From: Ralph Dolmans <ralph@nlnetlabs.nl>
Date: Wed, 15 Jan 2020 22:44:10 +0000 (+0100)
Subject: Merge branch 'master' of github.com:NLnetLabs/unbound into rpz
X-Git-Tag: release-1.10.0rc1~28^2~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9877e521610233b1a01dfa7a0aba51c2d88638d7;p=thirdparty%2Funbound.git

Merge branch 'master' of github.com:NLnetLabs/unbound into rpz
---

9877e521610233b1a01dfa7a0aba51c2d88638d7
diff --cc .gitignore
index 43ab4c6fb,22fedf0d7..084116535
--- a/.gitignore
+++ b/.gitignore
@@@ -1,7 -1,7 +1,8 @@@
  *.lo
  *.o
 +cscope.out
  /.libs/
+ /.source
  /Makefile
  /autom4te.cache/
  /config.h
diff --cc Makefile.in
index 19ff02330,1a2e2c548..e81131468
--- a/Makefile.in
+++ b/Makefile.in
@@@ -676,11 -681,11 +682,14 @@@ msgparse.lo msgparse.o: $(srcdir)/util/
  msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
   $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
 - $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
 - $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 +  $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
 + $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 + $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/module.h \
 + $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
++ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
++ $(srcdir)/respip/respip.h
  packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
@@@ -694,11 -699,11 +703,12 @@@ iterator.lo iterator.o: $(srcdir)/itera
   $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h $(srcdir)/iterator/iter_priv.h \
   $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
   $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h \
 - $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
 +  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
 + $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
-  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
   $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
 - $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
 + $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h
  iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
   $(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
@@@ -740,95 -745,89 +750,107 @@@ iter_utils.lo iter_utils.o: $(srcdir)/i
   $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
   $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h \
   $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/dns.h \
 - $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h \
 - $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
 +  $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
 + $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
-  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/validator/val_anchor.h \
-  $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_utils.h \
-  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
++ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
++ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
++ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+  $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
 - $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/sldns/str2wire.h
++ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/str2wire.h
  listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
   $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 - $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
 - $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/mesh.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 +  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
 +  $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
 + $(srcdir)/sldns/sbuffer.h $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
   $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
-- $(srcdir)/services/modstack.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
++ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
++ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
  localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
   $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
   $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
   $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
   $(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/as112.h
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/as112.h
  mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
-  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/outbound_list.h \
-  $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
-  $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
-  $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/util/edns.h $(srcdir)/sldns/sbuffer.h \
-  $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/services/view.h $(srcdir)/util/data/dname.h $(srcdir)/respip/respip.h \
++ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
++ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+  $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h \
 - $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/util/edns.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
 - $(srcdir)/services/view.h $(srcdir)/util/data/dname.h $(srcdir)/respip/respip.h \
++ $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
++ $(srcdir)/util/alloc.h $(srcdir)/util/edns.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/data/dname.h \
   $(srcdir)/services/listen_dnsport.h
  modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
   $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
   $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
 - $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
 - $(srcdir)/validator/val_utils.h $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
 - $(srcdir)/ipset/ipset.h
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
-  $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
-  $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/services/view.h $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h \
-  $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
-  $(srcdir)/ipset/ipset.h $(srcdir)/sldns/sbuffer.h
++ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
++ $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h
  view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
   $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h
 + $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h
 +rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
 + $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
 + $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
 + $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-   $(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h \
++  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h \
++ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h \
 + $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h
  outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
   $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h 
 + 
  outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
   $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/locks.h $(srcdir)/util/log.h  $(srcdir)/services/listen_dnsport.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/dnstree.h \
 - $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h \
 - $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/dnstap/dnstap.h \
 - 
 + $(srcdir)/dnscrypt/dnscrypt.h   \
 + $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h \
 + $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/iterator/iterator.h \
 + $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
 + $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h
++ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
++ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
++ $(srcdir)/dnstap/dnstap.h
  alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
   $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 +  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
++ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
++ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
   $(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h util/configparser.h \
   $(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
 - $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
 + $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
-  $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
-  $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
-  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/edns-subnet/edns-subnet.h \
-  $(srcdir)/util/iana_ports.inc
++ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
++ $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
+  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/iana_ports.inc
  configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
   $(srcdir)/util/config_file.h util/configparser.h
  configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@@ -838,58 -837,58 +860,68 @@@ shm_main.lo shm_main.o: $(srcdir)/util/
   $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
    $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
   $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
   $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/services/mesh.h \
-- $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
-- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
-- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/config_file.h \
-- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
++ $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
++ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
++ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
++ $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/fptr_wlist.h \
++ $(srcdir)/util/tube.h
  authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \
   $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h \
 - $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/random.h \
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
 + $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
 + $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
   $(srcdir)/services/cache/dns.h $(srcdir)/services/outside_network.h  \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
 - $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
 - $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_secalgo.h
 + $(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
 + $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h $(srcdir)/validator/val_nsec3.h \
 + $(srcdir)/validator/val_secalgo.h
  fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
 - $(srcdir)/services/outside_network.h  $(srcdir)/services/localzone.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
 - $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
 - $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
 - $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
 - $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
 - $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/respip/respip.h \
 - $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
 - $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/outside_network.h  $(srcdir)/services/localzone.h \
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
 + $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
-  $(srcdir)/services/authzone.h $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h \
-  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
-  $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
-  $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
-  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
-  $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
-  $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
-  $(srcdir)/libunbound/worker.h $(srcdir)/respip/respip.h $(PYTHONMOD_HEADER) \
-  $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
-  $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
++ $(srcdir)/services/outside_network.h  $(srcdir)/services/cache/infra.h \
++ $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
++ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
++ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
++ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
++ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
++ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound-event.h \
++ $(srcdir)/libunbound/worker.h
  locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
  log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
--mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h
++mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
++ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
++  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
++ $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
++ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
++ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
++ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
   $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
  netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 - $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/tcp_conn_limit.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/fptr_wlist.h \
 - $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
 - $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
 - $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/dnstap/dnstap.h  \
 - $(srcdir)/services/listen_dnsport.h \
 - 
 +  $(srcdir)/util/ub_event.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 + $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h \
 + $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/dnstap/dnstap.h \
-   $(srcdir)/services/listen_dnsport.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \
++ $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h
  net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
   $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
@@@ -898,10 -898,10 +930,13 @@@
  random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
  rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  regional.lo regional.o: $(srcdir)/util/regional.c config.h $(srcdir)/util/log.h $(srcdir)/util/regional.h
  rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/iterator/iterator.h \
   $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
@@@ -918,10 -918,10 +953,13 @@@ dnstree.lo dnstree.o: $(srcdir)/util/st
  lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/storage/lookup3.h
  lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
  tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(srcdir)/util/regional.h \
@@@ -933,22 -933,22 +971,26 @@@
  timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehist.h $(srcdir)/util/log.h
  tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h \
 - $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
 + $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/ub_event.h
  ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
-  $(srcdir)/util/tube.h \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/tube.h \
-- 
++ $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
  ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
   $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 - $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
 - $(srcdir)/services/modstack.h \
 - 
 +  $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/modstack.h \
-  
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
  winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
  autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
   $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@@ -957,9 -957,10 +999,11 @@@
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
   $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/services/mesh.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
-  $(srcdir)/services/modstack.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
-  $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
-  $(srcdir)/sldns/keyraw.h
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/services/modstack.h $(srcdir)/services/cache/rrset.h \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
 - 
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
++ $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
++ $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h
  val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
   $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h \
@@@ -976,8 -977,8 +1020,11 @@@ validator.lo validator.o: $(srcdir)/val
   $(srcdir)/validator/autotrust.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
   $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
   $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
 - $(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 +  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
++ $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
  val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
@@@ -1032,21 -1037,11 +1079,13 @@@ dns64.lo dns64.o: $(srcdir)/dns64/dns64
   $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
 - $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
 + $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
-  $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/data/dname.h \
-  $(srcdir)/sldns/str2wire.h
- edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h \
-  $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
- subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h $(srcdir)/edns-subnet/subnetmod.h \
-  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
-  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
-  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
-  $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h \
-  $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/edns-subnet/subnet-whitelist.h \
-  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
-  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/modstack.h \
-  $(srcdir)/services/cache/dns.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h \
-  $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h
++ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
++ $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
+ edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h
+ subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h
  addrtree.lo addrtree.o: $(srcdir)/edns-subnet/addrtree.c config.h $(srcdir)/util/log.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
@@@ -1062,38 -1053,36 +1097,16 @@@ respip.lo respip.o: $(srcdir)/respip/re
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
   $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h \
-  $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/config_file.h \
 - $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/config_file.h \
-- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-   $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-- $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/respip/respip.h
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
++ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/modstack.h \
++ $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/dns.h \
++ $(srcdir)/sldns/str2wire.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
++ $(srcdir)/util/regional.h
  checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/testcode/checklocks.h
--dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
-- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
-  $(srcdir)/dnscrypt/dnscrypt.h  \
-  $(srcdir)/dnstap/dnstap.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/locks.h $(srcdir)/dnstap/dnstap.h \
-- dnstap/dnstap.pb-c.h
--dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h \
-- 
- ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h $(srcdir)/ipsecmod/ipsecmod.h \
-  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
-  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
-  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h \
-  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
-  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
-  $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/wire2str.h
- ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
-  $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
-  $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
-  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
-  $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
- ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h $(srcdir)/util/module.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
-  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
-  $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
-  $(srcdir)/services/cache/dns.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
 -dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/storage/lookup3.h
+ ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h
 -ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
 - $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
 - $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
 - $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
 -ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h $(srcdir)/util/module.h \
 - $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
 - $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h \
 - $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
++ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h
  unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
   $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
@@@ -1141,21 -1131,15 +1154,17 @@@ testpkts.lo testpkts.o: $(srcdir)/testc
   $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
  unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
   $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
- unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgreply.h \
-  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
-  $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/edns-subnet/addrtree.h \
-  $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
-  $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/edns-subnet.h
+ unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h
  unitauth.lo unitauth.o: $(srcdir)/testcode/unitauth.c config.h $(srcdir)/services/authzone.h \
   $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/services/modstack.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h \
 - $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
 + $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/testcode/unitmain.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/testcode/unitmain.h \
 + $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h \
 + $(srcdir)/sldns/wire2str.h
  acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
   $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
   $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
@@@ -1175,33 -1160,34 +1184,33 @@@ cachedump.lo cachedump.o: $(srcdir)/dae
   $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
   $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
   $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 -daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
 - $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
 -   $(srcdir)/daemon/worker.h \
 +daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
 + $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
 +  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
 + $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
 + $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 + $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
 + $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
 + $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
 + $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
 + $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/rpz.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h \
-  $(srcdir)/respip/respip.h
++ $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
++ $(srcdir)/sldns/keyraw.h
 +remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h \
   $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 - $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
 - $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
 - $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 - $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
 - $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
 -remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
 - $(srcdir)/daemon/remote.h \
 - $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 - $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 - $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 -  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
 - $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
 - $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
 + $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/alloc.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 + $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
 + $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
 + $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
 + $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
-  $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/services/rpz.h $(srcdir)/util/fptr_wlist.h \
-  $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
++ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
++ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
+  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h \
   $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
   $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
   $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h \
@@@ -1211,55 -1197,56 +1220,59 @@@ stats.lo stats.o: $(srcdir)/daemon/stat
   $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 -  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
 - $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
 - $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h \
 - 
 + $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
 + $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h \
-  $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
++ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
++ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
++ $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/tube.h \
++ $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
 + $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
-  $(srcdir)/services/view.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
-  $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/addrtree.h \
-  $(srcdir)/edns-subnet/edns-subnet.h \
++ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
++ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
  unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
   $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
 -  $(srcdir)/daemon/remote.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 +  $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \
 + $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
 + $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
 + $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
-  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
++ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
++ $(srcdir)/util/ub_event.h
  worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
   $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 - $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 -  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
 - $(srcdir)/daemon/remote.h \
 - $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
 - $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
 - $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
 - $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
 - $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
 - $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
 + $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 + $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
 + $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
 + $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
 + $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
 + $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
 + $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 + $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
-  $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
-  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
-  $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
-  $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
++ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
++ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
++ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
++ $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
   $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
  testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
   $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 - $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/daemon/remote.h \
 - $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \
 - $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
 - $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
 - $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 +  $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
 + $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c \
 + $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
 +  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
 + $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
 + $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
++ $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
  testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
   $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
   $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
@@@ -1267,75 -1254,77 +1280,79 @@@ worker.lo worker.o: $(srcdir)/daemon/wo
   $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 - $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 -  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
 - $(srcdir)/daemon/remote.h \
 - $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
 - $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
 - $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
 - $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
 - $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
 - $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
 + $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 + $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
 + $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
 + $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
 + $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
 + $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
 + $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 + $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
-  $(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
-  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
-  $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
-  $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
++ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
++ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
++ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
++ $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
   $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
  acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
   $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
   $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
   $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
 -daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
 - $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
 -   $(srcdir)/daemon/worker.h \
 - $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 - $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
 - $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
 - $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
 - $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
 - $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 - $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
 - $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
 +daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
 + $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
 +  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
 + $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
 + $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 + $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
 + $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
 + $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
 + $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
 + $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/rpz.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h \
-  $(srcdir)/respip/respip.h
++ $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
++ $(srcdir)/sldns/keyraw.h
  stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
   $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h \
 - $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
 -  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
 - $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/outside_network.h \
 - $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
 - $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/iterator/iterator.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
 - $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h \
 - 
 + $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 + $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
 + $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
-  $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h \
-  $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
++ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
++ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
++ $(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/tube.h \
++ $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
 + $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
-  $(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
-  $(srcdir)/services/view.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h \
-  $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/addrtree.h \
-  $(srcdir)/edns-subnet/edns-subnet.h
++ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
++ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
  replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
   $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
 - $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h \
 - $(srcdir)/sldns/rrdef.h
 +  $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
 + $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
  fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
   $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
 - $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h \
 - $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h  \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
 - $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h \
 - $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 + $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
 + $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
 + $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
 + $(srcdir)/util/rbtree.h  $(srcdir)/services/cache/infra.h \
 + $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
 + $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
++ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
  lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
   $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 +  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/modstack.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
   $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
@@@ -1344,10 -1333,10 +1361,13 @@@ readhex.lo readhex.o: $(srcdir)/testcod
   $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
  memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
   $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 - $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
 +  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
 + $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
 + $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/modstack.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
++ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
   $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
   $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
@@@ -1355,29 -1344,27 +1375,31 @@@
   $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
   $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
   $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
 - $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
 - $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 - $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h
 + $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
-  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h \
-  $(srcdir)/sldns/sbuffer.h $(PYTHONMOD_HEADER) \
-  $(srcdir)/edns-subnet/subnet-whitelist.h
++ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
++ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
  worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
   $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
   $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
 - $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
 +  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
 + $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
-  $(srcdir)/services/mesh.h
++ $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
++ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
  context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
   $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
   $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
   $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
 - $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h \
 - $(srcdir)/services/mesh.h $(srcdir)/sldns/sbuffer.h
 + $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
-  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h
++ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
++ $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
  libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
   $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
   $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@@ -1386,26 -1373,28 +1408,27 @@@
   $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
   $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
   $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
 - $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
 -  $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/rrset.h \
 + $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
 + $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/cache/rrset.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
-  $(srcdir)/services/rpz.h
 - $(srcdir)/sldns/sbuffer.h
 -libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
 - $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
 - $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
 - $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
 - $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h \
 - $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 - $(srcdir)/dnscrypt/cert.h  $(srcdir)/services/mesh.h \
 - $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
 - $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
 - $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
 - $(srcdir)/services/outbound_list.h $(srcdir)/services/authzone.h $(srcdir)/util/fptr_wlist.h \
 - $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
++ $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
 +libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 + $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
 + $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h \
 + $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h \
 + $(srcdir)/dnscrypt/dnscrypt.h   \
 + $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
-  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h \
-  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h \
-  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/services/authzone.h \
-  $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
-  $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
-  $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
-  $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/str2wire.h
++ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
++ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h \
++ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
++ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
+  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
+  $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+  $(srcdir)/sldns/str2wire.h
  unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
 - 
 + $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
  asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
   $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
   $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
@@@ -1421,13 -1412,15 +1444,18 @@@ perf.lo perf.o: $(srcdir)/testcode/perf
   $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
  delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
   $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
 -unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
 - $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
 - $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h \
 - $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h
 +unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h $(srcdir)/util/log.h \
 + $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h $(srcdir)/util/shm_side/shm_main.h \
 + $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h \
-  $(srcdir)/sldns/pkthdr.h
++ $(srcdir)/sldns/pkthdr.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
++ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
++ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
++ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
++ $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
++  $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h
  unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
 - $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
 - 
 -petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
 - 
 + $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
 +petal.lo petal.o: $(srcdir)/testcode/petal.c config.h
  pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
   $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
@@@ -1455,7 -1450,8 +1483,8 @@@ keyraw.lo keyraw.o: $(srcdir)/sldns/key
  sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
  wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
   $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
-  $(srcdir)/sldns/keyraw.h
 - $(srcdir)/sldns/keyraw.h \
 - $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
++ $(srcdir)/sldns/keyraw.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
++ $(srcdir)/util/log.h
  parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
   $(srcdir)/sldns/sbuffer.h
  parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
@@@ -1475,9 -1471,12 +1504,9 @@@ snprintf.lo snprintf.o: $(srcdir)/compa
  strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
  strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
  strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
 -getentropy_freebsd.lo getentropy_freebsd.o: $(srcdir)/compat/getentropy_freebsd.c
 -getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
 - 
 +getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
- getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c config.h
+ getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c
 -getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h \
 - 
 +getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
  getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
  explicit_bzero.lo explicit_bzero.o: $(srcdir)/compat/explicit_bzero.c config.h
  arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/compat/chacha_private.h
diff --cc respip/respip.c
index e9baa6292,632a9df64..5f4ddf2ae
--- a/respip/respip.c
+++ b/respip/respip.c
@@@ -1280,23 -1186,7 +1286,23 @@@ respip_inform_print(struct respip_actio
  	addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
  	addr_to_str(&respip_addr->addr, respip_addr->addrlen,
  		respip, sizeof(respip));
 -	snprintf(txt, sizeof(txt), "%s/%d inform %s@%u", respip,
 -		respip_addr->net, srcip, port);
 +	if(respip_actinfo->rpz_log) {
 +		txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
 +			"RPZ applied ");
 +		if(respip_actinfo->rpz_cname_override)
 +			actionstr = rpz_action_to_string(
 +				RPZ_CNAME_OVERRIDE_ACTION);
 +		else
 +			actionstr = rpz_action_to_string(
 +				respip_action_to_rpz_action(
 +					respip_actinfo->action));
 +	}
 +	if(respip_actinfo->log_name) {
 +		txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen,
 +			"[%s] ", respip_actinfo->log_name);
 +	}
 +	snprintf(txt+txtlen, sizeof(txt)-txtlen,
 +		"%s/%d %s %s@%u", respip, respip_addr->net,
 +		(actionstr) ? actionstr : "inform", srcip, port);
- 	log_nametypeclass(0, txt, qname, qtype, qclass);
+ 	log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
  }
diff --cc services/rpz.c
index 6622606d3,000000000..97c2cff5c
mode 100644,000000..100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@@ -1,1002 -1,0 +1,1003 @@@
 +/*
 + * services/rpz.c - rpz service
 + *
 + * Copyright (c) 2019, NLnet Labs. All rights reserved.
 + *
 + * This software is open source.
 + * 
 + * Redistribution and use in source and binary forms, with or without
 + * modification, are permitted provided that the following conditions
 + * are met:
 + * 
 + * Redistributions of source code must retain the above copyright notice,
 + * this list of conditions and the following disclaimer.
 + * 
 + * Redistributions in binary form must reproduce the above copyright notice,
 + * this list of conditions and the following disclaimer in the documentation
 + * and/or other materials provided with the distribution.
 + * 
 + * Neither the name of the NLNET LABS nor the names of its contributors may
 + * be used to endorse or promote products derived from this software without
 + * specific prior written permission.
 + * 
 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
 + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 + */
 +
 +/**
 + * \file
 + *
 + * This file contains functions to enable RPZ service.
 + */
 +
 +#include "config.h"
 +#include "services/rpz.h"
 +#include "util/config_file.h"
 +#include "sldns/wire2str.h"
 +#include "sldns/str2wire.h"
 +#include "util/data/dname.h"
 +#include "util/net_help.h"
 +#include "util/log.h"
 +#include "util/data/dname.h"
 +#include "util/locks.h"
 +#include "util/regional.h"
 +
 +/** string for RPZ action enum */
 +const char*
 +rpz_action_to_string(enum rpz_action a)
 +{
 +	switch(a) {
 +	case RPZ_NXDOMAIN_ACTION:	return "nxdomain";
 +	case RPZ_NODATA_ACTION:		return "nodata";
 +	case RPZ_PASSTHRU_ACTION:	return "passthru";
 +	case RPZ_DROP_ACTION:		return "drop";
 +	case RPZ_TCP_ONLY_ACTION:	return "tcp_only";
 +	case RPZ_INVALID_ACTION:	return "invalid";
 +	case RPZ_LOCAL_DATA_ACTION:	return "local_data";
 +	case RPZ_DISABLED_ACTION:	return "disabled";
 +	case RPZ_CNAME_OVERRIDE_ACTION:	return "cname_override";
 +	case RPZ_NO_OVERRIDE_ACTION:	return "no_override";
 +	}
 +	return "unknown";
 +}
 +
 +/** RPZ action enum for config string */
 +static enum rpz_action
 +rpz_config_to_action(char* a)
 +{
 +	if(strcmp(a, "nxdomain") == 0)
 +		return RPZ_NXDOMAIN_ACTION;
 +	else if(strcmp(a, "nodata") == 0)
 +		return RPZ_NODATA_ACTION;
 +	else if(strcmp(a, "passthru") == 0)
 +		return RPZ_PASSTHRU_ACTION;
 +	else if(strcmp(a, "drop") == 0)
 +		return RPZ_DROP_ACTION;
 +	else if(strcmp(a, "tcp_only") == 0)
 +		return RPZ_TCP_ONLY_ACTION;
 +	else if(strcmp(a, "cname") == 0)
 +		return RPZ_CNAME_OVERRIDE_ACTION;
 +	else if(strcmp(a, "disabled") == 0)
 +		return RPZ_DISABLED_ACTION;
 +	return RPZ_INVALID_ACTION;
 +}
 +
 +/** string for RPZ trigger enum */
 +static const char*
 +rpz_trigger_to_string(enum rpz_trigger r)
 +{
 +	switch(r) {
 +	case RPZ_QNAME_TRIGGER:		return "qname";
 +	case RPZ_CLIENT_IP_TRIGGER:	return "client_ip";
 +	case RPZ_RESPONSE_IP_TRIGGER:	return "response_ip";
 +	case RPZ_NSDNAME_TRIGGER:	return "nsdname";
 +	case RPZ_NSIP_TRIGGER:		return "nsip";
 +	case RPZ_INVALID_TRIGGER:	return "invalid";
 +	}
 +	return "unknown";
 +}
 +
 +/**
 + * Get the label that is just before the root label.
 + * @param dname: dname to work on
 + * @param maxdnamelen: maximum length of the dname
 + * @return: pointer to TLD label, NULL if not found or invalid dname
 + */
 +static uint8_t*
 +get_tld_label(uint8_t* dname, size_t maxdnamelen)
 +{
 +	uint8_t* prevlab = dname;
 +	size_t dnamelen = 0;
 +
 +	/* only root label */
 +	if(*dname == 0)
 +		return NULL;
 +
 +	while(*dname) {
 +		dnamelen += ((size_t)*dname)+1;
 +		if(dnamelen > maxdnamelen)
 +			return NULL;
 +		dname = dname+((size_t)*dname)+1;
 +		if(*dname != 0)
 +			prevlab = dname;
 +	}
 +	return prevlab;
 +}
 +
 +/**
 + * Classify RPZ action for RR type/rdata
 + * @param rr_type: the RR type
 + * @param rdatawl: RDATA with 2 bytes length
 + * @param rdatalen: the length of rdatawl (including its 2 bytes length)
 + * @return: the RPZ action
 + */
 +static enum rpz_action
 +rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 +{
 +	char* endptr;
 +	uint8_t* rdata;
 +	int rdatalabs;
 +	uint8_t* tldlab = NULL;
 +
 +	switch(rr_type) {
 +		case LDNS_RR_TYPE_SOA:
 +		case LDNS_RR_TYPE_NS:
 +		case LDNS_RR_TYPE_DNAME:
 +		/* all DNSSEC-related RRs must be ignored */
 +		case LDNS_RR_TYPE_DNSKEY:
 +		case LDNS_RR_TYPE_DS:
 +		case LDNS_RR_TYPE_RRSIG:
 +		case LDNS_RR_TYPE_NSEC:
 +		case LDNS_RR_TYPE_NSEC3:
 +			return RPZ_INVALID_ACTION;
 +		case LDNS_RR_TYPE_CNAME:
 +			break;
 +		default:
 +			return RPZ_LOCAL_DATA_ACTION;
 +	}
 +
 +	/* use CNAME target to determine RPZ action */
 +	log_assert(rr_type == LDNS_RR_TYPE_CNAME);
 +	if(rdatalen < 3)
 +		return RPZ_INVALID_ACTION;
 +
 +	rdata = rdatawl + 2; /* 2 bytes of rdata length */
 +	if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
 +		return RPZ_INVALID_ACTION;
 +
 +	rdatalabs = dname_count_labels(rdata);
 +	if(rdatalabs == 1)
 +		return RPZ_NXDOMAIN_ACTION;
 +	else if(rdatalabs == 2) {
 +		if(dname_subdomain_c(rdata, (uint8_t*)&"\001*\000"))
 +			return RPZ_NODATA_ACTION;
 +		else if(dname_subdomain_c(rdata,
 +			(uint8_t*)&"\014rpz-passthru\000"))
 +			return RPZ_PASSTHRU_ACTION;
 +		else if(dname_subdomain_c(rdata, (uint8_t*)&"\010rpz-drop\000"))
 +			return RPZ_DROP_ACTION;
 +		else if(dname_subdomain_c(rdata,
 +			(uint8_t*)&"\014rpz-tcp-only\000"))
 +			return RPZ_TCP_ONLY_ACTION;
 +	}
 +
 +	/* all other TLDs starting with "rpz-" are invalid */
 +	tldlab = get_tld_label(rdata, rdatalen-2);
 +	if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
 +		return RPZ_INVALID_ACTION;
 +
 +	/* no special label found */
 +	return RPZ_LOCAL_DATA_ACTION;
 +}
 +
 +static enum localzone_type 
 +rpz_action_to_localzone_type(enum rpz_action a)
 +{
 +	switch(a) {
 +	case RPZ_NXDOMAIN_ACTION:	return local_zone_always_nxdomain;
 +	case RPZ_NODATA_ACTION:		return local_zone_always_nodata;
 +	case RPZ_DROP_ACTION:		return local_zone_always_deny;
 +	case RPZ_PASSTHRU_ACTION:	return local_zone_always_transparent;
 +	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
 +	case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 +	case RPZ_INVALID_ACTION: 	/* fallthrough */
 +	case RPZ_TCP_ONLY_ACTION:	/* fallthrough */
 +	default:			return local_zone_invalid;
 +	}
 +}
 +
 +enum respip_action
 +rpz_action_to_respip_action(enum rpz_action a)
 +{
 +	switch(a) {
 +	case RPZ_NXDOMAIN_ACTION:	return respip_always_nxdomain;
 +	case RPZ_NODATA_ACTION:		return respip_always_nodata;
 +	case RPZ_DROP_ACTION:		return respip_always_deny;
 +	case RPZ_PASSTHRU_ACTION:	return respip_always_transparent;
 +	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
 +	case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 +	case RPZ_INVALID_ACTION:	/* fallthrough */
 +	case RPZ_TCP_ONLY_ACTION:	/* fallthrough */
 +	default:			return respip_invalid;
 +	}
 +}
 +
 +static enum rpz_action
 +localzone_type_to_rpz_action(enum localzone_type lzt)
 +{
 +	switch(lzt) {
 +	case local_zone_always_nxdomain:	return RPZ_NXDOMAIN_ACTION;
 +	case local_zone_always_nodata:		return RPZ_NODATA_ACTION;
 +	case local_zone_always_deny:		return RPZ_DROP_ACTION;
 +	case local_zone_always_transparent:	return RPZ_PASSTHRU_ACTION;
 +	case local_zone_redirect:		return RPZ_LOCAL_DATA_ACTION;
 +	case local_zone_invalid:
 +	default:
 +		return RPZ_INVALID_ACTION;
 +	}
 +}
 +
 +enum rpz_action
 +respip_action_to_rpz_action(enum respip_action a)
 +{
 +	switch(a) {
 +	case respip_always_nxdomain:	return RPZ_NXDOMAIN_ACTION;
 +	case respip_always_nodata:	return RPZ_NODATA_ACTION;
 +	case respip_always_deny:	return RPZ_DROP_ACTION;
 +	case respip_always_transparent:	return RPZ_PASSTHRU_ACTION;
 +	case respip_redirect:		return RPZ_LOCAL_DATA_ACTION;
 +	case respip_invalid:
 +	default:
 +		return RPZ_INVALID_ACTION;
 +	}
 +}
 +
 +/**
 + * Get RPZ trigger for dname
 + * @param dname: dname containing RPZ trigger
 + * @param dname_len: length of the dname
 + * @return: RPZ trigger enum
 + */
 +static enum rpz_trigger
 +rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
 +{
 +	uint8_t* tldlab;
 +	char* endptr;
 +
 +	if(dname_valid(dname, dname_len) != dname_len)
 +		return RPZ_INVALID_TRIGGER;
 +
 +	tldlab = get_tld_label(dname, dname_len);
 +	if(!tldlab || !dname_lab_startswith(tldlab, "rpz-", &endptr))
 +		return RPZ_QNAME_TRIGGER;
 +
 +	if(dname_subdomain_c(tldlab,
 +		(uint8_t*)&"\015rpz-client-ip\000"))
 +		return RPZ_CLIENT_IP_TRIGGER;
 +	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\006rpz-ip\000"))
 +		return RPZ_RESPONSE_IP_TRIGGER;
 +	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\013rpz-nsdname\000"))
 +		return RPZ_NSDNAME_TRIGGER;
 +	else if(dname_subdomain_c(tldlab, (uint8_t*)&"\010rpz-nsip\000"))
 +		return RPZ_NSIP_TRIGGER;
 +
 +	return RPZ_QNAME_TRIGGER;
 +}
 +
 +void rpz_delete(struct rpz* r)
 +{
 +	if(!r)
 +		return;
 +	local_zones_delete(r->local_zones);
 +	respip_set_delete(r->respip_set);
 +	regional_destroy(r->region);
 +	free(r->taglist);
 +	free(r->log_name);
 +	free(r);
 +}
 +
 +int
 +rpz_clear(struct rpz* r)
 +{
 +	/* must hold write lock on auth_zone */
 +	local_zones_delete(r->local_zones);
 +	respip_set_delete(r->respip_set);
 +	if(!(r->local_zones = local_zones_create())){
 +		return 0;
 +	}
 +	if(!(r->respip_set = respip_set_create())) {
 +		return 0;
 +	}
 +	return 1;
 +}
 +
 +void
 +rpz_finish_config(struct rpz* r)
 +{
 +	lock_rw_wrlock(&r->respip_set->lock);
 +	addr_tree_init_parents(&r->respip_set->ip_tree);
 +	lock_rw_unlock(&r->respip_set->lock);
 +}
 +
 +/** new rrset containing CNAME override, does not yet contain a dname */
 +static struct ub_packed_rrset_key*
 +new_cname_override(struct regional* region, uint8_t* ct, size_t ctlen)
 +{
 +	struct ub_packed_rrset_key* rrset;
 +	struct packed_rrset_data* pd;
 +	uint16_t rdlength = htons(ctlen);
 +	rrset = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
 +		sizeof(*rrset));
 +	if(!rrset) {
 +		log_err("out of memory");
 +		return NULL;
 +	}
 +	rrset->entry.key = rrset;
 +	pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
 +	if(!pd) {
 +		log_err("out of memory");
 +		return NULL;
 +	}
 +	pd->trust = rrset_trust_prim_noglue;
 +	pd->security = sec_status_insecure;
 +
 +	pd->count = 1;
 +	pd->rr_len = regional_alloc_zero(region, sizeof(*pd->rr_len));
 +	pd->rr_ttl = regional_alloc_zero(region, sizeof(*pd->rr_ttl));
 +	pd->rr_data = regional_alloc_zero(region, sizeof(*pd->rr_data));
 +	if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
 +		log_err("out of memory");
 +		return NULL;
 +	}
 +	pd->rr_len[0] = ctlen+2;
 +	pd->rr_ttl[0] = 3600;
 +	pd->rr_data[0] = regional_alloc_zero(region, 2 /* rdlength */ + ctlen);
 +	if(!pd->rr_data[0]) {
 +		log_err("out of memory");
 +		return NULL;
 +	}
 +	memmove(pd->rr_data[0], &rdlength, 2);
 +	memmove(pd->rr_data[0]+2, ct, ctlen);
 +
 +	rrset->entry.data = pd;
 +	rrset->rk.type = htons(LDNS_RR_TYPE_CNAME);
 +	rrset->rk.rrset_class = htons(LDNS_RR_CLASS_IN);
 +	return rrset;
 +}
 +
 +struct rpz*
 +rpz_create(struct config_auth* p)
 +{
 +	struct rpz* r = calloc(1, sizeof(*r));
 +	if(!r)
 +		goto err;
 +
 +	r->region = regional_create_custom(sizeof(struct regional));
 +	if(!r->region) {
 +		goto err;
 +	}
 +
 +	if(!(r->local_zones = local_zones_create())){
 +		goto err;
 +	}
 +	if(!(r->respip_set = respip_set_create())) {
 +		goto err;
 +	}
 +	r->taglistlen = p->rpz_taglistlen;
 +	r->taglist = memdup(p->rpz_taglist, r->taglistlen);
 +	if(p->rpz_action_override) {
 +		r->action_override = rpz_config_to_action(p->rpz_action_override);
 +	}
 +	else
 +		r->action_override = RPZ_NO_OVERRIDE_ACTION;
 +
 +	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 +		uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 +		size_t nmlen = sizeof(nm);
 +
 +		if(!p->rpz_cname) {
 +			log_err("RPZ override with cname action found, but no "
 +				"rpz-cname-override configured");
 +			goto err;
 +		}
 +
 +		if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
 +			log_err("cannot parse RPZ cname override: %s",
 +				p->rpz_cname);
 +			goto err;
 +		}
 +		r->cname_override = new_cname_override(r->region, nm, nmlen);
 +		if(!r->cname_override) {
 +			goto err;
 +		}
 +	}
 +	r->log = p->rpz_log;
 +	if(p->rpz_log_name) {
- 		if(!(r->log_name = strdup(p->rpz_log_name)))
++		if(!(r->log_name = strdup(p->rpz_log_name))) {
 +			log_err("malloc failure on RPZ log_name strdup");
 +			goto err;
++		}
 +	}
 +	return r;
 +err:
 +	if(r) {
 +		if(r->local_zones)
 +			local_zones_delete(r->local_zones);
 +		if(r->respip_set)
 +			respip_set_delete(r->respip_set);
 +		if(r->taglist)
 +			free(r->taglist);
 +		free(r);
 +	}
 +	return NULL;
 +}
 +
 +/**
 + * Remove RPZ zone name from dname
 + * Copy dname to newdname, without the originlen number of trailing bytes
 + */
 +static size_t
 +strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 +	uint8_t* newdname, size_t maxnewdnamelen)
 +{
 +	size_t newdnamelen;
 +	if(dnamelen < originlen)
 +		return 0;
 +	newdnamelen = dnamelen - originlen;
 +	if(newdnamelen+1 > maxnewdnamelen)
 +		return 0;
 +	memmove(newdname, dname, newdnamelen);
 +	memset(newdname+newdnamelen, 0, 1);
 +	return newdnamelen + 1;	/* + 1 for root label */
 +}
 +
 +/** Insert RR into RPZ's local-zone */
 +static void
 +rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 +	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 +	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 +{
 +	struct local_zone* z;
 +	enum localzone_type tp = local_zone_always_transparent;
 +	int dnamelabs = dname_count_labels(dname);
 +	char* rrstr;
 +	int newzone = 0;
 +
 +	if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
 +		verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 +			rpz_action_to_string(a));
 +		free(dname);
 +		return;
 +	}
 +
 +	lock_rw_wrlock(&r->local_zones->lock);
 +	/* exact match */
 +	z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
 +		LDNS_RR_CLASS_IN);
 +	if(z && a != RPZ_LOCAL_DATA_ACTION) {
 +		rrstr = sldns_wire2str_rr(rr, rr_len);
 +		if(!rrstr) {
 +			log_err("malloc error while inserting RPZ qname "
 +				"trigger");
 +			free(dname);
 +			lock_rw_unlock(&r->local_zones->lock);
 +			return;
 +		}
 +		verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
 +			rrstr);
 +		free(rrstr);
 +		free(dname);
 +		lock_rw_unlock(&r->local_zones->lock);
 +		return;
 +	}
 +	if(!z) {
 +		tp = rpz_action_to_localzone_type(a);
 +		if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
 +			dnamelabs, rrclass, tp))) {
 +			log_warn("RPZ create failed");
 +			lock_rw_unlock(&r->local_zones->lock);
 +			/* dname will be free'd in failed local_zone_create() */
 +			return;
 +		}
 +		newzone = 1;
 +	}
 +	if(a == RPZ_LOCAL_DATA_ACTION) {
 +		rrstr = sldns_wire2str_rr(rr, rr_len);
 +		if(!rrstr) {
 +			log_err("malloc error while inserting RPZ qname "
 +				"trigger");
 +			free(dname);
 +			lock_rw_unlock(&r->local_zones->lock);
 +			return;
 +		}
 +		local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
 +			rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
 +		free(rrstr);
 +	}
 +	if(!newzone)
 +		free(dname);
 +	lock_rw_unlock(&r->local_zones->lock);
 +	return;
 +}
 +
 +/** Insert RR into RPZ's respip_set */
 +static int
 +rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 +	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 +	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 +{
 +	struct resp_addr* node;
 +	struct sockaddr_storage addr;
 +	socklen_t addrlen;
 +	int net, af;
 +	char* rrstr;
 +	enum respip_action respa = rpz_action_to_respip_action(a);
 +
 +	if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
 +		respa == respip_invalid) {
 +		verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 +			rpz_action_to_string(a));
 +		return 0;
 +	}
 +
 +	if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 +		return 0;
 +
 +	lock_rw_wrlock(&r->respip_set->lock);
 +	rrstr = sldns_wire2str_rr(rr, rr_len);
 +	if(!rrstr) {
 +		log_err("malloc error while inserting RPZ respip trigger");
 +		lock_rw_unlock(&r->respip_set->lock);
 +		return 0;
 +	}
 +	if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
 +		net, 1, rrstr))) {
 +		lock_rw_unlock(&r->respip_set->lock);
 +		free(rrstr);
 +		return 0;
 +	}
 +
 +	lock_rw_wrlock(&node->lock);
 +	lock_rw_unlock(&r->respip_set->lock);
 +	node->action = respa;
 +
 +	if(a == RPZ_LOCAL_DATA_ACTION) {
 +		respip_enter_rr(r->respip_set->region, node, rrtype,
 +			rrclass, ttl, rdata, rdata_len, rrstr, "");
 +	}
 +	lock_rw_unlock(&node->lock);
 +	free(rrstr);
 +	return 1;
 +}
 +
 +int
 +rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
 +	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
 +	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
 +{
 +	size_t policydnamelen;
 +	/* name is free'd in local_zone delete */
 +	enum rpz_trigger t;
 +	enum rpz_action a;
 +	uint8_t* policydname;
 +
 +	log_assert(dnamelen >= aznamelen);
 +	if(!(policydname = calloc(1, (dnamelen-aznamelen)+1)))
 +		return 0;
 +
 +	a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 +	if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 +		policydname, (dnamelen-aznamelen)+1))) {
 +		free(policydname);
 +		return 0;
 +	}
 +	t = rpz_dname_to_trigger(policydname, policydnamelen);
 +	if(t == RPZ_INVALID_TRIGGER) {
 +		free(policydname);
 +		verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
 +		return 1;
 +	}
 +	if(t == RPZ_QNAME_TRIGGER) {
 +		rpz_insert_qname_trigger(r, policydname, policydnamelen,
 +			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 +			rr_len);
 +	}
 +	else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 +		rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
 +			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 +			rr_len);
 +		free(policydname);
 +	}
 +	else {
 +		free(policydname);
 +		verbose(VERB_ALGO, "RPZ: skipping unusupported trigger: %s",
 +			rpz_trigger_to_string(t));
 +	}
 +	return 1;
 +}
 +
 +/**
 + * Find RPZ local-zone by qname.
 + * @param r: rpz containing local-zone tree
 + * @param qname: qname
 + * @param qname_len: length of qname
 + * @param qclass: qclass
 + * @param only_exact: if 1 only excact (non wildcard) matches are returned
 + * @param wr: get write lock for local-zone if 1, read lock if 0
 + * @param zones_keep_lock: if set do not release the r->local_zones lock, this
 + * 	  makes the caller of this function responsible for releasing the lock.
 + * @return: NULL or local-zone holding rd or wr lock
 + */
 +static struct local_zone*
 +rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
 +	int only_exact, int wr, int zones_keep_lock)
 +{
 +	uint8_t* ce;
 +	size_t ce_len, ce_labs;
 +	uint8_t wc[LDNS_MAX_DOMAINLEN];
 +	int exact;
 +	struct local_zone* z = NULL;
 +	if(wr) {
 +		lock_rw_wrlock(&r->local_zones->lock);
 +	} else {
 +		lock_rw_rdlock(&r->local_zones->lock);
 +	}
 +	z = local_zones_find_le(r->local_zones, qname, qname_len,
 +		dname_count_labels(qname),
 +		LDNS_RR_CLASS_IN, &exact);
 +	if(!z || (only_exact && !exact)) {
 +		lock_rw_unlock(&r->local_zones->lock);
 +		return NULL;
 +	}
 +	if(wr) {
 +		lock_rw_wrlock(&z->lock);
 +	} else {
 +		lock_rw_rdlock(&z->lock);
 +	}
 +	if(!zones_keep_lock) {
 +		lock_rw_unlock(&r->local_zones->lock);
 +	}
 +
 +	if(exact)
 +		return z;
 +
 +	/* No exact match found, lookup wildcard. closest encloser must
 +	 * be the shared parent between the qname and the best local
 +	 * zone match, append '*' to that and do another lookup. */
 +
 +	ce = dname_get_shared_topdomain(z->name, qname);
 +	if(!ce /* should not happen */ || !*ce /* root */) {
 +		lock_rw_unlock(&z->lock);
 +		return NULL;
 +	}
 +	ce_labs = dname_count_size_labels(ce, &ce_len);
 +	if(ce_len+2 > sizeof(wc)) {
 +		lock_rw_unlock(&z->lock);
 +		return NULL;
 +	}
 +	wc[0] = 1; /* length of wildcard label */
 +	wc[1] = (uint8_t)'*'; /* wildcard label */
 +	memmove(wc+2, ce, ce_len);
 +	lock_rw_unlock(&z->lock);
 +
 +	if(!zones_keep_lock) {
 +		if(wr) {
 +			lock_rw_wrlock(&r->local_zones->lock);
 +		} else {
 +			lock_rw_rdlock(&r->local_zones->lock);
 +		}
 +	}
 +	z = local_zones_find_le(r->local_zones, wc,
 +		ce_len+2, ce_labs+1, qclass, &exact);
 +	if(!z || !exact) {
 +		lock_rw_unlock(&r->local_zones->lock);
 +		return NULL;
 +	}
 +	if(wr) {
 +		lock_rw_wrlock(&z->lock);
 +	} else {
 +		lock_rw_rdlock(&z->lock);
 +	}
 +	if(!zones_keep_lock) {
 +		lock_rw_unlock(&r->local_zones->lock);
 +	}
 +	return z;
 +}
 +
 +/**
 + * Remove RR from RPZ's local-data
 + * @param z: local-zone for RPZ, holding write lock
 + * @param policydname: dname of RR to remove
 + * @param policydnamelen: lenth of policydname
 + * @param rr_type: RR type of RR to remove
 + * @param rdata: rdata of RR to remove
 + * @param rdatalen: length of rdata
 + * @return: 1 if zone must be removed after RR deletion
 + */
 +static int
 +rpz_data_delete_rr(struct local_zone* z, uint8_t* policydname,
 +	size_t policydnamelen, uint16_t rr_type, uint8_t* rdata,
 +	size_t rdatalen)
 +{
 +	struct local_data* ld;
 +	struct packed_rrset_data* d;
 +	size_t index;
 +	ld = local_zone_find_data(z, policydname, policydnamelen,
 +		dname_count_labels(policydname));
 +	if(ld) {
 +		struct local_rrset* prev=NULL, *p=ld->rrsets;
 +		while(p && ntohs(p->rrset->rk.type) != rr_type) {
 +			prev = p;
 +			p = p->next;
 +		}
 +		if(!p)
 +			return 0;
 +		d = (struct packed_rrset_data*)p->rrset->entry.data;
 +		if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 +			if(d->count == 1) {
 +				/* no memory recycling for zone deletions ... */
 +				if(prev) prev->next = p->next;
 +				else ld->rrsets = p->next;
 +			}
 +			if(d->count > 1) {
 +				if(!local_rrset_remove_rr(d, index))
 +					return 0;
 +			}
 +		}
 +	}
 +	if(ld && ld->rrsets)
 +		return 0;
 +	return 1;
 +}
 +
 +/**
 + * Remove RR from RPZ's respip set
 + * @param raddr: respip node
 + * @param rr_type: RR type of RR to remove
 + * @param rdata: rdata of RR to remove
 + * @param rdatalen: length of rdata
 + * @return: 1 if zone must be removed after RR deletion
 + */
 +static int
 +rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 +	size_t rdatalen)
 +{
 +	size_t index;
 +	struct packed_rrset_data* d;
 +	if(!raddr->data)
 +		return 1;
 +	d = raddr->data->entry.data;
 +	if(ntohs(raddr->data->rk.type) != rr_type) {
 +		return 0;
 +	}
 +	if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 +		if(d->count == 1) {
 +			/* regional alloc'd */
 +			raddr->data->entry.data = NULL; 
 +			raddr->data = NULL;
 +			return 1;
 +		}
 +		if(d->count > 1) {
 +			if(!local_rrset_remove_rr(d, index))
 +				return 0;
 +		}
 +	}
 +	return 0;
 +
 +}
 +
 +/** Remove RR from RPZ's local-zone */
 +static void
 +rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 +	enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
 +	uint8_t* rdatawl, size_t rdatalen)
 +{
 +	struct local_zone* z;
 +	int delete_zone = 1;
 +	z = rpz_find_zone(r, dname, dnamelen, rr_class,
 +		1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
 +	if(!z) {
 +		verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 +			"RPZ domain not found");
 +		return;
 +	}
 +	if(a == RPZ_LOCAL_DATA_ACTION)
 +		delete_zone = rpz_data_delete_rr(z, dname,
 +			dnamelen, rr_type, rdatawl, rdatalen);
 +	else if(a != localzone_type_to_rpz_action(z->type)) {
 +		return;
 +	}
 +	lock_rw_unlock(&z->lock); 
 +	if(delete_zone) {
 +		local_zones_del_zone(r->local_zones, z);
 +	}
 +	lock_rw_unlock(&r->local_zones->lock); 
 +	return;
 +}
 +
 +static void
 +rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 +	enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 +{
 +	struct resp_addr* node;
 +	struct sockaddr_storage addr;
 +	socklen_t addrlen;
 +	int net, af;
 +	int delete_respip = 1;
 +
 +	if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 +		return;
 +
 +	lock_rw_wrlock(&r->respip_set->lock);
 +	if(!(node = (struct resp_addr*)addr_tree_find(
 +		&r->respip_set->ip_tree, &addr, addrlen, net))) {
 +		verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 +			"RPZ domain not found");
 +		lock_rw_unlock(&r->respip_set->lock);
 +		return;
 +	}
 +
 +	lock_rw_wrlock(&node->lock);
 +	if(a == RPZ_LOCAL_DATA_ACTION) {
 +		/* remove RR, signal whether RR can be removed */
 +		delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl, 
 +			rdatalen);
 +	}
 +	lock_rw_unlock(&node->lock);
 +	if(delete_respip)
 +		respip_sockaddr_delete(r->respip_set, node);
 +	lock_rw_unlock(&r->respip_set->lock);
 +}
 +
 +void
 +rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
 +	uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
 +{
 +	size_t policydnamelen;
 +	enum rpz_trigger t;
 +	enum rpz_action a;
 +	uint8_t* policydname;
 +
 +	if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
 +		return;
 +
 +	a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 +	if(a == RPZ_INVALID_ACTION) {
 +		free(policydname);
 +		return;
 +	}
 +	if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 +		policydname, LDNS_MAX_DOMAINLEN + 1))) {
 +		free(policydname);
 +		return;
 +	}
 +	t = rpz_dname_to_trigger(policydname, policydnamelen);
 +	if(t == RPZ_QNAME_TRIGGER) {
 +		rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
 +			rr_type, rr_class, rdatawl, rdatalen);
 +	} else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 +		rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
 +			a, rr_type, rdatawl, rdatalen);
 +	}
 +	free(policydname);
 +}
 +
 +/** print log information for an applied RPZ policy. Based on local-zone's
 + * lz_inform_print().
 + */
 +static void
 +log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
 +	struct comm_reply* repinfo, char* log_name)
 +{
 +	char ip[128], txt[512];
 +	char dnamestr[LDNS_MAX_DOMAINLEN+1];
 +	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
 +	dname_str(dname, dnamestr);
 +	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
 +	if(log_name)
 +		snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
 +			log_name, dnamestr, rpz_action_to_string(a), ip,
 +			(unsigned)port);
 +	else
 +		snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
 +			dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
 +	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 +}
 +
 +int
 +rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 +	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 +	struct regional* temp, struct comm_reply* repinfo,
 +	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
 +{
 +	struct rpz* r;
 +	int ret;
 +	enum localzone_type lzt;
 +	struct local_zone* z = NULL;
 +	struct local_data* ld = NULL;
 +	lock_rw_rdlock(&az->rpz_lock);
 +	for(r = az->rpz_first; r; r = r->next) {
 +		if(!r->taglist || taglist_intersect(r->taglist, 
 +			r->taglistlen, taglist, taglen)) {
 +			z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
 +				qinfo->qclass, 0, 0, 0);
 +			if(z && r->action_override == RPZ_DISABLED_ACTION) {
 +				if(r->log)
 +					log_rpz_apply(z->name,
 +						r->action_override,
 +						qinfo, repinfo, r->log_name);
 +				/* TODO only register stats when stats_extended?
 +				 * */
 +				stats->rpz_action[r->action_override]++;
 +				lock_rw_unlock(&z->lock);
 +				z = NULL;
 +			}
 +			if(z)
 +				break;
 +		}	
 +	}
 +	lock_rw_unlock(&az->rpz_lock);
 +	if(!z)
 +		return 0;
 +
 +	
 +	if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
 +		lzt = z->type;
 +	else
 +		lzt = rpz_action_to_localzone_type(r->action_override);
 +
 +	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 +		qinfo->local_alias =
 +			regional_alloc_zero(temp, sizeof(struct local_rrset));
 +		if(!qinfo->local_alias) {
 +			lock_rw_unlock(&z->lock);
 +			return 0; /* out of memory */
 +		}
 +		qinfo->local_alias->rrset =
 +			regional_alloc_init(temp, r->cname_override,
 +				sizeof(*r->cname_override));
 +		if(!qinfo->local_alias->rrset) {
 +			lock_rw_unlock(&z->lock);
 +			return 0; /* out of memory */
 +		}
 +		qinfo->local_alias->rrset->rk.dname = qinfo->qname;
 +		qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
 +		if(r->log)
 +			log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION, 
 +				qinfo, repinfo, r->log_name);
 +		stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
 +		lock_rw_unlock(&z->lock);
 +		return 0;
 +	}
 +
 +	if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
 +		edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
 +		&ld, lzt, -1, NULL, 0, NULL, 0)) {
 +		if(r->log)
 +			log_rpz_apply(z->name,
 +				localzone_type_to_rpz_action(lzt), qinfo,
 +				repinfo, r->log_name);
 +		stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
 +		lock_rw_unlock(&z->lock);
 +		return !qinfo->local_alias;
 +	}
 +
 +	ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
 +		0 /* no local data used */, lzt);
 +	if(r->log)
 +		log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
 +			qinfo, repinfo, r->log_name);
 +	stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
 +	lock_rw_unlock(&z->lock);
 +
 +	return ret;
 +}
diff --cc util/configlexer.c
index 0be116cf1,cedb4878d..462820cef
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@@ -2877,18 -2844,18 +2876,18 @@@ static void config_end_include(void
          }
  #endif
  
- #line 2879 "<stdout>"
 -#line 2845 "<stdout>"
++#line 2878 "<stdout>"
  #define YY_NO_INPUT 1
- #line 185 "./util/configlexer.lex"
+ #line 184 "./util/configlexer.lex"
  #ifndef YY_NO_UNPUT
  #define YY_NO_UNPUT 1
  #endif
  #ifndef YY_NO_INPUT
  #define YY_NO_INPUT 1
  #endif
- #line 2888 "<stdout>"
 -#line 2854 "<stdout>"
++#line 2887 "<stdout>"
  
- #line 2890 "<stdout>"
 -#line 2856 "<stdout>"
++#line 2889 "<stdout>"
  
  #define INITIAL 0
  #define quotedstring 1
@@@ -3108,9 -3075,9 +3107,9 @@@ YY_DEC
  		}
  
  	{
- #line 205 "./util/configlexer.lex"
+ #line 204 "./util/configlexer.lex"
  
- #line 3112 "<stdout>"
 -#line 3078 "<stdout>"
++#line 3111 "<stdout>"
  
  	while ( /*CONSTCOND*/1 )		/* loops until end-of-file is reached */
  		{
@@@ -3733,888 -3700,858 +3732,888 @@@ YY_RULE_SETU
  	YY_BREAK
  case 112:
  YY_RULE_SETUP
- #line 320 "./util/configlexer.lex"
+ #line 319 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_ZONEFILE) }
 +{ YDVAR(0, VAR_RPZ) }
  	YY_BREAK
  case 113:
  YY_RULE_SETUP
- #line 321 "./util/configlexer.lex"
+ #line 320 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MASTER) }
 +{ YDVAR(1, VAR_TAGS) }
  	YY_BREAK
  case 114:
  YY_RULE_SETUP
- #line 322 "./util/configlexer.lex"
+ #line 321 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_URL) }
 +{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
  	YY_BREAK
  case 115:
  YY_RULE_SETUP
- #line 323 "./util/configlexer.lex"
+ #line 322 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_ALLOW_NOTIFY) }
 +{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
  	YY_BREAK
  case 116:
  YY_RULE_SETUP
- #line 324 "./util/configlexer.lex"
+ #line 323 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
 +{ YDVAR(1, VAR_RPZ_LOG) }
  	YY_BREAK
  case 117:
  YY_RULE_SETUP
- #line 325 "./util/configlexer.lex"
+ #line 324 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FOR_UPSTREAM) }
 +{ YDVAR(1, VAR_RPZ_LOG_NAME) }
  	YY_BREAK
  case 118:
  YY_RULE_SETUP
- #line 326 "./util/configlexer.lex"
+ #line 325 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FALLBACK_ENABLED) }
 +{ YDVAR(1, VAR_ZONEFILE) }
  	YY_BREAK
  case 119:
  YY_RULE_SETUP
- #line 327 "./util/configlexer.lex"
+ #line 326 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_VIEW) }
 +{ YDVAR(1, VAR_MASTER) }
  	YY_BREAK
  case 120:
  YY_RULE_SETUP
- #line 328 "./util/configlexer.lex"
+ #line 327 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VIEW_FIRST) }
 +{ YDVAR(1, VAR_URL) }
  	YY_BREAK
  case 121:
  YY_RULE_SETUP
- #line 329 "./util/configlexer.lex"
+ #line 328 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 +{ YDVAR(1, VAR_ALLOW_NOTIFY) }
  	YY_BREAK
  case 122:
  YY_RULE_SETUP
- #line 330 "./util/configlexer.lex"
+ #line 329 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 +{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
  	YY_BREAK
  case 123:
  YY_RULE_SETUP
- #line 331 "./util/configlexer.lex"
+ #line 330 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_ACCESS_CONTROL) }
 +{ YDVAR(1, VAR_FOR_UPSTREAM) }
  	YY_BREAK
  case 124:
  YY_RULE_SETUP
- #line 332 "./util/configlexer.lex"
+ #line 331 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
 +{ YDVAR(1, VAR_FALLBACK_ENABLED) }
  	YY_BREAK
  case 125:
  YY_RULE_SETUP
- #line 333 "./util/configlexer.lex"
+ #line 332 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
 +{ YDVAR(0, VAR_VIEW) }
  	YY_BREAK
  case 126:
  YY_RULE_SETUP
- #line 334 "./util/configlexer.lex"
+ #line 333 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
 +{ YDVAR(1, VAR_VIEW_FIRST) }
  	YY_BREAK
  case 127:
  YY_RULE_SETUP
- #line 335 "./util/configlexer.lex"
+ #line 334 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
 +{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
  	YY_BREAK
  case 128:
  YY_RULE_SETUP
- #line 336 "./util/configlexer.lex"
+ #line 335 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
 +{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
  	YY_BREAK
  case 129:
  YY_RULE_SETUP
- #line 337 "./util/configlexer.lex"
+ #line 336 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
 +{ YDVAR(2, VAR_ACCESS_CONTROL) }
  	YY_BREAK
  case 130:
  YY_RULE_SETUP
- #line 338 "./util/configlexer.lex"
+ #line 337 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
 +{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
  	YY_BREAK
  case 131:
  YY_RULE_SETUP
- #line 339 "./util/configlexer.lex"
+ #line 338 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
 +{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
  	YY_BREAK
  case 132:
  YY_RULE_SETUP
- #line 340 "./util/configlexer.lex"
+ #line 339 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
 +{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
  	YY_BREAK
  case 133:
  YY_RULE_SETUP
- #line 341 "./util/configlexer.lex"
+ #line 340 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
 +{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
  	YY_BREAK
  case 134:
  YY_RULE_SETUP
- #line 342 "./util/configlexer.lex"
+ #line 341 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_HIDE_IDENTITY) }
 +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
  	YY_BREAK
  case 135:
  YY_RULE_SETUP
- #line 343 "./util/configlexer.lex"
+ #line 342 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_HIDE_VERSION) }
 +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
  	YY_BREAK
  case 136:
  YY_RULE_SETUP
- #line 344 "./util/configlexer.lex"
+ #line 343 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
 +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
  	YY_BREAK
  case 137:
  YY_RULE_SETUP
- #line 345 "./util/configlexer.lex"
+ #line 344 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IDENTITY) }
 +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
  	YY_BREAK
  case 138:
  YY_RULE_SETUP
- #line 346 "./util/configlexer.lex"
+ #line 345 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VERSION) }
 +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
  	YY_BREAK
  case 139:
  YY_RULE_SETUP
- #line 347 "./util/configlexer.lex"
+ #line 346 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MODULE_CONF) }
 +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
  	YY_BREAK
  case 140:
  YY_RULE_SETUP
- #line 348 "./util/configlexer.lex"
+ #line 347 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DLV_ANCHOR) }
 +{ YDVAR(1, VAR_HIDE_IDENTITY) }
  	YY_BREAK
  case 141:
  YY_RULE_SETUP
- #line 349 "./util/configlexer.lex"
+ #line 348 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 +{ YDVAR(1, VAR_HIDE_VERSION) }
  	YY_BREAK
  case 142:
  YY_RULE_SETUP
- #line 350 "./util/configlexer.lex"
+ #line 349 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 +{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
  	YY_BREAK
  case 143:
  YY_RULE_SETUP
- #line 351 "./util/configlexer.lex"
+ #line 350 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 +{ YDVAR(1, VAR_IDENTITY) }
  	YY_BREAK
  case 144:
  YY_RULE_SETUP
- #line 352 "./util/configlexer.lex"
+ #line 351 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 +{ YDVAR(1, VAR_VERSION) }
  	YY_BREAK
  case 145:
  YY_RULE_SETUP
- #line 353 "./util/configlexer.lex"
+ #line 352 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_TRUST_ANCHOR) }
 +{ YDVAR(1, VAR_MODULE_CONF) }
  	YY_BREAK
  case 146:
  YY_RULE_SETUP
- #line 354 "./util/configlexer.lex"
+ #line 353 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
 +{ YDVAR(1, VAR_DLV_ANCHOR) }
  	YY_BREAK
  case 147:
  YY_RULE_SETUP
- #line 355 "./util/configlexer.lex"
+ #line 354 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
 +{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
  	YY_BREAK
  case 148:
  YY_RULE_SETUP
- #line 356 "./util/configlexer.lex"
+ #line 355 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 +{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
  	YY_BREAK
  case 149:
  YY_RULE_SETUP
- #line 357 "./util/configlexer.lex"
+ #line 356 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 +{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
  	YY_BREAK
  case 150:
  YY_RULE_SETUP
- #line 358 "./util/configlexer.lex"
+ #line 357 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 +{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
  	YY_BREAK
  case 151:
  YY_RULE_SETUP
- #line 359 "./util/configlexer.lex"
+ #line 358 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_BOGUS_TTL) }
 +{ YDVAR(1, VAR_TRUST_ANCHOR) }
  	YY_BREAK
  case 152:
  YY_RULE_SETUP
- #line 360 "./util/configlexer.lex"
+ #line 359 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 +{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
  	YY_BREAK
  case 153:
  YY_RULE_SETUP
- #line 361 "./util/configlexer.lex"
+ #line 360 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 +{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
  	YY_BREAK
  case 154:
  YY_RULE_SETUP
- #line 362 "./util/configlexer.lex"
+ #line 361 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
 +{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
  	YY_BREAK
  case 155:
  YY_RULE_SETUP
- #line 363 "./util/configlexer.lex"
+ #line 362 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
 +{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
  	YY_BREAK
  case 156:
  YY_RULE_SETUP
- #line 364 "./util/configlexer.lex"
+ #line 363 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SERVE_EXPIRED) }
 +{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
  	YY_BREAK
  case 157:
  YY_RULE_SETUP
- #line 365 "./util/configlexer.lex"
+ #line 364 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
 +{ YDVAR(1, VAR_BOGUS_TTL) }
  	YY_BREAK
  case 158:
  YY_RULE_SETUP
- #line 366 "./util/configlexer.lex"
+ #line 365 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
 +{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
  	YY_BREAK
  case 159:
  YY_RULE_SETUP
- #line 367 "./util/configlexer.lex"
+ #line 366 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAKE_DSA) }
 +{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
  	YY_BREAK
  case 160:
  YY_RULE_SETUP
- #line 368 "./util/configlexer.lex"
+ #line 367 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAKE_SHA1) }
 +{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
  	YY_BREAK
  case 161:
  YY_RULE_SETUP
- #line 369 "./util/configlexer.lex"
+ #line 368 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 +{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
  	YY_BREAK
  case 162:
  YY_RULE_SETUP
- #line 370 "./util/configlexer.lex"
+ #line 369 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 +{ YDVAR(1, VAR_SERVE_EXPIRED) }
  	YY_BREAK
  case 163:
  YY_RULE_SETUP
- #line 371 "./util/configlexer.lex"
+ #line 370 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
  	YY_BREAK
  case 164:
  YY_RULE_SETUP
- #line 372 "./util/configlexer.lex"
+ #line 371 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
  	YY_BREAK
  case 165:
  YY_RULE_SETUP
- #line 373 "./util/configlexer.lex"
+ #line 372 "./util/configlexer.lex"
 -{ 
 -				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 +{ YDVAR(1, VAR_FAKE_DSA) }
  	YY_BREAK
  case 166:
  YY_RULE_SETUP
--#line 374 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_ADD_HOLDDOWN) }
++#line 373 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_FAKE_SHA1) }
  	YY_BREAK
  case 167:
  YY_RULE_SETUP
--#line 375 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DEL_HOLDDOWN) }
++#line 374 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
  	YY_BREAK
  case 168:
  YY_RULE_SETUP
--#line 376 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_KEEP_MISSING) }
++#line 375 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
  	YY_BREAK
  case 169:
  YY_RULE_SETUP
--#line 377 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
++#line 376 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
  	YY_BREAK
  case 170:
  YY_RULE_SETUP
--#line 378 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_USE_SYSLOG) }
++#line 377 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
  	YY_BREAK
  case 171:
  YY_RULE_SETUP
--#line 379 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_IDENTITY) }
++#line 378 "./util/configlexer.lex"
 +{ 
 +				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
  	YY_BREAK
  case 172:
  YY_RULE_SETUP
- #line 381 "./util/configlexer.lex"
+ #line 380 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_TIME_ASCII) }
 +{ YDVAR(1, VAR_ADD_HOLDDOWN) }
  	YY_BREAK
  case 173:
  YY_RULE_SETUP
- #line 382 "./util/configlexer.lex"
+ #line 381 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_QUERIES) }
 +{ YDVAR(1, VAR_DEL_HOLDDOWN) }
  	YY_BREAK
  case 174:
  YY_RULE_SETUP
- #line 383 "./util/configlexer.lex"
+ #line 382 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_REPLIES) }
 +{ YDVAR(1, VAR_KEEP_MISSING) }
  	YY_BREAK
  case 175:
  YY_RULE_SETUP
- #line 384 "./util/configlexer.lex"
+ #line 383 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
 +{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
  	YY_BREAK
  case 176:
  YY_RULE_SETUP
- #line 385 "./util/configlexer.lex"
+ #line 384 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
 +{ YDVAR(1, VAR_USE_SYSLOG) }
  	YY_BREAK
  case 177:
  YY_RULE_SETUP
- #line 386 "./util/configlexer.lex"
+ #line 385 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOG_SERVFAIL) }
 +{ YDVAR(1, VAR_LOG_IDENTITY) }
  	YY_BREAK
  case 178:
  YY_RULE_SETUP
- #line 387 "./util/configlexer.lex"
+ #line 386 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_LOCAL_ZONE) }
 +{ YDVAR(1, VAR_LOG_TIME_ASCII) }
  	YY_BREAK
  case 179:
  YY_RULE_SETUP
- #line 388 "./util/configlexer.lex"
+ #line 387 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOCAL_DATA) }
 +{ YDVAR(1, VAR_LOG_QUERIES) }
  	YY_BREAK
  case 180:
  YY_RULE_SETUP
- #line 389 "./util/configlexer.lex"
+ #line 388 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
 +{ YDVAR(1, VAR_LOG_REPLIES) }
  	YY_BREAK
  case 181:
  YY_RULE_SETUP
- #line 390 "./util/configlexer.lex"
+ #line 389 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 +{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
  	YY_BREAK
  case 182:
  YY_RULE_SETUP
- #line 391 "./util/configlexer.lex"
+ #line 390 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
 +{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
  	YY_BREAK
  case 183:
  YY_RULE_SETUP
- #line 392 "./util/configlexer.lex"
+ #line 391 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
 +{ YDVAR(1, VAR_LOG_SERVFAIL) }
  	YY_BREAK
  case 184:
  YY_RULE_SETUP
- #line 393 "./util/configlexer.lex"
+ #line 392 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 +{ YDVAR(2, VAR_LOCAL_ZONE) }
  	YY_BREAK
  case 185:
  YY_RULE_SETUP
- #line 394 "./util/configlexer.lex"
+ #line 393 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
 +{ YDVAR(1, VAR_LOCAL_DATA) }
  	YY_BREAK
  case 186:
  YY_RULE_SETUP
- #line 395 "./util/configlexer.lex"
+ #line 394 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SHM_ENABLE) }
 +{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
  	YY_BREAK
  case 187:
  YY_RULE_SETUP
- #line 396 "./util/configlexer.lex"
+ #line 395 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SHM_KEY) }
 +{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
  	YY_BREAK
  case 188:
  YY_RULE_SETUP
- #line 397 "./util/configlexer.lex"
+ #line 396 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_REMOTE_CONTROL) }
 +{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
  	YY_BREAK
  case 189:
  YY_RULE_SETUP
- #line 398 "./util/configlexer.lex"
+ #line 397 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_ENABLE) }
 +{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
  	YY_BREAK
  case 190:
  YY_RULE_SETUP
- #line 399 "./util/configlexer.lex"
+ #line 398 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 +{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
  	YY_BREAK
  case 191:
  YY_RULE_SETUP
- #line 400 "./util/configlexer.lex"
+ #line 399 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_PORT) }
 +{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
  	YY_BREAK
  case 192:
  YY_RULE_SETUP
- #line 401 "./util/configlexer.lex"
+ #line 400 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 +{ YDVAR(1, VAR_SHM_ENABLE) }
  	YY_BREAK
  case 193:
  YY_RULE_SETUP
- #line 402 "./util/configlexer.lex"
+ #line 401 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 +{ YDVAR(1, VAR_SHM_KEY) }
  	YY_BREAK
  case 194:
  YY_RULE_SETUP
- #line 403 "./util/configlexer.lex"
+ #line 402 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 +{ YDVAR(0, VAR_REMOTE_CONTROL) }
  	YY_BREAK
  case 195:
  YY_RULE_SETUP
- #line 404 "./util/configlexer.lex"
+ #line 403 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
 +{ YDVAR(1, VAR_CONTROL_ENABLE) }
  	YY_BREAK
  case 196:
  YY_RULE_SETUP
- #line 405 "./util/configlexer.lex"
+ #line 404 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
 +{ YDVAR(1, VAR_CONTROL_INTERFACE) }
  	YY_BREAK
  case 197:
  YY_RULE_SETUP
- #line 406 "./util/configlexer.lex"
+ #line 405 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_PYTHON_SCRIPT) }
 +{ YDVAR(1, VAR_CONTROL_PORT) }
  	YY_BREAK
  case 198:
  YY_RULE_SETUP
- #line 407 "./util/configlexer.lex"
+ #line 406 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_PYTHON) }
 +{ YDVAR(1, VAR_CONTROL_USE_CERT) }
  	YY_BREAK
  case 199:
  YY_RULE_SETUP
- #line 408 "./util/configlexer.lex"
+ #line 407 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DOMAIN_INSECURE) }
 +{ YDVAR(1, VAR_SERVER_KEY_FILE) }
  	YY_BREAK
  case 200:
  YY_RULE_SETUP
- #line 409 "./util/configlexer.lex"
+ #line 408 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
 +{ YDVAR(1, VAR_SERVER_CERT_FILE) }
  	YY_BREAK
  case 201:
  YY_RULE_SETUP
- #line 410 "./util/configlexer.lex"
+ #line 409 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 +{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
  	YY_BREAK
  case 202:
  YY_RULE_SETUP
- #line 411 "./util/configlexer.lex"
+ #line 410 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
 +{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
  	YY_BREAK
  case 203:
  YY_RULE_SETUP
- #line 412 "./util/configlexer.lex"
+ #line 411 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_MAX_UDP_SIZE) }
 +{ YDVAR(1, VAR_PYTHON_SCRIPT) }
  	YY_BREAK
  case 204:
  YY_RULE_SETUP
- #line 413 "./util/configlexer.lex"
+ #line 412 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNS64_PREFIX) }
 +{ YDVAR(0, VAR_PYTHON) }
  	YY_BREAK
  case 205:
  YY_RULE_SETUP
- #line 414 "./util/configlexer.lex"
+ #line 413 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNS64_SYNTHALL) }
 +{ YDVAR(1, VAR_DOMAIN_INSECURE) }
  	YY_BREAK
  case 206:
  YY_RULE_SETUP
- #line 415 "./util/configlexer.lex"
+ #line 414 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
 +{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
  	YY_BREAK
  case 207:
  YY_RULE_SETUP
- #line 416 "./util/configlexer.lex"
+ #line 415 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DEFINE_TAG) }
 +{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
  	YY_BREAK
  case 208:
  YY_RULE_SETUP
- #line 417 "./util/configlexer.lex"
+ #line 416 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
 +{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
  	YY_BREAK
  case 209:
  YY_RULE_SETUP
- #line 418 "./util/configlexer.lex"
+ #line 417 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
 +{ YDVAR(1, VAR_MAX_UDP_SIZE) }
  	YY_BREAK
  case 210:
  YY_RULE_SETUP
- #line 419 "./util/configlexer.lex"
+ #line 418 "./util/configlexer.lex"
 -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
 +{ YDVAR(1, VAR_DNS64_PREFIX) }
  	YY_BREAK
  case 211:
  YY_RULE_SETUP
- #line 420 "./util/configlexer.lex"
+ #line 419 "./util/configlexer.lex"
 -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
 +{ YDVAR(1, VAR_DNS64_SYNTHALL) }
  	YY_BREAK
  case 212:
  YY_RULE_SETUP
- #line 421 "./util/configlexer.lex"
+ #line 420 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
 +{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
  	YY_BREAK
  case 213:
  YY_RULE_SETUP
- #line 422 "./util/configlexer.lex"
+ #line 421 "./util/configlexer.lex"
 -{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
 +{ YDVAR(1, VAR_DEFINE_TAG) }
  	YY_BREAK
  case 214:
  YY_RULE_SETUP
- #line 423 "./util/configlexer.lex"
+ #line 422 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_DNSTAP) }
 +{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
  	YY_BREAK
  case 215:
  YY_RULE_SETUP
- #line 424 "./util/configlexer.lex"
+ #line 423 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_ENABLE) }
 +{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
  	YY_BREAK
  case 216:
  YY_RULE_SETUP
- #line 425 "./util/configlexer.lex"
+ #line 424 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
  	YY_BREAK
  case 217:
  YY_RULE_SETUP
- #line 426 "./util/configlexer.lex"
+ #line 425 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
  	YY_BREAK
  case 218:
  YY_RULE_SETUP
- #line 427 "./util/configlexer.lex"
+ #line 426 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 +{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
  	YY_BREAK
  case 219:
  YY_RULE_SETUP
- #line 428 "./util/configlexer.lex"
+ #line 427 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 +{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
  	YY_BREAK
  case 220:
  YY_RULE_SETUP
- #line 429 "./util/configlexer.lex"
+ #line 428 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSTAP_VERSION) }
 +{ YDVAR(0, VAR_DNSTAP) }
  	YY_BREAK
  case 221:
  YY_RULE_SETUP
- #line 430 "./util/configlexer.lex"
+ #line 429 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 +{ YDVAR(1, VAR_DNSTAP_ENABLE) }
  	YY_BREAK
  case 222:
  YY_RULE_SETUP
--#line 431 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
++#line 430 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
  	YY_BREAK
  case 223:
  YY_RULE_SETUP
- #line 432 "./util/configlexer.lex"
 -#line 433 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
++#line 431 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
  	YY_BREAK
  case 224:
  YY_RULE_SETUP
- #line 433 "./util/configlexer.lex"
 -#line 435 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
++#line 432 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
  	YY_BREAK
  case 225:
  YY_RULE_SETUP
- #line 434 "./util/configlexer.lex"
 -#line 437 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
++#line 433 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
  	YY_BREAK
  case 226:
  YY_RULE_SETUP
- #line 435 "./util/configlexer.lex"
 -#line 439 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
++#line 434 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSTAP_VERSION) }
  	YY_BREAK
  case 227:
  YY_RULE_SETUP
- #line 436 "./util/configlexer.lex"
 -#line 441 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
++#line 435 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
  	YY_BREAK
  case 228:
  YY_RULE_SETUP
- #line 438 "./util/configlexer.lex"
 -#line 442 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IP_RATELIMIT) }
++#line 437 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
  	YY_BREAK
  case 229:
  YY_RULE_SETUP
- #line 440 "./util/configlexer.lex"
 -#line 443 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_RATELIMIT) }
++#line 439 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
  	YY_BREAK
  case 230:
  YY_RULE_SETUP
- #line 442 "./util/configlexer.lex"
 -#line 444 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
++#line 441 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
  	YY_BREAK
  case 231:
  YY_RULE_SETUP
- #line 444 "./util/configlexer.lex"
 -#line 445 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_RATELIMIT_SLABS) }
++#line 443 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
  	YY_BREAK
  case 232:
  YY_RULE_SETUP
--#line 446 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
++#line 445 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
  	YY_BREAK
  case 233:
  YY_RULE_SETUP
- #line 448 "./util/configlexer.lex"
+ #line 447 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_RATELIMIT_SIZE) }
 +{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
  	YY_BREAK
  case 234:
  YY_RULE_SETUP
- #line 449 "./util/configlexer.lex"
+ #line 448 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
 +{ YDVAR(1, VAR_IP_RATELIMIT) }
  	YY_BREAK
  case 235:
  YY_RULE_SETUP
- #line 450 "./util/configlexer.lex"
+ #line 449 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 +{ YDVAR(1, VAR_RATELIMIT) }
  	YY_BREAK
  case 236:
  YY_RULE_SETUP
- #line 451 "./util/configlexer.lex"
+ #line 450 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
 +{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
  	YY_BREAK
  case 237:
  YY_RULE_SETUP
- #line 452 "./util/configlexer.lex"
+ #line 451 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
 +{ YDVAR(1, VAR_RATELIMIT_SLABS) }
  	YY_BREAK
  case 238:
  YY_RULE_SETUP
- #line 453 "./util/configlexer.lex"
+ #line 452 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_LOW_RTT) }
 +{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
  	YY_BREAK
  case 239:
  YY_RULE_SETUP
- #line 454 "./util/configlexer.lex"
+ #line 453 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAST_SERVER_NUM) }
 +{ YDVAR(1, VAR_RATELIMIT_SIZE) }
  	YY_BREAK
  case 240:
  YY_RULE_SETUP
- #line 455 "./util/configlexer.lex"
+ #line 454 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 +{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
  	YY_BREAK
  case 241:
  YY_RULE_SETUP
- #line 456 "./util/configlexer.lex"
+ #line 455 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 +{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
  	YY_BREAK
  case 242:
  YY_RULE_SETUP
- #line 457 "./util/configlexer.lex"
+ #line 456 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 +{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
  	YY_BREAK
  case 243:
  YY_RULE_SETUP
- #line 458 "./util/configlexer.lex"
+ #line 457 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
 +{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
  	YY_BREAK
  case 244:
  YY_RULE_SETUP
- #line 459 "./util/configlexer.lex"
+ #line 458 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_RESPONSE_IP) }
 +{ YDVAR(1, VAR_LOW_RTT) }
  	YY_BREAK
  case 245:
  YY_RULE_SETUP
- #line 460 "./util/configlexer.lex"
+ #line 459 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
 +{ YDVAR(1, VAR_FAST_SERVER_NUM) }
  	YY_BREAK
  case 246:
  YY_RULE_SETUP
- #line 461 "./util/configlexer.lex"
+ #line 460 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_DNSCRYPT) }
 +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
  	YY_BREAK
  case 247:
  YY_RULE_SETUP
- #line 462 "./util/configlexer.lex"
+ #line 461 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
 +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
  	YY_BREAK
  case 248:
  YY_RULE_SETUP
- #line 463 "./util/configlexer.lex"
+ #line 462 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_PORT) }
 +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
  	YY_BREAK
  case 249:
  YY_RULE_SETUP
- #line 464 "./util/configlexer.lex"
+ #line 463 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
 +{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
  	YY_BREAK
  case 250:
  YY_RULE_SETUP
- #line 465 "./util/configlexer.lex"
+ #line 464 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
 +{ YDVAR(2, VAR_RESPONSE_IP) }
  	YY_BREAK
  case 251:
  YY_RULE_SETUP
- #line 466 "./util/configlexer.lex"
+ #line 465 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
 +{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
  	YY_BREAK
  case 252:
  YY_RULE_SETUP
- #line 467 "./util/configlexer.lex"
+ #line 466 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
 +{ YDVAR(0, VAR_DNSCRYPT) }
  	YY_BREAK
  case 253:
  YY_RULE_SETUP
- #line 468 "./util/configlexer.lex"
+ #line 467 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
 +{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
  	YY_BREAK
  case 254:
  YY_RULE_SETUP
--#line 469 "./util/configlexer.lex"
 -{
 -		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
++#line 468 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSCRYPT_PORT) }
  	YY_BREAK
  case 255:
  YY_RULE_SETUP
- #line 470 "./util/configlexer.lex"
 -#line 471 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
++#line 469 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
  	YY_BREAK
  case 256:
  YY_RULE_SETUP
- #line 471 "./util/configlexer.lex"
 -#line 472 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
++#line 470 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
  	YY_BREAK
  case 257:
  YY_RULE_SETUP
- #line 472 "./util/configlexer.lex"
 -#line 473 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
++#line 471 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
  	YY_BREAK
  case 258:
  YY_RULE_SETUP
- #line 473 "./util/configlexer.lex"
 -#line 474 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
++#line 472 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
  	YY_BREAK
  case 259:
  YY_RULE_SETUP
- #line 474 "./util/configlexer.lex"
 -#line 475 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_HOOK) }
++#line 473 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
  	YY_BREAK
  case 260:
  YY_RULE_SETUP
--#line 476 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
++#line 475 "./util/configlexer.lex"
 +{
 +		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
  	YY_BREAK
  case 261:
  YY_RULE_SETUP
- #line 478 "./util/configlexer.lex"
+ #line 477 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
 +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
  	YY_BREAK
  case 262:
  YY_RULE_SETUP
- #line 479 "./util/configlexer.lex"
+ #line 478 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSECMOD_STRICT) }
 +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
  	YY_BREAK
  case 263:
  YY_RULE_SETUP
- #line 480 "./util/configlexer.lex"
+ #line 479 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_CACHEDB) }
 +{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
  	YY_BREAK
  case 264:
  YY_RULE_SETUP
- #line 481 "./util/configlexer.lex"
+ #line 480 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CACHEDB_BACKEND) }
 +{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
  	YY_BREAK
  case 265:
  YY_RULE_SETUP
- #line 482 "./util/configlexer.lex"
+ #line 481 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
 +{ YDVAR(1, VAR_IPSECMOD_HOOK) }
  	YY_BREAK
  case 266:
  YY_RULE_SETUP
- #line 483 "./util/configlexer.lex"
+ #line 482 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
 +{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
  	YY_BREAK
  case 267:
  YY_RULE_SETUP
- #line 484 "./util/configlexer.lex"
+ #line 483 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
 +{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
  	YY_BREAK
  case 268:
  YY_RULE_SETUP
- #line 485 "./util/configlexer.lex"
+ #line 484 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
 +{ YDVAR(1, VAR_IPSECMOD_STRICT) }
  	YY_BREAK
  case 269:
  YY_RULE_SETUP
- #line 486 "./util/configlexer.lex"
+ #line 485 "./util/configlexer.lex"
 -{ YDVAR(0, VAR_IPSET) }
 +{ YDVAR(0, VAR_CACHEDB) }
  	YY_BREAK
  case 270:
  YY_RULE_SETUP
- #line 487 "./util/configlexer.lex"
+ #line 486 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSET_NAME_V4) }
 +{ YDVAR(1, VAR_CACHEDB_BACKEND) }
  	YY_BREAK
  case 271:
  YY_RULE_SETUP
- #line 488 "./util/configlexer.lex"
+ #line 487 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_IPSET_NAME_V6) }
 +{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
  	YY_BREAK
  case 272:
  YY_RULE_SETUP
- #line 489 "./util/configlexer.lex"
+ #line 488 "./util/configlexer.lex"
 -{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 +{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
  	YY_BREAK
  case 273:
  YY_RULE_SETUP
- #line 490 "./util/configlexer.lex"
+ #line 489 "./util/configlexer.lex"
 -{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
 +{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
  	YY_BREAK
  case 274:
 -/* rule 274 can match eol */
  YY_RULE_SETUP
- #line 491 "./util/configlexer.lex"
+ #line 490 "./util/configlexer.lex"
 -{ LEXOUT(("NL\n")); cfg_parser->line++; }
 +{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
  	YY_BREAK
 -/* Quoted strings. Strip leading and ending quotes */
  case 275:
  YY_RULE_SETUP
- #line 492 "./util/configlexer.lex"
++#line 491 "./util/configlexer.lex"
 +{ YDVAR(0, VAR_IPSET) }
 +	YY_BREAK
 +case 276:
 +YY_RULE_SETUP
- #line 493 "./util/configlexer.lex"
++#line 492 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_IPSET_NAME_V4) }
 +	YY_BREAK
 +case 277:
 +YY_RULE_SETUP
- #line 494 "./util/configlexer.lex"
+ #line 493 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_IPSET_NAME_V6) }
 +	YY_BREAK
 +case 278:
 +YY_RULE_SETUP
- #line 495 "./util/configlexer.lex"
++#line 494 "./util/configlexer.lex"
 +{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 +	YY_BREAK
 +case 279:
 +YY_RULE_SETUP
- #line 496 "./util/configlexer.lex"
++#line 495 "./util/configlexer.lex"
 +{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
 +	YY_BREAK
 +case 280:
 +/* rule 280 can match eol */
 +YY_RULE_SETUP
- #line 497 "./util/configlexer.lex"
++#line 496 "./util/configlexer.lex"
 +{ LEXOUT(("NL\n")); cfg_parser->line++; }
 +	YY_BREAK
 +/* Quoted strings. Strip leading and ending quotes */
 +case 281:
 +YY_RULE_SETUP
- #line 500 "./util/configlexer.lex"
++#line 499 "./util/configlexer.lex"
  { BEGIN(quotedstring); LEXOUT(("QS ")); }
  	YY_BREAK
  case YY_STATE_EOF(quotedstring):
- #line 501 "./util/configlexer.lex"
 -#line 494 "./util/configlexer.lex"
++#line 500 "./util/configlexer.lex"
  {
          yyerror("EOF inside quoted string");
  	if(--num_args == 0) { BEGIN(INITIAL); }
  	else		    { BEGIN(val); }
  }
  	YY_BREAK
 -case 276:
 +case 282:
  YY_RULE_SETUP
- #line 506 "./util/configlexer.lex"
 -#line 499 "./util/configlexer.lex"
++#line 505 "./util/configlexer.lex"
  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
  	YY_BREAK
 -case 277:
 -/* rule 277 can match eol */
 +case 283:
 +/* rule 283 can match eol */
  YY_RULE_SETUP
- #line 507 "./util/configlexer.lex"
 -#line 500 "./util/configlexer.lex"
++#line 506 "./util/configlexer.lex"
  { yyerror("newline inside quoted string, no end \""); 
  			  cfg_parser->line++; BEGIN(INITIAL); }
  	YY_BREAK
 -case 278:
 +case 284:
  YY_RULE_SETUP
- #line 509 "./util/configlexer.lex"
 -#line 502 "./util/configlexer.lex"
++#line 508 "./util/configlexer.lex"
  {
          LEXOUT(("QE "));
  	if(--num_args == 0) { BEGIN(INITIAL); }
@@@ -4627,34 -4564,34 +4626,34 @@@
  }
  	YY_BREAK
  /* Single Quoted strings. Strip leading and ending quotes */
 -case 279:
 +case 285:
  YY_RULE_SETUP
- #line 521 "./util/configlexer.lex"
 -#line 514 "./util/configlexer.lex"
++#line 520 "./util/configlexer.lex"
  { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
  	YY_BREAK
  case YY_STATE_EOF(singlequotedstr):
- #line 522 "./util/configlexer.lex"
 -#line 515 "./util/configlexer.lex"
++#line 521 "./util/configlexer.lex"
  {
          yyerror("EOF inside quoted string");
  	if(--num_args == 0) { BEGIN(INITIAL); }
  	else		    { BEGIN(val); }
  }
  	YY_BREAK
 -case 280:
 +case 286:
  YY_RULE_SETUP
- #line 527 "./util/configlexer.lex"
 -#line 520 "./util/configlexer.lex"
++#line 526 "./util/configlexer.lex"
  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
  	YY_BREAK
 -case 281:
 -/* rule 281 can match eol */
 +case 287:
 +/* rule 287 can match eol */
  YY_RULE_SETUP
- #line 528 "./util/configlexer.lex"
 -#line 521 "./util/configlexer.lex"
++#line 527 "./util/configlexer.lex"
  { yyerror("newline inside quoted string, no end '"); 
  			     cfg_parser->line++; BEGIN(INITIAL); }
  	YY_BREAK
 -case 282:
 +case 288:
  YY_RULE_SETUP
- #line 530 "./util/configlexer.lex"
 -#line 523 "./util/configlexer.lex"
++#line 529 "./util/configlexer.lex"
  {
          LEXOUT(("SQE "));
  	if(--num_args == 0) { BEGIN(INITIAL); }
@@@ -4667,38 -4604,38 +4666,38 @@@
  }
  	YY_BREAK
  /* include: directive */
 -case 283:
 +case 289:
  YY_RULE_SETUP
- #line 542 "./util/configlexer.lex"
 -#line 535 "./util/configlexer.lex"
++#line 541 "./util/configlexer.lex"
  { 
  	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
  	YY_BREAK
  case YY_STATE_EOF(include):
- #line 544 "./util/configlexer.lex"
 -#line 537 "./util/configlexer.lex"
++#line 543 "./util/configlexer.lex"
  {
          yyerror("EOF inside include directive");
          BEGIN(inc_prev);
  }
  	YY_BREAK
 -case 284:
 +case 290:
  YY_RULE_SETUP
- #line 548 "./util/configlexer.lex"
 -#line 541 "./util/configlexer.lex"
++#line 547 "./util/configlexer.lex"
  { LEXOUT(("ISP ")); /* ignore */ }
  	YY_BREAK
 -case 285:
 -/* rule 285 can match eol */
 +case 291:
 +/* rule 291 can match eol */
  YY_RULE_SETUP
- #line 549 "./util/configlexer.lex"
 -#line 542 "./util/configlexer.lex"
++#line 548 "./util/configlexer.lex"
  { LEXOUT(("NL\n")); cfg_parser->line++;}
  	YY_BREAK
 -case 286:
 +case 292:
  YY_RULE_SETUP
- #line 550 "./util/configlexer.lex"
 -#line 543 "./util/configlexer.lex"
++#line 549 "./util/configlexer.lex"
  { LEXOUT(("IQS ")); BEGIN(include_quoted); }
  	YY_BREAK
 -case 287:
 +case 293:
  YY_RULE_SETUP
- #line 551 "./util/configlexer.lex"
 -#line 544 "./util/configlexer.lex"
++#line 550 "./util/configlexer.lex"
  {
  	LEXOUT(("Iunquotedstr(%s) ", yytext));
  	config_start_include_glob(yytext);
@@@ -4706,27 -4643,27 +4705,27 @@@
  }
  	YY_BREAK
  case YY_STATE_EOF(include_quoted):
- #line 556 "./util/configlexer.lex"
 -#line 549 "./util/configlexer.lex"
++#line 555 "./util/configlexer.lex"
  {
          yyerror("EOF inside quoted string");
          BEGIN(inc_prev);
  }
  	YY_BREAK
 -case 288:
 +case 294:
  YY_RULE_SETUP
- #line 560 "./util/configlexer.lex"
 -#line 553 "./util/configlexer.lex"
++#line 559 "./util/configlexer.lex"
  { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
  	YY_BREAK
 -case 289:
 -/* rule 289 can match eol */
 +case 295:
 +/* rule 295 can match eol */
  YY_RULE_SETUP
- #line 561 "./util/configlexer.lex"
 -#line 554 "./util/configlexer.lex"
++#line 560 "./util/configlexer.lex"
  { yyerror("newline before \" in include name"); 
  				  cfg_parser->line++; BEGIN(inc_prev); }
  	YY_BREAK
 -case 290:
 +case 296:
  YY_RULE_SETUP
- #line 563 "./util/configlexer.lex"
 -#line 556 "./util/configlexer.lex"
++#line 562 "./util/configlexer.lex"
  {
  	LEXOUT(("IQE "));
  	yytext[yyleng - 1] = '\0';
@@@ -4736,7 -4673,7 +4735,7 @@@
  	YY_BREAK
  case YY_STATE_EOF(INITIAL):
  case YY_STATE_EOF(val):
- #line 569 "./util/configlexer.lex"
 -#line 562 "./util/configlexer.lex"
++#line 568 "./util/configlexer.lex"
  {
  	LEXOUT(("LEXEOF "));
  	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@@ -4748,33 -4685,33 +4747,33 @@@
  	}
  }
  	YY_BREAK
 -case 291:
 +case 297:
  YY_RULE_SETUP
- #line 580 "./util/configlexer.lex"
 -#line 573 "./util/configlexer.lex"
++#line 579 "./util/configlexer.lex"
  { LEXOUT(("unquotedstr(%s) ", yytext)); 
  			if(--num_args == 0) { BEGIN(INITIAL); }
  			yylval.str = strdup(yytext); return STRING_ARG; }
  	YY_BREAK
 -case 292:
 +case 298:
  YY_RULE_SETUP
- #line 584 "./util/configlexer.lex"
 -#line 577 "./util/configlexer.lex"
++#line 583 "./util/configlexer.lex"
  {
  	ub_c_error_msg("unknown keyword '%s'", yytext);
  	}
  	YY_BREAK
 -case 293:
 +case 299:
  YY_RULE_SETUP
- #line 588 "./util/configlexer.lex"
 -#line 581 "./util/configlexer.lex"
++#line 587 "./util/configlexer.lex"
  {
  	ub_c_error_msg("stray '%s'", yytext);
  	}
  	YY_BREAK
 -case 294:
 +case 300:
  YY_RULE_SETUP
- #line 592 "./util/configlexer.lex"
 -#line 585 "./util/configlexer.lex"
++#line 591 "./util/configlexer.lex"
  ECHO;
  	YY_BREAK
- #line 4776 "<stdout>"
 -#line 4712 "<stdout>"
++#line 4775 "<stdout>"
  
  	case YY_END_OF_BUFFER:
  		{
@@@ -5740,6 -5677,6 +5739,6 @@@ void yyfree (void * ptr 
  
  #define YYTABLES_NAME "yytables"
  
- #line 592 "./util/configlexer.lex"
 -#line 585 "./util/configlexer.lex"
++#line 591 "./util/configlexer.lex"
  
  
diff --cc util/configparser.c
index b141a052b,fda5d0ab6..b59e42b17
--- a/util/configparser.c
+++ b/util/configparser.c
@@@ -1027,64 -1012,62 +1027,64 @@@ static const yytype_uint16 yytranslate[
    /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
  static const yytype_uint16 yyrline[] =
  {
 -       0,   173,   173,   173,   174,   174,   175,   175,   176,   176,
 -     176,   177,   177,   178,   178,   182,   187,   188,   189,   189,
 -     189,   190,   190,   191,   191,   192,   192,   193,   193,   193,
 -     194,   194,   195,   195,   195,   196,   196,   196,   197,   197,
 -     198,   198,   199,   199,   200,   200,   201,   201,   202,   202,
 -     203,   203,   204,   204,   205,   205,   205,   206,   206,   206,
 -     207,   207,   207,   208,   208,   209,   209,   210,   210,   211,
 -     211,   212,   212,   212,   213,   213,   214,   214,   215,   215,
 -     215,   216,   216,   217,   217,   218,   218,   219,   219,   219,
 -     220,   220,   221,   221,   222,   222,   223,   223,   224,   224,
 -     225,   225,   225,   226,   226,   227,   227,   227,   228,   228,
 -     228,   229,   229,   229,   230,   230,   230,   230,   231,   232,
 -     232,   232,   233,   233,   233,   234,   234,   235,   235,   236,
 -     236,   236,   237,   237,   238,   238,   238,   239,   239,   240,
 -     240,   241,   242,   242,   243,   243,   244,   244,   245,   246,
 -     246,   247,   247,   248,   248,   249,   249,   250,   250,   251,
 -     251,   251,   252,   252,   253,   253,   254,   254,   255,   255,
 -     256,   256,   257,   257,   257,   258,   258,   258,   259,   259,
 -     259,   260,   260,   261,   262,   262,   263,   263,   264,   264,
 -     265,   265,   266,   266,   266,   267,   267,   267,   268,   268,
 -     268,   269,   269,   270,   270,   271,   271,   273,   285,   286,
 -     287,   287,   287,   287,   287,   288,   288,   290,   302,   303,
 -     304,   304,   304,   304,   305,   305,   307,   321,   322,   323,
 -     323,   323,   323,   324,   324,   324,   326,   342,   343,   344,
 -     344,   344,   344,   345,   345,   345,   346,   348,   357,   366,
 -     377,   386,   395,   404,   415,   424,   436,   450,   465,   476,
 -     493,   510,   527,   544,   559,   574,   587,   602,   611,   620,
 -     629,   638,   647,   656,   665,   674,   683,   692,   701,   710,
 -     719,   732,   741,   754,   763,   772,   781,   788,   795,   804,
 -     811,   820,   828,   835,   842,   850,   859,   868,   882,   891,
 -     900,   909,   918,   927,   936,   943,   950,   976,   984,   991,
 -     998,  1005,  1012,  1020,  1028,  1036,  1043,  1054,  1065,  1072,
 -    1081,  1090,  1099,  1106,  1113,  1121,  1129,  1139,  1149,  1159,
 -    1167,  1180,  1191,  1199,  1212,  1221,  1230,  1239,  1249,  1259,
 -    1267,  1280,  1289,  1297,  1306,  1314,  1327,  1336,  1343,  1353,
 -    1363,  1373,  1383,  1393,  1403,  1413,  1423,  1430,  1437,  1444,
 -    1453,  1462,  1471,  1480,  1487,  1497,  1517,  1524,  1542,  1555,
 -    1568,  1577,  1586,  1595,  1604,  1614,  1624,  1635,  1644,  1653,
 -    1662,  1671,  1684,  1697,  1706,  1713,  1722,  1731,  1740,  1749,
 -    1757,  1770,  1778,  1819,  1826,  1841,  1851,  1861,  1868,  1875,
 -    1882,  1891,  1899,  1913,  1934,  1955,  1967,  1979,  1991,  2000,
 -    2021,  2031,  2040,  2048,  2056,  2069,  2082,  2097,  2112,  2121,
 -    2130,  2136,  2145,  2154,  2164,  2174,  2187,  2200,  2212,  2226,
 -    2238,  2252,  2262,  2269,  2276,  2285,  2294,  2304,  2314,  2324,
 -    2331,  2338,  2347,  2356,  2366,  2376,  2383,  2390,  2397,  2405,
 -    2415,  2425,  2435,  2445,  2484,  2494,  2502,  2510,  2525,  2534,
 -    2539,  2540,  2541,  2541,  2541,  2542,  2542,  2542,  2543,  2543,
 -    2545,  2555,  2564,  2571,  2578,  2585,  2592,  2599,  2606,  2611,
 -    2612,  2613,  2613,  2614,  2614,  2615,  2615,  2616,  2617,  2618,
 -    2619,  2620,  2621,  2623,  2632,  2639,  2648,  2657,  2664,  2671,
 -    2681,  2691,  2701,  2711,  2721,  2731,  2736,  2737,  2738,  2740,
 -    2746,  2756,  2763,  2772,  2780,  2785,  2786,  2788,  2788,  2788,
 -    2789,  2789,  2790,  2791,  2792,  2793,  2794,  2796,  2806,  2815,
 -    2822,  2831,  2838,  2847,  2855,  2868,  2876,  2889,  2894,  2895,
 -    2896,  2896,  2897,  2897,  2897,  2899,  2914,  2929,  2941,  2956,
 -    2969,  2980,  2985,  2986,  2987,  2987,  2989,  3004
 +       0,   174,   174,   174,   175,   175,   176,   176,   177,   177,
 +     177,   178,   178,   179,   179,   180,   184,   189,   190,   191,
 +     191,   191,   192,   192,   193,   193,   194,   194,   195,   195,
 +     195,   196,   196,   197,   197,   197,   198,   198,   198,   199,
 +     199,   200,   200,   201,   201,   202,   202,   203,   203,   204,
 +     204,   205,   205,   206,   206,   207,   207,   207,   208,   208,
 +     208,   209,   209,   209,   210,   210,   211,   211,   212,   212,
 +     213,   213,   214,   214,   214,   215,   215,   216,   216,   217,
 +     217,   217,   218,   218,   219,   219,   220,   220,   221,   221,
 +     221,   222,   222,   223,   223,   224,   224,   225,   225,   226,
 +     226,   227,   227,   227,   228,   228,   229,   229,   229,   230,
 +     230,   230,   231,   231,   231,   232,   232,   232,   232,   233,
 +     234,   234,   234,   235,   235,   235,   236,   236,   237,   237,
 +     238,   238,   238,   239,   239,   240,   240,   240,   241,   241,
 +     242,   242,   243,   244,   244,   245,   245,   246,   246,   247,
 +     248,   248,   249,   249,   250,   250,   251,   251,   252,   252,
 +     253,   253,   253,   254,   254,   255,   255,   256,   256,   257,
 +     257,   258,   258,   259,   259,   259,   260,   260,   260,   261,
 +     261,   261,   262,   262,   263,   264,   264,   265,   265,   266,
 +     266,   267,   267,   268,   268,   268,   269,   269,   269,   270,
 +     270,   270,   271,   271,   272,   272,   273,   273,   275,   287,
 +     288,   289,   289,   289,   289,   289,   290,   290,   292,   304,
 +     305,   306,   306,   306,   306,   307,   307,   309,   323,   324,
 +     325,   325,   325,   325,   326,   326,   326,   328,   345,   346,
 +     347,   347,   347,   347,   348,   348,   348,   349,   352,   371,
 +     388,   396,   406,   414,   431,   432,   433,   433,   433,   433,
 +     433,   434,   434,   434,   435,   435,   437,   446,   455,   466,
-      475,   484,   493,   504,   513,   524,   537,   552,   563,   580,
-      597,   614,   631,   646,   661,   674,   689,   698,   707,   716,
-      725,   734,   743,   752,   761,   770,   779,   788,   797,   806,
-      819,   828,   841,   850,   859,   868,   875,   882,   891,   898,
-      907,   915,   922,   929,   937,   946,   955,   969,   978,   987,
-      996,  1005,  1014,  1023,  1030,  1037,  1063,  1071,  1078,  1085,
-     1092,  1099,  1107,  1115,  1123,  1130,  1141,  1152,  1159,  1168,
-     1177,  1186,  1193,  1200,  1208,  1216,  1226,  1236,  1246,  1254,
-     1267,  1278,  1286,  1299,  1308,  1317,  1326,  1336,  1346,  1354,
-     1367,  1376,  1384,  1393,  1401,  1414,  1423,  1430,  1440,  1450,
-     1460,  1470,  1480,  1490,  1500,  1510,  1517,  1524,  1531,  1540,
-     1549,  1558,  1567,  1574,  1584,  1604,  1611,  1629,  1642,  1655,
-     1664,  1673,  1682,  1691,  1701,  1711,  1722,  1731,  1740,  1749,
-     1758,  1771,  1784,  1793,  1800,  1809,  1818,  1827,  1836,  1844,
-     1857,  1865,  1906,  1913,  1928,  1938,  1948,  1955,  1962,  1969,
-     1978,  1986,  2000,  2021,  2042,  2054,  2066,  2078,  2087,  2108,
-     2118,  2127,  2135,  2143,  2156,  2169,  2184,  2199,  2208,  2217,
-     2223,  2232,  2241,  2251,  2261,  2274,  2287,  2299,  2313,  2325,
-     2339,  2349,  2356,  2363,  2372,  2381,  2391,  2401,  2411,  2418,
-     2425,  2434,  2443,  2453,  2463,  2470,  2477,  2484,  2492,  2502,
-     2512,  2522,  2532,  2571,  2581,  2589,  2597,  2612,  2621,  2626,
-     2627,  2628,  2628,  2628,  2629,  2629,  2629,  2630,  2630,  2632,
-     2642,  2651,  2658,  2665,  2672,  2679,  2686,  2693,  2698,  2699,
-     2700,  2700,  2701,  2701,  2702,  2702,  2703,  2704,  2705,  2706,
-     2707,  2708,  2710,  2719,  2726,  2735,  2744,  2751,  2758,  2768,
-     2778,  2788,  2798,  2808,  2818,  2823,  2824,  2825,  2827,  2833,
-     2843,  2850,  2859,  2867,  2872,  2873,  2875,  2875,  2875,  2876,
-     2876,  2877,  2878,  2879,  2880,  2881,  2883,  2893,  2902,  2909,
-     2918,  2925,  2934,  2942,  2955,  2963,  2976,  2981,  2982,  2983,
-     2983,  2984,  2984,  2984,  2986,  3001,  3016,  3028,  3043,  3056,
-     3067,  3072,  3073,  3074,  3074,  3076,  3091
++     475,   484,   493,   504,   513,   525,   539,   554,   565,   582,
++     599,   616,   633,   648,   663,   676,   691,   700,   709,   718,
++     727,   736,   745,   754,   763,   772,   781,   790,   799,   808,
++     821,   830,   843,   852,   861,   870,   877,   884,   893,   900,
++     909,   917,   924,   931,   939,   948,   957,   971,   980,   989,
++     998,  1007,  1016,  1025,  1032,  1039,  1065,  1073,  1080,  1087,
++    1094,  1101,  1109,  1117,  1125,  1132,  1143,  1154,  1161,  1170,
++    1179,  1188,  1195,  1202,  1210,  1218,  1228,  1238,  1248,  1256,
++    1269,  1280,  1288,  1301,  1310,  1319,  1328,  1338,  1348,  1356,
++    1369,  1378,  1386,  1395,  1403,  1416,  1425,  1432,  1442,  1452,
++    1462,  1472,  1482,  1492,  1502,  1512,  1519,  1526,  1533,  1542,
++    1551,  1560,  1569,  1576,  1586,  1606,  1613,  1631,  1644,  1657,
++    1666,  1675,  1684,  1693,  1703,  1713,  1724,  1733,  1742,  1751,
++    1760,  1773,  1786,  1795,  1802,  1811,  1820,  1829,  1838,  1846,
++    1859,  1867,  1908,  1915,  1930,  1940,  1950,  1957,  1964,  1971,
++    1980,  1988,  2002,  2023,  2044,  2056,  2068,  2080,  2089,  2110,
++    2120,  2129,  2137,  2145,  2158,  2171,  2186,  2201,  2210,  2219,
++    2225,  2234,  2243,  2253,  2263,  2276,  2289,  2301,  2315,  2327,
++    2341,  2351,  2358,  2365,  2374,  2383,  2393,  2403,  2413,  2420,
++    2427,  2436,  2445,  2455,  2465,  2472,  2479,  2486,  2494,  2504,
++    2514,  2524,  2534,  2573,  2583,  2591,  2599,  2614,  2623,  2628,
++    2629,  2630,  2630,  2630,  2631,  2631,  2631,  2632,  2632,  2634,
++    2644,  2653,  2660,  2667,  2674,  2681,  2688,  2695,  2700,  2701,
++    2702,  2702,  2703,  2703,  2704,  2704,  2705,  2706,  2707,  2708,
++    2709,  2710,  2712,  2721,  2728,  2737,  2746,  2753,  2760,  2770,
++    2780,  2790,  2800,  2810,  2820,  2825,  2826,  2827,  2829,  2835,
++    2845,  2852,  2861,  2869,  2874,  2875,  2877,  2877,  2877,  2878,
++    2878,  2879,  2880,  2881,  2882,  2883,  2885,  2895,  2904,  2911,
++    2920,  2927,  2936,  2944,  2957,  2965,  2978,  2983,  2984,  2985,
++    2985,  2986,  2986,  2986,  2988,  3003,  3018,  3030,  3045,  3058,
++    3069,  3074,  3075,  3076,  3076,  3078,  3093
  };
  #endif
  
@@@ -2915,13 -2790,14 +2915,14 @@@ yyreduce
  			fatal_exit("out of memory adding client-subnet");
  	#else
  		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+ 		free((yyvsp[0].str));
  	#endif
  	}
- #line 2921 "util/configparser.c" /* yacc.c:1646  */
 -#line 2797 "util/configparser.c"
++#line 2922 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 256:
 -#line 437 "./util/configparser.y"
 +  case 275:
- #line 525 "./util/configparser.y" /* yacc.c:1646  */
++#line 526 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(server_client_subnet_zone:%s)\n", (yyvsp[0].str)));
@@@ -2930,13 -2806,14 +2931,14 @@@
  			fatal_exit("out of memory adding client-subnet-zone");
  	#else
  		OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
+ 		free((yyvsp[0].str));
  	#endif
  	}
- #line 2936 "util/configparser.c" /* yacc.c:1646  */
 -#line 2813 "util/configparser.c"
++#line 2938 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 257:
 -#line 451 "./util/configparser.y"
 +  case 276:
- #line 538 "./util/configparser.y" /* yacc.c:1646  */
++#line 540 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(server_client_subnet_always_forward:%s)\n", (yyvsp[0].str)));
@@@ -2950,11 -2827,11 +2952,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 2954 "util/configparser.c" /* yacc.c:1646  */
 -#line 2831 "util/configparser.c"
++#line 2956 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 258:
 -#line 466 "./util/configparser.y"
 +  case 277:
- #line 553 "./util/configparser.y" /* yacc.c:1646  */
++#line 555 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(client_subnet_opcode:%s)\n", (yyvsp[0].str)));
@@@ -2964,11 -2841,11 +2966,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 2968 "util/configparser.c" /* yacc.c:1646  */
 -#line 2845 "util/configparser.c"
++#line 2970 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 259:
 -#line 477 "./util/configparser.y"
 +  case 278:
- #line 564 "./util/configparser.y" /* yacc.c:1646  */
++#line 566 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(max_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@@ -2984,11 -2861,11 +2986,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 2988 "util/configparser.c" /* yacc.c:1646  */
 -#line 2865 "util/configparser.c"
++#line 2990 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 260:
 -#line 494 "./util/configparser.y"
 +  case 279:
- #line 581 "./util/configparser.y" /* yacc.c:1646  */
++#line 583 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(max_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@@ -3004,11 -2881,11 +3006,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 3008 "util/configparser.c" /* yacc.c:1646  */
 -#line 2885 "util/configparser.c"
++#line 3010 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 261:
 -#line 511 "./util/configparser.y"
 +  case 280:
- #line 598 "./util/configparser.y" /* yacc.c:1646  */
++#line 600 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(min_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@@ -3024,11 -2901,11 +3026,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 3028 "util/configparser.c" /* yacc.c:1646  */
 -#line 2905 "util/configparser.c"
++#line 3030 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 262:
 -#line 528 "./util/configparser.y"
 +  case 281:
- #line 615 "./util/configparser.y" /* yacc.c:1646  */
++#line 617 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(min_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@@ -3044,11 -2921,11 +3046,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 3048 "util/configparser.c" /* yacc.c:1646  */
 -#line 2925 "util/configparser.c"
++#line 3050 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 263:
 -#line 545 "./util/configparser.y"
 +  case 282:
- #line 632 "./util/configparser.y" /* yacc.c:1646  */
++#line 634 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(max_ecs_tree_size_ipv4:%s)\n", (yyvsp[0].str)));
@@@ -3062,11 -2939,11 +3064,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 3066 "util/configparser.c" /* yacc.c:1646  */
 -#line 2943 "util/configparser.c"
++#line 3068 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 264:
 -#line 560 "./util/configparser.y"
 +  case 283:
- #line 647 "./util/configparser.y" /* yacc.c:1646  */
++#line 649 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef CLIENT_SUBNET
  		OUTYY(("P(max_ecs_tree_size_ipv6:%s)\n", (yyvsp[0].str)));
@@@ -3080,11 -2957,11 +3082,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 3084 "util/configparser.c" /* yacc.c:1646  */
 -#line 2961 "util/configparser.c"
++#line 3086 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 265:
 -#line 575 "./util/configparser.y"
 +  case 284:
- #line 662 "./util/configparser.y" /* yacc.c:1646  */
++#line 664 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_interface:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->num_ifs == 0)
@@@ -3096,11 -2973,11 +3098,11 @@@
  		else
  			cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = (yyvsp[0].str);
  	}
- #line 3100 "util/configparser.c" /* yacc.c:1646  */
 -#line 2977 "util/configparser.c"
++#line 3102 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 266:
 -#line 588 "./util/configparser.y"
 +  case 285:
- #line 675 "./util/configparser.y" /* yacc.c:1646  */
++#line 677 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->num_out_ifs == 0)
@@@ -3114,11 -2991,11 +3116,11 @@@
  			cfg_parser->cfg->out_ifs[
  				cfg_parser->cfg->num_out_ifs++] = (yyvsp[0].str);
  	}
- #line 3118 "util/configparser.c" /* yacc.c:1646  */
 -#line 2995 "util/configparser.c"
++#line 3120 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 267:
 -#line 603 "./util/configparser.y"
 +  case 286:
- #line 690 "./util/configparser.y" /* yacc.c:1646  */
++#line 692 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3126,11 -3003,11 +3128,11 @@@
  		else cfg_parser->cfg->outgoing_num_ports = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3130 "util/configparser.c" /* yacc.c:1646  */
 -#line 3007 "util/configparser.c"
++#line 3132 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 268:
 -#line 612 "./util/configparser.y"
 +  case 287:
- #line 699 "./util/configparser.y" /* yacc.c:1646  */
++#line 701 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[0].str)));
  		if(!cfg_mark_ports((yyvsp[0].str), 1, 
@@@ -3138,11 -3015,11 +3140,11 @@@
  			yyerror("port number or range (\"low-high\") expected");
  		free((yyvsp[0].str));
  	}
- #line 3142 "util/configparser.c" /* yacc.c:1646  */
 -#line 3019 "util/configparser.c"
++#line 3144 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 269:
 -#line 621 "./util/configparser.y"
 +  case 288:
- #line 708 "./util/configparser.y" /* yacc.c:1646  */
++#line 710 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[0].str)));
  		if(!cfg_mark_ports((yyvsp[0].str), 0, 
@@@ -3150,11 -3027,11 +3152,11 @@@
  			yyerror("port number or range (\"low-high\") expected");
  		free((yyvsp[0].str));
  	}
- #line 3154 "util/configparser.c" /* yacc.c:1646  */
 -#line 3031 "util/configparser.c"
++#line 3156 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 270:
 -#line 630 "./util/configparser.y"
 +  case 289:
- #line 717 "./util/configparser.y" /* yacc.c:1646  */
++#line 719 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3162,11 -3039,11 +3164,11 @@@
  		else cfg_parser->cfg->outgoing_num_tcp = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3166 "util/configparser.c" /* yacc.c:1646  */
 -#line 3043 "util/configparser.c"
++#line 3168 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 271:
 -#line 639 "./util/configparser.y"
 +  case 290:
- #line 726 "./util/configparser.y" /* yacc.c:1646  */
++#line 728 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3174,11 -3051,11 +3176,11 @@@
  		else cfg_parser->cfg->incoming_num_tcp = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3178 "util/configparser.c" /* yacc.c:1646  */
 -#line 3055 "util/configparser.c"
++#line 3180 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 272:
 -#line 648 "./util/configparser.y"
 +  case 291:
- #line 735 "./util/configparser.y" /* yacc.c:1646  */
++#line 737 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3186,11 -3063,11 +3188,11 @@@
  		else cfg_parser->cfg->if_automatic = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3190 "util/configparser.c" /* yacc.c:1646  */
 -#line 3067 "util/configparser.c"
++#line 3192 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 273:
 -#line 657 "./util/configparser.y"
 +  case 292:
- #line 744 "./util/configparser.y" /* yacc.c:1646  */
++#line 746 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3198,11 -3075,11 +3200,11 @@@
  		else cfg_parser->cfg->do_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3202 "util/configparser.c" /* yacc.c:1646  */
 -#line 3079 "util/configparser.c"
++#line 3204 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 274:
 -#line 666 "./util/configparser.y"
 +  case 293:
- #line 753 "./util/configparser.y" /* yacc.c:1646  */
++#line 755 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3210,11 -3087,11 +3212,11 @@@
  		else cfg_parser->cfg->do_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3214 "util/configparser.c" /* yacc.c:1646  */
 -#line 3091 "util/configparser.c"
++#line 3216 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 275:
 -#line 675 "./util/configparser.y"
 +  case 294:
- #line 762 "./util/configparser.y" /* yacc.c:1646  */
++#line 764 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3222,11 -3099,11 +3224,11 @@@
  		else cfg_parser->cfg->do_udp = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3226 "util/configparser.c" /* yacc.c:1646  */
 -#line 3103 "util/configparser.c"
++#line 3228 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 276:
 -#line 684 "./util/configparser.y"
 +  case 295:
- #line 771 "./util/configparser.y" /* yacc.c:1646  */
++#line 773 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3234,11 -3111,11 +3236,11 @@@
  		else cfg_parser->cfg->do_tcp = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3238 "util/configparser.c" /* yacc.c:1646  */
 -#line 3115 "util/configparser.c"
++#line 3240 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 277:
 -#line 693 "./util/configparser.y"
 +  case 296:
- #line 780 "./util/configparser.y" /* yacc.c:1646  */
++#line 782 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_prefer_ip6:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3246,11 -3123,11 +3248,11 @@@
  		else cfg_parser->cfg->prefer_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3250 "util/configparser.c" /* yacc.c:1646  */
 -#line 3127 "util/configparser.c"
++#line 3252 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 278:
 -#line 702 "./util/configparser.y"
 +  case 297:
- #line 789 "./util/configparser.y" /* yacc.c:1646  */
++#line 791 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_mss:%s)\n", (yyvsp[0].str)));
                  if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3258,11 -3135,11 +3260,11 @@@
                  else cfg_parser->cfg->tcp_mss = atoi((yyvsp[0].str));
                  free((yyvsp[0].str));
  	}
- #line 3262 "util/configparser.c" /* yacc.c:1646  */
 -#line 3139 "util/configparser.c"
++#line 3264 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 279:
 -#line 711 "./util/configparser.y"
 +  case 298:
- #line 798 "./util/configparser.y" /* yacc.c:1646  */
++#line 800 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3270,11 -3147,11 +3272,11 @@@
  		else cfg_parser->cfg->outgoing_tcp_mss = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3274 "util/configparser.c" /* yacc.c:1646  */
 -#line 3151 "util/configparser.c"
++#line 3276 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 280:
 -#line 720 "./util/configparser.y"
 +  case 299:
- #line 807 "./util/configparser.y" /* yacc.c:1646  */
++#line 809 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_idle_timeout:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3286,11 -3163,11 +3288,11 @@@
  		else cfg_parser->cfg->tcp_idle_timeout = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3290 "util/configparser.c" /* yacc.c:1646  */
 -#line 3167 "util/configparser.c"
++#line 3292 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 281:
 -#line 733 "./util/configparser.y"
 +  case 300:
- #line 820 "./util/configparser.y" /* yacc.c:1646  */
++#line 822 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_keepalive:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3298,11 -3175,11 +3300,11 @@@
  		else cfg_parser->cfg->do_tcp_keepalive = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3302 "util/configparser.c" /* yacc.c:1646  */
 -#line 3179 "util/configparser.c"
++#line 3304 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 282:
 -#line 742 "./util/configparser.y"
 +  case 301:
- #line 829 "./util/configparser.y" /* yacc.c:1646  */
++#line 831 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_keepalive_timeout:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3314,11 -3191,11 +3316,11 @@@
  		else cfg_parser->cfg->tcp_keepalive_timeout = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3318 "util/configparser.c" /* yacc.c:1646  */
 -#line 3195 "util/configparser.c"
++#line 3320 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 283:
 -#line 755 "./util/configparser.y"
 +  case 302:
- #line 842 "./util/configparser.y" /* yacc.c:1646  */
++#line 844 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3326,11 -3203,11 +3328,11 @@@
  		else cfg_parser->cfg->tcp_upstream = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3330 "util/configparser.c" /* yacc.c:1646  */
 -#line 3207 "util/configparser.c"
++#line 3332 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 284:
 -#line 764 "./util/configparser.y"
 +  case 303:
- #line 851 "./util/configparser.y" /* yacc.c:1646  */
++#line 853 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_udp_upstream_without_downstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3338,11 -3215,11 +3340,11 @@@
  		else cfg_parser->cfg->udp_upstream_without_downstream = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3342 "util/configparser.c" /* yacc.c:1646  */
 -#line 3219 "util/configparser.c"
++#line 3344 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 285:
 -#line 773 "./util/configparser.y"
 +  case 304:
- #line 860 "./util/configparser.y" /* yacc.c:1646  */
++#line 862 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3350,31 -3227,31 +3352,31 @@@
  		else cfg_parser->cfg->ssl_upstream = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3354 "util/configparser.c" /* yacc.c:1646  */
 -#line 3231 "util/configparser.c"
++#line 3356 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 286:
 -#line 782 "./util/configparser.y"
 +  case 305:
- #line 869 "./util/configparser.y" /* yacc.c:1646  */
++#line 871 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->ssl_service_key);
  		cfg_parser->cfg->ssl_service_key = (yyvsp[0].str);
  	}
- #line 3364 "util/configparser.c" /* yacc.c:1646  */
 -#line 3241 "util/configparser.c"
++#line 3366 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 287:
 -#line 789 "./util/configparser.y"
 +  case 306:
- #line 876 "./util/configparser.y" /* yacc.c:1646  */
++#line 878 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->ssl_service_pem);
  		cfg_parser->cfg->ssl_service_pem = (yyvsp[0].str);
  	}
- #line 3374 "util/configparser.c" /* yacc.c:1646  */
 -#line 3251 "util/configparser.c"
++#line 3376 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 288:
 -#line 796 "./util/configparser.y"
 +  case 307:
- #line 883 "./util/configparser.y" /* yacc.c:1646  */
++#line 885 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3382,21 -3259,21 +3384,21 @@@
  		else cfg_parser->cfg->ssl_port = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3386 "util/configparser.c" /* yacc.c:1646  */
 -#line 3263 "util/configparser.c"
++#line 3388 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 289:
 -#line 805 "./util/configparser.y"
 +  case 308:
- #line 892 "./util/configparser.y" /* yacc.c:1646  */
++#line 894 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->tls_cert_bundle);
  		cfg_parser->cfg->tls_cert_bundle = (yyvsp[0].str);
  	}
- #line 3396 "util/configparser.c" /* yacc.c:1646  */
 -#line 3273 "util/configparser.c"
++#line 3398 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 290:
 -#line 812 "./util/configparser.y"
 +  case 309:
- #line 899 "./util/configparser.y" /* yacc.c:1646  */
++#line 901 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_win_cert:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3404,53 -3281,53 +3406,53 @@@
  		else cfg_parser->cfg->tls_win_cert = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3408 "util/configparser.c" /* yacc.c:1646  */
 -#line 3285 "util/configparser.c"
++#line 3410 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 291:
 -#line 821 "./util/configparser.y"
 +  case 310:
- #line 908 "./util/configparser.y" /* yacc.c:1646  */
++#line 910 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_additional_port:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->tls_additional_port,
  			(yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3419 "util/configparser.c" /* yacc.c:1646  */
 -#line 3296 "util/configparser.c"
++#line 3421 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 292:
 -#line 829 "./util/configparser.y"
 +  case 311:
- #line 916 "./util/configparser.y" /* yacc.c:1646  */
++#line 918 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_ciphers:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->tls_ciphers);
  		cfg_parser->cfg->tls_ciphers = (yyvsp[0].str);
  	}
- #line 3429 "util/configparser.c" /* yacc.c:1646  */
 -#line 3306 "util/configparser.c"
++#line 3431 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 293:
 -#line 836 "./util/configparser.y"
 +  case 312:
- #line 923 "./util/configparser.y" /* yacc.c:1646  */
++#line 925 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_ciphersuites:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->tls_ciphersuites);
  		cfg_parser->cfg->tls_ciphersuites = (yyvsp[0].str);
  	}
- #line 3439 "util/configparser.c" /* yacc.c:1646  */
 -#line 3316 "util/configparser.c"
++#line 3441 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 294:
 -#line 843 "./util/configparser.y"
 +  case 313:
- #line 930 "./util/configparser.y" /* yacc.c:1646  */
++#line 932 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tls_session_ticket_keys:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_append(&cfg_parser->cfg->tls_session_ticket_keys,
  			(yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3450 "util/configparser.c" /* yacc.c:1646  */
 -#line 3327 "util/configparser.c"
++#line 3452 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 295:
 -#line 851 "./util/configparser.y"
 +  case 314:
- #line 938 "./util/configparser.y" /* yacc.c:1646  */
++#line 940 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_use_systemd:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3458,11 -3335,11 +3460,11 @@@
  		else cfg_parser->cfg->use_systemd = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3462 "util/configparser.c" /* yacc.c:1646  */
 -#line 3339 "util/configparser.c"
++#line 3464 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 296:
 -#line 860 "./util/configparser.y"
 +  case 315:
- #line 947 "./util/configparser.y" /* yacc.c:1646  */
++#line 949 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3470,11 -3347,11 +3472,11 @@@
  		else cfg_parser->cfg->do_daemonize = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3474 "util/configparser.c" /* yacc.c:1646  */
 -#line 3351 "util/configparser.c"
++#line 3476 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 297:
 -#line 869 "./util/configparser.y"
 +  case 316:
- #line 956 "./util/configparser.y" /* yacc.c:1646  */
++#line 958 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3487,11 -3364,11 +3489,11 @@@
  #endif
  		free((yyvsp[0].str));
  	}
- #line 3491 "util/configparser.c" /* yacc.c:1646  */
 -#line 3368 "util/configparser.c"
++#line 3493 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 298:
 -#line 883 "./util/configparser.y"
 +  case 317:
- #line 970 "./util/configparser.y" /* yacc.c:1646  */
++#line 972 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3499,11 -3376,11 +3501,11 @@@
  		else cfg_parser->cfg->log_time_ascii = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3503 "util/configparser.c" /* yacc.c:1646  */
 -#line 3380 "util/configparser.c"
++#line 3505 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 299:
 -#line 892 "./util/configparser.y"
 +  case 318:
- #line 979 "./util/configparser.y" /* yacc.c:1646  */
++#line 981 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3511,11 -3388,11 +3513,11 @@@
  		else cfg_parser->cfg->log_queries = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3515 "util/configparser.c" /* yacc.c:1646  */
 -#line 3392 "util/configparser.c"
++#line 3517 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 300:
 -#line 901 "./util/configparser.y"
 +  case 319:
- #line 988 "./util/configparser.y" /* yacc.c:1646  */
++#line 990 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(server_log_replies:%s)\n", (yyvsp[0].str)));
    	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3523,11 -3400,11 +3525,11 @@@
    	else cfg_parser->cfg->log_replies = (strcmp((yyvsp[0].str), "yes")==0);
    	free((yyvsp[0].str));
    }
- #line 3527 "util/configparser.c" /* yacc.c:1646  */
 -#line 3404 "util/configparser.c"
++#line 3529 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 301:
 -#line 910 "./util/configparser.y"
 +  case 320:
- #line 997 "./util/configparser.y" /* yacc.c:1646  */
++#line 999 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(server_log_tag_queryreply:%s)\n", (yyvsp[0].str)));
    	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3535,11 -3412,11 +3537,11 @@@
    	else cfg_parser->cfg->log_tag_queryreply = (strcmp((yyvsp[0].str), "yes")==0);
    	free((yyvsp[0].str));
    }
- #line 3539 "util/configparser.c" /* yacc.c:1646  */
 -#line 3416 "util/configparser.c"
++#line 3541 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 302:
 -#line 919 "./util/configparser.y"
 +  case 321:
- #line 1006 "./util/configparser.y" /* yacc.c:1646  */
++#line 1008 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_log_servfail:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3547,11 -3424,11 +3549,11 @@@
  		else cfg_parser->cfg->log_servfail = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3551 "util/configparser.c" /* yacc.c:1646  */
 -#line 3428 "util/configparser.c"
++#line 3553 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 303:
 -#line 928 "./util/configparser.y"
 +  case 322:
- #line 1015 "./util/configparser.y" /* yacc.c:1646  */
++#line 1017 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(server_log_local_actions:%s)\n", (yyvsp[0].str)));
    	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3559,31 -3436,31 +3561,31 @@@
    	else cfg_parser->cfg->log_local_actions = (strcmp((yyvsp[0].str), "yes")==0);
    	free((yyvsp[0].str));
    }
- #line 3563 "util/configparser.c" /* yacc.c:1646  */
 -#line 3440 "util/configparser.c"
++#line 3565 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 304:
 -#line 937 "./util/configparser.y"
 +  case 323:
- #line 1024 "./util/configparser.y" /* yacc.c:1646  */
++#line 1026 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_chroot:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->chrootdir);
  		cfg_parser->cfg->chrootdir = (yyvsp[0].str);
  	}
- #line 3573 "util/configparser.c" /* yacc.c:1646  */
 -#line 3450 "util/configparser.c"
++#line 3575 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 305:
 -#line 944 "./util/configparser.y"
 +  case 324:
- #line 1031 "./util/configparser.y" /* yacc.c:1646  */
++#line 1033 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_username:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->username);
  		cfg_parser->cfg->username = (yyvsp[0].str);
  	}
- #line 3583 "util/configparser.c" /* yacc.c:1646  */
 -#line 3460 "util/configparser.c"
++#line 3585 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 306:
 -#line 951 "./util/configparser.y"
 +  case 325:
- #line 1038 "./util/configparser.y" /* yacc.c:1646  */
++#line 1040 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_directory:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->directory);
@@@ -3608,105 -3485,105 +3610,105 @@@
  			}
  		}
  	}
- #line 3612 "util/configparser.c" /* yacc.c:1646  */
 -#line 3489 "util/configparser.c"
++#line 3614 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 307:
 -#line 977 "./util/configparser.y"
 +  case 326:
- #line 1064 "./util/configparser.y" /* yacc.c:1646  */
++#line 1066 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_logfile:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->logfile);
  		cfg_parser->cfg->logfile = (yyvsp[0].str);
  		cfg_parser->cfg->use_syslog = 0;
  	}
- #line 3623 "util/configparser.c" /* yacc.c:1646  */
 -#line 3500 "util/configparser.c"
++#line 3625 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 308:
 -#line 985 "./util/configparser.y"
 +  case 327:
- #line 1072 "./util/configparser.y" /* yacc.c:1646  */
++#line 1074 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->pidfile);
  		cfg_parser->cfg->pidfile = (yyvsp[0].str);
  	}
- #line 3633 "util/configparser.c" /* yacc.c:1646  */
 -#line 3510 "util/configparser.c"
++#line 3635 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 309:
 -#line 992 "./util/configparser.y"
 +  case 328:
- #line 1079 "./util/configparser.y" /* yacc.c:1646  */
++#line 1081 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3643 "util/configparser.c" /* yacc.c:1646  */
 -#line 3520 "util/configparser.c"
++#line 3645 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 310:
 -#line 999 "./util/configparser.y"
 +  case 329:
- #line 1086 "./util/configparser.y" /* yacc.c:1646  */
++#line 1088 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dlv_anchor_file);
  		cfg_parser->cfg->dlv_anchor_file = (yyvsp[0].str);
  	}
- #line 3653 "util/configparser.c" /* yacc.c:1646  */
 -#line 3530 "util/configparser.c"
++#line 3655 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 311:
 -#line 1006 "./util/configparser.y"
 +  case 330:
- #line 1093 "./util/configparser.y" /* yacc.c:1646  */
++#line 1095 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3663 "util/configparser.c" /* yacc.c:1646  */
 -#line 3540 "util/configparser.c"
++#line 3665 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 312:
 -#line 1013 "./util/configparser.y"
 +  case 331:
- #line 1100 "./util/configparser.y" /* yacc.c:1646  */
++#line 1102 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->
  			auto_trust_anchor_file_list, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3674 "util/configparser.c" /* yacc.c:1646  */
 -#line 3551 "util/configparser.c"
++#line 3676 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 313:
 -#line 1021 "./util/configparser.y"
 +  case 332:
- #line 1108 "./util/configparser.y" /* yacc.c:1646  */
++#line 1110 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->
  			trust_anchor_file_list, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3685 "util/configparser.c" /* yacc.c:1646  */
 -#line 3562 "util/configparser.c"
++#line 3687 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 314:
 -#line 1029 "./util/configparser.y"
 +  case 333:
- #line 1116 "./util/configparser.y" /* yacc.c:1646  */
++#line 1118 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->
  			trusted_keys_file_list, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3696 "util/configparser.c" /* yacc.c:1646  */
 -#line 3573 "util/configparser.c"
++#line 3698 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 315:
 -#line 1037 "./util/configparser.y"
 +  case 334:
- #line 1124 "./util/configparser.y" /* yacc.c:1646  */
++#line 1126 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3706 "util/configparser.c" /* yacc.c:1646  */
 -#line 3583 "util/configparser.c"
++#line 3708 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 316:
 -#line 1044 "./util/configparser.y"
 +  case 335:
- #line 1131 "./util/configparser.y" /* yacc.c:1646  */
++#line 1133 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_trust_anchor_signaling:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3716,11 -3593,11 +3718,11 @@@
  				(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3720 "util/configparser.c" /* yacc.c:1646  */
 -#line 3597 "util/configparser.c"
++#line 3722 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 317:
 -#line 1055 "./util/configparser.y"
 +  case 336:
- #line 1142 "./util/configparser.y" /* yacc.c:1646  */
++#line 1144 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_root_key_sentinel:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3730,21 -3607,21 +3732,21 @@@
  				(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3734 "util/configparser.c" /* yacc.c:1646  */
 -#line 3611 "util/configparser.c"
++#line 3736 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 318:
 -#line 1066 "./util/configparser.y"
 +  case 337:
- #line 1153 "./util/configparser.y" /* yacc.c:1646  */
++#line 1155 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 3744 "util/configparser.c" /* yacc.c:1646  */
 -#line 3621 "util/configparser.c"
++#line 3746 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 319:
 -#line 1073 "./util/configparser.y"
 +  case 338:
- #line 1160 "./util/configparser.y" /* yacc.c:1646  */
++#line 1162 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3752,11 -3629,11 +3754,11 @@@
  		else cfg_parser->cfg->hide_identity = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3756 "util/configparser.c" /* yacc.c:1646  */
 -#line 3633 "util/configparser.c"
++#line 3758 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 320:
 -#line 1082 "./util/configparser.y"
 +  case 339:
- #line 1169 "./util/configparser.y" /* yacc.c:1646  */
++#line 1171 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3764,11 -3641,11 +3766,11 @@@
  		else cfg_parser->cfg->hide_version = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3768 "util/configparser.c" /* yacc.c:1646  */
 -#line 3645 "util/configparser.c"
++#line 3770 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 321:
 -#line 1091 "./util/configparser.y"
 +  case 340:
- #line 1178 "./util/configparser.y" /* yacc.c:1646  */
++#line 1180 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_hide_trustanchor:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3776,53 -3653,53 +3778,53 @@@
  		else cfg_parser->cfg->hide_trustanchor = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3780 "util/configparser.c" /* yacc.c:1646  */
 -#line 3657 "util/configparser.c"
++#line 3782 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 322:
 -#line 1100 "./util/configparser.y"
 +  case 341:
- #line 1187 "./util/configparser.y" /* yacc.c:1646  */
++#line 1189 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_identity:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->identity);
  		cfg_parser->cfg->identity = (yyvsp[0].str);
  	}
- #line 3790 "util/configparser.c" /* yacc.c:1646  */
 -#line 3667 "util/configparser.c"
++#line 3792 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 323:
 -#line 1107 "./util/configparser.y"
 +  case 342:
- #line 1194 "./util/configparser.y" /* yacc.c:1646  */
++#line 1196 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_version:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->version);
  		cfg_parser->cfg->version = (yyvsp[0].str);
  	}
- #line 3800 "util/configparser.c" /* yacc.c:1646  */
 -#line 3677 "util/configparser.c"
++#line 3802 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 324:
 -#line 1114 "./util/configparser.y"
 +  case 343:
- #line 1201 "./util/configparser.y" /* yacc.c:1646  */
++#line 1203 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_rcvbuf))
  			yyerror("buffer size expected");
  		free((yyvsp[0].str));
  	}
- #line 3811 "util/configparser.c" /* yacc.c:1646  */
 -#line 3688 "util/configparser.c"
++#line 3813 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 325:
 -#line 1122 "./util/configparser.y"
 +  case 344:
- #line 1209 "./util/configparser.y" /* yacc.c:1646  */
++#line 1211 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_sndbuf))
  			yyerror("buffer size expected");
  		free((yyvsp[0].str));
  	}
- #line 3822 "util/configparser.c" /* yacc.c:1646  */
 -#line 3699 "util/configparser.c"
++#line 3824 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 326:
 -#line 1130 "./util/configparser.y"
 +  case 345:
- #line 1217 "./util/configparser.y" /* yacc.c:1646  */
++#line 1219 "./util/configparser.y" /* yacc.c:1646  */
      {
          OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[0].str)));
          if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3831,11 -3708,11 +3833,11 @@@
              (strcmp((yyvsp[0].str), "yes")==0);
          free((yyvsp[0].str));
      }
- #line 3835 "util/configparser.c" /* yacc.c:1646  */
 -#line 3712 "util/configparser.c"
++#line 3837 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 327:
 -#line 1140 "./util/configparser.y"
 +  case 346:
- #line 1227 "./util/configparser.y" /* yacc.c:1646  */
++#line 1229 "./util/configparser.y" /* yacc.c:1646  */
      {
          OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[0].str)));
          if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3844,11 -3721,11 +3846,11 @@@
              (strcmp((yyvsp[0].str), "yes")==0);
          free((yyvsp[0].str));
      }
- #line 3848 "util/configparser.c" /* yacc.c:1646  */
 -#line 3725 "util/configparser.c"
++#line 3850 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 328:
 -#line 1150 "./util/configparser.y"
 +  case 347:
- #line 1237 "./util/configparser.y" /* yacc.c:1646  */
++#line 1239 "./util/configparser.y" /* yacc.c:1646  */
      {
          OUTYY(("P(server_ip_freebind:%s)\n", (yyvsp[0].str)));
          if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3857,22 -3734,22 +3859,22 @@@
              (strcmp((yyvsp[0].str), "yes")==0);
          free((yyvsp[0].str));
      }
- #line 3861 "util/configparser.c" /* yacc.c:1646  */
 -#line 3738 "util/configparser.c"
++#line 3863 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 329:
 -#line 1160 "./util/configparser.y"
 +  case 348:
- #line 1247 "./util/configparser.y" /* yacc.c:1646  */
++#line 1249 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_stream_wait_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->stream_wait_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 3872 "util/configparser.c" /* yacc.c:1646  */
 -#line 3749 "util/configparser.c"
++#line 3874 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 330:
 -#line 1168 "./util/configparser.y"
 +  case 349:
- #line 1255 "./util/configparser.y" /* yacc.c:1646  */
++#line 1257 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3884,11 -3761,11 +3886,11 @@@
  		else cfg_parser->cfg->edns_buffer_size = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3888 "util/configparser.c" /* yacc.c:1646  */
 -#line 3765 "util/configparser.c"
++#line 3890 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 331:
 -#line 1181 "./util/configparser.y"
 +  case 350:
- #line 1268 "./util/configparser.y" /* yacc.c:1646  */
++#line 1270 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3898,22 -3775,22 +3900,22 @@@
  		else cfg_parser->cfg->msg_buffer_size = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3902 "util/configparser.c" /* yacc.c:1646  */
 -#line 3779 "util/configparser.c"
++#line 3904 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 332:
 -#line 1192 "./util/configparser.y"
 +  case 351:
- #line 1279 "./util/configparser.y" /* yacc.c:1646  */
++#line 1281 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->msg_cache_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 3913 "util/configparser.c" /* yacc.c:1646  */
 -#line 3790 "util/configparser.c"
++#line 3915 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 333:
 -#line 1200 "./util/configparser.y"
 +  case 352:
- #line 1287 "./util/configparser.y" /* yacc.c:1646  */
++#line 1289 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3925,11 -3802,11 +3927,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 3929 "util/configparser.c" /* yacc.c:1646  */
 -#line 3806 "util/configparser.c"
++#line 3931 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 334:
 -#line 1213 "./util/configparser.y"
 +  case 353:
- #line 1300 "./util/configparser.y" /* yacc.c:1646  */
++#line 1302 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -3937,11 -3814,11 +3939,11 @@@
  		else cfg_parser->cfg->num_queries_per_thread = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3941 "util/configparser.c" /* yacc.c:1646  */
 -#line 3818 "util/configparser.c"
++#line 3943 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 335:
 -#line 1222 "./util/configparser.y"
 +  case 354:
- #line 1309 "./util/configparser.y" /* yacc.c:1646  */
++#line 1311 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3949,11 -3826,11 +3951,11 @@@
  		else cfg_parser->cfg->jostle_time = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3953 "util/configparser.c" /* yacc.c:1646  */
 -#line 3830 "util/configparser.c"
++#line 3955 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 336:
 -#line 1231 "./util/configparser.y"
 +  case 355:
- #line 1318 "./util/configparser.y" /* yacc.c:1646  */
++#line 1320 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -3961,11 -3838,11 +3963,11 @@@
  		else cfg_parser->cfg->delay_close = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 3965 "util/configparser.c" /* yacc.c:1646  */
 -#line 3842 "util/configparser.c"
++#line 3967 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 337:
 -#line 1240 "./util/configparser.y"
 +  case 356:
- #line 1327 "./util/configparser.y" /* yacc.c:1646  */
++#line 1329 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3974,11 -3851,11 +3976,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3978 "util/configparser.c" /* yacc.c:1646  */
 -#line 3855 "util/configparser.c"
++#line 3980 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 338:
 -#line 1250 "./util/configparser.y"
 +  case 357:
- #line 1337 "./util/configparser.y" /* yacc.c:1646  */
++#line 1339 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_insecure_lan_zones:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -3987,22 -3864,22 +3989,22 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 3991 "util/configparser.c" /* yacc.c:1646  */
 -#line 3868 "util/configparser.c"
++#line 3993 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 339:
 -#line 1260 "./util/configparser.y"
 +  case 358:
- #line 1347 "./util/configparser.y" /* yacc.c:1646  */
++#line 1349 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->rrset_cache_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 4002 "util/configparser.c" /* yacc.c:1646  */
 -#line 3879 "util/configparser.c"
++#line 4004 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 340:
 -#line 1268 "./util/configparser.y"
 +  case 359:
- #line 1355 "./util/configparser.y" /* yacc.c:1646  */
++#line 1357 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -4014,11 -3891,11 +4016,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4018 "util/configparser.c" /* yacc.c:1646  */
 -#line 3895 "util/configparser.c"
++#line 4020 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 341:
 -#line 1281 "./util/configparser.y"
 +  case 360:
- #line 1368 "./util/configparser.y" /* yacc.c:1646  */
++#line 1370 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4026,22 -3903,22 +4028,22 @@@
  		else cfg_parser->cfg->host_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4030 "util/configparser.c" /* yacc.c:1646  */
 -#line 3907 "util/configparser.c"
++#line 4032 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 342:
 -#line 1290 "./util/configparser.y"
 +  case 361:
- #line 1377 "./util/configparser.y" /* yacc.c:1646  */
++#line 1379 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[0].str)));
  		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
  			"removed, use infra-host-ttl)", (yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4041 "util/configparser.c" /* yacc.c:1646  */
 -#line 3918 "util/configparser.c"
++#line 4043 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 343:
 -#line 1298 "./util/configparser.y"
 +  case 362:
- #line 1385 "./util/configparser.y" /* yacc.c:1646  */
++#line 1387 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -4049,22 -3926,22 +4051,22 @@@
  		else cfg_parser->cfg->infra_cache_numhosts = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4053 "util/configparser.c" /* yacc.c:1646  */
 -#line 3930 "util/configparser.c"
++#line 4055 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 344:
 -#line 1307 "./util/configparser.y"
 +  case 363:
- #line 1394 "./util/configparser.y" /* yacc.c:1646  */
++#line 1396 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[0].str)));
  		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
  			"(option removed, use infra-cache-numhosts)", (yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4064 "util/configparser.c" /* yacc.c:1646  */
 -#line 3941 "util/configparser.c"
++#line 4066 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 345:
 -#line 1315 "./util/configparser.y"
 +  case 364:
- #line 1402 "./util/configparser.y" /* yacc.c:1646  */
++#line 1404 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -4076,11 -3953,11 +4078,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4080 "util/configparser.c" /* yacc.c:1646  */
 -#line 3957 "util/configparser.c"
++#line 4082 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 346:
 -#line 1328 "./util/configparser.y"
 +  case 365:
- #line 1415 "./util/configparser.y" /* yacc.c:1646  */
++#line 1417 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4088,21 -3965,21 +4090,21 @@@
  		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4092 "util/configparser.c" /* yacc.c:1646  */
 -#line 3969 "util/configparser.c"
++#line 4094 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 347:
 -#line 1337 "./util/configparser.y"
 +  case 366:
- #line 1424 "./util/configparser.y" /* yacc.c:1646  */
++#line 1426 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->target_fetch_policy);
  		cfg_parser->cfg->target_fetch_policy = (yyvsp[0].str);
  	}
- #line 4102 "util/configparser.c" /* yacc.c:1646  */
 -#line 3979 "util/configparser.c"
++#line 4104 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 348:
 -#line 1344 "./util/configparser.y"
 +  case 367:
- #line 1431 "./util/configparser.y" /* yacc.c:1646  */
++#line 1433 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4111,11 -3988,11 +4113,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4115 "util/configparser.c" /* yacc.c:1646  */
 -#line 3992 "util/configparser.c"
++#line 4117 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 349:
 -#line 1354 "./util/configparser.y"
 +  case 368:
- #line 1441 "./util/configparser.y" /* yacc.c:1646  */
++#line 1443 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4124,11 -4001,11 +4126,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4128 "util/configparser.c" /* yacc.c:1646  */
 -#line 4005 "util/configparser.c"
++#line 4130 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 350:
 -#line 1364 "./util/configparser.y"
 +  case 369:
- #line 1451 "./util/configparser.y" /* yacc.c:1646  */
++#line 1453 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4137,11 -4014,11 +4139,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4141 "util/configparser.c" /* yacc.c:1646  */
 -#line 4018 "util/configparser.c"
++#line 4143 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 351:
 -#line 1374 "./util/configparser.y"
 +  case 370:
- #line 1461 "./util/configparser.y" /* yacc.c:1646  */
++#line 1463 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4150,11 -4027,11 +4152,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4154 "util/configparser.c" /* yacc.c:1646  */
 -#line 4031 "util/configparser.c"
++#line 4156 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 352:
 -#line 1384 "./util/configparser.y"
 +  case 371:
- #line 1471 "./util/configparser.y" /* yacc.c:1646  */
++#line 1473 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4163,11 -4040,11 +4165,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4167 "util/configparser.c" /* yacc.c:1646  */
 -#line 4044 "util/configparser.c"
++#line 4169 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 353:
 -#line 1394 "./util/configparser.y"
 +  case 372:
- #line 1481 "./util/configparser.y" /* yacc.c:1646  */
++#line 1483 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4176,11 -4053,11 +4178,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4180 "util/configparser.c" /* yacc.c:1646  */
 -#line 4057 "util/configparser.c"
++#line 4182 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 354:
 -#line 1404 "./util/configparser.y"
 +  case 373:
- #line 1491 "./util/configparser.y" /* yacc.c:1646  */
++#line 1493 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4189,11 -4066,11 +4191,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4193 "util/configparser.c" /* yacc.c:1646  */
 -#line 4070 "util/configparser.c"
++#line 4195 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 355:
 -#line 1414 "./util/configparser.y"
 +  case 374:
- #line 1501 "./util/configparser.y" /* yacc.c:1646  */
++#line 1503 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4202,41 -4079,41 +4204,41 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4206 "util/configparser.c" /* yacc.c:1646  */
 -#line 4083 "util/configparser.c"
++#line 4208 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 356:
 -#line 1424 "./util/configparser.y"
 +  case 375:
- #line 1511 "./util/configparser.y" /* yacc.c:1646  */
++#line 1513 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 4216 "util/configparser.c" /* yacc.c:1646  */
 -#line 4093 "util/configparser.c"
++#line 4218 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 357:
 -#line 1431 "./util/configparser.y"
 +  case 376:
- #line 1518 "./util/configparser.y" /* yacc.c:1646  */
++#line 1520 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_private_address:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 4226 "util/configparser.c" /* yacc.c:1646  */
 -#line 4103 "util/configparser.c"
++#line 4228 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 358:
 -#line 1438 "./util/configparser.y"
 +  case 377:
- #line 1525 "./util/configparser.y" /* yacc.c:1646  */
++#line 1527 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 4236 "util/configparser.c" /* yacc.c:1646  */
 -#line 4113 "util/configparser.c"
++#line 4238 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 359:
 -#line 1445 "./util/configparser.y"
 +  case 378:
- #line 1532 "./util/configparser.y" /* yacc.c:1646  */
++#line 1534 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4244,11 -4121,11 +4246,11 @@@
  		else cfg_parser->cfg->prefetch = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4248 "util/configparser.c" /* yacc.c:1646  */
 -#line 4125 "util/configparser.c"
++#line 4250 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 360:
 -#line 1454 "./util/configparser.y"
 +  case 379:
- #line 1541 "./util/configparser.y" /* yacc.c:1646  */
++#line 1543 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4256,11 -4133,11 +4258,11 @@@
  		else cfg_parser->cfg->prefetch_key = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4260 "util/configparser.c" /* yacc.c:1646  */
 -#line 4137 "util/configparser.c"
++#line 4262 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 361:
 -#line 1463 "./util/configparser.y"
 +  case 380:
- #line 1550 "./util/configparser.y" /* yacc.c:1646  */
++#line 1552 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_deny_any:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4268,11 -4145,11 +4270,11 @@@
  		else cfg_parser->cfg->deny_any = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4272 "util/configparser.c" /* yacc.c:1646  */
 -#line 4149 "util/configparser.c"
++#line 4274 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 362:
 -#line 1472 "./util/configparser.y"
 +  case 381:
- #line 1559 "./util/configparser.y" /* yacc.c:1646  */
++#line 1561 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4280,21 -4157,21 +4282,21 @@@
  		else cfg_parser->cfg->unwanted_threshold = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4284 "util/configparser.c" /* yacc.c:1646  */
 -#line 4161 "util/configparser.c"
++#line 4286 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 363:
 -#line 1481 "./util/configparser.y"
 +  case 382:
- #line 1568 "./util/configparser.y" /* yacc.c:1646  */
++#line 1570 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 4294 "util/configparser.c" /* yacc.c:1646  */
 -#line 4171 "util/configparser.c"
++#line 4296 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 364:
 -#line 1488 "./util/configparser.y"
 +  case 383:
- #line 1575 "./util/configparser.y" /* yacc.c:1646  */
++#line 1577 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4303,11 -4180,11 +4305,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4307 "util/configparser.c" /* yacc.c:1646  */
 -#line 4184 "util/configparser.c"
++#line 4309 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 365:
 -#line 1498 "./util/configparser.y"
 +  case 384:
- #line 1585 "./util/configparser.y" /* yacc.c:1646  */
++#line 1587 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "deny")!=0 && strcmp((yyvsp[0].str), "refuse")!=0 &&
@@@ -4326,21 -4203,21 +4328,21 @@@
  				fatal_exit("out of memory adding acl");
  		}
  	}
- #line 4330 "util/configparser.c" /* yacc.c:1646  */
 -#line 4207 "util/configparser.c"
++#line 4332 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 366:
 -#line 1518 "./util/configparser.y"
 +  case 385:
- #line 1605 "./util/configparser.y" /* yacc.c:1646  */
++#line 1607 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->module_conf);
  		cfg_parser->cfg->module_conf = (yyvsp[0].str);
  	}
- #line 4340 "util/configparser.c" /* yacc.c:1646  */
 -#line 4217 "util/configparser.c"
++#line 4342 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 367:
 -#line 1525 "./util/configparser.y"
 +  case 386:
- #line 1612 "./util/configparser.y" /* yacc.c:1646  */
++#line 1614 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[0].str)));
  		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@@ -4357,11 -4234,11 +4359,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4361 "util/configparser.c" /* yacc.c:1646  */
 -#line 4238 "util/configparser.c"
++#line 4363 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 368:
 -#line 1543 "./util/configparser.y"
 +  case 387:
- #line 1630 "./util/configparser.y" /* yacc.c:1646  */
++#line 1632 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[0].str)));
  		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@@ -4373,11 -4250,11 +4375,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4377 "util/configparser.c" /* yacc.c:1646  */
 -#line 4254 "util/configparser.c"
++#line 4379 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 369:
 -#line 1556 "./util/configparser.y"
 +  case 388:
- #line 1643 "./util/configparser.y" /* yacc.c:1646  */
++#line 1645 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[0].str)));
  		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@@ -4389,11 -4266,11 +4391,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4393 "util/configparser.c" /* yacc.c:1646  */
 -#line 4270 "util/configparser.c"
++#line 4395 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 370:
 -#line 1569 "./util/configparser.y"
 +  case 389:
- #line 1656 "./util/configparser.y" /* yacc.c:1646  */
++#line 1658 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4401,11 -4278,11 +4403,11 @@@
  		else cfg_parser->cfg->max_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4405 "util/configparser.c" /* yacc.c:1646  */
 -#line 4282 "util/configparser.c"
++#line 4407 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 371:
 -#line 1578 "./util/configparser.y"
 +  case 390:
- #line 1665 "./util/configparser.y" /* yacc.c:1646  */
++#line 1667 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4413,11 -4290,11 +4415,11 @@@
  		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4417 "util/configparser.c" /* yacc.c:1646  */
 -#line 4294 "util/configparser.c"
++#line 4419 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 372:
 -#line 1587 "./util/configparser.y"
 +  case 391:
- #line 1674 "./util/configparser.y" /* yacc.c:1646  */
++#line 1676 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4425,11 -4302,11 +4427,11 @@@
  		else cfg_parser->cfg->min_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4429 "util/configparser.c" /* yacc.c:1646  */
 -#line 4306 "util/configparser.c"
++#line 4431 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 373:
 -#line 1596 "./util/configparser.y"
 +  case 392:
- #line 1683 "./util/configparser.y" /* yacc.c:1646  */
++#line 1685 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4437,11 -4314,11 +4439,11 @@@
  		else cfg_parser->cfg->bogus_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4441 "util/configparser.c" /* yacc.c:1646  */
 -#line 4318 "util/configparser.c"
++#line 4443 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 374:
 -#line 1605 "./util/configparser.y"
 +  case 393:
- #line 1692 "./util/configparser.y" /* yacc.c:1646  */
++#line 1694 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4450,11 -4327,11 +4452,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4454 "util/configparser.c" /* yacc.c:1646  */
 -#line 4331 "util/configparser.c"
++#line 4456 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 375:
 -#line 1615 "./util/configparser.y"
 +  case 394:
- #line 1702 "./util/configparser.y" /* yacc.c:1646  */
++#line 1704 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4463,11 -4340,11 +4465,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4467 "util/configparser.c" /* yacc.c:1646  */
 -#line 4344 "util/configparser.c"
++#line 4469 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 376:
 -#line 1625 "./util/configparser.y"
 +  case 395:
- #line 1712 "./util/configparser.y" /* yacc.c:1646  */
++#line 1714 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_aggressive_nsec:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4477,11 -4354,11 +4479,11 @@@
  				(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4481 "util/configparser.c" /* yacc.c:1646  */
 -#line 4358 "util/configparser.c"
++#line 4483 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 377:
 -#line 1636 "./util/configparser.y"
 +  case 396:
- #line 1723 "./util/configparser.y" /* yacc.c:1646  */
++#line 1725 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4489,11 -4366,11 +4491,11 @@@
  		else cfg_parser->cfg->ignore_cd = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4493 "util/configparser.c" /* yacc.c:1646  */
 -#line 4370 "util/configparser.c"
++#line 4495 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 378:
 -#line 1645 "./util/configparser.y"
 +  case 397:
- #line 1732 "./util/configparser.y" /* yacc.c:1646  */
++#line 1734 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_serve_expired:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4501,11 -4378,11 +4503,11 @@@
  		else cfg_parser->cfg->serve_expired = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4505 "util/configparser.c" /* yacc.c:1646  */
 -#line 4382 "util/configparser.c"
++#line 4507 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 379:
 -#line 1654 "./util/configparser.y"
 +  case 398:
- #line 1741 "./util/configparser.y" /* yacc.c:1646  */
++#line 1743 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_serve_expired_ttl:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4513,11 -4390,11 +4515,11 @@@
  		else cfg_parser->cfg->serve_expired_ttl = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4517 "util/configparser.c" /* yacc.c:1646  */
 -#line 4394 "util/configparser.c"
++#line 4519 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 380:
 -#line 1663 "./util/configparser.y"
 +  case 399:
- #line 1750 "./util/configparser.y" /* yacc.c:1646  */
++#line 1752 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_serve_expired_ttl_reset:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4525,11 -4402,11 +4527,11 @@@
  		else cfg_parser->cfg->serve_expired_ttl_reset = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4529 "util/configparser.c" /* yacc.c:1646  */
 -#line 4406 "util/configparser.c"
++#line 4531 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 381:
 -#line 1672 "./util/configparser.y"
 +  case 400:
- #line 1759 "./util/configparser.y" /* yacc.c:1646  */
++#line 1761 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_fake_dsa:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4541,11 -4418,11 +4543,11 @@@
  #endif
  		free((yyvsp[0].str));
  	}
- #line 4545 "util/configparser.c" /* yacc.c:1646  */
 -#line 4422 "util/configparser.c"
++#line 4547 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 382:
 -#line 1685 "./util/configparser.y"
 +  case 401:
- #line 1772 "./util/configparser.y" /* yacc.c:1646  */
++#line 1774 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_fake_sha1:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4557,11 -4434,11 +4559,11 @@@
  #endif
  		free((yyvsp[0].str));
  	}
- #line 4561 "util/configparser.c" /* yacc.c:1646  */
 -#line 4438 "util/configparser.c"
++#line 4563 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 383:
 -#line 1698 "./util/configparser.y"
 +  case 402:
- #line 1785 "./util/configparser.y" /* yacc.c:1646  */
++#line 1787 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4569,21 -4446,21 +4571,21 @@@
  		else cfg_parser->cfg->val_log_level = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4573 "util/configparser.c" /* yacc.c:1646  */
 -#line 4450 "util/configparser.c"
++#line 4575 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 384:
 -#line 1707 "./util/configparser.y"
 +  case 403:
- #line 1794 "./util/configparser.y" /* yacc.c:1646  */
++#line 1796 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->val_nsec3_key_iterations);
  		cfg_parser->cfg->val_nsec3_key_iterations = (yyvsp[0].str);
  	}
- #line 4583 "util/configparser.c" /* yacc.c:1646  */
 -#line 4460 "util/configparser.c"
++#line 4585 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 385:
 -#line 1714 "./util/configparser.y"
 +  case 404:
- #line 1801 "./util/configparser.y" /* yacc.c:1646  */
++#line 1803 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4591,11 -4468,11 +4593,11 @@@
  		else cfg_parser->cfg->add_holddown = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4595 "util/configparser.c" /* yacc.c:1646  */
 -#line 4472 "util/configparser.c"
++#line 4597 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 386:
 -#line 1723 "./util/configparser.y"
 +  case 405:
- #line 1810 "./util/configparser.y" /* yacc.c:1646  */
++#line 1812 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4603,11 -4480,11 +4605,11 @@@
  		else cfg_parser->cfg->del_holddown = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4607 "util/configparser.c" /* yacc.c:1646  */
 -#line 4484 "util/configparser.c"
++#line 4609 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 387:
 -#line 1732 "./util/configparser.y"
 +  case 406:
- #line 1819 "./util/configparser.y" /* yacc.c:1646  */
++#line 1821 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4615,11 -4492,11 +4617,11 @@@
  		else cfg_parser->cfg->keep_missing = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4619 "util/configparser.c" /* yacc.c:1646  */
 -#line 4496 "util/configparser.c"
++#line 4621 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 388:
 -#line 1741 "./util/configparser.y"
 +  case 407:
- #line 1828 "./util/configparser.y" /* yacc.c:1646  */
++#line 1830 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_permit_small_holddown:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4628,22 -4505,22 +4630,22 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4632 "util/configparser.c" /* yacc.c:1646  */
 -#line 4509 "util/configparser.c"
++#line 4634 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 389:
 -#line 1750 "./util/configparser.y"
 +  case 408:
- #line 1837 "./util/configparser.y" /* yacc.c:1646  */
++#line 1839 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->key_cache_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 4643 "util/configparser.c" /* yacc.c:1646  */
 -#line 4520 "util/configparser.c"
++#line 4645 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 390:
 -#line 1758 "./util/configparser.y"
 +  case 409:
- #line 1845 "./util/configparser.y" /* yacc.c:1646  */
++#line 1847 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -4655,22 -4532,22 +4657,22 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4659 "util/configparser.c" /* yacc.c:1646  */
 -#line 4536 "util/configparser.c"
++#line 4661 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 391:
 -#line 1771 "./util/configparser.y"
 +  case 410:
- #line 1858 "./util/configparser.y" /* yacc.c:1646  */
++#line 1860 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->neg_cache_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 4670 "util/configparser.c" /* yacc.c:1646  */
 -#line 4547 "util/configparser.c"
++#line 4672 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 392:
 -#line 1779 "./util/configparser.y"
 +  case 411:
- #line 1866 "./util/configparser.y" /* yacc.c:1646  */
++#line 1868 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@@ -4710,21 -4587,21 +4712,21 @@@
  				fatal_exit("out of memory adding local-zone");
  		}
  	}
- #line 4714 "util/configparser.c" /* yacc.c:1646  */
 -#line 4591 "util/configparser.c"
++#line 4716 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 393:
 -#line 1820 "./util/configparser.y"
 +  case 412:
- #line 1907 "./util/configparser.y" /* yacc.c:1646  */
++#line 1909 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
  			fatal_exit("out of memory adding local-data");
  	}
- #line 4724 "util/configparser.c" /* yacc.c:1646  */
 -#line 4601 "util/configparser.c"
++#line 4726 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 394:
 -#line 1827 "./util/configparser.y"
 +  case 413:
- #line 1914 "./util/configparser.y" /* yacc.c:1646  */
++#line 1916 "./util/configparser.y" /* yacc.c:1646  */
      {
  		char* ptr;
  		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@@ -4738,11 -4615,11 +4740,11 @@@
  			yyerror("local-data-ptr could not be reversed");
  		}
  	}
- #line 4742 "util/configparser.c" /* yacc.c:1646  */
 -#line 4619 "util/configparser.c"
++#line 4744 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 395:
 -#line 1842 "./util/configparser.y"
 +  case 414:
- #line 1929 "./util/configparser.y" /* yacc.c:1646  */
++#line 1931 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4751,11 -4628,11 +4753,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4755 "util/configparser.c" /* yacc.c:1646  */
 -#line 4632 "util/configparser.c"
++#line 4757 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 396:
 -#line 1852 "./util/configparser.y"
 +  case 415:
- #line 1939 "./util/configparser.y" /* yacc.c:1646  */
++#line 1941 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4764,41 -4641,41 +4766,41 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4768 "util/configparser.c" /* yacc.c:1646  */
 -#line 4645 "util/configparser.c"
++#line 4770 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 397:
 -#line 1862 "./util/configparser.y"
 +  case 416:
- #line 1949 "./util/configparser.y" /* yacc.c:1646  */
++#line 1951 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_unknown_server_time_limit:%s)\n", (yyvsp[0].str)));
  		cfg_parser->cfg->unknown_server_time_limit = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4778 "util/configparser.c" /* yacc.c:1646  */
 -#line 4655 "util/configparser.c"
++#line 4780 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 398:
 -#line 1869 "./util/configparser.y"
 +  case 417:
- #line 1956 "./util/configparser.y" /* yacc.c:1646  */
++#line 1958 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
  		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4788 "util/configparser.c" /* yacc.c:1646  */
 -#line 4665 "util/configparser.c"
++#line 4790 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 399:
 -#line 1876 "./util/configparser.y"
 +  case 418:
- #line 1963 "./util/configparser.y" /* yacc.c:1646  */
++#line 1965 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dns64_prefix);
  		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
  	}
- #line 4798 "util/configparser.c" /* yacc.c:1646  */
 -#line 4675 "util/configparser.c"
++#line 4800 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 400:
 -#line 1883 "./util/configparser.y"
 +  case 419:
- #line 1970 "./util/configparser.y" /* yacc.c:1646  */
++#line 1972 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -4806,22 -4683,22 +4808,22 @@@
  		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 4810 "util/configparser.c" /* yacc.c:1646  */
 -#line 4687 "util/configparser.c"
++#line 4812 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 401:
 -#line 1892 "./util/configparser.y"
 +  case 420:
- #line 1979 "./util/configparser.y" /* yacc.c:1646  */
++#line 1981 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dns64_ignore_aaaa:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
  			(yyvsp[0].str)))
  			fatal_exit("out of memory adding dns64-ignore-aaaa");
  	}
- #line 4821 "util/configparser.c" /* yacc.c:1646  */
 -#line 4698 "util/configparser.c"
++#line 4823 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 402:
 -#line 1900 "./util/configparser.y"
 +  case 421:
- #line 1987 "./util/configparser.y" /* yacc.c:1646  */
++#line 1989 "./util/configparser.y" /* yacc.c:1646  */
      {
  		char* p, *s = (yyvsp[0].str);
  		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@@ -4834,11 -4711,11 +4836,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 4838 "util/configparser.c" /* yacc.c:1646  */
 -#line 4715 "util/configparser.c"
++#line 4840 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 403:
 -#line 1914 "./util/configparser.y"
 +  case 422:
- #line 2001 "./util/configparser.y" /* yacc.c:1646  */
++#line 2003 "./util/configparser.y" /* yacc.c:1646  */
      {
  		size_t len = 0;
  		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@@ -4858,11 -4735,11 +4860,11 @@@
  			}
  		}
  	}
- #line 4862 "util/configparser.c" /* yacc.c:1646  */
 -#line 4739 "util/configparser.c"
++#line 4864 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 404:
 -#line 1935 "./util/configparser.y"
 +  case 423:
- #line 2022 "./util/configparser.y" /* yacc.c:1646  */
++#line 2024 "./util/configparser.y" /* yacc.c:1646  */
      {
  		size_t len = 0;
  		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@@ -4882,11 -4759,11 +4884,11 @@@
  			}
  		}
  	}
- #line 4886 "util/configparser.c" /* yacc.c:1646  */
 -#line 4763 "util/configparser.c"
++#line 4888 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 405:
 -#line 1956 "./util/configparser.y"
 +  case 424:
- #line 2043 "./util/configparser.y" /* yacc.c:1646  */
++#line 2045 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
  		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@@ -4897,11 -4774,11 +4899,11 @@@
  			free((yyvsp[0].str));
  		}
  	}
- #line 4901 "util/configparser.c" /* yacc.c:1646  */
 -#line 4778 "util/configparser.c"
++#line 4903 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 406:
 -#line 1968 "./util/configparser.y"
 +  case 425:
- #line 2055 "./util/configparser.y" /* yacc.c:1646  */
++#line 2057 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
  		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@@ -4912,11 -4789,11 +4914,11 @@@
  			free((yyvsp[0].str));
  		}
  	}
- #line 4916 "util/configparser.c" /* yacc.c:1646  */
 -#line 4793 "util/configparser.c"
++#line 4918 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 407:
 -#line 1980 "./util/configparser.y"
 +  case 426:
- #line 2067 "./util/configparser.y" /* yacc.c:1646  */
++#line 2069 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
  		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@@ -4927,11 -4804,11 +4929,11 @@@
  			free((yyvsp[0].str));
  		}
  	}
- #line 4931 "util/configparser.c" /* yacc.c:1646  */
 -#line 4808 "util/configparser.c"
++#line 4933 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 408:
 -#line 1992 "./util/configparser.y"
 +  case 427:
- #line 2079 "./util/configparser.y" /* yacc.c:1646  */
++#line 2081 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@@ -4939,11 -4816,11 +4941,11 @@@
  			yyerror("out of memory");
  		}
  	}
- #line 4943 "util/configparser.c" /* yacc.c:1646  */
 -#line 4820 "util/configparser.c"
++#line 4945 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 409:
 -#line 2001 "./util/configparser.y"
 +  case 428:
- #line 2088 "./util/configparser.y" /* yacc.c:1646  */
++#line 2090 "./util/configparser.y" /* yacc.c:1646  */
      {
  		size_t len = 0;
  		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@@ -4963,11 -4840,11 +4965,11 @@@
  			}
  		}
  	}
- #line 4967 "util/configparser.c" /* yacc.c:1646  */
 -#line 4844 "util/configparser.c"
++#line 4969 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 410:
 -#line 2022 "./util/configparser.y"
 +  case 429:
- #line 2109 "./util/configparser.y" /* yacc.c:1646  */
++#line 2111 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4975,11 -4852,11 +4977,11 @@@
  		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4979 "util/configparser.c" /* yacc.c:1646  */
 -#line 4856 "util/configparser.c"
++#line 4981 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 411:
 -#line 2032 "./util/configparser.y"
 +  case 430:
- #line 2119 "./util/configparser.y" /* yacc.c:1646  */
++#line 2121 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -4987,33 -4864,33 +4989,33 @@@
  		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 4991 "util/configparser.c" /* yacc.c:1646  */
 -#line 4868 "util/configparser.c"
++#line 4993 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 412:
 -#line 2041 "./util/configparser.y"
 +  case 431:
- #line 2128 "./util/configparser.y" /* yacc.c:1646  */
++#line 2130 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
    	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
    		yyerror("memory size expected");
    	free((yyvsp[0].str));
    }
- #line 5002 "util/configparser.c" /* yacc.c:1646  */
 -#line 4879 "util/configparser.c"
++#line 5004 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 413:
 -#line 2049 "./util/configparser.y"
 +  case 432:
- #line 2136 "./util/configparser.y" /* yacc.c:1646  */
++#line 2138 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
  		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
  			yyerror("memory size expected");
  		free((yyvsp[0].str));
  	}
- #line 5013 "util/configparser.c" /* yacc.c:1646  */
 -#line 4890 "util/configparser.c"
++#line 5015 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 414:
 -#line 2057 "./util/configparser.y"
 +  case 433:
- #line 2144 "./util/configparser.y" /* yacc.c:1646  */
++#line 2146 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
    	if(atoi((yyvsp[0].str)) == 0)
@@@ -5025,11 -4902,11 +5027,11 @@@
    	}
    	free((yyvsp[0].str));
    }
- #line 5029 "util/configparser.c" /* yacc.c:1646  */
 -#line 4906 "util/configparser.c"
++#line 5031 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 415:
 -#line 2070 "./util/configparser.y"
 +  case 434:
- #line 2157 "./util/configparser.y" /* yacc.c:1646  */
++#line 2159 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -5041,11 -4918,11 +5043,11 @@@
  		}
  		free((yyvsp[0].str));
  	}
- #line 5045 "util/configparser.c" /* yacc.c:1646  */
 -#line 4922 "util/configparser.c"
++#line 5047 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 416:
 -#line 2083 "./util/configparser.y"
 +  case 435:
- #line 2170 "./util/configparser.y" /* yacc.c:1646  */
++#line 2172 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@@ -5059,11 -4936,11 +5061,11 @@@
  					"ratelimit-for-domain");
  		}
  	}
- #line 5063 "util/configparser.c" /* yacc.c:1646  */
 -#line 4940 "util/configparser.c"
++#line 5065 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 417:
 -#line 2098 "./util/configparser.y"
 +  case 436:
- #line 2185 "./util/configparser.y" /* yacc.c:1646  */
++#line 2187 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@@ -5077,11 -4954,11 +5079,11 @@@
  					"ratelimit-below-domain");
  		}
  	}
- #line 5081 "util/configparser.c" /* yacc.c:1646  */
 -#line 4958 "util/configparser.c"
++#line 5083 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 418:
 -#line 2113 "./util/configparser.y"
 +  case 437:
- #line 2200 "./util/configparser.y" /* yacc.c:1646  */
++#line 2202 "./util/configparser.y" /* yacc.c:1646  */
      { 
    	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
    	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -5089,11 -4966,11 +5091,11 @@@
    	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
    	free((yyvsp[0].str));
  	}
- #line 5093 "util/configparser.c" /* yacc.c:1646  */
 -#line 4970 "util/configparser.c"
++#line 5095 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 419:
 -#line 2122 "./util/configparser.y"
 +  case 438:
- #line 2209 "./util/configparser.y" /* yacc.c:1646  */
++#line 2211 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -5101,20 -4978,20 +5103,20 @@@
  		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 5105 "util/configparser.c" /* yacc.c:1646  */
 -#line 4982 "util/configparser.c"
++#line 5107 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 420:
 -#line 2131 "./util/configparser.y"
 +  case 439:
- #line 2218 "./util/configparser.y" /* yacc.c:1646  */
++#line 2220 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
  		free((yyvsp[0].str));
  	}
- #line 5114 "util/configparser.c" /* yacc.c:1646  */
 -#line 4991 "util/configparser.c"
++#line 5116 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 421:
 -#line 2137 "./util/configparser.y"
 +  case 440:
- #line 2224 "./util/configparser.y" /* yacc.c:1646  */
++#line 2226 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(server_fast_server_num:%s)\n", (yyvsp[0].str))); 
  		if(atoi((yyvsp[0].str)) <= 0)
@@@ -5122,11 -4999,11 +5124,11 @@@
  		else cfg_parser->cfg->fast_server_num = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 5126 "util/configparser.c" /* yacc.c:1646  */
 -#line 5003 "util/configparser.c"
++#line 5128 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 422:
 -#line 2146 "./util/configparser.y"
 +  case 441:
- #line 2233 "./util/configparser.y" /* yacc.c:1646  */
++#line 2235 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("P(server_fast_server_permil:%s)\n", (yyvsp[0].str))); 
  		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@@ -5134,11 -5011,11 +5136,11 @@@
  		else cfg_parser->cfg->fast_server_permil = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 5138 "util/configparser.c" /* yacc.c:1646  */
 -#line 5015 "util/configparser.c"
++#line 5140 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 423:
 -#line 2155 "./util/configparser.y"
 +  case 442:
- #line 2242 "./util/configparser.y" /* yacc.c:1646  */
++#line 2244 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5147,11 -5024,11 +5149,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5151 "util/configparser.c" /* yacc.c:1646  */
 -#line 5028 "util/configparser.c"
++#line 5153 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 424:
 -#line 2165 "./util/configparser.y"
 +  case 443:
- #line 2252 "./util/configparser.y" /* yacc.c:1646  */
++#line 2254 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5160,11 -5037,11 +5162,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5164 "util/configparser.c" /* yacc.c:1646  */
 -#line 5041 "util/configparser.c"
++#line 5166 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 425:
 -#line 2175 "./util/configparser.y"
 +  case 444:
- #line 2262 "./util/configparser.y" /* yacc.c:1646  */
++#line 2264 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@@ -5176,11 -5053,11 +5178,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 5180 "util/configparser.c" /* yacc.c:1646  */
 -#line 5057 "util/configparser.c"
++#line 5182 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 426:
 -#line 2188 "./util/configparser.y"
 +  case 445:
- #line 2275 "./util/configparser.y" /* yacc.c:1646  */
++#line 2277 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@@ -5192,11 -5069,11 +5194,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 5196 "util/configparser.c" /* yacc.c:1646  */
 -#line 5073 "util/configparser.c"
++#line 5198 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 427:
 -#line 2201 "./util/configparser.y"
 +  case 446:
- #line 2288 "./util/configparser.y" /* yacc.c:1646  */
++#line 2290 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@@ -5207,11 -5084,11 +5209,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 5211 "util/configparser.c" /* yacc.c:1646  */
 -#line 5088 "util/configparser.c"
++#line 5213 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 428:
 -#line 2213 "./util/configparser.y"
 +  case 447:
- #line 2300 "./util/configparser.y" /* yacc.c:1646  */
++#line 2302 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@@ -5224,11 -5101,11 +5226,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 5228 "util/configparser.c" /* yacc.c:1646  */
 -#line 5105 "util/configparser.c"
++#line 5230 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 429:
 -#line 2227 "./util/configparser.y"
 +  case 448:
- #line 2314 "./util/configparser.y" /* yacc.c:1646  */
++#line 2316 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@@ -5239,11 -5116,11 +5241,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 5243 "util/configparser.c" /* yacc.c:1646  */
 -#line 5120 "util/configparser.c"
++#line 5245 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 430:
 -#line 2239 "./util/configparser.y"
 +  case 449:
- #line 2326 "./util/configparser.y" /* yacc.c:1646  */
++#line 2328 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_IPSECMOD
  		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@@ -5256,11 -5133,11 +5258,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 5260 "util/configparser.c" /* yacc.c:1646  */
 -#line 5137 "util/configparser.c"
++#line 5262 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 431:
 -#line 2253 "./util/configparser.y"
 +  case 450:
- #line 2340 "./util/configparser.y" /* yacc.c:1646  */
++#line 2342 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->stubs->name)
@@@ -5269,31 -5146,31 +5271,31 @@@
  		free(cfg_parser->cfg->stubs->name);
  		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
  	}
- #line 5273 "util/configparser.c" /* yacc.c:1646  */
 -#line 5150 "util/configparser.c"
++#line 5275 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 432:
 -#line 2263 "./util/configparser.y"
 +  case 451:
- #line 2350 "./util/configparser.y" /* yacc.c:1646  */
++#line 2352 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5283 "util/configparser.c" /* yacc.c:1646  */
 -#line 5160 "util/configparser.c"
++#line 5285 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 433:
 -#line 2270 "./util/configparser.y"
 +  case 452:
- #line 2357 "./util/configparser.y" /* yacc.c:1646  */
++#line 2359 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5293 "util/configparser.c" /* yacc.c:1646  */
 -#line 5170 "util/configparser.c"
++#line 5295 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 434:
 -#line 2277 "./util/configparser.y"
 +  case 453:
- #line 2364 "./util/configparser.y" /* yacc.c:1646  */
++#line 2366 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5301,11 -5178,11 +5303,11 @@@
  		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5305 "util/configparser.c" /* yacc.c:1646  */
 -#line 5182 "util/configparser.c"
++#line 5307 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 435:
 -#line 2286 "./util/configparser.y"
 +  case 454:
- #line 2373 "./util/configparser.y" /* yacc.c:1646  */
++#line 2375 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-no-cache:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5313,11 -5190,11 +5315,11 @@@
  		else cfg_parser->cfg->stubs->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5317 "util/configparser.c" /* yacc.c:1646  */
 -#line 5194 "util/configparser.c"
++#line 5319 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 436:
 -#line 2295 "./util/configparser.y"
 +  case 455:
- #line 2382 "./util/configparser.y" /* yacc.c:1646  */
++#line 2384 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5326,11 -5203,11 +5328,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5330 "util/configparser.c" /* yacc.c:1646  */
 -#line 5207 "util/configparser.c"
++#line 5332 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 437:
 -#line 2305 "./util/configparser.y"
 +  case 456:
- #line 2392 "./util/configparser.y" /* yacc.c:1646  */
++#line 2394 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5339,11 -5216,11 +5341,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5343 "util/configparser.c" /* yacc.c:1646  */
 -#line 5220 "util/configparser.c"
++#line 5345 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 438:
 -#line 2315 "./util/configparser.y"
 +  case 457:
- #line 2402 "./util/configparser.y" /* yacc.c:1646  */
++#line 2404 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->forwards->name)
@@@ -5352,31 -5229,31 +5354,31 @@@
  		free(cfg_parser->cfg->forwards->name);
  		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
  	}
- #line 5356 "util/configparser.c" /* yacc.c:1646  */
 -#line 5233 "util/configparser.c"
++#line 5358 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 439:
 -#line 2325 "./util/configparser.y"
 +  case 458:
- #line 2412 "./util/configparser.y" /* yacc.c:1646  */
++#line 2414 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5366 "util/configparser.c" /* yacc.c:1646  */
 -#line 5243 "util/configparser.c"
++#line 5368 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 440:
 -#line 2332 "./util/configparser.y"
 +  case 459:
- #line 2419 "./util/configparser.y" /* yacc.c:1646  */
++#line 2421 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5376 "util/configparser.c" /* yacc.c:1646  */
 -#line 5253 "util/configparser.c"
++#line 5378 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 441:
 -#line 2339 "./util/configparser.y"
 +  case 460:
- #line 2426 "./util/configparser.y" /* yacc.c:1646  */
++#line 2428 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5384,11 -5261,11 +5386,11 @@@
  		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5388 "util/configparser.c" /* yacc.c:1646  */
 -#line 5265 "util/configparser.c"
++#line 5390 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 442:
 -#line 2348 "./util/configparser.y"
 +  case 461:
- #line 2435 "./util/configparser.y" /* yacc.c:1646  */
++#line 2437 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(forward-no-cache:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5396,11 -5273,11 +5398,11 @@@
  		else cfg_parser->cfg->forwards->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5400 "util/configparser.c" /* yacc.c:1646  */
 -#line 5277 "util/configparser.c"
++#line 5402 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 443:
 -#line 2357 "./util/configparser.y"
 +  case 462:
- #line 2444 "./util/configparser.y" /* yacc.c:1646  */
++#line 2446 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5409,11 -5286,11 +5411,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5413 "util/configparser.c" /* yacc.c:1646  */
 -#line 5290 "util/configparser.c"
++#line 5415 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 444:
 -#line 2367 "./util/configparser.y"
 +  case 463:
- #line 2454 "./util/configparser.y" /* yacc.c:1646  */
++#line 2456 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->auths->name)
@@@ -5422,52 -5299,52 +5424,52 @@@
  		free(cfg_parser->cfg->auths->name);
  		cfg_parser->cfg->auths->name = (yyvsp[0].str);
  	}
- #line 5426 "util/configparser.c" /* yacc.c:1646  */
 -#line 5303 "util/configparser.c"
++#line 5428 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 445:
 -#line 2377 "./util/configparser.y"
 +  case 464:
- #line 2464 "./util/configparser.y" /* yacc.c:1646  */
++#line 2466 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(zonefile:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->auths->zonefile);
  		cfg_parser->cfg->auths->zonefile = (yyvsp[0].str);
  	}
- #line 5436 "util/configparser.c" /* yacc.c:1646  */
 -#line 5313 "util/configparser.c"
++#line 5438 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 446:
 -#line 2384 "./util/configparser.y"
 +  case 465:
- #line 2471 "./util/configparser.y" /* yacc.c:1646  */
++#line 2473 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(master:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5446 "util/configparser.c" /* yacc.c:1646  */
 -#line 5323 "util/configparser.c"
++#line 5448 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 447:
 -#line 2391 "./util/configparser.y"
 +  case 466:
- #line 2478 "./util/configparser.y" /* yacc.c:1646  */
++#line 2480 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(url:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5456 "util/configparser.c" /* yacc.c:1646  */
 -#line 5333 "util/configparser.c"
++#line 5458 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 448:
 -#line 2398 "./util/configparser.y"
 +  case 467:
- #line 2485 "./util/configparser.y" /* yacc.c:1646  */
++#line 2487 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(allow-notify:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
  			(yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5467 "util/configparser.c" /* yacc.c:1646  */
 -#line 5344 "util/configparser.c"
++#line 5469 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 449:
 -#line 2406 "./util/configparser.y"
 +  case 468:
- #line 2493 "./util/configparser.y" /* yacc.c:1646  */
++#line 2495 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(for-downstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5476,11 -5353,11 +5478,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5480 "util/configparser.c" /* yacc.c:1646  */
 -#line 5357 "util/configparser.c"
++#line 5482 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 450:
 -#line 2416 "./util/configparser.y"
 +  case 469:
- #line 2503 "./util/configparser.y" /* yacc.c:1646  */
++#line 2505 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(for-upstream:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5489,11 -5366,11 +5491,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5493 "util/configparser.c" /* yacc.c:1646  */
 -#line 5370 "util/configparser.c"
++#line 5495 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 451:
 -#line 2426 "./util/configparser.y"
 +  case 470:
- #line 2513 "./util/configparser.y" /* yacc.c:1646  */
++#line 2515 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(fallback-enabled:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5502,11 -5379,11 +5504,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5506 "util/configparser.c" /* yacc.c:1646  */
 -#line 5383 "util/configparser.c"
++#line 5508 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 452:
 -#line 2436 "./util/configparser.y"
 +  case 471:
- #line 2523 "./util/configparser.y" /* yacc.c:1646  */
++#line 2525 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
  		if(cfg_parser->cfg->views->name)
@@@ -5515,11 -5392,11 +5517,11 @@@
  		free(cfg_parser->cfg->views->name);
  		cfg_parser->cfg->views->name = (yyvsp[0].str);
  	}
- #line 5519 "util/configparser.c" /* yacc.c:1646  */
 -#line 5396 "util/configparser.c"
++#line 5521 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 453:
 -#line 2446 "./util/configparser.y"
 +  case 472:
- #line 2533 "./util/configparser.y" /* yacc.c:1646  */
++#line 2535 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@@ -5557,11 -5434,11 +5559,11 @@@
  				fatal_exit("out of memory adding local-zone");
  		}
  	}
- #line 5561 "util/configparser.c" /* yacc.c:1646  */
 -#line 5438 "util/configparser.c"
++#line 5563 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 454:
 -#line 2485 "./util/configparser.y"
 +  case 473:
- #line 2572 "./util/configparser.y" /* yacc.c:1646  */
++#line 2574 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		validate_respip_action((yyvsp[0].str));
@@@ -5570,33 -5447,33 +5572,33 @@@
  			fatal_exit("out of memory adding per-view "
  				"response-ip action");
  	}
- #line 5574 "util/configparser.c" /* yacc.c:1646  */
 -#line 5451 "util/configparser.c"
++#line 5576 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 455:
 -#line 2495 "./util/configparser.y"
 +  case 474:
- #line 2582 "./util/configparser.y" /* yacc.c:1646  */
++#line 2584 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
  		if(!cfg_str2list_insert(
  			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
  			fatal_exit("out of memory adding response-ip-data");
  	}
- #line 5585 "util/configparser.c" /* yacc.c:1646  */
 -#line 5462 "util/configparser.c"
++#line 5587 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 456:
 -#line 2503 "./util/configparser.y"
 +  case 475:
- #line 2590 "./util/configparser.y" /* yacc.c:1646  */
++#line 2592 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
  			fatal_exit("out of memory adding local-data");
  		}
  	}
- #line 5596 "util/configparser.c" /* yacc.c:1646  */
 -#line 5473 "util/configparser.c"
++#line 5598 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 457:
 -#line 2511 "./util/configparser.y"
 +  case 476:
- #line 2598 "./util/configparser.y" /* yacc.c:1646  */
++#line 2600 "./util/configparser.y" /* yacc.c:1646  */
      {
  		char* ptr;
  		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@@ -5610,11 -5487,11 +5612,11 @@@
  			yyerror("local-data-ptr could not be reversed");
  		}
  	}
- #line 5614 "util/configparser.c" /* yacc.c:1646  */
 -#line 5491 "util/configparser.c"
++#line 5616 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 458:
 -#line 2526 "./util/configparser.y"
 +  case 477:
- #line 2613 "./util/configparser.y" /* yacc.c:1646  */
++#line 2615 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5622,19 -5499,19 +5624,19 @@@
  		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5626 "util/configparser.c" /* yacc.c:1646  */
 -#line 5503 "util/configparser.c"
++#line 5628 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 459:
 -#line 2535 "./util/configparser.y"
 +  case 478:
- #line 2622 "./util/configparser.y" /* yacc.c:1646  */
++#line 2624 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("\nP(remote-control:)\n")); 
  	}
- #line 5634 "util/configparser.c" /* yacc.c:1646  */
 -#line 5511 "util/configparser.c"
++#line 5636 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 470:
 -#line 2546 "./util/configparser.y"
 +  case 489:
- #line 2633 "./util/configparser.y" /* yacc.c:1646  */
++#line 2635 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5643,11 -5520,11 +5645,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5647 "util/configparser.c" /* yacc.c:1646  */
 -#line 5524 "util/configparser.c"
++#line 5649 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 471:
 -#line 2556 "./util/configparser.y"
 +  case 490:
- #line 2643 "./util/configparser.y" /* yacc.c:1646  */
++#line 2645 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -5655,79 -5532,79 +5657,79 @@@
  		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 5659 "util/configparser.c" /* yacc.c:1646  */
 -#line 5536 "util/configparser.c"
++#line 5661 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 472:
 -#line 2565 "./util/configparser.y"
 +  case 491:
- #line 2652 "./util/configparser.y" /* yacc.c:1646  */
++#line 2654 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5669 "util/configparser.c" /* yacc.c:1646  */
 -#line 5546 "util/configparser.c"
++#line 5671 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 473:
 -#line 2572 "./util/configparser.y"
 +  case 492:
- #line 2659 "./util/configparser.y" /* yacc.c:1646  */
++#line 2661 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
  		cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5679 "util/configparser.c" /* yacc.c:1646  */
 -#line 5556 "util/configparser.c"
++#line 5681 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 474:
 -#line 2579 "./util/configparser.y"
 +  case 493:
- #line 2666 "./util/configparser.y" /* yacc.c:1646  */
++#line 2668 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->server_key_file);
  		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
  	}
- #line 5689 "util/configparser.c" /* yacc.c:1646  */
 -#line 5566 "util/configparser.c"
++#line 5691 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 475:
 -#line 2586 "./util/configparser.y"
 +  case 494:
- #line 2673 "./util/configparser.y" /* yacc.c:1646  */
++#line 2675 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->server_cert_file);
  		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
  	}
- #line 5699 "util/configparser.c" /* yacc.c:1646  */
 -#line 5576 "util/configparser.c"
++#line 5701 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 476:
 -#line 2593 "./util/configparser.y"
 +  case 495:
- #line 2680 "./util/configparser.y" /* yacc.c:1646  */
++#line 2682 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->control_key_file);
  		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
  	}
- #line 5709 "util/configparser.c" /* yacc.c:1646  */
 -#line 5586 "util/configparser.c"
++#line 5711 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 477:
 -#line 2600 "./util/configparser.y"
 +  case 496:
- #line 2687 "./util/configparser.y" /* yacc.c:1646  */
++#line 2689 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->control_cert_file);
  		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
  	}
- #line 5719 "util/configparser.c" /* yacc.c:1646  */
 -#line 5596 "util/configparser.c"
++#line 5721 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 478:
 -#line 2607 "./util/configparser.y"
 +  case 497:
- #line 2694 "./util/configparser.y" /* yacc.c:1646  */
++#line 2696 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("\nP(dnstap:)\n"));
  	}
- #line 5727 "util/configparser.c" /* yacc.c:1646  */
 -#line 5604 "util/configparser.c"
++#line 5729 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 493:
 -#line 2624 "./util/configparser.y"
 +  case 512:
- #line 2711 "./util/configparser.y" /* yacc.c:1646  */
++#line 2713 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5735,21 -5612,21 +5737,21 @@@
  		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5739 "util/configparser.c" /* yacc.c:1646  */
 -#line 5616 "util/configparser.c"
++#line 5741 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 494:
 -#line 2633 "./util/configparser.y"
 +  case 513:
- #line 2720 "./util/configparser.y" /* yacc.c:1646  */
++#line 2722 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dnstap_socket_path);
  		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
  	}
- #line 5749 "util/configparser.c" /* yacc.c:1646  */
 -#line 5626 "util/configparser.c"
++#line 5751 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 495:
 -#line 2640 "./util/configparser.y"
 +  case 514:
- #line 2727 "./util/configparser.y" /* yacc.c:1646  */
++#line 2729 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5757,11 -5634,11 +5759,11 @@@
  		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5761 "util/configparser.c" /* yacc.c:1646  */
 -#line 5638 "util/configparser.c"
++#line 5763 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 496:
 -#line 2649 "./util/configparser.y"
 +  case 515:
- #line 2736 "./util/configparser.y" /* yacc.c:1646  */
++#line 2738 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5769,31 -5646,31 +5771,31 @@@
  		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5773 "util/configparser.c" /* yacc.c:1646  */
 -#line 5650 "util/configparser.c"
++#line 5775 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 497:
 -#line 2658 "./util/configparser.y"
 +  case 516:
- #line 2745 "./util/configparser.y" /* yacc.c:1646  */
++#line 2747 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dnstap_identity);
  		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
  	}
- #line 5783 "util/configparser.c" /* yacc.c:1646  */
 -#line 5660 "util/configparser.c"
++#line 5785 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 498:
 -#line 2665 "./util/configparser.y"
 +  case 517:
- #line 2752 "./util/configparser.y" /* yacc.c:1646  */
++#line 2754 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dnstap_version);
  		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
  	}
- #line 5793 "util/configparser.c" /* yacc.c:1646  */
 -#line 5670 "util/configparser.c"
++#line 5795 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 499:
 -#line 2672 "./util/configparser.y"
 +  case 518:
- #line 2759 "./util/configparser.y" /* yacc.c:1646  */
++#line 2761 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5802,11 -5679,11 +5804,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5806 "util/configparser.c" /* yacc.c:1646  */
 -#line 5683 "util/configparser.c"
++#line 5808 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 500:
 -#line 2682 "./util/configparser.y"
 +  case 519:
- #line 2769 "./util/configparser.y" /* yacc.c:1646  */
++#line 2771 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5815,11 -5692,11 +5817,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5819 "util/configparser.c" /* yacc.c:1646  */
 -#line 5696 "util/configparser.c"
++#line 5821 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 501:
 -#line 2692 "./util/configparser.y"
 +  case 520:
- #line 2779 "./util/configparser.y" /* yacc.c:1646  */
++#line 2781 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5828,11 -5705,11 +5830,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5832 "util/configparser.c" /* yacc.c:1646  */
 -#line 5709 "util/configparser.c"
++#line 5834 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 502:
 -#line 2702 "./util/configparser.y"
 +  case 521:
- #line 2789 "./util/configparser.y" /* yacc.c:1646  */
++#line 2791 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5841,11 -5718,11 +5843,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5845 "util/configparser.c" /* yacc.c:1646  */
 -#line 5722 "util/configparser.c"
++#line 5847 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 503:
 -#line 2712 "./util/configparser.y"
 +  case 522:
- #line 2799 "./util/configparser.y" /* yacc.c:1646  */
++#line 2801 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5854,11 -5731,11 +5856,11 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5858 "util/configparser.c" /* yacc.c:1646  */
 -#line 5735 "util/configparser.c"
++#line 5860 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 504:
 -#line 2722 "./util/configparser.y"
 +  case 523:
- #line 2809 "./util/configparser.y" /* yacc.c:1646  */
++#line 2811 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5867,29 -5744,29 +5869,29 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5871 "util/configparser.c" /* yacc.c:1646  */
 -#line 5748 "util/configparser.c"
++#line 5873 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 505:
 -#line 2732 "./util/configparser.y"
 +  case 524:
- #line 2819 "./util/configparser.y" /* yacc.c:1646  */
++#line 2821 "./util/configparser.y" /* yacc.c:1646  */
      { 
  		OUTYY(("\nP(python:)\n")); 
  	}
- #line 5879 "util/configparser.c" /* yacc.c:1646  */
 -#line 5756 "util/configparser.c"
++#line 5881 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 509:
 -#line 2741 "./util/configparser.y"
 +  case 528:
- #line 2828 "./util/configparser.y" /* yacc.c:1646  */
++#line 2830 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, (yyvsp[0].str)))
  			yyerror("out of memory");
  	}
- #line 5889 "util/configparser.c" /* yacc.c:1646  */
 -#line 5766 "util/configparser.c"
++#line 5891 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 510:
 -#line 2747 "./util/configparser.y"
 +  case 529:
- #line 2834 "./util/configparser.y" /* yacc.c:1646  */
++#line 2836 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
  		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5898,21 -5775,21 +5900,21 @@@
  			(strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5902 "util/configparser.c" /* yacc.c:1646  */
 -#line 5779 "util/configparser.c"
++#line 5904 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 511:
 -#line 2757 "./util/configparser.y"
 +  case 530:
- #line 2844 "./util/configparser.y" /* yacc.c:1646  */
++#line 2846 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->log_identity);
  		cfg_parser->cfg->log_identity = (yyvsp[0].str);
  	}
- #line 5912 "util/configparser.c" /* yacc.c:1646  */
 -#line 5789 "util/configparser.c"
++#line 5914 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 512:
 -#line 2764 "./util/configparser.y"
 +  case 531:
- #line 2851 "./util/configparser.y" /* yacc.c:1646  */
++#line 2853 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		validate_respip_action((yyvsp[0].str));
@@@ -5920,30 -5797,30 +5922,30 @@@
  			(yyvsp[-1].str), (yyvsp[0].str)))
  			fatal_exit("out of memory adding response-ip");
  	}
- #line 5924 "util/configparser.c" /* yacc.c:1646  */
 -#line 5801 "util/configparser.c"
++#line 5926 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 513:
 -#line 2773 "./util/configparser.y"
 +  case 532:
- #line 2860 "./util/configparser.y" /* yacc.c:1646  */
++#line 2862 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
  		if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
  			(yyvsp[-1].str), (yyvsp[0].str)))
  			fatal_exit("out of memory adding response-ip-data");
  	}
- #line 5935 "util/configparser.c" /* yacc.c:1646  */
 -#line 5812 "util/configparser.c"
++#line 5937 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 514:
 -#line 2781 "./util/configparser.y"
 +  case 533:
- #line 2868 "./util/configparser.y" /* yacc.c:1646  */
++#line 2870 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("\nP(dnscrypt:)\n"));
  	}
- #line 5943 "util/configparser.c" /* yacc.c:1646  */
 -#line 5820 "util/configparser.c"
++#line 5945 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 527:
 -#line 2797 "./util/configparser.y"
 +  case 546:
- #line 2884 "./util/configparser.y" /* yacc.c:1646  */
++#line 2886 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
  		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@@ -5951,11 -5828,11 +5953,11 @@@
  		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
  		free((yyvsp[0].str));
  	}
- #line 5955 "util/configparser.c" /* yacc.c:1646  */
 -#line 5832 "util/configparser.c"
++#line 5957 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 528:
 -#line 2807 "./util/configparser.y"
 +  case 547:
- #line 2894 "./util/configparser.y" /* yacc.c:1646  */
++#line 2896 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
  		if(atoi((yyvsp[0].str)) == 0)
@@@ -5963,21 -5840,21 +5965,21 @@@
  		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
  		free((yyvsp[0].str));
  	}
- #line 5967 "util/configparser.c" /* yacc.c:1646  */
 -#line 5844 "util/configparser.c"
++#line 5969 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 529:
 -#line 2816 "./util/configparser.y"
 +  case 548:
- #line 2903 "./util/configparser.y" /* yacc.c:1646  */
++#line 2905 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
  		free(cfg_parser->cfg->dnscrypt_provider);
  		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
  	}
- #line 5977 "util/configparser.c" /* yacc.c:1646  */
 -#line 5854 "util/configparser.c"
++#line 5979 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 530:
 -#line 2823 "./util/configparser.y"
 +  case 549:
- #line 2910 "./util/configparser.y" /* yacc.c:1646  */
++#line 2912 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
  		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
@@@ -5985,21 -5862,21 +5987,21 @@@
  		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
  			fatal_exit("out of memory adding dnscrypt-provider-cert");
  	}
- #line 5989 "util/configparser.c" /* yacc.c:1646  */
 -#line 5866 "util/configparser.c"
++#line 5991 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 531:
 -#line 2832 "./util/configparser.y"
 +  case 550:
- #line 2919 "./util/configparser.y" /* yacc.c:1646  */
++#line 2921 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", (yyvsp[0].str)));
  		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, (yyvsp[0].str)))
  			fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
  	}
- #line 5999 "util/configparser.c" /* yacc.c:1646  */
 -#line 5876 "util/configparser.c"
++#line 6001 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 532:
 -#line 2839 "./util/configparser.y"
 +  case 551:
- #line 2926 "./util/configparser.y" /* yacc.c:1646  */
++#line 2928 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
  		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
@@@ -6007,22 -5884,22 +6009,22 @@@
  		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
  			fatal_exit("out of memory adding dnscrypt-secret-key");
  	}
- #line 6011 "util/configparser.c" /* yacc.c:1646  */
 -#line 5888 "util/configparser.c"
++#line 6013 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 533:
 -#line 2848 "./util/configparser.y"
 +  case 552:
- #line 2935 "./util/configparser.y" /* yacc.c:1646  */
++#line 2937 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
    	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
    		yyerror("memory size expected");
    	free((yyvsp[0].str));
    }
- #line 6022 "util/configparser.c" /* yacc.c:1646  */
 -#line 5899 "util/configparser.c"
++#line 6024 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 534:
 -#line 2856 "./util/configparser.y"
 +  case 553:
- #line 2943 "./util/configparser.y" /* yacc.c:1646  */
++#line 2945 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
    	if(atoi((yyvsp[0].str)) == 0)
@@@ -6034,22 -5911,22 +6036,22 @@@
    	}
    	free((yyvsp[0].str));
    }
- #line 6038 "util/configparser.c" /* yacc.c:1646  */
 -#line 5915 "util/configparser.c"
++#line 6040 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 535:
 -#line 2869 "./util/configparser.y"
 +  case 554:
- #line 2956 "./util/configparser.y" /* yacc.c:1646  */
++#line 2958 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", (yyvsp[0].str)));
    	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_nonce_cache_size))
    		yyerror("memory size expected");
    	free((yyvsp[0].str));
    }
- #line 6049 "util/configparser.c" /* yacc.c:1646  */
 -#line 5926 "util/configparser.c"
++#line 6051 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 536:
 -#line 2877 "./util/configparser.y"
 +  case 555:
- #line 2964 "./util/configparser.y" /* yacc.c:1646  */
++#line 2966 "./util/configparser.y" /* yacc.c:1646  */
      {
    	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", (yyvsp[0].str)));
    	if(atoi((yyvsp[0].str)) == 0)
@@@ -6061,19 -5938,19 +6063,19 @@@
    	}
    	free((yyvsp[0].str));
    }
- #line 6065 "util/configparser.c" /* yacc.c:1646  */
 -#line 5942 "util/configparser.c"
++#line 6067 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 537:
 -#line 2890 "./util/configparser.y"
 +  case 556:
- #line 2977 "./util/configparser.y" /* yacc.c:1646  */
++#line 2979 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("\nP(cachedb:)\n"));
  	}
- #line 6073 "util/configparser.c" /* yacc.c:1646  */
 -#line 5950 "util/configparser.c"
++#line 6075 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 545:
 -#line 2900 "./util/configparser.y"
 +  case 564:
- #line 2987 "./util/configparser.y" /* yacc.c:1646  */
++#line 2989 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_CACHEDB
  		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
@@@ -6087,11 -5964,11 +6089,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 6091 "util/configparser.c" /* yacc.c:1646  */
 -#line 5968 "util/configparser.c"
++#line 6093 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 546:
 -#line 2915 "./util/configparser.y"
 +  case 565:
- #line 3002 "./util/configparser.y" /* yacc.c:1646  */
++#line 3004 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#ifdef USE_CACHEDB
  		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
@@@ -6105,11 -5982,11 +6107,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 6109 "util/configparser.c" /* yacc.c:1646  */
 -#line 5986 "util/configparser.c"
++#line 6111 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 547:
 -#line 2930 "./util/configparser.y"
 +  case 566:
- #line 3017 "./util/configparser.y" /* yacc.c:1646  */
++#line 3019 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#if defined(USE_CACHEDB) && defined(USE_REDIS)
  		OUTYY(("P(redis_server_host:%s)\n", (yyvsp[0].str)));
@@@ -6120,11 -5997,11 +6122,11 @@@
  		free((yyvsp[0].str));
  	#endif
  	}
- #line 6124 "util/configparser.c" /* yacc.c:1646  */
 -#line 6001 "util/configparser.c"
++#line 6126 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 548:
 -#line 2942 "./util/configparser.y"
 +  case 567:
- #line 3029 "./util/configparser.y" /* yacc.c:1646  */
++#line 3031 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#if defined(USE_CACHEDB) && defined(USE_REDIS)
  		int port;
@@@ -6138,11 -6015,11 +6140,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 6142 "util/configparser.c" /* yacc.c:1646  */
 -#line 6019 "util/configparser.c"
++#line 6144 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 549:
 -#line 2957 "./util/configparser.y"
 +  case 568:
- #line 3044 "./util/configparser.y" /* yacc.c:1646  */
++#line 3046 "./util/configparser.y" /* yacc.c:1646  */
      {
  	#if defined(USE_CACHEDB) && defined(USE_REDIS)
  		OUTYY(("P(redis_timeout:%s)\n", (yyvsp[0].str)));
@@@ -6154,11 -6031,11 +6156,11 @@@
  	#endif
  		free((yyvsp[0].str));
  	}
- #line 6158 "util/configparser.c" /* yacc.c:1646  */
 -#line 6035 "util/configparser.c"
++#line 6160 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 550:
 -#line 2970 "./util/configparser.y"
 +  case 569:
- #line 3057 "./util/configparser.y" /* yacc.c:1646  */
++#line 3059 "./util/configparser.y" /* yacc.c:1646  */
      {
  		OUTYY(("P(server_tcp_connection_limit:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
  		if (atoi((yyvsp[0].str)) < 0)
@@@ -6168,19 -6045,19 +6170,19 @@@
  				fatal_exit("out of memory adding tcp connection limit");
  		}
  	}
- #line 6172 "util/configparser.c" /* yacc.c:1646  */
 -#line 6049 "util/configparser.c"
++#line 6174 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 551:
 -#line 2981 "./util/configparser.y"
 +  case 570:
- #line 3068 "./util/configparser.y" /* yacc.c:1646  */
++#line 3070 "./util/configparser.y" /* yacc.c:1646  */
      {
  			OUTYY(("\nP(ipset:)\n"));
  		}
- #line 6180 "util/configparser.c" /* yacc.c:1646  */
 -#line 6057 "util/configparser.c"
++#line 6182 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 556:
 -#line 2990 "./util/configparser.y"
 +  case 575:
- #line 3077 "./util/configparser.y" /* yacc.c:1646  */
++#line 3079 "./util/configparser.y" /* yacc.c:1646  */
      {
  		#ifdef USE_IPSET
  			OUTYY(("P(name-v4:%s)\n", (yyvsp[0].str)));
@@@ -6194,11 -6071,11 +6196,11 @@@
  			free((yyvsp[0].str));
  		#endif
  		}
- #line 6198 "util/configparser.c" /* yacc.c:1646  */
 -#line 6075 "util/configparser.c"
++#line 6200 "util/configparser.c" /* yacc.c:1646  */
      break;
  
 -  case 557:
 -#line 3005 "./util/configparser.y"
 +  case 576:
- #line 3092 "./util/configparser.y" /* yacc.c:1646  */
++#line 3094 "./util/configparser.y" /* yacc.c:1646  */
      {
  		#ifdef USE_IPSET
  			OUTYY(("P(name-v6:%s)\n", (yyvsp[0].str)));
@@@ -6212,11 -6089,12 +6214,11 @@@
  			free((yyvsp[0].str));
  		#endif
  		}
- #line 6216 "util/configparser.c" /* yacc.c:1646  */
 -#line 6093 "util/configparser.c"
++#line 6218 "util/configparser.c" /* yacc.c:1646  */
      break;
  
  
- #line 6220 "util/configparser.c" /* yacc.c:1646  */
 -#line 6097 "util/configparser.c"
 -
++#line 6222 "util/configparser.c" /* yacc.c:1646  */
        default: break;
      }
    /* User semantic actions sometimes alter yychar, and that requires
@@@ -6444,7 -6325,7 +6446,7 @@@ yyreturn
  #endif
    return yyresult;
  }
- #line 3106 "./util/configparser.y" /* yacc.c:1906  */
 -#line 3019 "./util/configparser.y"
++#line 3108 "./util/configparser.y" /* yacc.c:1906  */
  
  
  /* parse helper routines could be here */