/fwd_udp.post
new file mode 100644
index 000000000000..87cf28085bc3
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.post
@@ -0,0 +1,10 @@
+# #-- fwd_udp.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_udp.tdir/fwd_udp.pre b/testdata/fwd_udp.tdir/fwd_udp.pre
new file mode 100644
index 000000000000..b0e08314656c
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.pre
@@ -0,0 +1,31 @@
+# #-- fwd_udp.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_udp.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_udp.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_udp.tdir/fwd_udp.test b/testdata/fwd_udp.tdir/fwd_udp.test
new file mode 100644
index 000000000000..9bd37adb3a7a
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.test
@@ -0,0 +1,22 @@
+# #-- fwd_udp.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_udp.tdir/fwd_udp.testns b/testdata/fwd_udp.tdir/fwd_udp.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/fwd_udp.tdir/fwd_udp.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_udp.tpkg b/testdata/fwd_udp.tpkg
deleted file mode 100644
index 4fd67469978d..000000000000
--- a/testdata/fwd_udp.tpkg
+++ /dev/null
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.conf b/testdata/fwd_udptmout.tdir/fwd_udptmout.conf
new file mode 100644
index 000000000000..d5135a1f7137
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 4
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	outgoing-range: 3
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	num-queries-per-thread: 1024
+	use-syslog: no
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.dsc b/testdata/fwd_udptmout.tdir/fwd_udptmout.dsc
new file mode 100644
index 000000000000..77f05d227f59
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_udptmout
+Version: 1.0
+Description: Forward udp queries with timeouts and multiple fds
+CreationDate: Mon Apr 14 10:26:48 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_udptmout.pre
+Post: fwd_udptmout.post
+Test: fwd_udptmout.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.post b/testdata/fwd_udptmout.tdir/fwd_udptmout.post
new file mode 100644
index 000000000000..f2138b9ec8ac
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.post
@@ -0,0 +1,19 @@
+# #-- fwd_udptmout.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+# kill fwder
+kill_pid $FWD_PID
+
+# find all extra forked testns and kill them.
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+for p in $pidlist; do
+	kill_pid $p
+done
+
+# kill unbound
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.pre b/testdata/fwd_udptmout.tdir/fwd_udptmout.pre
new file mode 100644
index 000000000000..5b4cacdbeccc
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.pre
@@ -0,0 +1,31 @@
+# #-- fwd_udptmout.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -f 9 fwd_udptmout.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_udptmout.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.test b/testdata/fwd_udptmout.tdir/fwd_udptmout.test
new file mode 100644
index 000000000000..8d89961047bc
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.test
@@ -0,0 +1,110 @@
+# #-- fwd_udptmout.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+
+# skip the single query test
+# so that all three queries get timeouts during the later test.
+#
+#echo "> dig www1.example.com."
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
+#echo "> cat logfiles"
+#cat fwd.log 
+#cat unbound.log
+#echo "> check answer for single query"
+#if grep "10.20.30.40" outfile; then
+	#echo "OK"
+#else
+	#echo "Not OK"
+	#exit 1
+#fi
+
+echo "> do queries"
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
+digpid1=$!
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
+digpid2=$!
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
+digpid3=$!
+dig @localhost -p $UNBOUND_PORT www4.example.com. >outfile4 &
+digpid4=$!
+dig @localhost -p $UNBOUND_PORT www5.example.com. >outfile5 &
+digpid5=$!
+dig @localhost -p $UNBOUND_PORT www6.example.com. >outfile6 &
+digpid6=$!
+
+sleep 15
+
+# some slow systems need more for processing
+if grep "10.20.30.40" outfile1 >/dev/null; then :; else sleep 2; fi
+if grep "10.20.30.50" outfile2 >/dev/null; then :; else sleep 2; fi
+if grep "10.20.30.60" outfile3 >/dev/null; then :; else sleep 2; fi
+if grep "10.20.30.70" outfile4 >/dev/null; then :; else sleep 2; fi
+if grep "10.20.30.80" outfile5 >/dev/null; then :; else sleep 2; fi
+if grep "10.20.30.90" outfile6 >/dev/null; then :; else sleep 2; fi
+
+kill -9 $digpid1
+kill -9 $digpid2
+kill -9 $digpid3
+kill -9 $digpid4
+kill -9 $digpid5
+kill -9 $digpid6
+
+echo "> cat outfile1"
+cat outfile1 
+echo "> cat outfile2"
+cat outfile2 
+echo "> cat outfile3"
+cat outfile3
+echo "> cat outfile4"
+cat outfile4
+echo "> cat outfile5"
+cat outfile5
+echo "> cat outfile6"
+cat outfile6
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answers for queries"
+if grep "10.20.30.40" outfile1; then
+	echo "1 is OK"
+else
+	echo "1 is not OK"
+	exit 1
+fi
+if grep "10.20.30.50" outfile2; then
+	echo "2 is OK"
+else
+	echo "2 is not OK"
+	exit 1
+fi
+if grep "10.20.30.60" outfile3; then
+	echo "3 is OK"
+else
+	echo "3 is not OK"
+	exit 1
+fi
+if grep "10.20.30.70" outfile4; then
+	echo "4 is OK"
+else
+	echo "4 is not OK"
+	exit 1
+fi
+if grep "10.20.30.80" outfile5; then
+	echo "5 is OK"
+else
+	echo "5 is not OK"
+	exit 1
+fi
+if grep "10.20.30.90" outfile6; then
+	echo "6 is OK"
+else
+	echo "6 is not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_udptmout.tdir/fwd_udptmout.testns b/testdata/fwd_udptmout.tdir/fwd_udptmout.testns
new file mode 100644
index 000000000000..bfccf9d71567
--- /dev/null
+++ b/testdata/fwd_udptmout.tdir/fwd_udptmout.testns
@@ -0,0 +1,64 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www4	IN	A
+SECTION ANSWER
+www4	IN	A	10.20.30.70
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www5	IN	A
+SECTION ANSWER
+www5	IN	A	10.20.30.80
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=2
+SECTION QUESTION
+www6	IN	A
+SECTION ANSWER
+www6	IN	A	10.20.30.90
+ENTRY_END
+
diff --git a/testdata/fwd_udptmout.tpkg b/testdata/fwd_udptmout.tpkg
deleted file mode 100644
index 0c476320098e..000000000000
--- a/testdata/fwd_udptmout.tpkg
+++ /dev/null
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.conf b/testdata/fwd_waitudp.tdir/fwd_waitudp.conf
new file mode 100644
index 000000000000..91eaf7d06f0c
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 4
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	outgoing-range: 1
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	num-queries-per-thread: 1024
+	use-syslog: no
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.dsc b/testdata/fwd_waitudp.tdir/fwd_waitudp.dsc
new file mode 100644
index 000000000000..5c310ac1a03d
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_waitudp
+Version: 1.0
+Description: Forward 3 queries, 1thr, 1fd and force a udp wait list.
+CreationDate: Mon Apr 14 10:03:28 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_waitudp.pre
+Post: fwd_waitudp.post
+Test: fwd_waitudp.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.post b/testdata/fwd_waitudp.tdir/fwd_waitudp.post
new file mode 100644
index 000000000000..fedf97a41641
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.post
@@ -0,0 +1,21 @@
+# #-- fwd_waitudp.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+
+# kill fwder
+kill_pid $FWD_PID
+
+# find all extra forked testns and kill them.
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+for p in $pidlist; do
+	kill_pid $p
+done
+
+# kill unbound
+kill_pid $UNBOUND_PID
+exit 0
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.pre b/testdata/fwd_waitudp.tdir/fwd_waitudp.pre
new file mode 100644
index 000000000000..ab7a886eeb88
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.pre
@@ -0,0 +1,31 @@
+# #-- fwd_waitudp.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT -f 9 fwd_waitudp.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_waitudp.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.test b/testdata/fwd_waitudp.tdir/fwd_waitudp.test
new file mode 100644
index 000000000000..1247885348ac
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.test
@@ -0,0 +1,67 @@
+# #-- fwd_waitudp.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+
+# skip the single query test
+# so that all three queries get timeouts during the later test.
+#
+#echo "> dig www1.example.com."
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
+#echo "> cat logfiles"
+#cat fwd.log 
+#cat unbound.log
+#echo "> check answer for single query"
+#if grep "10.20.30.40" outfile; then
+	#echo "OK"
+#else
+	#echo "Not OK"
+	#exit 1
+#fi
+
+echo "> do three queries"
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
+digpid1=$!
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
+digpid2=$!
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
+digpid3=$!
+sleep 15
+kill -9 $digpid1
+kill -9 $digpid2
+kill -9 $digpid3
+
+echo "> cat outfile1"
+cat outfile1 
+echo "> cat outfile2"
+cat outfile2 
+echo "> cat outfile3"
+cat outfile3
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answers for three queries"
+if grep "10.20.30.40" outfile1; then
+	echo "1 is OK"
+else
+	echo "1 is not OK"
+	exit 1
+fi
+if grep "10.20.30.50" outfile2; then
+	echo "2 is OK"
+else
+	echo "2 is not OK"
+	exit 1
+fi
+if grep "10.20.30.60" outfile3; then
+	echo "3 is OK"
+else
+	echo "3 is not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_waitudp.tdir/fwd_waitudp.testns b/testdata/fwd_waitudp.tdir/fwd_waitudp.testns
new file mode 100644
index 000000000000..e1e1ea8c4e01
--- /dev/null
+++ b/testdata/fwd_waitudp.tdir/fwd_waitudp.testns
@@ -0,0 +1,34 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www1	IN	A
+SECTION ANSWER
+www1	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=1
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.60
+ENTRY_END
+
diff --git a/testdata/fwd_waitudp.tpkg b/testdata/fwd_waitudp.tpkg
deleted file mode 100644
index db3cd8ea67da..000000000000
--- a/testdata/fwd_waitudp.tpkg
+++ /dev/null
diff --git a/testdata/fwd_zero.tdir/fwd_zero.conf b/testdata/fwd_zero.tdir/fwd_zero.conf
new file mode 100644
index 000000000000..9cd19c0d9d1c
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/fwd_zero.tdir/fwd_zero.dsc b/testdata/fwd_zero.tdir/fwd_zero.dsc
new file mode 100644
index 000000000000..acacf3809e68
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.dsc
@@ -0,0 +1,16 @@
+BaseName: fwd_zero
+Version: 1.0
+Description: Test for zero byte UDP reply assertion fail
+CreationDate: Tue Jan  6 10:39:28 CET 2009
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: fwd_zero.pre
+Post: fwd_zero.post
+Test: fwd_zero.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/fwd_zero.tdir/fwd_zero.post b/testdata/fwd_zero.tdir/fwd_zero.post
new file mode 100644
index 000000000000..b22a0b7af1b4
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.post
@@ -0,0 +1,10 @@
+# #-- fwd_zero.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/fwd_zero.tdir/fwd_zero.pre b/testdata/fwd_zero.tdir/fwd_zero.pre
new file mode 100644
index 000000000000..eaa7262e47dd
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.pre
@@ -0,0 +1,31 @@
+# #-- fwd_zero.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT fwd_zero.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_zero.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/fwd_zero.tdir/fwd_zero.test b/testdata/fwd_zero.tdir/fwd_zero.test
new file mode 100644
index 000000000000..87a2dec9c323
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.test
@@ -0,0 +1,32 @@
+# #-- fwd_zero.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+OPT="-i"
+if nc -h 2>&1 | grep -- "-w secs" >/dev/null; then
+        OPT="-w"
+fi
+
+# send query with qname but not qtype , qclass (malformed query)
+echo "> nc www.example.com. (malformed)"
+echo "b4380100000100000000000003777777076578616d706c6503636f6d00" | xxd -r -p | nc -un $OPT 2 127.0.0.1 $UNBOUND_PORT 2>/dev/null | xxd | tee outfile
+
+# now test that server is still up
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/fwd_zero.tdir/fwd_zero.testns b/testdata/fwd_zero.tdir/fwd_zero.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/fwd_zero.tdir/fwd_zero.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/fwd_zero.tpkg b/testdata/fwd_zero.tpkg
deleted file mode 100644
index bff17baa99d3..000000000000
--- a/testdata/fwd_zero.tpkg
+++ /dev/null
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.dsc b/testdata/hostsfileosx.tdir/hostsfileosx.dsc
new file mode 100644
index 000000000000..78ba2de0b16c
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.dsc
@@ -0,0 +1,16 @@
+BaseName: hostsfileosx
+Version: 1.0
+Description: Test lookup using libunbound with osx hosts file
+CreationDate: Fri May 16 13:29:39 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: hostsfileosx.pre
+Post: hostsfileosx.post
+Test: hostsfileosx.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.hosts b/testdata/hostsfileosx.tdir/hostsfileosx.hosts
new file mode 100644
index 000000000000..2bf277584abf
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.hosts
@@ -0,0 +1,15 @@
+# Host Database
+#
+# This file should contain the addresses and aliases for local hosts that
+# share this file.  Replace 'my.domain' below with the domainname of your
+# machine.
+#
+::1                     localhost localhost.my.domain
+127.0.0.1               localhost localhost.my.domain
+# from MacOSX.
+fe80::1%lo0 localhost
+255.255.255.255 broadcasthost
+# Imaginary network.
+10.0.0.2               myname.my.domain myname
+10.0.0.3               myfriend.my.domain myfriend
+10.20.30.40		virtual.virtual.virtual.local
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.post b/testdata/hostsfileosx.tdir/hostsfileosx.post
new file mode 100644
index 000000000000..50e72ebd88cd
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.post
@@ -0,0 +1,9 @@
+# #-- hostsfileosx.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.pre b/testdata/hostsfileosx.tdir/hostsfileosx.pre
new file mode 100644
index 000000000000..94432206afa4
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.pre
@@ -0,0 +1,20 @@
+# #-- hostsfileosx.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+FWD_PORT=$(($RND_PORT + 1))
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT hostsfileosx.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.test b/testdata/hostsfileosx.tdir/hostsfileosx.test
new file mode 100644
index 000000000000..96606094ab43
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.test
@@ -0,0 +1,63 @@
+# #-- hostsfileosx.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+# test if fwder is up
+echo "> dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile"
+dig @127.0.0.1 -p $FWD_PORT www.example.com | tee outfile
+if grep "10.20.30.40" outfile; then
+	echo "fwder is up"
+else
+	cat fwd.log
+	echo "fwder not up"
+	exit 1
+fi
+rm outfile
+
+# create asynclook
+get_make
+echo "> (cd $PRE ; $MAKE asynclook)"
+(cd $PRE ; $MAKE asynclook)
+if test ! -x $PRE/asynclook; then
+	echo "cannot build asynclook test program"
+	exit 1
+fi
+(cd $PRE ; $MAKE lock-verify)
+
+# check the locks.
+function locktest() {
+	if test -x $PRE/lock-verify -a -f ublocktrace.0; then
+		$PRE/lock-verify ublocktrace.*
+		if test $? -ne 0; then
+			echo "lock-verify error"
+			exit 1
+		fi
+	fi
+}
+
+
+THR=""
+if grep "undef HAVE_FORK" $PRE/config.h; then
+	THR="-t"
+fi
+
+# test hosts reading (directed at local auth info)
+echo '> $PRE/asynclook $THR -H hostsfileosx.hosts virtual.virtual.virtual.local 2>&1 | tee outfile'
+$PRE/asynclook $THR -H hostsfileosx.hosts virtual.virtual.virtual.local 2>&1 | tee outfile
+if grep "virtual.virtual.virtual.local: 10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+locktest
+rm outfile
+
+echo "> cat logfiles"
+cat fwd.log 
+exit 0
diff --git a/testdata/hostsfileosx.tdir/hostsfileosx.testns b/testdata/hostsfileosx.tdir/hostsfileosx.testns
new file mode 100644
index 000000000000..6245ae164172
--- /dev/null
+++ b/testdata/hostsfileosx.tdir/hostsfileosx.testns
@@ -0,0 +1,35 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+; for priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+@	IN	NS
+SECTION ANSWER
+@	IN	NS	127.0.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/hostsfileosx.tpkg b/testdata/hostsfileosx.tpkg
deleted file mode 100644
index 05ab7c233985..000000000000
--- a/testdata/hostsfileosx.tpkg
+++ /dev/null
diff --git a/testdata/local_ds.rpl b/testdata/local_ds.rpl
new file mode 100644
index 000000000000..58b3e2236d1b
--- /dev/null
+++ b/testdata/local_ds.rpl
@@ -0,0 +1,103 @@
+; config options
+; The island of trust is at example.com
+server:
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test local data for as112 zone with DS lookup.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+arpa. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+in-addr.arpa. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+10.in-addr.arpa. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+10.in-addr.arpa. IN NSEC 11.in-addr.arpa NSEC RRSIG
+. IN SOA invalid. invalid. 1 2 3 4 5
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+40.30.20.10.in-addr.arpa. IN PTR
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA DO NXDOMAIN
+SECTION QUESTION
+40.30.20.10.in-addr.arpa. IN PTR
+SECTION ANSWER
+SECTION AUTHORITY
+10.in-addr.arpa.	10800	IN	SOA	localhost. nobody.invalid. 1 3600 1200 604800 10800
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+10.in-addr.arpa. IN DS
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+10.in-addr.arpa. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+10.in-addr.arpa. IN NSEC 11.in-addr.arpa NSEC RRSIG
+. IN SOA invalid. invalid. 1 2 3 4 5
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/local_nodefault.rpl b/testdata/local_nodefault.rpl
index 91243d19fb6d..794196244829 100644
--- a/testdata/local_nodefault.rpl
+++ b/testdata/local_nodefault.rpl
@@ -30,7 +30,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR AA NXDOMAIN
 SECTION QUESTION
-40.30.20.10.in-addr-arpa. IN PTR
+40.30.20.10.in-addr.arpa. IN PTR
 SECTION ANSWER
 SECTION AUTHORITY
 . IN SOA invalid. invalid. 1 2 3 4 5
@@ -41,7 +41,7 @@ STEP 1 QUERY
 ENTRY_BEGIN
 REPLY RD DO
 SECTION QUESTION
-40.30.20.10.in-addr-arpa. IN PTR
+40.30.20.10.in-addr.arpa. IN PTR
 ENTRY_END
 ; not blocked!
 
@@ -51,7 +51,7 @@ ENTRY_BEGIN
 MATCH all
 REPLY QR RD RA DO NXDOMAIN
 SECTION QUESTION
-40.30.20.10.in-addr-arpa. IN PTR
+40.30.20.10.in-addr.arpa. IN PTR
 SECTION ANSWER
 SECTION AUTHORITY
 . IN SOA invalid. invalid. 1 2 3 4 5
diff --git a/testdata/local_nodefault.tdir/local_nodefault.conf b/testdata/local_nodefault.tdir/local_nodefault.conf
new file mode 100644
index 000000000000..b245c0373469
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.conf
@@ -0,0 +1,27 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	# trailing .
+	local-zone: "30.172.in-addr.arpa." nodefault
+	# no trailing .
+	local-zone: "29.172.in-addr.arpa" nodefault
+
+forward-zone:
+	name: "."
+	# invalid address to be sure it fails.
+	forward-addr: "127.0.0.5@@TOPORT@"
+forward-zone:
+	name: "30.172.in-addr.arpa"
+	forward-addr: "127.0.0.1@@TOPORT@"
+forward-zone:
+	name: "29.172.in-addr.arpa"
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/local_nodefault.tdir/local_nodefault.dsc b/testdata/local_nodefault.tdir/local_nodefault.dsc
new file mode 100644
index 000000000000..43133eec9425
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.dsc
@@ -0,0 +1,16 @@
+BaseName: local_nodefault
+Version: 1.0
+Description: Create a stub zone to replace a default local zone
+CreationDate: Tue Jun  3 14:08:00 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: local_nodefault.pre
+Post: local_nodefault.post
+Test: local_nodefault.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/local_nodefault.tdir/local_nodefault.post b/testdata/local_nodefault.tdir/local_nodefault.post
new file mode 100644
index 000000000000..af955a1e546c
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.post
@@ -0,0 +1,11 @@
+# #-- local_nodefault.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/local_nodefault.tdir/local_nodefault.pre b/testdata/local_nodefault.tdir/local_nodefault.pre
new file mode 100644
index 000000000000..48e8d25a4456
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.pre
@@ -0,0 +1,31 @@
+# #-- local_nodefault.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT local_nodefault.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < local_nodefault.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/local_nodefault.tdir/local_nodefault.test b/testdata/local_nodefault.tdir/local_nodefault.test
new file mode 100644
index 000000000000..01e0ac042717
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.test
@@ -0,0 +1,53 @@
+# #-- local_nodefault.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# this one should have NXDOMAIN builtin
+#
+echo "> dig 1.0.31.172.in-addr.arpa."
+dig @localhost -p $UNBOUND_PORT 1.0.31.172.in-addr.arpa. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK for a blocked by default zone"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# this one should give our own data as the reply
+echo "> dig 1.0.30.172.in-addr.arpa."
+dig @localhost -p $UNBOUND_PORT 1.0.30.172.in-addr.arpa. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK for nodefault zone"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# this one should give our own data as the reply
+# but different trailing dot in unbound.conf file
+echo "> dig 1.0.29.172.in-addr.arpa."
+dig @localhost -p $UNBOUND_PORT 1.0.29.172.in-addr.arpa. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.42" outfile; then
+	echo "OK for nodefault zone"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/local_nodefault.tdir/local_nodefault.testns b/testdata/local_nodefault.tdir/local_nodefault.testns
new file mode 100644
index 000000000000..041888ea6237
--- /dev/null
+++ b/testdata/local_nodefault.tdir/local_nodefault.testns
@@ -0,0 +1,24 @@
+; nameserver test file
+$ORIGIN 30.172.in-addr.arpa.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+1.0	IN 	A
+SECTION ANSWER
+1.0	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+1.0.29.172.in-addr.arpa.	IN 	A
+SECTION ANSWER
+1.0.29.172.in-addr.arpa.	IN	A	10.20.30.42
+ENTRY_END
+
diff --git a/testdata/local_nodefault.tpkg b/testdata/local_nodefault.tpkg
deleted file mode 100644
index 5f9dc441a338..000000000000
--- a/testdata/local_nodefault.tpkg
+++ /dev/null
diff --git a/testdata/local_norec.tdir/local_norec.conf b/testdata/local_norec.tdir/local_norec.conf
new file mode 100644
index 000000000000..86cddbddfb53
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.conf
@@ -0,0 +1,24 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	
+	local-data: "foo.example.com. A 1.1.1.1"
+
+	access-control: 0.0.0.0/0 allow_snoop
+	access-control: 127.0.0.0/8 allow_snoop
+	access-control: ::0/0 allow_snoop
+	access-control: ::1 allow_snoop
+	access-control: ::ffff:127.0.0.1 allow_snoop
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/local_norec.tdir/local_norec.dsc b/testdata/local_norec.tdir/local_norec.dsc
new file mode 100644
index 000000000000..fb1c77811f55
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.dsc
@@ -0,0 +1,16 @@
+BaseName: local_norec
+Version: 1.0
+Description: Local-data and access control allow_snoop test.
+CreationDate: Mon Sep  1 14:26:00 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: local_norec.pre
+Post: local_norec.post
+Test: local_norec.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/local_norec.tdir/local_norec.post b/testdata/local_norec.tdir/local_norec.post
new file mode 100644
index 000000000000..bf65aa84ac48
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.post
@@ -0,0 +1,10 @@
+# #-- local_norec.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/local_norec.tdir/local_norec.pre b/testdata/local_norec.tdir/local_norec.pre
new file mode 100644
index 000000000000..8ab4f6200463
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.pre
@@ -0,0 +1,31 @@
+# #-- local_norec.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT local_norec.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < local_norec.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/local_norec.tdir/local_norec.test b/testdata/local_norec.tdir/local_norec.test
new file mode 100644
index 000000000000..b32f0aed1a8c
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.test
@@ -0,0 +1,65 @@
+# #-- local_norec.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+#
+# www.example.com is available through recursion.
+# foo.example.com is available through local-data (and recursion...).
+#
+echo "> dig www.example.com. +RD"
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig www.example.com. +norec"
+dig @localhost +norec -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig foo.example.com. +RD"
+dig @localhost -p $UNBOUND_PORT foo.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig foo.example.com. +norec"
+dig @localhost +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/local_norec.tdir/local_norec.testns b/testdata/local_norec.tdir/local_norec.testns
new file mode 100644
index 000000000000..58dce45bc5bf
--- /dev/null
+++ b/testdata/local_norec.tdir/local_norec.testns
@@ -0,0 +1,24 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+foo	IN	A
+SECTION ANSWER
+foo	IN	A	10.20.30.50
+ENTRY_END
+
diff --git a/testdata/local_norec.tpkg b/testdata/local_norec.tpkg
deleted file mode 100644
index 2258695d8c50..000000000000
--- a/testdata/local_norec.tpkg
+++ /dev/null
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.conf b/testdata/local_nosnoop.tdir/local_nosnoop.conf
new file mode 100644
index 000000000000..f3dd8e72c17e
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.conf
@@ -0,0 +1,24 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	
+	local-data: "foo.example.com. A 1.1.1.1"
+
+	access-control: 0.0.0.0/0 allow
+	access-control: 127.0.0.0/8 allow
+	access-control: ::0/0 allow
+	access-control: ::1 allow
+	access-control: ::ffff:127.0.0.1 allow
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.dsc b/testdata/local_nosnoop.tdir/local_nosnoop.dsc
new file mode 100644
index 000000000000..1e009f9e2fc9
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.dsc
@@ -0,0 +1,16 @@
+BaseName: local_nosnoop
+Version: 1.0
+Description: Local-data and access control allow no snoop test.
+CreationDate: Mon Sep  1 14:36:53 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: local_nosnoop.pre
+Post: local_nosnoop.post
+Test: local_nosnoop.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.post b/testdata/local_nosnoop.tdir/local_nosnoop.post
new file mode 100644
index 000000000000..63d492d25470
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.post
@@ -0,0 +1,10 @@
+# #-- local_nosnoop.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.pre b/testdata/local_nosnoop.tdir/local_nosnoop.pre
new file mode 100644
index 000000000000..e304f496e6e6
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.pre
@@ -0,0 +1,31 @@
+# #-- local_nosnoop.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT local_nosnoop.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < local_nosnoop.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.test b/testdata/local_nosnoop.tdir/local_nosnoop.test
new file mode 100644
index 000000000000..1e762d5dc921
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.test
@@ -0,0 +1,75 @@
+# #-- local_nosnoop.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+#
+# www.example.com is available through recursion.
+# foo.example.com is available through local-data (and recursion...).
+#
+# so, with 'allow' the cache snoop stops working:
+# 	dig +norec for www does not work any more.
+#
+echo "> dig www.example.com. +RD"
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig www.example.com. +norec"
+dig @localhost +norec -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "REFUSED" outfile; then
+	echo "OK rcode"
+else
+	echo "Not OK rcode"
+	exit 1
+fi
+
+if grep "10.20.30.40" outfile; then
+	echo "Not OK"
+	exit 1
+else
+	echo "OK"
+fi
+
+echo "> dig foo.example.com. +RD"
+dig @localhost -p $UNBOUND_PORT foo.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig foo.example.com. +norec"
+dig @localhost +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/local_nosnoop.tdir/local_nosnoop.testns b/testdata/local_nosnoop.tdir/local_nosnoop.testns
new file mode 100644
index 000000000000..58dce45bc5bf
--- /dev/null
+++ b/testdata/local_nosnoop.tdir/local_nosnoop.testns
@@ -0,0 +1,24 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+foo	IN	A
+SECTION ANSWER
+foo	IN	A	10.20.30.50
+ENTRY_END
+
diff --git a/testdata/local_nosnoop.tpkg b/testdata/local_nosnoop.tpkg
deleted file mode 100644
index 23765b29836a..000000000000
--- a/testdata/local_nosnoop.tpkg
+++ /dev/null
diff --git a/testdata/nss_compile.tdir/nss_compile.dsc b/testdata/nss_compile.tdir/nss_compile.dsc
new file mode 100644
index 000000000000..6c59d245fa41
--- /dev/null
+++ b/testdata/nss_compile.tdir/nss_compile.dsc
@@ -0,0 +1,16 @@
+BaseName: nss_compile
+Version: 1.0
+Description: Compile with NSS
+CreationDate: Fri Feb  8 14:40:28 CET 2013
+Maintainer: Wouter Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: nss_compile.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/nss_compile.tdir/nss_compile.test b/testdata/nss_compile.tdir/nss_compile.test
new file mode 100644
index 000000000000..82b194668fd9
--- /dev/null
+++ b/testdata/nss_compile.tdir/nss_compile.test
@@ -0,0 +1,38 @@
+# #-- nss_compile.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+if test "`hostname`" = "open.nlnetlabs.nl"; then
+	echo "on open, continue test"
+else
+	echo "not on open, no test, do this explicitly"
+	exit 0
+fi
+
+. ../common.sh
+get_make
+PRE="../.."
+
+opts=`$PRE/unbound -h | grep configured | sed -e 's/^.*options: //' | sed -e "s/'//g" `
+
+function error_exit ()
+{
+	cat config.log
+	echo "$1"
+	exit 1
+}
+
+mkdir testdata
+cp $PRE/testdata/*.rpl testdata/.
+cp $PRE/testdata/test* testdata/.
+
+echo ">>> $PRE/configure $opts --without-ssl --with-nss --with-libunbound-only LDFLAGS=-L/usr/local/lib/nss" 'CPPFLAGS="-I/usr/local/include/nss/nss -I/usr/local/include/nspr"'
+$PRE/configure $opts --without-ssl --with-nss --with-libunbound-only LDFLAGS=-L/usr/local/lib/nss CPPFLAGS="-I/usr/local/include/nss/nss -I/usr/local/include/nspr" || error_exit "could not configure"
+echo ">>> $MAKE"
+$MAKE || error_exit "could not make"
+echo ">>> $MAKE test"
+$MAKE test || error_exit "could not make test"
+
+exit 0
diff --git a/testdata/nss_compile.tpkg b/testdata/nss_compile.tpkg
deleted file mode 100644
index d6412017c532..000000000000
--- a/testdata/nss_compile.tpkg
+++ /dev/null
diff --git a/testdata/pylib.tdir/pylib.conf b/testdata/pylib.tdir/pylib.conf
new file mode 100644
index 000000000000..82fa27a68196
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.conf
@@ -0,0 +1,19 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	#port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	module-config: "validator iterator"
+
+#python:
+	#python-script: "pylib.py"
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/pylib.tdir/pylib.dsc b/testdata/pylib.tdir/pylib.dsc
new file mode 100644
index 000000000000..fcea32b9e160
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.dsc
@@ -0,0 +1,16 @@
+BaseName: pylib
+Version: 1.0
+Description: Test python wrapper for libunbound
+CreationDate: Mon Apr  6 12:33:31 CEST 2009
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: pylib.pre
+Post: pylib.post
+Test: pylib.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/pylib.tdir/pylib.lookup.py b/testdata/pylib.tdir/pylib.lookup.py
new file mode 100755
index 000000000000..1c829bc7054d
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.lookup.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python
+'''
+Test for unbound lookup.
+BSD licensed.
+'''
+import unbound
+
+ctx = unbound.ub_ctx()
+status = ctx.config("ub.conf")
+if status != 0:
+	print "read config failed ", status
+	exit(1)
+
+print "config created"
+
+status, result = ctx.resolve("www.example.com", unbound.RR_TYPE_A, unbound.RR_CLASS_IN);
+if status == 0 and result.havedata:
+	print "Result: ", result.data.address_list
+else:
+	print "Failed ", status, " and data ", result
+
+ctx = None
+
+exit(0)
diff --git a/testdata/pylib.tdir/pylib.post b/testdata/pylib.tdir/pylib.post
new file mode 100644
index 000000000000..26db7e80eee9
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.post
@@ -0,0 +1,20 @@
+# #-- pylib.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYUNBOUND 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+# kill fwder
+kill_pid $FWD_PID
diff --git a/testdata/pylib.tdir/pylib.pre b/testdata/pylib.tdir/pylib.pre
new file mode 100644
index 000000000000..01ca2b896280
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.pre
@@ -0,0 +1,36 @@
+# #-- pylib.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYUNBOUND 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+# get module python local
+cp $PRE/pythonmod/unboundmodule.py .
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT pylib.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# modify config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < pylib.conf > ub.conf
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+
diff --git a/testdata/pylib.tdir/pylib.py b/testdata/pylib.tdir/pylib.py
new file mode 100644
index 000000000000..3f6fed1c696b
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.py
@@ -0,0 +1,159 @@
+# -*- coding: utf-8 -*-
+'''
+ ubmodule-msg.py: simple response packet logger
+
+ Authors: Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+          Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
+
+ Copyright (c) 2008. All rights reserved.
+
+ This software is open source.
+ 
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 
+ Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+ 
+ Redistributions in binary form must reproduce the above copyright notice,
+ this list of conditions and the following disclaimer in the documentation
+ and/or other materials provided with the distribution.
+ 
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ Modified for unit test by Wouter Wijngaards, NLnet Labs, 2009.
+'''
+import os
+
+def init(id, cfg):
+    log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
+    return True
+
+def deinit(id):
+    log_info("pythonmod: deinit called, module id is %d" % id)
+    return True
+
+def inform_super(id, qstate, superqstate, qdata):
+    return True
+
+def setTTL(qstate, ttl):
+    """Sets return_msg TTL and all the RRs TTL"""
+    if qstate.return_msg:
+        qstate.return_msg.rep.ttl = ttl
+        if (qstate.return_msg.rep):
+            for i in range(0,qstate.return_msg.rep.rrset_count):
+                d = qstate.return_msg.rep.rrsets[i].entry.data
+                for j in range(0,d.count+d.rrsig_count):
+                    d.rr_ttl[j] = ttl
+
+def dataHex(data, prefix=""):
+    res = ""
+    for i in range(0, (len(data)+15)/16):
+        res += "%s0x%02X | " % (prefix, i*16)
+        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        for ch in d:
+            res += "%02X " % ch
+        for i in range(0,17-len(d)):
+            res += "   "
+        res += "| "
+        for ch in d:
+            if (ch < 32) or (ch > 127):
+                res += ". "
+            else:
+                res += "%c " % ch
+        res += "\n"
+    return res
+
+def printReturnMsg(qstate):
+    print "Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount,qstate.return_msg.rep.security, qstate.return_msg.rep.ttl)
+    print "           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str
+    if (qstate.return_msg.rep):
+        print "RRSets:",qstate.return_msg.rep.rrset_count
+        prevkey = None
+        for i in range(0,qstate.return_msg.rep.rrset_count):
+            r = qstate.return_msg.rep.rrsets[i]
+            rk = r.rk
+            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
+            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+
+            d = r.entry.data
+            print "    RRDatas:",d.count+d.rrsig_count
+            for j in range(0,d.count+d.rrsig_count):
+                print "    ",j,":","TTL=",d.rr_ttl[j],"RR data:"
+                print dataHex(d.rr_data[j],"         ")
+
+
+def operate(id, event, qstate, qdata):
+    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
+    #print "pythonmod: per query data", qdata
+
+    print "Query:", ''.join(map(lambda x:chr(max(32,ord(x))),qstate.qinfo.qname)), qstate.qinfo.qname_list, qstate.qinfo.qname_str,
+    print "Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype,
+    print "Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass
+    print
+
+    if (event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS) and (qstate.qinfo.qname_str.endswith("www2.example.com.")):
+        print qstate.qinfo.qname_str
+
+        qstate.ext_state[id] = MODULE_FINISHED 
+
+        msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_A, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA) #, 300)
+        #msg.authority.append("xxx.seznam.cz. 10 IN A 192.168.1.1")
+        #msg.additional.append("yyy.seznam.cz. 10 IN A 1.1.1.2.")
+
+	# answer can be returned to the client without further checking.
+
+        if qstate.qinfo.qtype == RR_TYPE_A:
+            msg.answer.append("%s 10 IN A 192.168.1.1" % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_SRV) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN SRV 0 0 80 neinfo.example.com." % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_TXT) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN TXT path=/" % qstate.qinfo.qname_str)
+
+        if not msg.set_return_msg(qstate):
+            qstate.ext_state[id] = MODULE_ERROR 
+            return True
+
+        #qstate.return_msg.rep.security = 2 #pokud nebude nasledovat validator, je zapotrebi nastavit security, aby nebyl paket zahozen v mesh_send_reply
+        printReturnMsg(qstate)
+
+        #Authoritative result can't be stored in cache
+        #if (not storeQueryInCache(qstate, qstate.return_msg.qinfo, qstate.return_msg.rep, 0)):
+        #    print "Can't store in cache"
+        #    qstate.ext_state[id] = MODULE_ERROR
+        #    return False
+        #print "Store OK"
+
+        qstate.return_rcode = RCODE_NOERROR
+        return True
+
+    if event == MODULE_EVENT_NEW:
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    if event == MODULE_EVENT_MODDONE:
+        log_info("pythonmod: previous module done")
+        qstate.ext_state[id] = MODULE_FINISHED 
+        return True
+      
+    if event == MODULE_EVENT_PASS:
+        log_info("pythonmod: event_pass")
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    log_err("pythonmod: BAD event")
+    qstate.ext_state[id] = MODULE_ERROR
+    return True
+
+log_info("pythonmod: script loaded.")
diff --git a/testdata/pylib.tdir/pylib.test b/testdata/pylib.tdir/pylib.test
new file mode 100644
index 000000000000..96a846403c15
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.test
@@ -0,0 +1,40 @@
+# #-- pylib.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+if grep "define WITH_PYUNBOUND 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+if test "`uname 2>&1`" = "Darwin"; then
+	echo export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:../../.libs"
+	export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:../../.libs"
+fi
+#echo export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:../../.libs:."
+#export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:../../.libs:."
+
+cp $PRE/libunbound/python/unbound.py .
+cp $PRE/.libs/_unbound* .
+cp $PRE/.libs/libunbound* .
+
+# do the test
+echo "> pylib.lookup.py www.example.com."
+./pylib.lookup.py www.example.com. | tee outfile
+
+echo "> cat logfiles"
+cat fwd.log 
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/pylib.tdir/pylib.testns b/testdata/pylib.tdir/pylib.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/pylib.tdir/pylib.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/pylib.tpkg b/testdata/pylib.tpkg
deleted file mode 100644
index 202595c151e2..000000000000
--- a/testdata/pylib.tpkg
+++ /dev/null
diff --git a/testdata/pymod.tdir/pymod.conf b/testdata/pymod.tdir/pymod.conf
new file mode 100644
index 000000000000..b419c715bc68
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.conf
@@ -0,0 +1,19 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	module-config: "validator python iterator"
+
+python:
+	python-script: "pymod.py"
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/pymod.tdir/pymod.dsc b/testdata/pymod.tdir/pymod.dsc
new file mode 100644
index 000000000000..386e058e16b0
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.dsc
@@ -0,0 +1,16 @@
+BaseName: pymod
+Version: 1.0
+Description: Test python module
+CreationDate: Thu Apr  2 12:50:50 CEST 2009
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: pymod.pre
+Post: pymod.post
+Test: pymod.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/pymod.tdir/pymod.post b/testdata/pymod.tdir/pymod.post
new file mode 100644
index 000000000000..368d285edab2
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.post
@@ -0,0 +1,20 @@
+# #-- pymod.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/pymod.tdir/pymod.pre b/testdata/pymod.tdir/pymod.pre
new file mode 100644
index 000000000000..9029a8742337
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.pre
@@ -0,0 +1,56 @@
+# #-- pymod.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+# get module python local
+cp $PRE/pythonmod/unboundmodule.py .
+
+if test "`uname 2>&1`" = "Darwin"; then
+        ldnsdir=`grep ldnsdir= ../../Makefile | sed -e 's/ldnsdir=//'`
+        echo export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+        export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < pymod.conf > ub.conf
+
+# see if config file verifies
+if $PRE/unbound-checkconf ub.conf 2>&1; then
+	echo "checkconf OK"
+else
+	echo "checkconf failed"
+	exit 1
+fi
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT pymod.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/pymod.tdir/pymod.py b/testdata/pymod.tdir/pymod.py
new file mode 100644
index 000000000000..3f6fed1c696b
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.py
@@ -0,0 +1,159 @@
+# -*- coding: utf-8 -*-
+'''
+ ubmodule-msg.py: simple response packet logger
+
+ Authors: Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+          Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
+
+ Copyright (c) 2008. All rights reserved.
+
+ This software is open source.
+ 
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 
+ Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+ 
+ Redistributions in binary form must reproduce the above copyright notice,
+ this list of conditions and the following disclaimer in the documentation
+ and/or other materials provided with the distribution.
+ 
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ Modified for unit test by Wouter Wijngaards, NLnet Labs, 2009.
+'''
+import os
+
+def init(id, cfg):
+    log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
+    return True
+
+def deinit(id):
+    log_info("pythonmod: deinit called, module id is %d" % id)
+    return True
+
+def inform_super(id, qstate, superqstate, qdata):
+    return True
+
+def setTTL(qstate, ttl):
+    """Sets return_msg TTL and all the RRs TTL"""
+    if qstate.return_msg:
+        qstate.return_msg.rep.ttl = ttl
+        if (qstate.return_msg.rep):
+            for i in range(0,qstate.return_msg.rep.rrset_count):
+                d = qstate.return_msg.rep.rrsets[i].entry.data
+                for j in range(0,d.count+d.rrsig_count):
+                    d.rr_ttl[j] = ttl
+
+def dataHex(data, prefix=""):
+    res = ""
+    for i in range(0, (len(data)+15)/16):
+        res += "%s0x%02X | " % (prefix, i*16)
+        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        for ch in d:
+            res += "%02X " % ch
+        for i in range(0,17-len(d)):
+            res += "   "
+        res += "| "
+        for ch in d:
+            if (ch < 32) or (ch > 127):
+                res += ". "
+            else:
+                res += "%c " % ch
+        res += "\n"
+    return res
+
+def printReturnMsg(qstate):
+    print "Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount,qstate.return_msg.rep.security, qstate.return_msg.rep.ttl)
+    print "           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str
+    if (qstate.return_msg.rep):
+        print "RRSets:",qstate.return_msg.rep.rrset_count
+        prevkey = None
+        for i in range(0,qstate.return_msg.rep.rrset_count):
+            r = qstate.return_msg.rep.rrsets[i]
+            rk = r.rk
+            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
+            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+
+            d = r.entry.data
+            print "    RRDatas:",d.count+d.rrsig_count
+            for j in range(0,d.count+d.rrsig_count):
+                print "    ",j,":","TTL=",d.rr_ttl[j],"RR data:"
+                print dataHex(d.rr_data[j],"         ")
+
+
+def operate(id, event, qstate, qdata):
+    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
+    #print "pythonmod: per query data", qdata
+
+    print "Query:", ''.join(map(lambda x:chr(max(32,ord(x))),qstate.qinfo.qname)), qstate.qinfo.qname_list, qstate.qinfo.qname_str,
+    print "Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype,
+    print "Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass
+    print
+
+    if (event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS) and (qstate.qinfo.qname_str.endswith("www2.example.com.")):
+        print qstate.qinfo.qname_str
+
+        qstate.ext_state[id] = MODULE_FINISHED 
+
+        msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_A, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA) #, 300)
+        #msg.authority.append("xxx.seznam.cz. 10 IN A 192.168.1.1")
+        #msg.additional.append("yyy.seznam.cz. 10 IN A 1.1.1.2.")
+
+	# answer can be returned to the client without further checking.
+
+        if qstate.qinfo.qtype == RR_TYPE_A:
+            msg.answer.append("%s 10 IN A 192.168.1.1" % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_SRV) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN SRV 0 0 80 neinfo.example.com." % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_TXT) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN TXT path=/" % qstate.qinfo.qname_str)
+
+        if not msg.set_return_msg(qstate):
+            qstate.ext_state[id] = MODULE_ERROR 
+            return True
+
+        #qstate.return_msg.rep.security = 2 #pokud nebude nasledovat validator, je zapotrebi nastavit security, aby nebyl paket zahozen v mesh_send_reply
+        printReturnMsg(qstate)
+
+        #Authoritative result can't be stored in cache
+        #if (not storeQueryInCache(qstate, qstate.return_msg.qinfo, qstate.return_msg.rep, 0)):
+        #    print "Can't store in cache"
+        #    qstate.ext_state[id] = MODULE_ERROR
+        #    return False
+        #print "Store OK"
+
+        qstate.return_rcode = RCODE_NOERROR
+        return True
+
+    if event == MODULE_EVENT_NEW:
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    if event == MODULE_EVENT_MODDONE:
+        log_info("pythonmod: previous module done")
+        qstate.ext_state[id] = MODULE_FINISHED 
+        return True
+      
+    if event == MODULE_EVENT_PASS:
+        log_info("pythonmod: event_pass")
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    log_err("pythonmod: BAD event")
+    qstate.ext_state[id] = MODULE_ERROR
+    return True
+
+log_info("pythonmod: script loaded.")
diff --git a/testdata/pymod.tdir/pymod.test b/testdata/pymod.tdir/pymod.test
new file mode 100644
index 000000000000..43bf6e65f87f
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.test
@@ -0,0 +1,56 @@
+# #-- pymod.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+if test "`uname 2>&1`" = "Darwin"; then
+        ldnsdir=`grep ldnsdir= ../../Makefile | sed -e 's/ldnsdir=//'`
+        echo export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+        export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+fi
+
+# see if config file verifies
+if $PRE/unbound-checkconf ub.conf; then
+	echo "checkconf OK"
+else
+	echo "checkconf failed"
+	exit 1
+fi
+
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> dig www2.example.com."
+dig @localhost -p $UNBOUND_PORT www2.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "192.168.1.1" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/pymod.tdir/pymod.testns b/testdata/pymod.tdir/pymod.testns
new file mode 100644
index 000000000000..55926bb50c9f
--- /dev/null
+++ b/testdata/pymod.tdir/pymod.testns
@@ -0,0 +1,24 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/pymod.tpkg b/testdata/pymod.tpkg
deleted file mode 100644
index 164a82a00424..000000000000
--- a/testdata/pymod.tpkg
+++ /dev/null
diff --git a/testdata/pymod_thread.tdir/pymod_thread.conf b/testdata/pymod_thread.tdir/pymod_thread.conf
new file mode 100644
index 000000000000..3bf8df475d36
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.conf
@@ -0,0 +1,19 @@
+server:
+	verbosity: 2
+	num-threads: 3
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	module-config: "validator python iterator"
+
+python:
+	python-script: "pymod_thread.py"
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/pymod_thread.tdir/pymod_thread.dsc b/testdata/pymod_thread.tdir/pymod_thread.dsc
new file mode 100644
index 000000000000..d2cc7f5c5fb9
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.dsc
@@ -0,0 +1,16 @@
+BaseName: pymod_thread
+Version: 1.0
+Description: Test python module threaded
+CreationDate: Fri Mar 12 11:41:03 CET 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: pymod_thread.pre
+Post: pymod_thread.post
+Test: pymod_thread.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/pymod_thread.tdir/pymod_thread.post b/testdata/pymod_thread.tdir/pymod_thread.post
new file mode 100644
index 000000000000..e9b307548ba7
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.post
@@ -0,0 +1,21 @@
+# #-- pymod_thread.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+exit 0
diff --git a/testdata/pymod_thread.tdir/pymod_thread.pre b/testdata/pymod_thread.tdir/pymod_thread.pre
new file mode 100644
index 000000000000..c16362a0b3fb
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.pre
@@ -0,0 +1,56 @@
+# #-- pymod_thread.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no python; exit
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+# get module python local
+cp $PRE/pythonmod/unboundmodule.py .
+
+if test "`uname 2>&1`" = "Darwin"; then
+        ldnsdir=`grep ldnsdir= ../../Makefile | sed -e 's/ldnsdir=//'`
+        echo export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+        export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < pymod_thread.conf > ub.conf
+
+# see if config file verifies
+if $PRE/unbound-checkconf ub.conf 2>&1; then
+	echo "checkconf OK"
+else
+	echo "checkconf failed"
+	exit 1
+fi
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT pymod_thread.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/pymod_thread.tdir/pymod_thread.py b/testdata/pymod_thread.tdir/pymod_thread.py
new file mode 100644
index 000000000000..31e1d43f64ae
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.py
@@ -0,0 +1,165 @@
+# -*- coding: utf-8 -*-
+'''
+ ubmodule-msg.py: simple response packet logger
+
+ Authors: Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+          Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
+
+ Copyright (c) 2008. All rights reserved.
+
+ This software is open source.
+ 
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 
+ Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+ 
+ Redistributions in binary form must reproduce the above copyright notice,
+ this list of conditions and the following disclaimer in the documentation
+ and/or other materials provided with the distribution.
+ 
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ Modified for unit test by Wouter Wijngaards, NLnet Labs, 2009.
+'''
+import os
+
+def init(id, cfg):
+    log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
+    return True
+
+def deinit(id):
+    log_info("pythonmod: deinit called, module id is %d" % id)
+    return True
+
+def inform_super(id, qstate, superqstate, qdata):
+    return True
+
+def setTTL(qstate, ttl):
+    """Sets return_msg TTL and all the RRs TTL"""
+    if qstate.return_msg:
+        qstate.return_msg.rep.ttl = ttl
+        if (qstate.return_msg.rep):
+            for i in range(0,qstate.return_msg.rep.rrset_count):
+                d = qstate.return_msg.rep.rrsets[i].entry.data
+                for j in range(0,d.count+d.rrsig_count):
+                    d.rr_ttl[j] = ttl
+
+def dataHex(data, prefix=""):
+    res = ""
+    for i in range(0, (len(data)+15)/16):
+        res += "%s0x%02X | " % (prefix, i*16)
+        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        for ch in d:
+            res += "%02X " % ch
+        for i in range(0,17-len(d)):
+            res += "   "
+        res += "| "
+        for ch in d:
+            if (ch < 32) or (ch > 127):
+                res += ". "
+            else:
+                res += "%c " % ch
+        res += "\n"
+    return res
+
+def printReturnMsg(qstate):
+    print "Return MSG rep   :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (qstate.return_msg.rep.flags, qstate.return_msg.rep.qdcount,qstate.return_msg.rep.security, qstate.return_msg.rep.ttl)
+    print "           qinfo :: qname:",qstate.return_msg.qinfo.qname_list, qstate.return_msg.qinfo.qname_str, "type:",qstate.return_msg.qinfo.qtype_str, "class:",qstate.return_msg.qinfo.qclass_str
+    if (qstate.return_msg.rep):
+        print "RRSets:",qstate.return_msg.rep.rrset_count
+        prevkey = None
+        for i in range(0,qstate.return_msg.rep.rrset_count):
+            r = qstate.return_msg.rep.rrsets[i]
+            rk = r.rk
+            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
+            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+
+            d = r.entry.data
+            print "    RRDatas:",d.count+d.rrsig_count
+            for j in range(0,d.count+d.rrsig_count):
+                print "    ",j,":","TTL=",d.rr_ttl[j],"RR data:"
+                print dataHex(d.rr_data[j],"         ")
+
+
+def operate(id, event, qstate, qdata):
+    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
+    #print "pythonmod: per query data", qdata
+
+    print "Query:", ''.join(map(lambda x:chr(max(32,ord(x))),qstate.qinfo.qname)), qstate.qinfo.qname_list, qstate.qinfo.qname_str,
+    print "Type:",qstate.qinfo.qtype_str,"(%d)" % qstate.qinfo.qtype,
+    print "Class:",qstate.qinfo.qclass_str,"(%d)" % qstate.qinfo.qclass
+    print
+
+    if (event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS) and (qstate.qinfo.qname_str.endswith("example.com.")):
+        print qstate.qinfo.qname_str
+
+        qstate.ext_state[id] = MODULE_FINISHED 
+
+	# eat time
+	y = 20
+	for z in range(2, 10000):
+		y = y*2 - z/2
+		y = y/2 + z
+
+        msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_A, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA) #, 300)
+        #msg.authority.append("xxx.seznam.cz. 10 IN A 192.168.1.1")
+        #msg.additional.append("yyy.seznam.cz. 10 IN A 1.1.1.2.")
+
+	# answer can be returned to the client without further checking.
+
+        if qstate.qinfo.qtype == RR_TYPE_A:
+            msg.answer.append("%s 10 IN A 192.168.1.1" % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_SRV) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN SRV 0 0 80 neinfo.example.com." % qstate.qinfo.qname_str)
+        if (qstate.qinfo.qtype == RR_TYPE_TXT) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+            msg.answer.append("%s 10 IN TXT path=/" % qstate.qinfo.qname_str)
+
+        if not msg.set_return_msg(qstate):
+            qstate.ext_state[id] = MODULE_ERROR 
+            return True
+
+        #qstate.return_msg.rep.security = 2 #pokud nebude nasledovat validator, je zapotrebi nastavit security, aby nebyl paket zahozen v mesh_send_reply
+        printReturnMsg(qstate)
+
+        #Authoritative result can't be stored in cache
+        #if (not storeQueryInCache(qstate, qstate.return_msg.qinfo, qstate.return_msg.rep, 0)):
+        #    print "Can't store in cache"
+        #    qstate.ext_state[id] = MODULE_ERROR
+        #    return False
+        #print "Store OK"
+
+        qstate.return_rcode = RCODE_NOERROR
+        return True
+
+    if event == MODULE_EVENT_NEW:
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    if event == MODULE_EVENT_MODDONE:
+        log_info("pythonmod: previous module done")
+        qstate.ext_state[id] = MODULE_FINISHED 
+        return True
+      
+    if event == MODULE_EVENT_PASS:
+        log_info("pythonmod: event_pass")
+        qstate.ext_state[id] = MODULE_WAIT_MODULE 
+        return True
+
+    log_err("pythonmod: BAD event")
+    qstate.ext_state[id] = MODULE_ERROR
+    return True
+
+log_info("pythonmod: script loaded.")
diff --git a/testdata/pymod_thread.tdir/pymod_thread.test b/testdata/pymod_thread.tdir/pymod_thread.test
new file mode 100644
index 000000000000..c6baa01be842
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.test
@@ -0,0 +1,67 @@
+# #-- pymod_thread.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+if grep "define WITH_PYTHONMODULE 1" $PRE/config.h; then
+	echo "have python module"
+else
+	echo "no python module"
+	exit 0
+fi
+
+if test "`uname 2>&1`" = "Darwin"; then
+        ldnsdir=`grep ldnsdir= ../../Makefile | sed -e 's/ldnsdir=//'`
+        echo export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+        export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:$ldnsdir/lib:../../.libs"
+fi
+
+# see if config file verifies
+if $PRE/unbound-checkconf ub.conf; then
+	echo "checkconf OK"
+else
+	echo "checkconf failed"
+	exit 1
+fi
+
+# do the test
+# generate some load.
+echo "> dig www[1-10].example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile1 &
+dig @localhost -p $UNBOUND_PORT www2.example.com. | tee outfile3 &
+dig @localhost -p $UNBOUND_PORT www3.example.com. | tee outfile2 &
+dig @localhost -p $UNBOUND_PORT www4.example.com. | tee outfile4 &
+dig @localhost -p $UNBOUND_PORT www5.example.com. | tee outfile5 &
+dig @localhost -p $UNBOUND_PORT www6.example.com. | tee outfile6 &
+dig @localhost -p $UNBOUND_PORT www7.example.com. | tee outfile7 &
+dig @localhost -p $UNBOUND_PORT www8.example.com. | tee outfile8 &
+dig @localhost -p $UNBOUND_PORT www9.example.com. | tee outfile9 &
+dig @localhost -p $UNBOUND_PORT www10.example.com. | tee outfile10 &
+
+wait  # wait for all jobs to complete.
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+for x in outfile1 outfile2 outfile3 outfile4 outfile5; do
+if grep "192.168.1.1" $x; then
+	echo "$x OK"
+else
+	echo "$x Not OK"
+	exit 1
+fi
+done
+
+for x in outfile6 outfile7 outfile8 outfile9 outfile10; do
+if grep "192.168.1.1" $x; then
+	echo "$x OK"
+else
+	echo "$x Not OK"
+	exit 1
+fi
+done
+
+exit 0
diff --git a/testdata/pymod_thread.tdir/pymod_thread.testns b/testdata/pymod_thread.tdir/pymod_thread.testns
new file mode 100644
index 000000000000..55926bb50c9f
--- /dev/null
+++ b/testdata/pymod_thread.tdir/pymod_thread.testns
@@ -0,0 +1,24 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/pymod_thread.tpkg b/testdata/pymod_thread.tpkg
deleted file mode 100644
index 96d5d9b3936d..000000000000
--- a/testdata/pymod_thread.tpkg
+++ /dev/null
diff --git a/testdata/remote-threaded.tdir/bad_control.key b/testdata/remote-threaded.tdir/bad_control.key
new file mode 100644
index 000000000000..d29cdbc91b37
--- /dev/null
+++ b/testdata/remote-threaded.tdir/bad_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
+SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
+DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
+AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
+PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
+PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
+IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
+GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
+q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
+neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
+IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
+ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
+RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/bad_control.pem b/testdata/remote-threaded.tdir/bad_control.pem
new file mode 100644
index 000000000000..e06b847208e3
--- /dev/null
+++ b/testdata/remote-threaded.tdir/bad_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
+i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
+UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
+nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
+4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
+5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
+-----END CERTIFICATE-----
diff --git a/testdata/remote-threaded.tdir/bad_server.key b/testdata/remote-threaded.tdir/bad_server.key
new file mode 100644
index 000000000000..0dbb134b5be7
--- /dev/null
+++ b/testdata/remote-threaded.tdir/bad_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
+1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
+UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
+AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
+3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
+FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
+Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
+i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
+2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
+LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
+CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
+/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
+2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/bad_server.pem b/testdata/remote-threaded.tdir/bad_server.pem
new file mode 100644
index 000000000000..983247ac73bd
--- /dev/null
+++ b/testdata/remote-threaded.tdir/bad_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
+RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
+DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
+Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
+zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
+O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
+oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
+-----END CERTIFICATE-----
diff --git a/testdata/remote-threaded.tdir/remote-threaded.conf b/testdata/remote-threaded.tdir/remote-threaded.conf
new file mode 100644
index 000000000000..da9fee1de1ba
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.conf
@@ -0,0 +1,25 @@
+server:
+	verbosity: 2
+	num-threads: 4
+	outgoing-range: 16
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/remote-threaded.tdir/remote-threaded.dsc b/testdata/remote-threaded.tdir/remote-threaded.dsc
new file mode 100644
index 000000000000..b3aeebac141a
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.dsc
@@ -0,0 +1,16 @@
+BaseName: remote-threaded
+Version: 1.0
+Description: remote control test with thread communication
+CreationDate: Wed Dec  3 15:00:38 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: remote-threaded.pre
+Post: remote-threaded.post
+Test: remote-threaded.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/remote-threaded.tdir/remote-threaded.post b/testdata/remote-threaded.tdir/remote-threaded.post
new file mode 100644
index 000000000000..4cccd9a8b6ba
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.post
@@ -0,0 +1,13 @@
+# #-- remote-threaded.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+# unbound stopped by test (if successful)
+kill $UNBOUND_PID >/dev/null 2>&1
+kill $UNBOUND_PID >/dev/null 2>&1
+exit 0
diff --git a/testdata/remote-threaded.tdir/remote-threaded.pre b/testdata/remote-threaded.tdir/remote-threaded.pre
new file mode 100644
index 000000000000..76dc6b2492ae
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.pre
@@ -0,0 +1,33 @@
+# #-- remote-threaded.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+CONTROL_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT remote-threaded.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < remote-threaded.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/remote-threaded.tdir/remote-threaded.test b/testdata/remote-threaded.tdir/remote-threaded.test
new file mode 100644
index 000000000000..7392fa9097ca
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.test
@@ -0,0 +1,308 @@
+# #-- remote-threaded.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# exit value is 1 on usage
+$PRE/unbound-control -h
+if test $? -ne 1; then
+	echo "wrong exit value for usage."
+	exit 1
+else
+	echo "exit value for usage: OK"
+fi
+
+# use lock-verify if possible
+
+# test if the server is up.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# exit value is 1 when a bad command is given.
+echo "$PRE/unbound-control -c ub.conf blablargh"
+$PRE/unbound-control -c ub.conf blablargh
+if test $? -ne 1; then
+	echo "wrong exit value on error."
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	exit 1
+else
+	echo "correct exit value on error"
+fi
+
+# reload the server. test if the server came up by putting a new
+# local-data element in the server.
+echo "server: local-data: 'afterreload. IN A 5.6.7.8'" >> ub.conf
+echo "$PRE/unbound-control -c ub.conf reload"
+$PRE/unbound-control -c ub.conf reload
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "> dig afterreload."
+dig @127.0.0.1 -p $UNBOUND_PORT afterreload. | tee outfile
+echo "> check answer"
+if grep "5.6.7.8" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# must have had queries now.  1 since reload.
+echo "$PRE/unbound-control -c ub.conf stats"
+$PRE/unbound-control -c ub.conf stats > tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+if grep "^total.num.queries=[1-9][0-9]*$" tmp.$$; then
+	echo "OK"
+else
+	echo "bad stats"
+	cat tmp.$$
+	exit 1
+fi
+
+# verbosity
+echo "$PRE/unbound-control -c ub.conf verbosity 4"
+$PRE/unbound-control -c ub.conf verbosity 4
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# check syntax error in parse 
+echo "$PRE/unbound-control -c ub.conf verbosity jkdf"
+$PRE/unbound-control -c ub.conf verbosity jkdf
+if test $? -ne 1; then
+	echo "wrong exit value after failure"
+	exit 1
+fi
+
+# check bad credentials
+cp ub.conf bad.conf
+echo "remote-control:" >> bad.conf
+echo "	server-key-file: bad_server.key" >> bad.conf
+echo "	server-cert-file: bad_server.pem" >> bad.conf
+echo "	control-key-file: bad_control.key" >> bad.conf
+echo "	control-cert-file: bad_control.pem" >> bad.conf
+echo "$PRE/unbound-control -c bad.conf verbosity 2"
+$PRE/unbound-control -c bad.conf verbosity 2
+if test $? -ne 1; then
+	echo "wrong exit value after failure"
+	exit 1
+fi
+
+# create a new local zone
+echo "> test of local zone"
+echo "$PRE/unbound-control -c ub.conf local_zone example.net static"
+$PRE/unbound-control -c ub.conf local_zone example.net static
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1"
+$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# check that www.example.net exists
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# check that mail.example.net has nxdomain
+echo "> dig mail.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT mail.example.net. | tee outfile
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# remove www.example.net - check it gets nxdomain
+echo "$PRE/unbound-control -c ub.conf local_data_remove www.example.net"
+$PRE/unbound-control -c ub.conf local_data_remove www.example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# remove example.net - check its gone.
+echo "$PRE/unbound-control -c ub.conf local_zone_remove example.net"
+$PRE/unbound-control -c ub.conf local_zone_remove example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+echo "> dig www.example.net."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
+echo "> check answer"
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# dump the cache
+echo "> test cache dump"
+# fillup cache
+echo "dig www.example.com"
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com.
+echo "$PRE/unbound-control -c ub.conf dump_cache"
+$PRE/unbound-control -c ub.conf dump_cache > tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+cat tmp.$$
+# we do not look at content. Only thread 0 content.
+# because it may not be there when it is compiled with processes only.
+if grep MSG_CACHE tmp.$$; then
+	echo "OK this is a cache dump"
+else
+	echo "Not OK cache dump"
+	exit 1
+fi
+
+# test lookup 
+echo "$PRE/unbound-control -c ub.conf lookup www.example.com"
+$PRE/unbound-control -c ub.conf lookup www.example.com
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+# answer to lookup is meaningless because of use a forwarder, oh well.
+
+# load the cache dump.
+echo "$PRE/unbound-control -c ub.conf load_cache < tmp.$$"
+$PRE/unbound-control -c ub.conf load_cache < tmp.$$
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+# do not check if cache dump contents are present ; other threads
+# may not have gotten it when it is compiled with processes only.
+
+# flushing
+echo "$PRE/unbound-control -c ub.conf flush www.example.net"
+$PRE/unbound-control -c ub.conf flush www.example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "$PRE/unbound-control -c ub.conf flush_type www.example.net TXT"
+$PRE/unbound-control -c ub.conf flush_type www.example.net TXT
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+echo "$PRE/unbound-control -c ub.conf flush_zone example.net"
+$PRE/unbound-control -c ub.conf flush_zone example.net
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# now stop the server
+echo "$PRE/unbound-control -c ub.conf stop"
+$PRE/unbound-control -c ub.conf stop
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+# see if the server has really exited.
+TRY_MAX=20
+for (( try=0 ; try <= $TRY_MAX ; try++ )) ; do
+	if kill -0 $UNBOUND_PID 2>&1 | tee tmp.$$; then
+		echo "not stopped yet, waiting"
+		sleep 1
+	else
+		echo "stopped OK; break"
+		break;
+	fi
+	if grep "No such process" tmp.$$; then
+		echo "stopped OK; break"
+		break;
+	fi
+done
+if kill -0 $UNBOUND_PID; then
+	echo "still up!"
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "not stopped, failure"
+	exit 1
+else
+	echo "stopped OK"
+
+        if test -f ublocktrace.0; then
+		if $PRE/lock-verify ublocktrace.*; then
+			echo "lock-verify test worked."
+		else
+			echo "lock-verify test failed."
+			cat fwd.log 
+			cat unbound.log
+			exit 1
+		fi
+	fi
+fi
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> OK"
+exit 0
diff --git a/testdata/remote-threaded.tdir/remote-threaded.testns b/testdata/remote-threaded.tdir/remote-threaded.testns
new file mode 100644
index 000000000000..0c911ca5b30e
--- /dev/null
+++ b/testdata/remote-threaded.tdir/remote-threaded.testns
@@ -0,0 +1,22 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA SERVFAIL
+ADJUST copy_id
+SECTION QUESTION
+www.example.net.	IN	A
+ENTRY_END
+
diff --git a/testdata/remote-threaded.tdir/unbound_control.key b/testdata/remote-threaded.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/remote-threaded.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/unbound_control.pem b/testdata/remote-threaded.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/remote-threaded.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/remote-threaded.tdir/unbound_server.key b/testdata/remote-threaded.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/remote-threaded.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/unbound_server.pem b/testdata/remote-threaded.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/remote-threaded.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/remote-threaded.tpkg b/testdata/remote-threaded.tpkg
deleted file mode 100644
index 0e614d87a9b6..000000000000
--- a/testdata/remote-threaded.tpkg
+++ /dev/null
diff --git a/testdata/root_anchor.tdir/root_anchor.dsc b/testdata/root_anchor.tdir/root_anchor.dsc
new file mode 100644
index 000000000000..daf231da58de
--- /dev/null
+++ b/testdata/root_anchor.tdir/root_anchor.dsc
@@ -0,0 +1,16 @@
+BaseName: root_anchor
+Version: 1.0
+Description: check if root anchor has changed.
+CreationDate: Tue Sep 28 12:43:09 CEST 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: root_anchor.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/root_anchor.tdir/root_anchor.test b/testdata/root_anchor.tdir/root_anchor.test
new file mode 100644
index 000000000000..8be248ab9e12
--- /dev/null
+++ b/testdata/root_anchor.tdir/root_anchor.test
@@ -0,0 +1,51 @@
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# only do this test if the network is up.
+echo "is the net up?"
+if dig @k.root-servers.net . SOA 2>&1 | grep NOERROR ; then
+	echo yes
+else
+	echo no
+	exit 0
+fi
+
+# test that unbound-anchor, its builtin DNSKEY, works.
+# so the https is disabled (go to 127.0.0.1@10099).
+$PRE/unbound-anchor -u "127.0.0.1" -P 10099 -a test.ds -v
+# check that the test.ds file is OK.
+if $PRE/unbound-host -f test.ds -t SOA -v . 2>&1 | grep "(secure)"; then
+	echo "The builtin DS root anchors work"
+else
+	echo "The builtin DS root anchors do not work"
+	exit 1
+fi
+
+echo ""
+# test that unbound-anchor, the builtin certificate, works
+# so, force https with -F and the -c is a nonexistant file
+$PRE/unbound-anchor -a test.cert -c test.pem -v -F
+# check that the test.cert file is OK.
+if $PRE/unbound-host -f test.cert -t SOA -v . 2>&1 | grep "(secure)"; then
+	echo "The builtin root update certificate works"
+else
+	echo "The builtin root update certificate does not work"
+	exit 1
+fi
+
+# use curl to see if the PGP certificate has been updated.
+curl --time-cond "20170203 10:00:00" https://data.iana.org/root-anchors/icannbundle.pem > newcert
+if test -n "`cat newcert`"; then
+	echo "icannbundle.pem has been updated"
+	cat newcert
+	echo "icannbundle.pem has been updated"
+	exit 1
+else
+	echo "icannbundle.pem has not been updated"
+fi
+
+exit 0
diff --git a/testdata/root_anchor.tpkg b/testdata/root_anchor.tpkg
deleted file mode 100644
index 98aa57e5257e..000000000000
--- a/testdata/root_anchor.tpkg
+++ /dev/null
diff --git a/testdata/root_hints.tdir/root_hints.dsc b/testdata/root_hints.tdir/root_hints.dsc
new file mode 100644
index 000000000000..5576fbaf942a
--- /dev/null
+++ b/testdata/root_hints.tdir/root_hints.dsc
@@ -0,0 +1,16 @@
+BaseName: root_hints
+Version: 1.0
+Description: check if root hints have changed.
+CreationDate: Thu Oct 22 12:42:40 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre:
+Post:
+Test: root_hints.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/root_hints.tdir/root_hints.test b/testdata/root_hints.tdir/root_hints.test
new file mode 100644
index 000000000000..6ae4ec7f4677
--- /dev/null
+++ b/testdata/root_hints.tdir/root_hints.test
@@ -0,0 +1,62 @@
+# #-- 06-ianaports.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# dig 9 ?
+digv=`dig -v 2>&1 | wc -l`
+if test $digv -ne 1; then
+	echo "Dig too old. skip test"
+	exit 0
+fi
+
+eval `grep ^srcdir= $PRE/Makefile`
+echo "srcdir="$srcdir
+
+# obtain list from compiled in settings:
+grep "ROOT-SERVERS.NET." $PRE/$srcdir/iterator/iter_hints.c > curlist
+echo "Current list:"
+cat curlist
+
+result="0"
+
+# dig all servers and check if same
+for rs in A.ROOT-SERVERS.NET. B.ROOT-SERVERS.NET. C.ROOT-SERVERS.NET. D.ROOT-SERVERS.NET. E.ROOT-SERVERS.NET. F.ROOT-SERVERS.NET. G.ROOT-SERVERS.NET. H.ROOT-SERVERS.NET. I.ROOT-SERVERS.NET. J.ROOT-SERVERS.NET. K.ROOT-SERVERS.NET. L.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET.; do
+
+	addr4=`dig +short $rs A`
+	addr6=`dig +short $rs AAAA`
+
+	# all IP4 must be present as listed.
+	if test -z "$addr4" ; then
+		echo "$rs A is removed! It has changed!"
+		result="1"
+	fi
+	if grep $rs curlist | grep "$addr4" >/dev/null; then
+		echo "$rs is OK: A $addr4"
+	else
+		echo "$rs A now $addr4, it has changed!"
+		result="1"
+	fi
+	# if IP6 is "" then it must be "" as well in the compiled hints
+	if test -z "$addr6" ; then
+		if grep $rs curlist | grep ":" >/dev/null; then
+			echo "$rs AAAA now removed, it has changed!"
+			result="1"
+		else
+			echo $rs' is OK: AAAA ""'
+		fi
+	else
+		# root server has an IP6.
+		if grep $rs curlist | grep "$addr6" >/dev/null; then
+			echo "$rs is OK: AAAA $addr6"
+		else
+			echo "$rs AAAA now $addr6, it has changed!"
+			result="1"
+		fi
+	fi
+done
+
+exit $result
diff --git a/testdata/root_hints.tpkg b/testdata/root_hints.tpkg
deleted file mode 100644
index 9c83fc32d360..000000000000
--- a/testdata/root_hints.tpkg
+++ /dev/null
diff --git a/testdata/speed_cache.tdir/makeqs.c b/testdata/speed_cache.tdir/makeqs.c
new file mode 100644
index 000000000000..8e6179f66b21
--- /dev/null
+++ b/testdata/speed_cache.tdir/makeqs.c
@@ -0,0 +1,14 @@
+/**
+ * \file
+ * This file creates queries for the speed test
+ */
+#include <stdio.h>
+#include <stdlib.h>
+/** main program to create queries, pass the number of them. */
+int main(int argc, char** argv) {
+        int i;
+        int max = atoi(argv[1]);
+        for(i=0; i<max; i++)
+                printf("a%8.8d.example.com IN A\n", i);
+        return 0;
+}
diff --git a/testdata/speed_cache.tdir/makeqs.sh b/testdata/speed_cache.tdir/makeqs.sh
new file mode 100644
index 000000000000..aebabfcafa25
--- /dev/null
+++ b/testdata/speed_cache.tdir/makeqs.sh
@@ -0,0 +1,33 @@
+# generate query file, $1=number $2=filename.
+
+cat >makeqs.c <<EOF
+#include <stdio.h>
+#include <stdlib.h>
+int main(int argc, char** argv) {
+	int i;
+	int max = atoi(argv[1]);
+	for(i=0; i<max; i++)
+		printf("a%8.8d.example.com IN A\n", i);
+	return 0;
+}
+EOF
+
+gcc -o makeqs makeqs.c
+
+#function makeqs() {
+	#i=0
+	#echo "; generated by makeqs" > $2
+	#while test $i -lt $1; do
+		#echo "a$i.example.com IN A" >> $2
+		#i=`expr $i + 1`
+	#done
+#}
+
+./makeqs 10 > q10.txt
+cat q10.txt
+./makeqs 100 > q100.txt
+./makeqs 1000 > q1000.txt
+./makeqs 10000 > q10000.txt
+./makeqs 100000 > q100000.txt
+#./makeqs 1000000 > q1000000.txt
+#./makeqs 10000000 > q10000000.txt
diff --git a/testdata/speed_cache.tdir/speed_cache.conf b/testdata/speed_cache.tdir/speed_cache.conf
new file mode 100644
index 000000000000..64cf30b796d8
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 0
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	rrset-cache-size: 100k
+	msg-cache-size: 100k
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/speed_cache.tdir/speed_cache.dsc b/testdata/speed_cache.tdir/speed_cache.dsc
new file mode 100644
index 000000000000..9171dd2a6115
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.dsc
@@ -0,0 +1,16 @@
+BaseName: speed_cache
+Version: 1.0
+Description: Speed test with cache sizes
+CreationDate: Fri Feb 15 15:46:25 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: speed_cache.pre
+Post: speed_cache.post
+Test: speed_cache.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/speed_cache.tdir/speed_cache.post b/testdata/speed_cache.tdir/speed_cache.post
new file mode 100644
index 000000000000..3ca4a4b403d7
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.post
@@ -0,0 +1,10 @@
+# #-- speed_cache.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/speed_cache.tdir/speed_cache.pre b/testdata/speed_cache.tdir/speed_cache.pre
new file mode 100644
index 000000000000..fc7906e33f40
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.pre
@@ -0,0 +1,31 @@
+# #-- speed_cache.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT speed_cache.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < speed_cache.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/speed_cache.tdir/speed_cache.test b/testdata/speed_cache.tdir/speed_cache.test
new file mode 100644
index 000000000000..a45d4436c3b3
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.test
@@ -0,0 +1,79 @@
+# #-- speed_cache.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+# make tool
+get_make
+(cd $PRE; $MAKE perf)
+
+get_gcc
+$CC -o makeqs makeqs.c
+if test $? -ne 0; then
+	echo "could not compile makeqs"
+	exit 1
+fi
+
+./makeqs 10 > q10.txt
+cat q10.txt
+./makeqs 100 > q100.txt
+./makeqs 1000 > q1000.txt
+./makeqs 10000 > q10000.txt
+#./makeqs 100000 > q100000.txt
+#./makeqs 1000000 > q1000000.txt
+#./makeqs 10000000 > q10000000.txt
+
+# seconds per test
+dur=1
+
+# do the test
+echo "> perf test ldns-testns"
+$PRE/perf -d $dur -a "www.example.com IN A" 127.0.0.1@$FWD_PORT 2>&1 | tee outfile
+
+echo "> perf test cache-1"
+$PRE/perf -d $dur -a "www.example.com IN A" 127.0.0.1@$UNBOUND_PORT 2>&1 | tee outfile
+echo -n "cache-size-1  	" >> ../.perfstats.txt
+grep "average qps" outfile >> ../.perfstats.txt
+
+# with $1=number $2=pretty-str $3=queryfile
+function perfnum() {
+	echo ""
+	echo "> perf test $1 $2"
+	$PRE/perf -d $dur -f $3 127.0.0.1@$UNBOUND_PORT 2>&1 | tee outfile
+	if test -n "$2"; then
+		echo -n "$2	" >> ../.perfstats.txt
+		grep "average qps" outfile >> ../.perfstats.txt
+	fi
+}
+
+function perftns() {
+	echo ""
+	echo "> perf testns $1 $2"
+	$PRE/perf -d $dur -f $3 127.0.0.1@$FWD_PORT 2>&1 | tee outfile
+}
+
+#perfnum 10 "" q10.txt
+perfnum 100 "cache-suffices" q100.txt
+#perfnum 1000 "" q1000.txt
+perfnum 10000 "cache-toosmall" q10000.txt
+#perfnum 100000 "100k" q100000.txt
+#perfnum 1000000 "1m" q1000000.txt
+#perfnum 1000000 "10m" q10000000.txt
+
+#perftns 10 "10" q10.txt
+#perftns 100 "100" q100.txt
+perftns 1000 "1k" q1000.txt
+#perftns 10000 "10k" q10000.txt
+#perftns 100000 "100k" q100000.txt
+#perftns 1000000 "1m" q1000000.txt
+#perftns 1000000 "10m" q10000000.txt
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+rm -f q*.txt
+exit 0
diff --git a/testdata/speed_cache.tdir/speed_cache.testns b/testdata/speed_cache.tdir/speed_cache.testns
new file mode 100644
index 000000000000..1293c24b0150
--- /dev/null
+++ b/testdata/speed_cache.tdir/speed_cache.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype
+REPLY QR AA NOERROR
+ADJUST copy_id copy_query
+SECTION QUESTION
+www	IN	A
+SECTION AUTHORITY
+@	IN	SOA	ns hostmaster 2008021401 1800 900 604800 86400
+ENTRY_END
+
diff --git a/testdata/speed_cache.tpkg b/testdata/speed_cache.tpkg
deleted file mode 100644
index bade5288b3a4..000000000000
--- a/testdata/speed_cache.tpkg
+++ /dev/null
diff --git a/testdata/speed_local.tdir/speed_local.conf b/testdata/speed_local.tdir/speed_local.conf
new file mode 100644
index 000000000000..bfc10071272f
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 1
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/speed_local.tdir/speed_local.dsc b/testdata/speed_local.tdir/speed_local.dsc
new file mode 100644
index 000000000000..7b4076fb73ea
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.dsc
@@ -0,0 +1,16 @@
+BaseName: speed_local
+Version: 1.0
+Description: Speed test with localhost query.
+CreationDate: Thu Feb 14 16:51:55 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: speed_local.pre
+Post: speed_local.post
+Test: speed_local.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/speed_local.tdir/speed_local.post b/testdata/speed_local.tdir/speed_local.post
new file mode 100644
index 000000000000..dc88245eb7fd
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.post
@@ -0,0 +1,9 @@
+# #-- speed_local.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $UNBOUND_PID
diff --git a/testdata/speed_local.tdir/speed_local.pre b/testdata/speed_local.tdir/speed_local.pre
new file mode 100644
index 000000000000..712fde6ae4bb
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.pre
@@ -0,0 +1,23 @@
+# #-- speed_local.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < speed_local.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
+
diff --git a/testdata/speed_local.tdir/speed_local.test b/testdata/speed_local.tdir/speed_local.test
new file mode 100644
index 000000000000..684b3c52251b
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.test
@@ -0,0 +1,43 @@
+# #-- speed_local.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_make
+(cd $PRE; $MAKE perf)
+
+echo "> perf version.server"
+$PRE/perf -d 1 -a "version.server CH TXT -" 127.0.0.1@$UNBOUND_PORT 2>&1 | 
+tee outfile
+
+echo -n "version-server	" > line.txt
+if grep "average qps" outfile >> line.txt 2>&1; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+
+echo "> perf localhost"
+$PRE/perf -d 1 -a "localhost IN A -" 127.0.0.1@$UNBOUND_PORT 2>&1 | 
+tee outfile
+
+echo -n "localhost-addr	" >> line.txt
+if grep "average qps" outfile >> line.txt 2>&1; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+cat line.txt >> ../.perfstats.txt
+
+exit 0
diff --git a/testdata/speed_local.tdir/speed_local.testns b/testdata/speed_local.tdir/speed_local.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/speed_local.tdir/speed_local.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/speed_local.tpkg b/testdata/speed_local.tpkg
deleted file mode 100644
index 572f60cf14ca..000000000000
--- a/testdata/speed_local.tpkg
+++ /dev/null
diff --git a/testdata/stat_timer.tdir/stat_timer.conf b/testdata/stat_timer.tdir/stat_timer.conf
new file mode 100644
index 000000000000..8245647294b1
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.conf
@@ -0,0 +1,16 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	statistics-interval: 1
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
diff --git a/testdata/stat_timer.tdir/stat_timer.dsc b/testdata/stat_timer.tdir/stat_timer.dsc
new file mode 100644
index 000000000000..3d6f23e71e32
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.dsc
@@ -0,0 +1,16 @@
+BaseName: stat_timer
+Version: 1.0
+Description: Test statistics-interval timer.
+CreationDate: Tue Feb  5 14:41:10 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: stat_timer.pre
+Post: stat_timer.post
+Test: stat_timer.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/stat_timer.tdir/stat_timer.post b/testdata/stat_timer.tdir/stat_timer.post
new file mode 100644
index 000000000000..0a9d9ac5bd17
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.post
@@ -0,0 +1,11 @@
+# #-- stat_timer.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+
diff --git a/testdata/stat_timer.tdir/stat_timer.pre b/testdata/stat_timer.tdir/stat_timer.pre
new file mode 100644
index 000000000000..284e1106d58a
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.pre
@@ -0,0 +1,31 @@
+# #-- stat_timer.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT stat_timer.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < stat_timer.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/stat_timer.tdir/stat_timer.test b/testdata/stat_timer.tdir/stat_timer.test
new file mode 100644
index 000000000000..8a84c3f41d17
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.test
@@ -0,0 +1,40 @@
+# #-- stat_timer.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# test if unbound is up 
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+# wait for statistics timer to go off a couple times.
+sleep 5
+
+n=`grep "server stats" unbound.log | wc | awk '{print $1}'`
+echo "counted $n stat lines"
+if test $n -gt 6; then
+	echo "OK"
+else
+	echo "> cat logfiles"
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+exit 0
diff --git a/testdata/stat_timer.tdir/stat_timer.testns b/testdata/stat_timer.tdir/stat_timer.testns
new file mode 100644
index 000000000000..f2a700cc7daf
--- /dev/null
+++ b/testdata/stat_timer.tdir/stat_timer.testns
@@ -0,0 +1,14 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
diff --git a/testdata/stat_timer.tpkg b/testdata/stat_timer.tpkg
deleted file mode 100644
index 982e698829ab..000000000000
--- a/testdata/stat_timer.tpkg
+++ /dev/null
diff --git a/testdata/stream_ssl.tdir/stream_ssl.clie.conf b/testdata/stream_ssl.tdir/stream_ssl.clie.conf
new file mode 100644
index 000000000000..f62af1a86f45
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.clie.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @CLIEPORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound-clie.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+	ssl-upstream: yes
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@SERVPORT@"
diff --git a/testdata/stream_ssl.tdir/stream_ssl.dsc b/testdata/stream_ssl.tdir/stream_ssl.dsc
new file mode 100644
index 000000000000..ee79484ece6c
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.dsc
@@ -0,0 +1,16 @@
+BaseName: stream_ssl
+Version: 1.0
+Description: Stream queries over SSL channel.
+CreationDate: Wed Nov  9 14:02:31 CET 2011
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: stream_ssl.pre
+Post: stream_ssl.post
+Test: stream_ssl.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/stream_ssl.tdir/stream_ssl.post b/testdata/stream_ssl.tdir/stream_ssl.post
new file mode 100644
index 000000000000..4cdbe726710f
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.post
@@ -0,0 +1,10 @@
+# #-- stream_ssl.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $UNBOUNDSERV_PID
+kill_pid $UNBOUNDCLIE_PID
diff --git a/testdata/stream_ssl.tdir/stream_ssl.pre b/testdata/stream_ssl.tdir/stream_ssl.pre
new file mode 100644
index 000000000000..200d27cf61a2
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.pre
@@ -0,0 +1,29 @@
+# #-- stream_ssl.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+SERV_PORT=$RND_PORT
+CLIE_PORT=$(($RND_PORT + 1))
+echo "SERV_PORT=$SERV_PORT" >> .tpkg.var.test
+echo "CLIE_PORT=$CLIE_PORT" >> .tpkg.var.test
+
+# make config files
+sed -e 's/@SERVPORT\@/'$SERV_PORT'/' -e 's/@CLIEPORT\@/'$CLIE_PORT'/' < stream_ssl.serv.conf > ubserv.conf
+sed -e 's/@SERVPORT\@/'$SERV_PORT'/' -e 's/@CLIEPORT\@/'$CLIE_PORT'/' < stream_ssl.clie.conf > ubclie.conf
+
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -v -v -v -v -c ubserv.conf >unboundserv.log 2>&1 &
+UNBOUNDSERV_PID=$!
+echo "UNBOUNDSERV_PID=$UNBOUNDSERV_PID" >> .tpkg.var.test
+$PRE/unbound -d -v -v -v -v -c ubclie.conf >unboundclie.log 2>&1 &
+UNBOUNDCLIE_PID=$!
+echo "UNBOUNDCLIE_PID=$UNBOUNDCLIE_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unboundserv.log
+wait_unbound_up unboundclie.log
diff --git a/testdata/stream_ssl.tdir/stream_ssl.serv.conf b/testdata/stream_ssl.tdir/stream_ssl.serv.conf
new file mode 100644
index 000000000000..9dd169ff78bf
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.serv.conf
@@ -0,0 +1,20 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @SERVPORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound-serv.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: yes
+	local-data: "www.example.com. IN A 10.20.30.40"
+	ssl-port: @SERVPORT@
+	ssl-service-key: "unbound_server.key"
+	ssl-service-pem: "unbound_server.pem"
+
+# no other queries should reach here.
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1"
diff --git a/testdata/stream_ssl.tdir/stream_ssl.test b/testdata/stream_ssl.tdir/stream_ssl.test
new file mode 100644
index 000000000000..08bbcdee9205
--- /dev/null
+++ b/testdata/stream_ssl.tdir/stream_ssl.test
@@ -0,0 +1,74 @@
+# #-- stream_ssl.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+# first test streamtcp against the server unbound.
+echo "> streamtcp -s www.example.com A IN"
+$PRE/streamtcp -s -f 127.0.0.1@$SERV_PORT www.example.com. A IN >outfile 2>&1
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	echo "SSLSERVICE"
+	cat unboundserv.log
+	echo "SSLCLIENT"
+	cat unboundclie.log
+	echo "Not OK"
+	exit 1
+else
+	echo "exit status OK"
+fi
+echo "> cat logfiles"
+cat outfile
+echo "SSLSERVICE"
+cat unboundserv.log
+echo "SSLCLIENT"
+cat unboundclie.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+rm -f outfile
+
+# test client unbound (no SSL towards it, but it does SSL to the SSL service)
+echo "> dig www.example.com A IN"
+dig @127.0.0.1 -p $CLIE_PORT www.example.com. >outfile 2>&1
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	echo "SSLSERVICE"
+	cat unboundserv.log
+	echo "SSLCLIENT"
+	cat unboundclie.log
+	echo "Not OK"
+	exit 1
+else
+	echo "exit status OK"
+fi
+echo "> cat logfiles"
+cat outfile
+echo "SSLSERVICE"
+cat unboundserv.log
+echo "SSLCLIENT"
+cat unboundclie.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/stream_ssl.tdir/unbound_control.key b/testdata/stream_ssl.tdir/unbound_control.key
new file mode 100644
index 000000000000..d7c43a06bb58
--- /dev/null
+++ b/testdata/stream_ssl.tdir/unbound_control.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
+rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
+ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
+AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
+WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
+DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
+4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
+Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
+p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
+P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
+aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
+YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
+DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/stream_ssl.tdir/unbound_control.pem b/testdata/stream_ssl.tdir/unbound_control.pem
new file mode 100644
index 000000000000..8f1ba87f1cdd
--- /dev/null
+++ b/testdata/stream_ssl.tdir/unbound_control.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
+AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
+6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
+qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
+J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
+9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
+iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+-----END CERTIFICATE-----
diff --git a/testdata/stream_ssl.tdir/unbound_server.key b/testdata/stream_ssl.tdir/unbound_server.key
new file mode 100644
index 000000000000..4256c421dd0d
--- /dev/null
+++ b/testdata/stream_ssl.tdir/unbound_server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
+3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
+RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
+AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
+6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
+sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
+XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
+fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
+CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
+0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
+oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
+In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
+LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/stream_ssl.tdir/unbound_server.pem b/testdata/stream_ssl.tdir/unbound_server.pem
new file mode 100644
index 000000000000..aeda3ff11882
--- /dev/null
+++ b/testdata/stream_ssl.tdir/unbound_server.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
+bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
+AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
+y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
+/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
+g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
+9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
+l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
+Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+-----END CERTIFICATE-----
diff --git a/testdata/stream_ssl.tpkg b/testdata/stream_ssl.tpkg
deleted file mode 100644
index cf734d4d70b1..000000000000
--- a/testdata/stream_ssl.tpkg
+++ /dev/null
diff --git a/testdata/stream_tcp.tdir/stream_tcp.conf b/testdata/stream_tcp.tdir/stream_tcp.conf
new file mode 100644
index 000000000000..2b900640e764
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.conf
@@ -0,0 +1,14 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/stream_tcp.tdir/stream_tcp.dsc b/testdata/stream_tcp.tdir/stream_tcp.dsc
new file mode 100644
index 000000000000..3fce8b58559c
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.dsc
@@ -0,0 +1,16 @@
+BaseName: stream_tcp
+Version: 1.0
+Description: Stream several queries over a TCP channel.
+CreationDate: Fri Feb  8 11:09:09 CET 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: stream_tcp.pre
+Post: stream_tcp.post
+Test: stream_tcp.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/stream_tcp.tdir/stream_tcp.post b/testdata/stream_tcp.tdir/stream_tcp.post
new file mode 100644
index 000000000000..17f1e7089f72
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.post
@@ -0,0 +1,10 @@
+# #-- stream_tcp.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/stream_tcp.tdir/stream_tcp.pre b/testdata/stream_tcp.tdir/stream_tcp.pre
new file mode 100644
index 000000000000..4c2156c80e92
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.pre
@@ -0,0 +1,30 @@
+# #-- stream_tcp.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT stream_tcp.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < stream_tcp.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -v -v -v -v -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
diff --git a/testdata/stream_tcp.tdir/stream_tcp.test b/testdata/stream_tcp.tdir/stream_tcp.test
new file mode 100644
index 000000000000..695cb0c72f3a
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.test
@@ -0,0 +1,79 @@
+# #-- stream_tcp.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+# first test a single TCP query.
+echo "> query www.example.com."
+$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN >outfile 2>&1
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+else
+	echo "exit status OK"
+fi
+echo "> cat logfiles"
+cat outfile
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# test more 
+echo ""
+echo ""
+echo "> query www.example.com www2.example.com www3.example.com"
+$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN www2.example.com. A IN www3.example.com A IN >outfile 2>&1
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+else
+	echo "exit status OK"
+fi
+echo "> cat logfiles"
+cat outfile
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+if grep "10.20.30.42" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "10.20.30.43" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/stream_tcp.tdir/stream_tcp.testns b/testdata/stream_tcp.tdir/stream_tcp.testns
new file mode 100644
index 000000000000..fefbcc767a09
--- /dev/null
+++ b/testdata/stream_tcp.tdir/stream_tcp.testns
@@ -0,0 +1,34 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.43
+ENTRY_END
+
diff --git a/testdata/stream_tcp.tpkg b/testdata/stream_tcp.tpkg
deleted file mode 100644
index 9cc58912e4df..000000000000
--- a/testdata/stream_tcp.tpkg
+++ /dev/null
diff --git a/testdata/stub_udp.tdir/stub_udp.conf b/testdata/stub_udp.tdir/stub_udp.conf
new file mode 100644
index 000000000000..c8e2ae26ef94
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.conf
@@ -0,0 +1,18 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+stub-zone:
+	name: "example.com"
+	stub-addr: "127.0.0.1@@TOPORT@"
+# a k a root hints
+stub-zone:
+	name: "."
+	stub-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/stub_udp.tdir/stub_udp.dsc b/testdata/stub_udp.tdir/stub_udp.dsc
new file mode 100644
index 000000000000..c76c8995ed4f
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.dsc
@@ -0,0 +1,16 @@
+BaseName: stub_udp
+Version: 1.0
+Description: Stub server contacted via UDP.
+CreationDate: Tue Sep 30 15:10:00 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: stub_udp.pre
+Post: stub_udp.post
+Test: stub_udp.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/stub_udp.tdir/stub_udp.post b/testdata/stub_udp.tdir/stub_udp.post
new file mode 100644
index 000000000000..c9216ed749c1
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.post
@@ -0,0 +1,10 @@
+# #-- stub_udp.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/stub_udp.tdir/stub_udp.pre b/testdata/stub_udp.tdir/stub_udp.pre
new file mode 100644
index 000000000000..d9dcaadedc85
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.pre
@@ -0,0 +1,35 @@
+# #-- stub_udp.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+. ../common.sh
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT stub_udp.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < stub_udp.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+
+# wait for forwarder to come up
+wait_ldns_testns_up fwd.log
+
+# wait for unbound to come up
+wait_unbound_up unbound.log
+
diff --git a/testdata/stub_udp.tdir/stub_udp.test b/testdata/stub_udp.tdir/stub_udp.test
new file mode 100644
index 000000000000..c417d2a04b2e
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.test
@@ -0,0 +1,37 @@
+# #-- stub_udp.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+
+# check delegations from cache by doing second test
+echo "> dig mail.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT mail.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.66" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/stub_udp.tdir/stub_udp.testns b/testdata/stub_udp.tdir/stub_udp.testns
new file mode 100644
index 000000000000..5d581b00a665
--- /dev/null
+++ b/testdata/stub_udp.tdir/stub_udp.testns
@@ -0,0 +1,46 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+SECTION AUTHORITY
+@	IN 	NS	ns.example.com.
+SECTION ADDITIONAL
+ns	IN	A	127.0.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+mail	IN	A
+SECTION ANSWER
+mail	IN	A	10.20.30.66
+SECTION AUTHORITY
+@	IN 	NS	ns.example.com.
+SECTION ADDITIONAL
+ns	IN	A	127.0.0.1
+ENTRY_END
+
+; root prime
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+.	IN	NS
+SECTION ANSWER
+. 	IN 	NS 	root.server.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+root.server.	IN	A	127.0.0.1
+ENTRY_END
+
diff --git a/testdata/stub_udp.tpkg b/testdata/stub_udp.tpkg
deleted file mode 100644
index 9a4757d60daa..000000000000
--- a/testdata/stub_udp.tpkg
+++ /dev/null
diff --git a/testdata/stub_udp6.tdir/stub_udp6.conf b/testdata/stub_udp6.tdir/stub_udp6.conf
new file mode 100644
index 000000000000..a037908b3166
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.conf
@@ -0,0 +1,19 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: ::1
+	outgoing-interface: ::1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+stub-zone:
+	name: "example.com"
+	stub-addr: "::1@@TOPORT@"
+# a k a root hints
+stub-zone:
+	name: "."
+	stub-addr: "::1@@TOPORT@"
diff --git a/testdata/stub_udp6.tdir/stub_udp6.dsc b/testdata/stub_udp6.tdir/stub_udp6.dsc
new file mode 100644
index 000000000000..7f73c58218de
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.dsc
@@ -0,0 +1,16 @@
+BaseName: stub_udp6
+Version: 1.0
+Description: Stub server contacted via UDP over IPv6.
+CreationDate: Wed Mar 10 13:33:06 CET 2010
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: stub_udp6.pre
+Post: stub_udp6.post
+Test: stub_udp6.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/stub_udp6.tdir/stub_udp6.post b/testdata/stub_udp6.tdir/stub_udp6.post
new file mode 100644
index 000000000000..e25670bbac60
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.post
@@ -0,0 +1,10 @@
+# #-- stub_udp6.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/stub_udp6.tdir/stub_udp6.pre b/testdata/stub_udp6.tdir/stub_udp6.pre
new file mode 100644
index 000000000000..209ab242f32f
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.pre
@@ -0,0 +1,31 @@
+# #-- stub_udp6.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -6 -p $FWD_PORT stub_udp6.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < stub_udp6.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/stub_udp6.tdir/stub_udp6.test b/testdata/stub_udp6.tdir/stub_udp6.test
new file mode 100644
index 000000000000..5336c8e3d67d
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.test
@@ -0,0 +1,37 @@
+# #-- stub_udp6.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @::1 -p $UNBOUND_PORT www.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+
+# check delegations from cache by doing second test
+echo "> dig mail.example.com."
+dig @::1 -p $UNBOUND_PORT mail.example.com. | tee outfile
+echo "> cat logfiles"
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.66" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/stub_udp6.tdir/stub_udp6.testns b/testdata/stub_udp6.tdir/stub_udp6.testns
new file mode 100644
index 000000000000..5d581b00a665
--- /dev/null
+++ b/testdata/stub_udp6.tdir/stub_udp6.testns
@@ -0,0 +1,46 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+SECTION AUTHORITY
+@	IN 	NS	ns.example.com.
+SECTION ADDITIONAL
+ns	IN	A	127.0.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+mail	IN	A
+SECTION ANSWER
+mail	IN	A	10.20.30.66
+SECTION AUTHORITY
+@	IN 	NS	ns.example.com.
+SECTION ADDITIONAL
+ns	IN	A	127.0.0.1
+ENTRY_END
+
+; root prime
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+.	IN	NS
+SECTION ANSWER
+. 	IN 	NS 	root.server.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+root.server.	IN	A	127.0.0.1
+ENTRY_END
+
diff --git a/testdata/stub_udp6.tpkg b/testdata/stub_udp6.tpkg
deleted file mode 100644
index c5e7ffe9dcf4..000000000000
--- a/testdata/stub_udp6.tpkg
+++ /dev/null
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.conf b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.conf
new file mode 100644
index 000000000000..384f16b0738a
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.conf
@@ -0,0 +1,15 @@
+server:
+	verbosity: 2
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.dsc b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.dsc
new file mode 100644
index 000000000000..d775ec8e9df5
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.dsc
@@ -0,0 +1,16 @@
+BaseName: tcp_sigpipe
+Version: 1.0
+Description: Generate SIGPIPE over a TCP channel.
+CreationDate: Tue Apr 22 13:45:04 CEST 2008
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: tcp_sigpipe.pre
+Post: tcp_sigpipe.post
+Test: tcp_sigpipe.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.post b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.post
new file mode 100644
index 000000000000..4df9fe12588d
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.post
@@ -0,0 +1,10 @@
+# #-- tcp_sigpipe.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.pre b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.pre
new file mode 100644
index 000000000000..274dc1198d9a
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.pre
@@ -0,0 +1,31 @@
+# #-- tcp_sigpipe.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT tcp_sigpipe.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < tcp_sigpipe.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.test b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.test
new file mode 100644
index 000000000000..6263dca5e625
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.test
@@ -0,0 +1,45 @@
+# #-- tcp_sigpipe.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+if uname | grep MINGW >/dev/null; then
+	echo "no job control in shell on windows. end test"
+	exit 0
+fi
+
+PRE="../.."
+. ../common.sh
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+# first test a single TCP query.
+echo "> query www.example.com."
+$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www.example.com. A IN >outfile 2>&1 &
+kill -PIPE $UNBOUND_PID
+wait
+if test "$?" -ne 0; then
+	echo "exit status not OK"
+	echo "> cat logfiles"
+	cat outfile
+	cat fwd.log 
+	cat unbound.log
+	echo "Not OK"
+	exit 1
+else
+	echo "exit status OK"
+fi
+echo "> cat logfiles"
+cat outfile
+cat fwd.log 
+cat unbound.log
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/tcp_sigpipe.tdir/tcp_sigpipe.testns b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.testns
new file mode 100644
index 000000000000..7b773d3b2e73
--- /dev/null
+++ b/testdata/tcp_sigpipe.tdir/tcp_sigpipe.testns
@@ -0,0 +1,42 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH UDP opcode qtype qname
+REPLY QR AA NOERROR TC
+ADJUST copy_id 
+SECTION QUESTION
+www	IN	A
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH TCP opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id sleep=3
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2	IN	A
+SECTION ANSWER
+www2	IN	A	10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www3	IN	A
+SECTION ANSWER
+www3	IN	A	10.20.30.43
+ENTRY_END
+
diff --git a/testdata/tcp_sigpipe.tpkg b/testdata/tcp_sigpipe.tpkg
deleted file mode 100644
index 4d6dee4d41b7..000000000000
--- a/testdata/tcp_sigpipe.tpkg
+++ /dev/null
diff --git a/util/config_file.c b/util/config_file.c
index d0fdb2daaa25..796c1a61f269 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -282,6 +282,8 @@ config_create(void)
 	cfg->dnscrypt_provider = NULL;
 	cfg->dnscrypt_provider_cert = NULL;
 	cfg->dnscrypt_secret_key = NULL;
+	cfg->dnscrypt_shared_secret_cache_size = 4*1024*1024;
+	cfg->dnscrypt_shared_secret_cache_slabs = 4;
 #ifdef USE_IPSECMOD
 	cfg->ipsecmod_enabled = 1;
 	cfg->ipsecmod_ignore_bogus = 0;
@@ -290,6 +292,10 @@ config_create(void)
 	cfg->ipsecmod_whitelist = NULL;
 	cfg->ipsecmod_strict = 0;
 #endif
+#ifdef USE_CACHEDB
+	cfg->cachedb_backend = NULL;
+	cfg->cachedb_secret = NULL;
+#endif
 	return cfg;
 error_exit:
 	config_delete(cfg); 
@@ -561,6 +567,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("dnscrypt-provider:", dnscrypt_provider)
 	else S_STRLIST("dnscrypt-provider-cert:", dnscrypt_provider_cert)
 	else S_STRLIST("dnscrypt-secret-key:", dnscrypt_secret_key)
+	else S_MEMSIZE("dnscrypt-shared-secret-cache-size:",
+		dnscrypt_shared_secret_cache_size)
+	else S_POW2("dnscrypt-shared-secret-cache-slabs:",
+		dnscrypt_shared_secret_cache_slabs)
 #endif
 	else if(strcmp(opt, "ip-ratelimit:") == 0) {
 	    IS_NUMBER_OR_ZERO; cfg->ip_ratelimit = atoi(val);
@@ -922,6 +932,10 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_STR(opt, "dnscrypt-provider", dnscrypt_provider)
 	else O_LST(opt, "dnscrypt-provider-cert", dnscrypt_provider_cert)
 	else O_LST(opt, "dnscrypt-secret-key", dnscrypt_secret_key)
+	else O_MEM(opt, "dnscrypt-shared-secret-cache-size",
+		dnscrypt_shared_secret_cache_size)
+	else O_DEC(opt, "dnscrypt-shared-secret-cache-slabs",
+		dnscrypt_shared_secret_cache_slabs)
 #endif
 	else O_YNO(opt, "unblock-lan-zones", unblock_lan_zones)
 	else O_YNO(opt, "insecure-lan-zones", insecure_lan_zones)
@@ -958,6 +972,10 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_LST(opt, "ipsecmod-whitelist", ipsecmod_whitelist)
 	else O_YNO(opt, "ipsecmod-strict", ipsecmod_strict)
 #endif
+#ifdef USE_CACHEDB
+	else O_STR(opt, "backend", cachedb_backend)
+	else O_STR(opt, "secret-seed", cachedb_secret)
+#endif
 	/* not here:
 	 * outgoing-permit, outgoing-avoid - have list of ports
 	 * local-zone - zones and nodefault variables
@@ -1259,6 +1277,10 @@ config_delete(struct config_file* cfg)
 	free(cfg->ipsecmod_hook);
 	config_delstrlist(cfg->ipsecmod_whitelist);
 #endif
+#ifdef USE_CACHEDB
+	free(cfg->cachedb_backend);
+	free(cfg->cachedb_secret);
+#endif
 	free(cfg);
 }
 
diff --git a/util/config_file.h b/util/config_file.h
index bb7a292050b4..fdc48111e30a 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -464,6 +464,10 @@ struct config_file {
 	struct config_strlist* dnscrypt_secret_key;
 	/** dnscrypt provider certs 1.cert */
 	struct config_strlist* dnscrypt_provider_cert;
+	/** memory size in bytes for dnscrypt shared secrets cache */
+	size_t dnscrypt_shared_secret_cache_size;
+	/** number of slabs for dnscrypt shared secrets cache */
+	size_t dnscrypt_shared_secret_cache_slabs;
 
 	/** IPsec module */
 #ifdef USE_IPSECMOD
@@ -480,6 +484,14 @@ struct config_file {
 	/** false to proceed even when ipsecmod_hook fails */
 	int ipsecmod_strict;
 #endif
+
+	/* cachedb module */
+#ifdef USE_CACHEDB
+	/** backend DB name */
+	char* cachedb_backend;
+	/** secret seed for hash key calculation */
+	char* cachedb_secret;
+#endif
 };
 
 /** from cfg username, after daemonise setup performed */
diff --git a/util/configlexer.c b/util/configlexer.c
index ba4128c654ba..ee5428e8906c 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -363,8 +363,8 @@ static void yynoreturn yy_fatal_error (yyconst char* msg  );
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 229
-#define YY_END_OF_BUFFER 230
+#define YY_NUM_RULES 234
+#define YY_END_OF_BUFFER 235
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -372,254 +372,259 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static yyconst flex_int16_t yy_accept[2238] =
+static yyconst flex_int16_t yy_accept[2288] =
     {   0,
-        1,    1,  211,  211,  215,  215,  219,  219,  223,  223,
-        1,    1,  230,  227,    1,  209,  209,  228,    2,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  228,
-      211,  212,  212,  213,  228,  215,  216,  216,  217,  228,
-      222,  219,  220,  220,  221,  228,  223,  224,  224,  225,
-      228,  226,  210,    2,  214,  226,  228,  227,    0,    1,
-        2,    2,    2,    2,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      211,    0,  215,    0,  222,    0,  219,  223,    0,  226,
-        0,    2,    2,  226,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  226,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  226,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,   77,
-      227,  227,  227,  227,  227,  227,    8,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,   88,  226,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  226,  227,  227,  227,  227,  227,   37,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  170,  227,   14,   15,  227,   18,   17,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  156,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-        3,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  226,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  218,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-       40,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,   41,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  145,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,   20,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  103,  227,  218,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  197,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  120,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  102,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,   75,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-       25,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,   38,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   39,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  121,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,   28,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  185,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-       32,  227,   33,  227,  227,  227,   78,  227,   79,  227,
-      227,   76,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,    7,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  163,  227,  227,  227,  227,  105,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,   29,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  137,  227,  136,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   16,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,   42,  227,  227,  227,
-      227,  227,  227,  144,  227,  227,  227,  227,   81,   80,
-      227,  227,  227,  227,  227,  227,  227,  227,  131,  227,
-      227,  227,  227,  227,  227,  227,  227,   89,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,   60,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,   64,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,   36,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  134,  135,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,    6,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  195,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   26,  227,  227,  227,  227,
-      227,  227,  227,  227,  127,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  149,  227,  128,  227,  227,
-      161,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   27,  227,  227,  227,  227,
-       84,  227,   85,  227,   83,  227,  227,  227,  227,  227,
-      227,  227,  227,  100,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  184,  227,  227,  227,  227,
-      227,  227,  227,  227,  129,  227,  227,  227,  227,  227,
-
-      132,  227,  227,  160,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,   74,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,   34,  227,  227,   22,
-      227,  227,  227,  227,   19,  227,  110,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,   49,   51,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  199,  227,  227,  171,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,   86,  227,  227,  227,  227,  227,  227,  227,   99,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  205,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  104,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  155,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  119,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  115,  227,  122,  227,  227,  227,  227,  227,
-       92,  227,  227,   70,  227,  227,  227,  227,  147,  227,
-      227,  227,  227,  227,  162,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  176,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  118,
-      227,  227,  227,  227,  227,   52,   53,  227,  227,  227,
-      227,  227,   35,  227,  227,  227,  227,  227,   59,  123,
-      227,  138,  227,  164,  133,  227,  227,  227,   45,  227,
-      125,  227,  227,  227,  227,  227,    9,  227,  227,  227,
-       73,  227,  227,  227,  227,  189,  227,  146,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  106,  198,  227,  227,
-      175,  227,  227,  227,  227,  227,  227,  227,  227,  157,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  208,  227,  124,  227,  227,  227,   44,
-       46,  227,  227,  227,  227,  227,  227,  227,   72,  227,
-      227,  227,  227,  187,  227,  194,  227,  227,  227,  227,
-      227,  151,   23,   24,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,   69,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  153,
-
-      150,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,   43,  227,  227,  227,  227,  227,  227,  227,
-      227,  101,   13,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  203,  227,  206,  227,  227,  227,  227,  227,
-      227,   12,  227,  227,   21,  227,  227,  227,  193,  227,
-      196,   47,  227,  159,  227,  152,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  114,
-      113,  227,  227,  227,  227,  227,  227,  227,  154,  148,
-      227,  227,  200,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,   54,  227,  227,  227,  188,  227,  227,
-      227,  227,  227,  158,  227,  227,  227,  227,  227,  227,
-      227,  227,   48,  227,  227,  227,   82,  227,  107,  227,
-      109,  139,  227,  227,  227,  112,  227,  227,  165,  227,
-      227,  227,  227,  227,   94,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  172,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  140,  227,
-      227,  186,  227,  207,  227,  227,  227,   30,  227,  227,
-      227,  227,    4,  227,  227,   93,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  168,  227,  227,  227,
-
-      227,  227,  227,  201,  227,  227,  227,  227,  227,  174,
-      227,  227,  143,  227,  227,  227,  227,  227,  227,  227,
-      227,   57,  227,   31,  192,  227,  169,  227,  227,   11,
-      227,  227,  227,  227,  227,  227,  141,   61,  227,  227,
-      227,  227,  117,  227,  227,  227,  227,  227,   96,  227,
-      227,  227,  227,  227,  227,  227,  173,   90,  227,   87,
-      227,  227,  227,   63,   67,   62,  227,   55,  227,  227,
-      227,   10,  227,  227,  227,  190,  227,  227,  227,  116,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   68,   66,  227,   56,  204,
-
-      227,  227,  227,  130,  227,  227,  142,  227,  227,  227,
-      227,  227,  108,   50,  227,  227,  202,  227,  227,  227,
-      227,  227,  227,   91,   65,   97,   98,   58,  227,  191,
-      111,  227,  227,  227,  167,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  227,   71,  227,  166,  227,
-      183,  227,  227,  227,  227,  227,  227,    5,  227,  227,
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,   95,  227,  227,  227,  227,
-      227,  227,  126,  227,  227,  227,  227,  227,  227,  227,
-
-      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  179,  227,  227,  227,  227,  227,  227,  227,  227,
-      227,  227,  227,  227,  227,  177,  227,  180,  181,  227,
-      227,  227,  227,  227,  178,  182,    0
+        1,    1,  216,  216,  220,  220,  224,  224,  228,  228,
+        1,    1,  235,  232,    1,  214,  214,  233,    2,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      233,  216,  217,  217,  218,  233,  220,  221,  221,  222,
+      233,  227,  224,  225,  225,  226,  233,  228,  229,  229,
+      230,  233,  231,  215,    2,  219,  231,  233,  232,    0,
+        1,    2,    2,    2,    2,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  216,    0,  220,    0,  227,    0,  224,  228,
+        0,  231,    0,    2,    2,  231,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  231,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  231,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,   77,  232,  232,  232,
+      232,  232,  232,    8,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,   88,  231,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  231,  232,  232,  232,  232,  232,
+      232,  232,   37,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  170,  232,   14,   15,  232,
+       18,   17,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  156,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,    3,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      231,  232,  232,  232,  212,  232,  232,  211,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  223,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,   40,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,   41,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  145,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,   20,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  103,
+      232,  223,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  197,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  120,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  102,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,   75,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,   25,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,   38,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,   39,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  121,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,   28,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  185,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,   32,
+      232,   33,  232,  232,  232,   78,  232,   79,  232,  232,
+       76,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,    7,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  163,  232,  232,  232,  232,  105,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,   29,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  137,  232,  136,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,   16,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,   42,  232,  232,  232,
+      232,  232,  232,  232,  144,  232,  232,  232,  232,   81,
+       80,  232,  232,  232,  232,  232,  232,  232,  232,  131,
+
+      232,  232,  232,  232,  232,  232,  232,  232,   89,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,   60,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,   64,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,   36,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  134,  135,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,    6,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  195,  232,  232,
+      213,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,   26,  232,
+      232,  232,  232,  232,  232,  232,  232,  127,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  149,  232,
+      128,  232,  232,  161,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,   27,
+      232,  232,  232,  232,   84,  232,   85,  232,   83,  232,
+      232,  232,  232,  232,  232,  232,  232,  100,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  184,
+      232,  232,  232,  232,  232,  232,  232,  232,  129,  232,
+      232,  232,  232,  232,  132,  232,  232,  160,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,   74,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+       34,  232,  232,   22,  232,  232,  232,  232,   19,  232,
+      110,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,   49,   51,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  199,  232,
+
+      232,  232,  171,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,   86,  232,  232,  232,
+      232,  232,  232,  232,   99,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      207,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  104,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  155,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  119,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  115,  232,  122,
+
+      232,  232,  232,  232,  232,   92,  232,  232,   70,  232,
+      232,  232,  232,  147,  232,  232,  232,  232,  232,  162,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  176,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  118,  232,  232,  232,  232,
+      232,   52,   53,  232,  232,  232,  232,  232,   35,  232,
+      232,  232,  232,  232,   59,  123,  232,  138,  232,  164,
+      133,  232,  232,  232,   45,  232,  125,  232,  232,  232,
+      232,  232,    9,  232,  232,  232,   73,  232,  232,  232,
+      232,  189,  232,  146,  232,  232,  232,  232,  232,  232,
+
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  106,  198,  232,  232,  232,  175,  232,  232,
+      232,  232,  232,  232,  232,  232,  157,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      210,  232,  124,  232,  232,  232,   44,   46,  232,  232,
+      232,  232,  232,  232,  232,   72,  232,  232,  232,  232,
+      187,  232,  194,  232,  232,  232,  232,  232,  151,   23,
+
+       24,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+       69,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  153,  150,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+       43,  232,  232,  232,  232,  232,  232,  232,  232,  101,
+       13,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      205,  232,  208,  232,  232,  232,  232,  232,  232,   12,
+      232,  232,   21,  232,  232,  232,  193,  232,  196,   47,
+      232,  159,  232,  152,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  114,  113,  232,
+
+      232,  232,  232,  232,  232,  232,  154,  148,  232,  232,
+      200,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,   54,  232,  232,  232,  188,  232,  232,  232,
+      232,  232,  158,  232,  232,  232,  232,  232,  232,  232,
+      232,   48,  232,  232,  232,   82,  232,  107,  232,  109,
+      139,  232,  232,  232,  112,  232,  232,  165,  232,  232,
+      232,  232,  232,   94,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  172,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  140,  232,
+
+      232,  186,  232,  209,  232,  232,  232,   30,  232,  232,
+      232,  232,    4,  232,  232,   93,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  168,  232,  232,  232,
+      232,  232,  232,  201,  232,  232,  232,  232,  232,  232,
+      174,  232,  232,  143,  232,  232,  232,  232,  232,  232,
+      232,  232,   57,  232,   31,  192,  232,  169,  232,  232,
+       11,  232,  232,  232,  232,  232,  232,  141,   61,  232,
+      232,  232,  232,  117,  232,  232,  232,  232,  232,   96,
+      232,  232,  232,  232,  232,  232,  232,  232,  173,   90,
+      232,   87,  232,  232,  232,   63,   67,   62,  232,   55,
+
+      232,  232,  232,   10,  232,  232,  232,  190,  232,  232,
+      232,  116,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,   68,   66,
+      232,   56,  206,  232,  232,  232,  130,  232,  232,  142,
+      232,  232,  232,  232,  232,  108,   50,  232,  232,  202,
+      232,  232,  232,  232,  232,  232,  232,   91,   65,   97,
+       98,   58,  232,  191,  111,  232,  232,  232,  167,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,   71,  232,  166,  232,  183,  232,  232,  232,
+
+      232,  232,  232,  232,    5,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,   95,  232,  232,  232,  232,  232,
+      232,  232,  126,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  232,  232,
+      232,  232,  232,  232,  232,  232,  232,  232,  179,  232,
+      232,  232,  232,  232,  203,  232,  232,  232,  232,  232,
+      232,  204,  232,  232,  232,  177,  232,  180,  181,  232,
+      232,  232,  232,  232,  178,  182,    0
     } ;
 
 static yyconst YY_CHAR yy_ec[256] =
@@ -665,1226 +670,1259 @@ static yyconst YY_CHAR yy_meta[67] =
         1,    1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_uint16_t yy_base[2252] =
+static yyconst flex_uint16_t yy_base[2302] =
     {   0,
         0,    0,   64,   67,   70,   72,   78,   84,   89,   92,
-      131,  137,  420,  366,   96, 6399, 6399, 6399,  109,  111,
-      142,  180,   86,  133,  138,  172,   50,  151,   91,  181,
-      197,  124,  241,  187,  225,  289,  233,  228,  253,  307,
-      362, 6399, 6399, 6399,   95,  359, 6399, 6399, 6399,  102,
-      326,  355, 6399, 6399, 6399,  311,  245, 6399, 6399, 6399,
-      116,  221, 6399,  321, 6399,  265,  328,  212,  334,  160,
-        0,  338,    0,    0,  141,  206,  184,  330,  322,  255,
-      323,  335,  324,  222,  268,  350,  325,  334,  344,  357,
-      358,  352,  367,  364,  389,  385,  369,  393,  394,  214,
-
-      373,  402,  128,  400,  403,  419,  414,  399,  435,  420,
-      443,  422,  449,  431,  441,  178,  436,  453,  459,  416,
-      461,  463,  456,  469,  263,  487,  488,  480,  477,  497,
-      170,  284,  164,  241,  160,  514,  174,   85,  367,   77,
-      534,  541,    0,  514,  504,  518,  512,  513,  515,  523,
-      542,  526,  540,  556,  550,  551,  548,  560,  604,  561,
-      539,  559,  565,  571,  568,  588,  582,  585,  590,  583,
-      606,  609,  636,  617,  599,  623,  576,  633,  652,  621,
-      644,  638,  635,  650,  648,  662,  660,  657,  666,  668,
-      684,  651,  683,  679,  669,  687,  682,  685,  699,  703,
-
-      686,  721,  709,  725,  713,  720,  716,  726,  718,  712,
-      740,  743,  747,  744,  735,  745,  750,  748,  749,  754,
-      770,  751,  765,  762,  768,  783,  773,  784,  792,  800,
-      804,  781,  802,  811,  789,  807,  810,  816,  806,  809,
-      821,  828,  823,  836,  849,  825,  838,  832,  833,  857,
-      851,  843,  860,  848,  868,  859,  871,  855,  862,  876,
-      878,  891,  883,  894,  886,  895,  926,  676,  913,  903,
-      910,  905,  922,  912,  939,  932,  930,  941,  936,  934,
-      947,  956,  949,  970,  959,  973,  974,  953,  966,  981,
-      975,  983,  986,  996, 1003, 1005, 1017, 1008, 1062, 1006,
-
-     1015, 1055, 1004, 1010, 1012, 1033, 1043, 1034, 1039, 1048,
-     1052, 1066, 1058, 1045, 1063, 1075, 1082, 1093, 1072, 1090,
-     1102, 1113, 1095, 1100, 1103, 1104, 1123, 1117, 1122, 1110,
-     1124, 1147, 1127, 1130, 1154, 1150, 1137, 1139, 1155, 1166,
-     1168, 1151, 1174, 1163, 1179, 1178, 1188, 1152, 1195, 1183,
-     1187, 1198, 1196, 1197, 1213, 1211, 1215, 1200, 1227, 6399,
-     1229, 1216, 1224, 1236, 1226, 1238, 6399, 1240, 1241, 1235,
-     1257, 1262, 1264, 1252, 1267, 1279, 1277, 1283, 1256, 1276,
-     1268, 1265, 1278, 1284, 1295, 1296, 1297, 1343, 1294, 1306,
-     1302, 1341, 1327, 1311, 1333, 1315, 1336, 1305, 1338, 1357,
-
-     1329, 1352, 1361, 1371, 1363, 1368, 1375, 6399, 1387, 1358,
-     1385, 1376, 1379, 1396, 1400, 1360, 1393, 1416, 1401, 1412,
-     1402, 1420, 1419, 1414, 1410, 1450, 1421, 1435, 1436, 1443,
-     1451, 1454, 1460, 1437, 1461, 1440, 1448, 1464, 1470, 1465,
-     1453, 1467, 1462, 1478, 1474, 1476, 1499, 1486, 1509, 1494,
-     1495, 1503, 1501, 1505, 1489, 1514, 1516, 1529, 1513, 1539,
-     1532, 1536, 1546, 1543, 1537, 1542, 1530, 1556, 1558, 1564,
-     1560, 1550, 1570, 1563, 1569, 1577, 1583, 1588, 1603, 1587,
-     1589, 1604, 1590, 1596, 1615, 1595, 1614, 1626, 1611, 1610,
-     1622, 1621, 1623, 1629, 1636, 1638, 1639, 1651, 1634, 1649,
-
-     1650, 1652, 1658, 1663, 1653, 1656, 1686, 1665, 1677, 1684,
-     1678, 1674, 1690, 1699, 1692, 1700, 1704, 1705, 1711, 1701,
-     1713, 1698, 1714, 1737, 1740, 1741, 1725, 1750, 1735, 6399,
-     1728, 1753, 1734, 1756, 1763, 1739, 1758, 1768, 1761, 1764,
-     1772, 1815, 6399, 1767, 6399, 6399, 1781, 6399, 6399, 1787,
-     1795, 1808, 1803, 1816, 1770, 1864, 1806, 1805, 1818, 1788,
-     1843, 1821, 1822, 1851, 1835, 1857, 1854, 1869, 1862, 1873,
-     1878, 1861, 1870, 1884, 1887, 1900, 1911, 1898, 1901, 1842,
-     1907, 1916, 1918, 1917, 1925, 1928, 1923, 1924, 1929, 1933,
-     1936, 1942, 1951, 1940, 1961, 1953, 1957, 1971, 1956, 6399,
-
-     1963, 1964, 1967, 1974, 1968, 1976, 1978, 1987, 1983, 2005,
-     6399, 2009, 2012, 1992, 2010, 1997, 2001, 1995, 2006, 2020,
-     2023, 2028, 2022, 2042, 2040, 2043, 2053, 2031, 2044, 2047,
-     2035, 2065, 2062, 2056, 2070, 2067, 2060, 2076, 2068, 2093,
-     2080, 2087, 2106, 2085, 2110, 2095, 2111, 2101, 2114, 2102,
-     2107, 2112, 2115, 2103, 2160, 2145, 2143, 2137, 2130, 2157,
-     2141, 2162, 2164, 2159, 2166, 2173, 2170, 2194, 2190, 2187,
-     2189, 2188, 2200, 2216, 2213,   75, 2243, 2207, 2215, 2204,
-     2211, 2229, 2227, 2231, 2234, 2233, 2236, 2241, 2260, 6399,
-     2240, 2250, 2246, 2259, 2279, 2276, 2266, 2274, 2275, 2278,
-
-     2293, 2286, 2271, 2292, 2280, 2301, 2289, 2305, 2316, 2323,
-     6399, 2312, 2310, 2313, 2318, 2330, 2339, 2341, 2338, 2348,
-     2328, 2321, 6399, 2343, 2369, 2350, 2360, 2353, 2352, 2368,
-     2387, 2364, 2382, 2371, 2388, 2373, 2396, 2397, 2391, 6399,
-     2398, 2390, 2399, 2407, 2412, 2395, 2424, 2417, 2418, 2416,
-     2425, 2446, 2442, 2444, 6399, 2432, 2452, 2445, 2441, 2451,
-     2462, 2443, 2461, 2460, 2448, 2470, 2469,  291, 2468, 2482,
-     2471, 2474, 6399, 2473,   68, 2488, 2489, 2483, 2510, 2511,
-     2507, 2518, 2509, 2508, 2513, 2516, 2517, 2506, 2535, 2531,
-     2534, 2523, 2537, 2538, 2549, 2540, 2552, 6399, 2562, 2561,
-
-     2565, 2567, 2574, 2573, 2576, 2570, 2586, 2601, 2588, 6399,
-     2596, 2610, 2600, 2602, 2592, 2615, 2613, 2604, 2626, 2625,
-     2621, 2629, 2634, 2631, 2640, 2641, 6399, 2627, 2655, 2656,
-     2643, 2654, 2653, 2679, 2666, 2657, 2662, 2687, 2711, 2681,
-     2686, 2702, 2698, 2696, 2691, 2704, 2705, 2732, 2715, 2731,
-     2712, 2727, 2737, 2750, 2753, 2744, 2748, 2774, 2768,  153,
-     2759, 6399, 2762, 2757, 2760, 2764, 2803, 2793, 2795, 2787,
-     2800, 2797, 2798, 2809, 2805, 2801, 2824, 2813, 2822, 2816,
-     6399, 2838, 2839, 2827, 2842, 2828, 2847, 2852, 2840, 2858,
-     2843, 2854, 2864, 2855, 2875, 2862, 2871, 2885, 2870, 6399,
-
-     2758, 2867, 2873, 2898, 2886, 2882, 2897, 2896, 2891, 2894,
-     2893, 2920, 2912, 2907, 2917, 2919, 2913, 2935, 2910, 2923,
-     2924, 2940, 2949, 2938, 2947, 6399, 2951, 2971, 2946, 2956,
-     2954, 2962, 2979, 2983, 2972, 2992, 2989, 2990, 2975, 2982,
-     2978, 2995, 2997, 2998, 6399, 2999, 3011, 3012, 3020, 3019,
-     3021, 3022, 3024, 3035, 3007, 3039, 3034, 3041, 3053, 3042,
-     3049, 3051, 3060, 3058, 3078, 3073, 3082, 6399, 3075, 3084,
-     3077, 3071, 3076, 3079, 3100, 3092, 3098, 3087, 3103, 3109,
-     3105, 3131, 3133, 3117, 3119, 3120, 3121, 3102, 3115, 3130,
-     3146, 3148, 3134, 3135, 3136, 3150, 3145, 3157, 3156, 3173,
-
-     3167, 3175, 3185, 3183, 3186, 3176, 3182, 3179, 3202, 6399,
-     3200, 3195, 3199, 3218, 3203, 3205, 3206, 3216, 3233, 3237,
-     6399, 3222, 6399, 3234, 3241, 3246, 6399, 3244, 6399, 3253,
-     3238, 6399, 3252, 3256, 3243, 3247, 3248, 3271, 3263, 3259,
-     3273, 3267, 3290, 3266, 3281, 3293, 3282, 3302, 6399, 3295,
-     3294, 3296, 3305, 3308, 3311, 3316, 3317, 3320, 3321, 3328,
-     3322, 3347, 3339, 3350, 6399, 3337, 3346, 3342, 3354, 6399,
-     3338, 3355, 3366, 3352, 3357, 3368, 3363, 3365, 3397, 3381,
-     3386, 3387, 3399, 3380, 3398, 3411, 3408, 3392, 3402, 3413,
-     3416, 3412, 3425, 3418, 3429, 3422, 3442, 3428, 3430, 3431,
-
-     3439, 3440, 3452, 3449, 3468, 3445, 3455, 3456, 3463, 6399,
-     3459, 3467, 3466, 3495, 3473, 3485, 3477, 3489, 3494, 3490,
-     3502, 3515, 3492, 6399, 3498, 6399, 3506, 3510, 3520, 3535,
-     3522, 3534, 3528, 3537, 3529, 3551, 3543, 3555, 3553, 3547,
-     3556, 3554, 3562, 3561, 3573, 6399, 3532, 3568, 3590, 3581,
-     3583, 3588, 3601, 3613, 3587, 3606, 6399, 3603, 3608, 3612,
-     3604, 3628, 3615, 6399, 3607, 3642, 3631, 3638, 6399, 6399,
-     3632, 3637, 3633, 3639, 3643, 3655, 3640, 3658, 6399, 3611,
-     3659, 3671, 3672, 3682, 3683, 3654, 3668, 6399, 3665, 3693,
-     3686, 3689, 3685, 3699, 3698, 3674, 3710, 3707, 3704, 3702,
-
-     3728, 3727, 3732, 6399, 3731, 3724, 3739, 3729, 3738, 3723,
-     3720, 3734, 3748, 3755, 3750, 3756, 3767, 3765, 3758, 3761,
-     3773, 3786, 3763, 3777, 3775, 3793, 3788, 3797, 3785, 3807,
-     3805, 3791, 3813, 6399, 3815, 3799, 3824, 3800, 3818, 3828,
-     3829, 3834, 3846, 3819, 3827, 3836, 3842, 6399, 3872, 3823,
-     3851, 3857, 3855, 3854, 3866, 3856, 3850, 3879, 3864, 3887,
-     3874, 3878, 3895, 3904, 6399, 6399, 3898, 3889, 3908, 3897,
-     3902, 3911, 3892, 3925, 3906, 3914, 6399, 3923, 3916, 3922,
-     3933, 3949, 3951, 3948, 3953, 3945, 3936, 3943, 3952, 3963,
-     3947, 3960, 3967, 3946, 3978, 6399, 3977, 3984, 3981, 3993,
-
-     3995, 3994, 4002, 4020, 4006, 3989, 4005, 3987, 4017, 4015,
-     4040, 4022, 4012, 4029, 4023, 6399, 4033, 4039, 4042, 4026,
-     4053, 4030, 4060, 4047, 6399, 4058, 4063, 4062, 4071, 4055,
-     4078, 4070, 4072, 4086, 4074, 6399, 4079, 6399, 4090, 4082,
-     6399, 4088, 4095, 4096, 4099, 4109, 4112, 4098, 4115, 4110,
-     4111, 4125, 4126, 4121, 4119, 6399, 4142, 4122, 4123, 4135,
-     6399, 4147, 6399, 4145, 6399, 4148, 4150, 4170, 4149, 4167,
-     4171, 4178, 4172, 6399, 4175, 4159, 4183, 4176, 4187, 4177,
-     4201, 4203, 4191, 4204, 4214, 6399, 4202, 4209, 4196, 4207,
-     4212, 4223, 4238, 4231, 6399, 4240, 4235, 4236, 4250, 4249,
-
-     6399, 4248, 4259, 6399, 4252, 4268, 4247, 4264, 4278, 4282,
-     4284, 4267, 4270, 4197, 4293, 4279, 4291, 6399, 4283, 4294,
-     4301, 4303, 4300, 4312, 4276, 4317, 4311, 4321, 4323, 4335,
-     4325, 4339, 4326, 4343, 4345, 4344, 6399, 4350, 4352, 6399,
-     4360, 4338, 4349, 4353, 6399, 4372, 6399, 4380, 4374, 4363,
-     4366, 4392, 4394, 4395, 4379, 4393, 4399, 4396, 4417, 4400,
-     4412, 6399, 6399, 4410, 4427, 4402, 4414, 4433, 4431, 4422,
-     4438, 4441, 4445, 4447, 6399, 4444, 4430, 6399, 4437, 4451,
-     4458, 4461, 4477, 4466, 4470, 4463, 4483, 4479, 4490, 4465,
-     4480, 6399, 4493, 4473, 4474, 4497, 4506, 4503, 4507, 6399,
-
-     4504, 4502, 4529, 4522, 4523, 4525, 4539, 4536, 4541, 4530,
-     4531, 4546, 4566, 4553, 4555, 6399, 4556, 4549, 4550, 4567,
-     4581, 4584, 4571, 4585, 4568, 4589, 4591, 4587, 4573, 6399,
-     4594, 4603, 4588, 4604, 4602, 4616, 4606, 4623, 4610, 4608,
-     4617, 4619, 4625, 6399, 4621, 4630, 4640, 4652, 4642, 4643,
-     4645, 4644, 4651, 4634, 4672, 4654, 4674, 6399, 4665, 4670,
-     4659, 4680, 4667, 4690, 4691, 4683, 4697, 4699, 4700, 4702,
-     4710, 4715, 6399, 4694, 6399, 4703, 4727, 4718, 4731, 4729,
-     6399, 4723, 4725, 6399, 4735, 4737, 4733, 4745, 6399, 4741,
-     4758, 4746, 4765, 4769, 6399, 4770, 4774, 4786, 4782, 4773,
-
-     4788, 4771, 4780, 4772, 4801, 6399, 4799, 4792, 4805, 4806,
-     4797, 4800, 4798, 4804, 4814, 4818, 4841, 4831, 4822, 6399,
-     4826, 4838, 4851, 4844, 4846, 6399, 6399, 4845, 4853, 4857,
-     4829, 4861, 6399, 4870, 4856, 4864, 4863, 4868, 6399, 6399,
-     4866, 6399, 4867, 6399, 6399, 4887, 4891, 4898, 6399, 4899,
-     6399, 4905, 4901, 4890, 4886, 4904, 6399, 4888, 4910, 4911,
-     6399, 4912, 4915, 4923, 4925, 6399, 4916, 6399, 4919, 4924,
-     4939, 4928, 4931, 4942, 4948, 4927, 4959, 4960, 4949, 4946,
-     4962, 4958, 4965, 4967, 4966, 4976, 4975, 4979, 4973, 4972,
-     4987, 4983, 4988, 4997, 5015, 5004, 4999, 5005, 5006, 5018,
-
-     5014, 5025, 5031, 5019, 5020, 5034, 6399, 6399, 5032, 5026,
-     6399, 5040, 5047, 5044, 5048, 5042, 5052, 5055, 5069, 6399,
-     5049, 5071, 5063, 5076, 5074, 5067, 5084, 5088, 5086, 5091,
-     5106, 5093, 5096, 5094, 5098, 5119, 5107, 5108, 5121, 5120,
-     5130, 5135, 5138, 6399, 5123, 6399, 5131, 5125, 5141, 6399,
-     6399, 5136, 5158, 5139, 5144, 5152, 5173, 5171, 6399, 5162,
-     5172, 5174, 5165, 6399, 5180, 6399, 5181, 5163, 5184, 5186,
-     5193, 6399, 6399, 6399, 5194, 5188, 5199, 5187, 5201, 5202,
-     5214, 5198, 5222, 6399, 5209, 5226, 5227, 5220, 5234, 5238,
-     5233, 5237, 5250, 5243, 5251, 5241, 5258, 5255, 5266, 6399,
-
-     6399, 5259, 5276, 5268, 5279, 5277, 5275, 5278, 5269, 5283,
-     5289, 5285, 6399, 5295, 5296, 5299, 5300, 5306, 5310, 5308,
-     5311, 6399, 6399, 5312, 5314, 5324, 5329, 5326, 5321, 5335,
-     5332, 5333, 6399, 5339, 6399, 5344, 5351, 5368, 5349, 5357,
-     5362, 6399, 5360, 5361, 6399, 5371, 5359, 5370, 6399, 5379,
-     6399, 6399, 5383, 6399, 5384, 6399, 5388, 5389, 5393, 5396,
-     5403, 5412, 5405, 5409, 5400, 5407, 5419, 5422, 5420, 6399,
-     6399, 5433, 5402, 5431, 5443, 5416, 5438, 5444, 6399, 6399,
-     5445, 5451, 6399, 5428, 5439, 5458, 5449, 5455, 5447, 5459,
-     5460, 5465, 5470, 5490, 5492, 5494, 5480, 5498, 5481, 5478,
-
-     5500, 5506, 5512, 6399, 5510, 5508, 5497, 6399, 5513, 5507,
-     5529, 5538, 5535, 6399, 5527, 5546, 5547, 5539, 5534, 5552,
-     5537, 5554, 6399, 5555, 5558, 5556, 6399, 5559, 6399, 5575,
-     6399, 6399, 5564, 5579, 5583, 6399, 5588, 5596, 6399, 5589,
-     5590, 5578, 5582, 5603, 6399, 5609, 5607, 5613, 5610, 5616,
-     5611, 5623, 5617, 5622, 6399, 5614, 5630, 5632, 5634, 5648,
-     5637, 5635, 5636, 5657, 5649, 5640, 5653, 5658, 6399, 5668,
-     5670, 6399, 5662, 6399, 5671, 5672, 5681, 6399, 5687, 5674,
-     5673, 5684, 6399, 5689, 5691, 6399, 5680, 5706, 5709, 5710,
-     5693, 5713, 5704, 5722, 5723, 5727, 6399, 5729, 5715, 5732,
-
-     5734, 5740, 5720, 6399, 5739, 5745, 5750, 5756, 5748, 6399,
-     5757, 5759, 6399, 5758, 5755, 5749, 5775, 5769, 5779, 5781,
-     5783, 6399, 5789, 6399, 6399, 5776, 6399, 5770, 5793, 6399,
-     5798, 5785, 5784, 5800, 5813, 5812, 6399, 6399, 5810, 5806,
-     5818, 5823, 6399, 5815, 5826, 5825, 5820, 5837, 6399, 5821,
-     5834, 5831, 5844, 5848, 5842, 5862, 6399, 6399, 5852, 6399,
-     5868, 5874, 5873, 6399, 6399, 6399, 5878, 6399, 5880, 5884,
-     5881, 6399, 5886, 5870, 5882, 6399, 5891, 5895, 5883, 6399,
-     5899, 5894, 5905, 5914, 5916, 5904, 5915, 5924, 5909, 5912,
-     5928, 5930, 5932, 5921, 5938, 6399, 6399, 5945, 6399, 6399,
-
-     5950, 5952, 5953, 6399, 5947, 5958, 6399, 5960, 5951, 5965,
-     5954, 5968, 6399, 6399, 5955, 5967, 6399, 5976, 5961, 5979,
-     5972, 5971, 5985, 6399, 6399, 6399, 6399, 6399, 5983, 6399,
-     6399, 6000, 5987, 5994, 6399, 5982, 6006, 6002, 6003, 6018,
-     6010, 5998, 6024, 6020, 6019, 6029, 6041, 6042, 6048, 6047,
-     6049, 6030, 6044, 6063, 6046, 6061, 6399, 6057, 6399, 6062,
-     6399, 6058, 6067, 6069, 6064, 6070, 6073, 6399, 6079, 6091,
-     6082, 6085, 6089, 6084, 6108, 6109, 6096, 6117, 6120, 6119,
-     6122, 6126, 6118, 6138, 6132, 6399, 6136, 6133, 6142, 6139,
-     6148, 6144, 6399, 6145, 6149, 6154, 6165, 6155, 6169, 6166,
-
-     6179, 6186, 6184, 6183, 6172, 6197, 6195, 6196, 6200, 6193,
-     6207, 6399, 6204, 6210, 6213, 6214, 6220, 6216, 6225, 6227,
-     6238, 6242, 6239, 6245, 6243, 6399, 6246, 6399, 6399, 6252,
-     6237, 6248, 6258, 6261, 6399, 6399, 6399, 6307, 6314, 6321,
-     6328, 6335,  100, 6342, 6349, 6356, 6363, 6370, 6377, 6384,
-     6391
+      131,  137,  360,  306,   96, 6594, 6594, 6594,  109,  111,
+       85,  142,  180,  129,  134,  138,  183,   50,  166,   75,
+      214,  204,  124,  256,  141,  248,  304,  200,  221,  250,
+      305,  299, 6594, 6594, 6594,   96,  283, 6594, 6594, 6594,
+      102,  276,  265, 6594, 6594, 6594,  322,  216, 6594, 6594,
+     6594,  115,  212, 6594,  326, 6594,  161,  336,  186,  343,
+      115,    0,  363,    0,    0,  107,  207,  159,  217,  342,
+      219,  264,  243,  332,  322,  280,  260,  347,  334,  346,
+      351,  277,  352,  372,  359,  367,  392,  361,  377,  401,
+
+      402,  386,  400,  413,  408,  245,  423,  407,  404,  425,
+      441,  428,  449,  436,  447,  439,  452,  462,  442,  464,
+      474,  294,  468,  489,  466,  481,  475,  498,  501,  491,
+      495,  507,  181,  277,  177,  427,  173,  552,  207,  151,
+      391,  117,  558,  562,    0,  528,  530,  389,  544,  488,
+      534,  541,  548,  540,  546,  555,  575,  569,  577,  570,
+      580,  624,  584,  579,  587,  589,  572,  604,  610,  599,
+      605,  631,  591,  625,  629,  648,  657,  647,  637,  655,
+      658,  682,  674,  669,  670,  684,  685,  692,  697,  676,
+      686,  694,  687,  696,  698,  708,  709,  701,  715,  721,
+
+      711,  727,  723,  735,  718,  749,  733,  758,  736,  744,
+      748,  766,  750,  753,  771,  779,  775,  782,  763,  776,
+      762,  783,  792,  789,  790,  805,  799,  793,  809,  798,
+      796,  808,  826,  828,  836,  590,  820,  839,  841,  832,
+      831,  847,  845,  834,  856,  857,  867,  851,  875,  886,
+      862,  869,  864,  877,  891,  894,  881,  884,  883,  902,
+      898,  917,  910,  900,  928,  911,  936,  924,  938,  921,
+      930,  937,  905,  943,  957,  960,  962,  967,  935,  973,
+      981,  964,  980,  983,  970,  984,  993,  994,  991,  997,
+     1008, 1020, 1024, 1001, 1017, 1007, 1035, 1032, 1040, 1019,
+
+     1030, 1041, 1066, 1056, 1111, 1059, 1062, 1078, 1054, 1057,
+     1064, 1072, 1063, 1105, 1084, 1088, 1090, 1101, 1115, 1106,
+     1129, 1102, 1119, 1137, 1144, 1134, 1139, 1140, 1164, 1148,
+     1149, 1153, 1146, 1172, 1166, 1175, 1163, 1171, 1191, 1180,
+     1178, 1199, 1195, 1182, 1193, 1209, 1219, 1212, 1205, 1227,
+     1216, 1230, 1220, 1236, 1224, 1241, 1232, 1243, 1240, 1246,
+     1254, 1257, 1264, 1269, 1250, 1277, 6594, 1281, 1262, 1279,
+     1285, 1270, 1288, 6594, 1293, 1275, 1289, 1291, 1298, 1314,
+     1309, 1316, 1304, 1306, 1325, 1340, 1315, 1327, 1317, 1336,
+     1333, 1334, 1342, 1346, 1351, 1397, 1345, 1356, 1352, 1382,
+
+     1377, 1361, 1390, 1369, 1392, 1384, 1388, 1395, 1409, 1407,
+     1426, 1424, 1419, 1420, 1436, 6594, 1437, 1417, 1427, 1430,
+     1445, 1446, 1450, 1453, 1467, 1475, 1462, 1476, 1466, 1479,
+     1468, 1480, 1481, 1471, 1488, 1496, 1486, 1492, 1497, 1505,
+     1516, 1518, 1525, 1500, 1517, 1509, 1526, 1529, 1530, 1531,
+     1519, 1536, 1520, 1543, 1545, 1551, 1563, 1524, 1553, 1555,
+     1569, 1578, 1562, 1564, 1589, 1577, 1582, 1591, 1592, 1594,
+     1598, 1602, 1603, 1611, 1607, 1616, 1612, 1621, 1629, 1630,
+     1626, 1618, 1635, 1642, 1641, 1645, 1648, 1647, 1666, 1654,
+     1657, 1669, 1658, 1656, 1668, 1685, 1675, 1683, 1705, 1681,
+
+     1664, 1697, 1684, 1704, 1700, 1701, 1698, 1702, 1716, 1712,
+     1708, 1724, 1733, 1726, 1739, 1735, 1736, 1737, 1753, 1729,
+     1756, 1743, 1758, 1760, 1764, 1767, 1768, 1769, 1784, 1779,
+     1783, 1794, 1778, 1798, 1788, 1805, 1809, 1791, 1814, 1822,
+     1826, 1818, 6594, 1810, 1833, 1824, 1834, 1830, 1825, 1851,
+     1839, 1837, 1848, 1852, 1896, 6594, 1853, 6594, 6594, 1850,
+     6594, 6594, 1854, 1856, 1880, 1858, 1875, 1892, 1945, 1893,
+     1883, 1879, 1887, 1906, 1913, 1910, 1926, 1914, 1933, 1911,
+     1948, 1950, 1956, 1953, 1940, 1962, 1961, 1968, 1986, 1969,
+     1983, 1985, 1903, 1988, 1996, 2002, 2004, 1976, 2010, 2003,
+
+     2005, 2008, 2012, 2022, 2014, 2017, 2015, 2018, 2039, 2042,
+     2027, 2033, 6594, 2044, 2046, 2054, 2051, 2045, 2061, 2043,
+     2049, 2065, 2063, 2088, 6594, 2092, 2093, 2075, 2095, 2076,
+     2078, 2082, 2086, 2101, 2103, 2090, 2113, 2102, 2124, 2125,
+     2135, 2116, 2122, 2130, 2150, 2151, 2143, 2129, 2152, 2149,
+     2134, 2157, 2165, 2170, 2162, 2174, 2188, 2166, 2167, 2177,
+     2190, 2181, 2194, 2183, 6594, 2179, 2191, 6594, 2189, 2199,
+     2245, 2210, 2208, 2204, 2215, 2224, 2218, 2236, 2230, 2258,
+     2235, 2255, 2237, 2265, 2264, 2260, 2257, 2275, 2267, 2295,
+     2298,  156, 2325, 2291, 2305, 2294, 2297, 2311, 2314, 2307,
+
+     2313, 2301, 2329, 2323, 2339, 6594, 2318, 2346, 2336, 2352,
+     2334, 2354, 2345, 2353, 2358, 2341, 2374, 2368, 2369, 2378,
+     2370, 2373, 2379, 2384, 2389, 2407, 6594, 2394, 2400, 2385,
+     2409, 2413, 2417, 2423, 2420, 2430, 2412, 2425, 6594, 2416,
+     2442, 2459, 2445, 2427, 2444, 2446, 2458, 2447, 2473, 2456,
+     2457, 2465, 2466, 2474, 2475, 2469, 6594, 2472, 2494, 2489,
+     2498, 2502, 2496, 2509, 2497, 2499, 2493, 2504, 2524, 2522,
+     2523, 6594, 2516, 2529, 2519, 2521, 2540, 2552, 2538, 2557,
+     2558, 2544, 2550, 2554,  121, 2551, 2559, 2555, 2545, 6594,
+     2556,   68, 2573, 2561, 2572, 2578, 2599, 2593, 2602, 2601,
+
+     2594, 2595, 2605, 2596, 2588, 2617, 2603, 2620, 2613, 2627,
+     2625, 2636, 2626, 2645, 6594, 2647, 2644, 2651, 2653, 2652,
+     2638, 2672, 2657, 2668, 2685, 2673, 6594, 2659, 2689, 2688,
+     2683, 2677, 2686, 2695, 2691, 2707, 2684, 2709, 2715, 2716,
+     2713, 2717, 2729, 6594, 2712, 2732, 2739, 2725, 2730, 2743,
+     2768, 2742, 2753, 2758, 2748, 2794, 2764, 2769, 2714, 2782,
+     2774, 2784, 2787, 2795, 2788, 2798, 2814, 2819, 2821, 2763,
+     2833, 2836, 2827, 2834, 2857, 2841,  164, 2826, 6594, 2843,
+     2840, 2831, 2863, 2883, 2865, 2876, 2861, 2878, 2867, 2882,
+     2897, 2892, 2898, 2870, 2891, 2812, 2900, 2917, 6594, 2918,
+
+     2924, 2907, 2920, 2910, 2931, 2927, 2912, 2935, 2941, 2944,
+     2928, 2945, 2939, 2946, 2959, 2962, 2957, 6594, 2862, 2951,
+     2947, 2980, 2972, 2963, 2974, 2983, 2967, 2973, 2975, 3000,
+     2991, 2986, 2992, 2989, 2997, 3016, 3001, 3009, 3008, 3018,
+     3022, 3014, 3024, 6594, 3020, 3057, 3031, 3038, 3041, 3044,
+     3064, 3052, 3049, 3065, 3066, 3067, 3056, 3061, 3077, 3080,
+     3082, 3081, 6594, 3094, 3088, 3084, 3104, 3096, 3102, 3105,
+     3099, 3108, 3112, 3129, 3123, 3115, 3135, 3133, 3132, 3128,
+     3147, 3158, 3159, 3156, 3163, 6594, 3166, 3165, 3161, 3153,
+     3167, 3162, 3175, 3172, 3183, 3179, 3190, 3191, 3188, 3216,
+
+     3224, 3193, 3202, 3204, 3206, 3217, 3200, 3209, 3229, 3242,
+     3219, 3220, 3222, 3240, 3231, 3233, 3246, 3256, 3260, 3252,
+     3270, 3266, 3272, 3262, 3265, 3267, 3294, 6594, 3258, 3279,
+     3277, 3303, 3305, 3306, 3291, 3297, 3292, 3287, 3316, 6594,
+     3299, 6594, 3320, 3327, 3334, 6594, 3331, 6594, 3341, 3329,
+     6594, 3343, 3347, 3335, 3324, 3339, 3352, 3344, 3360, 3361,
+     3358, 3362, 3342, 3356, 3377, 3374, 3390, 6594, 3382, 3379,
+     3384, 3399, 3391, 3383, 3387, 3404, 3410, 3392, 3414, 3423,
+     3426, 3409, 3437, 6594, 3419, 3435, 3425, 3432, 6594, 3421,
+     3446, 3448, 3436, 3442, 3455, 3450, 3456, 3459, 3484, 3466,
+
+     3462, 3461, 3486, 3471, 3477, 3497, 3498, 3482, 3489, 3483,
+     3506, 3507, 3510, 3492, 3516, 3520, 3517, 3513, 3518, 3526,
+     3514, 3536, 3539, 3541, 3537, 3532, 3540, 3542, 3549, 6594,
+     3557, 3555, 3566, 3561, 3559, 3558, 3567, 3577, 3581, 3565,
+     3589, 3594, 3584, 6594, 3599, 6594, 3585, 3605, 3609, 3612,
+     3601, 3608, 3618, 3616, 3629, 3641, 3622, 3643, 3624, 3635,
+     3644, 3636, 3645, 3649, 3652, 6594, 3642, 3656, 3672, 3662,
+     3676, 3661, 3689, 3686, 3669, 3702, 6594, 3711, 3691, 3707,
+     3713, 3705, 3716, 3714, 6594, 3699, 3726, 3715, 3721, 6594,
+     6594, 3708, 3725, 3731, 3732, 3737, 3754, 3745, 3747, 6594,
+
+     3739, 3742, 3759, 3768, 3770, 3771, 3758, 3755, 6594, 3764,
+     3780, 3782, 3777, 3781, 3787, 3791, 3792, 3806, 3801, 3797,
+     3811, 3816, 3818, 3822, 6594, 3820, 3823, 3827, 3819, 3828,
+     3809, 3838, 3835, 3843, 3836, 3842, 3852, 3856, 3862, 3863,
+     3846, 3859, 3875, 3881, 3876, 3865, 3880, 3877, 3886, 3882,
+     3889, 3895, 3892, 3919, 3902, 6594, 3920, 3899, 3923, 3903,
+     3918, 3925, 3930, 3939, 3948, 3916, 3922, 3943, 3944, 6594,
+     3956, 3927, 3951, 3954, 3957, 3978, 3950, 3970, 3955, 3974,
+     3969, 3984, 3973, 3980, 3997, 3979, 6594, 6594, 3999, 3983,
+     4009, 4000, 4006, 4005, 3992, 4020, 4011, 4007, 6594, 4025,
+
+     4033, 4019, 4036, 4049, 4054, 4051, 4048, 4046, 4038, 4040,
+     4044, 4065, 4061, 4063, 4071, 4069, 4073, 6594, 4075, 4076,
+     6594, 4078, 4083, 4095, 4098, 4108, 4115, 4109, 4092, 4103,
+     4112, 4120, 4123, 4138, 4134, 4119, 4125, 4146, 6594, 4136,
+     4139, 4142, 4124, 4160, 4135, 4161, 4155, 6594, 4165, 4170,
+     4174, 4177, 4158, 4184, 4180, 4185, 4183, 4182, 6594, 4188,
+     6594, 4196, 4194, 6594, 4202, 4207, 4200, 4213, 4198, 4223,
+     4208, 4204, 4227, 4220, 4218, 4235, 4243, 4247, 4230, 6594,
+     4255, 4234, 4249, 4250, 6594, 4253, 6594, 4257, 6594, 4245,
+     4254, 4274, 4261, 4288, 4290, 4291, 4285, 6594, 4295, 4276,
+
+     4297, 4299, 4283, 4294, 4301, 4315, 4310, 4317, 4324, 6594,
+     4287, 4326, 4339, 4323, 4325, 4344, 4350, 4329, 6594, 4353,
+     4346, 4342, 4356, 4357, 6594, 4369, 4365, 6594, 4372, 4362,
+     4371, 4374, 4388, 4376, 4395, 4375, 4384, 4412, 4405, 4396,
+     4406, 6594, 4399, 4402, 4419, 4420, 4413, 4415, 4417, 4425,
+     4432, 4426, 4448, 4450, 4454, 4456, 4443, 4460, 4459, 4455,
+     6594, 4469, 4475, 6594, 4471, 4452, 4470, 4473, 6594, 4486,
+     6594, 4497, 4491, 4483, 4495, 4509, 4511, 4512, 4498, 4510,
+     4516, 4513, 4528, 4519, 4522, 6594, 6594, 4529, 4544, 4525,
+     4550, 4556, 4539, 4540, 4565, 4563, 4562, 4569, 6594, 4560,
+
+     4553, 4571, 6594, 4554, 4577, 4576, 4578, 4583, 4589, 4592,
+     4594, 4609, 4596, 4612, 4598, 4595, 6594, 4610, 4604, 4606,
+     4623, 4622, 4620, 4625, 6594, 4633, 4618, 4650, 4645, 4641,
+     4649, 4660, 4663, 4664, 4651, 4652, 4670, 4672, 4667, 4669,
+     6594, 4678, 4675, 4680, 4691, 4686, 4704, 4687, 4709, 4694,
+     4715, 4716, 4705, 4698, 6594, 4718, 4720, 4707, 4724, 4710,
+     4729, 4737, 4747, 4738, 4722, 4739, 4733, 4757, 6594, 4749,
+     4750, 4743, 4755, 4761, 4753, 4771, 4767, 4776, 4765, 4777,
+     4780, 4793, 6594, 4785, 4796, 4781, 4798, 4788, 4808, 4812,
+     4804, 4818, 4820, 4821, 4823, 4807, 4822, 6594, 4831, 6594,
+
+     4832, 4842, 4847, 4854, 4840, 6594, 4846, 4856, 6594, 4859,
+     4850, 4857, 4864, 6594, 4877, 4870, 4874, 4873, 4852, 6594,
+     4895, 4891, 4910, 4911, 4908, 4899, 4914, 4897, 4902, 4898,
+     4918, 6594, 4923, 4925, 4920, 4926, 4912, 4929, 4934, 4947,
+     4937, 4955, 4935, 4959, 4945, 6594, 4950, 4962, 4973, 4961,
+     4968, 6594, 6594, 4971, 4978, 4977, 4975, 4982, 6594, 4987,
+     4976, 4996, 4999, 5002, 6594, 6594, 5013, 6594, 4997, 6594,
+     6594, 5012, 5014, 5016, 6594, 5020, 6594, 5026, 5021, 5009,
+     5005, 5028, 6594, 5018, 5038, 5030, 6594, 5042, 5036, 5040,
+     5041, 6594, 5034, 6594, 5061, 5059, 5065, 5064, 5057, 5060,
+
+     5067, 5073, 5075, 5076, 5068, 5063, 5078, 5084, 5092, 5102,
+     5098, 5107, 5093, 5114, 5106, 5090, 5101, 5105, 5100, 5108,
+     5125, 5129, 5128, 5132, 5134, 5141, 5133, 5145, 5153, 5162,
+     5163, 5165, 6594, 6594, 5149, 5159, 5156, 6594, 5168, 5151,
+     5160, 5171, 5190, 5180, 5183, 5178, 6594, 5203, 5195, 5193,
+     5205, 5198, 5196, 5206, 5192, 5202, 5216, 5234, 5241, 5219,
+     5227, 5225, 5240, 5229, 5230, 5248, 5256, 5247, 5257, 5255,
+     6594, 5243, 6594, 5251, 5246, 5269, 6594, 6594, 5270, 5276,
+     5265, 5280, 5273, 5281, 5294, 6594, 5284, 5297, 5302, 5292,
+     6594, 5304, 6594, 5309, 5293, 5310, 5308, 5314, 6594, 6594,
+
+     6594, 5315, 5311, 5317, 5318, 5329, 5332, 5342, 5331, 5340,
+     6594, 5336, 5344, 5357, 5337, 5353, 5355, 5358, 5361, 5373,
+     5367, 5369, 5368, 5376, 5386, 5387, 6594, 6594, 5377, 5406,
+     5393, 5397, 5396, 5401, 5404, 5403, 5392, 5408, 5410, 5399,
+     6594, 5418, 5417, 5423, 5427, 5437, 5438, 5450, 5443, 6594,
+     6594, 5434, 5435, 5439, 5456, 5444, 5448, 5445, 5459, 5462,
+     6594, 5461, 6594, 5471, 5465, 5498, 5494, 5487, 5492, 6594,
+     5490, 5488, 6594, 5496, 5493, 5489, 6594, 5505, 6594, 6594,
+     5502, 6594, 5510, 6594, 5515, 5511, 5509, 5537, 5541, 5542,
+     5544, 5545, 5528, 5533, 5553, 5549, 5548, 6594, 6594, 5556,
+
+     5527, 5555, 5558, 5538, 5562, 5559, 6594, 6594, 5573, 5581,
+     6594, 5567, 5588, 5579, 5582, 5577, 5583, 5585, 5598, 5594,
+     5593, 5608, 5606, 5615, 5628, 5620, 5612, 5611, 5619, 5623,
+     5621, 5633, 6594, 5637, 5646, 5634, 6594, 5651, 5650, 5662,
+     5660, 5658, 6594, 5648, 5669, 5670, 5672, 5656, 5691, 5675,
+     5673, 6594, 5690, 5686, 5692, 6594, 5678, 6594, 5694, 6594,
+     6594, 5702, 5709, 5705, 6594, 5711, 5719, 6594, 5712, 5715,
+     5708, 5721, 5722, 6594, 5730, 5739, 5726, 5734, 5735, 5753,
+     5741, 5750, 5738, 5760, 6594, 5745, 5754, 5770, 5761, 5771,
+     5767, 5757, 5780, 5781, 5777, 5766, 5778, 5787, 6594, 5795,
+
+     5810, 6594, 5790, 6594, 5812, 5797, 5815, 6594, 5818, 5801,
+     5800, 5816, 6594, 5824, 5817, 6594, 5807, 5830, 5832, 5827,
+     5822, 5834, 5833, 5855, 5861, 5865, 6594, 5857, 5847, 5870,
+     5871, 5872, 5858, 6594, 5873, 5874, 5862, 5877, 5892, 5886,
+     6594, 5887, 5888, 6594, 5890, 5906, 5898, 5913, 5895, 5916,
+     5920, 5919, 6594, 5921, 6594, 6594, 5904, 6594, 5905, 5925,
+     6594, 5928, 5915, 5937, 5932, 5935, 5939, 6594, 6594, 5946,
+     5950, 5949, 5956, 6594, 5943, 5945, 5962, 5966, 5968, 6594,
+     5971, 5955, 5976, 5973, 5970, 5990, 5983, 5994, 6594, 6594,
+     5989, 6594, 6011, 6012, 6010, 6594, 6594, 6594, 6015, 6594,
+
+     6019, 6026, 6016, 6594, 6022, 6027, 6030, 6594, 6028, 6025,
+     6033, 6594, 6038, 6031, 6049, 6051, 6061, 6047, 6058, 6064,
+     6071, 6043, 6054, 6052, 6075, 6077, 6065, 6086, 6594, 6594,
+     6087, 6594, 6594, 6093, 6094, 6097, 6594, 6090, 6101, 6594,
+     6103, 6096, 6104, 6091, 6110, 6594, 6594, 6098, 6109, 6594,
+     6119, 6120, 6113, 6124, 6115, 6123, 6128, 6594, 6594, 6594,
+     6594, 6594, 6135, 6594, 6594, 6148, 6133, 6131, 6594, 6136,
+     6146, 6163, 6154, 6147, 6151, 6160, 6158, 6155, 6168, 6177,
+     6180, 6192, 6197, 6199, 6202, 6195, 6196, 6181, 6194, 6207,
+     6203, 6211, 6594, 6216, 6594, 6219, 6594, 6212, 6221, 6218,
+
+     6223, 6227, 6222, 6232, 6594, 6228, 6248, 6255, 6234, 6243,
+     6244, 6246, 6258, 6261, 6262, 6272, 6279, 6275, 6286, 6289,
+     6290, 6277, 6282, 6297, 6594, 6288, 6293, 6292, 6306, 6303,
+     6309, 6299, 6594, 6320, 6326, 6316, 6318, 6327, 6341, 6339,
+     6322, 6345, 6338, 6349, 6359, 6356, 6363, 6355, 6373, 6377,
+     6314, 6382, 6384, 6366, 6375, 6376, 6381, 6394, 6594, 6387,
+     6393, 6396, 6405, 6409, 6594, 6399, 6408, 6411, 6416, 6428,
+     6422, 6594, 6431, 6433, 6432, 6594, 6436, 6594, 6594, 6440,
+     6434, 6443, 6446, 6447, 6594, 6594, 6594, 6502, 6509, 6516,
+     6523, 6530,   83, 6537, 6544, 6551, 6558, 6565, 6572, 6579,
+
+     6586
     } ;
 
-static yyconst flex_int16_t yy_def[2252] =
+static yyconst flex_int16_t yy_def[2302] =
     {   0,
-     2237,    1, 2238, 2238, 2239, 2239, 2240, 2240, 2241, 2241,
-     2242, 2242, 2237, 2243, 2237, 2237, 2237, 2237, 2244, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2245, 2237, 2237, 2237, 2245, 2246, 2237, 2237, 2237, 2246,
-     2247, 2237, 2237, 2237, 2237, 2247, 2248, 2237, 2237, 2237,
-     2248, 2249, 2237, 2250, 2237, 2249, 2249, 2243, 2243, 2237,
-     2251, 2244, 2251, 2244, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2245, 2245, 2246, 2246, 2247, 2247, 2237, 2248, 2248, 2249,
-     2249, 2250, 2250, 2249, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2249, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2249, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2249, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2249, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2237, 2237, 2243, 2237, 2237, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2249, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2249, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2237, 2243, 2237, 2243, 2243, 2243, 2237, 2243, 2237, 2243,
-     2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2237, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2237, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-
-     2237, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2237, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2237, 2237, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2237, 2237,
-     2243, 2237, 2243, 2237, 2237, 2243, 2243, 2243, 2237, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2237, 2243, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2237,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2237, 2237, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2243, 2243, 2237, 2243, 2243, 2243, 2237, 2243,
-     2237, 2237, 2243, 2237, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2237,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2237, 2243, 2237, 2243,
-     2237, 2237, 2243, 2243, 2243, 2237, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2237, 2243, 2237, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2237,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2243, 2237, 2237, 2243, 2237, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2237, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2237, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2237, 2243, 2237,
-     2243, 2243, 2243, 2237, 2237, 2237, 2243, 2237, 2243, 2243,
-     2243, 2237, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2237,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2237, 2243, 2237, 2237,
-
-     2243, 2243, 2243, 2237, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2237, 2237, 2243, 2243, 2237, 2243, 2243, 2243,
-     2243, 2243, 2243, 2237, 2237, 2237, 2237, 2237, 2243, 2237,
-     2237, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2237, 2243,
-     2237, 2243, 2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2243, 2243, 2243,
-     2243, 2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-
-     2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2237, 2243, 2243, 2243, 2243, 2243, 2243, 2243, 2243,
-     2243, 2243, 2243, 2243, 2243, 2237, 2243, 2237, 2237, 2243,
-     2243, 2243, 2243, 2243, 2237, 2237,    0, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237
+     2287,    1, 2288, 2288, 2289, 2289, 2290, 2290, 2291, 2291,
+     2292, 2292, 2287, 2293, 2287, 2287, 2287, 2287, 2294, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2295, 2287, 2287, 2287, 2295, 2296, 2287, 2287, 2287,
+     2296, 2297, 2287, 2287, 2287, 2287, 2297, 2298, 2287, 2287,
+     2287, 2298, 2299, 2287, 2300, 2287, 2299, 2299, 2293, 2293,
+     2287, 2301, 2294, 2301, 2294, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2295, 2295, 2296, 2296, 2297, 2297, 2287, 2298,
+     2298, 2299, 2299, 2300, 2300, 2299, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2299,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2299, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2299, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2299, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2287, 2287, 2293,
+     2287, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2299, 2293, 2293, 2293, 2287, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2299, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2287, 2293, 2293, 2293, 2287, 2293, 2287, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2287,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2287, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2287, 2293, 2287, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2287, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2287,
+
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2287, 2287, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2287, 2287, 2293, 2287, 2293, 2287,
+     2287, 2293, 2293, 2293, 2287, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2287, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2287, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2287, 2293, 2293, 2293, 2287, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2287, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2287, 2287,
+
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2287, 2293, 2293, 2293, 2287, 2293, 2287, 2287,
+     2293, 2287, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293,
+
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2287, 2293, 2287, 2293, 2287,
+     2287, 2293, 2293, 2293, 2287, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+
+     2293, 2287, 2293, 2287, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2287, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2287, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2287, 2287, 2293, 2287, 2293, 2293,
+     2287, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293,
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287,
+     2293, 2287, 2293, 2293, 2293, 2287, 2287, 2287, 2293, 2287,
+
+     2293, 2293, 2293, 2287, 2293, 2293, 2293, 2287, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287,
+     2293, 2287, 2287, 2293, 2293, 2293, 2287, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2287, 2287, 2293, 2293, 2287,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2287, 2287,
+     2287, 2287, 2293, 2287, 2287, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2287, 2293, 2287, 2293, 2293, 2293,
+
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293,
+     2293, 2293, 2293, 2293, 2293, 2293, 2293, 2293, 2287, 2293,
+     2293, 2293, 2293, 2293, 2287, 2293, 2293, 2293, 2293, 2293,
+     2293, 2287, 2293, 2293, 2293, 2287, 2293, 2287, 2287, 2293,
+     2293, 2293, 2293, 2293, 2287, 2287,    0, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+
+     2287
     } ;
 
-static yyconst flex_uint16_t yy_nxt[6466] =
+static yyconst flex_uint16_t yy_nxt[6661] =
     {   0,
        14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
-       14,   14,   18,   20,   14,   21,   22,   23,   24,   14,
-       25,   26,   27,   28,   29,   30,   31,   32,   33,   34,
-       35,   36,   37,   38,   39,   14,   14,   14,   14,   40,
-       20,   14,   21,   22,   23,   24,   14,   25,   26,   27,
-       28,   29,   30,   31,   32,   33,   34,   35,   36,   37,
-       38,   39,   14,   14,   14,   14,   42,   43,   44,   42,
-       43,   44,   47,   48,   47,   48,   49,   97,   49,   52,
-       53,   54,   55,  811,   18,   52,   53,   54,   55,   69,
-       18,   58,   59,   60,   58,   59,   60,   70,  131,  131,
-
-       68,   71,   87,   45,   97,  133,   45,  141,  133,   50,
-       73,   50,   73,   73,   69,   73,  141,   56,   99,  138,
-      138,   73,   88,   56,  139,   69,   75,   76,   61,   87,
-       69,   61,   15,   16,   17,   63,   64,   65,   15,   16,
-       17,   63,   64,   65,   77,   99,   89,  183,   74,   88,
-       69,   91,   66,   75,   76,   78,  145,  107,   66,   92,
-       90,   70,   79,   69, 1003,   71,   80,   69,   98,   81,
-       67,   77,   69,   89,  183,  137,   67,   69,   91,   66,
-       69,   69,   78,  145,  107,   66,   92,   90,   93,   79,
-       69,   94,   69,   80,  100,   98,   81,   82,   95,  136,
-
-       96,   83,  101,  134,   84,  198,   85,   86,  102,  132,
-      104,   69,  103,  113,  105,   93,  147,   69,   94,   69,
-       69,  100,  146,   69,   82,   95,   69,   96,   83,  101,
-      106,   84,  198,   85,   86,  102,   69,  104,  114,  103,
-      113,  105,  115,  147,  133,   69,  123,  133,  124,  146,
-      180,   69,  116,   69,  126,  117,  157,  106,  108,  127,
-      141,   69,  109,  125,   69,  114,  128,   69,  110,  115,
-      129,  111,   69,  123,  130,  124,  151,  180,  112,  116,
-       69,  126,  117,  157,  139,  108,  127,  131,  131,  109,
-      125,  144,   69,  128,   69,  110,  209,  129,  111,  158,
-
-      904,  130,   69,  151,  141,  112,  118,   69,   68,  119,
-       68,   68,  135,   68,  135,  135,  120,  135,  144,   68,
-      121,  122,   73,  209,   73,   73,  158,   73,   69,  140,
-       69,  140,  140,  118,  140,   68,  119,   68,   68,   73,
-       68,   73,   73,  120,   73,  148,   68,  121,  122,  152,
-       73,  161,  150,  153,  155,  156,  137,  159,  149,  154,
-      143,   69,   69,   69,   69,  136,  162,  163,  166,   69,
-      138,  138,  148,   69,   69,  160,  152,   74,  161,  150,
-      153,  155,  156,   69,  167,  149,  154,  164,  165,   69,
-      168,   69,  173,  162,  163,  166,   69,   69,  134,  181,
-
-      175,  132,  160,   69,  169,   69,   69,  170,   69,  178,
-      176,  167,   69,  179,  164,  165,  174,  168,  182, 2237,
-      171,  172,  185,  203,   69,  184,  181,  175,   69,  188,
-      177,  169,   69,   69,  170, 2237,  178,  176,   69,   69,
-      179,   69,   69,  174,  186,  182,  187,  171,  172,  185,
-      190,  189,  184,   69,  193,   69,  188,  177,   69,   69,
-      191,   69,  194,  195,  192, 2237,  196,  199, 2237, 2237,
-       69,  186,  197,  187,   69,   69,  205,  190,  189,  200,
-       69,  193,   69,  201,  202,  204,  207,  191,   69,  194,
-      195,  192,   69,  196,  199,   69,  206,  208,   69,  197,
-
-       69,  210,   69,  205,  213,  212,  200,  214,   69, 2237,
-      201,  202,  204,  207,  215,  135,   69,  135,  135,   69,
-      135,  217,  211,  206,  208,  218,   69,   69,  210,  216,
-     2237,  213,  212,  220,  214,  140,   69,  140,  140,  219,
-      140,  215,   73,   69,   73,   73,  221,   73,  217,  211,
-      222,   69,   69,  141,   69,  230,  216,   69,  224,  223,
-      220,  225,   69,  226,  229,   69,  219,  228, 2237,  227,
-      240,  231, 2237,  221,  239,  232,  241,  222,   69,   69,
-      143,   69,  242,  260,  244,  224,  223,   69,  225,   69,
-       69,  229,  233, 2237,  228,   69,  227,  240,   69,   69,
-
-       69,  239,  232,  241,   69,  245,  243,   69,  246,  242,
-       69,  244,  247,  250,  248,   69, 2237,  249, 2237,  233,
-      234,   69,   69,  251,   69,  235,  252,   69,  264,   69,
-      236,  258,  245,  243,  257,  246,  237,  238,   69,  247,
-      250,  248,  267,   69,  249,   69,  261,  234,   69,  253,
-      251,  259,  235,  252,  254,  269,   69,  236,  258,  262,
-       69,  257,   69,  237,  238,  265,  255,  268,  256,  270,
-      263,  266,   69,  261,   69,   69,  253,   69,  259,  271,
-     2237,  254,  272,   69,  273,  276,  279,   69,  360,   69,
-       69,   69,  265,  255,  268,  256,   69,  263,  266,   69,
-
-      274,   69,  275,  277,  278,   69,  271,   69,   69,  272,
-      281,  273,  276,  279,  280,   69,  283,  282,   69,  284,
-      285,   69,   69,   69,   69,   69,   69,  274,  286,  275,
-      277,  278,  289,  293,  291,  292,  295,  281,   69,  287,
-      288,  280,   69,  283,  282,  290,  284,  285,   69,  294,
-      297,   69,   69,  296,  299,   69,  306,   69,  300,   69,
-       69,  291,  292,  295,   69,   69,  287,  288,  305,  303,
-      302,  307,  290,  298,   69,  301,  294,  308,  309,   69,
-      296,  304,   69,   69,  141,  300,   69,   69,   69,   69,
-       69,  310,  311,   69,  312,  305,  303,  302,  307,  315,
-
-      298,   69,  301,  313,   69,  309,  316,   69,  304,   69,
-      314,  319,   69,  317,  318,  320,  327,  322,  310,  311,
-       69,  312,   69,   69,  321,  324,  315,  326,   69, 2237,
-      313,   69,  325,  316,  323,  329,  330,  314,  319,   69,
-      317,   69,  320,   69,  322,   69,   69,  328,   69,   69,
-       69,  321,  324,  331,  326,   69,  332,  333,  336,  325,
-       69,  323,   69,  330,   69,  335,  338,   69,  334,  346,
-      337,   69,   69,  339,  328,   69,  340,   69,  341,  345,
-      331,  342,   69, 2237,  333,  336,  344,   69,   69,  343,
-       69,  347,  335,  338,   69,  334,   69,  337,   69,   69,
-
-      339,   69,  348,  340,  353,  341,  345,   69,  342,  354,
-       69,  356,  349,  344, 2237,   69,  343,   69,  347,  357,
-      350,  351,   69,  352,  367,   69,  365,  355,  361,  348,
-       69,  353,  362,   69,   69,  363,  354,  364,  356,  349,
-      358,  359,   69,  366,   69,  369,  357,  350,  351,   69,
-      352,   69,   69,  365,  355,  361,  368,  370,  371,  362,
-      372,   69,  363,  375,  364,   69,  373,  358,  359,   69,
-      366,   69,  369,   69,  374,   69,  378,  377,   69,  383,
-       69,  376,  388,  368,  370,  371,   69,  372,   69,  381,
-      379,  382,   69,  373,  384,   69,  380,  385,   69,  386,
-
-      389,  374,  387,  378, 2237,   69,  383, 2237,  376,   69,
-     2237,  390,   69,   69,   69, 2237,  381,  379,  382,  391,
-       69,  384,   69,  380,  385,   69,  386,  389,  392,  387,
-      393,  394,  395,  405,  397,   69,  406,  409,  390,  411,
-     2237,  410,   69,  141,   69,   69,  391,   69,  396,   69,
-      413,   69,  420, 2237,   69,  392,   69,  393,  394,  395,
-      405,  397,  407,  406,  409,  412,  411,  408,  410,  414,
-     2237,  415,   69,   69, 2237,  396,  398,  399,   69,  417,
-      416, 2237,   69,  418,   69,  419,  400,   69,  401,  402,
-      403,   69,  412,  404,   69,  421,  414,   69,  415,  422,
-
-      424,   69,   69,  398,  399,   69,  417,  416,  423,  425,
-      418,   69,  419,  400,   69,  401,  402,  403,  426,  427,
-      404,   69,  421,  428,  429, 2237,  422,  430,  431,   69,
-      433,  432,   69,  435,   69,  423,  425,  434,  436,   69,
-      438,   69,   69,   69,  447,  426,  427,  444,  443,   69,
-      439, 2237,   69,  437,  430,  431,   69,  433,  432,  458,
-      435,   69,   69,   69,  434,  436,   69,  438,  440,   69,
-      445,  446,  448,  449,  444,  443,   69,  439,   69,  441,
-      437,  442,  450,  452, 2237,  451,   69,  453,  454,   69,
-       69,   69, 2237,   69,   69,  440,  455,  445,  446,  448,
-
-      449,  457,   69,  456,  461,   69,  441,   69,  442,  450,
-      452,  459,  451,   69,  453,  454,  460,   69,   69,  462,
-      463,  464,   69,  455,  466, 2237,   69,   69,  457,  465,
-      456,  461,  467,  468,   69,   69,   69,   69,  459,   69,
-      469, 2237,  470,  460,  472, 2237,  462,  463,  464,  471,
-       69,  466,   69, 2237,   69,   69,  465,  473,  474,  467,
-      468,  479,  475,   69,  480,   69,   69,  469,   69,  470,
-      476,  472,  477,  478,   69,   69,  471,   69,  483,   69,
-       69,  482,  489,  481,  473,  474,  485,  484,  479,  475,
-      487,   69,  486,  490,  493,   69,   69,  476,  492,  477,
-
-      478,   69,  491,   69,   69,  483,   69,   69,  482,  489,
-      481,  494,  495,  488,  484,   69,   69,   69,   69,  486,
-      490,  493,   69,   69,  496,  492,  504, 2237,  497,  491,
-      506, 2237,  514,   69,   69,   69,   69,  505,  494,  495,
-      488,   69,  509,  510,   69,   69,  511, 2237,  507,  513,
-       69,  496,  512,  504,   69,  497,  498,  506,  508,  514,
-      517,  499,  515,  500,  505,  525,   69,  531,   69,  509,
-      510,  501,   69,  511,  502,   69,  513,   69,  519,  512,
-       69,  503,   69,  498,  516,  508,  518,  517,  499,  515,
-      500,   69,  520,  523,  521,  522,   69,   69,  501,   69,
-
-       69,  502,   69,  524,  528,  519,  527,   69,  503,  526,
-       69,  516,  530,  518,   69,   69,  529,  532,   69,  520,
-      523,  521,  522,  533,   69,  534,  141,  535, 2237,  536,
-      524,  528,   69,  527,  538,   69,  526,  537,  541,   69,
-       69,   69,  539,  529,  532,  540,  544,  545,  546,   69,
-      547,   69,  534,   69,  535,   69,  536,  542,   69,   69,
-       69,  538,  543,  548,  537,  541,  549,  550,  554,  539,
-      551,  553,  540,  544,   69,   69,   69,  556,  552,   69,
-      555,  557,   69,  558,  559,  561, 2237,   69, 2237,   69,
-       69,  562,   69,   69,  560,  554,  574,  551,  553,   69,
-
-       69,   69,  563,   69,   69,  552,   69,  555,  557,   69,
-      558,  559,  570,   69,  564,   69,  567,   69,  562,  565,
-      571,  560,  568,  566,  569,   69, 2237,  572,   69,  563,
-      579,  576,  573,   69,   69,  575, 2237,  587,   69,  570,
-       69,  564,   69,  567,   69,  577,  565,  571,   69,  568,
-      566,  569,   69,   69,  572,   69,  580,  579,  576,  573,
-      581,  582,  575,  583,  584,  585,  586,  578,   69,   69,
-      594,   69,  577,  589,  588,   69,   69,  591,   69,  590,
-      592,   69,   69,  580,  596,   69,  595,  581,  582,   69,
-      583,  584,  585,  586,  578,   69,  593,   69,  597,   69,
-
-      589,  588,   69,   69,  591,  598,  590,  592,   69,   69,
-      599,  603,  601,  595,  602,  600,   69,  605, 2237,  608,
-     2237,  604,   69,  593,  612,  597,   69,   69,   69,   69,
-      606,  609,  598,  610,   69,   69,  614,  616,  611,  601,
-     2237,  602,   69,   69,  605,  607,  608,  613,  604,   69,
-       69,  612,  615,   69,   69,  622, 2237,  606,  609,  617,
-       69,   69,   69,  614,  616,   69,  618,  621,   69,  619,
-      627,  620,  607,   69,  613,   69,  623,   69,   69,  615,
-      624,  631,  622,  625,  628,  626,  617,  629,   69,   69,
-       69,   69,   69,  618,  621,   69,  619,   69,  620,  630,
-
-      632,  633,   69,  623,   69,  635,  634,  624,  631,  638,
-      625,  628,  626,   69,  629,  636,   69,   69,  637,  639,
-      643,  640,  641,   69,  645,   69,  630,  632,  633,   69,
-     2237,   69,  635,  634,  644,  646,  638,   69,   69,   69,
-       69,  642,  636,   69,   69,  637,  639,  643,  640,  641,
-       69,  645,   69,   69,  647,  648,  653,  649,  650,  654,
-      655,  644,  646,  651,   69,  660,  656,   69,  642,  659,
-     2237,  652,  657,   69,   69, 2237,  141,  677,   69,   69,
-       69,  647,  648,  653,  649,  650,  654,  658,  661,   69,
-      651,  662,   69,  656,  670,   69,  659,   69,  652,  657,
-
-       69,  663,   69,   69,  664, 2237,   69,   69,  672,   69,
-      671,   69, 2237,  673,  658,  661,  675, 2237,  662, 2237,
-       69,  670, 2237,  685,  674,  688,   69,   69,  663,  676,
-     2237,  664,  665,  690,   69,  672,  666,  671,  686,  667,
-      673,  691,   69,  675,   69,   69,  668,   69,  687,  669,
-      685,  674,  688, 2237,   69,   69,  676,   69,  689,  665,
-       69,   69,  693,  666,  692,  686,  667, 2237,  691, 2237,
-      694,  695,  708,  668,   69,  687,  669,  678,  679,  697,
-      680,   69,   69,  681,  696,  689,  701,  698,  682,  693,
-       69,  692,  700,   69,  683,  684,   69,  694,  695,  708,
-
-       69,   69,  699,   69,  678,  679,  697,  680,   69,   69,
-      681,  696,   69,  701,  698,  682,  702,   69,  703,  700,
-      704,  683,  684,   69,  705,  706,   69,  707, 2237,  699,
-      711,  709,  713,  710,  712,  714, 2237,   69,  715,   69,
-       69, 2237,  716,  702, 2237,  703,   69,  704, 2237,  717,
-       69,  705,  706,  718,  707,   69,   69,   69,  709,  720,
-      710,  712,   69,   69,   69,  715,  719,   69,   69,  716,
-      721,  722,   69,  723,  724,   69,  717,  725,  726,   69,
-      718,   69,  730, 2237,  728,  729,  720,  727, 2237,  733,
-       69,  731,   69,  719,  732,   69,   69,  721,  722, 2237,
-
-       69,  724,   69,   69,  725,  734,   69,   69,  735,  730,
-       69,  728,  729,   69,  727,   69,  733,   69,  731,  736,
-      737,  732,   69,  739,  740,  741,   69,  742,  738,  745,
-      743,   69,  734,  744,   69,  735,   69, 2237,  746,  748,
-       69,  747,  758,  755,   69,   69,  736,  737,   69,   69,
-      739,   69,  741,  750,  742,  738,  745,  743,  749,   69,
-      744,   69,   69,  751,  752,  746,  748,   69,  747,  753,
-       69,  754,  759,  757,   69,  767,  756, 2237,  760,   69,
-      750,   69,   69,   69,  764,  749,   69,  761, 2237,  766,
-      751,  752,   69,  765,  762,   69,  753, 2237,  754,   69,
-
-      757,   69,  763,  756,   69,  760,   69,   69,  768,   69,
-      769,  764,  770,  771,  761,   69,  766,  772, 2237,   69,
-      765,  762,  773,  775,   69,  774,   69, 2237,  776,  763,
-      777, 2237,   69,  778,   69,  768,  782,  769,  780,  770,
-       69,   69,   69,  779,  772,   69,   69,  781, 2237,   69,
-      141,   69,  774,   69,   69,  776, 2237,  777,  789,  790,
-      778, 2237, 2237,  782,  791,  780,  797,  792,  794,   69,
-      779,  798, 2237,  793,  781,  783,   69,  784, 2237,  795,
-       69,  785,   69,  786,   69,  789,  790, 2237,  787,  800,
-      796,  791,  799,  788,  792,  794,   69,  801,   69,   69,
-
-      793,   69,  783,   69,  784,   69,  795,  804,  785,   69,
-      786,  802,   69,  805,  807,  787,  800,  796,  808,  799,
-      788,  803,  806,  809,  801,  810,   69,   69,   69,   69,
-      819,  817,  818,   69,  804,  820, 2237, 2237,  802,   69,
-      805,  807,  821,   69,  822,  808,   69,  829,  803,  806,
-       69,  823,   69,  827,   69,   69,  812,  819,  817,  818,
-      824,  813,  820,  814,  825,  830,   69,  826,   69,  821,
-       69,  822,   69,   69,  815,   69,  828,  831,  823,   69,
-       69,  816,   69,  812,  832,   69,  833,  824,  813,   69,
-      814,  825,  830,  834,  826,  836,  837,  835,   69,   69,
-
-      839,  815,  841,  828,  831,   69,  838,  840,  816,  842,
-       69,  832,  843,   69,   69,   69, 2237,   69,   69,   69,
-      834,  845,  836,  837,  835,   69,  846,  844,   69,  841,
-      848,   69,   69,  838,  840,  858,  842,  847,  849,  843,
-       69,  850, 2237,  851,   69,  852,  859,  853,  845,   69,
-     2237,   69,   69,  846,  844,   69,  854,   69,  855,  856,
-       69,  857,   69,  863,  847,  849,  864,   69,  850,   69,
-      851,  860,  852,  859,  853,  865,  861,   69,   69,  866,
-       69,  862,   69,  854,  867,  855,  856,   69,  857,   69,
-      863,   69,   69,  864,  869,  868,  870,  871,  860,   69,
-
-     2237,  874,  865,   69,  872,  873,  866,   69,   69, 2237,
-       69,  867,   69,  875,  876,  877,  878,  880,  879,  881,
-     2237,   69,  868,  870,  871,  883,   69,   69,  874,   69,
-       69,  872,  873,  882,   69,   69,   69,   69,   69,  884,
-      875,  876,  877,  878,  880,  879,   69,  885,  887,  886,
-      888,   69,  883,  889, 2237,   69,   69,   69,  896,  890,
-      882,  891,  892,   69,   69,  895,  884,  893,  894,  897,
-      898,   69,  900, 2237,  885,  887,  886,  888,  899,  901,
-       69,   69,   69,   69,   69,   69,  890,   69,  891,  892,
-       69,   69,  895,  903,  893,  894,  902,  898,  905,   69,
-
-       69,   69,  907,  906,  909,  899,  901,   69,   69,   69,
-       69,  908,   69,   69,  910,  912,  911,  913,  914, 2237,
-      903,   69,   69,  902,  915,  905,  917,   69,   69,  907,
-      906,  909,  916,  920,  918,  926, 2237,  922,  908,  919,
-     2237,  910,  912,  911,  921,   69,   69,   69,   69,   69,
-       69,  915,   69,  917,  923,   69,   69,   69,  924,  916,
-      920,  918,   69,  927,  922,  925,  919,  929,  928,  931,
-       69,  921,  930,   69,   69,  934,   69,   69,  935,   69,
-      932,  923, 2237,  933,  936,  924, 2237,  941,   69,  938,
-      927,   69,  925,  937,  929,  928,  931,  940, 2237,  930,
-
-       69,   69,  934,  939,   69,  935,   69,  932,  945,   69,
-      933,  936,   69,   69,  941,   69,  938,  942,  943,  944,
-      937,  947, 2237,  949,  940,   69,  946,   69,  952,  948,
-      939,   69,  951, 2237,  961,   69, 2237, 2237, 2237,   69,
-       69,   69,  950,   69,  942,  943,  944,  956,  947,   69,
-      949,  955,   69,  946,   69,  952,  948,  953,  954,  951,
-       69,  957,  960,  958,   69,   69,   69, 2237,   69,  950,
-       69,  965,  959,   69,  956,  964,  963,  966,  955,   69,
-       69,  962,   69,  970,  953,  954,  967,  971,  957,  960,
-      958,  968,   69,   69,   69,   69,   69,  969,  965,  959,
-
-      972,   69,  964,  963,  966,   69,  979,  980,  962,  981,
-      970,  982,  984,  983,  971, 2237, 2237, 2237,   69, 2237,
-       69,  985,  986, 2237,  969,   69,   69,  972,  973,  990,
-       69,  974,  975,  979,  980,   69,  976,   69,  982,  984,
-      983,   69,  977,   69,   69,  987,  978,  988,  985,  986,
-       69,   69,  989,  991,   69,  973,  990,  993,  974,  975,
-      994,  995, 2237,  976,  996, 1042,   69,  992, 2237,  977,
-       69,   69,  987,  978,  988, 2237,   69, 2237, 1005,  989,
-      991, 1002, 1004,   69, 1006, 1008, 2237,   69,  995,   69,
-     1007,  996,   69, 2237,  992,  997,   69,   69,   69,   69,
-
-      998,   69,  999,   69, 1000, 1005, 1001,   69, 1002, 1004,
-     1009, 1006, 1008,   69, 2237, 1010, 1012, 1007, 1013, 1011,
-     1014, 2237,  997, 1015, 1016, 1021,   69,  998, 1023,  999,
-     1017, 1000,   69, 1001,   69, 1018,   69,   69, 1019,   69,
-       69, 1020,   69, 1012,   69, 1013, 1011, 1014,   69, 1022,
-     1015, 1016,   69, 1024, 1027,   69, 1025, 1017, 1026, 1029,
-     1028,   69, 1018,   69, 2237, 1019,   69,   69, 1020, 1030,
-     1032, 1034, 1036, 1031, 1043, 1033, 1022,   69,   69,   69,
-     1024,   69,   69, 1025, 1035, 1026,   69, 1028, 1037, 1039,
-     1044,   69, 1038,   69,   69, 1041, 1030,   69, 1034, 1036,
-
-     1031,   69, 1033,   69, 1040, 1045,   69, 1046, 1049,   69,
-       69, 1035,   69, 1047,   69, 1037, 1039, 1044, 2237, 1038,
-     1048,   69, 1041, 1050,   69,   69, 1051, 1053, 1052, 2237,
-       69, 1040,   69,   69, 1046,   69,   69,   69, 1054, 1056,
-     1047, 1057, 1061, 1059, 1055, 1058,   69, 1048, 1060,   69,
-     1050,   69,   69, 1051, 1063, 1052,   69, 1064,   69,   69,
-     1062, 1065,   69,   69, 1067, 1054, 1056, 1071, 1057, 1061,
-     1059, 1055, 1058, 1066,   69, 1060, 1072,   69, 1069,   69,
-     1073, 1063, 1068, 1070, 1064,   69,   69, 1062,   69, 1074,
-       69, 1067, 1075,   69, 1071,   69, 1076, 1077, 1078, 1079,
-
-     1066,   69, 2237, 1072, 2237, 1080, 1082, 1073, 1084, 1068,
-       69,   69, 1085, 1081,   69, 1088, 1074,   69,   69, 1075,
-     1083,   69,   69, 1076, 1077, 1078, 1097, 1086,   69,   69,
-     1087,   69, 1080, 1082,   69, 1084,   69,   69,   69, 1085,
-     1081, 1089, 1088, 1090, 1091, 1092,   69, 1083, 1093, 1094,
-       69,   69, 1096, 1097, 1086, 1095, 1098, 1087,   69,   69,
-       69,   69, 1100,   69, 1099, 1106, 1101, 1103, 1089, 1102,
-     1090, 1091, 1092,   69,   69, 1093, 1094, 1105,   69, 1096,
-       69,   69, 1095, 1098, 1104, 1107, 1108, 1110,   69, 1100,
-       69, 1099,   69, 1101, 1103, 1109, 1102,   69, 1112,   69,
-
-     1111, 1113, 1114, 2237, 1105, 1117, 1115, 1119, 2237, 1131,
-       69, 1104,   69, 1108,   69,   69,   69,   69,   69, 1116,
-     1120,   69, 1109,   69, 2237, 1112,   69, 1111, 1113, 1114,
-     1118,   69, 1117, 1115, 1119, 1121, 1122,   69, 1123,   69,
-     1125,   69,   69, 1124,   69, 1126, 1116, 1120,   69, 1127,
-     1128, 1129, 1130, 1132,   69, 1135,   69, 1118,   69,   69,
-       69, 1133, 1121, 1122, 1134, 1136, 1137, 1138, 2237,   69,
-       69, 1140,   69,   69,   69,   69, 1127, 1128, 1129, 1130,
-     1132, 1139, 1144, 1142,   69,   69, 1143,   69, 1133,   69,
-     1141, 1134, 1136, 1137, 1138,   69,   69, 1146, 1140, 1145,
-
-     1147, 1149, 1148, 1150, 1151, 2237,   69, 2237, 1139, 1144,
-     1142, 1157,   69, 1143,   69,   69, 1152, 1141,   69, 1159,
-     1153,   69,   69, 1156,   69,   69, 1145, 1147, 1149, 1148,
-     1150, 1151, 1155, 1154,   69, 1158, 1161, 1160,   69,   69,
-     1163,   69,   69, 1152,   69,   69, 1159, 1153, 1162, 1164,
-     1156, 1166, 1165, 1168, 1167,   69, 1169,   69, 2237, 1155,
-     1154,   69, 1158, 1161, 1160, 1170, 1171, 1172, 2237, 1173,
-     1174, 1179,   69,   69, 1176, 1162,   69,   69, 1166, 1165,
-       69, 1167,   69,   69, 1175,   69,   69,   69, 1177, 1180,
-     1178,   69,   69, 1171, 1172,   69, 1173, 1174,   69, 1181,
-
-     1183, 1176,   69, 1182, 1184,   69,   69, 1188, 2237, 1185,
-       69, 1175,   69, 1186, 2237, 1177, 1180, 1178, 1191, 1187,
-       69,   69, 1190, 2237, 1189, 1192, 1181, 1183, 2237,   69,
-     1182, 1184,   69,   69,   69,   69, 1185, 1196, 1195, 1199,
-     1186,   69, 1198, 1193,   69, 1191, 1187,   69, 1194, 1190,
-       69, 1189, 1192, 1197, 1200,   69,   69, 1202, 1204,   69,
-       69,   69, 2237, 1203, 1196, 1195, 1199,   69, 1208, 1198,
-     1193, 1201, 1206, 1205, 1207, 1194,   69,   69,   69, 1209,
-     1197,   69, 1210, 1212, 1211,   69,   69, 1213, 1218,   69,
-     1203,   69, 2237,   69,   69, 1208,   69, 1214, 1201, 1206,
-
-     1205, 1207,   69, 1219,   69,   69, 1209,   69, 1220, 1210,
-     1212, 1211, 1215, 1223, 1213, 1216, 1221, 1222, 1224,   69,
-       69, 1225, 1226, 1229, 1214,   69,   69, 1217, 2237, 1230,
-     1219,   69, 1231, 1227, 1234, 1220,   69,   69,   69, 1215,
-     1223,   69, 1216, 1221, 1222, 1228, 1233,   69, 1225, 1226,
-       69,   69,   69, 1232, 1217,   69, 1230,   69, 1236, 1235,
-     1227,   69, 1237, 1238,   69, 1239, 1240,   69,   69,   69,
-       69, 1248, 1228, 1233, 1242, 1243, 1241, 1244,   69,   69,
-     1232,   69, 1246, 1250,   69, 1236, 1235, 1245,   69, 1237,
-     1238,   69, 1239, 1240,   69,   69, 1247, 2237,   69, 1249,
-
-     1252, 1242,   69, 1241, 1244,   69,   69,   69, 1251, 1246,
-     1250, 1253,   69, 1254, 1245, 1256,   69, 1257, 2237, 1255,
-     1261, 1258, 1265, 1247,   69, 1262, 1249, 1252,   69,   69,
-     1263,   69, 1266,   69,   69, 1251, 1259,   69, 1253, 1260,
-     1254,   69, 1256, 1264, 1257,   69, 1255, 1261, 1258,   69,
-     1267, 1269, 1262, 1268,   69, 2237, 1270, 1263, 1271,   69,
-     1272,   69, 1276, 1259, 1275, 1277, 1260,   69,   69, 1284,
-     1264,   69, 1273,   69,   69, 1274,   69, 1267, 1269, 1278,
-     1268, 1279,   69, 1270, 1280, 1271,   69, 1272, 1281, 1282,
-       69, 1275,   69,   69,   69,   69, 1284, 1283, 1285, 1273,
-
-       69,   69, 1274, 1286, 1288, 1289, 1278,   69, 1279, 1287,
-     1297, 1280,   69, 1295, 1290, 1281, 1282, 1294, 1296, 1299,
-       69, 1300,   69, 1316, 1283, 1285,   69,   69, 1291,   69,
-     1286, 1288, 1289, 1302, 1292, 1301, 1287, 1293, 1298, 1303,
-       69, 1290,   69,   69, 1294,   69,   69,   69, 1300, 1304,
-       69,   69,   69, 1306,   69, 1291, 1305, 1309, 1310, 1307,
-     1302, 1292, 1313, 1308, 1293, 1298, 1303,   69, 1314, 1311,
-       69,   69,   69, 2237, 1312, 1322,   69,   69,   69,   69,
-     1306,   69,   69, 1305, 1309, 1310, 1307, 1318, 1315, 1319,
-     1308, 1317, 1324,   69,   69, 1314, 1311,   69,   69, 1320,
-
-     1321, 1312, 1322, 1323,   69, 1325, 1331,   69, 1327, 1328,
-       69,   69, 1326,   69, 1318, 1315, 1319, 1332, 1317, 1324,
-     1335,   69,   69, 1329,   69,   69, 1320, 1321,   69, 1330,
-     1323, 1333,   69, 1331, 1334, 1327, 1328,   69,   69, 1326,
-     1336,   69, 1337,   69, 1338, 1340,   69, 1335, 1339,   69,
-     1329, 1341, 1343, 1342, 1345, 1344, 1330, 2237, 1333,   69,
-     2237, 1334,   69,   69, 1346, 1347,   69,   69,   69, 1337,
-       69,   69, 1340,   69, 1349, 1339, 1348,   69,   69, 1343,
-     1342, 1345, 1344, 1350, 1351, 1356, 1352,   69, 1355,   69,
-     1354, 1346, 1347, 1357,   69,   69, 1358,   69, 1367, 1353,
-
-       69, 1349,   69, 1348,   69, 1361,   69, 1360, 1359, 1363,
-     1350, 1351,   69, 1352,   69, 1355,   69, 1354, 1364, 1365,
-     1362, 1366, 1369, 1358,   69,   69, 1353,   69, 1368, 1370,
-       69, 1371,   69, 1373, 1360, 1359,   69, 1372,   69,   69,
-     1374, 1376, 1375, 1383,   69, 1364,   69, 1362, 1366, 1387,
-     2237, 1381,   69, 2237,   69, 1368, 1370,   69,   69, 1382,
-     1373, 1391,   69,   69, 1372, 1388,   69,   69,   69, 1375,
-     1377, 1378, 1379,   69, 1384,   69, 1387, 1380, 1381, 1385,
-     1389,   69, 1390, 1394, 1386,   69, 1382, 1392, 1393,   69,
-       69, 1395, 1388,   69,   69,   69,   69, 1377, 1378, 1379,
-
-     1397, 1384, 1396,   69, 1380,   69, 1398, 1389, 1400, 1390,
-     1394,   69, 1399,   69, 1392, 1393, 1401,   69,   69, 1402,
-     1404, 1406, 1403, 1413, 1405, 2237,   69, 1397,   69, 1396,
-     1408,   69, 1407, 1398,   69, 1400,   69,   69, 1409, 1399,
-     1412,   69, 1411,   69, 1410,   69, 1402,   69, 1406, 1403,
-       69, 1405, 1415,   69, 1414,   69, 1416, 1408, 1417, 1407,
-     1418,   69,   69, 2237,   69, 1409, 1420, 1412, 1421, 1411,
-     1419, 1410,   69, 1428, 1422,   69, 1423, 1425, 1424, 1415,
-     1427, 1414,   69, 2237,   69,   69,   69,   69,   69, 2237,
-       69,   69,   69, 1420, 1429, 1421, 2237, 1419, 1426,   69,
-
-     1428, 1422,   69, 1423, 1425, 1424,   69, 1427, 1431, 1434,
-     1430, 1432, 1433, 1435, 1437, 1436,   69,   69, 1440, 1443,
-       69, 1429, 1441,   69, 1444, 1426,   69, 1445,   69, 1448,
-     1451, 1442,   69,   69,   69, 1431, 1434, 1430, 1432, 1433,
-     1435,   69, 1436, 1438,   69,   69, 1443, 1446, 1439, 1441,
-     1449,   69, 1447, 1450,   69, 1453,   69, 1452, 1442,   69,
-     1456,   69,   69, 1455, 1457,   69, 1454, 1458,   69,   69,
-     1438, 1459,   69, 1460, 1462, 1439, 1461, 1449,   69,   69,
-     1450,   69, 1453, 1463, 1452, 1465,   69, 1464, 1466, 1467,
-     1455, 1457,   69, 1454,   69, 1469, 1470,   69, 1459,   69,
-
-     1460,   69,   69, 1461, 1468, 1471, 1472, 2237, 1475,   69,
-       69,   69, 1473,   69, 1464, 1466, 1467,   69,   69, 1474,
-     1476,   69, 1469, 1470, 1478,   69, 1477,   69, 1485,   69,
-     1479, 1468, 1471, 1472,   69,   69, 1480,   69,   69, 1473,
-     1481, 1483, 1482, 1484, 1490, 1486, 1474, 1476,   69,   69,
-       69,   69, 1489, 1477,   69, 1487, 1491, 1479,   69, 1492,
-       69,   69,   69, 1480,   69,   69, 1488, 1481, 1483, 1482,
-     1484, 1490, 1486, 1493,   69, 1494, 1495, 1496, 1497, 1489,
-     1498,   69, 1487, 1491,   69, 1499,   69,   69,   69,   69,
-     1500, 1503, 1501, 1488, 1502, 2237, 1504, 1505,   69, 2237,
-
-     1493, 1507, 1494, 1495, 1538, 1497,   69, 1498, 1516,   69,
-       69,   69, 1499, 2237,   69,   69,   69,   69, 1503, 1501,
-     1506, 1502,   69, 1504, 1505, 1508,   69, 1509, 1507, 1510,
-       69, 1511, 1512, 1515, 1514,   69,   69, 1517, 1519, 2237,
-       69,   69,   69,   69, 1518, 1513,   69, 1506,   69, 1523,
-     2237,   69, 1508,   69, 1509, 1520, 1510, 1522, 1511, 1512,
-     1515, 1514,   69, 1521, 1517, 1519, 1524, 1525, 1526, 1527,
-       69, 1518, 1513, 1528,   69,   69, 1523,   69, 1529,   69,
-     1530, 1532, 1520, 1548, 1522, 1531,   69,   69,   69,   69,
-     1521,   69, 1533, 1524, 1525, 1526, 1527, 1536,   69, 1534,
-
-     1528, 1535, 1537,   69, 1540, 1529,   69,   69, 1532,   69,
-     1539, 1541, 1531, 1544, 1542,   69, 1545,   69,   69, 1533,
-     1543,   69,   69,   69, 1536, 1550, 1534, 1546, 1535, 1537,
-       69, 1540,   69,   69, 1549, 2237, 1552, 1539, 1541,   69,
-       69, 1542,   69, 1545, 1547, 1551, 1554, 1543, 1553, 1555,
-       69,   69, 1550, 1556, 1546, 1558,   69, 2237, 2237, 1557,
-       69, 1549,   69, 1552,   69,   69, 1559, 1561, 1560, 1562,
-     1564, 1547, 1551, 1554,   69, 1553, 1555,   69,   69, 1565,
-     1556, 1566,   69,   69,   69, 1563, 1557, 1572,   69,   69,
-     1567,   69,   69, 1559, 1561, 1560, 1562, 1564, 1569,   69,
-
-     1571, 1570,   69, 1568, 1573,   69, 1565, 1575, 1566, 1577,
-     1576,   69, 1563,   69, 1572, 1574, 1578, 1567,   69,   69,
-     1582, 1579, 1584, 1588, 1580, 1569, 1589, 1571, 1570, 1581,
-     1568,   69,   69,   69,   69,   69, 1577, 1576,   69,   69,
-     1585,   69, 1574, 1578, 1583, 1593, 1590, 1582, 1579,   69,
-     1588,   69, 1592,   69, 1586, 1591,   69, 1595, 1594, 2237,
-     1597,   69, 1598, 2237, 1596, 1587,   69, 1585, 1600,   69,
-       69, 1583,   69, 1590, 1599, 1606,   69,   69, 2237, 1592,
-       69, 1586, 1591,   69,   69, 1594,   69, 1597, 1602, 1598,
-       69, 1596, 1587, 1601, 1603, 1600, 1604,   69, 1605, 1607,
-
-       69, 1599,   69, 1610,   69,   69, 1608, 1609, 1613,   69,
-     1614, 1611,   69,   69, 1620, 1602,   69, 2237,   69,   69,
-     1601, 1603,   69, 1604, 1612, 1605, 1607, 1617, 1615,   69,
-     1610, 1619,   69, 1608, 1609, 1613,   69, 1614, 1611, 1616,
-     1618,   69,   69,   69, 1621,   69,   69, 1622, 1626, 1623,
-     1624, 1612, 1625, 1627, 1617, 1615, 1629, 1628, 1619, 1630,
-     2237,   69,   69, 2237,   69, 1633, 1616, 1618,   69,   69,
-       69, 1621, 1634, 1635, 1622,   69, 1623, 1624,   69, 1625,
-       69, 1636, 1637, 1629, 1628,   69, 1630, 1631,   69,   69,
-     1632, 1638,   69, 1639,   69,   69, 1640, 1642, 1643, 1634,
-
-     1635, 1644, 1641, 1645, 1647,   69,   69,   69, 1636, 1637,
-       69, 1648,   69, 1646, 1631, 1649, 1651, 1632, 1638, 1650,
-       69, 1654, 1657,   69,   69, 1643,   69,   69,   69, 1641,
-       69, 1647, 1652,   69, 1653, 2237, 1655, 1661, 1648, 1658,
-     1646,   69,   69,   69, 1659,   69, 1650,   69, 1654,   69,
-     1660, 1656, 2237, 1662, 1666,   69,   69, 1668,   69, 1652,
-       69, 1653,   69, 1655,   69, 1663, 1658, 1664, 1665,   69,
-     1670, 1659, 1671,   69, 1667, 1673, 1669, 1660, 1656,   69,
-     1662,   69,   69,   69,   69, 1672, 2237, 1676, 1674, 1675,
-       69,   69, 1663,   69, 1664, 1665, 1677, 1670,   69, 1671,
-
-     1679, 1667, 1673, 1669,   69, 1678,   69, 1680, 1681,   69,
-     1682,   69, 1672,   69, 1676, 1674, 1675, 1687, 1683,   69,
-     1684, 1685,   69, 1677, 1690, 1692, 1689, 1679, 1686,   69,
-       69, 1688, 1678,   69, 1680, 1681,   69, 1682,   69,   69,
-     1691,   69,   69, 2237, 1693, 1683, 1698, 1684, 1685,   69,
-     1697, 1690, 1694, 1689,   69, 1686, 1703,   69, 1688, 1699,
-     1701, 1695,   69, 1696,   69, 1700,   69, 1691,   69, 1702,
-       69, 1693,   69, 1698,   69, 1704,   69, 1697, 1705, 1694,
-       69, 1707, 1708, 1703,   69,   69, 1699, 1701, 1695, 1706,
-     1696, 1709, 1700, 1710, 1711, 1714, 1702,   69, 2237, 1712,
-
-     2237, 1713, 1704, 1716,   69, 1705, 1715, 1719,   69,   69,
-       69,   69,   69,   69, 1717, 1718, 1706, 1720, 1709,   69,
-     1725,   69, 1714, 1721, 1724,   69, 1712,   69, 1713, 1722,
-     1716,   69, 1723, 1715, 1719, 1727,   69,   69,   69,   69,
-       69, 1717, 1718,   69,   69,   69, 1726, 1725, 1728, 1729,
-     1721, 1724, 1730,   69, 1731, 1732, 1722,   69, 1733, 1723,
-     1735,   69, 1727, 1742, 1734,   69, 1737, 1739,   69, 2237,
-       69, 1736, 1738, 1726, 1740, 1744, 1729,   69, 1746, 1730,
-       69, 1731, 1732,   69,   69,   69, 1741, 1735, 1743, 1745,
-       69, 1734,   69, 1737, 1739,   69,   69, 1747, 1736, 1738,
-
-       69, 1740,   69,   69, 1748,   69,   69,   69, 1749,   69,
-     1750, 1751, 1752, 1741, 1753, 1743, 1745, 2237, 1754, 1757,
-     1755, 1756, 1761, 1759, 1747,   69,   69,   69, 1764,   69,
-       69, 1748, 1765, 1760, 1758, 1749, 1766,   69,   69, 1772,
-       69, 1753, 1768,   69,   69, 1754, 1757, 1755, 1756,   69,
-       69,   69, 1763, 1762,   69,   69, 1767, 1769,   69, 1765,
-     1760, 1758,   69,   69,   69, 1771,   69,   69, 1770, 1768,
-       69, 1773, 1774, 1775, 2237, 1777, 1776, 2237,   69, 1763,
-     1762,   69, 1778, 1767, 1769,   69, 1780,   69,   69, 1779,
-     1781, 1784, 1771, 1782, 1785, 1770, 2237,   69,   69,   69,
-
-     1775,   69, 1777, 1776,   69,   69,   69, 1783, 1788, 1778,
-     1786,   69,   69, 1780,   69,   69, 1779, 1781,   69, 1787,
-     1782, 1785,   69, 1790, 1789, 1792,   69,   69, 1791, 1793,
-     2237, 1800, 1801, 1796, 1783, 1788,   69, 1786,   69, 1794,
-     1797, 1795, 1798,   69,   69,   69, 1787, 1802, 1799, 1804,
-     1790, 1789, 1792,   69,   69, 1791, 1793,   69,   69,   69,
-     1796, 1813, 1803, 1809,   69,   69, 1794, 1797, 1795, 1798,
-       69,   69, 1805,   69, 1802, 1799, 1804, 1806, 1807,   69,
-     1808,   69, 1812,   69, 1810, 1811,   69,   69,   69, 1803,
-     1809,   69, 1814, 1815,   69, 1816, 2237, 1818, 2237, 1805,
-
-     1824, 1817,   69, 1822, 1806, 1807,   69, 1808,   69, 1812,
-       69, 1810, 1811,   69, 1819,   69, 1820, 1821, 1823, 1814,
-     1815, 1826, 1816,   69, 1818,   69, 1825,   69, 1817, 1827,
-       69, 2237,   69,   69, 1832,   69, 1828,   69, 1831, 1829,
-     1830, 1819, 1833, 1820, 1821,   69,   69,   69, 1826, 1834,
-     1835, 1842, 1837, 1825, 1836, 2237, 1827, 1838,   69,   69,
-       69, 1832,   69, 1828,   69, 1831, 1829, 1830, 1840,   69,
-       69, 1843, 1839, 1841,   69,   69, 1834,   69,   69, 1837,
-       69, 1836, 1844,   69, 1838, 1845, 1849, 1846, 1848, 1847,
-     1850,   69, 1851, 1852, 1853, 1840, 1854,   69, 1843, 1839,
-
-     1841,   69,   69, 1855,   69, 1856, 2237, 1857, 1860, 1844,
-       69,   69,   69,   69, 1846, 1848, 1847, 1850, 1861,   69,
-       69, 1853, 1858,   69, 1859,   69,   69,   69, 1862, 1864,
-     1855, 1863,   69,   69, 1857, 1860, 1866,   69,   69, 2237,
-       69,   69, 1865, 1867, 1868, 1861, 1870, 1869,   69, 1858,
-     1871, 1859, 1872,   69, 1873, 1862, 1864, 1874, 1863,   69,
-     1875,   69, 2237, 1866, 1876,   69,   69, 1879, 1877, 1865,
-     1867, 1868,   69,   69, 1869, 1878,   69,   69, 1880, 1872,
-       69, 1873,   69, 1882, 1881, 1884, 1885, 1875, 1883,   69,
-       69, 1876, 1887, 1886,   69, 1877, 1889,   69,   69, 1888,
-
-     2237, 2237, 1878, 1890, 2237,   69, 1891,   69,   69, 1892,
-     1893, 1881, 1884, 1894,   69,   69,   69,   69,   69, 1887,
-     1886, 1899,   69, 1889,   69, 1896, 1888, 1897,   69, 1895,
-     1890, 1898, 1900, 1891,   69,   69, 1892, 1893,   69,   69,
-     1894, 1904, 1906, 1901, 1908,   69, 1902,   69, 1899,   69,
-       69,   69, 1896,   69, 1897, 1903, 1895, 1905, 1898, 1900,
-       69, 1914, 1907,   69, 1909,   69, 1910, 1912,   69, 1906,
-     1901,   69,   69, 1902,   69, 1913, 1911, 1915,   69, 1916,
-     2237, 1917, 1903,   69, 1905, 1920, 1918, 1919,   69, 1907,
-       69, 1909, 1922, 1910, 1912, 1923,   69, 1921,   69,   69,
-
-       69,   69, 1926, 1911, 1915, 1927, 1916,   69, 1917,   69,
-       69, 1928, 1920, 1918, 1919, 1929, 1924, 1931,   69, 1922,
-     1925, 1932,   69,   69, 1921, 1930, 1935,   69,   69, 1926,
-     1933, 2237,   69, 1934, 1936,   69, 1937, 1940, 1928,   69,
-     1938,   69,   69, 1924,   69, 1939,   69, 1925,   69, 1941,
-     1942,   69, 1930, 1943, 1944,   69, 1945, 1933,   69,   69,
-     1934,   69, 1946, 1937, 1940, 1948, 1947,   69, 1949, 1950,
-       69, 1955,   69, 1954, 2237, 1951, 1941,   69,   69, 1952,
-     1943, 1944,   69,   69,   69, 1957,   69, 1953,   69, 1946,
-       69, 1956, 1948, 1947,   69, 1949, 1950,   69,   69,   69,
-
-     1954, 1958, 1951, 1959,   69, 1960, 1952, 1961, 1962,   69,
-     2237, 2237, 1957, 1964, 1953, 1963, 1965,   69, 1956,   69,
-       69, 1966, 1969, 1970, 2237, 1972, 1973, 1971, 1958,   69,
-     1959,   69, 1960,   69, 1961, 1962,   69,   69, 1967,   69,
-     1964, 1974, 1963, 1965, 1968,   69,   69,   69, 1966,   69,
-     1970,   69,   69, 1973, 1971, 1975, 1976, 1977, 1978, 1982,
-     1980, 1981, 1984, 1979, 1983, 1967,   69, 1986,   69, 2237,
-     2237, 1968, 2237,   69,   69, 1985,   69,   69,   69, 1987,
-     1988, 1991, 1975, 1976, 1977,   69,   69, 1980, 1981, 1984,
-     1979,   69, 1992,   69,   69,   69, 1989,   69,   69, 1990,
-
-     2237, 1997, 1985,   69, 1993, 1994, 1987, 1988, 1991, 1995,
-     1999, 1998, 1996, 2000,   69, 2237, 2002,   69,   69, 1992,
-     2001,   69,   69, 1989, 2003, 2004, 1990,   69,   69,   69,
-     2008, 1993, 1994, 2006, 2010,   69, 1995, 1999, 1998, 1996,
-     2000, 2007,   69, 2005, 2013, 2011,   69, 2001,   69,   69,
-       69, 2003,   69,   69, 2009,   69,   69, 2012, 2016, 2014,
-     2006,   69,   69, 2017, 2015, 2022, 2020, 2018, 2007,   69,
-     2005,   69, 2011,   69,   69,   69,   69, 2019, 2021,   69,
-     2024, 2009, 2025, 2027, 2012, 2016, 2014,   69,   69, 2023,
-     2017, 2015,   69, 2020, 2018, 2026,   69,   69, 2029, 2030,
-
-     2028,   69, 2034, 2237, 2019, 2021, 2031,   69, 2032,   69,
-       69,   69,   69,   69, 2036, 2033, 2023, 2035, 2037,   69,
-       69, 2038, 2026,   69, 2040, 2029,   69, 2028,   69, 2034,
-       69, 2039,   69, 2031, 2043, 2032, 2042, 2041, 2044, 2048,
-     2045, 2036, 2033,   69, 2035,   69, 2049, 2047,   69,   69,
-     2051, 2040,   69, 2046,   69, 2050, 2052, 2054, 2039,   69,
-     2057,   69,   69, 2042, 2041, 2044,   69, 2045,   69, 2058,
-     2060,   69, 2061,   69, 2047, 2062, 2053, 2051,   69,   69,
-     2046, 2064, 2050, 2052,   69, 2055, 2056,   69,   69,   69,
-     2059, 2065, 2063, 2066,   69,   69,   69,   69,   69, 2061,
-
-     2067, 2068, 2062, 2053, 2070, 2237, 2071, 2069,   69,   69,
-     2072, 2073, 2055, 2056,   69,   69, 2074, 2059,   69, 2063,
-       69, 2075,   69,   69,   69, 2076, 2079, 2067,   69, 2077,
-     2080, 2070,   69, 2071, 2069, 2237, 2078,   69, 2073,   69,
-     2081, 2087, 2084, 2074, 2085,   69, 2237, 2082, 2075,   69,
-     2237,   69,   69, 2079,   69, 2086, 2077,   69, 2083,   69,
-       69, 2089,   69, 2078,   69,   69, 2088, 2081, 2087, 2084,
-       69, 2085, 2090,   69, 2082, 2093,   69, 2091, 2092, 2094,
-     2096,   69, 2086,   69, 2095, 2083, 2097,   69, 2089, 2098,
-     2099,   69, 2100, 2088, 2101, 2102, 2237, 2103, 2104, 2090,
-
-     2105,   69, 2093, 2107, 2091, 2092, 2094,   69, 2106,   69,
-     2109, 2095,   69,   69, 2108, 2111, 2098,   69, 2112,   69,
-       69,   69,   69,   69, 2103,   69, 2113, 2105, 2114, 2110,
-       69, 2115, 2116,   69,   69, 2106, 2117, 2109,   69, 2119,
-     2237, 2108, 2111,   69,   69, 2112, 2118, 2121,   69, 2122,
-     2124,   69, 2123,   69,   69,   69, 2110, 2125, 2115, 2116,
-       69, 2120, 2126,   69, 2127, 2128, 2119,   69, 2129,   69,
-     2130,   69, 2131, 2118, 2121, 2132, 2122,   69, 2133, 2123,
-     2135, 2134, 2137, 2138,   69, 2136,   69, 2139, 2120,   69,
-       69,   69,   69,   69,   69, 2129, 2140,   69, 2144,   69,
-
-       69, 2142, 2132, 2141,   69, 2133,   69,   69, 2134, 2137,
-       69,   69, 2136, 2143, 2139,   69, 2145, 2148,   69, 2146,
-     2147,   69,   69, 2140,   69, 2144,   69, 2150, 2142, 2149,
-     2141, 2157, 2237,   69, 2151, 2154, 2237,   69, 2153,   69,
-     2143,   69,   69, 2145, 2148,   69, 2146, 2147, 2152,   69,
-     2158, 2155, 2156, 2159, 2150, 2160, 2149,   69,   69,   69,
-     2161, 2151, 2154,   69, 2162, 2153, 2163, 2164,   69,   69,
-     2166, 2165, 2167, 2168, 2172, 2152, 2173, 2158, 2155, 2156,
-       69,   69, 2160,   69, 2169,   69,   69,   69,   69, 2171,
-     2174, 2162, 2170, 2163, 2164, 2175,   69,   69, 2165, 2167,
-
-       69,   69,   69,   69, 2176, 2177,   69, 2178,   69,   69,
-     2180, 2169,   69, 2179, 2181, 2182, 2171, 2174,   69, 2170,
-     2237,   69, 2175,   69,   69, 2183, 2184, 2185,   69, 2186,
-       69, 2176, 2177, 2187, 2178,   69, 2188, 2180, 2237, 2189,
-     2179, 2181, 2182, 2190, 2193, 2192, 2197,   69,   69, 2191,
-     2237, 2237, 2183, 2184, 2185, 2194,   69,   69,   69,   69,
-     2187,   69, 2200, 2188, 2195,   69, 2189, 2237, 2204, 2199,
-     2190,   69,   69, 2196, 2237,   69, 2191,   69,   69, 2198,
-     2201,   69, 2194,   69,   69, 2202, 2205,   69,   69, 2200,
-     2203, 2195, 2207,   69,   69, 2204, 2199, 2206, 2237, 2208,
-
-     2196, 2209, 2210, 2211,   69,   69, 2198, 2201,   69, 2212,
-     2216,   69, 2202, 2205, 2213, 2214, 2237, 2203,   69, 2207,
-     2237, 2218,   69,   69, 2206,   69, 2208, 2219, 2209, 2210,
-     2211, 2215,   69, 2222,   69,   69,   69, 2216, 2217,   69,
-     2225, 2213, 2214,   69, 2220, 2221,   69, 2223, 2218,   69,
-     2226, 2228,   69,   69, 2219,   69, 2224, 2229, 2215,   69,
-     2222, 2227, 2230, 2231,   69, 2217,   69, 2225, 2233, 2232,
-     2235, 2220, 2221, 2236, 2223, 2237,   69,   69,   69, 2234,
-     2237,   69,   69, 2224,   69,   69, 2237,   69, 2227, 2230,
-     2231,   69, 2237, 2237, 2237, 2233, 2232,   69, 2237, 2237,
-
-       69, 2237, 2237, 2237, 2237, 2237, 2234,   41,   41,   41,
-       41,   41,   41,   41,   46,   46,   46,   46,   46,   46,
-       46,   51,   51,   51,   51,   51,   51,   51,   57,   57,
-       57,   57,   57,   57,   57,   62,   62,   62,   62,   62,
-       62,   62,   72,   72, 2237,   72,   72,   72,   72,  131,
-      131, 2237, 2237, 2237,  131,  131,  133,  133, 2237, 2237,
-      133, 2237,  133,  135, 2237, 2237, 2237, 2237, 2237,  135,
-      138,  138, 2237, 2237, 2237,  138,  138,  140, 2237, 2237,
-     2237, 2237, 2237,  140,  142,  142, 2237,  142,  142,  142,
-      142,   73,   73, 2237,   73,   73,   73,   73,   13, 2237,
-
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237
+       14,   14,   18,   20,   21,   22,   23,   24,   25,   14,
+       26,   27,   28,   29,   30,   31,   32,   33,   34,   35,
+       36,   37,   38,   39,   40,   14,   14,   14,   14,   41,
+       20,   21,   22,   23,   24,   25,   14,   26,   27,   28,
+       29,   30,   31,   32,   33,   34,   35,   36,   37,   38,
+       39,   40,   14,   14,   14,   14,   43,   44,   45,   43,
+       44,   45,   48,   49,   48,   49,   50,   99,   50,   53,
+       54,   55,   56,   69,   18,   53,   54,   55,   56,   70,
+       18,   59,   60,   61,   59,   60,   61,   71,   79,  133,
+
+      133,   72,  101,   46,   99,  135,   46,  143,  135,   51,
+       74,   51,   74,   74,   70,   74,   71,   57,  140,  140,
+       72,   74,  147,   57,   70,   79,   76,   77,   62,  101,
+      922,   62,   15,   16,   17,   64,   65,   66,   15,   16,
+       17,   64,   65,   66,   78,   89,   70,   91,   75,  147,
+       70,   93,   67,   76,   77,   80,  143,  109,   67,   94,
+       70,   92,   81,   70,  828,   90,   82,  115,   70,   83,
+       68,   78,   89,   70,   91, 1021,   68,   70,   93,   67,
+       70,   70,   80,  100,  109,   67,   94,  146,   92,   81,
+      141,  149,   90,   82,  115,   70,   83,   84,   70,   95,
+
+      143,   85,   96,   70,   86,   70,   87,   88,  139,   97,
+      100,   98,  138,  125,  146,  126,  136,  106,  149,   70,
+      134,  107,   70,  148,   84,   70,   95,  102,   85,   96,
+      127,   86,  150,   87,   88,  103,   97,  108,   98,   70,
+      125,  104,  126,   70,  106,  105,   70,  128,  107,  153,
+      148,  143,  129,   70,  102,  141,   70,  127,   70,  150,
+       70,  116,  103,  130,  108,  117,  139,  131,  104,  155,
+      187,  132,  105,  110,  128,  118,  153,  111,  119,  129,
+      133,  133,   70,  112,   70,  154,  113,   70,  116,   70,
+      130,  161,  117,  114,  131,   70,  155,  187,  132,   70,
+
+      110,  207,  118,   70,  111,  119,   69,  167,   69,   69,
+      112,   69,  154,  113,  160,  138,   70,   69,  161,   70,
+      114,  120,  136,  137,  121,  137,  137,   74,  137,   74,
+       74,  122,   74,   70,  167,  123,  124,  142,  134,  142,
+      142,  160,  142,   70,   69,   70,   69,   69,  120,   69,
+      156,  121,  158,  159,  162,   69,  157,  151,  122, 2287,
+      164,   70,  123,  124,   74,  145,   74,   74,  176,   74,
+      152,   70,  163,   70,  166,   74,  170,  156,  165,  158,
+      159,   70,  168,  157,  151,   70,   70,  164,  169, 2287,
+       70,   70,  177,  171,  140,  140,  222,  152,   70,  163,
+
+       70,  166,   75,  170, 2287,  165,   70,  172,  178,  168,
+      173,   70, 2287, 2287, 2287,  169,   70,  181,  179,  177,
+      171,  182,  183,  174,  175,   70,  184,  186,   70,  185,
+      135,   70,  189,  135,  172,  178,  190,  173,  180,   70,
+       70,   70,  188,   70,  181,  179,   70,   70,  182,  183,
+      174,  175,   70,  184,  186,  191,  185,  192,  193,  189,
+      197, 2287,   70,  190,   70,  180,  194,   70,  196,  188,
+      195,  198, 2287,  202, 2287,   70, 2287,  199,   70,  203,
+       70,   70,  191,  200,  192,  193,   70,  197,   70,  201,
+      204,   70,  208,  194,  205,  196,  211,  195,  198,  206,
+
+      202,   70,  209,   70,  199,   70,  203,   70,  213,  212,
+      200,  224,  214,   70,   70,  217,  201,  204,  216,  208,
+       70,  205,  210,  211,  219,  218,  206,   70,   70,  209,
+       70, 2287, 2287,  215,   70,  213,  212,   70,  224,  214,
+       70, 2287,  217,  220, 2287,  216,   70,  221, 2287,  210,
+     2287,  219,  218,  137,  225,  137,  137,  228,  137,  142,
+      215,  142,  142,   74,  142,   74,   74,  143,   74,   70,
+      220,  223,  226,   70,  221,  227,  230,  235,  229,   70,
+       70,  225,  231,   70,  228,   70,  233,   70,  232, 2287,
+      234,  236, 2287, 2287,   70,  237, 2287,  244,  223,  226,
+
+      325,  145,  227,  230,  246,  229,  247,  248,   70,   70,
+      245,   70,  238,  233,   70,  232,   70,  234,   70,   70,
+      249,  255,  237,   70,  244,  251,   70,  250,   70,   70,
+       70,  246,  252,  247,  248, 2287, 2287,  245,   70,  238,
+      239, 2287,  256,   70,   70,  240,  257,  249,  255,   70,
+      241, 2287,  251, 2287,  250,  253,  242,  243,  254,  252,
+     2287,  258,  265,   70,   70,  264,  259,  239,   70,  256,
+       70,  266,  240,  257,  262, 2287,   70,  241,  260,  263,
+      261,  269,  253,  242,  243,  254,   70,   70,  258,  267,
+      270,  272,  264,  259,   70,  276,   70,   70,  266,  274,
+
+      268,  262,  273,  271,  275,  260,  263,  261,   70,   70,
+     2287,  277,  278,   70,  280,   70, 2287,  270,  284,  279,
+     2287,   70,  276,   70,   70,   70,   70,  268,  282,  273,
+      271,   70,  281,   70,  283,   70,   70,   70,  277,  278,
+       70,  280,  285,  287,  288,  284,  279,   70,   70,  286,
+       70,  290,  291,  289,   70,  282,  292,   70,  297,  281,
+       70,  283,   70,  293,  294,  295,   70,  298,  296,  285,
+      287,  288,   70,  299,   70,   70,  286,  301,  290,  291,
+      289,  300,  305,   70,  302,  297,  303,   70,   70,   70,
+      293,  294,   70,  310,  298,  296,  306,   70,  308,  312,
+
+      309,   70,   70,  311,  301,   70,  313,  314,  300,  304,
+       70,  302,  315,  307,   70,  143,  320, 2287,   70,  317,
+      310,   70,   70,  306,  319,  308,  316,  309,   70,   70,
+      311,   70,   70,  313,  314,   70,  304,   70,   70,  318,
+      307,  322,  323,  320,   70,  321,  317,   70,   70,  324,
+      326,  319,  327,  316,  328,  333, 2287, 2287,  330,   70,
+      329,  332,  331,  334,  337,   70,  318,   70,  322,  323,
+       70,   70,  321,   70,  336,   70,  324,  326,   70,  327,
+       70,  328,  333,  335,   70,  330,   70,  329,  332,  331,
+       70,  337,  338,  339,  340,   70,   70,  342, 2287,  341,
+
+      347,   70,  343,   70,  344, 2287,   70,  353,   70,  345,
+      335,  346, 2287,  348,   70,  349,   70,  367, 2287,  338,
+       70,  340,   70,   70,  342,   70,  341,  347,  350,  343,
+       70,  344,  351,   70,  352,  355,  345,   70,  346,   70,
+      348,   70,  349,  354,   70,  360,  363,  374, 2287,   70,
+       70,  365,  366,  361,  364,  350,   70,  356,  368,  351,
+       70,  352,  355,   70, 2287,  357,  358,   70,  359,   70,
+      354,  362,  360,  363,   70,   70,   70,   70,  365,  366,
+      361,  364,   70,  372,  356,  368,  369,  371,  373,  370,
+      375,  377,  357,  358,  376,  359,   70,  378,  362,   70,
+
+      382,   70,  380,   70,  385, 2287,   70,  379,  384,   70,
+      372,  381,   70,  369,  371,  373,  370,  375,  377,   70,
+       70,  376,   70,   70,  378,  386,  383,  391,  395,  380,
+       70, 2287,   70,   70,  379,  384,   70,  387,  381,  389,
+       70,  390,  396,  388, 2287,  392,   70,   70,  393,  397,
+      394,  400,  386,  383,  391,  395,   70,  401,   70,   70,
+     2287, 2287, 2287,   70,  387,  398,  389,  402,  390,   70,
+      388,   70,  392,  399,   70,  393,  397,  394,  400,   70,
+       70,  403,  405,  414,  401,  415,  413,  417,  418,  421,
+      416,  419,  398,  143,  402,   70,   70,  404,   70, 2287,
+
+      399,   70,   70,   70,  420,   70, 2287, 2287,  403,  405,
+      414,   70,  422,  413,  417,  418,  421,   70,  419,  424,
+      425,  423,  426,   70,  404,  406,  407,   70,  427,   70,
+     2287,  420,  428,  429,  431,  408,  430,  409,  410,  411,
+       70,   70,  412,  432,   70,   70,  424,  425,  423,  426,
+       70,  434,  406,  407,   70,  427, 2287,  437,   70,  428,
+      429,  431,  408,  433,  409,  410,  411,  436,   70,  412,
+      432,  435,  443,   70,  438,  439,   70,  441,   70,   70,
+      440,  442,  445,   70,  437,   70,  444,   70,   70,  457,
+      433,  446,   70,  448,  436,  454, 2287,  449,  435,  443,
+
+     2287,  453,   70,   70,  441,   70,  447,  440,  442,  445,
+       70,   70,  450,  444,   70,  455,  456,   70,  446,   70,
+      448,   70,  454,  451,  449,  452,  458,  459,  453,  461,
+       70,  468,   70,  447,   70,  460, 2287,  462,   70,  450,
+      463,  464,  455,  456,   70,  466, 2287,  465,   70,  467,
+      451,   70,  452,  458,  459,   70,  461,  469,   70,   70,
+      471,  472,  460,   70,  462,  470,   70,  463,  464,   70,
+      473,   70,  466,  475,  465,   70,  467,  476,  474,   70,
+       70, 2287,   70,  478,  469,   70,  477,  471,  472,   70,
+      479, 2287,  470,   70,  480,  481,   70,  473,  490,  482,
+
+      475,   70,  484,   70,  476,  474,  483,  488,   70,   70,
+      478,  495,  485,  477,   70,  489,   70,  479,   70,  491,
+       70,  480,  481,  486,   70,  487,  482,   70,   70,  484,
+       70,  492,   70,  483,  488,  493,  494,   70,  496,  485,
+      497,  500,  489,   70,  501,   70,  491,  498,   70,  504,
+      486,  502,  487,   70,   70,   70,   70, 2287,  492,  506,
+     2287,  505,  493,  494,   70,  496,   70,  497,  500,  503,
+      499,  501,   70,   70,  507,   70,  504,  515,  502,   70,
+      517,   70,  508, 2287,   70,   70,  506,  516,  505,  518,
+       70,   70,  520,  521, 2287,   70,  503,  499, 2287,  519,
+
+       70,  507, 2287,  522,  515,  524,  523,  517,   70,  508,
+      509,  525,  526, 2287,  516,  510,   70,  511, 2287,  520,
+      521,   70,  527,   70,  536,  512,  519,   70,  513,   70,
+      522,   70,  524,  523,   70,  514,   70,  509,  525,  526,
+      528,  529,  510,  530,  511,  531,   70,  533,   70,  527,
+      532,  537,  512,  535,  534,  513,   70, 2287,   70,   70,
+      538,  539,  514,   70,  541,   70,   70,  528,  529,   70,
+      530,  540,  531,  542,  533,   70,  143,  532,  537,  543,
+      535,  534,  544,  546,   70,   70,  545,  538,  539,   70,
+      547,  541,   70, 2287,  548,  549,  551,  550,  540,  552,
+
+      542,   70,  553,  555,  558,   70,   70,   70,  556,  559,
+       70,  557,  560,  545,   70,   70,  554,  547,   70,   70,
+       70,  548,  549,  551,  550,   70,  552,   70,  561,  553,
+      562,   70,  563,  564,  565,   70,   70,  569,  557,   70,
+      566, 2287, 2287,  554,   70,  568,  567,  570,   70,  571,
+      574, 2287,  573,  572,  580,   70,   70,   70,   70,   70,
+      564,  565,  575,   70,   70,   70,  581,  566,   70,   70,
+       70, 2287,  568,  567,  570,   70,  571,  576,  577,  573,
+      572,  580,   70,  578,   70,  582,  583,  579,  585,  575,
+       70,  586,   70,  581,   70,  584,  587,  589,  588, 2287,
+
+     2287,   70,   70,   70,  576,  577, 2287,  590,   70,  592,
+      578,  593,  582,  583,  579,  585,   70,   70,  586,  600,
+      596,   70,  584, 2287,  589,  588,  594,  595,   70,  591,
+       70,   70,  597,   70,  590,  598,  592,   70,  593,  601,
+      599,   70,   70,  604,  602,  603,   70,  596,  605,  607,
+       70,   70,  609,  594,  595,   70,  591,   70,  608,  597,
+       70,  606,  598,  610,  611,   70,  601,  599,   70,   70,
+      604,  602,  603,  612,   70,  605,  616,  618,  613,  614,
+       70,   70,  615,  619,   70,  608,   70,   70,  606,  617,
+      610,  611,  621,   70,  626,   70,   70,   70,  620,  622,
+
+      623,  627, 2287,   70,  618,   70,  614,   70,   70,  615,
+      619,  628,  624, 2287,   70,  629,  617,  625,  630, 2287,
+       70,  626,   70,   70,   70,  620,  622,  623,  627,  633,
+      631,  632,  635,  636,  634,  637,   70,   70,  628,   70,
+       70,   70,  629,   70,   70,  630,  641,   70, 2287, 2287,
+      644,   70,  646,  640,  638,   70,  633,  631,  632,  635,
+      636,  634,  637,   70,  639,   70,  642,  643,   70,  645,
+     2287,  648,   70,  647,   70,   70,   70,  644,   70,  646,
+      640,  638,   70,  651,  652,  650,  654,  653, 2287,  649,
+     2287,  639,   70,  642,  643,   70,  645,   70,  648,   70,
+
+      647,  655,  657,   70,  659,  661,   70,   70,   70,  656,
+      651,  652,  650,  654,  653,  658,  649,   70,   70,  660,
+      662, 2287,   70,   70,  664,  663,  665,  143,  655,  657,
+       70,  659,  661,   70, 2287,  666,  656,   70,  668,  669,
+      671,  670,  658,  667,   70, 2287,  660,  662,   70,   70,
+      673,  664,  663,   70,  674,  675,  672,   70,  676,  677,
+     2287,   70,  666,   70,   70,   70,  669,  678,  670,   70,
+      667,  691,   70,   70,  689,  688,   70,  673,   70,  687,
+      686,  674,  675,  672,  680,  679,  677,   70,  692,   70,
+       70,   70,   70,   70,  678,   70,  690,   70,  691,  693,
+
+     2287,  689,  688, 2287, 2287, 2287,  687,  686, 2287,  703,
+      701,  680,  679,  681,   70,  692,  702,  682,   70,   70,
+      683,  705,   70,  690,  704,  706,   70,  684,  711,  707,
+      685,   70,   70,  724, 2287,   70,  703,  701, 2287,  708,
+      681,  709,   70,  702,  682,   70,  710,  683,  705,   70,
+       70,  704,   70,   70,  684,  711,  707,  685,  694,  695,
+      724,  696, 2287,  712,  697,   70,  708,  713,  709,  698,
+      714,  716,   70,  710, 2287,  699,  700,  715,  717,   70,
+     2287, 2287,  721,  729,   70,  694,  695,   70,  696,   70,
+      712,  697,   70,  718,  713,   70,  698,  714,  716,  719,
+
+       70,   70,  699,  700,  715,  717,  720,   70,   70,  721,
+      722,  723,  725,  726,  727,   70, 2287,  730,  731, 2287,
+      718,  728,   70,  732,   70,   70,  719,   70,  733, 2287,
+      739,  736,  734,  720,  742,   70,  737,  722,  723,  725,
+      726,   70,   70,   70,   70,  731,  738,   70,  728,   70,
+      732,   70,  735,   70,   70,  733,   70,   70,  736,  734,
+      740,   70,  741,  737,  743,  744,   70,  745,  747,  746,
+      750,  748,   70,  738,  749, 2287, 2287, 2287,   70,  735,
+      751,   70,   70,   70,   70,   70,  752,  740,   70,  741,
+       70,  743,  744,   70,  745,  747,  746,  750,  748,  753,
+
+       70,  749,   70,  754,   70,  757,  756,  751,  758,  760,
+      761,  755,  759,  752,   70,   70,  762,   70,  763,  765,
+      766,   70,  764,  768, 2287,   70,  753,   70,  772,   70,
+      754,   70,   70,  756,   70,  758,  760,  761,  755,  759,
+       70,   70,   70,  762,  767,  763,  765,  766,  769,  764,
+      768,  770,   70,  771,  773,   70,  774,  775,  776,  777,
+      778,   70, 2287,   70,   70, 2287,  781,  782,   70,   70,
+      783,  767,  784,   70,   70,  769,  779, 2287,  770,  790,
+      771,  773,   70,  774,  780,  785,  777,  778,   70,   70,
+       70,   70,  786,  781,  782,  788,   70,  783,  789,  787,
+
+     2287,   70,  792,  779,   70,   70,   70,  791,  793,   70,
+      794,  780,  785,   70,  795,  796,   70,  797,   70,  786,
+       70,  798,   70,  806,  807,  789,  787,   70,   70,  143,
+       70,  808,  799,   70,  791,  793, 2287,  794,   70, 2287,
+      810,  795,  796,   70,  797,  811, 2287,   70,  798,   70,
+      806,  807,  809,  812,   70, 2287,  813,   70,  808,  799,
+      800,  816,  801,   70,  818,  814,  802,  810,  803,   70,
+      815,  817,  811,  804,   70,   70,   70, 2287,  805,  809,
+      812,  821,  819,  813,   70,  825,  822,  800,  816,  801,
+      823,  818,  820,  802,   70,  803,   70,   70,  817,   70,
+
+      804,  824,  826,   70,   70,  805,   70, 2287,  821,  819,
+      827, 2287,  825,  822,   70,  834, 2287,  823, 2287,  820,
+      836,  837,  835, 2287,  838,  846, 2287,  840,  824, 2287,
+       70,  839,  842,   70,   70,  844,   70,   70,  829,  841,
+       70,  850,  834,  830,   70,  831,   70,  836,  837,  835,
+       70,  838,   70,   70,  840,  845,  832,   70,  839,  842,
+      843,  847,   70,  833,   70,  829,  841,  848,   70,  855,
+      830,  851,  831,   70,  853,   70,  852,  849,   70,  854,
+       70,  856,  845,  832,   70,   70, 2287,  843,  847,  857,
+      833,   70,   70,   70,  848,  859,  855,   70,  851,  861,
+
+      858,  853,  860,  852,  849,  863,  854,   70,   70,   70,
+      864,  862,   70,   70,  865,  868,  857,   70,   70,  875,
+      866, 2287,  859,   70,   70, 2287,  861,  858,   70,  860,
+      870,  867,  863,   70,  871, 2287,  869,  864,  862,   70,
+      872,  873,  868,  874,  877, 2287,   70,  866,   70,  878,
+      876,   70,   70,  883,  879,   70,   70,  870,  867,   70,
+      882,  871,   70,  869,   70,  886,   70,  872,  873,   70,
+      874,  877,  880,  885,  890,  881,  884,  876, 2287,  887,
+      883,   70,  891,   70,   70,   70,   70,  882,  888,  889,
+      896,  893,  894,  895,  892,   70,   70,   70,   70,  880,
+
+      885,  890,  881,  884,   70,   70,  887,  898,   70,  891,
+      899,   70,   70,   70,   70,  888,  889,  896,  893,  894,
+      895,  892,  897,  900,  902,  905,  901,  903,   70,  906,
+      904,  907,   70,   70,  898,   70,   70,   70,   70,  908,
+      909,   70,  912,   70,  911,  913,  910,  914,   70,  897,
+      900,  902,  905,  901,  903,   70,  906,  904,   70,  915,
+       70,   70,   70,   70, 2287,  916,  908,  909,   70,  912,
+      918,  911,  913,  910,  917,  919,  920,   70,  921,   70,
+      924,  923,  926,   70,   70,  931,  925,  927,  929,   70,
+       70,   70,  916,   70,   70,   70,   70,   70,   70,  928,
+
+       70,  917,  919,  920,  930,  921,  932,  924,  923,  926,
+      933,   70,   70,  925,  927,  929,  934,   70,  935,  940,
+      936,  937,  938,  939, 2287,  944,  928,   70, 2287, 2287,
+      942,  930,   70,   70,   70,   70,  941,  933,   70, 2287,
+       70,   70,   70,  934,   70,  935,  940,  936,  937,  938,
+      939,  943,   70,  945,  947,  946,   70,  942,  948,   70,
+      952,  953,  949,  941,   70,   70,   70,  956,  957, 2287,
+      954,  963, 2287,  950,  959,   70,  951,   70,  943,  955,
+      945,  947,  946,   70,   70,  948,   70,  952,  953,  949,
+       70,   70,   70,  958,  956,  957,   70,  954,   70,  960,
+
+      950,  959,  961,  951,  962,  964,  955,   70,  967,  965,
+      966,   70,   70,  968,  969,  970,   70,  972, 2287,  979,
+      958,  999,   70,   70,   70,   70,  960,   70,   70,  961,
+       70,  962,  964,  974,   70,  967,  965,  966,  971,  973,
+      968,  969,  970,  975,  972,  976,   70,  983,   70,  977,
+      978,   70,   70,   70,   70,   70,   70,  982,  980,  981,
+      974,  990, 2287, 2287,   70,  971,  973,  984,   70,   70,
+      975,   70,  976,  987,  983,  985,  977,  978,   70,  988,
+      986,   70,   70,  989,  982,  980,  981,   70,  990,  997,
+      998, 1001,   70, 1010,  984, 1000, 2287,   70, 2287, 2287,
+
+      987, 1005,   70,   70, 1003, 1002,  988,   70,   70, 2287,
+      989,  991, 1004,   70,  992,  993,  997,  998, 1001,  994,
+     1010,   70, 1000,   70, 1040,  995,   70,   70, 1005,  996,
+     1006, 1003, 1002,   70,   70, 1007, 1008,   70,  991, 1004,
+     1011,  992,  993, 1012, 1013, 2287,  994, 1009, 2287, 1022,
+     1014,   70,  995,   70, 1020, 2287,  996, 1006,   70, 1023,
+       70, 1025, 1007, 1008, 2287,   70,   70, 1024, 2287, 1061,
+       70, 1013,   70,   70, 1009,   70, 1022, 1014, 1015,   70,
+       70, 1020,   70, 1016, 1026, 1017, 1023, 1018, 1025, 1019,
+     1027, 1029, 1031, 1033, 1024, 1028,   70, 1030, 1032, 1034,
+
+       70,   70,   70, 2287,   70, 1015,   70, 1038, 1039,   70,
+     1016, 1026, 1017, 1036, 1018,   70, 1019,   70, 1029, 1031,
+     1033,   70,   70, 1035, 1030, 1032, 1034, 1041, 1037, 1042,
+       70,   70, 1046, 1043, 1038, 1039,   70,   70, 1045,   70,
+     1036, 1044, 1047, 1048, 1049, 1050,   70, 1051, 1054,   70,
+     1035,   70, 1056, 2287, 1041, 1037,   70,   70, 1062,   70,
+     1043, 1053, 1055,   70, 1063, 1045,   70,   70, 1044, 1047,
+       70, 1049, 1050, 1052,   70, 1054, 1057, 1058,   70, 1056,
+       70, 1059, 1060,   70,   70,   70,   70, 1064, 1053, 1055,
+       70, 1063, 2287, 1065, 1066, 1068,   70, 1067,   70, 1069,
+
+     1052,   70,   70, 1057, 1058, 1070,   70, 1072, 1059, 1060,
+     1071,   70,   70,   70,   70, 1077, 1076, 1073, 1075,   70,
+     1065, 1066,   70, 1074, 1067,   70, 1069, 1078,   70, 1079,
+       70,   70, 1070, 1080, 1084, 1083,   70, 1071, 1082,   70,
+       70, 1086, 1077, 1076, 1073, 1075, 1081,   70,   70, 1085,
+     1074, 1087, 1090,   70, 1078,   70, 1079,   70, 1091,   70,
+     1080,   70, 1083,   70, 1088, 1082, 1097, 1092, 1086, 1089,
+       70, 1093, 1099, 1081, 1094, 1098, 1085,   70, 1087, 1090,
+       70, 1095, 1100,   70, 1096, 1091, 2287, 1102,   70, 2287,
+     1101,   70, 2287, 1097, 1092,   70,   70, 1105, 1093, 1103,
+
+       70, 1094, 1098,   70,   70,   70,   70, 1104, 1095, 1100,
+     1108, 1096, 1106, 1107, 1102, 1110,   70, 1101, 1109,   70,
+       70,   70, 1112,   70, 1105, 1116, 1103,   70, 1111, 1113,
+     1115, 1117, 1114,   70, 1104,   70, 1120, 1108,   70, 1106,
+     1107,   70, 1110,   70,   70, 1109, 1118,   70, 1121, 1112,
+     1123,   70, 1116, 1119,   70, 1111, 1113, 1115, 1117, 1114,
+     1122, 1124,   70, 1120, 1125, 1126, 1127,   70,   70, 1128,
+     2287,   70,   70, 1118,   70, 1121, 1129, 1123, 1130, 2287,
+     1119, 1131, 1132, 1133, 2287, 1137,   70, 1122, 1124, 1135,
+     2287, 1125,   70, 1134, 1136,   70, 1128,   70,   70, 1139,
+
+       70,   70,   70, 1129,   70,   70,   70, 1140, 1131, 1132,
+     1133,   70, 1137, 2287,   70, 1138, 1135, 1141,   70, 1142,
+     1134, 1136,   70, 1143, 1151, 1147, 1139,   70, 1144,   70,
+       70, 1145,   70, 1148, 1140, 1149, 1146, 1150, 1152,   70,
+     1153,   70, 1138,   70, 1141,   70, 1142, 1154,   70, 1155,
+     1156, 1157, 1147, 1158, 2287,   70,   70, 1160,   70,   70,
+     1148,   70, 1149,   70, 1150, 1152, 1161, 1153,   70, 1163,
+       70, 1159,   70, 1162, 1154, 1164, 1165, 1156, 1157,   70,
+     1158,   70, 1166, 1167, 1160,   70, 1170, 1169, 1168, 1177,
+     1175,   70, 1171, 1161, 1184,   70, 1163,   70, 1159,   70,
+
+     1162,   70, 1164, 1165,   70,   70,   70, 1176, 1172,   70,
+     1167,   70, 1173, 1170, 1169, 1168,   70, 1175,   70, 1171,
+     1178, 1179, 1180, 1181, 1183, 1174,   70, 1182, 1185, 1186,
+       70,   70, 2287,   70, 1176, 1172,   70, 1187,   70, 1173,
+     1188, 1189,   70, 1190,   70,   70, 2287, 1178, 1179, 1180,
+     1181, 1183, 1174, 1191, 1182,   70, 1186, 1192, 1193,   70,
+     1194, 1196, 1195,   70, 1187, 1197,   70, 1188,   70, 1198,
+       70, 1199, 1200,   70,   70, 1203, 1204, 1201,   70, 1205,
+       70,   70,   70,   70, 1192, 1193,   70, 1194, 1196, 1195,
+     1202,   70, 1197, 1206, 1209,   70, 1198,   70, 1199,   70,
+
+       70,   70, 1203, 1204, 1201, 1207, 1205, 1208, 1213, 1210,
+     1211, 2287, 1212,   70, 2287, 1214,   70, 1202,   70, 1215,
+     1206,   70,   70,   70, 1218, 1216,   70, 1217, 1219,   70,
+       70,   70, 1207, 1221, 1208, 1213, 1210, 1211,   70, 1212,
+     1220, 1222, 1214,   70, 1223, 1224, 1215, 1225,   70,   70,
+     1227, 1218, 1216,   70, 1217, 1219, 1226, 1228,   70, 1229,
+       70, 1230,   70, 1234,   70,   70, 1231, 1220, 1222, 1232,
+     1233,   70, 1224, 1240,   70,   70,   70, 1227, 2287, 1241,
+     1235,   70, 1242, 1226, 1228,   70, 1229,   70, 1230,   70,
+     1234, 1236, 1245, 1231,   70,   70, 1232, 1233,   70, 1237,
+
+       70,   70, 1238, 1243, 1246,   70, 1241, 1235, 1244, 1242,
+       70, 1247, 1248, 1251, 1239, 1250,   70, 1253, 1236, 1245,
+     1249,   70,   70,   70, 1252,   70, 1237, 1254,   70, 1238,
+     1243,   70, 1256, 1255, 1257, 1244,   70,   70, 1247, 1248,
+     1261, 1239, 1250, 1258, 1265,   70,   70, 1249, 2287,   70,
+     1259, 1252,   70,   70, 1254,   70,   70,   70, 1260,   70,
+     1255, 1257, 1262, 1263, 1266,   70, 1264, 1261, 1268, 1270,
+     1258,   70, 1267, 2287, 1273,   70,   70, 1259,   70,   70,
+       70,   70, 1269, 1272, 1275, 1260, 1274, 1271,   70, 1262,
+     1263, 1266, 1279, 1264,   70, 1268,   70,   70,   70, 1267,
+
+       70, 1273, 1278, 1276,   70,   70,   70, 1277, 1280, 1269,
+     1272, 1275, 1283, 1274, 1271, 1281,   70, 1287, 1282, 1279,
+       70, 1288, 1286,   70,   70, 1291, 1284, 1289,   70, 1278,
+     1276, 1285, 1290,   70, 1277, 1280, 1299, 1293,   70, 1283,
+       70, 2287, 1281, 1297,   70, 1282, 1292,   70,   70, 1286,
+     1298,   70, 1291, 1284, 1289,   70, 2287,   70, 1285, 1290,
+     1294,   70, 1295,   70, 1293, 1296, 1302, 1300,   70, 1301,
+     1297, 1303, 2287, 1292,   70,   70, 1305, 1304, 1311, 1306,
+       70,   70,   70,   70,   70, 1308, 1307, 1294,   70, 1295,
+     1309,   70, 1296, 1302, 1300,   70, 1301, 1310, 1303, 1316,
+
+       70,   70, 1312, 1305, 1304, 1311, 1306, 1314,   70, 1317,
+     1315,   70, 1308, 1307, 1318,   70, 1313, 1309, 1319, 1321,
+     1322, 1320, 1323, 1324, 1310,   70, 1316, 2287,   70, 1312,
+       70, 1326, 1325, 1327, 1314, 2287, 1329, 1315,   70, 1331,
+     1328,   70, 1330, 1313,   70, 1332,   70,   70, 1320, 1323,
+       70, 1339,   70,   70,   70,   70, 1333, 2287, 1326, 1325,
+       70, 1336, 1334, 1329,   70,   70, 1331, 1328, 1335, 1330,
+       70,   70, 1332, 1337, 1340, 1341,   70, 1338,   70, 1345,
+     2287,   70, 2287, 1333,   70, 1342,   70, 1343, 1344, 1334,
+     1346, 1347, 1348,   70,   70, 1335, 1350,   70,   70, 2287,
+
+     1337, 1340, 1341,   70, 1338, 1351, 1345,   70, 1349,   70,
+       70, 1352, 1342, 1355, 1343, 1344,   70, 1346, 1347,   70,
+       70,   70, 1353, 1350, 1354, 1356,   70, 1357, 1359, 1358,
+       70,   70, 1351, 1360, 1361, 1349,   70, 1362, 1352, 1364,
+       70, 1367, 1366, 1365, 1363,   70, 2287, 2287,   70, 1353,
+       70, 1354, 1356, 1371, 1357,   70, 1358,   70,   70,   70,
+     1360,   70,   70, 1372, 1362, 1369,   70,   70, 1367, 1366,
+     1365, 1363, 1368, 1370,   70,   70, 1373,   70, 1378, 1375,
+     1371,   70,   70, 1374, 1376,   70, 1379, 1380, 1381, 1385,
+     1372,   70, 1369, 2287, 1387,   70, 1383, 1377,   70, 1368,
+
+     1370,   70,   70, 1373,   70, 1378, 1375, 1389, 1390, 1382,
+     1374, 1376, 1384, 1379,   70,   70,   70, 1392, 1386,   70,
+       70,   70, 1388, 1383, 1377,   70, 1391, 1393,   70, 1394,
+     1395,   70, 2287, 1397,   70, 1390, 1382, 1398,   70, 1384,
+     1396,   70,   70, 1399, 1392, 1386, 1400, 2287, 1405, 1388,
+     1407, 2287, 2287, 1411, 1406,   70, 1394,   70,   70,   70,
+     1397,   70,   70, 1409,   70, 1412,   70, 1396, 1410,   70,
+     1399, 1416, 1401, 1402, 1403, 1405, 1408, 1413,   70, 1404,
+     1411, 1406,   70,   70, 1414, 1415, 1419,   70, 1418,   70,
+       70, 1425, 1412,   70,   70,   70,   70, 1421, 1416, 1401,
+
+     1402, 1403, 1417, 1408, 1413, 1422, 1404, 1420,   70,   70,
+     1424, 1414,   70,   70, 1423, 1418, 1427,   70,   70,   70,
+     1426, 1428,   70,   70, 1421, 1430, 1431, 1429, 2287, 1417,
+     1432,   70, 1422, 1433, 1420, 1435,   70, 1424,   70,   70,
+     1437, 1423, 1436, 1427,   70,   70,   70, 1426,   70, 1434,
+       70, 1438, 1430, 1431, 1429, 1439, 1440, 1432,   70,   70,
+     1433, 1441, 1435, 1442,   70, 1443, 2287, 1444, 1447, 1436,
+     1445, 1446,   70, 2287, 2287,   70, 1434,   70, 1438,   70,
+     1448, 2287, 1439,   70, 1451,   70, 2287,   70,   70, 1453,
+       70, 1449, 1443,   70, 1444, 1447, 1452, 1445, 1446, 1458,
+
+       70, 1450,   70, 1456,   70, 1454, 1455, 1448,   70, 1457,
+       70, 1451,   70, 1459,   70,   70, 1453,   70, 1449, 1460,
+     1461, 1464,   70, 1452, 2287, 1465, 1458, 1468, 1450, 1466,
+     1456,   70, 1454, 1455,   70, 1469, 1457,   70, 1462, 2287,
+     1459, 1472,   70, 1463, 1467, 1470, 1460,   70,   70, 1474,
+     1471,   70, 1465, 1475,   70, 1477, 1466, 1473,   70,   70,
+     1476, 1479,   70,   70,   70, 1462, 1478, 1480, 1482, 1481,
+     1463, 1467, 2287,   70,   70,   70, 1474,   70,   70, 1483,
+     1484,   70, 1477, 1485, 1473,   70, 1486, 1476, 1479, 1487,
+     1488, 1489, 2287, 1478,   70, 2287, 1481,   70, 1490,   70,
+
+       70, 1492, 1491, 1493,   70, 1494, 1483, 1484, 2287,   70,
+     1485, 1495, 1499,   70, 2287, 1501,   70, 1488, 1496,   70,
+     1503,   70,   70,   70,   70, 1490, 1497,   70, 1492, 1491,
+     1493, 1498, 1494,   70, 1500,   70, 1504,   70, 1495,   70,
+     1502,   70, 1501,   70, 2287, 1496,   70,   70, 1505, 1507,
+     1506, 1508,   70, 1497, 1510, 2287, 1511,   70, 1498,   70,
+     1509, 1500,   70, 1504, 1514, 1517,   70, 1502, 1512,   70,
+     1515, 1516, 1519,   70,   70, 1505, 1507, 1506, 1508, 1513,
+     1520, 1521,   70, 1511,   70, 1518,   70, 1509,   70,   70,
+     1522, 1514,   70,   70,   70, 1512,   70, 1515, 1516, 1519,
+
+       70, 1523, 2287, 1525, 1524, 1526, 1513, 1520, 1528, 2287,
+     1529, 2287, 1518,   70, 1527,   70, 1531, 1522, 1532, 1539,
+     1530, 2287,   70, 2287,   70, 1533,   70,   70, 1523,   70,
+       70, 1524, 1526,   70,   70, 1528,   70, 1529,   70, 1534,
+       70, 1527, 1537, 1531, 1536, 1532, 1539, 1530, 1535,   70,
+     1540, 1541, 1533, 1542,   70, 1538,   70, 1543, 2287, 1544,
+     1548, 1546,   70,   70,   70,   70, 1534, 1545,   70, 1537,
+     1547, 1536, 1549, 1550, 1555, 1535, 1551, 1540,   70, 1553,
+     1542,   70, 1538,   70, 1543,   70, 1544, 1548, 1546,   70,
+     1552, 1557,   70, 1559, 1545,   70,   70, 1547, 1554, 1549,
+
+     1550,   70, 1558, 1551,   70, 1561, 1553, 2287,   70, 1556,
+       70,   70, 1560,   70,   70,   70, 1562, 1552, 1557, 1563,
+     1559, 1565, 1564,   70, 1573, 1554, 1566,   70, 1568, 1558,
+     1567, 1569, 1561, 1570,   70,   70, 1556, 2287,   70, 1560,
+     1571,   70, 1574, 1562,   70,   70, 1575, 1572, 1565, 1564,
+     1576,   70,   70, 1566,   70, 1568,   70, 1567,   70,   70,
+     1570, 1577, 2287, 1578,   70,   70, 2287, 1571, 2287, 1574,
+     1581,   70, 1583, 1575, 1572, 1579, 1582, 1576, 1580, 1585,
+     1584, 2287,   70, 2287, 1589, 2287, 1586,   70, 1577,   70,
+     1578,   70, 1587,   70,   70,   70, 1588, 1581,   70,   70,
+
+     1590, 1591, 1579, 1582, 1592, 1580, 1585, 1584,   70,   70,
+       70, 1589,   70, 1586,   70, 1594, 1597, 1593, 1595, 1587,
+     1596, 1598,   70, 1588, 1600,   70, 1602, 1590, 1591, 1601,
+       70, 1592, 1599, 1603,   70, 1605,   70,   70, 1604, 1607,
+     1606, 1609, 1594, 1597, 1593, 1595, 1613, 1596,   70,   70,
+       70,   70,   70, 1602, 1608,   70, 1601, 1610,   70, 1599,
+     1603,   70, 1614, 1616,   70, 1604, 1607,   70,   70, 1615,
+     1617, 1611, 1618, 1613, 1620, 2287, 1622, 2287,   70,   70,
+     1619, 1608, 1612,   70, 1610, 1623, 1621, 1624, 2287,   70,
+     1616, 1625,   70,   70, 1626,   70, 1615, 1617, 1611,   70,
+
+     1629,   70,   70, 1622,   70, 1628, 1632, 1619,   70, 1612,
+       70, 1627, 1623, 1621, 1624,   70,   70,   70, 1625, 1630,
+     1631, 1626,   70, 1634, 2287, 1633, 1637, 1629,   70, 1635,
+     1646,   70, 1628,   70,   70,   70, 1636,   70, 1627, 1639,
+     2287, 1638, 1640,   70, 1643,   70, 1630, 1631,   70,   70,
+     1634,   70, 1633, 1637, 1641, 1642, 1635,   70, 1644,   70,
+     1645,   70,   70, 1636,   70, 1647, 1639, 1649, 1638, 1640,
+     1648, 1643,   70, 1651, 1650, 1652, 1653, 1655, 1654, 1659,
+       70, 1641, 1642, 1656,   70, 1644, 1660, 1645,   70,   70,
+       70,   70, 1647, 1657, 1649, 1661, 1658, 1648, 1665,   70,
+
+     1651, 1650,   70,   70, 1655, 1654,   70, 1662,   70,   70,
+     1656,   70, 1663, 1660,   70, 1664, 1666,   70, 1667,   70,
+     1657, 1668, 1661, 1658, 1669,   70,   70, 1670, 1671, 1673,
+       70, 1672, 1675,   70, 1662, 1674, 1677,   70, 1676, 1663,
+     1678, 2287, 1664,   70,   70, 1667,   70, 1679,   70,   70,
+     1683, 1669, 1680, 1684,   70,   70, 1673,   70, 1672,   70,
+     1681,   70, 1674,   70, 1686, 1676, 1685, 1678,   70, 1687,
+     1690, 1691,   70, 1692, 1679, 1682,   70,   70,   70, 1680,
+     1684, 1688,   70, 1694, 1693, 1689,   70, 1681,   70,   70,
+     1698, 1686,   70, 1685,   70, 1696,   70, 1690, 1691, 1695,
+
+       70, 1699, 1682, 1697,   70, 2287,   70, 1700, 1688, 1701,
+       70, 1693, 1689, 1702, 1713,   70,   70, 1698, 1703,   70,
+       70, 1705, 1696, 1704,   70, 1706, 1695,   70, 1699, 1707,
+     1697, 1708,   70, 2287, 1700,   70, 1701,   70, 1714, 1709,
+     1702, 1710, 1711,   70, 2287, 1703,   70,   70, 1705, 1712,
+     1704,   70, 1706, 1716, 1718, 1717, 1707,   70, 1708,   70,
+       70,   70,   70, 1715, 1733, 1714, 1709, 1719, 1710, 1711,
+       70,   70, 1721, 1723, 1722, 1720, 1712, 1724, 1726,   70,
+     1716,   70, 1717, 1725, 1727,   70,   70, 1730, 1728,   70,
+     1715,   70, 1729,   70, 1719,   70,   70, 1732,   70, 1721,
+
+     1723, 1722, 1720,   70, 1724, 1726, 1731, 1734, 1735,   70,
+     1725, 1727,   70,   70, 1730, 1728,   70, 1736, 1737, 1729,
+     1738, 1741, 2287, 2287, 1732, 1739, 2287, 1740, 1742, 1743,
+       70, 1744, 1747, 1731,   70, 1735,   70,   70,   70, 1745,
+     1746,   70, 1755, 1748, 1749, 2287, 2287,   70, 1741,   70,
+       70,   70, 1739,   70, 1740, 1742, 1743,   70, 1744,   70,
+     1751, 1750,   70, 1752,   70,   70, 1745, 1746,   70, 1753,
+     1748, 1749, 1754,   70,   70, 1757,   70, 1756, 1758, 1759,
+     1760, 1761, 1762, 1769,   70, 2287,   70, 1751, 1750,   70,
+     1752, 1764, 1765, 2287,   70, 1767, 1753, 1763,   70, 1754,
+
+       70,   70, 1757, 1768, 1756, 1758, 1759,   70, 1761, 1762,
+       70, 1771,   70, 1766,   70,   70,   70,   70, 1764, 1765,
+     1770,   70, 1767, 1772, 1763, 1773,   70, 1774, 1777, 1775,
+     1768, 1776, 1778, 1779, 1780,   70,   70, 1781,   70, 1782,
+     1766,   70, 1786, 1788,   70, 1783, 1791, 1770,   70, 1784,
+     1772,   70,   70,   70, 1774,   70, 1775,   70, 1776,   70,
+       70, 1780, 1785, 1787, 1781,   70, 1782,   70, 1790,   70,
+     1789, 1793, 1783,   70, 1792,   70, 1784,   70, 1795,   70,
+       70,   70, 1794, 1796, 1798, 1799, 1797, 1800, 1801, 1785,
+     1787, 1804, 1802, 1803, 2287, 1790,   70, 1789,   70,   70,
+
+       70, 1792,   70,   70,   70, 1795,   70,   70, 1805, 1794,
+     1796, 1798,   70, 1797,   70,   70, 1806,   70, 1804, 1802,
+     1803, 1807, 1808,   70, 1809, 1810, 1811, 1812, 1813,   70,
+     1815,   70,   70, 1814, 1817, 1805, 1816,   70, 1818,   70,
+       70,   70, 2287, 1806,   70,   70,   70,   70, 1807, 1808,
+     1819, 1809, 1810,   70, 1812, 1813, 1823, 1815, 1820, 1824,
+     1814, 1817, 1825, 1816,   70, 1818, 1821,   70,   70, 1822,
+     1826,   70,   70,   70, 1827, 1828, 2287, 1819, 1829, 1830,
+       70, 1834, 1831, 1823,   70, 1820, 1824, 1832,   70, 1825,
+       70, 1840,   70, 1821, 1835,   70, 1822, 1826,   70,   70,
+
+     1833,   70,   70, 1836,   70, 1829, 1830,   70, 1834, 1831,
+       70, 1837, 1838, 1839, 1832, 1841, 1842,   70, 1840,   70,
+     1848, 1835,   70, 1843, 1844, 1845, 1846, 1833, 1850,   70,
+     1836,   70,   70, 1849,   70,   70, 1847,   70, 1837, 1838,
+     1839,   70,   70, 1842,   70,   70, 1851, 1848, 1852, 1853,
+     1843, 1844, 1845, 1846, 1854,   70, 1855, 1856,   70, 1861,
+     1849, 1857, 1858, 1847,   70, 1859,   70, 1863,   70,   70,
+     1860, 1862, 1865,   70, 1864, 2287, 1853, 1870, 1866,   70,
+       70, 1854,   70, 1855, 1856,   70,   70,   70, 1857, 1858,
+       70, 1869, 1859, 1873,   70,   70,   70, 1860, 1862, 1865,
+
+     1867, 1864, 1868, 1872,   70, 1866, 2287, 1871,   70,   70,
+     1874, 1875,   70, 1876, 1877,   70, 1879, 1878, 1869,   70,
+       70, 1880, 1882,   70, 1881, 1883, 1884, 1867, 1885, 1868,
+     1872,   70,   70,   70, 1871, 2287,   70, 1874, 1875, 1888,
+     1876,   70, 1887,   70, 1878, 1886, 1889,   70,   70,   70,
+       70, 1881, 1883,   70,   70, 1885,   70,   70, 1890, 1891,
+     1893, 1895, 1892, 1894, 1897, 1898, 1888, 1899,   70, 1887,
+       70,   70, 1886, 1889, 1896,   70,   70, 1900, 1901,   70,
+     1902,   70, 1904,   70, 1903, 1890, 1891, 1893, 1895, 1892,
+     1894, 1897,   70, 1906,   70, 1905,   70,   70, 1907, 1908,
+
+       70, 1896, 1909, 1914, 1900, 1901,   70,   70,   70, 1904,
+     1912, 1903,   70, 1910, 1913,   70,   70, 1915, 1911, 1918,
+     1906, 1916, 1905, 1921, 1917,   70,   70, 1920, 1919, 1909,
+     2287,   70,   70, 1922, 1923,   70,   70, 1912,   70, 2287,
+       70, 1913,   70,   70, 1915,   70, 1918,   70, 1916,   70,
+     1921, 1917, 1925, 1924, 1920, 1919,   70,   70, 1926, 1927,
+     1922, 1923,   70, 1928, 1929, 1930,   70, 1931, 1933, 1935,
+     1932, 1937, 1936,   70,   70, 1934,   70,   70,   70, 1925,
+     1924, 1941,   70,   70,   70, 1926, 1927,   70, 1939,   70,
+     1928, 1929, 1930, 1938, 1931,   70, 1935, 1932,   70, 1936,
+
+       70,   70, 1934, 1940,   70, 1942, 1943, 1944, 1941, 1945,
+       70, 1946, 1948, 1947, 1952, 1939, 1950, 2287, 1951, 1949,
+     1938, 1956, 2287, 2287, 1955, 2287,   70,   70,   70,   70,
+     1940,   70,   70,   70, 1944,   70, 1945,   70, 1946, 1948,
+     1947,   70, 1953, 1950,   70, 1951, 1949, 1954,   70,   70,
+       70, 1955, 1957, 1958,   70, 1959, 1960, 1961, 1962, 1963,
+     1964, 1965, 1969, 1967, 1966, 1971,   70,   70, 1968, 1953,
+     2287, 1974,   70, 1970, 1954, 1972,   70,   70, 1973, 1957,
+       70,   70, 1959,   70,   70, 1962, 1963,   70,   70, 1969,
+     1975, 1966,   70, 2287,   70,   70, 1976,   70,   70, 1981,
+
+     1970,   70, 1972, 1978, 1977, 1973,   70, 1982, 1979, 1980,
+     1985, 1984,   70, 1987, 2287, 1983,   70, 1975,   70, 1989,
+       70,   70,   70, 1976,   70, 1986, 1981,   70, 1990, 1993,
+     1978, 1977,   70,   70, 1982, 1979, 1980,   70, 1984, 1988,
+     1987, 1991, 1983, 1994, 1996,   70, 1989,   70, 1992, 1999,
+       70,   70, 1986, 1997,   70, 1990, 1993, 1995,   70,   70,
+       70, 2000,   70, 2002, 2001, 1998, 1988,   70, 1991, 2003,
+     1994, 1996,   70,   70, 2004, 1992,   70, 2005, 2007, 2006,
+     1997, 2008, 2287, 2011, 1995,   70, 2009,   70, 2000,   70,
+       70, 2001, 1998, 2010, 2015,   70, 2003,   70, 2012,   70,
+
+     2014,   70, 2016, 2013, 2005, 2007, 2006, 2017,   70,   70,
+     2011,   70,   70, 2009,   70, 2019, 2018,   70, 2020, 2021,
+     2010, 2015, 2022, 2287, 2027,   70, 2023, 2014, 2024,   70,
+       70,   70, 2025,   70, 2017, 2026, 2028, 2032, 2034, 2031,
+     2029,   70, 2019, 2018,   70, 2020, 2021,   70,   70, 2022,
+       70,   70, 2030, 2023,   70, 2024, 2033, 2039,   70, 2025,
+       70,   70, 2026, 2028, 2035,   70, 2031, 2029, 2036,   70,
+     2037, 2038, 2041,   70,   70, 2040, 2042,   70,   70, 2030,
+       70, 2043, 2044, 2033,   70, 2048, 2045, 2046, 2047,   70,
+     2053, 2035,   70,   70, 2051, 2036,   70, 2037, 2038,   70,
+
+       70, 2050, 2040, 2042, 2052,   70,   70, 2055, 2043,   70,
+       70, 2049, 2048, 2045, 2046, 2047,   70,   70, 2054,   70,
+       70, 2051, 2056, 2057, 2058, 2059,   70, 2287, 2050,   70,
+     2061, 2052, 2060, 2062,   70, 2063,   70, 2065, 2049,   70,
+       70, 2067, 2068, 2066, 2069, 2054,   70, 2064, 2070,   70,
+     2057,   70, 2059, 2071,   70,   70,   70,   70, 2072, 2060,
+     2062,   70, 2063,   70, 2065, 2073,   70, 2074, 2067,   70,
+     2066,   70,   70,   70, 2064, 2070, 2075, 2079, 2076, 2078,
+     2071, 2077, 2287, 2080, 2086, 2072,   70, 2081, 2082, 2287,
+     2083, 2084, 2073, 2085,   70, 2287,   70,   70, 2089, 2090,
+
+       70,   70, 2092, 2075,   70, 2076, 2078, 2096, 2077,   70,
+       70,   70,   70,   70, 2081, 2082,   70, 2083, 2084, 2091,
+     2085, 2087, 2088, 2093, 2094,   70,   70,   70, 2097,   70,
+     2095,   70, 2098, 2100,   70, 2101, 2099,   70, 2103, 2102,
+     2104, 2105, 2287,   70,   70,   70, 2091, 2108, 2087, 2088,
+     2093, 2094,   70, 2107,   70,   70, 2109, 2095,   70,   70,
+       70, 2112, 2101, 2099,   70, 2103, 2102,   70, 2105, 2106,
+     2111,   70, 2110, 2113,   70, 2114,   70, 2115,   70, 2116,
+     2107, 2287,   70, 2109,   70,   70, 2118, 2120,   70,   70,
+     2117, 2119, 2287, 2287,   70,   70, 2106, 2111, 2123, 2110,
+
+     2113,   70, 2114, 2122, 2115,   70, 2116,   70, 2121,   70,
+       70, 2127,   70, 2118, 2120,   70, 2126, 2117, 2119, 2124,
+     2125, 2128,   70, 2129, 2130, 2123, 2131, 2132,   70,   70,
+     2122, 2133, 2136,   70, 2137, 2121, 2134, 2135, 2127, 2287,
+     2140, 2287, 2287, 2126, 2141, 2287, 2124, 2125, 2128,   70,
+       70,   70, 2144, 2131,   70,   70, 2139, 2138,   70, 2136,
+     2142,   70, 2145, 2146,   70,   70,   70,   70, 2143,   70,
+       70, 2141,   70, 2147, 2148, 2149, 2150,   70, 2151, 2144,
+     2152, 2153,   70, 2139, 2138, 2154,   70, 2142,   70, 2145,
+       70,   70, 2155,   70, 2156, 2143, 2157,   70, 2158, 2159,
+
+       70, 2148, 2149,   70,   70, 2160, 2161, 2152, 2153, 2162,
+       70, 2163, 2154, 2164,   70, 2165,   70, 2167, 2168, 2155,
+     2166, 2156, 2169, 2157, 2171,   70,   70, 2173, 2170,   70,
+       70, 2287,   70,   70, 2172,   70,   70,   70, 2163, 2174,
+       70, 2175,   70,   70, 2167, 2168, 2176, 2166,   70,   70,
+     2179, 2171,   70, 2177,   70, 2170, 2178, 2182,   70,   70,
+     2287, 2172,   70,   70, 2180, 2181, 2174,   70, 2175, 2184,
+       70, 2183,   70, 2176,   70,   70, 2185, 2179, 2187, 2186,
+     2177, 2188, 2191, 2178, 2182,   70,   70,   70, 2189, 2193,
+       70, 2180, 2181,   70,   70, 2190, 2184,   70, 2183,   70,
+
+     2192, 2194,   70, 2185, 2195, 2187, 2186,   70, 2188, 2191,
+     2196, 2197, 2199, 2200, 2203, 2189,   70, 2198, 2201,   70,
+       70, 2202, 2190, 2205, 2287, 2210, 2287, 2192, 2194, 2204,
+     2211,   70, 2208,   70,   70,   70,   70, 2196,   70, 2199,
+     2200,   70,   70, 2206, 2198, 2201,   70, 2213, 2202, 2207,
+       70,   70, 2209, 2212, 2215,   70, 2204,   70,   70, 2208,
+       70,   70,   70, 2214, 2216, 2218,   70,   70, 2219, 2220,
+     2206,   70, 2217,   70, 2213, 2222, 2207, 2221, 2223, 2209,
+     2212, 2215,   70,   70, 2225,   70, 2226,   70, 2227, 2232,
+     2214, 2216, 2218, 2224,   70, 2219, 2220,   70, 2287, 2217,
+
+       70,   70, 2222, 2228, 2221, 2223, 2229, 2230, 2231, 2233,
+     2238,   70, 2235, 2287,   70, 2227,   70, 2287,   70, 2234,
+     2224,   70, 2287, 2236, 2240,   70, 2259,   70,   70,   70,
+     2228,   70,   70, 2229, 2230, 2231,   70, 2237,   70, 2235,
+     2239, 2241,   70, 2243, 2242,   70, 2234, 2244,   70, 2245,
+     2236, 2240, 2246,   70, 2247,   70, 2248,   70, 2250,   70,
+     2249,   70, 2252, 2287, 2237,   70,   70, 2239, 2241, 2251,
+     2243, 2242, 2253, 2254, 2244, 2287, 2245,   70,   70, 2246,
+       70, 2247, 2255, 2248,   70, 2250, 2256, 2249,   70, 2252,
+     2257, 2258, 2263, 2265,   70,   70, 2251, 2262,   70, 2253,
+
+     2254, 2260,   70, 2261, 2267,   70, 2287, 2264, 2287, 2255,
+     2268, 2272,   70, 2256,   70,   70,   70, 2257, 2258, 2263,
+       70,   70, 2271,   70, 2262, 2266,   70, 2269, 2260, 2275,
+     2261, 2267,   70,   70, 2264,   70, 2270, 2268,   70, 2273,
+     2276, 2277, 2274, 2278,   70, 2279, 2287,   70,   70, 2271,
+       70, 2280, 2266, 2281, 2269,   70, 2275, 2282, 2285, 2286,
+     2287,   70, 2287, 2270, 2287, 2283, 2273,   70, 2277, 2274,
+       70,   70,   70,   70, 2284,   70, 2287, 2287, 2280,   70,
+     2281, 2287,   70, 2287, 2282,   70,   70, 2287, 2287, 2287,
+     2287, 2287, 2283, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+
+     2287, 2284,   42,   42,   42,   42,   42,   42,   42,   47,
+       47,   47,   47,   47,   47,   47,   52,   52,   52,   52,
+       52,   52,   52,   58,   58,   58,   58,   58,   58,   58,
+       63,   63,   63,   63,   63,   63,   63,   73,   73, 2287,
+       73,   73,   73,   73,  133,  133, 2287, 2287, 2287,  133,
+      133,  135,  135, 2287, 2287,  135, 2287,  135,  137, 2287,
+     2287, 2287, 2287, 2287,  137,  140,  140, 2287, 2287, 2287,
+      140,  140,  142, 2287, 2287, 2287, 2287, 2287,  142,  144,
+      144, 2287,  144,  144,  144,  144,   74,   74, 2287,   74,
+       74,   74,   74,   13, 2287, 2287, 2287, 2287, 2287, 2287,
+
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287
     } ;
 
-static yyconst flex_int16_t yy_chk[6466] =
+static yyconst flex_int16_t yy_chk[6661] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -1893,710 +1931,731 @@ static yyconst flex_int16_t yy_chk[6466] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    3,    3,    3,    4,
-        4,    4,    5,    5,    6,    6,    5,   27,    6,    7,
-        7,    7,    7,  676,    7,    8,    8,    8,    8,   27,
-        8,    9,    9,    9,   10,   10,   10,   15,   45,   45,
-
-     2243,   15,   23,    3,   27,   50,    4,  775,   50,    5,
-       19,    6,   19,   19,  676,   19,  140,    7,   29,   61,
-       61,   19,   23,    8,  138,   23,   20,   20,    9,   23,
-       29,   10,   11,   11,   11,   11,   11,   11,   12,   12,
-       12,   12,   12,   12,   20,   29,   24,  103,   19,   23,
-       20,   25,   11,   20,   20,   21,   75,   32,   12,   25,
-       24,   70,   21,   32,  860,   70,   21,  103,   28,   21,
-       11,   20,   24,   24,  103,  137,   12,   25,   25,   11,
-       75,   21,   21,   75,   32,   12,   25,   24,   26,   21,
-       28,   26,  860,   21,   30,   28,   21,   22,   26,  135,
-
-       26,   22,   30,  133,   22,  116,   22,   22,   30,  131,
-       31,   26,   30,   34,   31,   26,   77,  116,   26,   22,
-       30,   30,   76,   77,   22,   26,   34,   26,   22,   30,
-       31,   22,  116,   22,   22,   30,   31,   31,   35,   30,
-       34,   31,   35,   77,  134,   76,   37,  134,   37,   76,
-      100,   68,   35,  100,   38,   35,   84,   31,   33,   38,
-       62,   84,   33,   37,   35,   35,   39,   38,   33,   35,
-       39,   33,   37,   37,   39,   37,   80,  100,   33,   35,
-       33,   38,   35,   84,   57,   33,   38,  132,  132,   33,
-       37,   66,   39,   39,   80,   33,  125,   39,   33,   85,
-
-      768,   39,  125,   80,   66,   33,   36,   85,   40,   36,
-       40,   40,   56,   40,   56,   56,   36,   56,   66,   40,
-       36,   36,   64,  125,   64,   64,   85,   64,   36,   67,
-      768,   67,   67,   36,   67,   69,   36,   69,   69,   72,
-       69,   72,   72,   36,   72,   78,   69,   36,   36,   81,
-       72,   87,   79,   82,   83,   83,   52,   86,   78,   82,
-       64,   79,   81,   83,   87,   51,   88,   89,   92,   78,
-      139,  139,   78,   88,   82,   86,   81,   72,   87,   79,
-       82,   83,   83,   89,   93,   78,   82,   90,   91,   86,
-       94,   92,   96,   88,   89,   92,   90,   91,   46,  101,
-
-       97,   41,   86,   94,   95,   14,   93,   95,   97,   99,
-       98,   93,  101,   99,   90,   91,   96,   94,  102,   13,
-       95,   95,  105,  120,   96,  104,  101,   97,   95,  108,
-       98,   95,   98,   99,   95,    0,   99,   98,  108,  104,
-       99,  102,  105,   96,  106,  102,  107,   95,   95,  105,
-      110,  109,  104,  107,  112,  120,  108,   98,  106,  110,
-      111,  112,  113,  114,  111,    0,  115,  117,    0,    0,
-      114,  106,  115,  107,  109,  117,  122,  110,  109,  118,
-      115,  112,  111,  118,  119,  121,  123,  111,  113,  113,
-      114,  111,  118,  115,  117,  123,  122,  124,  119,  115,
-
-      121,  126,  122,  122,  128,  127,  118,  129,  124,    0,
-      118,  119,  121,  123,  130,  136,  129,  136,  136,  128,
-      136,  145,  126,  122,  124,  146,  126,  127,  126,  144,
-        0,  128,  127,  148,  129,  141,  130,  141,  141,  147,
-      141,  130,  142,  145,  142,  142,  149,  142,  145,  126,
-      150,  147,  148,  144,  149,  157,  144,  146,  152,  151,
-      148,  153,  150,  154,  156,  152,  147,  155,    0,  154,
-      161,  158,    0,  149,  160,  158,  162,  150,  161,  153,
-      142,  151,  163,  177,  165,  152,  151,  157,  153,  155,
-      156,  156,  158,    0,  155,  154,  154,  161,  162,  158,
-
-      160,  160,  158,  162,  163,  166,  164,  165,  167,  163,
-      164,  165,  168,  170,  169,  177,    0,  169,    0,  158,
-      159,  167,  170,  171,  168,  159,  172,  166,  180,  169,
-      159,  175,  166,  164,  174,  167,  159,  159,  175,  168,
-      170,  169,  183,  159,  169,  171,  178,  159,  172,  173,
-      171,  176,  159,  172,  173,  185,  174,  159,  175,  179,
-      180,  174,  176,  159,  159,  181,  173,  184,  173,  186,
-      179,  182,  178,  178,  183,  173,  173,  182,  176,  187,
-        0,  173,  188,  181,  189,  192,  195,  185,  268,  184,
-      192,  179,  181,  173,  184,  173,  188,  179,  182,  187,
-
-      190,  186,  191,  193,  194,  189,  187,  190,  195,  188,
-      197,  189,  192,  195,  196,  268,  199,  198,  194,  200,
-      201,  197,  193,  191,  198,  201,  196,  190,  202,  191,
-      193,  194,  204,  208,  206,  207,  210,  197,  199,  203,
-      203,  196,  200,  199,  198,  205,  200,  201,  203,  209,
-      212,  210,  205,  211,  213,  207,  219,  209,  214,  206,
-      202,  206,  207,  210,  204,  208,  203,  203,  218,  216,
-      215,  220,  205,  212,  215,  214,  209,  221,  222,  211,
-      211,  217,  212,  214,  216,  214,  213,  218,  219,  217,
-      222,  223,  224,  220,  225,  218,  216,  215,  220,  228,
-
-      212,  224,  214,  226,  223,  222,  229,  225,  217,  221,
-      227,  232,  227,  230,  231,  233,  240,  235,  223,  224,
-      232,  225,  226,  228,  234,  237,  228,  239,  235,    0,
-      226,  229,  238,  229,  236,  242,  243,  227,  232,  230,
-      230,  233,  233,  231,  235,  239,  236,  241,  240,  237,
-      234,  234,  237,  244,  239,  238,  245,  246,  249,  238,
-      241,  236,  243,  243,  246,  248,  251,  242,  247,  259,
-      250,  248,  249,  252,  241,  244,  253,  247,  254,  258,
-      244,  255,  252,    0,  246,  249,  257,  254,  245,  256,
-      251,  260,  248,  251,  258,  247,  250,  250,  256,  253,
-
-      252,  259,  261,  253,  263,  254,  258,  255,  255,  264,
-      257,  265,  262,  257,    0,  260,  256,  261,  260,  266,
-      262,  262,  263,  262,  274,  265,  272,  264,  269,  261,
-      262,  263,  270,  264,  266,  270,  264,  271,  265,  262,
-      267,  267,  270,  273,  272,  276,  266,  262,  262,  271,
-      262,  274,  269,  272,  264,  269,  275,  277,  278,  270,
-      279,  273,  270,  282,  271,  267,  280,  267,  267,  277,
-      273,  276,  276,  280,  281,  279,  285,  284,  275,  288,
-      278,  283,  291,  275,  277,  278,  281,  279,  283,  287,
-      286,  287,  288,  280,  289,  282,  286,  289,  285,  289,
-
-      292,  281,  290,  285,    0,  289,  288,    0,  283,  284,
-        0,  293,  286,  287,  291,    0,  287,  286,  287,  293,
-      290,  289,  292,  286,  289,  293,  289,  292,  294,  290,
-      295,  296,  297,  300,  298,  294,  301,  303,  293,  305,
-        0,  304,  295,  303,  296,  300,  293,  298,  297,  304,
-      307,  305,  314,    0,  301,  294,  297,  295,  296,  297,
-      300,  298,  302,  301,  303,  306,  305,  302,  304,  308,
-        0,  309,  306,  308,    0,  297,  299,  299,  309,  311,
-      310,    0,  307,  312,  314,  313,  299,  310,  299,  299,
-      299,  311,  306,  299,  302,  315,  308,  313,  309,  316,
-
-      318,  299,  315,  299,  299,  312,  311,  310,  317,  319,
-      312,  319,  313,  299,  316,  299,  299,  299,  320,  321,
-      299,  317,  315,  322,  322,    0,  316,  323,  324,  320,
-      326,  325,  318,  328,  323,  317,  319,  327,  329,  324,
-      330,  321,  325,  326,  337,  320,  321,  334,  333,  330,
-      331,    0,  322,  329,  323,  324,  328,  326,  325,  348,
-      328,  329,  327,  331,  327,  329,  333,  330,  332,  334,
-      335,  336,  338,  339,  334,  333,  337,  331,  338,  332,
-      329,  332,  340,  342,    0,  341,  332,  343,  344,  336,
-      342,  348,    0,  335,  339,  332,  345,  335,  336,  338,
-
-      339,  347,  344,  346,  351,  340,  332,  341,  332,  340,
-      342,  349,  341,  343,  343,  344,  350,  346,  345,  352,
-      353,  354,  350,  345,  356,    0,  351,  347,  347,  355,
-      346,  351,  357,  358,  349,  353,  354,  352,  349,  358,
-      359,    0,  361,  350,  363,    0,  352,  353,  354,  362,
-      356,  356,  355,    0,  357,  362,  355,  364,  365,  357,
-      358,  370,  366,  363,  371,  365,  359,  359,  361,  361,
-      368,  363,  368,  369,  370,  364,  362,  366,  374,  368,
-      369,  373,  379,  372,  364,  365,  376,  375,  370,  366,
-      378,  374,  377,  380,  383,  379,  371,  368,  382,  368,
-
-      369,  372,  381,  373,  382,  374,  375,  381,  373,  379,
-      372,  384,  385,  378,  375,  380,  377,  383,  376,  377,
-      380,  383,  378,  384,  386,  382,  389,    0,  387,  381,
-      391,    0,  398,  389,  385,  386,  387,  390,  384,  385,
-      378,  391,  393,  394,  398,  390,  395,    0,  392,  397,
-      394,  386,  396,  389,  396,  387,  388,  391,  392,  398,
-      401,  388,  399,  388,  390,  410,  393,  416,  401,  393,
-      394,  388,  395,  395,  388,  397,  397,  399,  403,  396,
-      392,  388,  388,  388,  400,  392,  402,  401,  388,  399,
-      388,  402,  404,  407,  405,  406,  400,  410,  388,  416,
-
-      403,  388,  405,  409,  413,  403,  412,  406,  388,  411,
-      404,  400,  415,  402,  407,  412,  414,  417,  413,  404,
-      407,  405,  406,  418,  411,  419,  409,  420,    0,  421,
-      409,  413,  417,  412,  423,  414,  411,  422,  425,  415,
-      419,  421,  424,  414,  417,  424,  427,  428,  429,  425,
-      430,  420,  419,  424,  420,  418,  421,  426,  423,  422,
-      427,  423,  426,  431,  422,  425,  432,  433,  437,  424,
-      434,  436,  424,  427,  428,  429,  434,  439,  435,  436,
-      438,  440,  430,  441,  442,  444,    0,  437,    0,  426,
-      431,  445,  441,  432,  443,  437,  455,  434,  436,  433,
-
-      435,  443,  446,  438,  440,  435,  442,  438,  440,  439,
-      441,  442,  451,  445,  447,  446,  448,  444,  445,  447,
-      452,  443,  449,  447,  450,  448,    0,  453,  455,  446,
-      459,  457,  454,  450,  451,  456,    0,  467,  447,  451,
-      453,  447,  452,  448,  454,  458,  447,  452,  449,  449,
-      447,  450,  459,  456,  453,  457,  460,  459,  457,  454,
-      461,  462,  456,  463,  464,  465,  466,  458,  458,  467,
-      474,  461,  458,  469,  468,  462,  465,  471,  460,  470,
-      472,  466,  464,  460,  476,  463,  475,  461,  462,  472,
-      463,  464,  465,  466,  458,  468,  473,  469,  477,  471,
-
-      469,  468,  474,  470,  471,  478,  470,  472,  475,  473,
-      479,  482,  480,  475,  481,  479,  476,  484,    0,  486,
-        0,  483,  477,  473,  489,  477,  480,  478,  481,  483,
-      485,  487,  478,  488,  486,  484,  491,  493,  488,  480,
-        0,  481,  479,  482,  484,  485,  486,  490,  483,  490,
-      489,  489,  492,  487,  485,  499,    0,  485,  487,  494,
-      492,  491,  493,  491,  493,  488,  495,  498,  494,  496,
-      504,  497,  485,  499,  490,  495,  500,  496,  497,  492,
-      501,  508,  499,  502,  505,  503,  494,  506,  500,  501,
-      498,  502,  505,  495,  498,  506,  496,  503,  497,  507,
-
-      509,  510,  504,  500,  508,  512,  511,  501,  508,  515,
-      502,  505,  503,  512,  506,  513,  509,  511,  514,  516,
-      520,  517,  518,  510,  522,  507,  507,  509,  510,  513,
-        0,  515,  512,  511,  521,  523,  515,  522,  514,  516,
-      520,  519,  513,  517,  518,  514,  516,  520,  517,  518,
-      519,  522,  521,  523,  524,  525,  529,  526,  527,  531,
-      532,  521,  523,  528,  527,  537,  533,  531,  519,  536,
-        0,  528,  534,  533,  529,    0,  524,  555,  536,  525,
-      526,  524,  525,  529,  526,  527,  531,  535,  538,  528,
-      528,  539,  532,  533,  544,  534,  536,  537,  528,  534,
-
-      539,  540,  535,  540,  541,    0,  544,  538,  550,  555,
-      547,  541,    0,  551,  535,  538,  553,    0,  539,    0,
-      547,  544,    0,  557,  552,  560,  550,  560,  540,  554,
-        0,  541,  542,  562,  551,  550,  542,  547,  558,  542,
-      551,  563,  553,  553,  558,  557,  542,  552,  559,  542,
-      557,  552,  560,    0,  542,  554,  554,  559,  561,  542,
-      562,  563,  565,  542,  564,  558,  542,    0,  563,    0,
-      566,  567,  580,  542,  565,  559,  542,  556,  556,  569,
-      556,  580,  561,  556,  568,  561,  573,  570,  556,  565,
-      564,  564,  572,  567,  556,  556,  566,  566,  567,  580,
-
-      572,  569,  571,  556,  556,  556,  569,  556,  568,  573,
-      556,  568,  570,  573,  570,  556,  574,  571,  575,  572,
-      576,  556,  556,  574,  577,  578,  575,  579,    0,  571,
-      583,  581,  585,  582,  584,  586,    0,  578,  587,  576,
-      579,    0,  588,  574,    0,  575,  581,  576,    0,  589,
-      577,  577,  578,  590,  579,  582,  584,  583,  581,  592,
-      582,  584,  587,  588,  585,  587,  591,  586,  589,  588,
-      593,  594,  590,  595,  596,  591,  589,  597,  598,  594,
-      590,  592,  603,    0,  601,  602,  592,  599,    0,  606,
-      593,  604,  596,  591,  605,  599,  597,  593,  594,    0,
-
-      595,  596,  601,  602,  597,  607,  603,  605,  608,  603,
-      598,  601,  602,  604,  599,  606,  606,  607,  604,  609,
-      610,  605,  609,  612,  613,  614,  608,  615,  610,  618,
-      616,  614,  607,  617,  618,  608,  616,    0,  619,  621,
-      617,  620,  631,  628,  610,  619,  609,  610,  612,  615,
-      612,  613,  614,  623,  615,  610,  618,  616,  622,  620,
-      617,  623,  621,  624,  625,  619,  621,  622,  620,  626,
-      628,  627,  632,  630,  631,  639,  629,    0,  633,  625,
-      623,  624,  626,  629,  636,  622,  630,  634,    0,  638,
-      624,  625,  627,  637,  635,  634,  626,    0,  627,  637,
-
-      630,  633,  635,  629,  632,  633,  636,  639,  640,  635,
-      641,  636,  642,  643,  634,  638,  638,  644,    0,  641,
-      637,  635,  645,  647,  644,  646,  642,    0,  648,  635,
-      649,    0,  640,  650,  646,  640,  654,  641,  652,  642,
-      648,  650,  654,  651,  644,  643,  651,  653,    0,  645,
-      647,  652,  646,  649,  653,  648,    0,  649,  656,  657,
-      650,    0,    0,  654,  658,  652,  664,  659,  661,  659,
-      651,  664,    0,  660,  653,  655,  658,  655,    0,  662,
-      661,  655,  657,  655,  656,  656,  657,    0,  655,  666,
-      663,  658,  665,  655,  659,  661,  660,  667,  664,  655,
-
-      660,  662,  655,  663,  655,  665,  662,  669,  655,  667,
-      655,  668,  666,  670,  672,  655,  666,  663,  673,  665,
-      655,  668,  671,  674,  667,  675,  670,  672,  671,  669,
-      680,  678,  679,  668,  669,  681,    0,    0,  668,  673,
-      670,  672,  682,  680,  683,  673,  678,  691,  668,  671,
-      681,  684,  675,  688,  679,  674,  677,  680,  678,  679,
-      685,  677,  681,  677,  686,  692,  683,  687,  682,  682,
-      684,  683,  686,  685,  677,  687,  689,  693,  684,  691,
-      688,  677,  677,  677,  694,  693,  695,  685,  677,  692,
-      677,  686,  692,  696,  687,  698,  699,  697,  694,  689,
-
-      701,  677,  703,  689,  693,  697,  700,  702,  677,  704,
-      703,  694,  705,  698,  699,  696,    0,  700,  695,  705,
-      696,  707,  698,  699,  697,  702,  708,  706,  707,  703,
-      710,  704,  701,  700,  702,  721,  704,  709,  712,  705,
-      706,  713,    0,  714,  708,  715,  722,  716,  707,  713,
-        0,  712,  714,  708,  706,  709,  717,  715,  718,  719,
-      722,  720,  710,  726,  709,  712,  726,  721,  713,  716,
-      714,  724,  715,  722,  716,  727,  725,  719,  717,  728,
-      718,  725,  724,  717,  729,  718,  719,  720,  720,  726,
-      726,  729,  728,  726,  731,  730,  732,  733,  724,  727,
-
-        0,  736,  727,  732,  734,  735,  728,  730,  725,    0,
-      734,  729,  736,  737,  738,  739,  741,  743,  742,  744,
-        0,  733,  730,  732,  733,  746,  731,  735,  736,  742,
-      739,  734,  735,  745,  746,  737,  738,  741,  743,  747,
-      737,  738,  739,  741,  743,  742,  744,  748,  750,  749,
-      751,  745,  746,  752,    0,  750,  748,  749,  760,  753,
-      745,  754,  756,  747,  751,  759,  747,  757,  758,  761,
-      762,  756,  764,    0,  748,  750,  749,  751,  763,  765,
-      759,  753,  762,  754,  758,  752,  753,  765,  754,  756,
-      760,  757,  759,  767,  757,  758,  766,  762,  769,  764,
-
-      763,  761,  771,  770,  774,  763,  765,  769,  767,  766,
-      771,  772,  774,  772,  776,  778,  777,  779,  780,    0,
-      767,  770,  778,  766,  781,  769,  783,  776,  777,  771,
-      770,  774,  782,  786,  784,  792,    0,  788,  772,  785,
-        0,  776,  778,  777,  787,  788,  781,  784,  783,  779,
-      780,  781,  785,  783,  789,  786,  787,  782,  790,  782,
-      786,  784,  792,  793,  788,  791,  785,  795,  794,  797,
-      790,  787,  796,  791,  789,  799,  793,  794,  800,  796,
-      797,  789,    0,  797,  801,  790,    0,  806,  795,  803,
-      793,  797,  791,  802,  795,  794,  797,  805,    0,  796,
-
-      800,  799,  799,  804,  801,  800,  802,  797,  811,  806,
-      797,  801,  804,  803,  806,  805,  803,  807,  808,  809,
-      802,  813,    0,  815,  805,  807,  812,  809,  818,  814,
-      804,  815,  817,    0,  828,  811,    0,    0,    0,  813,
-      808,  814,  816,  818,  807,  808,  809,  822,  813,  812,
-      815,  821,  817,  812,  816,  818,  814,  819,  820,  817,
-      821,  823,  826,  824,  820,  819,  828,    0,  822,  816,
-      824,  832,  825,  823,  822,  831,  830,  833,  821,  825,
-      826,  829,  831,  836,  819,  820,  834,  837,  823,  826,
-      824,  834,  833,  832,  829,  830,  836,  835,  832,  825,
-
-      838,  837,  831,  830,  833,  835,  840,  841,  829,  842,
-      836,  843,  845,  844,  837,    0,    0,    0,  834,    0,
-      840,  846,  847,    0,  835,  841,  838,  838,  839,  851,
-      845,  839,  839,  840,  841,  844,  839,  843,  843,  845,
-      844,  842,  839,  846,  847,  848,  839,  849,  846,  847,
-      839,  851,  850,  852,  849,  839,  851,  854,  839,  839,
-      855,  856,    0,  839,  857,  901,  852,  853,    0,  839,
-      850,  848,  848,  839,  849,    0,  853,    0,  863,  850,
-      852,  859,  861,  856,  864,  866,    0,  857,  856,  854,
-      865,  857,  855,    0,  853,  858,  864,  901,  861,  865,
-
-      858,  863,  858,  866,  858,  863,  858,  859,  859,  861,
-      867,  864,  866,  858,    0,  867,  869,  865,  870,  868,
-      871,    0,  858,  872,  873,  878,  870,  858,  880,  858,
-      874,  858,  868,  858,  869,  875,  872,  873,  876,  871,
-      876,  877,  867,  869,  875,  870,  868,  871,  874,  879,
-      872,  873,  878,  882,  885,  880,  883,  874,  884,  887,
-      886,  879,  875,  877,    0,  876,  884,  886,  877,  888,
-      890,  892,  894,  889,  902,  891,  879,  882,  883,  889,
-      882,  885,  891,  883,  893,  884,  887,  886,  895,  897,
-      903,  888,  896,  892,  894,  899,  888,  890,  892,  894,
-
-      889,  896,  891,  893,  898,  904,  902,  905,  908,  899,
-      897,  893,  903,  906,  895,  895,  897,  903,    0,  896,
-      907,  906,  899,  909,  898,  905,  910,  912,  911,    0,
-      909,  898,  911,  910,  905,  908,  907,  904,  913,  914,
-      906,  915,  919,  917,  913,  916,  914,  907,  918,  919,
-      909,  913,  917,  910,  921,  911,  915,  922,  916,  912,
-      920,  923,  920,  921,  925,  913,  914,  929,  915,  919,
-      917,  913,  916,  924,  918,  918,  930,  924,  928,  922,
-      931,  921,  927,  928,  922,  929,  925,  920,  923,  932,
-      927,  925,  932,  931,  929,  930,  933,  934,  935,  936,
-
-      924,  932,    0,  930,    0,  937,  939,  931,  941,  927,
-      928,  935,  942,  938,  939,  946,  932,  941,  933,  932,
-      940,  940,  934,  933,  934,  935,  955,  943,  937,  938,
-      944,  936,  937,  939,  942,  941,  943,  944,  946,  942,
-      938,  947,  946,  948,  949,  950,  955,  940,  951,  952,
-      947,  948,  954,  955,  943,  953,  956,  944,  950,  949,
-      951,  952,  958,  953,  957,  964,  959,  961,  947,  960,
-      948,  949,  950,  957,  954,  951,  952,  963,  956,  954,
-      958,  960,  953,  956,  962,  965,  966,  969,  961,  958,
-      962,  957,  959,  959,  961,  967,  960,  964,  971,  963,
-
-      970,  972,  973,    0,  963,  976,  974,  978,    0,  988,
-      972,  962,  966,  966,  969,  973,  971,  965,  974,  975,
-      979,  967,  967,  970,    0,  971,  978,  970,  972,  973,
-      977,  976,  976,  974,  978,  980,  981,  977,  982,  975,
-      983,  988,  979,  982,  981,  983,  975,  979,  980,  984,
-      985,  986,  987,  989,  989,  992,  984,  977,  985,  986,
-      987,  990,  980,  981,  991,  993,  994,  995,    0,  990,
-      982,  997,  983,  993,  994,  995,  984,  985,  986,  987,
-      989,  996, 1001,  999,  997,  991, 1000,  992,  990,  996,
-      998,  991,  993,  994,  995,  999,  998, 1003,  997, 1002,
-
-     1004, 1006, 1005, 1007, 1008,    0, 1001,    0,  996, 1001,
-      999, 1013, 1000, 1000, 1002, 1006, 1009,  998, 1008, 1015,
-     1009, 1007, 1004, 1012, 1003, 1005, 1002, 1004, 1006, 1005,
-     1007, 1008, 1011, 1009, 1012, 1014, 1017, 1016, 1013, 1011,
-     1019, 1009, 1015, 1009, 1016, 1017, 1015, 1009, 1018, 1020,
-     1012, 1024, 1022, 1026, 1025, 1018, 1028, 1014,    0, 1011,
-     1009, 1022, 1014, 1017, 1016, 1030, 1031, 1033,    0, 1034,
-     1035, 1040, 1019, 1024, 1037, 1018, 1020, 1031, 1024, 1022,
-     1025, 1025, 1035, 1028, 1036, 1026, 1036, 1037, 1038, 1041,
-     1039, 1033, 1030, 1031, 1033, 1034, 1034, 1035, 1040, 1042,
-
-     1044, 1037, 1039, 1043, 1045, 1044, 1042, 1050,    0, 1046,
-     1038, 1036, 1041, 1047,    0, 1038, 1041, 1039, 1053, 1048,
-     1045, 1047, 1052,    0, 1051, 1054, 1042, 1044,    0, 1043,
-     1043, 1045, 1046, 1051, 1050, 1052, 1046, 1058, 1057, 1061,
-     1047, 1048, 1060, 1055, 1053, 1053, 1048, 1054, 1056, 1052,
-     1055, 1051, 1054, 1059, 1062, 1056, 1057, 1064, 1067, 1058,
-     1059, 1061,    0, 1066, 1058, 1057, 1061, 1060, 1072, 1060,
-     1055, 1063, 1069, 1068, 1071, 1056, 1066, 1071, 1063, 1073,
-     1059, 1068, 1074, 1076, 1075, 1067, 1062, 1077, 1080, 1064,
-     1066, 1074,    0, 1069, 1072, 1072, 1075, 1078, 1063, 1069,
-
-     1068, 1071, 1077, 1081, 1078, 1073, 1073, 1076, 1082, 1074,
-     1076, 1075, 1079, 1085, 1077, 1079, 1083, 1084, 1086, 1084,
-     1080, 1087, 1088, 1091, 1078, 1081, 1082, 1079,    0, 1092,
-     1081, 1088, 1093, 1089, 1096, 1082, 1079, 1085, 1083, 1079,
-     1085, 1089, 1079, 1083, 1084, 1090, 1095, 1087, 1087, 1088,
-     1086, 1092, 1090, 1094, 1079, 1091, 1092, 1094, 1098, 1097,
-     1089, 1096, 1099, 1100, 1093, 1101, 1102, 1098, 1095, 1099,
-     1100, 1111, 1090, 1095, 1104, 1105, 1103, 1106, 1101, 1102,
-     1094, 1097, 1108, 1113, 1106, 1098, 1097, 1107, 1104, 1099,
-     1100, 1103, 1101, 1102, 1107, 1108, 1109,    0, 1111, 1112,
-
-     1115, 1104, 1109, 1103, 1106, 1113, 1112, 1105, 1114, 1108,
-     1113, 1116, 1115, 1117, 1107, 1119, 1117, 1120,    0, 1118,
-     1123, 1121, 1128, 1109, 1116, 1125, 1112, 1115, 1118, 1120,
-     1125, 1123, 1129, 1119, 1114, 1114, 1122, 1125, 1116, 1122,
-     1117, 1121, 1119, 1127, 1120, 1127, 1118, 1123, 1121, 1128,
-     1130, 1132, 1125, 1131, 1122,    0, 1133, 1125, 1134, 1129,
-     1135, 1131, 1138, 1122, 1137, 1139, 1122, 1133, 1135, 1147,
-     1127, 1147, 1136, 1132, 1130, 1136, 1134, 1130, 1132, 1140,
-     1131, 1141, 1137, 1133, 1142, 1134, 1140, 1135, 1143, 1144,
-     1136, 1137, 1139, 1142, 1138, 1141, 1147, 1145, 1148, 1136,
-
-     1144, 1143, 1136, 1149, 1151, 1152, 1140, 1148, 1141, 1150,
-     1158, 1142, 1145, 1156, 1153, 1143, 1144, 1155, 1156, 1160,
-     1150, 1161, 1151, 1180, 1145, 1148, 1155, 1152, 1153, 1149,
-     1149, 1151, 1152, 1163, 1154, 1162, 1150, 1154, 1159, 1165,
-     1153, 1153, 1158, 1161, 1155, 1156, 1165, 1159, 1161, 1166,
-     1180, 1160, 1154, 1168, 1163, 1153, 1167, 1172, 1173, 1168,
-     1163, 1154, 1176, 1171, 1154, 1159, 1165, 1162, 1177, 1174,
-     1167, 1171, 1173,    0, 1175, 1186, 1172, 1168, 1174, 1177,
-     1168, 1166, 1175, 1167, 1172, 1173, 1168, 1182, 1178, 1183,
-     1171, 1181, 1189, 1186, 1176, 1177, 1174, 1178, 1181, 1184,
-
-     1185, 1175, 1186, 1187, 1189, 1190, 1196, 1187, 1192, 1193,
-     1182, 1183, 1191, 1196, 1182, 1178, 1183, 1197, 1181, 1189,
-     1200, 1184, 1185, 1194, 1193, 1191, 1184, 1185, 1192, 1195,
-     1187, 1198, 1190, 1196, 1199, 1192, 1193, 1195, 1194, 1191,
-     1201, 1200, 1202, 1199, 1203, 1206, 1198, 1200, 1205, 1197,
-     1194, 1207, 1209, 1208, 1211, 1210, 1195,    0, 1198, 1211,
-        0, 1199, 1210, 1206, 1212, 1213, 1202, 1201, 1208, 1202,
-     1205, 1203, 1206, 1212, 1215, 1205, 1214, 1209, 1207, 1209,
-     1208, 1211, 1210, 1216, 1217, 1221, 1218, 1213, 1220, 1215,
-     1219, 1212, 1213, 1222, 1214, 1216, 1223, 1219, 1232, 1218,
-
-     1220, 1215, 1223, 1214, 1218, 1226, 1217, 1225, 1224, 1228,
-     1216, 1217, 1221, 1218, 1225, 1220, 1224, 1219, 1229, 1230,
-     1227, 1231, 1235, 1223, 1229, 1222, 1218, 1227, 1233, 1236,
-     1232, 1237, 1226, 1239, 1225, 1224, 1228, 1238, 1236, 1238,
-     1240, 1242, 1241, 1246, 1231, 1229, 1230, 1227, 1231, 1250,
-        0, 1244, 1233,    0, 1235, 1233, 1236, 1239, 1244, 1245,
-     1239, 1254, 1250, 1237, 1238, 1251, 1245, 1240, 1241, 1241,
-     1243, 1243, 1243, 1242, 1247, 1246, 1250, 1243, 1244, 1249,
-     1252, 1247, 1253, 1257, 1249, 1243, 1245, 1255, 1256, 1257,
-     1251, 1258, 1251, 1254, 1253, 1256, 1252, 1243, 1243, 1243,
-
-     1260, 1247, 1259, 1259, 1243, 1255, 1261, 1252, 1263, 1253,
-     1257, 1249, 1262, 1261, 1255, 1256, 1264, 1262, 1258, 1267,
-     1269, 1271, 1268, 1279, 1270,    0, 1260, 1260, 1268, 1259,
-     1273, 1273, 1272, 1261, 1263, 1263, 1270, 1267, 1274, 1262,
-     1278, 1271, 1276, 1264, 1275, 1275, 1267, 1269, 1271, 1268,
-     1272, 1270, 1281, 1276, 1280, 1279, 1282, 1273, 1283, 1272,
-     1284, 1280, 1278,    0, 1274, 1274, 1286, 1278, 1287, 1276,
-     1285, 1275, 1281, 1294, 1288, 1287, 1289, 1291, 1290, 1281,
-     1293, 1280, 1288,    0, 1286, 1294, 1291, 1284, 1282,    0,
-     1283, 1289, 1285, 1286, 1295, 1287,    0, 1285, 1292, 1292,
-
-     1294, 1288, 1290, 1289, 1291, 1290, 1293, 1293, 1297, 1300,
-     1295, 1298, 1299, 1301, 1303, 1302, 1297, 1295, 1305, 1308,
-     1299, 1295, 1306, 1298, 1309, 1292, 1308, 1310, 1306, 1312,
-     1315, 1307, 1300, 1302, 1301, 1297, 1300, 1295, 1298, 1299,
-     1301, 1303, 1302, 1304, 1307, 1305, 1308, 1311, 1304, 1306,
-     1313, 1313, 1311, 1314, 1310, 1318, 1309, 1317, 1307, 1304,
-     1321, 1312, 1315, 1320, 1322, 1320, 1319, 1323, 1314, 1322,
-     1304, 1324, 1317, 1326, 1328, 1304, 1327, 1313, 1318, 1311,
-     1314, 1319, 1318, 1329, 1317, 1331, 1324, 1330, 1332, 1333,
-     1320, 1322, 1321, 1319, 1330, 1335, 1337, 1326, 1324, 1323,
-
-     1326, 1328, 1327, 1327, 1334, 1339, 1340,    0, 1344, 1332,
-     1329, 1333, 1342, 1335, 1330, 1332, 1333, 1331, 1337, 1343,
-     1345, 1340, 1335, 1337, 1347, 1334, 1346, 1342, 1354, 1339,
-     1348, 1334, 1339, 1340, 1343, 1344, 1349, 1348, 1345, 1342,
-     1350, 1352, 1351, 1353, 1359, 1355, 1343, 1345, 1346, 1350,
-     1351, 1347, 1358, 1346, 1349, 1357, 1360, 1348, 1355, 1362,
-     1354, 1358, 1359, 1349, 1352, 1353, 1357, 1350, 1352, 1351,
-     1353, 1359, 1355, 1364, 1360, 1366, 1367, 1368, 1369, 1358,
-     1370, 1357, 1357, 1360, 1364, 1371, 1362, 1366, 1369, 1367,
-     1372, 1376, 1373, 1357, 1375,    0, 1377, 1378, 1376,    0,
-
-     1364, 1380, 1366, 1367, 1414, 1369, 1370, 1370, 1389, 1368,
-     1371, 1373, 1371,    0, 1375, 1378, 1380, 1372, 1376, 1373,
-     1379, 1375, 1377, 1377, 1378, 1381, 1379, 1382, 1380, 1383,
-     1383, 1384, 1385, 1388, 1387, 1389, 1414, 1390, 1392,    0,
-     1381, 1387, 1382, 1384, 1391, 1385, 1390, 1379, 1388, 1397,
-        0, 1391, 1381, 1385, 1382, 1393, 1383, 1396, 1384, 1385,
-     1388, 1387, 1392, 1394, 1390, 1392, 1398, 1399, 1400, 1402,
-     1394, 1391, 1385, 1403, 1397, 1398, 1397, 1393, 1405, 1396,
-     1406, 1408, 1393, 1425, 1396, 1407, 1407, 1402, 1400, 1399,
-     1394, 1405, 1409, 1398, 1399, 1400, 1402, 1412, 1403, 1410,
-
-     1403, 1411, 1413, 1408, 1416, 1405, 1412, 1406, 1408, 1413,
-     1415, 1417, 1407, 1421, 1419, 1425, 1422, 1409, 1416, 1409,
-     1420, 1410, 1419, 1411, 1412, 1427, 1410, 1423, 1411, 1413,
-     1417, 1416, 1415, 1420, 1426,    0, 1429, 1415, 1417, 1423,
-     1421, 1419, 1422, 1422, 1424, 1428, 1431, 1420, 1430, 1431,
-     1427, 1424, 1427, 1432, 1423, 1434, 1426,    0,    0, 1433,
-     1428, 1426, 1429, 1429, 1431, 1433, 1435, 1438, 1436, 1439,
-     1442, 1424, 1428, 1431, 1430, 1430, 1431, 1442, 1432, 1443,
-     1432, 1444, 1434, 1436, 1435, 1441, 1433, 1451, 1443, 1438,
-     1446, 1439, 1444, 1435, 1438, 1436, 1439, 1442, 1448, 1441,
-
-     1450, 1449, 1450, 1446, 1452, 1451, 1443, 1454, 1444, 1456,
-     1455, 1446, 1441, 1449, 1451, 1453, 1457, 1446, 1455, 1448,
-     1460, 1458, 1464, 1466, 1459, 1448, 1467, 1450, 1449, 1459,
-     1446, 1452, 1456, 1453, 1454, 1458, 1456, 1455, 1457, 1460,
-     1465, 1466, 1453, 1457, 1461, 1471, 1468, 1460, 1458, 1464,
-     1466, 1461, 1470, 1467, 1465, 1469, 1459, 1473, 1472,    0,
-     1476, 1470, 1477,    0, 1474, 1465, 1465, 1465, 1480, 1477,
-     1469, 1461, 1468, 1468, 1479, 1486, 1479, 1471,    0, 1470,
-     1472, 1465, 1469, 1476, 1473, 1472, 1474, 1476, 1482, 1477,
-     1480, 1474, 1465, 1481, 1483, 1480, 1484, 1481, 1485, 1487,
-
-     1482, 1479, 1486, 1490, 1490, 1484, 1488, 1489, 1494, 1485,
-     1495, 1491, 1494, 1495, 1502, 1482, 1483,    0, 1488, 1491,
-     1481, 1483, 1487, 1484, 1493, 1485, 1487, 1498, 1496, 1489,
-     1490, 1501, 1493, 1488, 1489, 1494, 1496, 1495, 1491, 1497,
-     1499, 1502, 1498, 1501, 1503, 1497, 1499, 1504, 1508, 1505,
-     1506, 1493, 1507, 1509, 1498, 1496, 1511, 1510, 1501, 1512,
-        0, 1504, 1505,    0, 1506, 1514, 1497, 1499, 1503, 1510,
-     1511, 1503, 1515, 1517, 1504, 1508, 1505, 1506, 1507, 1507,
-     1509, 1518, 1519, 1511, 1510, 1512, 1512, 1513, 1518, 1519,
-     1513, 1520, 1514, 1521, 1515, 1517, 1522, 1524, 1525, 1515,
-
-     1517, 1526, 1523, 1527, 1529, 1513, 1520, 1525, 1518, 1519,
-     1523, 1531, 1529, 1528, 1513, 1532, 1534, 1513, 1520, 1533,
-     1521, 1537, 1539, 1522, 1524, 1525, 1528, 1533, 1526, 1523,
-     1527, 1529, 1535, 1531, 1536,    0, 1538, 1543, 1531, 1540,
-     1528, 1535, 1532, 1534, 1541, 1537, 1533, 1540, 1537, 1539,
-     1542, 1538,    0, 1545, 1549, 1536, 1541, 1551, 1542, 1535,
-     1545, 1536, 1538, 1538, 1543, 1546, 1540, 1547, 1548, 1546,
-     1553, 1541, 1554, 1554, 1550, 1556, 1552, 1542, 1538, 1547,
-     1545, 1549, 1550, 1552, 1551, 1555,    0, 1560, 1557, 1559,
-     1553, 1548, 1546, 1556, 1547, 1548, 1561, 1553, 1561, 1554,
-
-     1563, 1550, 1556, 1552, 1559, 1562, 1563, 1564, 1565, 1560,
-     1566, 1555, 1555, 1557, 1560, 1557, 1559, 1571, 1567, 1562,
-     1568, 1569, 1566, 1561, 1576, 1578, 1574, 1563, 1570, 1564,
-     1565, 1572, 1562, 1574, 1564, 1565, 1567, 1566, 1568, 1569,
-     1577, 1570, 1576,    0, 1579, 1567, 1583, 1568, 1569, 1571,
-     1582, 1576, 1579, 1574, 1572, 1570, 1590, 1578, 1572, 1585,
-     1587, 1580, 1582, 1580, 1583, 1586, 1577, 1577, 1580, 1588,
-     1579, 1579, 1587, 1583, 1585, 1591, 1586, 1582, 1592, 1579,
-     1590, 1594, 1596, 1590, 1588, 1592, 1585, 1587, 1580, 1593,
-     1580, 1597, 1586, 1598, 1599, 1602, 1588, 1591,    0, 1600,
-
-        0, 1601, 1591, 1604, 1593, 1592, 1603, 1608, 1594, 1596,
-     1602, 1604, 1600, 1597, 1605, 1607, 1593, 1609, 1597, 1603,
-     1614, 1599, 1602, 1610, 1613, 1598, 1600, 1601, 1601, 1611,
-     1604, 1608, 1612, 1603, 1608, 1616, 1611, 1613, 1607, 1612,
-     1605, 1605, 1607, 1614, 1609, 1610, 1615, 1614, 1617, 1618,
-     1610, 1613, 1619, 1615, 1621, 1622, 1611, 1616, 1623, 1612,
-     1625, 1619, 1616, 1635, 1624, 1621, 1629, 1631, 1631,    0,
-     1618, 1628, 1630, 1615, 1632, 1637, 1618, 1622, 1641, 1619,
-     1617, 1621, 1622, 1624, 1628, 1625, 1634, 1625, 1636, 1638,
-     1623, 1624, 1629, 1629, 1631, 1635, 1630, 1643, 1628, 1630,
-
-     1632, 1632, 1637, 1636, 1646, 1641, 1643, 1638, 1647, 1634,
-     1648, 1650, 1652, 1634, 1653, 1636, 1638,    0, 1654, 1658,
-     1655, 1656, 1663, 1660, 1643, 1655, 1646, 1658, 1667, 1654,
-     1647, 1646, 1669, 1662, 1659, 1647, 1670, 1648, 1650, 1676,
-     1653, 1653, 1672, 1656, 1652, 1654, 1658, 1655, 1656, 1659,
-     1660, 1662, 1665, 1664, 1663, 1667, 1671, 1673, 1669, 1669,
-     1662, 1659, 1664, 1670, 1665, 1675, 1676, 1672, 1674, 1672,
-     1673, 1677, 1678, 1679,    0, 1681, 1680,    0, 1671, 1665,
-     1664, 1674, 1682, 1671, 1673, 1680, 1684, 1675, 1679, 1683,
-     1685, 1688, 1675, 1686, 1689, 1674,    0, 1682, 1677, 1678,
-
-     1679, 1681, 1681, 1680, 1683, 1685, 1684, 1687, 1692, 1682,
-     1690, 1690, 1689, 1684, 1687, 1686, 1683, 1685, 1688, 1691,
-     1686, 1689, 1692, 1694, 1693, 1696, 1691, 1693, 1695, 1697,
-        0, 1704, 1705, 1700, 1687, 1692, 1694, 1690, 1697, 1698,
-     1701, 1699, 1702, 1696, 1698, 1699, 1691, 1706, 1703, 1710,
-     1694, 1693, 1696, 1701, 1695, 1695, 1697, 1700, 1704, 1705,
-     1700, 1721, 1709, 1716, 1702, 1710, 1698, 1701, 1699, 1702,
-     1703, 1709, 1712, 1706, 1706, 1703, 1710, 1713, 1714, 1712,
-     1715, 1716, 1719, 1714, 1717, 1718, 1713, 1715, 1721, 1709,
-     1716, 1717, 1722, 1723, 1718, 1724,    0, 1726,    0, 1712,
-
-     1732, 1725, 1723, 1730, 1713, 1714, 1726, 1715, 1719, 1719,
-     1722, 1717, 1718, 1725, 1727, 1724, 1728, 1729, 1731, 1722,
-     1723, 1734, 1724, 1727, 1726, 1729, 1733, 1728, 1725, 1735,
-     1730,    0, 1732, 1734, 1740, 1733, 1736, 1735, 1739, 1737,
-     1738, 1727, 1741, 1728, 1729, 1731, 1737, 1738, 1734, 1742,
-     1743, 1754, 1747, 1733, 1745,    0, 1735, 1748, 1736, 1740,
-     1739, 1740, 1745, 1736, 1748, 1739, 1737, 1738, 1752, 1741,
-     1747, 1755, 1749, 1753, 1742, 1752, 1742, 1743, 1754, 1747,
-     1749, 1745, 1756, 1755, 1748, 1757, 1762, 1758, 1761, 1760,
-     1763, 1756, 1765, 1767, 1768, 1752, 1769, 1753, 1755, 1749,
-
-     1753, 1760, 1768, 1770, 1763, 1771,    0, 1775, 1778, 1756,
-     1758, 1761, 1757, 1762, 1758, 1761, 1760, 1763, 1779, 1765,
-     1767, 1768, 1776, 1769, 1777, 1770, 1778, 1776, 1780, 1782,
-     1770, 1781, 1771, 1775, 1775, 1778, 1785, 1782, 1777,    0,
-     1779, 1780, 1783, 1786, 1787, 1779, 1789, 1788, 1785, 1776,
-     1790, 1777, 1791, 1781, 1792, 1780, 1782, 1793, 1781, 1788,
-     1794, 1783,    0, 1785, 1795, 1786, 1787, 1798, 1796, 1783,
-     1786, 1787, 1791, 1789, 1788, 1797, 1792, 1790, 1799, 1791,
-     1796, 1792, 1794, 1803, 1802, 1804, 1805, 1794, 1803, 1793,
-     1795, 1795, 1807, 1806, 1798, 1796, 1809, 1797, 1802, 1808,
-
-        0,    0, 1797, 1810,    0, 1799, 1811, 1804, 1809, 1812,
-     1814, 1802, 1804, 1815, 1807, 1803, 1806, 1808, 1805, 1807,
-     1806, 1820, 1810, 1809, 1812, 1817, 1808, 1818, 1811, 1816,
-     1810, 1819, 1821, 1811, 1814, 1815, 1812, 1814, 1816, 1817,
-     1815, 1827, 1829, 1824, 1831, 1818, 1825, 1820, 1820, 1819,
-     1821, 1824, 1817, 1825, 1818, 1826, 1816, 1828, 1819, 1821,
-     1829, 1839, 1830, 1826, 1832, 1828, 1834, 1837, 1827, 1829,
-     1824, 1831, 1832, 1825, 1830, 1838, 1836, 1840, 1834, 1841,
-        0, 1843, 1826, 1836, 1828, 1847, 1844, 1846, 1839, 1830,
-     1837, 1832, 1850, 1834, 1837, 1853, 1840, 1848, 1847, 1843,
-
-     1844, 1841, 1858, 1836, 1840, 1859, 1841, 1838, 1843, 1848,
-     1846, 1860, 1847, 1844, 1846, 1861, 1855, 1863, 1850, 1850,
-     1857, 1864, 1853, 1855, 1848, 1862, 1867, 1857, 1858, 1858,
-     1865,    0, 1859, 1866, 1868, 1860, 1869, 1873, 1860, 1865,
-     1872, 1873, 1861, 1855, 1863, 1872, 1866, 1857, 1864, 1874,
-     1875, 1862, 1862, 1876, 1877, 1876, 1878, 1865, 1867, 1869,
-     1866, 1868, 1881, 1869, 1873, 1884, 1882, 1884, 1885, 1885,
-     1874, 1890, 1872, 1889,    0, 1886, 1874, 1877, 1885, 1887,
-     1876, 1877, 1875, 1878, 1881, 1892, 1889, 1888, 1887, 1881,
-     1882, 1891, 1884, 1882, 1888, 1885, 1885, 1886, 1890, 1891,
-
-     1889, 1893, 1886, 1894, 1892, 1895, 1887, 1896, 1897, 1893,
-        0,    0, 1892, 1899, 1888, 1898, 1900, 1900, 1891, 1897,
-     1899, 1901, 1905, 1906,    0, 1909, 1910, 1907, 1893, 1894,
-     1894, 1895, 1895, 1896, 1896, 1897, 1907, 1898, 1902, 1901,
-     1899, 1911, 1898, 1900, 1903, 1902, 1910, 1906, 1901, 1905,
-     1906, 1903, 1909, 1910, 1907, 1912, 1913, 1915, 1916, 1920,
-     1918, 1919, 1921, 1917, 1920, 1902, 1915, 1924, 1911,    0,
-        0, 1903,    0, 1919, 1913, 1922, 1921, 1912, 1918, 1925,
-     1926, 1933, 1912, 1913, 1915, 1916, 1917, 1918, 1919, 1921,
-     1917, 1920, 1934, 1922, 1924, 1926, 1928, 1925, 1928, 1930,
-
-        0, 1940, 1922, 1933, 1935, 1937, 1925, 1926, 1933, 1938,
-     1942, 1941, 1938, 1943, 1930,    0, 1946, 1942, 1934, 1934,
-     1944, 1943, 1935, 1928, 1947, 1948, 1930, 1937, 1940, 1941,
-     1952, 1935, 1937, 1950, 1954, 1938, 1938, 1942, 1941, 1938,
-     1943, 1951, 1944, 1949, 1958, 1956, 1947, 1944, 1946, 1949,
-     1951, 1947, 1948, 1956, 1953, 1950, 1953, 1957, 1961, 1959,
-     1950, 1954, 1952, 1962, 1960, 1967, 1965, 1963, 1951, 1957,
-     1949, 1958, 1956, 1959, 1962, 1963, 1961, 1964, 1966, 1966,
-     1970, 1953, 1971, 1975, 1957, 1961, 1959, 1960, 1965, 1968,
-     1962, 1960, 1967, 1965, 1963, 1973, 1964, 1968, 1977, 1979,
-
-     1976, 1973, 1984,    0, 1964, 1966, 1980, 1970, 1981, 1971,
-     1975, 1976, 1981, 1980, 1987, 1982, 1968, 1985, 1988, 1987,
-     1977, 1989, 1973, 1982, 1991, 1977, 1979, 1976, 1984, 1984,
-     1985, 1990, 1991, 1980, 1994, 1981, 1993, 1992, 1995, 2000,
-     1996, 1987, 1982, 1993, 1985, 1988, 2001, 1999, 1989, 1990,
-     2003, 1991, 1992, 1998, 1999, 2002, 2005, 2007, 1990, 2003,
-     2009, 1994, 1995, 1993, 1992, 1995, 1996, 1996, 1998, 2011,
-     2014, 2000, 2015, 2001, 1999, 2016, 2006, 2003, 2005, 2002,
-     1998, 2018, 2002, 2005, 2006, 2008, 2008, 2009, 2016, 2007,
-     2012, 2019, 2017, 2020, 2015, 2008, 2011, 2014, 2012, 2015,
-
-     2021, 2023, 2016, 2006, 2028,    0, 2029, 2026, 2018, 2028,
-     2031, 2032, 2008, 2008, 2017, 2026, 2033, 2012, 2019, 2017,
-     2020, 2034, 2021, 2033, 2032, 2035, 2040, 2021, 2023, 2036,
-     2041, 2028, 2029, 2029, 2026,    0, 2039, 2031, 2032, 2034,
-     2042, 2050, 2046, 2033, 2047, 2040,    0, 2044, 2034, 2039,
-        0, 2036, 2035, 2040, 2044, 2048, 2036, 2041, 2045, 2047,
-     2050, 2052, 2042, 2039, 2046, 2045, 2051, 2042, 2050, 2046,
-     2052, 2047, 2053, 2051, 2044, 2055, 2048, 2054, 2054, 2056,
-     2061, 2055, 2048, 2053, 2059, 2045, 2062, 2054, 2052, 2063,
-     2067, 2059, 2069, 2051, 2070, 2070,    0, 2071, 2073, 2053,
-
-     2074, 2056, 2055, 2077, 2054, 2054, 2056, 2061, 2075, 2074,
-     2079, 2059, 2063, 2062, 2078, 2082, 2063, 2067, 2083, 2069,
-     2071, 2075, 2079, 2070, 2071, 2073, 2084, 2074, 2085, 2081,
-     2077, 2086, 2087, 2082, 2078, 2075, 2088, 2079, 2081, 2090,
-        0, 2078, 2082, 2086, 2083, 2083, 2089, 2092, 2089, 2093,
-     2095, 2090, 2094, 2084, 2087, 2085, 2081, 2098, 2086, 2087,
-     2094, 2091, 2101, 2088, 2102, 2103, 2090, 2091, 2105, 2092,
-     2106, 2093, 2108, 2089, 2092, 2109, 2093, 2095, 2110, 2094,
-     2112, 2111, 2116, 2118, 2098, 2115, 2105, 2119, 2091, 2101,
-     2109, 2102, 2103, 2111, 2115, 2105, 2120, 2106, 2129, 2108,
-
-     2119, 2122, 2109, 2121, 2110, 2110, 2116, 2112, 2111, 2116,
-     2122, 2121, 2115, 2123, 2119, 2118, 2132, 2136, 2120, 2133,
-     2134, 2136, 2129, 2120, 2123, 2129, 2133, 2138, 2122, 2137,
-     2121, 2145,    0, 2134, 2139, 2142,    0, 2142, 2141, 2132,
-     2123, 2138, 2139, 2132, 2136, 2137, 2133, 2134, 2140, 2141,
-     2146, 2143, 2144, 2147, 2138, 2148, 2137, 2140, 2145, 2144,
-     2149, 2139, 2142, 2143, 2150, 2141, 2151, 2152, 2146, 2152,
-     2154, 2153, 2155, 2156, 2163, 2140, 2164, 2146, 2143, 2144,
-     2147, 2148, 2148, 2153, 2158, 2155, 2150, 2149, 2151, 2162,
-     2165, 2150, 2160, 2151, 2152, 2166, 2158, 2162, 2153, 2155,
-
-     2156, 2160, 2154, 2165, 2167, 2169, 2163, 2170, 2164, 2166,
-     2172, 2158, 2167, 2171, 2173, 2174, 2162, 2165, 2169, 2160,
-        0, 2171, 2166, 2174, 2172, 2175, 2176, 2177, 2173, 2178,
-     2170, 2167, 2169, 2179, 2170, 2177, 2180, 2172,    0, 2181,
-     2171, 2173, 2174, 2182, 2185, 2184, 2190, 2175, 2176, 2183,
-        0,    0, 2175, 2176, 2177, 2187, 2178, 2183, 2180, 2179,
-     2179, 2181, 2194, 2180, 2188, 2182, 2181,    0, 2198, 2192,
-     2182, 2185, 2188, 2189,    0, 2187, 2183, 2184, 2190, 2191,
-     2195, 2189, 2187, 2192, 2194, 2196, 2199, 2191, 2195, 2194,
-     2197, 2188, 2201, 2196, 2198, 2198, 2192, 2200,    0, 2202,
-
-     2189, 2203, 2204, 2205, 2197, 2200, 2191, 2195, 2199, 2206,
-     2210, 2205, 2196, 2199, 2207, 2208,    0, 2197, 2201, 2201,
-        0, 2213, 2204, 2203, 2200, 2202, 2202, 2214, 2203, 2204,
-     2205, 2209, 2210, 2217, 2207, 2208, 2206, 2210, 2211, 2209,
-     2220, 2207, 2208, 2213, 2215, 2216, 2211, 2218, 2213, 2214,
-     2221, 2223, 2215, 2216, 2214, 2218, 2219, 2224, 2209, 2217,
-     2217, 2222, 2225, 2227, 2219, 2211, 2220, 2220, 2231, 2230,
-     2233, 2215, 2216, 2234, 2218,    0, 2231, 2221, 2223, 2232,
-        0, 2222, 2225, 2219, 2224, 2227,    0, 2232, 2222, 2225,
-     2227, 2230,    0,    0,    0, 2231, 2230, 2233,    0,    0,
-
-     2234,    0,    0,    0,    0,    0, 2232, 2238, 2238, 2238,
-     2238, 2238, 2238, 2238, 2239, 2239, 2239, 2239, 2239, 2239,
-     2239, 2240, 2240, 2240, 2240, 2240, 2240, 2240, 2241, 2241,
-     2241, 2241, 2241, 2241, 2241, 2242, 2242, 2242, 2242, 2242,
-     2242, 2242, 2244, 2244,    0, 2244, 2244, 2244, 2244, 2245,
-     2245,    0,    0,    0, 2245, 2245, 2246, 2246,    0,    0,
-     2246,    0, 2246, 2247,    0,    0,    0,    0,    0, 2247,
-     2248, 2248,    0,    0,    0, 2248, 2248, 2249,    0,    0,
-        0,    0,    0, 2249, 2250, 2250,    0, 2250, 2250, 2250,
-     2250, 2251, 2251,    0, 2251, 2251, 2251, 2251, 2237, 2237,
-
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237, 2237,
-     2237, 2237, 2237, 2237, 2237
+        4,    4,    5,    5,    6,    6,    5,   28,    6,    7,
+        7,    7,    7, 2293,    7,    8,    8,    8,    8,   28,
+        8,    9,    9,    9,   10,   10,   10,   15,   21,   46,
+
+       46,   15,   30,    3,   28,   51,    4,  792,   51,    5,
+       19,    6,   19,   19,   30,   19,   71,    7,   62,   62,
+       71,   19,   76,    8,   21,   21,   20,   20,    9,   30,
+      785,   10,   11,   11,   11,   11,   11,   11,   12,   12,
+       12,   12,   12,   12,   20,   24,   76,   25,   19,   76,
+       20,   26,   11,   20,   20,   22,  142,   33,   12,   26,
+      785,   25,   22,   33,  692,   24,   22,   35,   24,   22,
+       11,   20,   24,   25,   25,  877,   12,   26,   26,   11,
+       35,   22,   22,   29,   33,   12,   26,   67,   25,   22,
+      140,   78,   24,   22,   35,  692,   22,   23,   78,   27,
+
+       67,   23,   27,  877,   23,   29,   23,   23,  139,   27,
+       29,   27,  137,   38,   67,   38,  135,   32,   78,   23,
+      133,   32,   27,   77,   23,   69,   27,   31,   23,   27,
+       38,   23,   79,   23,   23,   31,   27,   32,   27,   38,
+       38,   31,   38,   32,   32,   31,   77,   39,   32,   81,
+       77,   63,   39,   31,   31,   58,   79,   38,   81,   79,
+       39,   36,   31,   40,   32,   36,   53,   40,   31,   83,
+      106,   40,   31,   34,   39,   36,   81,   34,   36,   39,
+      134,  134,   83,   34,  106,   82,   34,   36,   36,   40,
+       40,   87,   36,   34,   40,   34,   83,  106,   40,   87,
+
+       34,  122,   36,   82,   34,   36,   41,   92,   41,   41,
+       34,   41,   82,   34,   86,   52,   92,   41,   87,   86,
+       34,   37,   47,   57,   37,   57,   57,   65,   57,   65,
+       65,   37,   65,  122,   92,   37,   37,   68,   42,   68,
+       68,   86,   68,   37,   70,   14,   70,   70,   37,   70,
+       84,   37,   85,   85,   88,   70,   84,   80,   37,   13,
+       89,   85,   37,   37,   73,   65,   73,   73,   98,   73,
+       80,   84,   88,   89,   91,   73,   95,   84,   90,   85,
+       85,   80,   93,   84,   80,   90,   88,   89,   94,    0,
+       91,   93,   98,   96,  141,  141,  148,   80,   95,   88,
+
+       98,   91,   73,   95,    0,   90,   96,   97,   99,   93,
+       97,   94,    0,    0,    0,   94,   99,  101,  100,   98,
+       96,  101,  102,   97,   97,  102,  103,  105,  148,  104,
+      136,   97,  108,  136,   97,   99,  109,   97,  100,  103,
+      100,  101,  107,  109,  101,  100,  108,  105,  101,  102,
+       97,   97,  104,  103,  105,  110,  104,  111,  112,  108,
+      115,    0,  107,  109,  110,  100,  113,  112,  114,  107,
+      113,  116,    0,  119,    0,  114,    0,  117,  116,  120,
+      111,  119,  110,  117,  111,  112,  115,  115,  113,  118,
+      120,  117,  123,  113,  120,  114,  125,  113,  116,  121,
+
+      119,  118,  124,  120,  117,  125,  120,  123,  127,  126,
+      117,  150,  128,  121,  127,  130,  118,  120,  129,  123,
+      126,  120,  124,  125,  132,  131,  121,  150,  124,  124,
+      130,    0,    0,  128,  131,  127,  126,  128,  150,  128,
+      129,    0,  130,  146,    0,  129,  132,  147,    0,  124,
+        0,  132,  131,  138,  151,  138,  138,  154,  138,  143,
+      128,  143,  143,  144,  143,  144,  144,  146,  144,  147,
+      146,  149,  152,  151,  147,  153,  156,  160,  155,  154,
+      152,  151,  157,  149,  154,  155,  158,  153,  157,    0,
+      159,  161,    0,    0,  156,  161,    0,  163,  149,  152,
+
+      236,  144,  153,  156,  165,  155,  166,  167,  158,  160,
+      164,  167,  161,  158,  157,  157,  159,  159,  164,  161,
+      168,  173,  161,  163,  163,  170,  165,  169,  166,  236,
+      173,  165,  171,  166,  167,    0,    0,  164,  170,  161,
+      162,    0,  174,  168,  171,  162,  175,  168,  173,  169,
+      162,    0,  170,    0,  169,  172,  162,  162,  172,  171,
+        0,  176,  180,  162,  174,  179,  176,  162,  175,  174,
+      172,  181,  162,  175,  177,    0,  179,  162,  176,  178,
+      176,  183,  172,  162,  162,  172,  178,  176,  176,  182,
+      184,  186,  179,  176,  180,  190,  177,  181,  181,  188,
+
+      182,  177,  187,  185,  189,  176,  178,  176,  184,  185,
+        0,  191,  192,  183,  194,  190,    0,  184,  198,  193,
+        0,  182,  190,  186,  187,  191,  193,  182,  196,  187,
+      185,  188,  195,  192,  197,  194,  189,  195,  191,  192,
+      198,  194,  199,  201,  202,  198,  193,  196,  197,  200,
+      201,  204,  205,  203,  199,  196,  206,  205,  210,  195,
+      200,  197,  203,  207,  207,  208,  202,  211,  209,  199,
+      201,  202,  207,  212,  204,  209,  200,  214,  204,  205,
+      203,  213,  217,  210,  215,  210,  216,  211,  206,  213,
+      207,  207,  214,  221,  211,  209,  218,  208,  219,  223,
+
+      220,  221,  219,  222,  214,  212,  224,  225,  213,  216,
+      215,  215,  226,  218,  217,  220,  231,    0,  216,  228,
+      221,  218,  222,  218,  230,  219,  227,  220,  224,  225,
+      222,  223,  228,  224,  225,  231,  216,  230,  227,  229,
+      218,  233,  234,  231,  226,  232,  228,  232,  229,  235,
+      237,  230,  238,  227,  239,  244,    0,    0,  241,  237,
+      240,  243,  242,  245,  248,  233,  229,  234,  233,  234,
+      241,  240,  232,  244,  247,  235,  235,  237,  238,  238,
+      239,  239,  244,  246,  243,  241,  242,  240,  243,  242,
+      248,  248,  249,  250,  251,  245,  246,  253,    0,  252,
+
+      258,  251,  254,  253,  255,    0,  247,  264,  252,  256,
+      246,  257,    0,  259,  249,  260,  254,  273,    0,  249,
+      257,  251,  259,  258,  253,  250,  252,  258,  261,  254,
+      255,  255,  262,  256,  263,  266,  256,  261,  257,  264,
+      259,  260,  260,  265,  273,  268,  270,  279,    0,  263,
+      266,  272,  272,  269,  271,  261,  262,  267,  274,  262,
+      270,  263,  266,  268,    0,  267,  267,  265,  267,  271,
+      265,  269,  268,  270,  279,  267,  272,  269,  272,  272,
+      269,  271,  274,  277,  267,  274,  275,  276,  278,  275,
+      280,  282,  267,  267,  281,  267,  275,  283,  269,  276,
+
+      287,  277,  285,  282,  290,    0,  278,  284,  289,  285,
+      277,  286,  280,  275,  276,  278,  275,  280,  282,  283,
+      281,  281,  284,  286,  283,  291,  288,  294,  296,  285,
+      289,    0,  287,  288,  284,  289,  290,  292,  286,  293,
+      294,  293,  297,  292,    0,  295,  296,  291,  295,  298,
+      295,  300,  291,  288,  294,  296,  295,  301,  300,  292,
+        0,    0,    0,  293,  292,  299,  293,  302,  293,  301,
+      292,  298,  295,  299,  297,  295,  298,  295,  300,  299,
+      302,  303,  304,  307,  301,  308,  306,  309,  310,  313,
+      308,  311,  299,  309,  302,  304,  310,  303,  306,    0,
+
+      299,  307,  313,  311,  312,  303,    0,    0,  303,  304,
+      307,  312,  314,  306,  309,  310,  313,  308,  311,  315,
+      316,  314,  317,  315,  303,  305,  305,  316,  318,  317,
+        0,  312,  319,  320,  322,  305,  321,  305,  305,  305,
+      318,  322,  305,  323,  314,  320,  315,  316,  314,  317,
+      305,  325,  305,  305,  319,  318,    0,  328,  323,  319,
+      320,  322,  305,  324,  305,  305,  305,  327,  321,  305,
+      323,  326,  333,  326,  329,  329,  324,  331,  327,  328,
+      330,  332,  335,  325,  328,  333,  334,  330,  331,  344,
+      324,  336,  332,  337,  327,  341,    0,  338,  326,  333,
+
+        0,  340,  337,  329,  331,  335,  336,  330,  332,  335,
+      338,  334,  339,  334,  336,  342,  343,  341,  336,  340,
+      337,  344,  341,  339,  338,  339,  345,  346,  340,  348,
+      339,  355,  345,  336,  343,  347,    0,  349,  342,  339,
+      350,  351,  342,  343,  349,  353,    0,  352,  346,  354,
+      339,  348,  339,  345,  346,  351,  348,  356,  347,  353,
+      358,  359,  347,  355,  349,  357,  350,  350,  351,  352,
+      360,  357,  353,  362,  352,  354,  354,  363,  361,  359,
+      356,    0,  358,  365,  356,  360,  364,  358,  359,  365,
+      366,    0,  357,  361,  368,  369,  362,  360,  378,  370,
+
+      362,  369,  372,  363,  363,  361,  371,  376,  364,  372,
+      365,  383,  373,  364,  376,  377,  366,  366,  370,  379,
+      368,  368,  369,  375,  371,  375,  370,  373,  377,  372,
+      378,  380,  375,  371,  376,  381,  382,  379,  384,  373,
+      385,  387,  377,  383,  388,  384,  379,  386,  381,  391,
+      375,  389,  375,  380,  387,  382,  389,    0,  380,  393,
+        0,  392,  381,  382,  385,  384,  388,  385,  387,  390,
+      386,  388,  391,  392,  394,  390,  391,  397,  389,  386,
+      399,  393,  395,    0,  397,  394,  393,  398,  392,  400,
+      395,  399,  401,  402,    0,  398,  390,  386,    0,  400,
+
+      402,  394,    0,  403,  397,  405,  404,  399,  404,  395,
+      396,  406,  407,    0,  398,  396,  401,  396,    0,  401,
+      402,  400,  408,  406,  418,  396,  400,  407,  396,  403,
+      403,  405,  405,  404,  408,  396,  396,  396,  406,  407,
+      409,  410,  396,  411,  396,  412,  410,  414,  409,  408,
+      413,  419,  396,  417,  415,  396,  418,    0,  413,  414,
+      420,  421,  396,  412,  423,  411,  419,  409,  410,  420,
+      411,  422,  412,  424,  414,  415,  417,  413,  419,  425,
+      417,  415,  426,  428,  421,  422,  427,  420,  421,  423,
+      429,  423,  424,    0,  430,  431,  433,  432,  422,  434,
+
+      424,  427,  434,  436,  438,  429,  425,  431,  436,  439,
+      434,  437,  440,  427,  426,  428,  435,  429,  430,  432,
+      433,  430,  431,  433,  432,  437,  434,  435,  441,  434,
+      442,  438,  443,  444,  445,  436,  439,  449,  437,  444,
+      446,    0,    0,  435,  440,  448,  447,  450,  446,  451,
+      454,    0,  453,  452,  458,  441,  445,  442,  451,  453,
+      444,  445,  455,  458,  443,  447,  459,  446,  448,  449,
+      450,    0,  448,  447,  450,  452,  451,  456,  457,  453,
+      452,  458,  454,  457,  455,  460,  461,  457,  463,  455,
+      456,  464,  459,  459,  460,  462,  465,  467,  466,    0,
+
+        0,  463,  457,  464,  456,  457,    0,  468,  461,  469,
+      457,  470,  460,  461,  457,  463,  466,  462,  464,  477,
+      473,  467,  462,    0,  467,  466,  471,  472,  465,  468,
+      468,  469,  474,  470,  468,  475,  469,  471,  470,  478,
+      476,  472,  473,  481,  479,  480,  475,  473,  482,  484,
+      474,  477,  486,  471,  472,  476,  468,  482,  485,  474,
+      478,  483,  475,  487,  488,  481,  478,  476,  479,  480,
+      481,  479,  480,  489,  483,  482,  492,  494,  489,  490,
+      485,  484,  491,  495,  486,  485,  488,  487,  483,  493,
+      487,  488,  496,  490,  500,  494,  491,  493,  495,  497,
+
+      498,  501,    0,  501,  494,  489,  490,  495,  492,  491,
+      495,  502,  499,    0,  497,  503,  493,  499,  504,    0,
+      500,  500,  498,  503,  496,  495,  497,  498,  501,  507,
+      505,  506,  509,  510,  508,  511,  502,  507,  502,  505,
+      506,  508,  503,  504,  499,  504,  515,  511,    0,    0,
+      518,  510,  520,  514,  512,  509,  507,  505,  506,  509,
+      510,  508,  511,  512,  513,  514,  516,  517,  520,  519,
+        0,  522,  513,  521,  516,  517,  518,  518,  515,  520,
+      514,  512,  522,  525,  526,  524,  528,  527,    0,  523,
+        0,  513,  519,  516,  517,  521,  519,  523,  522,  524,
+
+      521,  529,  531,  525,  533,  535,  526,  527,  528,  530,
+      525,  526,  524,  528,  527,  532,  523,  533,  530,  534,
+      536,    0,  531,  529,  538,  537,  539,  535,  529,  531,
+      538,  533,  535,  532,    0,  540,  530,  534,  541,  542,
+      545,  544,  532,  540,  536,    0,  534,  536,  537,  544,
+      547,  538,  537,  539,  548,  549,  546,  542,  550,  551,
+        0,  540,  540,  546,  549,  541,  542,  552,  544,  548,
+      540,  566,  545,  547,  564,  563,  552,  547,  551,  560,
+      557,  548,  549,  546,  554,  553,  551,  553,  567,  560,
+      550,  554,  557,  563,  552,  564,  565,  566,  566,  568,
+
+        0,  564,  563,    0,    0,    0,  560,  557,    0,  572,
+      570,  554,  553,  555,  567,  567,  571,  555,  572,  565,
+      555,  574,  571,  565,  573,  575,  573,  555,  580,  576,
+      555,  568,  570,  593,    0,  555,  572,  570,    0,  577,
+      555,  578,  593,  571,  555,  574,  579,  555,  574,  576,
+      580,  573,  575,  578,  555,  580,  576,  555,  569,  569,
+      593,  569,    0,  581,  569,  577,  577,  582,  578,  569,
+      583,  585,  579,  579,    0,  569,  569,  584,  586,  585,
+        0,    0,  590,  598,  569,  569,  569,  581,  569,  582,
+      581,  569,  584,  587,  582,  583,  569,  583,  585,  588,
+
+      587,  586,  569,  569,  584,  586,  589,  588,  590,  590,
+      591,  592,  594,  595,  596,  598,    0,  599,  600,    0,
+      587,  597,  591,  601,  592,  589,  588,  594,  602,    0,
+      608,  605,  603,  589,  611,  595,  606,  591,  592,  594,
+      595,  596,  600,  597,  601,  600,  607,  602,  597,  599,
+      601,  603,  604,  605,  607,  602,  606,  608,  605,  603,
+      609,  604,  610,  606,  612,  614,  611,  615,  617,  616,
+      620,  618,  612,  607,  619,    0,    0,    0,  609,  604,
+      621,  610,  620,  614,  618,  615,  622,  609,  621,  610,
+      617,  612,  614,  616,  615,  617,  616,  620,  618,  623,
+
+      619,  619,  623,  624,  622,  627,  626,  621,  628,  630,
+      631,  624,  629,  622,  628,  630,  632,  631,  633,  635,
+      636,  632,  634,  638,    0,  633,  623,  624,  642,  636,
+      624,  626,  627,  626,  629,  628,  630,  631,  624,  629,
+      634,  638,  635,  632,  637,  633,  635,  636,  639,  634,
+      638,  640,  637,  641,  643,  642,  644,  645,  646,  647,
+      648,  643,    0,  639,  640,    0,  650,  651,  648,  644,
+      652,  637,  653,  651,  641,  639,  649,    0,  640,  659,
+      641,  643,  647,  644,  649,  654,  647,  648,  650,  645,
+      646,  649,  655,  650,  651,  657,  652,  652,  658,  656,
+
+        0,  655,  661,  649,  653,  658,  659,  660,  662,  654,
+      663,  649,  654,  656,  664,  666,  660,  667,  666,  655,
+      662,  669,  664,  672,  673,  658,  656,  657,  669,  661,
+      667,  674,  670,  663,  660,  662,    0,  663,  670,    0,
+      676,  664,  666,  674,  667,  677,    0,  673,  669,  672,
+      672,  673,  675,  678,  675,    0,  679,  677,  674,  670,
+      671,  681,  671,  676,  683,  680,  671,  676,  671,  679,
+      680,  682,  677,  671,  681,  678,  683,    0,  671,  675,
+      678,  685,  684,  679,  671,  689,  686,  671,  681,  671,
+      687,  683,  684,  671,  682,  671,  687,  680,  682,  686,
+
+      671,  688,  690,  685,  684,  671,  689,    0,  685,  684,
+      691,    0,  689,  686,  688,  694,    0,  687,    0,  684,
+      696,  697,  695,    0,  698,  707,    0,  700,  688,    0,
+      694,  699,  702,  696,  690,  704,  697,  691,  693,  701,
+      702,  711,  694,  693,  695,  693,  700,  696,  697,  695,
+      698,  698,  701,  699,  700,  705,  693,  707,  699,  702,
+      703,  708,  704,  693,  693,  693,  701,  709,  703,  716,
+      693,  712,  693,  711,  714,  709,  713,  710,  705,  715,
+      716,  717,  705,  693,  713,  708,    0,  703,  708,  718,
+      693,  710,  714,  712,  709,  720,  716,  715,  712,  722,
+
+      719,  714,  721,  713,  710,  724,  715,  718,  719,  721,
+      725,  723,  722,  717,  726,  730,  718,  720,  723,  737,
+      728,    0,  720,  724,  730,    0,  722,  719,  725,  721,
+      732,  729,  724,  728,  733,    0,  731,  725,  723,  729,
+      734,  735,  730,  736,  740,    0,  726,  728,  731,  741,
+      738,  737,  732,  744,  741,  740,  733,  732,  729,  735,
+      743,  733,  734,  731,  738,  747,  744,  734,  735,  736,
+      736,  740,  742,  746,  751,  742,  745,  738,    0,  748,
+      744,  741,  752,  745,  743,  746,  748,  743,  749,  750,
+      758,  754,  755,  756,  753,  750,  751,  747,  742,  742,
+
+      746,  751,  742,  745,  752,  753,  748,  760,  756,  752,
+      761,  758,  749,  754,  755,  749,  750,  758,  754,  755,
+      756,  753,  759,  762,  764,  767,  763,  765,  760,  768,
+      766,  769,  767,  759,  760,  763,  765,  761,  766,  770,
+      771,  762,  775,  768,  774,  776,  773,  777,  764,  759,
+      762,  764,  767,  763,  765,  773,  768,  766,  775,  778,
+      776,  770,  771,  769,    0,  779,  770,  771,  774,  775,
+      781,  774,  776,  773,  780,  782,  783,  779,  784,  777,
+      787,  786,  789,  782,  789,  796,  788,  791,  794,  783,
+      786,  778,  779,  784,  788,  791,  780,  781,  787,  793,
+
+      794,  780,  782,  783,  795,  784,  797,  787,  786,  789,
+      798,  795,  793,  788,  791,  794,  799,  796,  800,  805,
+      801,  802,  803,  804,    0,  809,  793,  805,    0,    0,
+      807,  795,  798,  801,  802,  804,  806,  798,  797,    0,
+      800,  799,  807,  799,  803,  800,  805,  801,  802,  803,
+      804,  808,  809,  810,  812,  811,  806,  807,  813,  808,
+      816,  817,  814,  806,  811,  813,  810,  820,  821,    0,
+      818,  828,    0,  814,  823,  812,  814,  821,  808,  819,
+      810,  812,  811,  817,  814,  813,  816,  816,  817,  814,
+      818,  820,  819,  822,  820,  821,  823,  818,  828,  824,
+
+      814,  823,  825,  814,  826,  829,  819,  824,  832,  830,
+      831,  822,  826,  833,  834,  835,  832,  837,    0,  845,
+      822,  859,  831,  837,  825,  833,  824,  830,  829,  825,
+      835,  826,  829,  839,  834,  832,  830,  831,  836,  838,
+      833,  834,  835,  840,  837,  841,  836,  849,  838,  842,
+      843,  845,  841,  859,  839,  840,  842,  848,  846,  847,
+      839,  855,    0,    0,  848,  836,  838,  850,  843,  849,
+      840,  846,  841,  852,  849,  851,  842,  843,  847,  853,
+      851,  852,  850,  854,  848,  846,  847,  855,  855,  857,
+      858,  861,  853,  870,  850,  860,    0,  854,    0,    0,
+
+      852,  865,  870,  857,  863,  862,  853,  851,  858,    0,
+      854,  856,  864,  861,  856,  856,  857,  858,  861,  856,
+      870,  860,  860,  862,  896,  856,  863,  865,  865,  856,
+      866,  863,  862,  856,  864,  867,  868,  866,  856,  864,
+      871,  856,  856,  872,  873,    0,  856,  869,    0,  878,
+      874,  896,  856,  867,  876,    0,  856,  866,  868,  880,
+      869,  882,  867,  868,    0,  878,  873,  881,    0,  919,
+      882,  873,  871,  874,  869,  872,  878,  874,  875,  881,
+      876,  876,  880,  875,  883,  875,  880,  875,  882,  875,
+      884,  885,  887,  889,  881,  884,  875,  886,  888,  890,
+
+      887,  919,  883,    0,  885,  875,  889,  894,  895,  894,
+      875,  883,  875,  892,  875,  886,  875,  888,  885,  887,
+      889,  890,  884,  891,  886,  888,  890,  897,  893,  898,
+      895,  892,  903,  900,  894,  895,  891,  893,  902,  897,
+      892,  901,  904,  905,  906,  907,  902,  908,  911,  904,
+      891,  907,  913,    0,  897,  893,  898,  900,  920,  903,
+      900,  910,  912,  901,  921,  902,  906,  911,  901,  904,
+      905,  906,  907,  909,  908,  911,  914,  915,  913,  913,
+      909,  916,  917,  910,  912,  914,  921,  922,  910,  912,
+      920,  921,    0,  923,  924,  926,  917,  925,  915,  927,
+
+      909,  916,  924,  914,  915,  928,  927,  930,  916,  917,
+      929,  923,  928,  925,  929,  934,  933,  931,  932,  922,
+      923,  924,  926,  931,  925,  932,  927,  935,  934,  936,
+      931,  933,  928,  937,  941,  940,  935,  929,  939,  930,
+      937,  943,  934,  933,  931,  932,  938,  939,  938,  942,
+      931,  945,  947,  942,  935,  936,  936,  940,  948,  945,
+      937,  941,  940,  943,  946,  939,  952,  949,  943,  946,
+      947,  950,  954,  938,  950,  953,  942,  948,  945,  947,
+      949,  951,  955,  950,  951,  948,    0,  957,  953,    0,
+      956,  952,    0,  952,  949,  957,  946,  960,  950,  958,
+
+      958,  950,  953,  951,  954,  955,  956,  959,  951,  955,
+      964,  951,  961,  962,  957,  966,  959,  956,  965,  960,
+      962,  961,  968,  966,  960,  972,  958,  965,  967,  969,
+      971,  973,  970,  964,  959,  968,  976,  964,  971,  961,
+      962,  969,  966,  967,  970,  965,  974,  972,  977,  968,
+      979,  973,  972,  975,  976,  967,  969,  971,  973,  970,
+      978,  980,  975,  976,  981,  982,  983,  980,  974,  984,
+        0,  979,  978,  974,  977,  977,  985,  979,  987,    0,
+      975,  988,  989,  990,    0,  994,  981,  978,  980,  992,
+        0,  981,  990,  991,  993,  984,  984,  982,  983,  996,
+
+      989,  992,  985,  985,  988,  987,  991,  997,  988,  989,
+      990,  994,  994,    0,  993,  995,  992,  998,  996,  999,
+      991,  993,  995, 1000, 1006, 1002,  996,  999, 1000,  997,
+      998, 1001, 1002, 1003,  997, 1004, 1001, 1005, 1007, 1007,
+     1008, 1003,  995, 1004,  998, 1005,  999, 1009, 1008, 1010,
+     1011, 1012, 1002, 1013,    0, 1000, 1006, 1015, 1011, 1012,
+     1003, 1013, 1004, 1001, 1005, 1007, 1016, 1008, 1009, 1018,
+     1015, 1014, 1016, 1017, 1009, 1019, 1020, 1011, 1012, 1014,
+     1013, 1010, 1021, 1022, 1015, 1017, 1025, 1024, 1023, 1031,
+     1029, 1020, 1026, 1016, 1038, 1018, 1018, 1029, 1014, 1019,
+
+     1017, 1024, 1019, 1020, 1025, 1022, 1026, 1030, 1027, 1021,
+     1022, 1023, 1027, 1025, 1024, 1023, 1031, 1029, 1030, 1026,
+     1032, 1033, 1034, 1035, 1037, 1027, 1038, 1036, 1039, 1041,
+     1035, 1037,    0, 1027, 1030, 1027, 1036, 1043, 1041, 1027,
+     1044, 1045, 1032, 1047, 1033, 1034,    0, 1032, 1033, 1034,
+     1035, 1037, 1027, 1049, 1036, 1039, 1041, 1050, 1052, 1043,
+     1053, 1055, 1054, 1055, 1043, 1056, 1044, 1044, 1050, 1057,
+     1047, 1058, 1059, 1045, 1054, 1062, 1063, 1060, 1056, 1064,
+     1049, 1063, 1052, 1058, 1050, 1052, 1053, 1053, 1055, 1054,
+     1061, 1057, 1056, 1065, 1069, 1064, 1057, 1061, 1058, 1059,
+
+     1060, 1062, 1062, 1063, 1060, 1066, 1064, 1067, 1073, 1070,
+     1071,    0, 1072, 1066,    0, 1074, 1065, 1061, 1070, 1075,
+     1065, 1069, 1074, 1071, 1078, 1076, 1075, 1077, 1079, 1067,
+     1073, 1078, 1066, 1081, 1067, 1073, 1070, 1071, 1072, 1072,
+     1080, 1082, 1074, 1076, 1083, 1085, 1075, 1086, 1082, 1077,
+     1088, 1078, 1076, 1079, 1077, 1079, 1087, 1090, 1085, 1091,
+     1090, 1092, 1080, 1096, 1087, 1081, 1093, 1080, 1082, 1094,
+     1095, 1088, 1085, 1100, 1086, 1093, 1083, 1088,    0, 1101,
+     1097, 1094, 1102, 1087, 1090, 1091, 1091, 1092, 1092, 1096,
+     1096, 1098, 1105, 1093, 1095, 1097, 1094, 1095, 1098, 1099,
+
+     1102, 1101, 1099, 1103, 1106, 1100, 1101, 1097, 1104, 1102,
+     1104, 1107, 1108, 1111, 1099, 1110, 1105, 1113, 1098, 1105,
+     1109, 1108, 1110, 1099, 1112, 1103, 1099, 1114, 1109, 1099,
+     1103, 1114, 1116, 1115, 1117, 1104, 1106, 1107, 1107, 1108,
+     1121, 1099, 1110, 1118, 1125, 1111, 1112, 1109,    0, 1113,
+     1119, 1112, 1118, 1121, 1114, 1115, 1117, 1119, 1120, 1116,
+     1115, 1117, 1122, 1123, 1126, 1120, 1124, 1121, 1128, 1131,
+     1118, 1126, 1127,    0, 1134, 1122, 1125, 1119, 1123, 1127,
+     1124, 1128, 1129, 1133, 1136, 1120, 1135, 1132, 1129, 1122,
+     1123, 1126, 1140, 1124, 1132, 1128, 1131, 1136, 1135, 1127,
+
+     1134, 1134, 1139, 1137, 1140, 1133, 1137, 1138, 1141, 1129,
+     1133, 1136, 1143, 1135, 1132, 1142, 1138, 1148, 1142, 1140,
+     1139, 1149, 1147, 1143, 1147, 1152, 1145, 1150, 1141, 1139,
+     1137, 1145, 1151, 1142, 1138, 1141, 1159, 1154, 1145, 1143,
+     1151,    0, 1142, 1157, 1148, 1142, 1153, 1152, 1149, 1147,
+     1158, 1150, 1152, 1145, 1150, 1154,    0, 1153, 1145, 1151,
+     1155, 1157, 1156, 1159, 1154, 1156, 1162, 1160, 1155, 1161,
+     1157, 1163,    0, 1153, 1160, 1162, 1165, 1164, 1172, 1167,
+     1156, 1167, 1158, 1161, 1163, 1169, 1168, 1155, 1164, 1156,
+     1170, 1165, 1156, 1162, 1160, 1168, 1161, 1171, 1163, 1175,
+
+     1172, 1170, 1173, 1165, 1164, 1172, 1167, 1174, 1175, 1176,
+     1174, 1169, 1169, 1168, 1176, 1171, 1173, 1170, 1178, 1180,
+     1181, 1179, 1182, 1183, 1171, 1174, 1175,    0, 1173, 1173,
+     1179, 1186, 1184, 1187, 1174,    0, 1189, 1174, 1186, 1192,
+     1188, 1176, 1189, 1173, 1182, 1193, 1180, 1192, 1179, 1182,
+     1178, 1201, 1181, 1184, 1188, 1183, 1194,    0, 1186, 1184,
+     1189, 1197, 1195, 1189, 1193, 1187, 1192, 1188, 1196, 1189,
+     1194, 1195, 1193, 1198, 1202, 1203, 1196, 1199, 1201, 1207,
+        0, 1202,    0, 1194, 1198, 1204, 1199, 1205, 1206, 1195,
+     1208, 1210, 1211, 1197, 1208, 1196, 1213, 1207, 1203,    0,
+
+     1198, 1202, 1203, 1210, 1199, 1214, 1207, 1204, 1212, 1205,
+     1206, 1215, 1204, 1218, 1205, 1206, 1213, 1208, 1210, 1211,
+     1214, 1212, 1216, 1213, 1217, 1219, 1215, 1220, 1222, 1221,
+     1216, 1217, 1214, 1223, 1224, 1212, 1220, 1226, 1215, 1228,
+     1219, 1231, 1230, 1229, 1227, 1218,    0,    0, 1231, 1216,
+     1221, 1217, 1219, 1235, 1220, 1222, 1221, 1223, 1229, 1226,
+     1223, 1224, 1227, 1236, 1226, 1233, 1228, 1230, 1231, 1230,
+     1229, 1227, 1232, 1234, 1233, 1235, 1237, 1232, 1241, 1239,
+     1235, 1236, 1234, 1238, 1240, 1241, 1242, 1243, 1244, 1248,
+     1236, 1237, 1233,    0, 1250, 1238, 1246, 1240, 1242, 1232,
+
+     1234, 1239, 1240, 1237, 1246, 1241, 1239, 1252, 1253, 1245,
+     1238, 1240, 1247, 1242, 1243, 1245, 1248, 1255, 1249, 1247,
+     1244, 1250, 1251, 1246, 1240, 1249, 1254, 1257, 1251, 1258,
+     1259, 1253,    0, 1261, 1252, 1253, 1245, 1262, 1258, 1247,
+     1260, 1255, 1260, 1263, 1255, 1249, 1264,    0, 1266, 1251,
+     1268,    0,    0, 1272, 1267, 1266, 1258, 1261, 1254, 1257,
+     1261, 1267, 1259, 1271, 1262, 1273, 1272, 1260, 1271, 1263,
+     1263, 1277, 1265, 1265, 1265, 1266, 1269, 1274, 1264, 1265,
+     1272, 1267, 1268, 1269, 1275, 1276, 1280, 1265, 1279, 1277,
+     1273, 1286, 1273, 1274, 1279, 1271, 1275, 1282, 1277, 1265,
+
+     1265, 1265, 1278, 1269, 1274, 1283, 1265, 1281, 1281, 1278,
+     1285, 1275, 1283, 1280, 1284, 1279, 1290, 1276, 1286, 1284,
+     1289, 1291, 1290, 1282, 1282, 1293, 1294, 1292,    0, 1278,
+     1295, 1295, 1283, 1296, 1281, 1298, 1285, 1285, 1289, 1292,
+     1301, 1284, 1300, 1290, 1294, 1293, 1298, 1289, 1291, 1297,
+     1297, 1302, 1293, 1294, 1292, 1303, 1304, 1295, 1302, 1296,
+     1296, 1305, 1298, 1306, 1300, 1307,    0, 1308, 1311, 1300,
+     1309, 1310, 1301,    0,    0, 1303, 1297, 1309, 1302, 1310,
+     1312,    0, 1303, 1311, 1315, 1308,    0, 1307, 1304, 1317,
+     1306, 1313, 1307, 1305, 1308, 1311, 1316, 1309, 1310, 1323,
+
+     1313, 1314, 1314, 1320, 1312, 1317, 1319, 1312, 1316, 1322,
+     1315, 1315, 1317, 1324, 1319, 1320, 1317, 1322, 1313, 1325,
+     1326, 1328, 1323, 1316,    0, 1329, 1323, 1332, 1314, 1330,
+     1320, 1329, 1317, 1319, 1324, 1333, 1322, 1325, 1327,    0,
+     1324, 1335, 1330, 1327, 1331, 1334, 1325, 1326, 1328, 1337,
+     1334, 1331, 1329, 1338, 1327, 1341, 1330, 1336, 1336, 1332,
+     1340, 1343, 1333, 1343, 1337, 1327, 1342, 1344, 1346, 1345,
+     1327, 1331,    0, 1335, 1345, 1340, 1337, 1334, 1341, 1347,
+     1349, 1342, 1341, 1350, 1336, 1338, 1351, 1340, 1343, 1352,
+     1353, 1354,    0, 1342, 1347,    0, 1345, 1353, 1355, 1344,
+
+     1346, 1357, 1356, 1358, 1349, 1360, 1347, 1349,    0, 1350,
+     1350, 1362, 1367, 1351,    0, 1369, 1352, 1353, 1363, 1355,
+     1371, 1358, 1357, 1354, 1356, 1355, 1365, 1360, 1357, 1356,
+     1358, 1366, 1360, 1363, 1368, 1362, 1372, 1369, 1362, 1367,
+     1370, 1365, 1369, 1372,    0, 1363, 1366, 1371, 1373, 1375,
+     1374, 1376, 1368, 1365, 1378,    0, 1379, 1375, 1366, 1374,
+     1377, 1368, 1370, 1372, 1382, 1386, 1373, 1370, 1381, 1379,
+     1383, 1384, 1390, 1382, 1376, 1373, 1375, 1374, 1376, 1381,
+     1391, 1392, 1377, 1379, 1390, 1388, 1378, 1377, 1383, 1384,
+     1393, 1382, 1386, 1391, 1381, 1381, 1388, 1383, 1384, 1390,
+
+     1393, 1394,    0, 1396, 1395, 1397, 1381, 1391, 1400,    0,
+     1401,    0, 1388, 1392, 1399, 1400, 1403, 1393, 1404, 1411,
+     1402,    0, 1403,    0, 1397, 1405, 1411, 1394, 1394, 1395,
+     1396, 1395, 1397, 1404, 1399, 1400, 1401, 1401, 1402, 1406,
+     1405, 1399, 1409, 1403, 1408, 1404, 1411, 1402, 1407, 1407,
+     1412, 1413, 1405, 1414, 1406, 1409, 1408, 1415,    0, 1416,
+     1421, 1418, 1414, 1409, 1415, 1412, 1406, 1417, 1418, 1409,
+     1420, 1408, 1422, 1423, 1430, 1407, 1424, 1412, 1413, 1427,
+     1414, 1422, 1409, 1416, 1415, 1421, 1416, 1421, 1418, 1417,
+     1426, 1432, 1420, 1434, 1417, 1423, 1424, 1420, 1429, 1422,
+
+     1423, 1430, 1433, 1424, 1427, 1436, 1427,    0, 1426, 1431,
+     1431, 1429, 1435, 1432, 1436, 1434, 1437, 1426, 1432, 1438,
+     1434, 1440, 1439, 1437, 1449, 1429, 1441, 1433, 1444, 1433,
+     1443, 1445, 1436, 1446, 1435, 1440, 1431,    0, 1443, 1435,
+     1447, 1444, 1450, 1437, 1439, 1441, 1451, 1448, 1440, 1439,
+     1452, 1438, 1447, 1441, 1448, 1444, 1449, 1443, 1445, 1446,
+     1446, 1453,    0, 1454, 1450, 1452,    0, 1447,    0, 1450,
+     1456, 1451, 1458, 1451, 1448, 1455, 1457, 1452, 1455, 1460,
+     1459,    0, 1457,    0, 1466,    0, 1462, 1453, 1453, 1454,
+     1454, 1466, 1463, 1455, 1460, 1456, 1465, 1456, 1459, 1458,
+
+     1467, 1468, 1455, 1457, 1470, 1455, 1460, 1459, 1462, 1467,
+     1465, 1466, 1468, 1462, 1463, 1472, 1475, 1470, 1473, 1463,
+     1474, 1476, 1474, 1465, 1478, 1470, 1480, 1467, 1468, 1479,
+     1473, 1470, 1477, 1481, 1475, 1483, 1472, 1479, 1482, 1484,
+     1483, 1488, 1472, 1475, 1470, 1473, 1490, 1474, 1476, 1480,
+     1477, 1478, 1482, 1480, 1485, 1481, 1479, 1489, 1484, 1477,
+     1481, 1485, 1491, 1493, 1490, 1482, 1484, 1483, 1488, 1492,
+     1494, 1489, 1495, 1490, 1497,    0, 1500,    0, 1493, 1494,
+     1496, 1485, 1489, 1489, 1489, 1501, 1498, 1502,    0, 1491,
+     1493, 1504, 1501, 1504, 1505, 1492, 1492, 1494, 1489, 1500,
+
+     1508, 1497, 1496, 1500, 1495, 1507, 1511, 1496, 1498, 1489,
+     1502, 1506, 1501, 1498, 1502, 1506, 1505, 1507, 1504, 1509,
+     1510, 1505, 1508, 1513,    0, 1512, 1516, 1508, 1509, 1514,
+     1527, 1510, 1507, 1511, 1516, 1513, 1515, 1515, 1506, 1519,
+        0, 1518, 1520, 1519, 1523, 1520, 1509, 1510, 1512, 1518,
+     1513, 1514, 1512, 1516, 1521, 1522, 1514, 1527, 1524, 1523,
+     1526, 1522, 1521, 1515, 1524, 1528, 1519, 1530, 1518, 1520,
+     1529, 1523, 1526, 1532, 1531, 1533, 1534, 1536, 1535, 1539,
+     1530, 1521, 1522, 1537, 1529, 1524, 1540, 1526, 1531, 1528,
+     1535, 1536, 1528, 1538, 1530, 1542, 1538, 1529, 1546, 1532,
+
+     1532, 1531, 1533, 1534, 1536, 1535, 1539, 1543, 1540, 1537,
+     1537, 1538, 1544, 1540, 1543, 1545, 1547, 1542, 1548, 1544,
+     1538, 1549, 1542, 1538, 1550, 1546, 1548, 1551, 1552, 1554,
+     1545, 1553, 1557, 1550, 1543, 1556, 1559, 1554, 1558, 1544,
+     1560,    0, 1545, 1547, 1553, 1548, 1558, 1561, 1549, 1560,
+     1564, 1550, 1562, 1565, 1551, 1552, 1554, 1556, 1553, 1557,
+     1563, 1565, 1556, 1559, 1567, 1558, 1566, 1560, 1561, 1568,
+     1572, 1573, 1567, 1574, 1561, 1563, 1562, 1564, 1566, 1562,
+     1565, 1570, 1572, 1576, 1575, 1571, 1563, 1563, 1570, 1571,
+     1580, 1567, 1575, 1566, 1573, 1578, 1568, 1572, 1573, 1577,
+
+     1574, 1581, 1563, 1579, 1579,    0, 1577, 1582, 1570, 1584,
+     1576, 1575, 1571, 1585, 1596, 1578, 1580, 1580, 1586, 1581,
+     1586, 1588, 1578, 1587, 1584, 1589, 1577, 1588, 1581, 1590,
+     1579, 1591, 1582,    0, 1582, 1585, 1584, 1587, 1597, 1592,
+     1585, 1593, 1594, 1591,    0, 1586, 1596, 1589, 1588, 1595,
+     1587, 1590, 1589, 1601, 1603, 1602, 1590, 1592, 1591, 1593,
+     1594, 1597, 1595, 1599, 1619, 1597, 1592, 1604, 1593, 1594,
+     1599, 1601, 1605, 1607, 1605, 1604, 1595, 1608, 1611, 1605,
+     1601, 1602, 1602, 1610, 1612, 1607, 1603, 1616, 1613, 1611,
+     1599, 1619, 1615, 1604, 1604, 1608, 1612, 1618, 1610, 1605,
+
+     1607, 1605, 1604, 1613, 1608, 1611, 1617, 1621, 1622, 1616,
+     1610, 1612, 1618, 1617, 1616, 1613, 1615, 1623, 1624, 1615,
+     1625, 1628,    0,    0, 1618, 1626,    0, 1627, 1629, 1630,
+     1622, 1631, 1635, 1617, 1621, 1622, 1628, 1630, 1626, 1633,
+     1634, 1629, 1643, 1636, 1637,    0,    0, 1625, 1628, 1623,
+     1624, 1637, 1626, 1627, 1627, 1629, 1630, 1631, 1631, 1635,
+     1639, 1638, 1633, 1640, 1634, 1636, 1633, 1634, 1638, 1641,
+     1636, 1637, 1642, 1639, 1643, 1645, 1641, 1644, 1647, 1648,
+     1649, 1650, 1651, 1661, 1645,    0, 1640, 1639, 1638, 1647,
+     1640, 1655, 1656,    0, 1642, 1658, 1641, 1654, 1644, 1642,
+
+     1650, 1648, 1645, 1660, 1644, 1647, 1648, 1651, 1650, 1651,
+     1654, 1663, 1649, 1657, 1657, 1661, 1656, 1655, 1655, 1656,
+     1662, 1658, 1658, 1664, 1654, 1667, 1660, 1669, 1674, 1672,
+     1660, 1673, 1676, 1678, 1679, 1662, 1669, 1680, 1663, 1681,
+     1657, 1664, 1686, 1689, 1681, 1682, 1693, 1662, 1680, 1684,
+     1664, 1672, 1667, 1673, 1669, 1674, 1672, 1684, 1673, 1676,
+     1679, 1679, 1685, 1688, 1680, 1678, 1681, 1682, 1691, 1686,
+     1690, 1696, 1682, 1693, 1695, 1689, 1684, 1685, 1698, 1690,
+     1691, 1688, 1697, 1699, 1701, 1702, 1700, 1703, 1704, 1685,
+     1688, 1707, 1705, 1706,    0, 1691, 1699, 1690, 1696, 1700,
+
+     1695, 1695, 1706, 1698, 1697, 1698, 1701, 1705, 1708, 1697,
+     1699, 1701, 1702, 1700, 1703, 1704, 1709, 1707, 1707, 1705,
+     1706, 1710, 1711, 1708, 1712, 1713, 1714, 1715, 1716, 1716,
+     1718, 1709, 1713, 1717, 1720, 1708, 1719, 1711, 1721, 1719,
+     1717, 1710,    0, 1709, 1718, 1715, 1712, 1720, 1710, 1711,
+     1722, 1712, 1713, 1714, 1715, 1716, 1726, 1718, 1723, 1727,
+     1717, 1720, 1728, 1719, 1721, 1721, 1724, 1723, 1722, 1725,
+     1729, 1724, 1727, 1725, 1730, 1731,    0, 1722, 1732, 1735,
+     1726, 1740, 1736, 1726, 1728, 1723, 1727, 1737, 1735, 1728,
+     1740, 1746, 1729, 1724, 1741, 1737, 1725, 1729, 1736, 1741,
+
+     1739, 1730, 1731, 1742, 1732, 1732, 1735, 1739, 1740, 1736,
+     1742, 1743, 1744, 1745, 1737, 1748, 1749, 1746, 1746, 1744,
+     1755, 1741, 1745, 1750, 1751, 1752, 1753, 1739, 1757, 1743,
+     1742, 1755, 1750, 1756, 1749, 1753, 1754, 1752, 1743, 1744,
+     1745, 1756, 1748, 1749, 1751, 1754, 1758, 1755, 1759, 1760,
+     1750, 1751, 1752, 1753, 1761, 1757, 1762, 1763, 1760, 1768,
+     1756, 1764, 1765, 1754, 1762, 1766, 1761, 1770, 1764, 1765,
+     1767, 1769, 1774, 1758, 1772,    0, 1760, 1781, 1775, 1763,
+     1759, 1761, 1772, 1762, 1763, 1775, 1768, 1766, 1764, 1765,
+     1774, 1780, 1766, 1784, 1770, 1767, 1769, 1767, 1769, 1774,
+
+     1776, 1772, 1779, 1783, 1781, 1775,    0, 1782, 1776, 1779,
+     1785, 1787, 1783, 1788, 1789, 1780, 1792, 1790, 1780, 1782,
+     1784, 1794, 1796, 1787, 1795, 1797, 1798, 1776, 1802, 1779,
+     1783, 1790, 1795, 1785, 1782,    0, 1788, 1785, 1787, 1805,
+     1788, 1789, 1804, 1792, 1790, 1803, 1806, 1797, 1794, 1796,
+     1803, 1795, 1797, 1798, 1802, 1802, 1804, 1805, 1807, 1808,
+     1810, 1813, 1809, 1812, 1815, 1816, 1805, 1817, 1806, 1804,
+     1809, 1807, 1803, 1806, 1814, 1812, 1815, 1818, 1819, 1810,
+     1820, 1808, 1822, 1813, 1821, 1807, 1808, 1810, 1813, 1809,
+     1812, 1815, 1816, 1824, 1817, 1823, 1814, 1818, 1825, 1826,
+
+     1819, 1814, 1829, 1833, 1818, 1819, 1821, 1823, 1822, 1822,
+     1831, 1821, 1820, 1830, 1832, 1824, 1829, 1834, 1830, 1837,
+     1824, 1835, 1823, 1840, 1836, 1825, 1826, 1839, 1838, 1829,
+        0, 1837, 1831, 1842, 1843, 1833, 1832, 1831, 1840,    0,
+     1834, 1832, 1836, 1835, 1834, 1830, 1837, 1838, 1835, 1839,
+     1840, 1836, 1845, 1844, 1839, 1838, 1843, 1842, 1846, 1847,
+     1842, 1843, 1844, 1848, 1849, 1852, 1845, 1853, 1855, 1857,
+     1854, 1859, 1858, 1852, 1853, 1856, 1846, 1847, 1854, 1845,
+     1844, 1865, 1849, 1856, 1858, 1846, 1847, 1857, 1862, 1848,
+     1848, 1849, 1852, 1860, 1853, 1855, 1857, 1854, 1859, 1858,
+
+     1862, 1860, 1856, 1864, 1865, 1866, 1867, 1868, 1865, 1869,
+     1864, 1871, 1874, 1872, 1881, 1862, 1876,    0, 1878, 1875,
+     1860, 1887,    0,    0, 1886,    0, 1868, 1872, 1876, 1871,
+     1864, 1869, 1875, 1867, 1868, 1874, 1869, 1866, 1871, 1874,
+     1872, 1881, 1883, 1876, 1878, 1878, 1875, 1885, 1887, 1883,
+     1886, 1886, 1888, 1889, 1885, 1890, 1891, 1892, 1893, 1894,
+     1895, 1896, 1901, 1900, 1897, 1903, 1901, 1893, 1900, 1883,
+        0, 1906, 1894, 1902, 1885, 1904, 1888, 1904, 1905, 1888,
+     1889, 1890, 1890, 1891, 1892, 1893, 1894, 1897, 1896, 1901,
+     1909, 1897, 1895,    0, 1902, 1900, 1910, 1903, 1906, 1915,
+
+     1902, 1905, 1904, 1913, 1912, 1905, 1912, 1916, 1914, 1914,
+     1919, 1918, 1909, 1921,    0, 1917, 1916, 1909, 1914, 1923,
+     1910, 1915, 1917, 1910, 1918, 1920, 1915, 1913, 1924, 1927,
+     1913, 1912, 1921, 1920, 1916, 1914, 1914, 1919, 1918, 1922,
+     1921, 1925, 1917, 1928, 1930, 1923, 1923, 1922, 1926, 1934,
+     1928, 1927, 1920, 1931, 1924, 1924, 1927, 1929, 1929, 1926,
+     1931, 1935, 1930, 1938, 1936, 1932, 1922, 1925, 1925, 1939,
+     1928, 1930, 1932, 1936, 1940, 1926, 1934, 1941, 1944, 1942,
+     1931, 1945,    0, 1948, 1929, 1935, 1946, 1944, 1935, 1939,
+     1938, 1936, 1932, 1947, 1951, 1948, 1939, 1942, 1949, 1941,
+
+     1950, 1940, 1953, 1949, 1941, 1944, 1942, 1954, 1945, 1946,
+     1948, 1947, 1951, 1946, 1950, 1957, 1955, 1957, 1959, 1962,
+     1947, 1951, 1963,    0, 1969, 1954, 1964, 1950, 1966, 1953,
+     1949, 1955, 1967, 1959, 1954, 1967, 1970, 1975, 1977, 1973,
+     1971, 1962, 1957, 1955, 1964, 1959, 1962, 1971, 1963, 1963,
+     1966, 1969, 1972, 1964, 1970, 1966, 1976, 1982, 1967, 1967,
+     1972, 1973, 1967, 1970, 1978, 1977, 1973, 1971, 1979, 1975,
+     1980, 1981, 1984, 1978, 1979, 1983, 1986, 1983, 1976, 1972,
+     1981, 1987, 1988, 1976, 1986, 1992, 1989, 1990, 1991, 1982,
+     1997, 1978, 1980, 1987, 1995, 1979, 1992, 1980, 1981, 1984,
+
+     1989, 1994, 1983, 1986, 1996, 1996, 1991, 2000, 1987, 1988,
+     1990, 1993, 1992, 1989, 1990, 1991, 1995, 1997, 1998, 1993,
+     1994, 1995, 2001, 2003, 2005, 2006, 1998,    0, 1994, 2003,
+     2009, 1996, 2007, 2010, 2000, 2011, 2006, 2014, 1993, 2011,
+     2010, 2017, 2018, 2015, 2019, 1998, 2017, 2012, 2020, 2001,
+     2003, 2005, 2006, 2021, 2007, 2012, 2015, 2009, 2022, 2007,
+     2010, 2021, 2011, 2014, 2014, 2023, 2020, 2024, 2017, 2018,
+     2015, 2019, 2023, 2022, 2012, 2020, 2025, 2030, 2026, 2029,
+     2021, 2028,    0, 2031, 2038, 2022, 2029, 2032, 2033,    0,
+     2035, 2036, 2023, 2037, 2024,    0, 2028, 2033, 2040, 2042,
+
+     2025, 2037, 2045, 2025, 2026, 2026, 2029, 2049, 2028, 2030,
+     2031, 2032, 2035, 2036, 2032, 2033, 2038, 2035, 2036, 2043,
+     2037, 2039, 2039, 2046, 2047, 2040, 2042, 2043, 2050, 2045,
+     2048, 2039, 2051, 2054, 2049, 2057, 2052, 2047, 2060, 2059,
+     2062, 2063,    0, 2057, 2059, 2046, 2043, 2066, 2039, 2039,
+     2046, 2047, 2048, 2065, 2063, 2050, 2067, 2048, 2052, 2051,
+     2054, 2072, 2057, 2052, 2060, 2060, 2059, 2062, 2063, 2064,
+     2071, 2065, 2070, 2073, 2066, 2075, 2064, 2076, 2067, 2077,
+     2065,    0, 2075, 2067, 2076, 2070, 2079, 2082, 2072, 2071,
+     2078, 2081,    0,    0, 2082, 2073, 2064, 2071, 2085, 2070,
+
+     2073, 2077, 2075, 2084, 2076, 2078, 2077, 2079, 2083, 2085,
+     2081, 2088, 2084, 2079, 2082, 2083, 2087, 2078, 2081, 2086,
+     2086, 2091, 2087, 2093, 2094, 2085, 2095, 2099, 2091, 2086,
+     2084, 2101, 2103, 2088, 2105, 2083, 2102, 2102, 2088,    0,
+     2109,    0,    0, 2087, 2110,    0, 2086, 2086, 2091, 2095,
+     2093, 2094, 2114, 2095, 2099, 2103, 2107, 2106, 2101, 2103,
+     2111, 2105, 2115, 2116, 2110, 2102, 2106, 2109, 2113, 2107,
+     2114, 2110, 2111, 2117, 2118, 2119, 2120, 2113, 2121, 2114,
+     2122, 2123, 2122, 2107, 2106, 2124, 2118, 2111, 2115, 2115,
+     2116, 2124, 2125, 2123, 2126, 2113, 2127, 2119, 2128, 2131,
+
+     2117, 2118, 2119, 2120, 2127, 2134, 2135, 2122, 2123, 2136,
+     2121, 2138, 2124, 2139, 2125, 2141, 2126, 2143, 2144, 2125,
+     2142, 2126, 2145, 2127, 2149, 2128, 2131, 2152, 2148, 2138,
+     2144,    0, 2134, 2135, 2151, 2142, 2136, 2148, 2138, 2153,
+     2139, 2154, 2141, 2143, 2143, 2144, 2155, 2142, 2149, 2145,
+     2163, 2149, 2153, 2156, 2155, 2148, 2157, 2168, 2151, 2152,
+        0, 2151, 2156, 2154, 2166, 2167, 2153, 2157, 2154, 2171,
+     2168, 2170, 2167, 2155, 2163, 2170, 2172, 2163, 2174, 2173,
+     2156, 2175, 2178, 2157, 2168, 2171, 2174, 2166, 2176, 2180,
+     2175, 2166, 2167, 2173, 2178, 2177, 2171, 2177, 2170, 2176,
+
+     2179, 2181, 2172, 2172, 2182, 2174, 2173, 2179, 2175, 2178,
+     2183, 2184, 2186, 2187, 2190, 2176, 2180, 2185, 2188, 2181,
+     2188, 2189, 2177, 2192,    0, 2200,    0, 2179, 2181, 2191,
+     2201, 2182, 2198, 2189, 2186, 2187, 2183, 2183, 2184, 2186,
+     2187, 2185, 2191, 2194, 2185, 2188, 2190, 2203, 2189, 2196,
+     2192, 2198, 2199, 2202, 2206, 2194, 2191, 2200, 2196, 2198,
+     2199, 2203, 2201, 2204, 2207, 2209, 2202, 2206, 2210, 2211,
+     2194, 2204, 2208, 2209, 2203, 2213, 2196, 2212, 2214, 2199,
+     2202, 2206, 2210, 2211, 2216, 2212, 2217, 2207, 2218, 2223,
+     2204, 2207, 2209, 2215, 2208, 2210, 2211, 2213,    0, 2208,
+
+     2214, 2215, 2213, 2219, 2212, 2214, 2220, 2221, 2222, 2224,
+     2230, 2216, 2227,    0, 2218, 2218, 2222,    0, 2217, 2226,
+     2215, 2223,    0, 2228, 2232, 2219, 2251, 2226, 2220, 2221,
+     2219, 2228, 2227, 2220, 2221, 2222, 2224, 2229, 2232, 2227,
+     2231, 2234, 2230, 2235, 2234, 2229, 2226, 2236, 2231, 2237,
+     2228, 2232, 2238, 2251, 2239, 2236, 2240, 2237, 2242, 2234,
+     2241, 2241, 2244,    0, 2229, 2235, 2238, 2231, 2234, 2243,
+     2235, 2234, 2245, 2246, 2236,    0, 2237, 2243, 2240, 2238,
+     2239, 2239, 2247, 2240, 2242, 2242, 2248, 2241, 2244, 2244,
+     2249, 2250, 2255, 2257, 2248, 2246, 2243, 2254, 2245, 2245,
+
+     2246, 2252, 2247, 2253, 2260, 2254,    0, 2256,    0, 2247,
+     2261, 2266, 2249, 2248, 2255, 2256, 2250, 2249, 2250, 2255,
+     2257, 2252, 2264, 2253, 2254, 2258, 2260, 2262, 2252, 2269,
+     2253, 2260, 2261, 2258, 2256, 2262, 2263, 2261, 2266, 2267,
+     2270, 2271, 2268, 2273, 2263, 2274,    0, 2267, 2264, 2264,
+     2268, 2275, 2258, 2277, 2262, 2269, 2269, 2280, 2283, 2284,
+        0, 2271,    0, 2263,    0, 2281, 2267, 2270, 2271, 2268,
+     2273, 2275, 2274, 2281, 2282, 2277,    0,    0, 2275, 2280,
+     2277,    0, 2282,    0, 2280, 2283, 2284,    0,    0,    0,
+        0,    0, 2281,    0,    0,    0,    0,    0,    0,    0,
+
+        0, 2282, 2288, 2288, 2288, 2288, 2288, 2288, 2288, 2289,
+     2289, 2289, 2289, 2289, 2289, 2289, 2290, 2290, 2290, 2290,
+     2290, 2290, 2290, 2291, 2291, 2291, 2291, 2291, 2291, 2291,
+     2292, 2292, 2292, 2292, 2292, 2292, 2292, 2294, 2294,    0,
+     2294, 2294, 2294, 2294, 2295, 2295,    0,    0,    0, 2295,
+     2295, 2296, 2296,    0,    0, 2296,    0, 2296, 2297,    0,
+        0,    0,    0,    0, 2297, 2298, 2298,    0,    0,    0,
+     2298, 2298, 2299,    0,    0,    0,    0,    0, 2299, 2300,
+     2300,    0, 2300, 2300, 2300, 2300, 2301, 2301,    0, 2301,
+     2301, 2301, 2301, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287,
+     2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287, 2287
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -2807,7 +2866,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 2809 "<stdout>"
+#line 2868 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -3030,7 +3089,7 @@ YY_DECL
 	{
 #line 207 "util/configlexer.lex"
 
-#line 3032 "<stdout>"
+#line 3091 "<stdout>"
 
 	while ( /*CONSTCOND*/1 )		/* loops until end-of-file is reached */
 		{
@@ -3063,13 +3122,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 2238 )
+				if ( yy_current_state >= 2288 )
 					yy_c = yy_meta[(unsigned int) yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 6399 );
+		while ( yy_base[yy_current_state] != 6594 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -4116,68 +4175,95 @@ YY_RULE_SETUP
 case 203:
 YY_RULE_SETUP
 #line 420 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
+{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
 	YY_BREAK
 case 204:
 YY_RULE_SETUP
-#line 421 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
+#line 422 "util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
 	YY_BREAK
 case 205:
 YY_RULE_SETUP
-#line 422 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_HOOK) }
+#line 424 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
 	YY_BREAK
 case 206:
 YY_RULE_SETUP
-#line 423 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
+#line 425 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
 	YY_BREAK
 case 207:
 YY_RULE_SETUP
-#line 424 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+#line 426 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_HOOK) }
 	YY_BREAK
 case 208:
 YY_RULE_SETUP
-#line 425 "util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+#line 427 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
 	YY_BREAK
 case 209:
-/* rule 209 can match eol */
 YY_RULE_SETUP
-#line 426 "util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++; }
+#line 428 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
 	YY_BREAK
-/* Quoted strings. Strip leading and ending quotes */
 case 210:
 YY_RULE_SETUP
 #line 429 "util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+	YY_BREAK
+case 211:
+YY_RULE_SETUP
+#line 430 "util/configlexer.lex"
+{ YDVAR(0, VAR_CACHEDB) }
+	YY_BREAK
+case 212:
+YY_RULE_SETUP
+#line 431 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+	YY_BREAK
+case 213:
+YY_RULE_SETUP
+#line 432 "util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
+	YY_BREAK
+case 214:
+/* rule 214 can match eol */
+YY_RULE_SETUP
+#line 433 "util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++; }
+	YY_BREAK
+/* Quoted strings. Strip leading and ending quotes */
+case 215:
+YY_RULE_SETUP
+#line 436 "util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 430 "util/configlexer.lex"
+#line 437 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 211:
+case 216:
 YY_RULE_SETUP
-#line 435 "util/configlexer.lex"
+#line 442 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 212:
-/* rule 212 can match eol */
+case 217:
+/* rule 217 can match eol */
 YY_RULE_SETUP
-#line 436 "util/configlexer.lex"
+#line 443 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 213:
+case 218:
 YY_RULE_SETUP
-#line 438 "util/configlexer.lex"
+#line 445 "util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -4190,34 +4276,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 214:
+case 219:
 YY_RULE_SETUP
-#line 450 "util/configlexer.lex"
+#line 457 "util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 451 "util/configlexer.lex"
+#line 458 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 215:
+case 220:
 YY_RULE_SETUP
-#line 456 "util/configlexer.lex"
+#line 463 "util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 216:
-/* rule 216 can match eol */
+case 221:
+/* rule 221 can match eol */
 YY_RULE_SETUP
-#line 457 "util/configlexer.lex"
+#line 464 "util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 217:
+case 222:
 YY_RULE_SETUP
-#line 459 "util/configlexer.lex"
+#line 466 "util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -4230,38 +4316,38 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 218:
+case 223:
 YY_RULE_SETUP
-#line 471 "util/configlexer.lex"
+#line 478 "util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 473 "util/configlexer.lex"
+#line 480 "util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 219:
+case 224:
 YY_RULE_SETUP
-#line 477 "util/configlexer.lex"
+#line 484 "util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
-case 220:
-/* rule 220 can match eol */
+case 225:
+/* rule 225 can match eol */
 YY_RULE_SETUP
-#line 478 "util/configlexer.lex"
+#line 485 "util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
 	YY_BREAK
-case 221:
+case 226:
 YY_RULE_SETUP
-#line 479 "util/configlexer.lex"
+#line 486 "util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
 	YY_BREAK
-case 222:
+case 227:
 YY_RULE_SETUP
-#line 480 "util/configlexer.lex"
+#line 487 "util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
 	config_start_include_glob(yytext);
@@ -4269,27 +4355,27 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 485 "util/configlexer.lex"
+#line 492 "util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 223:
+case 228:
 YY_RULE_SETUP
-#line 489 "util/configlexer.lex"
+#line 496 "util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 224:
-/* rule 224 can match eol */
+case 229:
+/* rule 229 can match eol */
 YY_RULE_SETUP
-#line 490 "util/configlexer.lex"
+#line 497 "util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 225:
+case 230:
 YY_RULE_SETUP
-#line 492 "util/configlexer.lex"
+#line 499 "util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
@@ -4299,7 +4385,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 498 "util/configlexer.lex"
+#line 505 "util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -4311,33 +4397,33 @@ case YY_STATE_EOF(val):
 	}
 }
 	YY_BREAK
-case 226:
+case 231:
 YY_RULE_SETUP
-#line 509 "util/configlexer.lex"
+#line 516 "util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 227:
+case 232:
 YY_RULE_SETUP
-#line 513 "util/configlexer.lex"
+#line 520 "util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 228:
+case 233:
 YY_RULE_SETUP
-#line 517 "util/configlexer.lex"
+#line 524 "util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 229:
+case 234:
 YY_RULE_SETUP
-#line 521 "util/configlexer.lex"
+#line 528 "util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 4339 "<stdout>"
+#line 4425 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -4628,7 +4714,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 2238 )
+			if ( yy_current_state >= 2288 )
 				yy_c = yy_meta[(unsigned int) yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
@@ -4656,11 +4742,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 2238 )
+		if ( yy_current_state >= 2288 )
 			yy_c = yy_meta[(unsigned int) yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
-	yy_is_jam = (yy_current_state == 2237);
+	yy_is_jam = (yy_current_state == 2287);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -5299,7 +5385,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 521 "util/configlexer.lex"
+#line 528 "util/configlexer.lex"
 
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index d9b8e281c568..0c9a4df04298 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -417,12 +417,19 @@ dnscrypt-port{COLON}		{ YDVAR(1, VAR_DNSCRYPT_PORT) }
 dnscrypt-provider{COLON}	{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
 dnscrypt-secret-key{COLON}	{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
 dnscrypt-provider-cert{COLON}	{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
+dnscrypt-shared-secret-cache-size{COLON}	{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
+dnscrypt-shared-secret-cache-slabs{COLON}	{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
 ipsecmod-enabled{COLON}		{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
 ipsecmod-ignore-bogus{COLON}	{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
 ipsecmod-hook{COLON}		{ YDVAR(1, VAR_IPSECMOD_HOOK) }
 ipsecmod-max-ttl{COLON}		{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
 ipsecmod-whitelist{COLON}	{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
 ipsecmod-strict{COLON}		{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+cachedb{COLON}			{ YDVAR(0, VAR_CACHEDB) }
+backend{COLON}			{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+secret-seed{COLON}		{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }
 
 	/* Quoted strings. Strip leading and ending quotes */
diff --git a/util/configparser.c b/util/configparser.c
index 9fa436b02886..7829ed8cd2bf 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -333,12 +333,17 @@ extern int yydebug;
     VAR_DNSCRYPT_PROVIDER = 462,
     VAR_DNSCRYPT_SECRET_KEY = 463,
     VAR_DNSCRYPT_PROVIDER_CERT = 464,
-    VAR_IPSECMOD_ENABLED = 465,
-    VAR_IPSECMOD_HOOK = 466,
-    VAR_IPSECMOD_IGNORE_BOGUS = 467,
-    VAR_IPSECMOD_MAX_TTL = 468,
-    VAR_IPSECMOD_WHITELIST = 469,
-    VAR_IPSECMOD_STRICT = 470
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 465,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 466,
+    VAR_IPSECMOD_ENABLED = 467,
+    VAR_IPSECMOD_HOOK = 468,
+    VAR_IPSECMOD_IGNORE_BOGUS = 469,
+    VAR_IPSECMOD_MAX_TTL = 470,
+    VAR_IPSECMOD_WHITELIST = 471,
+    VAR_IPSECMOD_STRICT = 472,
+    VAR_CACHEDB = 473,
+    VAR_CACHEDB_BACKEND = 474,
+    VAR_CACHEDB_SECRETSEED = 475
   };
 #endif
 /* Tokens.  */
@@ -549,12 +554,17 @@ extern int yydebug;
 #define VAR_DNSCRYPT_PROVIDER 462
 #define VAR_DNSCRYPT_SECRET_KEY 463
 #define VAR_DNSCRYPT_PROVIDER_CERT 464
-#define VAR_IPSECMOD_ENABLED 465
-#define VAR_IPSECMOD_HOOK 466
-#define VAR_IPSECMOD_IGNORE_BOGUS 467
-#define VAR_IPSECMOD_MAX_TTL 468
-#define VAR_IPSECMOD_WHITELIST 469
-#define VAR_IPSECMOD_STRICT 470
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 465
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 466
+#define VAR_IPSECMOD_ENABLED 467
+#define VAR_IPSECMOD_HOOK 468
+#define VAR_IPSECMOD_IGNORE_BOGUS 469
+#define VAR_IPSECMOD_MAX_TTL 470
+#define VAR_IPSECMOD_WHITELIST 471
+#define VAR_IPSECMOD_STRICT 472
+#define VAR_CACHEDB 473
+#define VAR_CACHEDB_BACKEND 474
+#define VAR_CACHEDB_SECRETSEED 475
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -565,7 +575,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 569 "util/configparser.c" /* yacc.c:355  */
+#line 579 "util/configparser.c" /* yacc.c:355  */
 };
 
 typedef union YYSTYPE YYSTYPE;
@@ -582,7 +592,7 @@ int yyparse (void);
 
 /* Copy the second part of user declarations.  */
 
-#line 586 "util/configparser.c" /* yacc.c:358  */
+#line 596 "util/configparser.c" /* yacc.c:358  */
 
 #ifdef short
 # undef short
@@ -824,21 +834,21 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   442
+#define YYLAST   446
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  216
+#define YYNTOKENS  221
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  231
+#define YYNNTS  238
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  443
+#define YYNRULES  455
 /* YYNSTATES -- Number of states.  */
-#define YYNSTATES  667
+#define YYNSTATES  683
 
 /* YYTRANSLATE[YYX] -- Symbol number corresponding to YYX as returned
    by yylex, with out-of-bounds checking.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   470
+#define YYMAXUTOK   475
 
 #define YYTRANSLATE(YYX)                                                \
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -894,58 +904,59 @@ static const yytype_uint8 yytranslate[] =
      185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
      195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
      205,   206,   207,   208,   209,   210,   211,   212,   213,   214,
-     215
+     215,   216,   217,   218,   219,   220
 };
 
 #if YYDEBUG
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   151,   151,   151,   152,   152,   153,   153,   154,   154,
-     154,   156,   160,   165,   166,   167,   167,   167,   168,   168,
-     169,   169,   170,   170,   171,   171,   172,   172,   172,   173,
-     173,   173,   174,   174,   175,   175,   176,   176,   177,   177,
-     178,   178,   179,   179,   180,   180,   181,   181,   182,   182,
-     182,   183,   183,   183,   184,   184,   184,   185,   185,   186,
-     186,   187,   187,   188,   188,   189,   189,   189,   190,   190,
-     191,   191,   192,   192,   192,   193,   193,   194,   194,   195,
-     195,   196,   196,   196,   197,   197,   198,   198,   199,   199,
-     200,   200,   201,   201,   202,   202,   202,   203,   203,   204,
-     204,   204,   205,   205,   205,   206,   206,   206,   207,   207,
-     207,   207,   208,   208,   208,   209,   209,   209,   210,   210,
-     211,   211,   212,   212,   213,   213,   214,   214,   214,   215,
-     215,   216,   216,   217,   218,   218,   219,   219,   220,   220,
-     221,   222,   222,   223,   223,   224,   224,   225,   225,   225,
-     226,   226,   227,   227,   228,   228,   229,   229,   230,   230,
-     230,   231,   231,   231,   232,   232,   232,   233,   233,   234,
-     234,   235,   235,   236,   236,   238,   250,   251,   252,   252,
-     252,   252,   252,   253,   255,   267,   268,   269,   269,   269,
-     269,   270,   272,   286,   287,   288,   288,   288,   288,   289,
-     289,   289,   291,   300,   309,   320,   329,   338,   347,   358,
-     367,   378,   391,   406,   417,   434,   451,   464,   479,   488,
-     497,   506,   515,   524,   533,   542,   551,   560,   569,   578,
-     587,   596,   605,   614,   621,   628,   637,   646,   655,   669,
-     678,   687,   696,   703,   710,   736,   744,   751,   758,   765,
-     772,   780,   788,   796,   803,   814,   821,   830,   839,   848,
-     855,   862,   870,   878,   888,   898,   908,   921,   932,   940,
-     953,   962,   971,   980,   990,  1000,  1008,  1021,  1030,  1038,
-    1047,  1055,  1068,  1077,  1084,  1094,  1104,  1114,  1124,  1134,
-    1144,  1154,  1164,  1171,  1178,  1185,  1194,  1203,  1212,  1219,
-    1229,  1246,  1253,  1271,  1284,  1297,  1306,  1315,  1324,  1333,
-    1343,  1353,  1362,  1371,  1384,  1397,  1406,  1413,  1422,  1431,
-    1440,  1449,  1457,  1470,  1478,  1506,  1513,  1528,  1538,  1548,
-    1555,  1562,  1571,  1585,  1604,  1623,  1635,  1647,  1659,  1670,
-    1689,  1699,  1708,  1716,  1724,  1737,  1750,  1763,  1776,  1785,
-    1794,  1804,  1814,  1827,  1840,  1851,  1864,  1875,  1888,  1898,
-    1905,  1912,  1921,  1931,  1941,  1951,  1958,  1965,  1974,  1984,
-    1994,  2023,  2033,  2041,  2050,  2065,  2074,  2079,  2080,  2081,
-    2081,  2081,  2082,  2082,  2082,  2083,  2083,  2085,  2095,  2104,
-    2111,  2121,  2128,  2135,  2142,  2149,  2154,  2155,  2156,  2156,
-    2157,  2157,  2158,  2158,  2159,  2160,  2161,  2162,  2163,  2164,
-    2166,  2174,  2181,  2189,  2197,  2204,  2211,  2220,  2229,  2238,
-    2247,  2256,  2265,  2270,  2271,  2272,  2274,  2280,  2290,  2297,
-    2306,  2314,  2320,  2321,  2323,  2323,  2323,  2324,  2324,  2326,
-    2336,  2346,  2353,  2360
+       0,   154,   154,   154,   155,   155,   156,   156,   157,   157,
+     157,   159,   160,   164,   169,   170,   171,   171,   171,   172,
+     172,   173,   173,   174,   174,   175,   175,   176,   176,   176,
+     177,   177,   177,   178,   178,   179,   179,   180,   180,   181,
+     181,   182,   182,   183,   183,   184,   184,   185,   185,   186,
+     186,   186,   187,   187,   187,   188,   188,   188,   189,   189,
+     190,   190,   191,   191,   192,   192,   193,   193,   193,   194,
+     194,   195,   195,   196,   196,   196,   197,   197,   198,   198,
+     199,   199,   200,   200,   200,   201,   201,   202,   202,   203,
+     203,   204,   204,   205,   205,   206,   206,   206,   207,   207,
+     208,   208,   208,   209,   209,   209,   210,   210,   210,   211,
+     211,   211,   211,   212,   212,   212,   213,   213,   213,   214,
+     214,   215,   215,   216,   216,   217,   217,   218,   218,   218,
+     219,   219,   220,   220,   221,   222,   222,   223,   223,   224,
+     224,   225,   226,   226,   227,   227,   228,   228,   229,   229,
+     229,   230,   230,   231,   231,   232,   232,   233,   233,   234,
+     234,   234,   235,   235,   235,   236,   236,   236,   237,   237,
+     238,   238,   239,   239,   240,   240,   242,   254,   255,   256,
+     256,   256,   256,   256,   257,   259,   271,   272,   273,   273,
+     273,   273,   274,   276,   290,   291,   292,   292,   292,   292,
+     293,   293,   293,   295,   304,   313,   324,   333,   342,   351,
+     362,   371,   382,   395,   410,   421,   438,   455,   468,   483,
+     492,   501,   510,   519,   528,   537,   546,   555,   564,   573,
+     582,   591,   600,   609,   618,   625,   632,   641,   650,   659,
+     673,   682,   691,   700,   707,   714,   740,   748,   755,   762,
+     769,   776,   784,   792,   800,   807,   818,   825,   834,   843,
+     852,   859,   866,   874,   882,   892,   902,   912,   925,   936,
+     944,   957,   966,   975,   984,   994,  1004,  1012,  1025,  1034,
+    1042,  1051,  1059,  1072,  1081,  1088,  1098,  1108,  1118,  1128,
+    1138,  1148,  1158,  1168,  1175,  1182,  1189,  1198,  1207,  1216,
+    1223,  1233,  1250,  1257,  1275,  1288,  1301,  1310,  1319,  1328,
+    1337,  1347,  1357,  1366,  1375,  1388,  1401,  1410,  1417,  1426,
+    1435,  1444,  1453,  1461,  1474,  1482,  1510,  1517,  1532,  1542,
+    1552,  1559,  1566,  1575,  1589,  1608,  1627,  1639,  1651,  1663,
+    1674,  1693,  1703,  1712,  1720,  1728,  1741,  1754,  1767,  1780,
+    1789,  1798,  1808,  1818,  1831,  1844,  1855,  1868,  1879,  1892,
+    1902,  1909,  1916,  1925,  1935,  1945,  1955,  1962,  1969,  1978,
+    1988,  1998,  2027,  2037,  2045,  2054,  2069,  2078,  2083,  2084,
+    2085,  2085,  2085,  2086,  2086,  2086,  2087,  2087,  2089,  2099,
+    2108,  2115,  2125,  2132,  2139,  2146,  2153,  2158,  2159,  2160,
+    2160,  2161,  2161,  2162,  2162,  2163,  2164,  2165,  2166,  2167,
+    2168,  2170,  2178,  2185,  2193,  2201,  2208,  2215,  2224,  2233,
+    2242,  2251,  2260,  2269,  2274,  2275,  2276,  2278,  2284,  2294,
+    2301,  2310,  2318,  2324,  2325,  2327,  2327,  2327,  2328,  2328,
+    2329,  2330,  2332,  2342,  2352,  2359,  2366,  2373,  2381,  2394,
+    2399,  2400,  2401,  2401,  2403,  2417
 };
 #endif
 
@@ -1028,12 +1039,15 @@ static const char *const yytname[] =
   "VAR_USE_SYSTEMD", "VAR_SHM_ENABLE", "VAR_SHM_KEY", "VAR_DNSCRYPT",
   "VAR_DNSCRYPT_ENABLE", "VAR_DNSCRYPT_PORT", "VAR_DNSCRYPT_PROVIDER",
   "VAR_DNSCRYPT_SECRET_KEY", "VAR_DNSCRYPT_PROVIDER_CERT",
-  "VAR_IPSECMOD_ENABLED", "VAR_IPSECMOD_HOOK", "VAR_IPSECMOD_IGNORE_BOGUS",
-  "VAR_IPSECMOD_MAX_TTL", "VAR_IPSECMOD_WHITELIST", "VAR_IPSECMOD_STRICT",
-  "$accept", "toplevelvars", "toplevelvar", "serverstart",
-  "contents_server", "content_server", "stubstart", "contents_stub",
-  "content_stub", "forwardstart", "contents_forward", "content_forward",
-  "viewstart", "contents_view", "content_view", "server_num_threads",
+  "VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE",
+  "VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS", "VAR_IPSECMOD_ENABLED",
+  "VAR_IPSECMOD_HOOK", "VAR_IPSECMOD_IGNORE_BOGUS", "VAR_IPSECMOD_MAX_TTL",
+  "VAR_IPSECMOD_WHITELIST", "VAR_IPSECMOD_STRICT", "VAR_CACHEDB",
+  "VAR_CACHEDB_BACKEND", "VAR_CACHEDB_SECRETSEED", "$accept",
+  "toplevelvars", "toplevelvar", "serverstart", "contents_server",
+  "content_server", "stubstart", "contents_stub", "content_stub",
+  "forwardstart", "contents_forward", "content_forward", "viewstart",
+  "contents_view", "content_view", "server_num_threads",
   "server_verbosity", "server_statistics_interval",
   "server_statistics_cumulative", "server_extended_statistics",
   "server_shm_enable", "server_shm_key", "server_port",
@@ -1122,7 +1136,11 @@ static const char *const yytname[] =
   "server_response_ip", "server_response_ip_data", "dnscstart",
   "contents_dnsc", "content_dnsc", "dnsc_dnscrypt_enable",
   "dnsc_dnscrypt_port", "dnsc_dnscrypt_provider",
-  "dnsc_dnscrypt_provider_cert", "dnsc_dnscrypt_secret_key", YY_NULLPTR
+  "dnsc_dnscrypt_provider_cert", "dnsc_dnscrypt_secret_key",
+  "dnsc_dnscrypt_shared_secret_cache_size",
+  "dnsc_dnscrypt_shared_secret_cache_slabs", "cachedbstart",
+  "contents_cachedb", "content_cachedb", "cachedb_backend_name",
+  "cachedb_secret_seed", YY_NULLPTR
 };
 #endif
 
@@ -1152,14 +1170,15 @@ static const yytype_uint16 yytoknum[] =
      435,   436,   437,   438,   439,   440,   441,   442,   443,   444,
      445,   446,   447,   448,   449,   450,   451,   452,   453,   454,
      455,   456,   457,   458,   459,   460,   461,   462,   463,   464,
-     465,   466,   467,   468,   469,   470
+     465,   466,   467,   468,   469,   470,   471,   472,   473,   474,
+     475
 };
 # endif
 
-#define YYPACT_NINF -200
+#define YYPACT_NINF -213
 
 #define yypact_value_is_default(Yystate) \
-  (!!((Yystate) == (-200)))
+  (!!((Yystate) == (-213)))
 
 #define YYTABLE_NINF -1
 
@@ -1170,73 +1189,75 @@ static const yytype_uint16 yytoknum[] =
      STATE-NUM.  */
 static const yytype_int16 yypact[] =
 {
-    -200,     0,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-      96,   -39,   -35,   248,   -65,  -131,  -106,  -199,     2,    25,
-      26,    27,    28,    29,    30,    32,    33,    34,    35,    36,
-      38,    39,    40,    41,    42,    43,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    55,    56,    57,    58,
-      59,    60,    61,    62,    63,    64,    65,    66,    67,    68,
-      69,    70,    71,    72,    73,    74,    75,    76,    77,    78,
-      79,    80,    82,    83,    85,    88,    90,    91,    92,    93,
-      94,    95,   126,   127,   128,   129,   133,   134,   177,   178,
-     179,   180,   181,   183,   184,   185,   189,   193,   218,   219,
-     220,   221,   231,   232,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   280,   290,   291,   292,   293,
-     294,   295,   302,   303,   304,   305,   306,   307,   308,   309,
-     310,   311,   312,   313,   316,   317,   318,   319,   320,   321,
-     322,   323,   324,   325,   326,   327,   328,   329,   330,   331,
-     332,   333,   334,   335,   336,   337,   338,   340,   341,   342,
-     343,   344,   345,   346,   347,   348,   349,   350,   351,   352,
-     353,   354,   355,   356,   357,   358,   359,   360,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,   361,
-     362,   363,   364,   365,   366,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,   367,   368,   369,   370,   371,  -200,  -200,  -200,
-    -200,  -200,  -200,   372,   373,   374,   375,   376,   377,   378,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,   379,   380,
-     381,   382,   383,   384,   385,   386,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,   387,   388,   389,   390,   391,
-     392,   393,   394,   395,   396,   399,   400,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-     401,  -200,  -200,   402,   403,   404,   405,   406,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-     407,   408,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,   409,   410,   411,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,   412,   413,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,   414,   415,   416,   417,   418,   419,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,   420,  -200,  -200,   421,
-     422,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,   423,   424,   425,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200
+    -213,     0,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,   207,   -38,   -34,   -39,   -64,  -130,  -105,  -157,
+    -212,    -1,     2,     3,    26,    29,    30,    32,    33,    34,
+      35,    36,    45,    46,    47,    48,    49,    50,    51,    53,
+      54,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
+      75,    76,    77,    78,    79,    80,    82,    83,    84,    86,
+      89,    91,    92,    93,    94,    95,    96,    98,    99,   100,
+     101,   102,   103,   104,   105,   106,   107,   108,   109,   112,
+     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
+     123,   124,   125,   126,   127,   128,   129,   130,   131,   132,
+     133,   134,   136,   137,   138,   139,   140,   141,   142,   143,
+     144,   146,   147,   148,   149,   150,   151,   152,   153,   154,
+     155,   156,   157,   158,   159,   160,   161,   162,   163,   164,
+     165,   166,   167,   168,   169,   170,   171,   172,   173,   174,
+     175,   176,   177,   178,   179,   180,   181,   183,   184,   185,
+     186,   187,   188,   189,   190,   191,   192,   193,   195,   196,
+     197,   198,   199,   200,   201,   202,   203,   204,   205,   206,
+     237,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,   238,   239,   240,   244,   245,   246,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,   288,   289,   290,   291,   292,
+    -213,  -213,  -213,  -213,  -213,  -213,   293,   294,   295,   296,
+     300,   304,   305,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,   329,   330,   331,   332,   342,   343,   344,   345,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,   346,   347,
+     348,   349,   350,   351,   352,   353,   354,   389,   391,   401,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,   402,  -213,  -213,   403,   404,   405,   406,
+     407,   408,   415,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,   416,   417,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,   418,   419,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,   420,   421,   422,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,   423,   424,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,   425,   426,   427,   428,   429,
+     430,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,   431,  -213,
+    -213,   432,   433,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,   434,   435,   436,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213
 };
 
   /* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
@@ -1244,9 +1265,11 @@ static const yytype_int16 yypact[] =
      means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-       2,     0,     1,    12,   175,   184,   376,   422,   395,   192,
-     431,     3,    14,   177,   186,   194,   378,   397,   424,   433,
-       4,     5,     6,    10,     8,     9,     7,    11,     0,     0,
+       2,     0,     1,    13,   176,   185,   377,   423,   396,   193,
+     432,   449,     3,    15,   178,   187,   195,   379,   398,   425,
+     434,   451,     4,     5,     6,    10,     8,     9,     7,    11,
+      12,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1261,114 +1284,114 @@ static const yytype_uint16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,    14,    16,    17,    76,    79,    88,   165,   166,    18,
+     138,   139,   140,   141,   142,   143,    27,    67,    19,    80,
+      81,    38,    60,    75,    20,    21,    23,    24,    22,    25,
+      26,   111,   112,   113,   114,   115,   161,    77,    66,    92,
+     109,   110,    28,    29,    30,    31,    32,    68,    82,    83,
+      98,    54,    64,    55,   169,    93,    48,    49,   168,    50,
+      51,   102,   106,   119,   127,   148,   103,    61,    33,    34,
+      35,    90,   120,   121,   122,    36,    37,    39,    40,    42,
+      43,    41,   125,    44,    45,    46,    52,    71,   107,    85,
+     126,    78,   144,    86,    87,   104,   105,    91,    47,    69,
+      72,    53,    56,    94,    95,    70,   145,    96,    57,    58,
+      59,   108,   158,   159,   167,    97,    65,    99,   100,   101,
+     146,    62,    63,    84,    73,    74,    89,   116,   117,   118,
+     123,   124,   149,   150,   152,   154,   155,   153,   156,   162,
+     128,   129,   132,   133,   130,   131,   134,   135,   137,   136,
+     147,   157,   170,   172,   171,   173,   174,   175,   151,   160,
+     163,   164,     0,     0,     0,     0,     0,     0,   177,   179,
+     180,   181,   183,   184,   182,     0,     0,     0,     0,     0,
+     186,   188,   189,   190,   191,   192,     0,     0,     0,     0,
+       0,     0,     0,   194,   196,   197,   200,   201,   198,   202,
+     199,     0,     0,     0,     0,     0,     0,     0,     0,   378,
+     380,   382,   381,   387,   383,   384,   385,   386,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,    13,    15,
-      16,    75,    78,    87,   164,   165,    17,   137,   138,   139,
-     140,   141,   142,    26,    66,    18,    79,    80,    37,    59,
-      74,    19,    20,    22,    23,    21,    24,    25,   110,   111,
-     112,   113,   114,   160,    76,    65,    91,   108,   109,    27,
-      28,    29,    30,    31,    67,    81,    82,    97,    53,    63,
-      54,   168,    92,    47,    48,   167,    49,    50,   101,   105,
-     118,   126,   147,   102,    60,    32,    33,    34,    89,   119,
-     120,   121,    35,    36,    38,    39,    41,    42,    40,   124,
-      43,    44,    45,    51,    70,   106,    84,   125,    77,   143,
-      85,    86,   103,   104,    90,    46,    68,    71,    52,    55,
-      93,    94,    69,   144,    95,    56,    57,    58,   107,   157,
-     158,   166,    96,    64,    98,    99,   100,   145,    61,    62,
-      83,    72,    73,    88,   115,   116,   117,   122,   123,   148,
-     149,   151,   153,   154,   152,   155,   161,   127,   128,   131,
-     132,   129,   130,   133,   134,   136,   135,   146,   156,   169,
-     171,   170,   172,   173,   174,   150,   159,   162,   163,     0,
-       0,     0,     0,     0,     0,   176,   178,   179,   180,   182,
-     183,   181,     0,     0,     0,     0,     0,   185,   187,   188,
-     189,   190,   191,     0,     0,     0,     0,     0,     0,     0,
-     193,   195,   196,   199,   200,   197,   201,   198,     0,     0,
-       0,     0,     0,     0,     0,     0,   377,   379,   381,   380,
-     386,   382,   383,   384,   385,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,   396,   398,   399,
-     400,   401,   402,   403,   404,   405,   406,   407,   408,   409,
-       0,   423,   425,     0,     0,     0,     0,     0,   432,   434,
-     435,   436,   438,   437,   203,   202,   209,   218,   216,   224,
-     225,   228,   226,   227,   229,   230,   242,   243,   244,   245,
-     246,   268,   269,   270,   275,   276,   221,   277,   278,   281,
-     279,   280,   283,   284,   285,   298,   256,   257,   259,   260,
-     286,   301,   251,   253,   302,   308,   309,   310,   222,   267,
-     321,   322,   252,   316,   238,   217,   247,   299,   305,   287,
-       0,     0,   325,   223,   204,   237,   291,   205,   219,   220,
-     248,   249,   323,   289,   293,   294,   206,   326,   271,   297,
-     239,   255,   303,   304,   307,   315,   250,   319,   317,   318,
-     261,   266,   295,   296,   262,   263,   288,   311,   240,   241,
-     231,   232,   233,   234,   235,   327,   328,   329,   272,   273,
-     274,   282,   330,   331,     0,     0,     0,   290,   264,   427,
-     340,   344,   342,   341,   345,   343,     0,     0,   348,   349,
-     210,   211,   212,   213,   214,   215,   292,   306,   320,   350,
-     351,   265,   332,     0,     0,     0,     0,     0,     0,   312,
-     313,   314,   428,   258,   254,   236,   207,   208,   352,   354,
-     353,   355,   356,   357,   358,   359,   360,   363,   362,   361,
-     364,   365,   366,   367,   368,   369,     0,   373,   374,     0,
-       0,   375,   387,   389,   388,   391,   392,   393,   394,   390,
-     410,   411,   412,   413,   414,   415,   416,   417,   418,   419,
-     420,   421,   426,   439,   440,   441,   443,   442,   300,   324,
-     339,   429,   430,   346,   347,   333,   334,     0,     0,     0,
-     338,   370,   371,   372,   337,   335,   336
+     397,   399,   400,   401,   402,   403,   404,   405,   406,   407,
+     408,   409,   410,     0,   424,   426,     0,     0,     0,     0,
+       0,     0,     0,   433,   435,   436,   437,   439,   438,   440,
+     441,     0,     0,   450,   452,   453,   204,   203,   210,   219,
+     217,   225,   226,   229,   227,   228,   230,   231,   243,   244,
+     245,   246,   247,   269,   270,   271,   276,   277,   222,   278,
+     279,   282,   280,   281,   284,   285,   286,   299,   257,   258,
+     260,   261,   287,   302,   252,   254,   303,   309,   310,   311,
+     223,   268,   322,   323,   253,   317,   239,   218,   248,   300,
+     306,   288,     0,     0,   326,   224,   205,   238,   292,   206,
+     220,   221,   249,   250,   324,   290,   294,   295,   207,   327,
+     272,   298,   240,   256,   304,   305,   308,   316,   251,   320,
+     318,   319,   262,   267,   296,   297,   263,   264,   289,   312,
+     241,   242,   232,   233,   234,   235,   236,   328,   329,   330,
+     273,   274,   275,   283,   331,   332,     0,     0,     0,   291,
+     265,   428,   341,   345,   343,   342,   346,   344,     0,     0,
+     349,   350,   211,   212,   213,   214,   215,   216,   293,   307,
+     321,   351,   352,   266,   333,     0,     0,     0,     0,     0,
+       0,   313,   314,   315,   429,   259,   255,   237,   208,   209,
+     353,   355,   354,   356,   357,   358,   359,   360,   361,   364,
+     363,   362,   365,   366,   367,   368,   369,   370,     0,   374,
+     375,     0,     0,   376,   388,   390,   389,   392,   393,   394,
+     395,   391,   411,   412,   413,   414,   415,   416,   417,   418,
+     419,   420,   421,   422,   427,   442,   443,   444,   446,   445,
+     447,   448,   454,   455,   301,   325,   340,   430,   431,   347,
+     348,   334,   335,     0,     0,     0,   339,   371,   372,   373,
+     338,   336,   337
 };
 
   /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,  -200,
-    -200
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213,
+    -213,  -213,  -213,  -213,  -213,  -213,  -213,  -213
 };
 
   /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,    11,    12,    20,   188,    13,    21,   355,    14,
-      22,   367,    15,    23,   380,   189,   190,   191,   192,   193,
-     194,   195,   196,   197,   198,   199,   200,   201,   202,   203,
-     204,   205,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
-     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
-     234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
-     244,   245,   246,   247,   248,   249,   250,   251,   252,   253,
-     254,   255,   256,   257,   258,   259,   260,   261,   262,   263,
-     264,   265,   266,   267,   268,   269,   270,   271,   272,   273,
-     274,   275,   276,   277,   278,   279,   280,   281,   282,   283,
-     284,   285,   286,   287,   288,   289,   290,   291,   292,   293,
-     294,   295,   296,   297,   298,   299,   300,   301,   302,   303,
-     304,   305,   306,   307,   308,   309,   310,   311,   312,   313,
-     314,   315,   316,   317,   318,   319,   320,   321,   322,   323,
-     324,   325,   326,   327,   328,   329,   330,   331,   332,   333,
-     334,   335,   336,   337,   338,   339,   340,   341,   342,   343,
-     344,   356,   357,   358,   359,   360,   361,   368,   369,   370,
-     371,   372,   381,   382,   383,   384,   385,   386,   387,    16,
-      24,   396,   397,   398,   399,   400,   401,   402,   403,   404,
-      17,    25,   417,   418,   419,   420,   421,   422,   423,   424,
-     425,   426,   427,   428,   429,    18,    26,   431,   432,   345,
-     346,   347,   348,    19,    27,   438,   439,   440,   441,   442,
-     443
+      -1,     1,    12,    13,    22,   191,    14,    23,   358,    15,
+      24,   370,    16,    25,   383,   192,   193,   194,   195,   196,
+     197,   198,   199,   200,   201,   202,   203,   204,   205,   206,
+     207,   208,   209,   210,   211,   212,   213,   214,   215,   216,
+     217,   218,   219,   220,   221,   222,   223,   224,   225,   226,
+     227,   228,   229,   230,   231,   232,   233,   234,   235,   236,
+     237,   238,   239,   240,   241,   242,   243,   244,   245,   246,
+     247,   248,   249,   250,   251,   252,   253,   254,   255,   256,
+     257,   258,   259,   260,   261,   262,   263,   264,   265,   266,
+     267,   268,   269,   270,   271,   272,   273,   274,   275,   276,
+     277,   278,   279,   280,   281,   282,   283,   284,   285,   286,
+     287,   288,   289,   290,   291,   292,   293,   294,   295,   296,
+     297,   298,   299,   300,   301,   302,   303,   304,   305,   306,
+     307,   308,   309,   310,   311,   312,   313,   314,   315,   316,
+     317,   318,   319,   320,   321,   322,   323,   324,   325,   326,
+     327,   328,   329,   330,   331,   332,   333,   334,   335,   336,
+     337,   338,   339,   340,   341,   342,   343,   344,   345,   346,
+     347,   359,   360,   361,   362,   363,   364,   371,   372,   373,
+     374,   375,   384,   385,   386,   387,   388,   389,   390,    17,
+      26,   399,   400,   401,   402,   403,   404,   405,   406,   407,
+      18,    27,   420,   421,   422,   423,   424,   425,   426,   427,
+     428,   429,   430,   431,   432,    19,    28,   434,   435,   348,
+     349,   350,   351,    20,    29,   443,   444,   445,   446,   447,
+     448,   449,   450,    21,    30,   453,   454,   455
 };
 
   /* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
@@ -1376,151 +1399,152 @@ static const yytype_int16 yydefgoto[] =
      number is the opposite.  If YYTABLE_NINF, syntax error.  */
 static const yytype_uint16 yytable[] =
 {
-       2,   349,   430,   350,   351,   362,   433,   434,   435,   436,
-     437,     3,   444,   363,   364,   405,   406,   407,   408,   409,
-     410,   411,   412,   413,   414,   415,   416,   388,   389,   390,
-     391,   392,   393,   394,   395,   445,   446,   447,   448,   449,
-     450,     4,   451,   452,   453,   454,   455,     5,   456,   457,
-     458,   459,   460,   461,   462,   463,   464,   465,   466,   467,
-     468,   469,   470,   471,   352,   472,   473,   474,   475,   476,
-     477,   478,   479,   480,   481,   482,   483,   484,   485,   486,
-     487,   488,   489,   490,   491,   492,   493,   494,   495,   496,
-     497,     6,   498,   499,   353,   500,   354,   365,   501,   366,
-     502,   503,   504,   505,   506,   507,     0,     7,    28,    29,
-      30,    31,    32,    33,    34,    35,    36,    37,    38,    39,
-      40,    41,    42,    43,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    54,    55,   508,   509,   510,   511,
-      56,    57,    58,   512,   513,     8,    59,    60,    61,    62,
-      63,    64,    65,    66,    67,    68,    69,    70,    71,    72,
-      73,    74,    75,    76,    77,    78,    79,    80,    81,    82,
-      83,    84,    85,    86,    87,    88,    89,    90,    91,    92,
-      93,    94,    95,    96,    97,    98,    99,   514,   515,   516,
-     517,   518,     9,   519,   520,   521,   100,   101,   102,   522,
-     103,   104,   105,   523,    10,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
-     121,   122,   123,   124,   125,   126,   127,   128,   524,   525,
-     526,   527,   129,   130,   131,   132,   133,   134,   135,   136,
-     137,   528,   529,   530,   531,   532,   533,   534,   535,   536,
-     537,   538,   539,   540,   138,   139,   140,   141,   142,   143,
-     144,   145,   146,   147,   148,   149,   150,   151,   152,   153,
-     154,   155,   156,   157,   158,   159,   160,   161,   162,   163,
-     164,   165,   166,   167,   168,   169,   170,   171,   373,   172,
-     541,   173,   174,   175,   176,   177,   178,   179,   180,   181,
-     542,   543,   544,   545,   546,   547,   182,   183,   184,   185,
-     186,   187,   548,   549,   550,   551,   552,   553,   554,   555,
-     556,   557,   558,   559,   374,   375,   560,   561,   562,   563,
-     564,   565,   566,   567,   568,   569,   570,   571,   572,   573,
-     574,   575,   576,   577,   578,   579,   580,   581,   582,   376,
-     583,   584,   585,   586,   587,   588,   589,   590,   591,   592,
-     593,   594,   595,   596,   597,   598,   599,   600,   601,   602,
-     603,   604,   605,   606,   607,   608,   609,   610,   611,   612,
-     613,   614,   615,   616,   617,   618,   619,   620,   621,   622,
-     623,   624,   625,   626,   627,   628,   629,   630,   631,   632,
-     633,   634,   635,   636,   637,   638,   639,   377,   378,   640,
-     641,   642,   643,   644,   645,   646,   647,   648,   649,   650,
-     651,   652,   653,   654,   655,   656,   657,   658,   659,   660,
-     661,   662,   663,   664,   665,   666,     0,     0,     0,     0,
-       0,     0,   379
+       2,   376,   352,   433,   353,   354,   365,   451,   452,   456,
+       0,     3,   457,   458,   366,   367,   408,   409,   410,   411,
+     412,   413,   414,   415,   416,   417,   418,   419,   391,   392,
+     393,   394,   395,   396,   397,   398,   459,   377,   378,   460,
+     461,     4,   462,   463,   464,   465,   466,     5,   436,   437,
+     438,   439,   440,   441,   442,   467,   468,   469,   470,   471,
+     472,   473,   379,   474,   475,   355,   476,   477,   478,   479,
+     480,   481,   482,   483,   484,   485,   486,   487,   488,   489,
+     490,   491,   492,   493,   494,   495,   496,   497,   498,   499,
+     500,     6,   501,   502,   503,   356,   504,   357,   368,   505,
+     369,   506,   507,   508,   509,   510,   511,     7,   512,   513,
+     514,   515,   516,   517,   518,   519,   520,   521,   522,   523,
+     380,   381,   524,   525,   526,   527,   528,   529,   530,   531,
+     532,   533,   534,   535,   536,   537,   538,   539,   540,   541,
+     542,   543,   544,   545,   546,     8,   547,   548,   549,   550,
+     551,   552,   553,   554,   555,   382,   556,   557,   558,   559,
+     560,   561,   562,   563,   564,   565,   566,   567,   568,   569,
+     570,   571,   572,   573,   574,   575,   576,   577,   578,   579,
+     580,   581,   582,   583,   584,   585,   586,   587,   588,   589,
+     590,   591,     9,   592,   593,   594,   595,   596,   597,   598,
+     599,   600,   601,   602,    10,   603,   604,   605,   606,   607,
+     608,   609,   610,   611,   612,   613,   614,     0,    11,    31,
+      32,    33,    34,    35,    36,    37,    38,    39,    40,    41,
+      42,    43,    44,    45,    46,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,   615,   616,   617,
+     618,    59,    60,    61,   619,   620,   621,    62,    63,    64,
+      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
+      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
+      85,    86,    87,    88,    89,    90,    91,    92,    93,    94,
+      95,    96,    97,    98,    99,   100,   101,   102,   622,   623,
+     624,   625,   626,   627,   628,   629,   630,   103,   104,   105,
+     631,   106,   107,   108,   632,   633,   109,   110,   111,   112,
+     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
+     123,   124,   125,   126,   127,   128,   129,   130,   131,   634,
+     635,   636,   637,   132,   133,   134,   135,   136,   137,   138,
+     139,   140,   638,   639,   640,   641,   642,   643,   644,   645,
+     646,   647,   648,   649,   650,   141,   142,   143,   144,   145,
+     146,   147,   148,   149,   150,   151,   152,   153,   154,   155,
+     156,   157,   158,   159,   160,   161,   162,   163,   164,   165,
+     166,   167,   168,   169,   170,   171,   172,   173,   174,   651,
+     175,   652,   176,   177,   178,   179,   180,   181,   182,   183,
+     184,   653,   654,   655,   656,   657,   658,   659,   660,   185,
+     186,   187,   188,   189,   190,   661,   662,   663,   664,   665,
+     666,   667,   668,   669,   670,   671,   672,   673,   674,   675,
+     676,   677,   678,   679,   680,   681,   682
 };
 
 static const yytype_int16 yycheck[] =
 {
-       0,    40,   108,    42,    43,    40,   205,   206,   207,   208,
-     209,    11,    10,    48,    49,   146,   147,   148,   149,   150,
-     151,   152,   153,   154,   155,   156,   157,    92,    93,    94,
-      95,    96,    97,    98,    99,    10,    10,    10,    10,    10,
-      10,    41,    10,    10,    10,    10,    10,    47,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,   103,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+       0,    40,    40,   108,    42,    43,    40,   219,   220,    10,
+      -1,    11,    10,    10,    48,    49,   146,   147,   148,   149,
+     150,   151,   152,   153,   154,   155,   156,   157,    92,    93,
+      94,    95,    96,    97,    98,    99,    10,    76,    77,    10,
+      10,    41,    10,    10,    10,    10,    10,    47,   205,   206,
+     207,   208,   209,   210,   211,    10,    10,    10,    10,    10,
+      10,    10,   101,    10,    10,   103,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    91,    10,    10,   133,    10,   135,   132,    10,   134,
-      10,    10,    10,    10,    10,    10,    -1,   107,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    22,    23,
-      24,    25,    26,    27,    28,    29,    30,    31,    32,    33,
-      34,    35,    36,    37,    38,    39,    10,    10,    10,    10,
-      44,    45,    46,    10,    10,   145,    50,    51,    52,    53,
-      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    68,    69,    70,    71,    72,    73,
-      74,    75,    76,    77,    78,    79,    80,    81,    82,    83,
-      84,    85,    86,    87,    88,    89,    90,    10,    10,    10,
-      10,    10,   192,    10,    10,    10,   100,   101,   102,    10,
-     104,   105,   106,    10,   204,   109,   110,   111,   112,   113,
-     114,   115,   116,   117,   118,   119,   120,   121,   122,   123,
-     124,   125,   126,   127,   128,   129,   130,   131,    10,    10,
-      10,    10,   136,   137,   138,   139,   140,   141,   142,   143,
-     144,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,   158,   159,   160,   161,   162,   163,
-     164,   165,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   177,   178,   179,   180,   181,   182,   183,
-     184,   185,   186,   187,   188,   189,   190,   191,    40,   193,
-      10,   195,   196,   197,   198,   199,   200,   201,   202,   203,
-      10,    10,    10,    10,    10,    10,   210,   211,   212,   213,
-     214,   215,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    76,    77,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,   101,
+      10,    91,    10,    10,    10,   133,    10,   135,   132,    10,
+     134,    10,    10,    10,    10,    10,    10,   107,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+     159,   160,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,   145,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,   194,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,   159,   160,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,   192,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,   204,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    -1,   218,    12,
+      13,    14,    15,    16,    17,    18,    19,    20,    21,    22,
+      23,    24,    25,    26,    27,    28,    29,    30,    31,    32,
+      33,    34,    35,    36,    37,    38,    39,    10,    10,    10,
+      10,    44,    45,    46,    10,    10,    10,    50,    51,    52,
+      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
+      63,    64,    65,    66,    67,    68,    69,    70,    71,    72,
+      73,    74,    75,    76,    77,    78,    79,    80,    81,    82,
+      83,    84,    85,    86,    87,    88,    89,    90,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,   100,   101,   102,
+      10,   104,   105,   106,    10,    10,   109,   110,   111,   112,
+     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
+     123,   124,   125,   126,   127,   128,   129,   130,   131,    10,
+      10,    10,    10,   136,   137,   138,   139,   140,   141,   142,
+     143,   144,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,   158,   159,   160,   161,   162,
+     163,   164,   165,   166,   167,   168,   169,   170,   171,   172,
+     173,   174,   175,   176,   177,   178,   179,   180,   181,   182,
+     183,   184,   185,   186,   187,   188,   189,   190,   191,    10,
+     193,    10,   195,   196,   197,   198,   199,   200,   201,   202,
+     203,    10,    10,    10,    10,    10,    10,    10,    10,   212,
+     213,   214,   215,   216,   217,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    -1,    -1,    -1,    -1,
-      -1,    -1,   194
+      10,    10,    10,    10,    10,    10,    10
 };
 
   /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
      symbol of state STATE-NUM.  */
 static const yytype_uint16 yystos[] =
 {
-       0,   217,     0,    11,    41,    47,    91,   107,   145,   192,
-     204,   218,   219,   222,   225,   228,   405,   416,   431,   439,
-     220,   223,   226,   229,   406,   417,   432,   440,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    22,    23,
-      24,    25,    26,    27,    28,    29,    30,    31,    32,    33,
-      34,    35,    36,    37,    38,    39,    44,    45,    46,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,    76,    77,    78,    79,    80,
-      81,    82,    83,    84,    85,    86,    87,    88,    89,    90,
-     100,   101,   102,   104,   105,   106,   109,   110,   111,   112,
-     113,   114,   115,   116,   117,   118,   119,   120,   121,   122,
-     123,   124,   125,   126,   127,   128,   129,   130,   131,   136,
-     137,   138,   139,   140,   141,   142,   143,   144,   158,   159,
-     160,   161,   162,   163,   164,   165,   166,   167,   168,   169,
-     170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
-     180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
-     190,   191,   193,   195,   196,   197,   198,   199,   200,   201,
-     202,   203,   210,   211,   212,   213,   214,   215,   221,   231,
-     232,   233,   234,   235,   236,   237,   238,   239,   240,   241,
-     242,   243,   244,   245,   246,   247,   248,   249,   250,   251,
-     252,   253,   254,   255,   256,   257,   258,   259,   260,   261,
-     262,   263,   264,   265,   266,   267,   268,   269,   270,   271,
-     272,   273,   274,   275,   276,   277,   278,   279,   280,   281,
-     282,   283,   284,   285,   286,   287,   288,   289,   290,   291,
-     292,   293,   294,   295,   296,   297,   298,   299,   300,   301,
-     302,   303,   304,   305,   306,   307,   308,   309,   310,   311,
-     312,   313,   314,   315,   316,   317,   318,   319,   320,   321,
-     322,   323,   324,   325,   326,   327,   328,   329,   330,   331,
-     332,   333,   334,   335,   336,   337,   338,   339,   340,   341,
-     342,   343,   344,   345,   346,   347,   348,   349,   350,   351,
-     352,   353,   354,   355,   356,   357,   358,   359,   360,   361,
-     362,   363,   364,   365,   366,   367,   368,   369,   370,   371,
-     372,   373,   374,   375,   376,   377,   378,   379,   380,   381,
-     382,   383,   384,   385,   386,   435,   436,   437,   438,    40,
-      42,    43,   103,   133,   135,   224,   387,   388,   389,   390,
-     391,   392,    40,    48,    49,   132,   134,   227,   393,   394,
-     395,   396,   397,    40,    76,    77,   101,   159,   160,   194,
-     230,   398,   399,   400,   401,   402,   403,   404,    92,    93,
-      94,    95,    96,    97,    98,    99,   407,   408,   409,   410,
-     411,   412,   413,   414,   415,   146,   147,   148,   149,   150,
-     151,   152,   153,   154,   155,   156,   157,   418,   419,   420,
-     421,   422,   423,   424,   425,   426,   427,   428,   429,   430,
-     108,   433,   434,   205,   206,   207,   208,   209,   441,   442,
-     443,   444,   445,   446,    10,    10,    10,    10,    10,    10,
+       0,   222,     0,    11,    41,    47,    91,   107,   145,   192,
+     204,   218,   223,   224,   227,   230,   233,   410,   421,   436,
+     444,   454,   225,   228,   231,   234,   411,   422,   437,   445,
+     455,    12,    13,    14,    15,    16,    17,    18,    19,    20,
+      21,    22,    23,    24,    25,    26,    27,    28,    29,    30,
+      31,    32,    33,    34,    35,    36,    37,    38,    39,    44,
+      45,    46,    50,    51,    52,    53,    54,    55,    56,    57,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
+      68,    69,    70,    71,    72,    73,    74,    75,    76,    77,
+      78,    79,    80,    81,    82,    83,    84,    85,    86,    87,
+      88,    89,    90,   100,   101,   102,   104,   105,   106,   109,
+     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
+     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
+     130,   131,   136,   137,   138,   139,   140,   141,   142,   143,
+     144,   158,   159,   160,   161,   162,   163,   164,   165,   166,
+     167,   168,   169,   170,   171,   172,   173,   174,   175,   176,
+     177,   178,   179,   180,   181,   182,   183,   184,   185,   186,
+     187,   188,   189,   190,   191,   193,   195,   196,   197,   198,
+     199,   200,   201,   202,   203,   212,   213,   214,   215,   216,
+     217,   226,   236,   237,   238,   239,   240,   241,   242,   243,
+     244,   245,   246,   247,   248,   249,   250,   251,   252,   253,
+     254,   255,   256,   257,   258,   259,   260,   261,   262,   263,
+     264,   265,   266,   267,   268,   269,   270,   271,   272,   273,
+     274,   275,   276,   277,   278,   279,   280,   281,   282,   283,
+     284,   285,   286,   287,   288,   289,   290,   291,   292,   293,
+     294,   295,   296,   297,   298,   299,   300,   301,   302,   303,
+     304,   305,   306,   307,   308,   309,   310,   311,   312,   313,
+     314,   315,   316,   317,   318,   319,   320,   321,   322,   323,
+     324,   325,   326,   327,   328,   329,   330,   331,   332,   333,
+     334,   335,   336,   337,   338,   339,   340,   341,   342,   343,
+     344,   345,   346,   347,   348,   349,   350,   351,   352,   353,
+     354,   355,   356,   357,   358,   359,   360,   361,   362,   363,
+     364,   365,   366,   367,   368,   369,   370,   371,   372,   373,
+     374,   375,   376,   377,   378,   379,   380,   381,   382,   383,
+     384,   385,   386,   387,   388,   389,   390,   391,   440,   441,
+     442,   443,    40,    42,    43,   103,   133,   135,   229,   392,
+     393,   394,   395,   396,   397,    40,    48,    49,   132,   134,
+     232,   398,   399,   400,   401,   402,    40,    76,    77,   101,
+     159,   160,   194,   235,   403,   404,   405,   406,   407,   408,
+     409,    92,    93,    94,    95,    96,    97,    98,    99,   412,
+     413,   414,   415,   416,   417,   418,   419,   420,   146,   147,
+     148,   149,   150,   151,   152,   153,   154,   155,   156,   157,
+     423,   424,   425,   426,   427,   428,   429,   430,   431,   432,
+     433,   434,   435,   108,   438,   439,   205,   206,   207,   208,
+     209,   210,   211,   446,   447,   448,   449,   450,   451,   452,
+     453,   219,   220,   456,   457,   458,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -1542,64 +1566,66 @@ static const yytype_uint16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10
 };
 
   /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint16 yyr1[] =
 {
-       0,   216,   217,   217,   218,   218,   218,   218,   218,   218,
-     218,   218,   219,   220,   220,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   221,   221,   221,   221,   221,
-     221,   221,   221,   221,   221,   222,   223,   223,   224,   224,
-     224,   224,   224,   224,   225,   226,   226,   227,   227,   227,
-     227,   227,   228,   229,   229,   230,   230,   230,   230,   230,
-     230,   230,   231,   232,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   247,   248,
-     249,   250,   251,   252,   253,   254,   255,   256,   257,   258,
-     259,   260,   261,   262,   263,   264,   265,   266,   267,   268,
-     269,   270,   271,   272,   273,   274,   275,   276,   277,   278,
-     279,   280,   281,   282,   283,   284,   285,   286,   287,   288,
-     289,   290,   291,   292,   293,   294,   295,   296,   297,   298,
-     299,   300,   301,   302,   303,   304,   305,   306,   307,   308,
-     309,   310,   311,   312,   313,   314,   315,   316,   317,   318,
-     319,   320,   321,   322,   323,   324,   325,   326,   327,   328,
-     329,   330,   331,   332,   333,   334,   335,   336,   337,   338,
-     339,   340,   341,   342,   343,   344,   345,   346,   347,   348,
-     349,   350,   351,   352,   353,   354,   355,   356,   357,   358,
-     359,   360,   361,   362,   363,   364,   365,   366,   367,   368,
-     369,   370,   371,   372,   373,   374,   375,   376,   377,   378,
-     379,   380,   381,   382,   383,   384,   385,   386,   387,   388,
-     389,   390,   391,   392,   393,   394,   395,   396,   397,   398,
-     399,   400,   401,   402,   403,   404,   405,   406,   406,   407,
-     407,   407,   407,   407,   407,   407,   407,   408,   409,   410,
-     411,   412,   413,   414,   415,   416,   417,   417,   418,   418,
-     418,   418,   418,   418,   418,   418,   418,   418,   418,   418,
-     419,   420,   421,   422,   423,   424,   425,   426,   427,   428,
-     429,   430,   431,   432,   432,   433,   434,   435,   436,   437,
-     438,   439,   440,   440,   441,   441,   441,   441,   441,   442,
-     443,   444,   445,   446
+       0,   221,   222,   222,   223,   223,   223,   223,   223,   223,
+     223,   223,   223,   224,   225,   225,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   226,   226,   226,   226,
+     226,   226,   226,   226,   226,   226,   227,   228,   228,   229,
+     229,   229,   229,   229,   229,   230,   231,   231,   232,   232,
+     232,   232,   232,   233,   234,   234,   235,   235,   235,   235,
+     235,   235,   235,   236,   237,   238,   239,   240,   241,   242,
+     243,   244,   245,   246,   247,   248,   249,   250,   251,   252,
+     253,   254,   255,   256,   257,   258,   259,   260,   261,   262,
+     263,   264,   265,   266,   267,   268,   269,   270,   271,   272,
+     273,   274,   275,   276,   277,   278,   279,   280,   281,   282,
+     283,   284,   285,   286,   287,   288,   289,   290,   291,   292,
+     293,   294,   295,   296,   297,   298,   299,   300,   301,   302,
+     303,   304,   305,   306,   307,   308,   309,   310,   311,   312,
+     313,   314,   315,   316,   317,   318,   319,   320,   321,   322,
+     323,   324,   325,   326,   327,   328,   329,   330,   331,   332,
+     333,   334,   335,   336,   337,   338,   339,   340,   341,   342,
+     343,   344,   345,   346,   347,   348,   349,   350,   351,   352,
+     353,   354,   355,   356,   357,   358,   359,   360,   361,   362,
+     363,   364,   365,   366,   367,   368,   369,   370,   371,   372,
+     373,   374,   375,   376,   377,   378,   379,   380,   381,   382,
+     383,   384,   385,   386,   387,   388,   389,   390,   391,   392,
+     393,   394,   395,   396,   397,   398,   399,   400,   401,   402,
+     403,   404,   405,   406,   407,   408,   409,   410,   411,   411,
+     412,   412,   412,   412,   412,   412,   412,   412,   413,   414,
+     415,   416,   417,   418,   419,   420,   421,   422,   422,   423,
+     423,   423,   423,   423,   423,   423,   423,   423,   423,   423,
+     423,   424,   425,   426,   427,   428,   429,   430,   431,   432,
+     433,   434,   435,   436,   437,   437,   438,   439,   440,   441,
+     442,   443,   444,   445,   445,   446,   446,   446,   446,   446,
+     446,   446,   447,   448,   449,   450,   451,   452,   453,   454,
+     455,   455,   456,   456,   457,   458
 };
 
   /* YYR2[YYN] -- Number of symbols on the right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
        0,     2,     0,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     1,     2,     0,     1,     1,     1,     1,     1,
+       2,     2,     2,     1,     2,     0,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
@@ -1615,10 +1641,10 @@ static const yytype_uint8 yyr2[] =
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     2,     0,     1,
        1,     1,     1,     1,     1,     1,     2,     0,     1,     1,
-       1,     1,     1,     1,     1,     2,     0,     1,     1,     1,
-       1,     1,     1,     2,     0,     1,     1,     1,     1,     1,
-       1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
+       1,     1,     1,     1,     2,     0,     1,     1,     1,     1,
+       1,     1,     1,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -1628,21 +1654,22 @@ static const yytype_uint8 yyr2[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       3,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     3,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
-       2,     2,     2,     3,     3,     4,     4,     4,     3,     3,
-       2,     2,     2,     2,     2,     2,     3,     3,     2,     2,
+       2,     2,     2,     2,     2,     3,     2,     2,     2,     2,
+       2,     2,     2,     2,     3,     3,     4,     4,     4,     3,
+       3,     2,     2,     2,     2,     2,     2,     3,     3,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       3,     3,     3,     2,     2,     2,     1,     2,     0,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
+       2,     3,     3,     3,     2,     2,     2,     1,     2,     0,
+       1,     1,     1,     1,     1,     1,     1,     1,     2,     2,
+       2,     2,     2,     2,     2,     2,     1,     2,     0,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     1,     2,     0,     1,     2,     2,     2,     3,
-       3,     1,     2,     0,     1,     1,     1,     1,     1,     2,
-       2,     2,     2,     2
+       1,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     1,     2,     0,     1,     2,     2,     2,
+       3,     3,     1,     2,     0,     1,     1,     1,     1,     1,
+       1,     1,     2,     2,     2,     2,     2,     2,     2,     1,
+       2,     0,     1,     1,     2,     2
 };
 
 
@@ -2318,16 +2345,16 @@ yyreduce:
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
-        case 12:
-#line 161 "util/configparser.y" /* yacc.c:1646  */
+        case 13:
+#line 165 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(server:)\n")); 
 	}
-#line 2327 "util/configparser.c" /* yacc.c:1646  */
+#line 2354 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 175:
-#line 239 "util/configparser.y" /* yacc.c:1646  */
+  case 176:
+#line 243 "util/configparser.y" /* yacc.c:1646  */
     {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2338,11 +2365,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2342 "util/configparser.c" /* yacc.c:1646  */
+#line 2369 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 184:
-#line 256 "util/configparser.y" /* yacc.c:1646  */
+  case 185:
+#line 260 "util/configparser.y" /* yacc.c:1646  */
     {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2353,11 +2380,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2357 "util/configparser.c" /* yacc.c:1646  */
+#line 2384 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 192:
-#line 273 "util/configparser.y" /* yacc.c:1646  */
+  case 193:
+#line 277 "util/configparser.y" /* yacc.c:1646  */
     {
 		struct config_view* s;
 		OUTYY(("\nP(view:)\n")); 
@@ -2370,11 +2397,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2374 "util/configparser.c" /* yacc.c:1646  */
+#line 2401 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 202:
-#line 292 "util/configparser.y" /* yacc.c:1646  */
+  case 203:
+#line 296 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2382,11 +2409,11 @@ yyreduce:
 		else cfg_parser->cfg->num_threads = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2386 "util/configparser.c" /* yacc.c:1646  */
+#line 2413 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 203:
-#line 301 "util/configparser.y" /* yacc.c:1646  */
+  case 204:
+#line 305 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2394,11 +2421,11 @@ yyreduce:
 		else cfg_parser->cfg->verbosity = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2398 "util/configparser.c" /* yacc.c:1646  */
+#line 2425 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 204:
-#line 310 "util/configparser.y" /* yacc.c:1646  */
+  case 205:
+#line 314 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -2408,11 +2435,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_interval = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2412 "util/configparser.c" /* yacc.c:1646  */
+#line 2439 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 205:
-#line 321 "util/configparser.y" /* yacc.c:1646  */
+  case 206:
+#line 325 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2420,11 +2447,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_cumulative = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2424 "util/configparser.c" /* yacc.c:1646  */
+#line 2451 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 206:
-#line 330 "util/configparser.y" /* yacc.c:1646  */
+  case 207:
+#line 334 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2432,11 +2459,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_extended = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2436 "util/configparser.c" /* yacc.c:1646  */
+#line 2463 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 207:
-#line 339 "util/configparser.y" /* yacc.c:1646  */
+  case 208:
+#line 343 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_shm_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2444,11 +2471,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_enable = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2448 "util/configparser.c" /* yacc.c:1646  */
+#line 2475 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 208:
-#line 348 "util/configparser.y" /* yacc.c:1646  */
+  case 209:
+#line 352 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_shm_key:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -2458,11 +2485,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_key = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2462 "util/configparser.c" /* yacc.c:1646  */
+#line 2489 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 209:
-#line 359 "util/configparser.y" /* yacc.c:1646  */
+  case 210:
+#line 363 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2470,11 +2497,11 @@ yyreduce:
 		else cfg_parser->cfg->port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2474 "util/configparser.c" /* yacc.c:1646  */
+#line 2501 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 210:
-#line 368 "util/configparser.y" /* yacc.c:1646  */
+  case 211:
+#line 372 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_send_client_subnet:%s)\n", (yyvsp[0].str)));
@@ -2484,11 +2511,11 @@ yyreduce:
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
 	#endif
 	}
-#line 2488 "util/configparser.c" /* yacc.c:1646  */
+#line 2515 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 211:
-#line 379 "util/configparser.y" /* yacc.c:1646  */
+  case 212:
+#line 383 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_zone:%s)\n", (yyvsp[0].str)));
@@ -2499,11 +2526,11 @@ yyreduce:
 		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
 	#endif
 	}
-#line 2503 "util/configparser.c" /* yacc.c:1646  */
+#line 2530 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 212:
-#line 392 "util/configparser.y" /* yacc.c:1646  */
+  case 213:
+#line 396 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_always_forward:%s)\n", (yyvsp[0].str)));
@@ -2517,11 +2544,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2521 "util/configparser.c" /* yacc.c:1646  */
+#line 2548 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 213:
-#line 407 "util/configparser.y" /* yacc.c:1646  */
+  case 214:
+#line 411 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(client_subnet_opcode:%s)\n", (yyvsp[0].str)));
@@ -2531,11 +2558,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2535 "util/configparser.c" /* yacc.c:1646  */
+#line 2562 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 214:
-#line 418 "util/configparser.y" /* yacc.c:1646  */
+  case 215:
+#line 422 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@ -2551,11 +2578,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2555 "util/configparser.c" /* yacc.c:1646  */
+#line 2582 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 215:
-#line 435 "util/configparser.y" /* yacc.c:1646  */
+  case 216:
+#line 439 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@ -2571,11 +2598,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 2575 "util/configparser.c" /* yacc.c:1646  */
+#line 2602 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 216:
-#line 452 "util/configparser.y" /* yacc.c:1646  */
+  case 217:
+#line 456 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -2587,11 +2614,11 @@ yyreduce:
 		else
 			cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = (yyvsp[0].str);
 	}
-#line 2591 "util/configparser.c" /* yacc.c:1646  */
+#line 2618 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 217:
-#line 465 "util/configparser.y" /* yacc.c:1646  */
+  case 218:
+#line 469 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -2605,11 +2632,11 @@ yyreduce:
 			cfg_parser->cfg->out_ifs[
 				cfg_parser->cfg->num_out_ifs++] = (yyvsp[0].str);
 	}
-#line 2609 "util/configparser.c" /* yacc.c:1646  */
+#line 2636 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 218:
-#line 480 "util/configparser.y" /* yacc.c:1646  */
+  case 219:
+#line 484 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2617,11 +2644,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_ports = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2621 "util/configparser.c" /* yacc.c:1646  */
+#line 2648 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 219:
-#line 489 "util/configparser.y" /* yacc.c:1646  */
+  case 220:
+#line 493 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 1, 
@@ -2629,11 +2656,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 2633 "util/configparser.c" /* yacc.c:1646  */
+#line 2660 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 220:
-#line 498 "util/configparser.y" /* yacc.c:1646  */
+  case 221:
+#line 502 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 0, 
@@ -2641,11 +2668,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 2645 "util/configparser.c" /* yacc.c:1646  */
+#line 2672 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 221:
-#line 507 "util/configparser.y" /* yacc.c:1646  */
+  case 222:
+#line 511 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2653,11 +2680,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2657 "util/configparser.c" /* yacc.c:1646  */
+#line 2684 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 222:
-#line 516 "util/configparser.y" /* yacc.c:1646  */
+  case 223:
+#line 520 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2665,11 +2692,11 @@ yyreduce:
 		else cfg_parser->cfg->incoming_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2669 "util/configparser.c" /* yacc.c:1646  */
+#line 2696 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 223:
-#line 525 "util/configparser.y" /* yacc.c:1646  */
+  case 224:
+#line 529 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2677,11 +2704,11 @@ yyreduce:
 		else cfg_parser->cfg->if_automatic = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2681 "util/configparser.c" /* yacc.c:1646  */
+#line 2708 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 224:
-#line 534 "util/configparser.y" /* yacc.c:1646  */
+  case 225:
+#line 538 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2689,11 +2716,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2693 "util/configparser.c" /* yacc.c:1646  */
+#line 2720 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 225:
-#line 543 "util/configparser.y" /* yacc.c:1646  */
+  case 226:
+#line 547 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2701,11 +2728,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2705 "util/configparser.c" /* yacc.c:1646  */
+#line 2732 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 226:
-#line 552 "util/configparser.y" /* yacc.c:1646  */
+  case 227:
+#line 556 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2713,11 +2740,11 @@ yyreduce:
 		else cfg_parser->cfg->do_udp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2717 "util/configparser.c" /* yacc.c:1646  */
+#line 2744 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 227:
-#line 561 "util/configparser.y" /* yacc.c:1646  */
+  case 228:
+#line 565 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2725,11 +2752,11 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2729 "util/configparser.c" /* yacc.c:1646  */
+#line 2756 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 228:
-#line 570 "util/configparser.y" /* yacc.c:1646  */
+  case 229:
+#line 574 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_prefer_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2737,11 +2764,11 @@ yyreduce:
 		else cfg_parser->cfg->prefer_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2741 "util/configparser.c" /* yacc.c:1646  */
+#line 2768 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 229:
-#line 579 "util/configparser.y" /* yacc.c:1646  */
+  case 230:
+#line 583 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_tcp_mss:%s)\n", (yyvsp[0].str)));
                 if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2749,11 +2776,11 @@ yyreduce:
                 else cfg_parser->cfg->tcp_mss = atoi((yyvsp[0].str));
                 free((yyvsp[0].str));
 	}
-#line 2753 "util/configparser.c" /* yacc.c:1646  */
+#line 2780 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 230:
-#line 588 "util/configparser.y" /* yacc.c:1646  */
+  case 231:
+#line 592 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -2761,11 +2788,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_tcp_mss = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2765 "util/configparser.c" /* yacc.c:1646  */
+#line 2792 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 231:
-#line 597 "util/configparser.y" /* yacc.c:1646  */
+  case 232:
+#line 601 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2773,11 +2800,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2777 "util/configparser.c" /* yacc.c:1646  */
+#line 2804 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 232:
-#line 606 "util/configparser.y" /* yacc.c:1646  */
+  case 233:
+#line 610 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2785,31 +2812,31 @@ yyreduce:
 		else cfg_parser->cfg->ssl_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2789 "util/configparser.c" /* yacc.c:1646  */
+#line 2816 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 233:
-#line 615 "util/configparser.y" /* yacc.c:1646  */
+  case 234:
+#line 619 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_key);
 		cfg_parser->cfg->ssl_service_key = (yyvsp[0].str);
 	}
-#line 2799 "util/configparser.c" /* yacc.c:1646  */
+#line 2826 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 234:
-#line 622 "util/configparser.y" /* yacc.c:1646  */
+  case 235:
+#line 626 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
 		cfg_parser->cfg->ssl_service_pem = (yyvsp[0].str);
 	}
-#line 2809 "util/configparser.c" /* yacc.c:1646  */
+#line 2836 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 235:
-#line 629 "util/configparser.y" /* yacc.c:1646  */
+  case 236:
+#line 633 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -2817,11 +2844,11 @@ yyreduce:
 		else cfg_parser->cfg->ssl_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 2821 "util/configparser.c" /* yacc.c:1646  */
+#line 2848 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 236:
-#line 638 "util/configparser.y" /* yacc.c:1646  */
+  case 237:
+#line 642 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_use_systemd:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2829,11 +2856,11 @@ yyreduce:
 		else cfg_parser->cfg->use_systemd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2833 "util/configparser.c" /* yacc.c:1646  */
+#line 2860 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 237:
-#line 647 "util/configparser.y" /* yacc.c:1646  */
+  case 238:
+#line 651 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2841,11 +2868,11 @@ yyreduce:
 		else cfg_parser->cfg->do_daemonize = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2845 "util/configparser.c" /* yacc.c:1646  */
+#line 2872 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 238:
-#line 656 "util/configparser.y" /* yacc.c:1646  */
+  case 239:
+#line 660 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2858,11 +2885,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 2862 "util/configparser.c" /* yacc.c:1646  */
+#line 2889 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 239:
-#line 670 "util/configparser.y" /* yacc.c:1646  */
+  case 240:
+#line 674 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2870,11 +2897,11 @@ yyreduce:
 		else cfg_parser->cfg->log_time_ascii = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2874 "util/configparser.c" /* yacc.c:1646  */
+#line 2901 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 240:
-#line 679 "util/configparser.y" /* yacc.c:1646  */
+  case 241:
+#line 683 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2882,11 +2909,11 @@ yyreduce:
 		else cfg_parser->cfg->log_queries = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2886 "util/configparser.c" /* yacc.c:1646  */
+#line 2913 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 241:
-#line 688 "util/configparser.y" /* yacc.c:1646  */
+  case 242:
+#line 692 "util/configparser.y" /* yacc.c:1646  */
     {
   	OUTYY(("P(server_log_replies:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2894,31 +2921,31 @@ yyreduce:
   	else cfg_parser->cfg->log_replies = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 2898 "util/configparser.c" /* yacc.c:1646  */
+#line 2925 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 242:
-#line 697 "util/configparser.y" /* yacc.c:1646  */
+  case 243:
+#line 701 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->chrootdir);
 		cfg_parser->cfg->chrootdir = (yyvsp[0].str);
 	}
-#line 2908 "util/configparser.c" /* yacc.c:1646  */
+#line 2935 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 243:
-#line 704 "util/configparser.y" /* yacc.c:1646  */
+  case 244:
+#line 708 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->username);
 		cfg_parser->cfg->username = (yyvsp[0].str);
 	}
-#line 2918 "util/configparser.c" /* yacc.c:1646  */
+#line 2945 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 244:
-#line 711 "util/configparser.y" /* yacc.c:1646  */
+  case 245:
+#line 715 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->directory);
@@ -2943,105 +2970,105 @@ yyreduce:
 			}
 		}
 	}
-#line 2947 "util/configparser.c" /* yacc.c:1646  */
+#line 2974 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 245:
-#line 737 "util/configparser.y" /* yacc.c:1646  */
+  case 246:
+#line 741 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->logfile);
 		cfg_parser->cfg->logfile = (yyvsp[0].str);
 		cfg_parser->cfg->use_syslog = 0;
 	}
-#line 2958 "util/configparser.c" /* yacc.c:1646  */
+#line 2985 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 246:
-#line 745 "util/configparser.y" /* yacc.c:1646  */
+  case 247:
+#line 749 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->pidfile);
 		cfg_parser->cfg->pidfile = (yyvsp[0].str);
 	}
-#line 2968 "util/configparser.c" /* yacc.c:1646  */
+#line 2995 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 247:
-#line 752 "util/configparser.y" /* yacc.c:1646  */
+  case 248:
+#line 756 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2978 "util/configparser.c" /* yacc.c:1646  */
+#line 3005 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 248:
-#line 759 "util/configparser.y" /* yacc.c:1646  */
+  case 249:
+#line 763 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dlv_anchor_file);
 		cfg_parser->cfg->dlv_anchor_file = (yyvsp[0].str);
 	}
-#line 2988 "util/configparser.c" /* yacc.c:1646  */
+#line 3015 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 249:
-#line 766 "util/configparser.y" /* yacc.c:1646  */
+  case 250:
+#line 770 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 2998 "util/configparser.c" /* yacc.c:1646  */
+#line 3025 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 250:
-#line 773 "util/configparser.y" /* yacc.c:1646  */
+  case 251:
+#line 777 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			auto_trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3009 "util/configparser.c" /* yacc.c:1646  */
+#line 3036 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 251:
-#line 781 "util/configparser.y" /* yacc.c:1646  */
+  case 252:
+#line 785 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3020 "util/configparser.c" /* yacc.c:1646  */
+#line 3047 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 252:
-#line 789 "util/configparser.y" /* yacc.c:1646  */
+  case 253:
+#line 793 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trusted_keys_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3031 "util/configparser.c" /* yacc.c:1646  */
+#line 3058 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 253:
-#line 797 "util/configparser.y" /* yacc.c:1646  */
+  case 254:
+#line 801 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3041 "util/configparser.c" /* yacc.c:1646  */
+#line 3068 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 254:
-#line 804 "util/configparser.y" /* yacc.c:1646  */
+  case 255:
+#line 808 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_trust_anchor_signaling:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3051,21 +3078,21 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3055 "util/configparser.c" /* yacc.c:1646  */
+#line 3082 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 255:
-#line 815 "util/configparser.y" /* yacc.c:1646  */
+  case 256:
+#line 819 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3065 "util/configparser.c" /* yacc.c:1646  */
+#line 3092 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 256:
-#line 822 "util/configparser.y" /* yacc.c:1646  */
+  case 257:
+#line 826 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3073,11 +3100,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3077 "util/configparser.c" /* yacc.c:1646  */
+#line 3104 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 257:
-#line 831 "util/configparser.y" /* yacc.c:1646  */
+  case 258:
+#line 835 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3085,11 +3112,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3089 "util/configparser.c" /* yacc.c:1646  */
+#line 3116 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 258:
-#line 840 "util/configparser.y" /* yacc.c:1646  */
+  case 259:
+#line 844 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_hide_trustanchor:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3097,53 +3124,53 @@ yyreduce:
 		else cfg_parser->cfg->hide_trustanchor = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3101 "util/configparser.c" /* yacc.c:1646  */
+#line 3128 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 259:
-#line 849 "util/configparser.y" /* yacc.c:1646  */
+  case 260:
+#line 853 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->identity);
 		cfg_parser->cfg->identity = (yyvsp[0].str);
 	}
-#line 3111 "util/configparser.c" /* yacc.c:1646  */
+#line 3138 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 260:
-#line 856 "util/configparser.y" /* yacc.c:1646  */
+  case 261:
+#line 860 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->version);
 		cfg_parser->cfg->version = (yyvsp[0].str);
 	}
-#line 3121 "util/configparser.c" /* yacc.c:1646  */
+#line 3148 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 261:
-#line 863 "util/configparser.y" /* yacc.c:1646  */
+  case 262:
+#line 867 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_rcvbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 3132 "util/configparser.c" /* yacc.c:1646  */
+#line 3159 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 262:
-#line 871 "util/configparser.y" /* yacc.c:1646  */
+  case 263:
+#line 875 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_sndbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 3143 "util/configparser.c" /* yacc.c:1646  */
+#line 3170 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 263:
-#line 879 "util/configparser.y" /* yacc.c:1646  */
+  case 264:
+#line 883 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3152,11 +3179,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3156 "util/configparser.c" /* yacc.c:1646  */
+#line 3183 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 264:
-#line 889 "util/configparser.y" /* yacc.c:1646  */
+  case 265:
+#line 893 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3165,11 +3192,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3169 "util/configparser.c" /* yacc.c:1646  */
+#line 3196 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 265:
-#line 899 "util/configparser.y" /* yacc.c:1646  */
+  case 266:
+#line 903 "util/configparser.y" /* yacc.c:1646  */
     {
         OUTYY(("P(server_ip_freebind:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3178,11 +3205,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 3182 "util/configparser.c" /* yacc.c:1646  */
+#line 3209 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 266:
-#line 909 "util/configparser.y" /* yacc.c:1646  */
+  case 267:
+#line 913 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3194,11 +3221,11 @@ yyreduce:
 		else cfg_parser->cfg->edns_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3198 "util/configparser.c" /* yacc.c:1646  */
+#line 3225 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 267:
-#line 922 "util/configparser.y" /* yacc.c:1646  */
+  case 268:
+#line 926 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3208,22 +3235,22 @@ yyreduce:
 		else cfg_parser->cfg->msg_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3212 "util/configparser.c" /* yacc.c:1646  */
+#line 3239 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 268:
-#line 933 "util/configparser.y" /* yacc.c:1646  */
+  case 269:
+#line 937 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->msg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3223 "util/configparser.c" /* yacc.c:1646  */
+#line 3250 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 269:
-#line 941 "util/configparser.y" /* yacc.c:1646  */
+  case 270:
+#line 945 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3235,11 +3262,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3239 "util/configparser.c" /* yacc.c:1646  */
+#line 3266 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 270:
-#line 954 "util/configparser.y" /* yacc.c:1646  */
+  case 271:
+#line 958 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3247,11 +3274,11 @@ yyreduce:
 		else cfg_parser->cfg->num_queries_per_thread = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3251 "util/configparser.c" /* yacc.c:1646  */
+#line 3278 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 271:
-#line 963 "util/configparser.y" /* yacc.c:1646  */
+  case 272:
+#line 967 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3259,11 +3286,11 @@ yyreduce:
 		else cfg_parser->cfg->jostle_time = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3263 "util/configparser.c" /* yacc.c:1646  */
+#line 3290 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 272:
-#line 972 "util/configparser.y" /* yacc.c:1646  */
+  case 273:
+#line 976 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3271,11 +3298,11 @@ yyreduce:
 		else cfg_parser->cfg->delay_close = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3275 "util/configparser.c" /* yacc.c:1646  */
+#line 3302 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 273:
-#line 981 "util/configparser.y" /* yacc.c:1646  */
+  case 274:
+#line 985 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3284,11 +3311,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3288 "util/configparser.c" /* yacc.c:1646  */
+#line 3315 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 274:
-#line 991 "util/configparser.y" /* yacc.c:1646  */
+  case 275:
+#line 995 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_insecure_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3297,22 +3324,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3301 "util/configparser.c" /* yacc.c:1646  */
+#line 3328 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 275:
-#line 1001 "util/configparser.y" /* yacc.c:1646  */
+  case 276:
+#line 1005 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->rrset_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3312 "util/configparser.c" /* yacc.c:1646  */
+#line 3339 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 276:
-#line 1009 "util/configparser.y" /* yacc.c:1646  */
+  case 277:
+#line 1013 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3324,11 +3351,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3328 "util/configparser.c" /* yacc.c:1646  */
+#line 3355 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 277:
-#line 1022 "util/configparser.y" /* yacc.c:1646  */
+  case 278:
+#line 1026 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3336,22 +3363,22 @@ yyreduce:
 		else cfg_parser->cfg->host_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3340 "util/configparser.c" /* yacc.c:1646  */
+#line 3367 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 278:
-#line 1031 "util/configparser.y" /* yacc.c:1646  */
+  case 279:
+#line 1035 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
 			"removed, use infra-host-ttl)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3351 "util/configparser.c" /* yacc.c:1646  */
+#line 3378 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 279:
-#line 1039 "util/configparser.y" /* yacc.c:1646  */
+  case 280:
+#line 1043 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3359,22 +3386,22 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_numhosts = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3363 "util/configparser.c" /* yacc.c:1646  */
+#line 3390 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 280:
-#line 1048 "util/configparser.y" /* yacc.c:1646  */
+  case 281:
+#line 1052 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
 			"(option removed, use infra-cache-numhosts)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3374 "util/configparser.c" /* yacc.c:1646  */
+#line 3401 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 281:
-#line 1056 "util/configparser.y" /* yacc.c:1646  */
+  case 282:
+#line 1060 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3386,11 +3413,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3390 "util/configparser.c" /* yacc.c:1646  */
+#line 3417 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 282:
-#line 1069 "util/configparser.y" /* yacc.c:1646  */
+  case 283:
+#line 1073 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3398,21 +3425,21 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3402 "util/configparser.c" /* yacc.c:1646  */
+#line 3429 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 283:
-#line 1078 "util/configparser.y" /* yacc.c:1646  */
+  case 284:
+#line 1082 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
 		cfg_parser->cfg->target_fetch_policy = (yyvsp[0].str);
 	}
-#line 3412 "util/configparser.c" /* yacc.c:1646  */
+#line 3439 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 284:
-#line 1085 "util/configparser.y" /* yacc.c:1646  */
+  case 285:
+#line 1089 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3421,11 +3448,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3425 "util/configparser.c" /* yacc.c:1646  */
+#line 3452 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 285:
-#line 1095 "util/configparser.y" /* yacc.c:1646  */
+  case 286:
+#line 1099 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3434,11 +3461,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3438 "util/configparser.c" /* yacc.c:1646  */
+#line 3465 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 286:
-#line 1105 "util/configparser.y" /* yacc.c:1646  */
+  case 287:
+#line 1109 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3447,11 +3474,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3451 "util/configparser.c" /* yacc.c:1646  */
+#line 3478 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 287:
-#line 1115 "util/configparser.y" /* yacc.c:1646  */
+  case 288:
+#line 1119 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3460,11 +3487,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3464 "util/configparser.c" /* yacc.c:1646  */
+#line 3491 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 288:
-#line 1125 "util/configparser.y" /* yacc.c:1646  */
+  case 289:
+#line 1129 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3473,11 +3500,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3477 "util/configparser.c" /* yacc.c:1646  */
+#line 3504 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 289:
-#line 1135 "util/configparser.y" /* yacc.c:1646  */
+  case 290:
+#line 1139 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3486,11 +3513,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3490 "util/configparser.c" /* yacc.c:1646  */
+#line 3517 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 290:
-#line 1145 "util/configparser.y" /* yacc.c:1646  */
+  case 291:
+#line 1149 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3499,11 +3526,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3503 "util/configparser.c" /* yacc.c:1646  */
+#line 3530 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 291:
-#line 1155 "util/configparser.y" /* yacc.c:1646  */
+  case 292:
+#line 1159 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3512,41 +3539,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3516 "util/configparser.c" /* yacc.c:1646  */
+#line 3543 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 292:
-#line 1165 "util/configparser.y" /* yacc.c:1646  */
+  case 293:
+#line 1169 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3526 "util/configparser.c" /* yacc.c:1646  */
+#line 3553 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 293:
-#line 1172 "util/configparser.y" /* yacc.c:1646  */
+  case 294:
+#line 1176 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3536 "util/configparser.c" /* yacc.c:1646  */
+#line 3563 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 294:
-#line 1179 "util/configparser.y" /* yacc.c:1646  */
+  case 295:
+#line 1183 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3546 "util/configparser.c" /* yacc.c:1646  */
+#line 3573 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 295:
-#line 1186 "util/configparser.y" /* yacc.c:1646  */
+  case 296:
+#line 1190 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3554,11 +3581,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3558 "util/configparser.c" /* yacc.c:1646  */
+#line 3585 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 296:
-#line 1195 "util/configparser.y" /* yacc.c:1646  */
+  case 297:
+#line 1199 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3566,11 +3593,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch_key = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3570 "util/configparser.c" /* yacc.c:1646  */
+#line 3597 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 297:
-#line 1204 "util/configparser.y" /* yacc.c:1646  */
+  case 298:
+#line 1208 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3578,21 +3605,21 @@ yyreduce:
 		else cfg_parser->cfg->unwanted_threshold = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3582 "util/configparser.c" /* yacc.c:1646  */
+#line 3609 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 298:
-#line 1213 "util/configparser.y" /* yacc.c:1646  */
+  case 299:
+#line 1217 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3592 "util/configparser.c" /* yacc.c:1646  */
+#line 3619 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 299:
-#line 1220 "util/configparser.y" /* yacc.c:1646  */
+  case 300:
+#line 1224 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3601,11 +3628,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3605 "util/configparser.c" /* yacc.c:1646  */
+#line 3632 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 300:
-#line 1230 "util/configparser.y" /* yacc.c:1646  */
+  case 301:
+#line 1234 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "deny")!=0 && strcmp((yyvsp[0].str), "refuse")!=0 &&
@@ -3621,21 +3648,21 @@ yyreduce:
 				fatal_exit("out of memory adding acl");
 		}
 	}
-#line 3625 "util/configparser.c" /* yacc.c:1646  */
+#line 3652 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 301:
-#line 1247 "util/configparser.y" /* yacc.c:1646  */
+  case 302:
+#line 1251 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->module_conf);
 		cfg_parser->cfg->module_conf = (yyvsp[0].str);
 	}
-#line 3635 "util/configparser.c" /* yacc.c:1646  */
+#line 3662 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 302:
-#line 1254 "util/configparser.y" /* yacc.c:1646  */
+  case 303:
+#line 1258 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3652,11 +3679,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3656 "util/configparser.c" /* yacc.c:1646  */
+#line 3683 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 303:
-#line 1272 "util/configparser.y" /* yacc.c:1646  */
+  case 304:
+#line 1276 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3668,11 +3695,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3672 "util/configparser.c" /* yacc.c:1646  */
+#line 3699 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 304:
-#line 1285 "util/configparser.y" /* yacc.c:1646  */
+  case 305:
+#line 1289 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -3684,11 +3711,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3688 "util/configparser.c" /* yacc.c:1646  */
+#line 3715 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 305:
-#line 1298 "util/configparser.y" /* yacc.c:1646  */
+  case 306:
+#line 1302 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3696,11 +3723,11 @@ yyreduce:
 		else cfg_parser->cfg->max_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3700 "util/configparser.c" /* yacc.c:1646  */
+#line 3727 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 306:
-#line 1307 "util/configparser.y" /* yacc.c:1646  */
+  case 307:
+#line 1311 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3708,11 +3735,11 @@ yyreduce:
 		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3712 "util/configparser.c" /* yacc.c:1646  */
+#line 3739 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 307:
-#line 1316 "util/configparser.y" /* yacc.c:1646  */
+  case 308:
+#line 1320 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3720,11 +3747,11 @@ yyreduce:
 		else cfg_parser->cfg->min_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3724 "util/configparser.c" /* yacc.c:1646  */
+#line 3751 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 308:
-#line 1325 "util/configparser.y" /* yacc.c:1646  */
+  case 309:
+#line 1329 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3732,11 +3759,11 @@ yyreduce:
 		else cfg_parser->cfg->bogus_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3736 "util/configparser.c" /* yacc.c:1646  */
+#line 3763 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 309:
-#line 1334 "util/configparser.y" /* yacc.c:1646  */
+  case 310:
+#line 1338 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3745,11 +3772,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3749 "util/configparser.c" /* yacc.c:1646  */
+#line 3776 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 310:
-#line 1344 "util/configparser.y" /* yacc.c:1646  */
+  case 311:
+#line 1348 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3758,11 +3785,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3762 "util/configparser.c" /* yacc.c:1646  */
+#line 3789 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 311:
-#line 1354 "util/configparser.y" /* yacc.c:1646  */
+  case 312:
+#line 1358 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3770,11 +3797,11 @@ yyreduce:
 		else cfg_parser->cfg->ignore_cd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3774 "util/configparser.c" /* yacc.c:1646  */
+#line 3801 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 312:
-#line 1363 "util/configparser.y" /* yacc.c:1646  */
+  case 313:
+#line 1367 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_serve_expired:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3782,11 +3809,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3786 "util/configparser.c" /* yacc.c:1646  */
+#line 3813 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 313:
-#line 1372 "util/configparser.y" /* yacc.c:1646  */
+  case 314:
+#line 1376 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_fake_dsa:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3798,11 +3825,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 3802 "util/configparser.c" /* yacc.c:1646  */
+#line 3829 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 314:
-#line 1385 "util/configparser.y" /* yacc.c:1646  */
+  case 315:
+#line 1389 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_fake_sha1:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3814,11 +3841,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 3818 "util/configparser.c" /* yacc.c:1646  */
+#line 3845 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 315:
-#line 1398 "util/configparser.y" /* yacc.c:1646  */
+  case 316:
+#line 1402 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3826,21 +3853,21 @@ yyreduce:
 		else cfg_parser->cfg->val_log_level = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3830 "util/configparser.c" /* yacc.c:1646  */
+#line 3857 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 316:
-#line 1407 "util/configparser.y" /* yacc.c:1646  */
+  case 317:
+#line 1411 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
 		cfg_parser->cfg->val_nsec3_key_iterations = (yyvsp[0].str);
 	}
-#line 3840 "util/configparser.c" /* yacc.c:1646  */
+#line 3867 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 317:
-#line 1414 "util/configparser.y" /* yacc.c:1646  */
+  case 318:
+#line 1418 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3848,11 +3875,11 @@ yyreduce:
 		else cfg_parser->cfg->add_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3852 "util/configparser.c" /* yacc.c:1646  */
+#line 3879 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 318:
-#line 1423 "util/configparser.y" /* yacc.c:1646  */
+  case 319:
+#line 1427 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3860,11 +3887,11 @@ yyreduce:
 		else cfg_parser->cfg->del_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3864 "util/configparser.c" /* yacc.c:1646  */
+#line 3891 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 319:
-#line 1432 "util/configparser.y" /* yacc.c:1646  */
+  case 320:
+#line 1436 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3872,11 +3899,11 @@ yyreduce:
 		else cfg_parser->cfg->keep_missing = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3876 "util/configparser.c" /* yacc.c:1646  */
+#line 3903 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 320:
-#line 1441 "util/configparser.y" /* yacc.c:1646  */
+  case 321:
+#line 1445 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_permit_small_holddown:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3885,22 +3912,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3889 "util/configparser.c" /* yacc.c:1646  */
+#line 3916 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 321:
-#line 1450 "util/configparser.y" /* yacc.c:1646  */
+  case 322:
+#line 1454 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->key_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3900 "util/configparser.c" /* yacc.c:1646  */
+#line 3927 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 322:
-#line 1458 "util/configparser.y" /* yacc.c:1646  */
+  case 323:
+#line 1462 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3912,22 +3939,22 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 3916 "util/configparser.c" /* yacc.c:1646  */
+#line 3943 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 323:
-#line 1471 "util/configparser.y" /* yacc.c:1646  */
+  case 324:
+#line 1475 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->neg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3927 "util/configparser.c" /* yacc.c:1646  */
+#line 3954 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 324:
-#line 1479 "util/configparser.y" /* yacc.c:1646  */
+  case 325:
+#line 1483 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -3954,21 +3981,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 3958 "util/configparser.c" /* yacc.c:1646  */
+#line 3985 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 325:
-#line 1507 "util/configparser.y" /* yacc.c:1646  */
+  case 326:
+#line 1511 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 3968 "util/configparser.c" /* yacc.c:1646  */
+#line 3995 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 326:
-#line 1514 "util/configparser.y" /* yacc.c:1646  */
+  case 327:
+#line 1518 "util/configparser.y" /* yacc.c:1646  */
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -3982,11 +4009,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 3986 "util/configparser.c" /* yacc.c:1646  */
+#line 4013 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 327:
-#line 1529 "util/configparser.y" /* yacc.c:1646  */
+  case 328:
+#line 1533 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3995,11 +4022,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3999 "util/configparser.c" /* yacc.c:1646  */
+#line 4026 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 328:
-#line 1539 "util/configparser.y" /* yacc.c:1646  */
+  case 329:
+#line 1543 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4008,31 +4035,31 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4012 "util/configparser.c" /* yacc.c:1646  */
+#line 4039 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 329:
-#line 1549 "util/configparser.y" /* yacc.c:1646  */
+  case 330:
+#line 1553 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4022 "util/configparser.c" /* yacc.c:1646  */
+#line 4049 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 330:
-#line 1556 "util/configparser.y" /* yacc.c:1646  */
+  case 331:
+#line 1560 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 4032 "util/configparser.c" /* yacc.c:1646  */
+#line 4059 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 331:
-#line 1563 "util/configparser.y" /* yacc.c:1646  */
+  case 332:
+#line 1567 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4040,11 +4067,11 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4044 "util/configparser.c" /* yacc.c:1646  */
+#line 4071 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 332:
-#line 1572 "util/configparser.y" /* yacc.c:1646  */
+  case 333:
+#line 1576 "util/configparser.y" /* yacc.c:1646  */
     {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -4057,11 +4084,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4061 "util/configparser.c" /* yacc.c:1646  */
+#line 4088 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 333:
-#line 1586 "util/configparser.y" /* yacc.c:1646  */
+  case 334:
+#line 1590 "util/configparser.y" /* yacc.c:1646  */
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4079,11 +4106,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4083 "util/configparser.c" /* yacc.c:1646  */
+#line 4110 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 334:
-#line 1605 "util/configparser.y" /* yacc.c:1646  */
+  case 335:
+#line 1609 "util/configparser.y" /* yacc.c:1646  */
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4101,11 +4128,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4105 "util/configparser.c" /* yacc.c:1646  */
+#line 4132 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 335:
-#line 1624 "util/configparser.y" /* yacc.c:1646  */
+  case 336:
+#line 1628 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@ -4116,11 +4143,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4120 "util/configparser.c" /* yacc.c:1646  */
+#line 4147 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 336:
-#line 1636 "util/configparser.y" /* yacc.c:1646  */
+  case 337:
+#line 1640 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@ -4131,11 +4158,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4135 "util/configparser.c" /* yacc.c:1646  */
+#line 4162 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 337:
-#line 1648 "util/configparser.y" /* yacc.c:1646  */
+  case 338:
+#line 1652 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@ -4146,11 +4173,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4150 "util/configparser.c" /* yacc.c:1646  */
+#line 4177 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 338:
-#line 1660 "util/configparser.y" /* yacc.c:1646  */
+  case 339:
+#line 1664 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@ -4160,11 +4187,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4164 "util/configparser.c" /* yacc.c:1646  */
+#line 4191 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 339:
-#line 1671 "util/configparser.y" /* yacc.c:1646  */
+  case 340:
+#line 1675 "util/configparser.y" /* yacc.c:1646  */
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -4182,11 +4209,11 @@ yyreduce:
 			}
 		}
 	}
-#line 4186 "util/configparser.c" /* yacc.c:1646  */
+#line 4213 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 340:
-#line 1690 "util/configparser.y" /* yacc.c:1646  */
+  case 341:
+#line 1694 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4194,11 +4221,11 @@ yyreduce:
 		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4198 "util/configparser.c" /* yacc.c:1646  */
+#line 4225 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 341:
-#line 1700 "util/configparser.y" /* yacc.c:1646  */
+  case 342:
+#line 1704 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4206,33 +4233,33 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4210 "util/configparser.c" /* yacc.c:1646  */
+#line 4237 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 342:
-#line 1709 "util/configparser.y" /* yacc.c:1646  */
+  case 343:
+#line 1713 "util/configparser.y" /* yacc.c:1646  */
     {
   	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 4221 "util/configparser.c" /* yacc.c:1646  */
+#line 4248 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 343:
-#line 1717 "util/configparser.y" /* yacc.c:1646  */
+  case 344:
+#line 1721 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4232 "util/configparser.c" /* yacc.c:1646  */
+#line 4259 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 344:
-#line 1725 "util/configparser.y" /* yacc.c:1646  */
+  case 345:
+#line 1729 "util/configparser.y" /* yacc.c:1646  */
     {
   	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -4244,11 +4271,11 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 4248 "util/configparser.c" /* yacc.c:1646  */
+#line 4275 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 345:
-#line 1738 "util/configparser.y" /* yacc.c:1646  */
+  case 346:
+#line 1742 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4260,11 +4287,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4264 "util/configparser.c" /* yacc.c:1646  */
+#line 4291 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 346:
-#line 1751 "util/configparser.y" /* yacc.c:1646  */
+  case 347:
+#line 1755 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -4276,11 +4303,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 4280 "util/configparser.c" /* yacc.c:1646  */
+#line 4307 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 347:
-#line 1764 "util/configparser.y" /* yacc.c:1646  */
+  case 348:
+#line 1768 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -4292,11 +4319,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 4296 "util/configparser.c" /* yacc.c:1646  */
+#line 4323 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 348:
-#line 1777 "util/configparser.y" /* yacc.c:1646  */
+  case 349:
+#line 1781 "util/configparser.y" /* yacc.c:1646  */
     { 
   	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
   	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4304,11 +4331,11 @@ yyreduce:
   	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
   	free((yyvsp[0].str));
 	}
-#line 4308 "util/configparser.c" /* yacc.c:1646  */
+#line 4335 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 349:
-#line 1786 "util/configparser.y" /* yacc.c:1646  */
+  case 350:
+#line 1790 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4316,11 +4343,11 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4320 "util/configparser.c" /* yacc.c:1646  */
+#line 4347 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 350:
-#line 1795 "util/configparser.y" /* yacc.c:1646  */
+  case 351:
+#line 1799 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4329,11 +4356,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4333 "util/configparser.c" /* yacc.c:1646  */
+#line 4360 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 351:
-#line 1805 "util/configparser.y" /* yacc.c:1646  */
+  case 352:
+#line 1809 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4342,11 +4369,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4346 "util/configparser.c" /* yacc.c:1646  */
+#line 4373 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 352:
-#line 1815 "util/configparser.y" /* yacc.c:1646  */
+  case 353:
+#line 1819 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@ -4358,11 +4385,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4362 "util/configparser.c" /* yacc.c:1646  */
+#line 4389 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 353:
-#line 1828 "util/configparser.y" /* yacc.c:1646  */
+  case 354:
+#line 1832 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@ -4374,11 +4401,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4378 "util/configparser.c" /* yacc.c:1646  */
+#line 4405 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 354:
-#line 1841 "util/configparser.y" /* yacc.c:1646  */
+  case 355:
+#line 1845 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@ -4388,11 +4415,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4392 "util/configparser.c" /* yacc.c:1646  */
+#line 4419 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 355:
-#line 1852 "util/configparser.y" /* yacc.c:1646  */
+  case 356:
+#line 1856 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@ -4404,11 +4431,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4408 "util/configparser.c" /* yacc.c:1646  */
+#line 4435 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 356:
-#line 1865 "util/configparser.y" /* yacc.c:1646  */
+  case 357:
+#line 1869 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@ -4418,11 +4445,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4422 "util/configparser.c" /* yacc.c:1646  */
+#line 4449 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 357:
-#line 1876 "util/configparser.y" /* yacc.c:1646  */
+  case 358:
+#line 1880 "util/configparser.y" /* yacc.c:1646  */
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@ -4434,11 +4461,11 @@ yyreduce:
 		OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
 	#endif
 	}
-#line 4438 "util/configparser.c" /* yacc.c:1646  */
+#line 4465 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 358:
-#line 1889 "util/configparser.y" /* yacc.c:1646  */
+  case 359:
+#line 1893 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -4447,31 +4474,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 4451 "util/configparser.c" /* yacc.c:1646  */
+#line 4478 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 359:
-#line 1899 "util/configparser.y" /* yacc.c:1646  */
+  case 360:
+#line 1903 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4461 "util/configparser.c" /* yacc.c:1646  */
+#line 4488 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 360:
-#line 1906 "util/configparser.y" /* yacc.c:1646  */
+  case 361:
+#line 1910 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4471 "util/configparser.c" /* yacc.c:1646  */
+#line 4498 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 361:
-#line 1913 "util/configparser.y" /* yacc.c:1646  */
+  case 362:
+#line 1917 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4479,11 +4506,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4483 "util/configparser.c" /* yacc.c:1646  */
+#line 4510 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 362:
-#line 1922 "util/configparser.y" /* yacc.c:1646  */
+  case 363:
+#line 1926 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4492,11 +4519,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4496 "util/configparser.c" /* yacc.c:1646  */
+#line 4523 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 363:
-#line 1932 "util/configparser.y" /* yacc.c:1646  */
+  case 364:
+#line 1936 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4505,11 +4532,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4509 "util/configparser.c" /* yacc.c:1646  */
+#line 4536 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 364:
-#line 1942 "util/configparser.y" /* yacc.c:1646  */
+  case 365:
+#line 1946 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -4518,31 +4545,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 4522 "util/configparser.c" /* yacc.c:1646  */
+#line 4549 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 365:
-#line 1952 "util/configparser.y" /* yacc.c:1646  */
+  case 366:
+#line 1956 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4532 "util/configparser.c" /* yacc.c:1646  */
+#line 4559 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 366:
-#line 1959 "util/configparser.y" /* yacc.c:1646  */
+  case 367:
+#line 1963 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4542 "util/configparser.c" /* yacc.c:1646  */
+#line 4569 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 367:
-#line 1966 "util/configparser.y" /* yacc.c:1646  */
+  case 368:
+#line 1970 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4550,11 +4577,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4554 "util/configparser.c" /* yacc.c:1646  */
+#line 4581 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 368:
-#line 1975 "util/configparser.y" /* yacc.c:1646  */
+  case 369:
+#line 1979 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4563,11 +4590,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4567 "util/configparser.c" /* yacc.c:1646  */
+#line 4594 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 369:
-#line 1985 "util/configparser.y" /* yacc.c:1646  */
+  case 370:
+#line 1989 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->views->name)
@@ -4576,11 +4603,11 @@ yyreduce:
 		free(cfg_parser->cfg->views->name);
 		cfg_parser->cfg->views->name = (yyvsp[0].str);
 	}
-#line 4580 "util/configparser.c" /* yacc.c:1646  */
+#line 4607 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 370:
-#line 1995 "util/configparser.y" /* yacc.c:1646  */
+  case 371:
+#line 1999 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -4608,11 +4635,11 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 4612 "util/configparser.c" /* yacc.c:1646  */
+#line 4639 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 371:
-#line 2024 "util/configparser.y" /* yacc.c:1646  */
+  case 372:
+#line 2028 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -4621,22 +4648,22 @@ yyreduce:
 			fatal_exit("out of memory adding per-view "
 				"response-ip action");
 	}
-#line 4625 "util/configparser.c" /* yacc.c:1646  */
+#line 4652 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 372:
-#line 2034 "util/configparser.y" /* yacc.c:1646  */
+  case 373:
+#line 2038 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(
 			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 4636 "util/configparser.c" /* yacc.c:1646  */
+#line 4663 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 373:
-#line 2042 "util/configparser.y" /* yacc.c:1646  */
+  case 374:
+#line 2046 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
@@ -4644,11 +4671,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 4648 "util/configparser.c" /* yacc.c:1646  */
+#line 4675 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 374:
-#line 2051 "util/configparser.y" /* yacc.c:1646  */
+  case 375:
+#line 2055 "util/configparser.y" /* yacc.c:1646  */
     {
 		char* ptr;
 		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -4662,11 +4689,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 4666 "util/configparser.c" /* yacc.c:1646  */
+#line 4693 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 375:
-#line 2066 "util/configparser.y" /* yacc.c:1646  */
+  case 376:
+#line 2070 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4674,19 +4701,19 @@ yyreduce:
 		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4678 "util/configparser.c" /* yacc.c:1646  */
+#line 4705 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 376:
-#line 2075 "util/configparser.y" /* yacc.c:1646  */
+  case 377:
+#line 2079 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 4686 "util/configparser.c" /* yacc.c:1646  */
+#line 4713 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 387:
-#line 2086 "util/configparser.y" /* yacc.c:1646  */
+  case 388:
+#line 2090 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4695,11 +4722,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4699 "util/configparser.c" /* yacc.c:1646  */
+#line 4726 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 388:
-#line 2096 "util/configparser.y" /* yacc.c:1646  */
+  case 389:
+#line 2100 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4707,21 +4734,21 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4711 "util/configparser.c" /* yacc.c:1646  */
+#line 4738 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 389:
-#line 2105 "util/configparser.y" /* yacc.c:1646  */
+  case 390:
+#line 2109 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4721 "util/configparser.c" /* yacc.c:1646  */
+#line 4748 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 390:
-#line 2112 "util/configparser.y" /* yacc.c:1646  */
+  case 391:
+#line 2116 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4730,122 +4757,122 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4734 "util/configparser.c" /* yacc.c:1646  */
+#line 4761 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 391:
-#line 2122 "util/configparser.y" /* yacc.c:1646  */
+  case 392:
+#line 2126 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 4744 "util/configparser.c" /* yacc.c:1646  */
+#line 4771 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 392:
-#line 2129 "util/configparser.y" /* yacc.c:1646  */
+  case 393:
+#line 2133 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 4754 "util/configparser.c" /* yacc.c:1646  */
+#line 4781 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 393:
-#line 2136 "util/configparser.y" /* yacc.c:1646  */
+  case 394:
+#line 2140 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 4764 "util/configparser.c" /* yacc.c:1646  */
+#line 4791 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 394:
-#line 2143 "util/configparser.y" /* yacc.c:1646  */
+  case 395:
+#line 2147 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 4774 "util/configparser.c" /* yacc.c:1646  */
+#line 4801 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 395:
-#line 2150 "util/configparser.y" /* yacc.c:1646  */
+  case 396:
+#line 2154 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 4782 "util/configparser.c" /* yacc.c:1646  */
+#line 4809 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 410:
-#line 2167 "util/configparser.y" /* yacc.c:1646  */
+  case 411:
+#line 2171 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4793 "util/configparser.c" /* yacc.c:1646  */
+#line 4820 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 411:
-#line 2175 "util/configparser.y" /* yacc.c:1646  */
+  case 412:
+#line 2179 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 4803 "util/configparser.c" /* yacc.c:1646  */
+#line 4830 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 412:
-#line 2182 "util/configparser.y" /* yacc.c:1646  */
+  case 413:
+#line 2186 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4814 "util/configparser.c" /* yacc.c:1646  */
+#line 4841 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 413:
-#line 2190 "util/configparser.y" /* yacc.c:1646  */
+  case 414:
+#line 2194 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
 			yyerror("expected yes or no.");
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4825 "util/configparser.c" /* yacc.c:1646  */
+#line 4852 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 414:
-#line 2198 "util/configparser.y" /* yacc.c:1646  */
+  case 415:
+#line 2202 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 4835 "util/configparser.c" /* yacc.c:1646  */
+#line 4862 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 415:
-#line 2205 "util/configparser.y" /* yacc.c:1646  */
+  case 416:
+#line 2209 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 4845 "util/configparser.c" /* yacc.c:1646  */
+#line 4872 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 416:
-#line 2212 "util/configparser.y" /* yacc.c:1646  */
+  case 417:
+#line 2216 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4853,11 +4880,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_resolver_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4857 "util/configparser.c" /* yacc.c:1646  */
+#line 4884 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 417:
-#line 2221 "util/configparser.y" /* yacc.c:1646  */
+  case 418:
+#line 2225 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4865,11 +4892,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_resolver_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4869 "util/configparser.c" /* yacc.c:1646  */
+#line 4896 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 418:
-#line 2230 "util/configparser.y" /* yacc.c:1646  */
+  case 419:
+#line 2234 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4877,11 +4904,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_client_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4881 "util/configparser.c" /* yacc.c:1646  */
+#line 4908 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 419:
-#line 2239 "util/configparser.y" /* yacc.c:1646  */
+  case 420:
+#line 2243 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4889,11 +4916,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_client_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4893 "util/configparser.c" /* yacc.c:1646  */
+#line 4920 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 420:
-#line 2248 "util/configparser.y" /* yacc.c:1646  */
+  case 421:
+#line 2252 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4901,11 +4928,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_forwarder_query_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4905 "util/configparser.c" /* yacc.c:1646  */
+#line 4932 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 421:
-#line 2257 "util/configparser.y" /* yacc.c:1646  */
+  case 422:
+#line 2261 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4913,29 +4940,29 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_log_forwarder_response_messages =
 			(strcmp((yyvsp[0].str), "yes")==0);
 	}
-#line 4917 "util/configparser.c" /* yacc.c:1646  */
+#line 4944 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 422:
-#line 2266 "util/configparser.y" /* yacc.c:1646  */
+  case 423:
+#line 2270 "util/configparser.y" /* yacc.c:1646  */
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 4925 "util/configparser.c" /* yacc.c:1646  */
+#line 4952 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 426:
-#line 2275 "util/configparser.y" /* yacc.c:1646  */
+  case 427:
+#line 2279 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->python_script);
 		cfg_parser->cfg->python_script = (yyvsp[0].str);
 	}
-#line 4935 "util/configparser.c" /* yacc.c:1646  */
+#line 4962 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 427:
-#line 2281 "util/configparser.y" /* yacc.c:1646  */
+  case 428:
+#line 2285 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4944,21 +4971,21 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4948 "util/configparser.c" /* yacc.c:1646  */
+#line 4975 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 428:
-#line 2291 "util/configparser.y" /* yacc.c:1646  */
+  case 429:
+#line 2295 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->log_identity);
 		cfg_parser->cfg->log_identity = (yyvsp[0].str);
 	}
-#line 4958 "util/configparser.c" /* yacc.c:1646  */
+#line 4985 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 429:
-#line 2298 "util/configparser.y" /* yacc.c:1646  */
+  case 430:
+#line 2302 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -4966,31 +4993,31 @@ yyreduce:
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip");
 	}
-#line 4970 "util/configparser.c" /* yacc.c:1646  */
+#line 4997 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 430:
-#line 2307 "util/configparser.y" /* yacc.c:1646  */
+  case 431:
+#line 2311 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
 			if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
 				(yyvsp[-1].str), (yyvsp[0].str)))
 				fatal_exit("out of memory adding response-ip-data");
 	}
-#line 4981 "util/configparser.c" /* yacc.c:1646  */
+#line 5008 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 431:
-#line 2315 "util/configparser.y" /* yacc.c:1646  */
+  case 432:
+#line 2319 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("\nP(dnscrypt:)\n"));
 		OUTYY(("\nP(dnscrypt:)\n"));
 	}
-#line 4990 "util/configparser.c" /* yacc.c:1646  */
+#line 5017 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 439:
-#line 2327 "util/configparser.y" /* yacc.c:1646  */
+  case 442:
+#line 2333 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4998,11 +5025,11 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5002 "util/configparser.c" /* yacc.c:1646  */
+#line 5029 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 440:
-#line 2337 "util/configparser.y" /* yacc.c:1646  */
+  case 443:
+#line 2343 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
 
@@ -5011,41 +5038,111 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5015 "util/configparser.c" /* yacc.c:1646  */
+#line 5042 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 441:
-#line 2347 "util/configparser.y" /* yacc.c:1646  */
+  case 444:
+#line 2353 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnscrypt_provider);
 		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
 	}
-#line 5025 "util/configparser.c" /* yacc.c:1646  */
+#line 5052 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 442:
-#line 2354 "util/configparser.y" /* yacc.c:1646  */
+  case 445:
+#line 2360 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert");
 	}
-#line 5035 "util/configparser.c" /* yacc.c:1646  */
+#line 5062 "util/configparser.c" /* yacc.c:1646  */
     break;
 
-  case 443:
-#line 2361 "util/configparser.y" /* yacc.c:1646  */
+  case 446:
+#line 2367 "util/configparser.y" /* yacc.c:1646  */
     {
 		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
-#line 5045 "util/configparser.c" /* yacc.c:1646  */
+#line 5072 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 447:
+#line 2374 "util/configparser.y" /* yacc.c:1646  */
+    {
+  	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
+  	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
+  		yyerror("memory size expected");
+  	free((yyvsp[0].str));
+  }
+#line 5083 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 448:
+#line 2382 "util/configparser.y" /* yacc.c:1646  */
+    {
+  	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
+  	if(atoi((yyvsp[0].str)) == 0)
+  		yyerror("number expected");
+  	else {
+  		cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi((yyvsp[0].str));
+  		if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs))
+  			yyerror("must be a power of 2");
+  	}
+  	free((yyvsp[0].str));
+  }
+#line 5099 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 449:
+#line 2395 "util/configparser.y" /* yacc.c:1646  */
+    {
+		OUTYY(("\nP(cachedb:)\n"));
+	}
+#line 5107 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 454:
+#line 2404 "util/configparser.y" /* yacc.c:1646  */
+    {
+	#ifdef USE_CACHEDB
+		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
+		if(cfg_parser->cfg->cachedb_backend)
+			yyerror("cachedb backend override, there must be one "
+				"backend");
+		free(cfg_parser->cfg->cachedb_backend);
+		cfg_parser->cfg->cachedb_backend = (yyvsp[0].str);
+	#else
+		OUTYY(("P(Compiled without cachedb, ignoring)\n"));
+	#endif
+	}
+#line 5124 "util/configparser.c" /* yacc.c:1646  */
+    break;
+
+  case 455:
+#line 2418 "util/configparser.y" /* yacc.c:1646  */
+    {
+	#ifdef USE_CACHEDB
+		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
+		if(cfg_parser->cfg->cachedb_secret)
+			yyerror("cachedb secret-seed override, there must be "
+				"only one secret");
+		free(cfg_parser->cfg->cachedb_secret);
+		cfg_parser->cfg->cachedb_secret = (yyvsp[0].str);
+	#else
+		OUTYY(("P(Compiled without cachedb, ignoring)\n"));
+		free((yyvsp[0].str));
+	#endif
+	}
+#line 5142 "util/configparser.c" /* yacc.c:1646  */
     break;
 
 
-#line 5049 "util/configparser.c" /* yacc.c:1646  */
+#line 5146 "util/configparser.c" /* yacc.c:1646  */
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -5273,7 +5370,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 2367 "util/configparser.y" /* yacc.c:1906  */
+#line 2432 "util/configparser.y" /* yacc.c:1906  */
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index 30373da46cdf..fe9d6144256d 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -252,12 +252,17 @@ extern int yydebug;
     VAR_DNSCRYPT_PROVIDER = 462,
     VAR_DNSCRYPT_SECRET_KEY = 463,
     VAR_DNSCRYPT_PROVIDER_CERT = 464,
-    VAR_IPSECMOD_ENABLED = 465,
-    VAR_IPSECMOD_HOOK = 466,
-    VAR_IPSECMOD_IGNORE_BOGUS = 467,
-    VAR_IPSECMOD_MAX_TTL = 468,
-    VAR_IPSECMOD_WHITELIST = 469,
-    VAR_IPSECMOD_STRICT = 470
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 465,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 466,
+    VAR_IPSECMOD_ENABLED = 467,
+    VAR_IPSECMOD_HOOK = 468,
+    VAR_IPSECMOD_IGNORE_BOGUS = 469,
+    VAR_IPSECMOD_MAX_TTL = 470,
+    VAR_IPSECMOD_WHITELIST = 471,
+    VAR_IPSECMOD_STRICT = 472,
+    VAR_CACHEDB = 473,
+    VAR_CACHEDB_BACKEND = 474,
+    VAR_CACHEDB_SECRETSEED = 475
   };
 #endif
 /* Tokens.  */
@@ -468,12 +473,17 @@ extern int yydebug;
 #define VAR_DNSCRYPT_PROVIDER 462
 #define VAR_DNSCRYPT_SECRET_KEY 463
 #define VAR_DNSCRYPT_PROVIDER_CERT 464
-#define VAR_IPSECMOD_ENABLED 465
-#define VAR_IPSECMOD_HOOK 466
-#define VAR_IPSECMOD_IGNORE_BOGUS 467
-#define VAR_IPSECMOD_MAX_TTL 468
-#define VAR_IPSECMOD_WHITELIST 469
-#define VAR_IPSECMOD_STRICT 470
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 465
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 466
+#define VAR_IPSECMOD_ENABLED 467
+#define VAR_IPSECMOD_HOOK 468
+#define VAR_IPSECMOD_IGNORE_BOGUS 469
+#define VAR_IPSECMOD_MAX_TTL 470
+#define VAR_IPSECMOD_WHITELIST 471
+#define VAR_IPSECMOD_STRICT 472
+#define VAR_CACHEDB 473
+#define VAR_CACHEDB_BACKEND 474
+#define VAR_CACHEDB_SECRETSEED 475
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -484,7 +494,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 488 "util/configparser.h" /* yacc.c:1909  */
+#line 498 "util/configparser.h" /* yacc.c:1909  */
 };
 
 typedef union YYSTYPE YYSTYPE;
diff --git a/util/configparser.y b/util/configparser.y
index 7c8161442ccd..7b41b1d767d6 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -144,8 +144,11 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_USE_SYSTEMD VAR_SHM_ENABLE VAR_SHM_KEY
 %token VAR_DNSCRYPT VAR_DNSCRYPT_ENABLE VAR_DNSCRYPT_PORT VAR_DNSCRYPT_PROVIDER
 %token VAR_DNSCRYPT_SECRET_KEY VAR_DNSCRYPT_PROVIDER_CERT
+%token VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE
+%token VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS
 %token VAR_IPSECMOD_ENABLED VAR_IPSECMOD_HOOK VAR_IPSECMOD_IGNORE_BOGUS
 %token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT
+%token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -153,7 +156,8 @@ toplevelvar: serverstart contents_server | stubstart contents_stub |
 	forwardstart contents_forward | pythonstart contents_py | 
 	rcstart contents_rc | dtstart contents_dt | viewstart 
 	contents_view |
-	dnscstart contents_dnsc
+	dnscstart contents_dnsc |
+	cachedbstart contents_cachedb
 	;
 
 /* server: declaration */
@@ -2321,7 +2325,9 @@ contents_dnsc: contents_dnsc content_dnsc
 	| ;
 content_dnsc:
 	dnsc_dnscrypt_enable | dnsc_dnscrypt_port | dnsc_dnscrypt_provider |
-	dnsc_dnscrypt_secret_key | dnsc_dnscrypt_provider_cert
+	dnsc_dnscrypt_secret_key | dnsc_dnscrypt_provider_cert |
+	dnsc_dnscrypt_shared_secret_cache_size |
+    dnsc_dnscrypt_shared_secret_cache_slabs
 	;
 dnsc_dnscrypt_enable: VAR_DNSCRYPT_ENABLE STRING_ARG
 	{
@@ -2364,6 +2370,65 @@ dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
 	;
+dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG
+  {
+  	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2));
+  	if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
+  		yyerror("memory size expected");
+  	free($2);
+  }
+  ;
+dnsc_dnscrypt_shared_secret_cache_slabs: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS STRING_ARG
+  {
+  	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2));
+  	if(atoi($2) == 0)
+  		yyerror("number expected");
+  	else {
+  		cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2);
+  		if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs))
+  			yyerror("must be a power of 2");
+  	}
+  	free($2);
+  }
+  ;
+cachedbstart: VAR_CACHEDB
+	{
+		OUTYY(("\nP(cachedb:)\n"));
+	}
+	;
+contents_cachedb: contents_cachedb content_cachedb
+	| ;
+content_cachedb: cachedb_backend_name | cachedb_secret_seed
+	;
+cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG
+	{
+	#ifdef USE_CACHEDB
+		OUTYY(("P(backend:%s)\n", $2));
+		if(cfg_parser->cfg->cachedb_backend)
+			yyerror("cachedb backend override, there must be one "
+				"backend");
+		free(cfg_parser->cfg->cachedb_backend);
+		cfg_parser->cfg->cachedb_backend = $2;
+	#else
+		OUTYY(("P(Compiled without cachedb, ignoring)\n"));
+	#endif
+	}
+	;
+cachedb_secret_seed: VAR_CACHEDB_SECRETSEED STRING_ARG
+	{
+	#ifdef USE_CACHEDB
+		OUTYY(("P(secret-seed:%s)\n", $2));
+		if(cfg_parser->cfg->cachedb_secret)
+			yyerror("cachedb secret-seed override, there must be "
+				"only one secret");
+		free(cfg_parser->cfg->cachedb_secret);
+		cfg_parser->cfg->cachedb_secret = $2;
+	#else
+		OUTYY(("P(Compiled without cachedb, ignoring)\n"));
+		free($2);
+	#endif
+	}
+	;
 %%
 
 /* parse helper routines could be here */
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 2ce898d7f031..6d80cce4cb50 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -840,7 +840,9 @@ log_reply_info(enum verbosity_value v, struct query_info *qinf,
 	{
 		log_info("%s - - - %s - - - ", clientip_buf, rcode_buf);
 	} else {
-		dname_str(qinf->qname, qname_buf);
+		if(qinf->qname)
+			dname_str(qinf->qname, qname_buf);
+		else	snprintf(qname_buf, sizeof(qname_buf), "null");
 		pktlen = sldns_buffer_limit(rmsg);
 		sldns_wire2str_type_buf(qinf->qtype, type_buf, sizeof(type_buf));
 		sldns_wire2str_class_buf(qinf->qclass, class_buf, sizeof(class_buf));
diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c
index 2797d1fe8449..81ef487c5877 100644
--- a/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@ -231,6 +231,9 @@ fptr_whitelist_hash_sizefunc(lruhash_sizefunc_type fptr)
 #ifdef CLIENT_SUBNET
 	else if(fptr == &msg_cache_sizefunc) return 1;
 #endif
+#ifdef USE_DNSCRYPT
+	else if(fptr == &dnsc_shared_secrets_sizefunc) return 1;
+#endif
 	return 0;
 }
 
@@ -244,6 +247,9 @@ fptr_whitelist_hash_compfunc(lruhash_compfunc_type fptr)
 	else if(fptr == &rate_compfunc) return 1;
 	else if(fptr == &ip_rate_compfunc) return 1;
 	else if(fptr == &test_slabhash_compfunc) return 1;
+#ifdef USE_DNSCRYPT
+	else if(fptr == &dnsc_shared_secrets_compfunc) return 1;
+#endif
 	return 0;
 }
 
@@ -257,6 +263,9 @@ fptr_whitelist_hash_delkeyfunc(lruhash_delkeyfunc_type fptr)
 	else if(fptr == &rate_delkeyfunc) return 1;
 	else if(fptr == &ip_rate_delkeyfunc) return 1;
 	else if(fptr == &test_slabhash_delkey) return 1;
+#ifdef USE_DNSCRYPT
+	else if(fptr == &dnsc_shared_secrets_delkeyfunc) return 1;
+#endif
 	return 0;
 }
 
@@ -272,6 +281,9 @@ fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_type fptr)
 #ifdef CLIENT_SUBNET
 	else if(fptr == &subnet_data_delete) return 1;
 #endif
+#ifdef USE_DNSCRYPT
+	else if(fptr == &dnsc_shared_secrets_deldatafunc) return 1;
+#endif
 	return 0;
 }
 
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index dba3e62270c6..58c69fd1c1a7 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -2696,7 +2696,6 @@
 3068,
 3069,
 3070,
-3071,
 3072,
 3073,
 3074,
@@ -4733,6 +4732,7 @@
 8003,
 8005,
 8006,
+8007,
 8008,
 8019,
 8020,
@@ -4744,6 +4744,7 @@
 8033,
 8034,
 8040,
+8041,
 8052,
 8053,
 8054,
diff --git a/util/net_help.c b/util/net_help.c
index 6c0d68e312b8..ce136a337cff 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -114,8 +114,9 @@ fd_set_block(int s)
 #elif defined(HAVE_IOCTLSOCKET)
 	unsigned long off = 0;
 	if(ioctlsocket(s, FIONBIO, &off) != 0) {
-		log_err("can't ioctlsocket FIONBIO off: %s", 
-			wsa_strerror(WSAGetLastError()));
+		if(WSAGetLastError() != WSAEINVAL || verbosity >= 4)
+			log_err("can't ioctlsocket FIONBIO off: %s", 
+				wsa_strerror(WSAGetLastError()));
 	}
 #endif	
 	return 1;
@@ -610,45 +611,66 @@ log_crypto_err(const char* str)
 #endif /* HAVE_SSL */
 }
 
-void* listen_sslctx_create(char* key, char* pem, char* verifypem)
+int
+listen_sslctx_setup(void* ctxt)
 {
 #ifdef HAVE_SSL
-	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
-	if(!ctx) {
-		log_crypto_err("could not SSL_CTX_new");
-		return NULL;
-	}
+	SSL_CTX* ctx = (SSL_CTX*)ctxt;
 	/* no SSLv2, SSLv3 because has defects */
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
 		!= SSL_OP_NO_SSLv2){
 		log_crypto_err("could not set SSL_OP_NO_SSLv2");
-		SSL_CTX_free(ctx);
-		return NULL;
+		return 0;
 	}
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
 		!= SSL_OP_NO_SSLv3){
 		log_crypto_err("could not set SSL_OP_NO_SSLv3");
-		SSL_CTX_free(ctx);
-		return NULL;
+		return 0;
 	}
-	if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
-		log_err("error for cert file: %s", pem);
-		log_crypto_err("error in SSL_CTX use_certificate_chain_file");
-		SSL_CTX_free(ctx);
-		return NULL;
+#if defined(SSL_OP_NO_TLSv1) && defined(SSL_OP_NO_TLSv1_1)
+	/* if we have tls 1.1 disable 1.0 */
+	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1)
+		!= SSL_OP_NO_TLSv1){
+		log_crypto_err("could not set SSL_OP_NO_TLSv1");
+		return 0;
 	}
-	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
-		log_err("error for private key file: %s", key);
-		log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
-		SSL_CTX_free(ctx);
-		return NULL;
+#endif
+#if defined(SSL_OP_NO_TLSv1_1) && defined(SSL_OP_NO_TLSv1_2)
+	/* if we have tls 1.2 disable 1.1 */
+	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1)
+		!= SSL_OP_NO_TLSv1_1){
+		log_crypto_err("could not set SSL_OP_NO_TLSv1_1");
+		return 0;
 	}
-	if(!SSL_CTX_check_private_key(ctx)) {
-		log_err("error for key file: %s", key);
-		log_crypto_err("Error in SSL_CTX check_private_key");
-		SSL_CTX_free(ctx);
-		return NULL;
+#endif
+#if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA)
+	/* if we have sha256, set the cipher list to have no known vulns */
+	if(!SSL_CTX_set_cipher_list(ctx, "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
+		log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
+#endif
+
+	if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
+		SSL_OP_CIPHER_SERVER_PREFERENCE) !=
+		SSL_OP_CIPHER_SERVER_PREFERENCE) {
+		log_crypto_err("could not set SSL_OP_CIPHER_SERVER_PREFERENCE");
+		return 0;
 	}
+
+#ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
+	SSL_CTX_set_security_level(ctx, 0);
+#endif
+#else
+	(void)ctxt;
+#endif /* HAVE_SSL */
+	return 1;
+}
+
+void
+listen_sslctx_setup_2(void* ctxt)
+{
+#ifdef HAVE_SSL
+	SSL_CTX* ctx = (SSL_CTX*)ctxt;
+	(void)ctx;
 #if HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
 	if(!SSL_CTX_set_ecdh_auto(ctx,1)) {
 		log_crypto_err("Error in SSL_CTX_ecdh_auto, not enabling ECDHE");
@@ -666,7 +688,42 @@ void* listen_sslctx_create(char* key, char* pem, char* verifypem)
 		}
 	}
 #endif
+#else
+	(void)ctxt;
+#endif /* HAVE_SSL */
+}
 
+void* listen_sslctx_create(char* key, char* pem, char* verifypem)
+{
+#ifdef HAVE_SSL
+	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
+	if(!ctx) {
+		log_crypto_err("could not SSL_CTX_new");
+		return NULL;
+	}
+	if(!listen_sslctx_setup(ctx)) {
+		SSL_CTX_free(ctx);
+		return NULL;
+	}
+	if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
+		log_err("error for cert file: %s", pem);
+		log_crypto_err("error in SSL_CTX use_certificate_chain_file");
+		SSL_CTX_free(ctx);
+		return NULL;
+	}
+	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
+		log_err("error for private key file: %s", key);
+		log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
+		SSL_CTX_free(ctx);
+		return NULL;
+	}
+	if(!SSL_CTX_check_private_key(ctx)) {
+		log_err("error for key file: %s", key);
+		log_crypto_err("Error in SSL_CTX check_private_key");
+		SSL_CTX_free(ctx);
+		return NULL;
+	}
+	listen_sslctx_setup_2(ctx);
 	if(verifypem && verifypem[0]) {
 		if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) {
 			log_crypto_err("Error in SSL_CTX verify locations");
diff --git a/util/net_help.h b/util/net_help.h
index 54f4c9c0e7cd..f0236e5335df 100644
--- a/util/net_help.h
+++ b/util/net_help.h
@@ -345,6 +345,19 @@ void sock_list_merge(struct sock_list** list, struct regional* region,
  */
 void log_crypto_err(const char* str);
 
+/**
+ * Set SSL_OP_NOxxx options on SSL context to disable bad crypto
+ * @param ctxt: SSL_CTX*
+ * @return false on failure.
+ */
+int listen_sslctx_setup(void* ctxt);
+
+/**
+ * Further setup of listening SSL context, after keys loaded.
+ * @param ctxt: SSL_CTX*
+ */
+void listen_sslctx_setup_2(void* ctxt);
+
 /** 
  * create SSL listen context
  * @param key: private key file.
diff --git a/util/netevent.c b/util/netevent.c
index 6990cdb36f36..771cb6bc7101 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -1551,6 +1551,13 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 		c->dnscrypt_buffer = sldns_buffer_new(sldns_buffer_capacity(c->buffer));
 		if(!c->dnscrypt_buffer) {
 			log_err("Could not allocate dnscrypt buffer");
+			reclaim_tcp_handler(c);
+			if(!c->tcp_do_close) {
+				fptr_ok(fptr_whitelist_comm_point(
+					c->callback));
+				(void)(*c->callback)(c, c->cb_arg, 
+					NETEVENT_CLOSED, NULL);
+			}
 			return;
 		}
 	}
diff --git a/util/shm_side/shm_main.c b/util/shm_side/shm_main.c
index bba2a8396333..c0757ed7cdef 100644
--- a/util/shm_side/shm_main.c
+++ b/util/shm_side/shm_main.c
@@ -249,6 +249,13 @@ void shm_main_run(struct worker *worker)
 
 		shm_stat->mem.msg = (long long)slabhash_get_mem(worker->env.msg_cache);
 		shm_stat->mem.rrset = (long long)slabhash_get_mem(&worker->env.rrset_cache->table);
+		shm_stat->mem.dnscrypt_shared_secret = 0;
+#ifdef USE_DNSCRYPT
+		if(worker->daemon->dnscenv) {
+			shm_stat->mem.dnscrypt_shared_secret = (long long)slabhash_get_mem(
+				worker->daemon->dnscenv->shared_secrets_cache);
+		}
+#endif
 		shm_stat->mem.val = (long long)mod_get_mem(&worker->env,
 			"validator");
 		shm_stat->mem.iter = (long long)mod_get_mem(&worker->env,
diff --git a/util/storage/lookup3.c b/util/storage/lookup3.c
index e9b05af37e31..cc110748156f 100644
--- a/util/storage/lookup3.c
+++ b/util/storage/lookup3.c
@@ -5,6 +5,7 @@
      added #ifdef VALGRIND to remove 298,384,660 'unused variable k8' warnings.
      added include of lookup3.h to check definitions match declarations.
      removed include of stdint - config.h takes care of platform independence.
+     added fallthrough comments for new gcc warning suppression.
   url http://burtleburtle.net/bob/hash/index.html.
 */
 /*
@@ -235,7 +236,9 @@ uint32_t        initval)         /* the previous hash, or an arbitrary value */
   switch(length)                     /* all the case statements fall through */
   { 
   case 3 : c+=k[2];
+  	/* fallthrough */
   case 2 : b+=k[1];
+  	/* fallthrough */
   case 1 : a+=k[0];
     final(a,b,c);
   case 0:     /* case 0: nothing left to add */
@@ -473,16 +476,27 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
     switch(length)                   /* all the case statements fall through */
     {
     case 12: c+=((uint32_t)k[11])<<24;
+  	/* fallthrough */
     case 11: c+=((uint32_t)k[10])<<16;
+  	/* fallthrough */
     case 10: c+=((uint32_t)k[9])<<8;
+  	/* fallthrough */
     case 9 : c+=k[8];
+  	/* fallthrough */
     case 8 : b+=((uint32_t)k[7])<<24;
+  	/* fallthrough */
     case 7 : b+=((uint32_t)k[6])<<16;
+  	/* fallthrough */
     case 6 : b+=((uint32_t)k[5])<<8;
+  	/* fallthrough */
     case 5 : b+=k[4];
+  	/* fallthrough */
     case 4 : a+=((uint32_t)k[3])<<24;
+  	/* fallthrough */
     case 3 : a+=((uint32_t)k[2])<<16;
+  	/* fallthrough */
     case 2 : a+=((uint32_t)k[1])<<8;
+  	/* fallthrough */
     case 1 : a+=k[0];
              break;
     case 0 : return c;
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 88d23472118f..e9ec5a5b5879 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -1320,6 +1320,9 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #include "ecdsa.h"
 #include "ecc-curve.h"
 #endif
+#ifdef HAVE_NETTLE_EDDSA_H
+#include "eddsa.h"
+#endif
 
 static int
 _digest_nettle(int algo, uint8_t* buf, size_t len,
@@ -1477,6 +1480,10 @@ dnskey_algo_id_is_supported(int id)
 	case LDNS_ECDSAP384SHA384:
 #endif
 		return 1;
+#ifdef USE_ED25519
+	case LDNS_ED25519:
+		return 1;
+#endif
 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
 	case LDNS_ECC_GOST:
 	default:
@@ -1718,6 +1725,30 @@ _verify_nettle_ecdsa(sldns_buffer* buf, unsigned int digest_size, unsigned char*
 }
 #endif
 
+#ifdef USE_ED25519
+static char *
+_verify_nettle_ed25519(sldns_buffer* buf, unsigned char* sigblock,
+	unsigned int sigblock_len, unsigned char* key, unsigned int keylen)
+{
+	int res = 0;
+
+	if(sigblock_len != ED25519_SIGNATURE_SIZE) {
+		return "wrong ED25519 signature length";
+	}
+	if(keylen != ED25519_KEY_SIZE) {
+		return "wrong ED25519 key length";
+	}
+
+	res = ed25519_sha512_verify((uint8_t*)key, sldns_buffer_limit(buf),
+		sldns_buffer_begin(buf), (uint8_t*)sigblock);
+
+	if (!res)
+		return "ED25519 signature verification failed";
+	else
+		return NULL;
+}
+#endif
+
 /**
  * Check a canonical sig+rrset and signature against a dnskey
  * @param buf: buffer with data to verify, the first rrsig part and the
@@ -1759,9 +1790,13 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	case LDNS_RSASHA1_NSEC3:
 		digest_size = (digest_size ? digest_size : SHA1_DIGEST_SIZE);
 #endif
+		/* double fallthrough annotation to please gcc parser */
+		/* fallthrough */
 #ifdef USE_SHA2
+		/* fallthrough */
 	case LDNS_RSASHA256:
 		digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
+		/* fallthrough */
 	case LDNS_RSASHA512:
 		digest_size = (digest_size ? digest_size : SHA512_DIGEST_SIZE);
 
@@ -1776,6 +1811,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #ifdef USE_ECDSA
 	case LDNS_ECDSAP256SHA256:
 		digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
+		/* fallthrough */
 	case LDNS_ECDSAP384SHA384:
 		digest_size = (digest_size ? digest_size : SHA384_DIGEST_SIZE);
 		*reason = _verify_nettle_ecdsa(buf, digest_size, sigblock,
@@ -1785,6 +1821,15 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		else
 			return sec_status_secure;
 #endif
+#ifdef USE_ED25519
+	case LDNS_ED25519:
+		*reason = _verify_nettle_ed25519(buf, sigblock, sigblock_len,
+			key, keylen);
+		if (*reason != NULL)
+			return sec_status_bogus;
+		else
+			return sec_status_secure;
+#endif
 	case LDNS_RSAMD5:
 	case LDNS_ECC_GOST:
 	default:
diff --git a/validator/val_utils.c b/validator/val_utils.c
index e4eff1b2523b..973473f9dc85 100644
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -932,17 +932,24 @@ val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 			 * Therefore the message is bogus.
 			 */
 
-			/* check if authority consists of only an NS record
+			/* check if authority has an NS record
 			 * which is bad, and there is an answer section with
 			 * data.  In that case, delete NS and additional to 
 			 * be lenient and make a minimal response */
-			if(rep->an_numrrsets != 0 && rep->ns_numrrsets == 1 &&
+			if(rep->an_numrrsets != 0 &&
 				ntohs(rep->rrsets[i]->rk.type) 
 				== LDNS_RR_TYPE_NS) {
 				verbose(VERB_ALGO, "truncate to minimal");
-				rep->ns_numrrsets = 0;
 				rep->ar_numrrsets = 0;
-				rep->rrset_count = rep->an_numrrsets;
+				rep->rrset_count = rep->an_numrrsets +
+					rep->ns_numrrsets;
+				/* remove this unneeded authority rrset */
+				memmove(rep->rrsets+i, rep->rrsets+i+1, 
+					sizeof(struct ub_packed_rrset_key*)*
+					(rep->rrset_count - i - 1));
+				rep->ns_numrrsets--;
+				rep->rrset_count--;
+				i--;
 				return;
 			}