Update to libunbound 1.15.0; heavy lifting by sthen in unbound(8).

Upstream renamed parse_edns_from_pkt to parse_edns_from_query_pkt and
added two arguments (config_file and comm_point) that we don't use,
adjust callers in frontend accordingly.

diff --git a/sbin/unwind/frontend.c b/sbin/unwind/frontend.c
index e267b92..6316231 100644 (file)
--- a/sbin/unwind/frontend.c
+++ b/sbin/unwind/frontend.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: frontend.c,v 1.70 2022/03/01 18:30:23 florian Exp $   */
+/*     $OpenBSD: frontend.c,v 1.71 2022/03/01 18:34:21 florian Exp $   */
 
 /*
  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
@@ -779,7 +779,8 @@ handle_query(struct pending_query *pq)
                error_answer(pq, LDNS_RCODE_SERVFAIL);
                goto send_answer;
        }
-       rcode = parse_edns_from_pkt(pq->qbuf, &pq->edns, pq->region);
+       rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL,
+           pq->region);
        if (rcode != LDNS_RCODE_NOERROR) {
                error_answer(pq, rcode);
                goto send_answer;
@@ -1071,7 +1072,8 @@ resend_dns64_query(struct pending_query *opq) {
                error_answer(pq, LDNS_RCODE_SERVFAIL);
                goto send_answer;
        }
-       rcode = parse_edns_from_pkt(pq->qbuf, &pq->edns, pq->region);
+       rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL,
+           pq->region);
        if (rcode != LDNS_RCODE_NOERROR) {
                error_answer(pq, rcode);
                goto send_answer;

diff --git a/sbin/unwind/libunbound/config.h b/sbin/unwind/libunbound/config.h
index 695945c..b09a31b 100644 (file)
--- a/sbin/unwind/libunbound/config.h
+++ b/sbin/unwind/libunbound/config.h
@@ -73,6 +73,9 @@
 /* If we have be64toh */
 #define HAVE_BE64TOH 1
 
+/* Define to 1 if you have the `BIO_set_callback_ex' function. */
+#define HAVE_BIO_SET_CALLBACK_EX 1
+
 /* Define to 1 if you have the <bsd/stdlib.h> header file. */
 /* #undef HAVE_BSD_STDLIB_H */
 
@@ -224,7 +227,7 @@
 #define HAVE_EVP_DIGESTVERIFY 1
 
 /* Define to 1 if you have the `EVP_dss1' function. */
-#define HAVE_EVP_DSS1 1
+/* #undef HAVE_EVP_DSS1 */
 
 /* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
 #define HAVE_EVP_ENCRYPTINIT_EX 1
@@ -260,7 +263,7 @@
 #define HAVE_FCNTL 1
 
 /* Define to 1 if you have the `FIPS_mode' function. */
-/* #undef HAVE_FIPS_MODE */
+#define HAVE_FIPS_MODE 1
 
 /* Define to 1 if you have the `fork' function. */
 #define HAVE_FORK 1
@@ -319,6 +322,9 @@
 /* Define to 1 if you have the `if_nametoindex' function. */
 #define HAVE_IF_NAMETOINDEX 1
 
+/* Define to 1 if you have the `if_nametoindex' function. */
+#define HAVE_IF_NAMETOINDEX 1
+
 /* Define to 1 if you have the `inet_aton' function. */
 #define HAVE_INET_ATON 1
 
@@ -379,6 +385,9 @@
 /* Define to 1 if you have the <netinet/tcp.h> header file. */
 #define HAVE_NETINET_TCP_H 1
 
+/* Define to 1 if you have the <netioapi.h> header file. */
+/* #undef HAVE_NETIOAPI_H */
+
 /* Use libnettle for crypto */
 /* #undef HAVE_NETTLE */
 
@@ -536,7 +545,7 @@
 #define HAVE_SSL_CTX_SET_ALPN_SELECT_CB 1
 
 /* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
-/* #undef HAVE_SSL_CTX_SET_CIPHERSUITES */
+#define HAVE_SSL_CTX_SET_CIPHERSUITES 1
 
 /* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
 /* #undef HAVE_SSL_CTX_SET_SECURITY_LEVEL */
@@ -751,7 +760,7 @@
 #define PACKAGE_NAME "unbound"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "unbound 1.13.2"
+#define PACKAGE_STRING "unbound 1.15.0"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "unbound"
@@ -760,7 +769,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.13.2"
+#define PACKAGE_VERSION "1.15.0"
 
 /* default pidfile location */
 #define PIDFILE ""
@@ -783,7 +792,7 @@
 #define ROOT_CERT_FILE "/var/unbound/etc/icannbundle.pem"
 
 /* version number for resource files */
-#define RSRC_PACKAGE_VERSION 1,13,2,0
+#define RSRC_PACKAGE_VERSION 1,15,0,0
 
 /* Directory to chdir to */
 #define RUN_DIR "/var/unbound/etc"

diff --git a/sbin/unwind/libunbound/dns64/dns64.c b/sbin/unwind/libunbound/dns64/dns64.c
index c79bc9c..d01b436 100644 (file)
--- a/sbin/unwind/libunbound/dns64/dns64.c
+++ b/sbin/unwind/libunbound/dns64/dns64.c
@@ -685,8 +685,12 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
        switch(event) {
                case module_event_new:
                        /* Tag this query as being new and fall through. */
-                       iq = (struct dns64_qstate*)regional_alloc(
-                               qstate->region, sizeof(*iq));
+                       if (!(iq = (struct dns64_qstate*)regional_alloc(
+                               qstate->region, sizeof(*iq)))) {
+                               log_err("out of memory");
+                               qstate->ext_state[id] = module_error;
+                               return;
+                       }
                        qstate->minfo[id] = iq;
                        iq->state = DNS64_NEW_QUERY;
                        iq->started_no_cache_store = qstate->no_cache_store;
@@ -913,8 +917,9 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
                     sizeof(struct dns_msg))))
         return;
     super->return_msg->qinfo = super->qinfo;
-    super->return_msg->rep = reply_info_copy(qstate->return_msg->rep, NULL,
-            super->region);
+    if (!(super->return_msg->rep = reply_info_copy(qstate->return_msg->rep,
+                    NULL, super->region)))
+        return;
 
     /*
      * Adjust the domain name of the answer RR set so that it matches the

diff --git a/sbin/unwind/libunbound/dnscrypt/dnscrypt.h b/sbin/unwind/libunbound/dnscrypt/dnscrypt.h
index 666f54e..b0da9b7 100644 (file)
--- a/sbin/unwind/libunbound/dnscrypt/dnscrypt.h
+++ b/sbin/unwind/libunbound/dnscrypt/dnscrypt.h
@@ -114,7 +114,7 @@ void dnsc_delete(struct dnsc_env *env);
 
 /**
  * handle a crypted dnscrypt request.
- * Determine wether or not a query is coming over the dnscrypt listener and
+ * Determine whether or not a query is coming over the dnscrypt listener and
  * attempt to uncurve it or detect if it is a certificate query.
  * return 0 in case of failure.
  */
@@ -122,7 +122,7 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
                                struct comm_reply* repinfo);
 /**
  * handle an unencrypted dnscrypt request.
- * Determine wether or not a query is going over the dnscrypt channel and
+ * Determine whether or not a query is going over the dnscrypt channel and
  * attempt to curve it unless it was not crypted like when  it is a
  * certificate query.
  * \return 0 in case of failure.

diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.c b/sbin/unwind/libunbound/iterator/iter_delegpt.c
index 9a672b0..80148e8 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_delegpt.c
+++ b/sbin/unwind/libunbound/iterator/iter_delegpt.c
@@ -73,8 +73,10 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
        copy->bogus = dp->bogus;
        copy->has_parent_side_NS = dp->has_parent_side_NS;
        copy->ssl_upstream = dp->ssl_upstream;
+       copy->tcp_upstream = dp->tcp_upstream;
        for(ns = dp->nslist; ns; ns = ns->next) {
-               if(!delegpt_add_ns(copy, region, ns->name, ns->lame))
+               if(!delegpt_add_ns(copy, region, ns->name, ns->lame,
+                       ns->tls_auth_name, ns->port))
                        return NULL;
                copy->nslist->resolved = ns->resolved;
                copy->nslist->got4 = ns->got4;
@@ -83,8 +85,8 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
                copy->nslist->done_pside6 = ns->done_pside6;
        }
        for(a = dp->target_list; a; a = a->next_target) {
-               if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-                       a->bogus, a->lame, a->tls_auth_name, NULL))
+               if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen,
+                       a->bogus, a->lame, a->tls_auth_name, -1, NULL))
                        return NULL;
        }
        return copy;
@@ -101,7 +103,7 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)
 
 int 
 delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
-       uint8_t lame)
+       uint8_t lame, char* tls_auth_name, int port)
 {
        struct delegpt_ns* ns;
        size_t len;
@@ -125,6 +127,14 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
        ns->lame = lame;
        ns->done_pside4 = 0;
        ns->done_pside6 = 0;
+       ns->port = port;
+       if(tls_auth_name) {
+               ns->tls_auth_name = regional_strdup(region, tls_auth_name);
+               if(!ns->tls_auth_name)
+                       return 0;
+       } else {
+               ns->tls_auth_name = NULL;
+       }
        return ns->name != 0;
 }
 
@@ -158,9 +168,9 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
        return NULL;
 }
 
-int 
-delegpt_add_target(struct delegpt* dp, struct regional* region, 
-       uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
+int
+delegpt_add_target(struct delegpt* dp, struct regional* region,
+       uint8_t* name, size_t namelen, struct sockaddr_storage* addr,
        socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions)
 {
        struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
@@ -176,17 +186,22 @@ delegpt_add_target(struct delegpt* dp, struct regional* region,
                if(ns->got4 && ns->got6)
                        ns->resolved = 1;
        }
-       return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, NULL,
-               additions);
+       log_assert(ns->port>0);
+       return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame,
+               ns->tls_auth_name, ns->port, additions);
 }
 
-int 
-delegpt_add_addr(struct delegpt* dp, struct regional* region, 
-       struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, 
-       uint8_t lame, char* tls_auth_name, int* additions)
+int
+delegpt_add_addr(struct delegpt* dp, struct regional* region,
+       struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus,
+       uint8_t lame, char* tls_auth_name, int port, int* additions)
 {
        struct delegpt_addr* a;
        log_assert(!dp->dp_type_mlc);
+       if(port != -1) {
+               log_assert(port>0);
+               sockaddr_store_port(addr, addrlen, port);
+       }
        /* check for duplicates */
        if((a = delegpt_find_addr(dp, addr, addrlen))) {
                if(bogus)
@@ -411,7 +426,8 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
                        (size_t)sldns_read_uint16(nsdata->rr_data[i]))
                        continue; /* bad format */
                /* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
-               if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame))
+               if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame,
+                       NULL, UNBOUND_DNS_PORT))
                        return 0;
        }
        return 1;
@@ -428,7 +444,6 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
        log_assert(!dp->dp_type_mlc);
         memset(&sa, 0, len);
         sa.sin_family = AF_INET;
-        sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
         for(i=0; i<d->count; i++) {
                 if(d->rr_len[i] != 2 + INET_SIZE)
                         continue;
@@ -452,7 +467,6 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
        log_assert(!dp->dp_type_mlc);
         memset(&sa, 0, len);
         sa.sin6_family = AF_INET6;
-        sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
         for(i=0; i<d->count; i++) {
                 if(d->rr_len[i] != 2 + INET6_SIZE) /* rdatalen + len of IP6 */
                         continue;
@@ -554,6 +568,7 @@ void delegpt_free_mlc(struct delegpt* dp)
        while(n) {
                nn = n->next;
                free(n->name);
+               free(n->tls_auth_name);
                free(n);
                n = nn;
        }
@@ -576,7 +591,8 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name)
        return (dp->name != NULL);
 }
 
-int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame)
+int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
+       char* tls_auth_name, int port)
 {
        struct delegpt_ns* ns;
        size_t len;
@@ -603,14 +619,30 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame)
        ns->lame = (uint8_t)lame;
        ns->done_pside4 = 0;
        ns->done_pside6 = 0;
+       ns->port = port;
+       if(tls_auth_name) {
+               ns->tls_auth_name = strdup(tls_auth_name);
+               if(!ns->tls_auth_name) {
+                       free(ns->name);
+                       free(ns);
+                       return 0;
+               }
+       } else {
+               ns->tls_auth_name = NULL;
+       }
        return 1;
 }
 
 int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
-       socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name)
+       socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name,
+       int port)
 {
        struct delegpt_addr* a;
        log_assert(dp->dp_type_mlc);
+       if(port != -1) {
+               log_assert(port>0);
+               sockaddr_store_port(addr, addrlen, port);
+       }
        /* check for duplicates */
        if((a = delegpt_find_addr(dp, addr, addrlen))) {
                if(bogus)
@@ -663,7 +695,9 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen,
                if(ns->got4 && ns->got6)
                        ns->resolved = 1;
        }
-       return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame, NULL);
+       log_assert(ns->port>0);
+       return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame,
+               ns->tls_auth_name, ns->port);
 }
 
 size_t delegpt_get_mem(struct delegpt* dp)

diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.h b/sbin/unwind/libunbound/iterator/iter_delegpt.h
index 138eb6e..17db15a 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_delegpt.h
+++ b/sbin/unwind/libunbound/iterator/iter_delegpt.h
@@ -83,6 +83,8 @@ struct delegpt {
        uint8_t dp_type_mlc;
        /** use SSL for upstream query */
        uint8_t ssl_upstream;
+       /** use TCP for upstream query */
+       uint8_t tcp_upstream;
        /** delegpt from authoritative zone that is locally hosted */
        uint8_t auth_dp;
        /*** no cache */
@@ -124,6 +126,11 @@ struct delegpt_ns {
         * Also enabled if a parent-side cache entry exists, or a parent-side
         * negative-cache entry exists. */
        uint8_t done_pside6;
+       /** the TLS authentication name, (if not NULL) to use. */
+       char* tls_auth_name;
+       /** the port to use; it should mosty be the default 53 but configured
+        *  upstreams can provide nondefault ports. */
+       int port;
 };
 
 /**
@@ -189,10 +196,12 @@ int delegpt_set_name(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param name: domain name in wire format.
  * @param lame: name is lame, disprefer it.
+ * @param tls_auth_name: TLS authentication name (or NULL).
+ * @param port: port to use for resolved addresses.
  * @return false on error.
  */
-int delegpt_add_ns(struct delegpt* dp, struct regional* regional, 
-       uint8_t* name, uint8_t lame);
+int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
+       uint8_t* name, uint8_t lame, char* tls_auth_name, int port);
 
 /**
  * Add NS rrset; calls add_ns repeatedly.
@@ -269,12 +278,14 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param bogus: if address is bogus.
  * @param lame: if address is lame.
  * @param tls_auth_name: TLS authentication name (or NULL).
+ * @param port: the port to use; if -1 the port is taken from addr.
  * @param additions: will be set to 1 if a new address is added
  * @return false on error.
  */
-int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
+int delegpt_add_addr(struct delegpt* dp, struct regional* regional,
        struct sockaddr_storage* addr, socklen_t addrlen,
-       uint8_t bogus, uint8_t lame, char* tls_auth_name, int* additions);
+       uint8_t bogus, uint8_t lame, char* tls_auth_name, int port,
+       int* additions);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -402,22 +413,27 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name);
  * @param dp: must have been created with delegpt_create_mlc. 
  * @param name: the name to add.
  * @param lame: the name is lame, disprefer.
+ * @param tls_auth_name: TLS authentication name (or NULL).
+ * @param port: port to use for resolved addresses.
  * @return false on error.
  */
-int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame);
+int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
+       char* tls_auth_name, int port);
 
 /**
  * add an address to a malloced delegation point.
- * @param dp: must have been created with delegpt_create_mlc. 
+ * @param dp: must have been created with delegpt_create_mlc.
  * @param addr: the address.
  * @param addrlen: the length of addr.
  * @param bogus: if address is bogus.
  * @param lame: if address is lame.
  * @param tls_auth_name: TLS authentication name (or NULL).
+ * @param port: the port to use; if -1 the port is taken from addr.
  * @return false on error.
  */
 int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
-       socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name);
+       socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name,
+       int port);
 
 /**
  * Add target address to the delegation point.

diff --git a/sbin/unwind/libunbound/iterator/iter_fwd.c b/sbin/unwind/libunbound/iterator/iter_fwd.c
index ea3d70e..1513729 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_fwd.c
+++ b/sbin/unwind/libunbound/iterator/iter_fwd.c
@@ -200,21 +200,27 @@ read_fwds_name(struct config_stub* s)
 }
 
 /** set fwd host names */
-static int 
+static int
 read_fwds_host(struct config_stub* s, struct delegpt* dp)
 {
        struct config_strlist* p;
        uint8_t* dname;
-       size_t dname_len;
+       char* tls_auth_name;
+       int port;
        for(p = s->hosts; p; p = p->next) {
                log_assert(p->str);
-               dname = sldns_str2wire_dname(p->str, &dname_len);
+               dname = authextstrtodname(p->str, &port, &tls_auth_name);
                if(!dname) {
                        log_err("cannot parse forward %s server name: '%s'", 
                                s->name, p->str);
                        return 0;
                }
-               if(!delegpt_add_ns_mlc(dp, dname, 0)) {
+#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
+               if(tls_auth_name)
+                       log_err("no name verification functionality in "
+                               "ssl library, ignored name for %s", p->str);
+#endif
+               if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) {
                        free(dname);
                        log_err("out of memory");
                        return 0;
@@ -245,7 +251,7 @@ read_fwds_addr(struct config_stub* s, struct delegpt* dp)
                                "ssl library, ignored name for %s", p->str);
 #endif
                if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
-                       tls_auth_name)) {
+                       tls_auth_name, -1)) {
                        log_err("out of memory");
                        return 0;
                }
@@ -276,6 +282,8 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
                dp->no_cache = s->no_cache;
                /* use SSL for queries to this forwarder */
                dp->ssl_upstream = (uint8_t)s->ssl_upstream;
+               /* use TCP for queries to this forwarder */
+               dp->tcp_upstream = (uint8_t)s->tcp_upstream;
                verbose(VERB_QUERY, "Forward zone server list:");
                delegpt_log(VERB_QUERY, dp);
                if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))

diff --git a/sbin/unwind/libunbound/iterator/iter_hints.c b/sbin/unwind/libunbound/iterator/iter_hints.c
index 60e5181..9b1a200 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_hints.c
+++ b/sbin/unwind/libunbound/iterator/iter_hints.c
@@ -99,7 +99,7 @@ ah(struct delegpt* dp, const char* sv, const char* ip)
                log_err("could not parse %s", sv);
                return 0;
        }
-       if(!delegpt_add_ns_mlc(dp, dname, 0) ||
+       if(!delegpt_add_ns_mlc(dp, dname, 0, NULL, UNBOUND_DNS_PORT) ||
           !extstrtoaddr(ip, &addr, &addrlen) ||
           !delegpt_add_target_mlc(dp, dname, dname_len,
                &addr, addrlen, 0, 0)) {
@@ -213,21 +213,27 @@ read_stubs_name(struct config_stub* s)
 }
 
 /** set stub host names */
-static int 
+static int
 read_stubs_host(struct config_stub* s, struct delegpt* dp)
 {
        struct config_strlist* p;
-       size_t dname_len;
        uint8_t* dname;
+       char* tls_auth_name;
+       int port;
        for(p = s->hosts; p; p = p->next) {
                log_assert(p->str);
-               dname = sldns_str2wire_dname(p->str, &dname_len);
+               dname = authextstrtodname(p->str, &port, &tls_auth_name);
                if(!dname) {
                        log_err("cannot parse stub %s nameserver name: '%s'", 
                                s->name, p->str);
                        return 0;
                }
-               if(!delegpt_add_ns_mlc(dp, dname, 0)) {
+#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
+               if(tls_auth_name)
+                       log_err("no name verification functionality in "
+                               "ssl library, ignored name for %s", p->str);
+#endif
+               if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) {
                        free(dname);
                        log_err("out of memory");
                        return 0;
@@ -258,7 +264,7 @@ read_stubs_addr(struct config_stub* s, struct delegpt* dp)
                                "ssl library, ignored name for %s", p->str);
 #endif
                if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
-                       auth_name)) {
+                       auth_name, -1)) {
                        log_err("out of memory");
                        return 0;
                }
@@ -287,6 +293,8 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
                dp->no_cache = s->no_cache;
                /* ssl_upstream */
                dp->ssl_upstream = (uint8_t)s->ssl_upstream;
+               /* tcp_upstream */
+               dp->tcp_upstream = (uint8_t)s->tcp_upstream;
                delegpt_log(VERB_QUERY, dp);
                if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime))
                        return 0;
@@ -336,7 +344,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
                if(sldns_wirerr_get_type(rr, rr_len, dname_len)
                        == LDNS_RR_TYPE_NS) {
                        if(!delegpt_add_ns_mlc(dp, sldns_wirerr_get_rdata(rr,
-                               rr_len, dname_len), 0)) {
+                               rr_len, dname_len), 0, NULL, UNBOUND_DNS_PORT)) {
                                log_err("out of memory reading root hints");
                                goto stop_read;
                        }
@@ -395,10 +403,10 @@ read_root_hints(struct iter_hints* hints, char* fname)
                delegpt_free_mlc(dp);
                return 1;
        }
+       delegpt_log(VERB_QUERY, dp);
        if(!hints_insert(hints, c, dp, 0)) {
                return 0;
        }
-       delegpt_log(VERB_QUERY, dp);
        return 1;
 
 stop_read:

diff --git a/sbin/unwind/libunbound/iterator/iter_utils.c b/sbin/unwind/libunbound/iterator/iter_utils.c
index 668f898..2482a1f 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_utils.c
+++ b/sbin/unwind/libunbound/iterator/iter_utils.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -37,7 +37,7 @@
  * \file
  *
  * This file contains functions to assist the iterator module.
- * Configuration options. Forward zones. 
+ * Configuration options. Forward zones.
  */
 #include "config.h"
 #include "iterator/iter_utils.h"
@@ -141,7 +141,7 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
        return 1;
 }
 
-int 
+int
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
        int i;
@@ -151,7 +151,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
        for(i=0; i<iter_env->max_dependency_depth+1; i++)
                verbose(VERB_QUERY, "target fetch policy for level %d is %d",
                        i, iter_env->target_fetch_policy[i]);
-       
+
        if(!iter_env->donotq)
                iter_env->donotq = donotq_create();
        if(!iter_env->donotq || !donotq_apply_cfg(iter_env->donotq, cfg)) {
@@ -176,6 +176,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
        }
        iter_env->supports_ipv6 = cfg->do_ip6;
        iter_env->supports_ipv4 = cfg->do_ip4;
+       iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
        return 1;
 }
 
@@ -212,7 +213,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *             dnsseclame servers get penalty
  *     USEFUL_SERVER_TOP_TIMEOUT*3 ..
  *             recursion lame servers get penalty
- *     UNKNOWN_SERVER_NICENESS 
+ *     UNKNOWN_SERVER_NICENESS
  *             If no information is known about the server, this is
  *             returned. 376 msec or so.
  *     +BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*4) for dnssec failed IPs.
@@ -221,11 +222,11 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  * is turned off (so we do not discard the reply).
  * When a final value is chosen that is recursionlame; RD bit is set on query.
  * Because of the numbers this means recursionlame also have dnssec lameness
- * checking turned off. 
+ * checking turned off.
  */
 static int
 iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
-       uint8_t* name, size_t namelen, uint16_t qtype, time_t now, 
+       uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
        struct delegpt_addr* a)
 {
        int rtt, lame, reclame, dnsseclame;
@@ -243,8 +244,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
                return -1; /* there is no ip4 available */
        }
        /* check lameness - need zone , class info */
-       if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
-               name, namelen, qtype, &lame, &dnsseclame, &reclame, 
+       if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
+               name, namelen, qtype, &lame, &dnsseclame, &reclame,
                &rtt, now)) {
                log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
                verbose(VERB_ALGO, "   rtt=%d%s%s%s%s", rtt,
@@ -282,7 +283,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 /** lookup RTT information, and also store fastest rtt (if any) */
 static int
 iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
-       uint8_t* name, size_t namelen, uint16_t qtype, time_t now, 
+       uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
        struct delegpt* dp, int* best_rtt, struct sock_list* blacklist,
        size_t* num_suitable_results)
 {
@@ -293,7 +294,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
        if(dp->bogus)
                return 0; /* NS bogus, all bogus, nothing found */
        for(a=dp->result_list; a; a = a->next_result) {
-               a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
+               a->sel_rtt = iter_filter_unsuitable(iter_env, env,
                        name, namelen, qtype, now, a);
                if(a->sel_rtt != -1) {
                        if(sock_list_find(blacklist, &a->addr, a->addrlen))
@@ -329,7 +330,7 @@ nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n)
        int rtt_band;
        size_t i;
        int* rtt_list, *rtt_index;
-       
+
        if(num_results < 1 || n >= num_results) {
                return -1;
        }
@@ -361,8 +362,8 @@ nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n)
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
-       uint8_t* name, size_t namelen, uint16_t qtype, time_t now, 
-       struct delegpt* dp, int* selected_rtt, int open_target, 
+       uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
+       struct delegpt* dp, int* selected_rtt, int open_target,
        struct sock_list* blacklist, time_t prefetch)
 {
        int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND, nth;
@@ -370,9 +371,9 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
        struct delegpt_addr* a, *n, *prev=NULL;
 
        /* fillup sel_rtt and find best rtt in the bunch */
-       got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, 
+       got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp,
                &low_rtt, blacklist, &num_results);
-       if(got_num == 0) 
+       if(got_num == 0)
                return 0;
        if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
                (delegpt_count_missing_targets(dp) > 0 || open_target > 0)) {
@@ -548,9 +549,9 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
        return got_num;
 }
 
-struct delegpt_addr* 
-iter_server_selection(struct iter_env* iter_env, 
-       struct module_env* env, struct delegpt* dp, 
+struct delegpt_addr*
+iter_server_selection(struct iter_env* iter_env,
+       struct module_env* env, struct delegpt* dp,
        uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_lame,
        int* chase_to_rd, int open_target, struct sock_list* blacklist,
        time_t prefetch)
@@ -592,7 +593,7 @@ iter_server_selection(struct iter_env* iter_env,
 
        if(num == 1) {
                a = dp->result_list;
-               if(++a->attempts < OUTBOUND_MSG_RETRY)
+               if(++a->attempts < iter_env->outbound_msg_retry)
                        return a;
                dp->result_list = a->next_result;
                return a;
@@ -602,7 +603,7 @@ iter_server_selection(struct iter_env* iter_env,
        log_assert(num > 1);
        /* grab secure random number, to pick unexpected server.
         * also we need it to be threadsafe. */
-       sel = ub_random_max(env->rnd, num); 
+       sel = ub_random_max(env->rnd, num);
        a = dp->result_list;
        prev = NULL;
        while(sel > 0 && a) {
@@ -612,7 +613,7 @@ iter_server_selection(struct iter_env* iter_env,
        }
        if(!a)  /* robustness */
                return NULL;
-       if(++a->attempts < OUTBOUND_MSG_RETRY)
+       if(++a->attempts < iter_env->outbound_msg_retry)
                return a;
        /* remove it from the delegation point result list */
        if(prev)
@@ -621,8 +622,8 @@ iter_server_selection(struct iter_env* iter_env,
        return a;
 }
 
-struct dns_msg* 
-dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg, 
+struct dns_msg*
+dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg,
        struct regional* region)
 {
        struct dns_msg* m = (struct dns_msg*)regional_alloc(region,
@@ -637,7 +638,7 @@ dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg,
        return m;
 }
 
-struct dns_msg* 
+struct dns_msg*
 dns_copy_msg(struct dns_msg* from, struct regional* region)
 {
        struct dns_msg* m = (struct dns_msg*)regional_alloc(region,
@@ -653,7 +654,7 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
        return m;
 }
 
-void 
+void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
        struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
        struct regional* region, uint16_t flags)
@@ -663,7 +664,7 @@ iter_dns_store(struct module_env* env, struct query_info* msgqinf,
                log_err("out of memory: cannot store data in cache");
 }
 
-int 
+int
 iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 {
        int sel;
@@ -671,7 +672,7 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
                return 1;
        /* we do not need secure random numbers here, but
         * we do need it to be threadsafe, so we use this */
-       sel = ub_random_max(rnd, m); 
+       sel = ub_random_max(rnd, m);
        return (sel < n);
 }
 
@@ -688,12 +689,12 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
        qinf.local_alias = NULL;
        fptr_ok(fptr_whitelist_modenv_detect_cycle(
                qstate->env->detect_cycle));
-       return (*qstate->env->detect_cycle)(qstate, &qinf, 
+       return (*qstate->env->detect_cycle)(qstate, &qinf,
                (uint16_t)(BIT_RD|BIT_CD), qstate->is_priming,
                qstate->is_valrec);
 }
 
-void 
+void
 iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 {
        struct delegpt_ns* ns;
@@ -701,21 +702,21 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
                if(ns->resolved)
                        continue;
                /* see if this ns as target causes dependency cycle */
-               if(causes_cycle(qstate, ns->name, ns->namelen, 
+               if(causes_cycle(qstate, ns->name, ns->namelen,
                        LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass) ||
-                  causes_cycle(qstate, ns->name, ns->namelen, 
+                  causes_cycle(qstate, ns->name, ns->namelen,
                        LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
                        log_nametypeclass(VERB_QUERY, "skipping target due "
                                "to dependency cycle (harden-glue: no may "
-                               "fix some of the cycles)", 
-                               ns->name, LDNS_RR_TYPE_A, 
+                               "fix some of the cycles)",
+                               ns->name, LDNS_RR_TYPE_A,
                                qstate->qinfo.qclass);
                        ns->resolved = 1;
                }
        }
 }
 
-void 
+void
 iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 {
        struct delegpt_ns* ns;
@@ -723,14 +724,14 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
                if(ns->done_pside4 && ns->done_pside6)
                        continue;
                /* see if this ns as target causes dependency cycle */
-               if(causes_cycle(qstate, ns->name, ns->namelen, 
+               if(causes_cycle(qstate, ns->name, ns->namelen,
                        LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
                        log_nametypeclass(VERB_QUERY, "skipping target due "
                                "to dependency cycle", ns->name,
                                LDNS_RR_TYPE_A, qstate->qinfo.qclass);
                        ns->done_pside4 = 1;
                }
-               if(causes_cycle(qstate, ns->name, ns->namelen, 
+               if(causes_cycle(qstate, ns->name, ns->namelen,
                        LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass)) {
                        log_nametypeclass(VERB_QUERY, "skipping target due "
                                "to dependency cycle", ns->name,
@@ -740,8 +741,8 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
        }
 }
 
-int 
-iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
+int
+iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
        struct delegpt* dp)
 {
        struct delegpt_ns* ns;
@@ -760,14 +761,14 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
        /* either available or unused targets */
        if(dp->usable_list || dp->result_list)
                return 0;
-       
+
        /* see if query is for one of the nameservers, which is glue */
        if( (qinfo->qtype == LDNS_RR_TYPE_A ||
                qinfo->qtype == LDNS_RR_TYPE_AAAA) &&
                dname_subdomain_c(qinfo->qname, dp->name) &&
                delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
                return 1;
-       
+
        for(ns = dp->nslist; ns; ns = ns->next) {
                if(ns->resolved) /* skip failed targets */
                        continue;
@@ -785,7 +786,7 @@ iter_qname_indicates_dnssec(struct module_env* env, struct query_info *qinfo)
                return 0;
        /* a trust anchor exists above the name? */
        if((a=anchors_lookup(env->anchors, qinfo->qname, qinfo->qname_len,
-               qinfo->qclass))) { 
+               qinfo->qclass))) {
                if(a->numDS == 0 && a->numDNSKEY == 0) {
                        /* insecure trust point */
                        lock_basic_unlock(&a->lock);
@@ -798,7 +799,7 @@ iter_qname_indicates_dnssec(struct module_env* env, struct query_info *qinfo)
        return 0;
 }
 
-int 
+int
 iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
         struct dns_msg* msg, uint16_t dclass)
 {
@@ -842,7 +843,7 @@ iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
        return 0;
 }
 
-int 
+int
 iter_msg_has_dnssec(struct dns_msg* msg)
 {
        size_t i;
@@ -875,7 +876,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
                 * and referral to example.com. NS ... , then origin zone
                 * is .com. For a referral to sub.example.com. NS ... then
                 * we do not know, since example.com. may be in between. */
-               for(i=0; i<msg->rep->an_numrrsets+msg->rep->ns_numrrsets; 
+               for(i=0; i<msg->rep->an_numrrsets+msg->rep->ns_numrrsets;
                        i++) {
                        struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
                        if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS &&
@@ -890,7 +891,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
                return 0;
        }
        log_assert(type==RESPONSE_TYPE_ANSWER || type==RESPONSE_TYPE_CNAME);
-       /* not a referral, and not lame delegation (upwards), so, 
+       /* not a referral, and not lame delegation (upwards), so,
         * any NS rrset must be from the zone itself */
        if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
                LDNS_RR_TYPE_NS, dclass) ||
@@ -906,7 +907,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
 }
 
 /**
- * check equality of two rrsets 
+ * check equality of two rrsets
  * @param k1: rrset
  * @param k2: rrset
  * @return true if equal
@@ -935,7 +936,7 @@ rrset_equal(struct ub_packed_rrset_key* k1, struct ub_packed_rrset_key* k2)
        for(i=0; i<t; i++) {
                if(d1->rr_len[i] != d2->rr_len[i] ||
                        /* no ttl check: d1->rr_ttl[i] != d2->rr_ttl[i] ||*/
-                       memcmp(d1->rr_data[i], d2->rr_data[i], 
+                       memcmp(d1->rr_data[i], d2->rr_data[i],
                                d1->rr_len[i]) != 0)
                        return 0;
        }
@@ -966,7 +967,7 @@ rrset_canonical_sort_cmp(const void* x, const void* y)
        return 0;
 }
 
-int 
+int
 reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
 {
        size_t i;
@@ -1024,7 +1025,7 @@ reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
        return 1;
 }
 
-void 
+void
 caps_strip_reply(struct reply_info* rep)
 {
        size_t i;
@@ -1066,8 +1067,8 @@ int caps_failed_rcode(struct reply_info* rep)
                FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN);
 }
 
-void 
-iter_store_parentside_rrset(struct module_env* env, 
+void
+iter_store_parentside_rrset(struct module_env* env,
        struct ub_packed_rrset_key* rrset)
 {
        struct rrset_ref ref;
@@ -1107,12 +1108,12 @@ iter_store_parentside_NS(struct module_env* env, struct reply_info* rep)
        }
 }
 
-void iter_store_parentside_neg(struct module_env* env, 
+void iter_store_parentside_neg(struct module_env* env,
         struct query_info* qinfo, struct reply_info* rep)
 {
        /* TTL: NS from referral in iq->deleg_msg,
         *      or first RR from iq->response,
-        *      or servfail5secs if !iq->response */ 
+        *      or servfail5secs if !iq->response */
        time_t ttl = NORR_TTL;
        struct ub_packed_rrset_key* neg;
        struct packed_rrset_data* newd;
@@ -1133,7 +1134,7 @@ void iter_store_parentside_neg(struct module_env* env,
        neg->rk.type = htons(qinfo->qtype);
        neg->rk.rrset_class = htons(qinfo->qclass);
        neg->rk.flags = 0;
-       neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname, 
+       neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname,
                qinfo->qname_len);
        if(!neg->rk.dname) {
                log_err("out of memory in store_parentside_neg");
@@ -1141,7 +1142,7 @@ void iter_store_parentside_neg(struct module_env* env,
        }
        neg->rk.dname_len = qinfo->qname_len;
        neg->entry.hash = rrset_key_hash(&neg->rk);
-       newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch, 
+       newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch,
                sizeof(struct packed_rrset_data) + sizeof(size_t) +
                sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t));
        if(!newd) {
@@ -1166,13 +1167,13 @@ void iter_store_parentside_neg(struct module_env* env,
        iter_store_parentside_rrset(env, neg);
 }
 
-int 
+int
 iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
        struct regional* region, struct query_info* qinfo)
 {
        struct ub_packed_rrset_key* akey;
-       akey = rrset_cache_lookup(env->rrset_cache, dp->name, 
-               dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass, 
+       akey = rrset_cache_lookup(env->rrset_cache, dp->name,
+               dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass,
                PACKED_RRSET_PARENT_SIDE, *env->now, 0);
        if(akey) {
                log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
@@ -1195,8 +1196,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
        size_t num = delegpt_count_targets(dp);
        for(ns = dp->nslist; ns; ns = ns->next) {
                /* get cached parentside A */
-               akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-                       ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass, 
+               akey = rrset_cache_lookup(env->rrset_cache, ns->name,
+                       ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass,
                        PACKED_RRSET_PARENT_SIDE, *env->now, 0);
                if(akey) {
                        log_rrset_key(VERB_ALGO, "found parent-side", akey);
@@ -1207,8 +1208,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
                        lock_rw_unlock(&akey->entry.lock);
                }
                /* get cached parentside AAAA */
-               akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-                       ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass, 
+               akey = rrset_cache_lookup(env->rrset_cache, ns->name,
+                       ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass,
                        PACKED_RRSET_PARENT_SIDE, *env->now, 0);
                if(akey) {
                        log_rrset_key(VERB_ALGO, "found parent-side", akey);
@@ -1223,8 +1224,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env,
        return delegpt_count_targets(dp) != num;
 }
 
-int 
-iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 
+int
+iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
        uint16_t* c)
 {
        uint16_t c1 = *c, c2 = *c;
@@ -1246,7 +1247,7 @@ void
 iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
 {
        /* Only the DS record for the delegation itself is expected.
-        * We allow DS for everything between the bailiwick and the 
+        * We allow DS for everything between the bailiwick and the
         * zonecut, thus DS records must be at or above the zonecut.
         * And the DS records must be below the server authority zone.
         * The answer section is already scrubbed. */
@@ -1260,7 +1261,7 @@ iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
                                s->rk.dname, ntohs(s->rk.type),
                                ntohs(s->rk.rrset_class));
                        memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1,
-                               sizeof(struct ub_packed_rrset_key*) * 
+                               sizeof(struct ub_packed_rrset_key*) *
                                (msg->rep->rrset_count-i-1));
                        msg->rep->ns_numrrsets--;
                        msg->rep->rrset_count--;
@@ -1284,11 +1285,11 @@ iter_scrub_nxdomain(struct dns_msg* msg)
        msg->rep->an_numrrsets = 0;
 }
 
-void iter_dec_attempts(struct delegpt* dp, int d)
+void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry)
 {
        struct delegpt_addr* a;
        for(a=dp->target_list; a; a = a->next_target) {
-               if(a->attempts >= OUTBOUND_MSG_RETRY) {
+               if(a->attempts >= outbound_msg_retry) {
                        /* add back to result list */
                        a->next_result = dp->result_list;
                        dp->result_list = a;
@@ -1299,7 +1300,8 @@ void iter_dec_attempts(struct delegpt* dp, int d)
        }
 }
 
-void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old)
+void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old,
+       int outbound_msg_retry)
 {
        struct delegpt_addr* a, *o, *prev;
        for(a=dp->target_list; a; a = a->next_target) {
@@ -1313,7 +1315,7 @@ void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old)
        prev = NULL;
        a = dp->usable_list;
        while(a) {
-               if(a->attempts >= OUTBOUND_MSG_RETRY) {
+               if(a->attempts >= outbound_msg_retry) {
                        log_addr(VERB_ALGO, "remove from usable list dp",
                                &a->addr, a->addrlen);
                        /* remove from result list */

diff --git a/sbin/unwind/libunbound/iterator/iter_utils.h b/sbin/unwind/libunbound/iterator/iter_utils.h
index 509d292..0a40916 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_utils.h
+++ b/sbin/unwind/libunbound/iterator/iter_utils.h
@@ -347,16 +347,19 @@ void iter_scrub_nxdomain(struct dns_msg* msg);
  * Remove query attempts from all available ips. For 0x20.
  * @param dp: delegpt.
  * @param d: decrease.
+ * @param outbound_msg_retry: number of retries of outgoing queries
  */
-void iter_dec_attempts(struct delegpt* dp, int d);
+void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry);
 
 /**
  * Add retry counts from older delegpt to newer delegpt.
  * Does not waste time on timeout'd (or other failing) addresses.
  * @param dp: new delegationpoint.
  * @param old: old delegationpoint.
+ * @param outbound_msg_retry: number of retries of outgoing queries
  */
-void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old);
+void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old,
+       int outbound_msg_retry);
 
 /**
  * See if a DS response (type ANSWER) is too low: a nodata answer with 

diff --git a/sbin/unwind/libunbound/iterator/iterator.c b/sbin/unwind/libunbound/iterator/iterator.c
index f0105ad..5400694 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iterator.c
+++ b/sbin/unwind/libunbound/iterator/iterator.c
@@ -1533,36 +1533,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
                if(!iq->ratelimit_ok && qstate->prefetch_leeway)
                        iq->ratelimit_ok = 1; /* allow prefetches, this keeps
                        otherwise valid data in the cache */
-               if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
-                       qstate->env->infra_cache, iq->dp->name,
-                       iq->dp->namelen, *qstate->env->now)) {
-                       /* and increment the rate, so that the rate for time
-                        * now will also exceed the rate, keeping cache fresh */
-                       (void)infra_ratelimit_inc(qstate->env->infra_cache,
-                               iq->dp->name, iq->dp->namelen,
-                               *qstate->env->now, &qstate->qinfo,
-                               qstate->reply);
-                       /* see if we are passed through with slip factor */
-                       if(qstate->env->cfg->ratelimit_factor != 0 &&
-                               ub_random_max(qstate->env->rnd,
-                                   qstate->env->cfg->ratelimit_factor) == 1) {
-                               iq->ratelimit_ok = 1;
-                               log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
-                                       "delegation point", iq->dp->name,
-                                       LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
-                       } else {
-                               lock_basic_lock(&ie->queries_ratelimit_lock);
-                               ie->num_queries_ratelimited++;
-                               lock_basic_unlock(&ie->queries_ratelimit_lock);
-                               log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
-                                       "delegation point", iq->dp->name,
-                                       LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
-                               qstate->was_ratelimited = 1;
-                               errinf(qstate, "query was ratelimited");
-                               errinf_dname(qstate, "for zone", iq->dp->name);
-                               return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-                       }
-               }
 
                /* see if this dp not useless.
                 * It is useless if:
@@ -1988,12 +1958,13 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
                        iq->chase_flags &= ~BIT_RD; /* go to authorities */
                        for(ns = p->nslist; ns; ns=ns->next) {
                                (void)delegpt_add_ns(iq->dp, qstate->region,
-                                       ns->name, ns->lame);
+                                       ns->name, ns->lame, ns->tls_auth_name,
+                                       ns->port);
                        }
                        for(a = p->target_list; a; a=a->next_target) {
                                (void)delegpt_add_addr(iq->dp, qstate->region,
                                        &a->addr, a->addrlen, a->bogus,
-                                       a->lame, a->tls_auth_name, NULL);
+                                       a->lame, a->tls_auth_name, -1, NULL);
                        }
                }
                iq->dp->has_parent_side_NS = 1;
@@ -2211,9 +2182,11 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        int auth_fallback = 0;
        uint8_t* qout_orig = NULL;
        size_t qout_orig_len = 0;
+       int sq_check_ratelimit = 1;
+       int sq_was_ratelimited = 0;
 
-       /* NOTE: a request will encounter this state for each target it 
-        * needs to send a query to. That is, at least one per referral, 
+       /* NOTE: a request will encounter this state for each target it
+        * needs to send a query to. That is, at least one per referral,
         * more if some targets timeout or return throwaway answers. */
 
        log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
@@ -2298,7 +2271,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                iq->minimise_count++;
                iq->timeout_count = 0;
 
-               iter_dec_attempts(iq->dp, 1);
+               iter_dec_attempts(iq->dp, 1, ie->outbound_msg_retry);
 
                /* Limit number of iterations for QNAMEs with more
                 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
@@ -2500,7 +2473,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                                (int)iq->caps_server+1, (int)naddr*3);
                        iq->response = iq->caps_response;
                        iq->caps_fallback = 0;
-                       iter_dec_attempts(iq->dp, 3); /* space for fallback */
+                       iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */
                        iq->num_current_queries++; /* RespState decrements it*/
                        iq->referral_count++; /* make sure we don't loop */
                        iq->sent_count = 0;
@@ -2529,6 +2502,23 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        /* Add the current set of unused targets to our queue. */
        delegpt_add_unused_targets(iq->dp);
 
+       if(qstate->env->auth_zones) {
+               /* apply rpz triggers at query time */
+               struct dns_msg* forged_response = rpz_callback_from_iterator_module(qstate, iq);
+               if(forged_response != NULL) {
+                       qstate->ext_state[id] = module_finished;
+                       qstate->return_rcode = LDNS_RCODE_NOERROR;
+                       qstate->return_msg = forged_response;
+                       iq->response = forged_response;
+                       next_state(iq, FINISHED_STATE);
+                       if(!iter_prepend(iq, qstate->return_msg, qstate->region)) {
+                               log_err("rpz, prepend rrsets: out of memory");
+                               return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+                       }
+                       return 0;
+               }
+       }
+
        /* Select the next usable target, filtering out unsuitable targets. */
        target = iter_server_selection(ie, qstate->env, iq->dp, 
                iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
@@ -2588,7 +2578,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                                                (int)iq->caps_server+1);
                                        iq->response = iq->caps_response;
                                        iq->caps_fallback = 0;
-                                       iter_dec_attempts(iq->dp, 3); /* space for fallback */
+                                       iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */
                                        iq->num_current_queries++; /* RespState decrements it*/
                                        iq->referral_count++; /* make sure we don't loop */
                                        iq->sent_count = 0;
@@ -2629,22 +2619,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                return 0;
        }
 
-       /* if not forwarding, check ratelimits per delegationpoint name */
-       if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
-               if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
-                       iq->dp->namelen, *qstate->env->now, &qstate->qinfo,
-                       qstate->reply)) {
-                       lock_basic_lock(&ie->queries_ratelimit_lock);
-                       ie->num_queries_ratelimited++;
-                       lock_basic_unlock(&ie->queries_ratelimit_lock);
-                       verbose(VERB_ALGO, "query exceeded ratelimits");
-                       qstate->was_ratelimited = 1;
-                       errinf_dname(qstate, "exceeded ratelimit for zone",
-                               iq->dp->name);
-                       return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-               }
-       }
-
+       /* Do not check ratelimit for forwarding queries or if we already got a
+        * pass. */
+       sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok);
        /* We have a valid target. */
        if(verbosity >= VERB_QUERY) {
                log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
@@ -2656,24 +2633,32 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        }
        fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
        outq = (*qstate->env->send_query)(&iq->qinfo_out,
-               iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 
+               iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
                /* unset CD if to forwarder(RD set) and not dnssec retry
                 * (blacklist nonempty) and no trust-anchors are configured
                 * above the qname or on the first attempt when dnssec is on */
                EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&&
                !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
-               &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 
+               &iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
                iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-               ie, iq), &target->addr, target->addrlen,
+               ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
                iq->dp->name, iq->dp->namelen,
+               (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
                (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
-               target->tls_auth_name, qstate);
+               target->tls_auth_name, qstate, &sq_was_ratelimited);
        if(!outq) {
+               if(sq_was_ratelimited) {
+                       lock_basic_lock(&ie->queries_ratelimit_lock);
+                       ie->num_queries_ratelimited++;
+                       lock_basic_unlock(&ie->queries_ratelimit_lock);
+                       verbose(VERB_ALGO, "query exceeded ratelimits");
+                       qstate->was_ratelimited = 1;
+                       errinf_dname(qstate, "exceeded ratelimit for zone",
+                               iq->dp->name);
+                       return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+               }
                log_addr(VERB_QUERY, "error sending query to auth server",
                        &target->addr, target->addrlen);
-               if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
-                   infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
-                       iq->dp->namelen, *qstate->env->now);
                if(qstate->env->cfg->qname_minimisation)
                        iq->minimisation_state = SKIP_MINIMISE_STATE;
                return next_state(iq, QUERYTARGETS_STATE);
@@ -2707,6 +2692,7 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
  * 
  * @param qstate: query state.
  * @param iq: iterator query state.
+ * @param ie: iterator shared global environment.
  * @param id: module id.
  * @return true if the event requires more immediate processing, false if
  *         not. This is generally only true when forwarding the request to
@@ -2714,10 +2700,11 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
  */
 static int
 processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
-       int id)
+       struct iter_env* ie, int id)
 {
        int dnsseclame = 0;
        enum response_type type;
+
        iq->num_current_queries--;
 
        if(!inplace_cb_query_response_call(qstate->env, qstate, iq->response))
@@ -2915,14 +2902,6 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                 * delegation point, and back to the QUERYTARGETS_STATE. */
                verbose(VERB_DETAIL, "query response was REFERRAL");
 
-               if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
-                       /* we have a referral, no ratelimit, we can send
-                        * our queries to the given name */
-                       infra_ratelimit_dec(qstate->env->infra_cache,
-                               iq->dp->name, iq->dp->namelen,
-                               *qstate->env->now);
-               }
-
                /* if hardened, only store referral if we asked for it */
                if(!qstate->no_cache_store &&
                (!qstate->env->cfg->harden_referral_path ||
@@ -2983,7 +2962,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                }
                if(iq->store_parent_NS && query_dname_compare(iq->dp->name,
                        iq->store_parent_NS->name) == 0)
-                       iter_merge_retry_counts(iq->dp, iq->store_parent_NS);
+                       iter_merge_retry_counts(iq->dp, iq->store_parent_NS,
+                               ie->outbound_msg_retry);
                delegpt_log(VERB_ALGO, iq->dp);
                /* Count this as a referral. */
                iq->referral_count++;
@@ -3061,6 +3041,39 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                /* set the current request's qname to the new value. */
                iq->qchase.qname = sname;
                iq->qchase.qname_len = snamelen;
+               if(qstate->env->auth_zones) {
+                       /* apply rpz qname triggers after cname */
+                       struct dns_msg* forged_response =
+                               rpz_callback_from_iterator_cname(qstate, iq);
+                       while(forged_response && reply_find_rrset_section_an(
+                               forged_response->rep, iq->qchase.qname,
+                               iq->qchase.qname_len, LDNS_RR_TYPE_CNAME,
+                               iq->qchase.qclass)) {
+                               /* another cname to follow */
+                               if(!handle_cname_response(qstate, iq, forged_response,
+                                       &sname, &snamelen)) {
+                                       errinf(qstate, "malloc failure, CNAME info");
+                                       return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+                               }
+                               iq->qchase.qname = sname;
+                               iq->qchase.qname_len = snamelen;
+                               forged_response =
+                                       rpz_callback_from_iterator_cname(qstate, iq);
+                       }
+                       if(forged_response != NULL) {
+                               qstate->ext_state[id] = module_finished;
+                               qstate->return_rcode = LDNS_RCODE_NOERROR;
+                               qstate->return_msg = forged_response;
+                               iq->response = forged_response;
+                               next_state(iq, FINISHED_STATE);
+                               if(!iter_prepend(iq, qstate->return_msg, qstate->region)) {
+                                       log_err("rpz after cname, prepend rrsets: out of memory");
+                                       return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+                               }
+                               qstate->return_msg->qinfo = qstate->qinfo;
+                               return 0;
+                       }
+               }
                /* Clear the query state, since this is a query restart. */
                iq->deleg_msg = NULL;
                iq->dp = NULL;
@@ -3188,7 +3201,7 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
        /* Convert our response to a delegation point */
        dp = delegpt_from_message(qstate->return_msg, forq->region);
        if(!dp) {
-               /* if there is no convertable delegation point, then 
+               /* if there is no convertible delegation point, then 
                 * the ANSWER type was (presumably) a negative answer. */
                verbose(VERB_ALGO, "prime response was not a positive "
                        "ANSWER; failing");
@@ -3330,21 +3343,22 @@ processTargetResponse(struct module_qstate* qstate, int id,
                        log_err("out of memory adding pside glue");
        }
 
-       /* This response is relevant to the current query, so we 
-        * add (attempt to add, anyway) this target(s) and reactivate 
-        * the original event. 
-        * NOTE: we could only look for the AnswerRRset if the 
+       /* This response is relevant to the current query, so we
+        * add (attempt to add, anyway) this target(s) and reactivate
+        * the original event.
+        * NOTE: we could only look for the AnswerRRset if the
         * response type was ANSWER. */
        rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep);
        if(rrset) {
                int additions = 0;
                /* if CNAMEs have been followed - add new NS to delegpt. */
                /* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
-               if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 
+               if(!delegpt_find_ns(foriq->dp, rrset->rk.dname,
                        rrset->rk.dname_len)) {
                        /* if dpns->lame then set newcname ns lame too */
-                       if(!delegpt_add_ns(foriq->dp, forq->region, 
-                               rrset->rk.dname, dpns->lame))
+                       if(!delegpt_add_ns(foriq->dp, forq->region,
+                               rrset->rk.dname, dpns->lame, dpns->tls_auth_name,
+                               dpns->port))
                                log_err("out of memory adding cnamed-ns");
                }
                /* if dpns->lame then set the address(es) lame too */
@@ -3694,7 +3708,7 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
                                cont = processQueryTargets(qstate, iq, ie, id);
                                break;
                        case QUERY_RESP_STATE:
-                               cont = processQueryResponse(qstate, iq, id);
+                               cont = processQueryResponse(qstate, iq, ie, id);
                                break;
                        case PRIME_RESP_STATE:
                                cont = processPrimeResponse(qstate, id);
@@ -3764,7 +3778,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
                        iq->num_current_queries--;
                        /* need fresh attempts for the 0x20 fallback, if
                         * that was the cause for the failure */
-                       iter_dec_attempts(iq->dp, 3);
+                       iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry);
                        verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback");
                        goto handle_it;
                }
@@ -3798,15 +3812,15 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
                goto handle_it;
        }
        /* edns is not examined, but removed from message to help cache */
-       if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
+       if(parse_extract_edns_from_response_msg(prs, &edns, qstate->env->scratch) !=
                LDNS_RCODE_NOERROR) {
                iq->parse_failures++;
                goto handle_it;
        }
 
        /* Copy the edns options we may got from the back end */
-       if(edns.opt_list) {
-               qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list,
+       if(edns.opt_list_in) {
+               qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in,
                        qstate->region);
                if(!qstate->edns_opts_back_in) {
                        log_err("out of memory on incoming message");

diff --git a/sbin/unwind/libunbound/iterator/iterator.h b/sbin/unwind/libunbound/iterator/iterator.h
index dc5e575..8b84052 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iterator.h
+++ b/sbin/unwind/libunbound/iterator/iterator.h
@@ -80,7 +80,7 @@ struct rbtree_type;
 /**
  * number of labels from QNAME that are always send individually when using
  * QNAME minimisation, even when the number of labels of the QNAME is bigger
- * tham MAX_MINIMISE_COUNT */
+ * than MAX_MINIMISE_COUNT */
 #define MINIMISE_ONE_LAB       4
 #define MINIMISE_MULTIPLE_LABS (MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
 /** at what query-sent-count to stop target fetch policy */
@@ -94,8 +94,6 @@ extern int UNKNOWN_SERVER_NICENESS;
  * Equals RTT_MAX_TIMEOUT
  */
 #define USEFUL_SERVER_TOP_TIMEOUT      120000
-/** number of retries on outgoing queries */
-#define OUTBOUND_MSG_RETRY 5
 /** RTT band, within this amount from the best, servers are chosen randomly.
  * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
  * fast server, this causes server exploration as a side benefit. msec. */
@@ -139,6 +137,9 @@ struct iter_env {
        lock_basic_type queries_ratelimit_lock;
        /** number of queries that have been ratelimited */
        size_t num_queries_ratelimited;
+
+       /** number of retries on outgoing queries */
+       int outbound_msg_retry;
 };
 
 /**
@@ -378,7 +379,7 @@ struct iter_qstate {
        /** list of pending queries to authoritative servers. */
        struct outbound_list outlist;
 
-       /** QNAME minimisation state, RFC7816 */
+       /** QNAME minimisation state, RFC9156 */
        enum minimisation_state minimisation_state;
 
        /** State for capsfail: QNAME minimisation state for comparisons. */

diff --git a/sbin/unwind/libunbound/libunbound/context.c b/sbin/unwind/libunbound/libunbound/context.c
index e589c6a..c8d911f 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/context.c
+++ b/sbin/unwind/libunbound/libunbound/context.c
@@ -48,6 +48,7 @@
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/authzone.h"
+#include "services/listen_dnsport.h"
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
@@ -73,6 +74,7 @@ context_finalize(struct ub_ctx* ctx)
        config_apply(cfg);
        if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
                return UB_INITFAIL;
+       listen_setup_locks();
        log_edns_known_options(VERB_ALGO, ctx->env);
        ctx->local_zones = local_zones_create();
        if(!ctx->local_zones)

diff --git a/sbin/unwind/libunbound/libunbound/context.h b/sbin/unwind/libunbound/libunbound/context.h
index 78f8731..c0c86fb 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/context.h
+++ b/sbin/unwind/libunbound/libunbound/context.h
@@ -176,35 +176,6 @@ struct ctx_query {
        struct ub_result* res;
 };
 
-/**
- * The error constants
- */
-enum ub_ctx_err {
-       /** no error */
-       UB_NOERROR = 0,
-       /** socket operation. Set to -1, so that if an error from _fd() is
-        * passed (-1) it gives a socket error. */
-       UB_SOCKET = -1,
-       /** alloc failure */
-       UB_NOMEM = -2,
-       /** syntax error */
-       UB_SYNTAX = -3,
-       /** DNS service failed */
-       UB_SERVFAIL = -4,
-       /** fork() failed */
-       UB_FORKFAIL = -5,
-       /** cfg change after finalize() */
-       UB_AFTERFINAL = -6,
-       /** initialization failed (bad settings) */
-       UB_INITFAIL = -7,
-       /** error in pipe communication with async bg worker */
-       UB_PIPE = -8,
-       /** error reading from file (resolv.conf) */
-       UB_READFILE = -9,
-       /** error async_id does not exist or result already been delivered */
-       UB_NOID = -10
-};
-
 /**
  * Command codes for libunbound pipe.
  *

diff --git a/sbin/unwind/libunbound/libunbound/libunbound.c b/sbin/unwind/libunbound/libunbound/libunbound.c
index c9e24ba..038b7b9 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/libunbound.c
+++ b/sbin/unwind/libunbound/libunbound/libunbound.c
@@ -64,6 +64,7 @@
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
 #include "services/authzone.h"
+#include "services/listen_dnsport.h"
 #include "sldns/sbuffer.h"
 #ifdef HAVE_PTHREAD
 #include <signal.h>
@@ -185,6 +186,7 @@ ub_ctx_create(void)
                ub_randfree(ctx->seed_rnd);
                config_delete(ctx->env->cfg);
                modstack_desetup(&ctx->mods, ctx->env);
+               listen_desetup_locks();
                edns_known_options_delete(ctx->env);
                edns_strings_delete(ctx->env->edns_strings);
                free(ctx->env);
@@ -198,6 +200,7 @@ ub_ctx_create(void)
                ub_randfree(ctx->seed_rnd);
                config_delete(ctx->env->cfg);
                modstack_desetup(&ctx->mods, ctx->env);
+               listen_desetup_locks();
                edns_known_options_delete(ctx->env);
                edns_strings_delete(ctx->env->edns_strings);
                free(ctx->env);
@@ -344,6 +347,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
        }
        ub_randfree(ctx->seed_rnd);
        alloc_clear(&ctx->superalloc);
+       listen_desetup_locks();
        traverse_postorder(&ctx->queries, delq, NULL);
        if(ctx_logfile_overridden) {
                log_file(NULL);

diff --git a/sbin/unwind/libunbound/libunbound/libworker.c b/sbin/unwind/libunbound/libunbound/libworker.c
index 8a9ca94..ab28dd5 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/libworker.c
+++ b/sbin/unwind/libunbound/libunbound/libworker.c
@@ -600,7 +600,9 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
        edns->ext_rcode = 0;
        edns->edns_version = 0;
        edns->bits = EDNS_DO;
-       edns->opt_list = NULL;
+       edns->opt_list_in = NULL;
+       edns->opt_list_out = NULL;
+       edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
        if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
                edns->udp_size = (uint16_t)sldns_buffer_capacity(
@@ -880,9 +882,10 @@ void libworker_alloc_cleanup(void* arg)
 
 struct outbound_entry* libworker_send_query(struct query_info* qinfo,
        uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+       int check_ratelimit,
        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-       size_t zonelen, int ssl_upstream, char* tls_auth_name,
-       struct module_qstate* q)
+       size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
+       struct module_qstate* q, int* was_ratelimited)
 {
        struct libworker* w = (struct libworker*)q->env->worker;
        struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -891,9 +894,10 @@ struct outbound_entry* libworker_send_query(struct query_info* qinfo,
                return NULL;
        e->qstate = q;
        e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec,
-               want_dnssec, nocaps, q->env->cfg->tcp_upstream, ssl_upstream,
+               want_dnssec, nocaps, check_ratelimit, tcp_upstream, ssl_upstream,
                tls_auth_name, addr, addrlen, zone, zonelen, q,
-               libworker_handle_service_reply, e, w->back->udp_buff, q->env);
+               libworker_handle_service_reply, e, w->back->udp_buff, q->env,
+               was_ratelimited);
        if(!e->qsent) {
                return NULL;
        }
@@ -974,10 +978,11 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
        uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
        int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
+       int ATTR_UNUSED(check_ratelimit),
        struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
-       uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
+       uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
        int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-       struct module_qstate* ATTR_UNUSED(q))
+       struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
 {
        log_assert(0);
        return 0;

diff --git a/sbin/unwind/libunbound/libunbound/unbound-event.h b/sbin/unwind/libunbound/libunbound/unbound-event.h
index 4d694b8..a5d5c03 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/unbound-event.h
+++ b/sbin/unwind/libunbound/libunbound/unbound-event.h
@@ -41,7 +41,7 @@
  *
  * Use ub_ctx_create_event_ub_base() to create an unbound context that uses
  * the user provided event base API.  Then, use the ub_resolve_event call
- * to add DNS resolve queries to the context.  Those then run whith the
+ * to add DNS resolve queries to the context.  Those then run with the
  * provided event_base, and when they are done you get a function callback.
  *
  * This method does not fork another process or create a thread, the effort

diff --git a/sbin/unwind/libunbound/libunbound/unbound.h b/sbin/unwind/libunbound/libunbound/unbound.h
index 945c17a..ee85587 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/unbound.h
+++ b/sbin/unwind/libunbound/libunbound/unbound.h
@@ -224,7 +224,7 @@ struct ub_result {
  * It is called with
  *     void* my_arg: your pointer to a (struct of) data of your choice, 
  *             or NULL.
- *     int err: if 0 all is OK, otherwise an error occured and no results
+ *     int err: if 0 all is OK, otherwise an error occurred and no results
  *          are forthcoming.
  *     struct result: pointer to more detailed result structure.
  *             This structure is allocated on the heap and needs to be
@@ -232,6 +232,35 @@ struct ub_result {
  */
 typedef void (*ub_callback_type)(void*, int, struct ub_result*);
 
+/**
+ * The error constants
+ */
+enum ub_ctx_err {
+       /** no error */
+       UB_NOERROR = 0,
+       /** socket operation. Set to -1, so that if an error from _fd() is
+        * passed (-1) it gives a socket error. */
+       UB_SOCKET = -1,
+       /** alloc failure */
+       UB_NOMEM = -2,
+       /** syntax error */
+       UB_SYNTAX = -3,
+       /** DNS service failed */
+       UB_SERVFAIL = -4,
+       /** fork() failed */
+       UB_FORKFAIL = -5,
+       /** cfg change after finalize() */
+       UB_AFTERFINAL = -6,
+       /** initialization failed (bad settings) */
+       UB_INITFAIL = -7,
+       /** error in pipe communication with async bg worker */
+       UB_PIPE = -8,
+       /** error reading from file (resolv.conf) */
+       UB_READFILE = -9,
+       /** error async_id does not exist or result already been delivered */
+       UB_NOID = -10
+};
+
 /**
  * Create a resolving and validation context.
  * The information from /etc/resolv.conf and /etc/hosts is not utilised by
@@ -563,6 +592,7 @@ void ub_resolve_free(struct ub_result* result);
 /** 
  * Convert error value to a human readable string.
  * @param err: error code from one of the libunbound functions.
+ *     The error codes are from the type enum ub_ctx_err.
  * @return pointer to constant text string, zero terminated.
  */
 const char* ub_strerror(int err);

diff --git a/sbin/unwind/libunbound/libunbound/worker.h b/sbin/unwind/libunbound/libunbound/worker.h
index bf74738..0fa5bfa 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/worker.h
+++ b/sbin/unwind/libunbound/libunbound/worker.h
@@ -58,22 +58,27 @@ struct query_info;
  * @param dnssec: if set, EDNS record will have DO bit set.
  * @param want_dnssec: signatures needed.
  * @param nocaps: ignore capsforid(if in config), do not perturb qname.
+ * @param check_ratelimit: if set, will check ratelimit before sending out.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param zone: delegation point name.
  * @param zonelen: length of zone name wireformat dname.
+ * @param tcp_upstream: use TCP for upstream queries.
  * @param ssl_upstream: use SSL for upstream queries.
  * @param tls_auth_name: if ssl_upstream, use this name with TLS
  *     authentication.
- * @param q: wich query state to reactivate upon return.
+ * @param q: which query state to reactivate upon return.
+ * @param was_ratelimited: it will signal back if the query failed to pass the
+ *     ratelimit check.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
  */
 struct outbound_entry* libworker_send_query(struct query_info* qinfo,
        uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+       int check_ratelimit,
        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-       size_t zonelen, int ssl_upstream, char* tls_auth_name,
-       struct module_qstate* q);
+       size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
+       struct module_qstate* q, int* was_ratelimited);
 
 /** process incoming serviced query replies from the network */
 int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
@@ -109,22 +114,27 @@ void worker_sighandler(int sig, void* arg);
  * @param dnssec: if set, EDNS record will have DO bit set.
  * @param want_dnssec: signatures needed.
  * @param nocaps: ignore capsforid(if in config), do not perturb qname.
+ * @param check_ratelimit: if set, will check ratelimit before sending out.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param zone: wireformat dname of the zone.
  * @param zonelen: length of zone name.
+ * @param tcp_upstream: use TCP for upstream queries.
  * @param ssl_upstream: use SSL for upstream queries.
  * @param tls_auth_name: if ssl_upstream, use this name with TLS
  *     authentication.
- * @param q: wich query state to reactivate upon return.
+ * @param q: which query state to reactivate upon return.
+ * @param was_ratelimited: it will signal back if the query failed to pass the
+ *     ratelimit check.
  * @return: false on failure (memory or socket related). no query was
  *      sent.
  */
 struct outbound_entry* worker_send_query(struct query_info* qinfo,
        uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+       int check_ratelimit,
        struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-       size_t zonelen, int ssl_upstream, char* tls_auth_name,
-       struct module_qstate* q);
+       size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
+       struct module_qstate* q, int* was_ratelimited);
 
 /** 
  * process control messages from the main thread. Frees the control 

diff --git a/sbin/unwind/libunbound/respip/respip.c b/sbin/unwind/libunbound/respip/respip.c
index aae41f5..3d1b3fe 100644 (file)
--- a/sbin/unwind/libunbound/respip/respip.c
+++ b/sbin/unwind/libunbound/respip/respip.c
@@ -25,6 +25,7 @@
 #include "respip/respip.h"
 #include "services/view.h"
 #include "sldns/rrdef.h"
+#include "util/data/dname.h"
 
 
 /** Subset of resp_addr.node, used for inform-variant logging */
@@ -483,8 +484,8 @@ respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
  * This function returns the copied rrset key on success, and NULL on memory
  * allocation failure.
  */
-static struct ub_packed_rrset_key*
-copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
+struct ub_packed_rrset_key*
+respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
 {
        struct ub_packed_rrset_key* ck = regional_alloc(region,
                sizeof(struct ub_packed_rrset_key));
@@ -602,7 +603,7 @@ rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
  */
 static struct resp_addr*
 respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
-       size_t* rrset_id)
+       size_t* rrset_id, size_t* rr_id)
 {
        size_t i;
        struct resp_addr* ra;
@@ -625,6 +626,7 @@ respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
                                &ss, addrlen);
                        if(ra) {
                                *rrset_id = i;
+                               *rr_id = j;
                                lock_rw_rdlock(&ra->lock);
                                lock_rw_unlock(&rs->lock);
                                return ra;
@@ -635,43 +637,6 @@ respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
        return NULL;
 }
 
-/*
- * Create a new reply_info based on 'rep'.  The new info is based on
- * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
- * RRsets in the answer section.  These answer rrsets are copied to the
- * new info, up to 'copy_rrsets' rrsets (which must not be larger than
- * 'an_numrrsets').  If an_numrrsets > copy_rrsets, the remaining rrsets array
- * entries will be kept empty so the caller can fill them later.  When rrsets
- * are copied, they are shallow copied.  The caller must ensure that the
- * copied rrsets are valid throughout its lifetime and must provide appropriate
- * mutex if it can be shared by multiple threads.
- */
-static struct reply_info *
-make_new_reply_info(const struct reply_info* rep, struct regional* region,
-       size_t an_numrrsets, size_t copy_rrsets)
-{
-       struct reply_info* new_rep;
-       size_t i;
-
-       /* create a base struct.  we specify 'insecure' security status as
-        * the modified response won't be DNSSEC-valid.  In our faked response
-        * the authority and additional sections will be empty (except possible
-        * EDNS0 OPT RR in the additional section appended on sending it out),
-        * so the total number of RRsets is an_numrrsets. */
-       new_rep = construct_reply_info_base(region, rep->flags,
-               rep->qdcount, rep->ttl, rep->prefetch_ttl,
-               rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
-               sec_status_insecure);
-       if(!new_rep)
-               return NULL;
-       if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
-               return NULL;
-       for(i=0; i<copy_rrsets; i++)
-               new_rep->rrsets[i] = rep->rrsets[i];
-
-       return new_rep;
-}
-
 /**
  * See if response-ip or tag data should override the original answer rrset
  * (which is rep->rrsets[rrset_id]) and if so override it.
@@ -730,7 +695,7 @@ respip_data_answer(enum respip_action action,
                                "response-ip redirect with tag data [%d] %s",
                                tag, (tag<num_tags?tagname[tag]:"null"));
                        /* use copy_rrset() to 'normalize' memory layout */
-                       rp = copy_rrset(&r, region);
+                       rp = respip_copy_rrset(&r, region);
                        if(!rp)
                                return -1;
                }
@@ -743,7 +708,7 @@ respip_data_answer(enum respip_action action,
         * rename the dname for other actions than redirect.  This is because
         * response-ip-data isn't associated to any specific name. */
        if(rp == data) {
-               rp = copy_rrset(rp, region);
+               rp = respip_copy_rrset(rp, region);
                if(!rp)
                        return -1;
                rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
@@ -807,7 +772,6 @@ respip_nodata_answer(uint16_t qtype, enum respip_action action,
                 * is explicitly specified. */
                int rcode = (action == respip_always_nxdomain)?
                        LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;
-
                /* We should empty the answer section except for any preceding
                 * CNAMEs (in that case rrset_id > 0).  Type-ANY case is
                 * special as noted in respip_data_answer(). */
@@ -907,7 +871,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
        size_t tag_datas_size;
        struct view* view = NULL;
        struct respip_set* ipset = NULL;
-       size_t rrset_id = 0;
+       size_t rrset_id = 0, rr_id = 0;
        enum respip_action action = respip_none;
        int tag = -1;
        struct resp_addr* raddr = NULL;
@@ -948,7 +912,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
                lock_rw_rdlock(&view->lock);
                if(view->respip_set) {
                        if((raddr = respip_addr_lookup(rep,
-                               view->respip_set, &rrset_id))) {
+                               view->respip_set, &rrset_id, &rr_id))) {
                                /** for per-view respip directives the action
                                 * can only be direct (i.e. not tag-based) */
                                action = raddr->action;
@@ -962,7 +926,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
                }
        }
        if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
-               &rrset_id))) {
+               &rrset_id, &rr_id))) {
                action = (enum respip_action)local_data_find_tag_action(
                        raddr->taglist, raddr->taglen, ctaglist, ctaglen,
                        tag_actions, tag_actions_size,
@@ -976,7 +940,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
                if(!r->taglist || taglist_intersect(r->taglist, 
                        r->taglistlen, ctaglist, ctaglen)) {
                        if((raddr = respip_addr_lookup(rep,
-                               r->respip_set, &rrset_id))) {
+                               r->respip_set, &rrset_id, &rr_id))) {
                                if(!respip_use_rpz(raddr, r, &action, &data,
                                        &rpz_log, &log_name, &rpz_cname_override,
                                        region, &rpz_used)) {
@@ -987,6 +951,21 @@ respip_rewrite_reply(const struct query_info* qinfo,
                                        return 0;
                                }
                                if(rpz_used) {
+                                       if(verbosity >= VERB_ALGO) {
+                                               struct sockaddr_storage ss;
+                                               socklen_t ss_len = 0;
+                                               char nm[256], ip[256];
+                                               char qn[255+1];
+                                               if(!rdata2sockaddr(rep->rrsets[rrset_id]->entry.data, ntohs(rep->rrsets[rrset_id]->rk.type), rr_id, &ss, &ss_len))
+                                                       snprintf(ip, sizeof(ip), "invalidRRdata");
+                                               else
+                                                       addr_to_str(&ss, ss_len, ip, sizeof(ip));
+                                               dname_str(qinfo->qname, qn);
+                                               addr_to_str(&raddr->node.addr,
+                                                       raddr->node.addrlen,
+                                                       nm, sizeof(nm));
+                                               verbose(VERB_ALGO, "respip: rpz response-ip trigger %s/%d on %s %s with action %s", nm, raddr->node.net, qn, ip, rpz_action_to_string(respip_action_to_rpz_action(action)));
+                                       }
                                        /* break to make sure 'a' stays pointed
                                         * to used auth_zone, and keeps lock */
                                        break;
@@ -1209,7 +1188,7 @@ respip_merge_cname(struct reply_info* base_rep,
        if(!new_rep)
                return 0;
        for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
-               new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region);
+               new_rep->rrsets[j] = respip_copy_rrset(tgt_rep->rrsets[i], region);
                if(!new_rep->rrsets[j])
                        return 0;
        }

diff --git a/sbin/unwind/libunbound/respip/respip.h b/sbin/unwind/libunbound/respip/respip.h
index bbd4714..3dfb4e9 100644 (file)
--- a/sbin/unwind/libunbound/respip/respip.h
+++ b/sbin/unwind/libunbound/respip/respip.h
@@ -294,4 +294,7 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr,
  */
 void
 respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node);
+
+struct ub_packed_rrset_key*
+respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region);
 #endif /* RESPIP_RESPIP_H */

diff --git a/sbin/unwind/libunbound/services/authzone.c b/sbin/unwind/libunbound/services/authzone.c
index e6e3a8c..e83af53 100644 (file)
--- a/sbin/unwind/libunbound/services/authzone.c
+++ b/sbin/unwind/libunbound/services/authzone.c
@@ -84,7 +84,7 @@
 #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */
 /* auth transfer timeout for TCP connections, in msec */
 #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */
-/* auth transfer max backoff for failed tranfers and probes */
+/* auth transfer max backoff for failed transfers and probes */
 #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */
 /* auth http port number */
 #define AUTH_HTTP_PORT 80
@@ -243,7 +243,7 @@ msg_add_rrset_an(struct auth_zone* z, struct regional* region,
        return 1;
 }
 
-/** add rrset to authority section (no additonal section rrsets yet) */
+/** add rrset to authority section (no additional section rrsets yet) */
 static int
 msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
        struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
@@ -1950,6 +1950,17 @@ static int auth_zone_zonemd_check_hash(struct auth_zone* z,
        return 0;
 }
 
+/** find the apex SOA RRset, if it exists */
+struct auth_rrset* auth_zone_get_soa_rrset(struct auth_zone* z)
+{
+       struct auth_data* apex;
+       struct auth_rrset* soa;
+       apex = az_find_name(z, z->name, z->namelen);
+       if(!apex) return NULL;
+       soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
+       return soa;
+}
+
 /** find serial number of zone or false if none */
 int
 auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
@@ -3507,7 +3518,7 @@ auth_error_encode(struct query_info* qinfo, struct module_env* env,
 
        if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
                rcode, edns, repinfo, temp, env->now_tv))
-               edns->opt_list = NULL;
+               edns->opt_list_inplace_cb_out = NULL;
        error_encode(buf, rcode|BIT_AA, qinfo,
                *(uint16_t*)sldns_buffer_begin(buf),
                sldns_buffer_read_u16_at(buf, 2), edns);
@@ -5347,7 +5358,9 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
        edns.ext_rcode = 0;
        edns.edns_version = 0;
        edns.bits = EDNS_DO;
-       edns.opt_list = NULL;
+       edns.opt_list_in = NULL;
+       edns.opt_list_out = NULL;
+       edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
@@ -6480,7 +6493,7 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
        comm_point_delete(xfr->task_probe->cp);
        xfr->task_probe->cp = NULL;
 
-       /* if the result was not a successfull probe, we need
+       /* if the result was not a successful probe, we need
         * to send the next one */
        xfr_probe_nextmaster(xfr);
        xfr_probe_send_or_end(xfr, env);
@@ -6536,7 +6549,9 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
        edns.ext_rcode = 0;
        edns.edns_version = 0;
        edns.bits = EDNS_DO;
-       edns.opt_list = NULL;
+       edns.opt_list_in = NULL;
+       edns.opt_list_out = NULL;
+       edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
@@ -7149,7 +7164,7 @@ parse_url(char* url, char** host, char** file, int* port, int* ssl)
        while(p && *p == '/')
                p++;
        if(!p || p[0] == 0)
-               *file = strdup("index.html");
+               *file = strdup("/");
        else    *file = strdup(p);
        if(!*file) {
                log_err("malloc failure");
@@ -7683,7 +7698,7 @@ static void auth_zone_log(uint8_t* name, enum verbosity_value level,
 static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
        struct module_env* env, struct module_stack* mods,
        struct ub_packed_rrset_key* dnskey, struct auth_data* node,
-       struct auth_rrset* rrset, char** why_bogus)
+       struct auth_rrset* rrset, char** why_bogus, uint8_t* sigalg)
 {
        struct ub_packed_rrset_key pk;
        enum sec_status sec;
@@ -7711,7 +7726,7 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
                auth_zone_log(z->name, VERB_ALGO,
                        "zonemd: verify %s RRset with DNSKEY", typestr);
        }
-       sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, NULL, why_bogus,
+       sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus,
                LDNS_SECTION_ANSWER, NULL);
        if(sec == sec_status_secure) {
                return 1;
@@ -7755,7 +7770,7 @@ static int nsec3_of_param_has_type(struct auth_rrset* nsec3, int algo,
 static int zonemd_check_dnssec_absence(struct auth_zone* z,
        struct module_env* env, struct module_stack* mods,
        struct ub_packed_rrset_key* dnskey, struct auth_data* apex,
-       char** reason, char** why_bogus)
+       char** reason, char** why_bogus, uint8_t* sigalg)
 {
        struct auth_rrset* nsec = NULL;
        if(!apex) {
@@ -7767,7 +7782,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z,
                struct ub_packed_rrset_key pk;
                /* dnssec verify the NSEC */
                if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex,
-                       nsec, why_bogus)) {
+                       nsec, why_bogus, sigalg)) {
                        *reason = "DNSSEC verify failed for NSEC RRset";
                        return 0;
                }
@@ -7810,7 +7825,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z,
                }
                /* dnssec verify the NSEC3 */
                if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, match,
-                       nsec3, why_bogus)) {
+                       nsec3, why_bogus, sigalg)) {
                        *reason = "DNSSEC verify failed for NSEC3 RRset";
                        return 0;
                }
@@ -7831,7 +7846,8 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z,
 static int zonemd_check_dnssec_soazonemd(struct auth_zone* z,
        struct module_env* env, struct module_stack* mods,
        struct ub_packed_rrset_key* dnskey, struct auth_data* apex,
-       struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus)
+       struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus,
+       uint8_t* sigalg)
 {
        struct auth_rrset* soa;
        if(!apex) {
@@ -7844,12 +7860,12 @@ static int zonemd_check_dnssec_soazonemd(struct auth_zone* z,
                return 0;
        }
        if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, soa,
-               why_bogus)) {
+               why_bogus, sigalg)) {
                *reason = "DNSSEC verify failed for SOA RRset";
                return 0;
        }
        if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex,
-               zonemd_rrset, why_bogus)) {
+               zonemd_rrset, why_bogus, sigalg)) {
                *reason = "DNSSEC verify failed for ZONEMD RRset";
                return 0;
        }
@@ -7908,12 +7924,14 @@ static void auth_zone_zonemd_fail(struct auth_zone* z, struct module_env* env,
  * @param is_insecure: if true, the dnskey is not used, the zone is insecure.
  *     And dnssec is not used.  It is DNSSEC secure insecure or not under
  *     a trust anchor.
+ * @param sigalg: if nonNULL provide algorithm downgrade protection.
+ *     Otherwise one algorithm is enough. Must have space of ALGO_NEEDS_MAX+1.
  * @param result: if not NULL result reason copied here.
  */
 static void
 auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
        struct module_stack* mods, struct ub_packed_rrset_key* dnskey,
-       int is_insecure, char** result)
+       int is_insecure, char** result, uint8_t* sigalg)
 {
        char* reason = NULL, *why_bogus = NULL;
        struct auth_data* apex = NULL;
@@ -7943,7 +7961,7 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
        } else if(!zonemd_rrset && dnskey && !is_insecure) {
                /* fetch, DNSSEC verify, and check NSEC/NSEC3 */
                if(!zonemd_check_dnssec_absence(z, env, mods, dnskey, apex,
-                       &reason, &why_bogus)) {
+                       &reason, &why_bogus, sigalg)) {
                        auth_zone_zonemd_fail(z, env, reason, why_bogus, result);
                        return;
                }
@@ -7951,7 +7969,7 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
        } else if(zonemd_rrset && dnskey && !is_insecure) {
                /* check DNSSEC verify of SOA and ZONEMD */
                if(!zonemd_check_dnssec_soazonemd(z, env, mods, dnskey, apex,
-                       zonemd_rrset, &reason, &why_bogus)) {
+                       zonemd_rrset, &reason, &why_bogus, sigalg)) {
                        auth_zone_zonemd_fail(z, env, reason, why_bogus, result);
                        return;
                }
@@ -8065,15 +8083,78 @@ zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env,
        return NULL;
 }
 
+/** verify the DNSKEY from the zone with looked up DS record */
+static struct ub_packed_rrset_key*
+auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z,
+       struct module_env* env, struct module_stack* mods,
+       struct ub_packed_rrset_key* ds, int* is_insecure, char** why_bogus,
+       struct ub_packed_rrset_key* keystorage, uint8_t* sigalg)
+{
+       struct auth_data* apex;
+       struct auth_rrset* dnskey_rrset;
+       enum sec_status sec;
+       struct val_env* ve;
+       int m;
+
+       /* fetch DNSKEY from zone data */
+       apex = az_find_name(z, z->name, z->namelen);
+       if(!apex) {
+               *why_bogus = "in verifywithDS, zone has no apex";
+               return NULL;
+       }
+       dnskey_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_DNSKEY);
+       if(!dnskey_rrset || dnskey_rrset->data->count==0) {
+               *why_bogus = "in verifywithDS, zone has no DNSKEY";
+               return NULL;
+       }
+
+       m = modstack_find(mods, "validator");
+       if(m == -1) {
+               *why_bogus = "in verifywithDS, have no validator module";
+               return NULL;
+       }
+       ve = (struct val_env*)env->modinfo[m];
+
+       memset(keystorage, 0, sizeof(*keystorage));
+       keystorage->entry.key = keystorage;
+       keystorage->entry.data = dnskey_rrset->data;
+       keystorage->rk.dname = apex->name;
+       keystorage->rk.dname_len = apex->namelen;
+       keystorage->rk.type = htons(LDNS_RR_TYPE_DNSKEY);
+       keystorage->rk.rrset_class = htons(z->dclass);
+       auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS");
+       sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg,
+               why_bogus, NULL);
+       regional_free_all(env->scratch);
+       if(sec == sec_status_secure) {
+               /* success */
+               return keystorage;
+       } else if(sec == sec_status_insecure) {
+               /* insecure */
+               *is_insecure = 1;
+       } else {
+               /* bogus */
+               *is_insecure = 0;
+               if(*why_bogus == NULL)
+                       *why_bogus = "verify failed";
+               auth_zone_log(z->name, VERB_ALGO,
+                       "zonemd: verify DNSKEY RRset with DS failed: %s",
+                       *why_bogus);
+       }
+       return NULL;
+}
+
 /** callback for ZONEMD lookup of DNSKEY */
 void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
        enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited))
 {
        struct auth_zone* z = (struct auth_zone*)arg;
        struct module_env* env;
-       char* reason = NULL;
-       struct ub_packed_rrset_key* dnskey = NULL;
-       int is_insecure = 0;
+       char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY";
+       struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL;
+       int is_insecure = 0, downprot;
+       struct ub_packed_rrset_key keystorage;
+       uint8_t sigalg[ALGO_NEEDS_MAX+1];
 
        lock_rw_wrlock(&z->lock);
        env = z->zonemd_callback_env;
@@ -8084,16 +8165,22 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
                lock_rw_unlock(&z->lock);
                return; /* stop on quit */
        }
+       if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DS)
+               typestr = "DS";
+       downprot = env->cfg->harden_algo_downgrade;
 
        /* process result */
        if(sec == sec_status_bogus) {
                reason = why_bogus;
-               if(!reason)
-                       reason = "lookup of DNSKEY was bogus";
+               if(!reason) {
+                       if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY)
+                               reason = "lookup of DNSKEY was bogus";
+                       else    reason = "lookup of DS was bogus";
+               }
                auth_zone_log(z->name, VERB_ALGO,
-                       "zonemd lookup of DNSKEY was bogus: %s", reason);
+                       "zonemd lookup of %s was bogus: %s", typestr, reason);
        } else if(rcode == LDNS_RCODE_NOERROR) {
-               uint16_t wanted_qtype = LDNS_RR_TYPE_DNSKEY;
+               uint16_t wanted_qtype = z->zonemd_callback_qtype;
                struct regional* temp = env->scratch;
                struct query_info rq;
                struct reply_info* rep;
@@ -8106,25 +8193,29 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
                        struct ub_packed_rrset_key* answer =
                                reply_find_answer_rrset(&rq, rep);
                        if(answer && sec == sec_status_secure) {
-                               dnskey = answer;
+                               if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY)
+                                       dnskey = answer;
+                               else    ds = answer;
                                auth_zone_log(z->name, VERB_ALGO,
-                                       "zonemd lookup of DNSKEY was secure");
+                                       "zonemd lookup of %s was secure", typestr);
                        } else if(sec == sec_status_secure && !answer) {
                                is_insecure = 1;
                                auth_zone_log(z->name, VERB_ALGO,
-                                       "zonemd lookup of DNSKEY has no content, but is secure, treat as insecure");
+                                       "zonemd lookup of %s has no content, but is secure, treat as insecure", typestr);
                        } else if(sec == sec_status_insecure) {
                                is_insecure = 1;
                                auth_zone_log(z->name, VERB_ALGO,
-                                       "zonemd lookup of DNSKEY was insecure");
+                                       "zonemd lookup of %s was insecure", typestr);
                        } else if(sec == sec_status_indeterminate) {
                                is_insecure = 1;
                                auth_zone_log(z->name, VERB_ALGO,
-                                       "zonemd lookup of DNSKEY was indeterminate, treat as insecure");
+                                       "zonemd lookup of %s was indeterminate, treat as insecure", typestr);
                        } else {
                                auth_zone_log(z->name, VERB_ALGO,
-                                       "zonemd lookup of DNSKEY has nodata");
-                               reason = "lookup of DNSKEY has nodata";
+                                       "zonemd lookup of %s has nodata", typestr);
+                               if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY)
+                                       reason = "lookup of DNSKEY has nodata";
+                               else    reason = "lookup of DS has nodata";
                        }
                } else if(rep && rq.qtype == wanted_qtype &&
                        query_dname_compare(z->name, rq.qname) == 0 &&
@@ -8137,40 +8228,52 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
                         * trust, as insecure. */
                        is_insecure = 1;
                        auth_zone_log(z->name, VERB_ALGO,
-                               "zonemd lookup of DNSKEY was secure NXDOMAIN, treat as insecure");
+                               "zonemd lookup of %s was secure NXDOMAIN, treat as insecure", typestr);
                } else if(rep && rq.qtype == wanted_qtype &&
                        query_dname_compare(z->name, rq.qname) == 0 &&
                        FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN &&
                        sec == sec_status_insecure) {
                        is_insecure = 1;
                        auth_zone_log(z->name, VERB_ALGO,
-                               "zonemd lookup of DNSKEY was insecure NXDOMAIN, treat as insecure");
+                               "zonemd lookup of %s was insecure NXDOMAIN, treat as insecure", typestr);
                } else if(rep && rq.qtype == wanted_qtype &&
                        query_dname_compare(z->name, rq.qname) == 0 &&
                        FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN &&
                        sec == sec_status_indeterminate) {
                        is_insecure = 1;
                        auth_zone_log(z->name, VERB_ALGO,
-                               "zonemd lookup of DNSKEY was indeterminate NXDOMAIN, treat as insecure");
+                               "zonemd lookup of %s was indeterminate NXDOMAIN, treat as insecure", typestr);
                } else {
                        auth_zone_log(z->name, VERB_ALGO,
-                               "zonemd lookup of DNSKEY has no answer");
-                       reason = "lookup of DNSKEY has no answer";
+                               "zonemd lookup of %s has no answer", typestr);
+                       if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY)
+                               reason = "lookup of DNSKEY has no answer";
+                       else    reason = "lookup of DS has no answer";
                }
        } else {
                auth_zone_log(z->name, VERB_ALGO,
-                       "zonemd lookup of DNSKEY failed");
-               reason = "lookup of DNSKEY failed";
+                       "zonemd lookup of %s failed", typestr);
+               if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY)
+                       reason = "lookup of DNSKEY failed";
+               else    reason = "lookup of DS failed";
+       }
+
+       if(!reason && !is_insecure && !dnskey && ds) {
+               dnskey = auth_zone_verify_zonemd_key_with_ds(z, env,
+                       &env->mesh->mods, ds, &is_insecure, &ds_bogus,
+                       &keystorage, downprot?sigalg:NULL);
+               if(!dnskey && !is_insecure && !reason)
+                       reason = "DNSKEY verify with DS failed";
        }
 
        if(reason) {
-               auth_zone_zonemd_fail(z, env, reason, NULL, NULL);
+               auth_zone_zonemd_fail(z, env, reason, ds_bogus, NULL);
                lock_rw_unlock(&z->lock);
                return;
        }
 
        auth_zone_verify_zonemd_with_key(z, env, &env->mesh->mods, dnskey,
-               is_insecure, NULL);
+               is_insecure, NULL, downprot?sigalg:NULL);
        regional_free_all(env->scratch);
        lock_rw_unlock(&z->lock);
 }
@@ -8183,14 +8286,21 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
        uint16_t qflags = BIT_RD;
        struct edns_data edns;
        sldns_buffer* buf = env->scratch_buffer;
+       int fetch_ds = 0;
 
+       if(!z->fallback_enabled) {
+               /* we cannot actually get the DNSKEY, because it is in the
+                * zone we have ourselves, and it is not served yet
+                * (possibly), so fetch type DS */
+               fetch_ds = 1;
+       }
        if(z->zonemd_callback_env) {
                /* another worker is already working on the callback
                 * for the DNSKEY lookup for ZONEMD verification.
                 * We do not also have to do ZONEMD verification, let that
                 * worker do it */
                auth_zone_log(z->name, VERB_ALGO,
-                       "zonemd needs lookup of DNSKEY and that already worked on by another worker");
+                       "zonemd needs lookup of %s and that already is worked on by another worker", (fetch_ds?"DS":"DNSKEY"));
                return 1;
        }
 
@@ -8199,21 +8309,26 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
        qinfo.qname_len = z->namelen;
        qinfo.qname = z->name;
        qinfo.qclass = z->dclass;
-       qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
+       if(fetch_ds)
+               qinfo.qtype = LDNS_RR_TYPE_DS;
+       else    qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
        qinfo.local_alias = NULL;
        if(verbosity >= VERB_ALGO) {
                char buf1[512];
                char buf2[LDNS_MAX_DOMAINLEN+1];
                dname_str(z->name, buf2);
-               snprintf(buf1, sizeof(buf1), "auth zone %s: lookup DNSKEY "
-                       "for zonemd verification", buf2);
+               snprintf(buf1, sizeof(buf1), "auth zone %s: lookup %s "
+                       "for zonemd verification", buf2,
+                       (fetch_ds?"DS":"DNSKEY"));
                log_query_info(VERB_ALGO, buf1, &qinfo);
        }
        edns.edns_present = 1;
        edns.ext_rcode = 0;
        edns.edns_version = 0;
        edns.bits = EDNS_DO;
-       edns.opt_list = NULL;
+       edns.opt_list_in = NULL;
+       edns.opt_list_out = NULL;
+       edns.opt_list_inplace_cb_out = NULL;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
        else    edns.udp_size = 65535;
@@ -8221,12 +8336,14 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
        /* store the worker-specific module env for the callback.
         * We can then reference this when the callback executes */
        z->zonemd_callback_env = env;
+       z->zonemd_callback_qtype = qinfo.qtype;
        /* the callback can be called straight away */
        lock_rw_unlock(&z->lock);
        if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
                &auth_zonemd_dnskey_lookup_callback, z)) {
                lock_rw_wrlock(&z->lock);
-               log_err("out of memory lookup up dnskey for zonemd");
+               log_err("out of memory lookup of %s for zonemd",
+                       (fetch_ds?"DS":"DNSKEY"));
                return 0;
        }
        lock_rw_wrlock(&z->lock);
@@ -8245,6 +8362,8 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
         * If not present check if absence is allowed by DNSSEC */
        if(!z->zonemd_check)
                return;
+       if(z->data.count == 0)
+               return; /* no data */
 
        /* if zone is under a trustanchor */
        /* is it equal to trustanchor - get dnskey's verified */
@@ -8298,7 +8417,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
        }
 
        auth_zone_verify_zonemd_with_key(z, env, mods, dnskey, is_insecure,
-               result);
+               result, NULL);
        regional_free_all(env->scratch);
 }
 

diff --git a/sbin/unwind/libunbound/services/authzone.h b/sbin/unwind/libunbound/services/authzone.h
index ffe234d..d24e569 100644 (file)
--- a/sbin/unwind/libunbound/services/authzone.h
+++ b/sbin/unwind/libunbound/services/authzone.h
@@ -143,6 +143,8 @@ struct auth_zone {
         * worker has already picked up the zonemd verification task and
         * this worker does not have to do it as well. */
        struct module_env* zonemd_callback_env;
+       /** for the zonemd callback, the type of data looked up */
+       uint16_t zonemd_callback_qtype;
        /** zone has been deleted */
        int zone_deleted;
        /** deletelist pointer, unused normally except during delete */
@@ -634,6 +636,9 @@ int auth_zones_startprobesequence(struct auth_zones* az,
 /** read auth zone from zonefile. caller must lock zone. false on failure */
 int auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg);
 
+/** find the apex SOA RRset, if it exists. NULL if no SOA RRset. */
+struct auth_rrset* auth_zone_get_soa_rrset(struct auth_zone* z);
+
 /** find serial number of zone or false if none (no SOA record) */
 int auth_zone_get_serial(struct auth_zone* z, uint32_t* serial);
 

diff --git a/sbin/unwind/libunbound/services/cache/infra.c b/sbin/unwind/libunbound/services/cache/infra.c
index 518e696..252e1e2 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/infra.c
+++ b/sbin/unwind/libunbound/services/cache/infra.c
@@ -898,8 +898,9 @@ static void infra_ip_create_ratedata(struct infra_cache* infra,
        slabhash_insert(infra->client_ip_rates, h, &k->entry, d, NULL);
 }
 
-/** find the second and return its rate counter, if none, remove oldest */
-static int* infra_rate_find_second(void* data, time_t t)
+/** Find the second and return its rate counter. If none and should_add, remove
+ *  oldest to accommodate. Else return none. */
+static int* infra_rate_find_second_or_none(void* data, time_t t, int should_add)
 {
        struct rate_data* d = (struct rate_data*)data;
        int i, oldest;
@@ -907,6 +908,7 @@ static int* infra_rate_find_second(void* data, time_t t)
                if(d->timestamp[i] == t)
                        return &(d->qps[i]);
        }
+       if(!should_add) return NULL;
        /* remove oldest timestamp, and insert it at t with 0 qps */
        oldest = 0;
        for(i=0; i<RATE_WINDOW; i++) {
@@ -918,21 +920,41 @@ static int* infra_rate_find_second(void* data, time_t t)
        return &(d->qps[oldest]);
 }
 
-int infra_rate_max(void* data, time_t now)
+/** find the second and return its rate counter, if none, remove oldest to
+ *  accommodate */
+static int* infra_rate_give_second(void* data, time_t t)
+{
+    return infra_rate_find_second_or_none(data, t, 1);
+}
+
+/** find the second and return its rate counter only if it exists. Caller
+ *  should check for NULL return value */
+static int* infra_rate_get_second(void* data, time_t t)
+{
+    return infra_rate_find_second_or_none(data, t, 0);
+}
+
+int infra_rate_max(void* data, time_t now, int backoff)
 {
        struct rate_data* d = (struct rate_data*)data;
        int i, max = 0;
        for(i=0; i<RATE_WINDOW; i++) {
-               if(now-d->timestamp[i] <= RATE_WINDOW) {
-                       if(d->qps[i] > max)
+               if(backoff) {
+                       if(now-d->timestamp[i] <= RATE_WINDOW &&
+                               d->qps[i] > max) {
                                max = d->qps[i];
+                       }
+               } else {
+                       if(now == d->timestamp[i]) {
+                               return d->qps[i];
+                       }
                }
        }
        return max;
 }
 
 int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
-       size_t namelen, time_t timenow, struct query_info* qinfo,
+       size_t namelen, time_t timenow, int backoff, struct query_info* qinfo,
        struct comm_reply* replylist)
 {
        int lim, max;
@@ -949,13 +971,13 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
        /* find or insert ratedata */
        entry = infra_find_ratedata(infra, name, namelen, 1);
        if(entry) {
-               int premax = infra_rate_max(entry->data, timenow);
-               int* cur = infra_rate_find_second(entry->data, timenow);
+               int premax = infra_rate_max(entry->data, timenow, backoff);
+               int* cur = infra_rate_give_second(entry->data, timenow);
                (*cur)++;
-               max = infra_rate_max(entry->data, timenow);
+               max = infra_rate_max(entry->data, timenow, backoff);
                lock_rw_unlock(&entry->lock);
 
-               if(premax < lim && max >= lim) {
+               if(premax <= lim && max > lim) {
                        char buf[257], qnm[257], ts[12], cs[12], ip[128];
                        dname_str(name, buf);
                        dname_str(qinfo->qname, qnm);
@@ -970,12 +992,12 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
                                verbose(VERB_OPS, "ratelimit exceeded %s %d query %s %s %s", buf, lim, qnm, cs, ts);
                        }
                }
-               return (max < lim);
+               return (max <= lim);
        }
 
        /* create */
        infra_create_ratedata(infra, name, namelen, timenow);
-       return (1 < lim);
+       return (1 <= lim);
 }
 
 void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
@@ -987,14 +1009,19 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
                return; /* not enabled */
        entry = infra_find_ratedata(infra, name, namelen, 1);
        if(!entry) return; /* not cached */
-       cur = infra_rate_find_second(entry->data, timenow);
+       cur = infra_rate_get_second(entry->data, timenow);
+       if(cur == NULL) {
+               /* our timenow is not available anymore; nothing to decrease */
+               lock_rw_unlock(&entry->lock);
+               return;
+       }
        if((*cur) > 0)
                (*cur)--;
        lock_rw_unlock(&entry->lock);
 }
 
 int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
-       size_t namelen, time_t timenow)
+       size_t namelen, time_t timenow, int backoff)
 {
        struct lruhash_entry* entry;
        int lim, max;
@@ -1010,7 +1037,7 @@ int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
        entry = infra_find_ratedata(infra, name, namelen, 0);
        if(!entry)
                return 0; /* not cached */
-       max = infra_rate_max(entry->data, timenow);
+       max = infra_rate_max(entry->data, timenow, backoff);
        lock_rw_unlock(&entry->lock);
 
        return (max >= lim);
@@ -1027,7 +1054,8 @@ infra_get_mem(struct infra_cache* infra)
 }
 
 int infra_ip_ratelimit_inc(struct infra_cache* infra,
-  struct comm_reply* repinfo, time_t timenow, struct sldns_buffer* buffer)
+       struct comm_reply* repinfo, time_t timenow, int backoff,
+       struct sldns_buffer* buffer)
 {
        int max;
        struct lruhash_entry* entry;
@@ -1039,10 +1067,10 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra,
        /* find or insert ratedata */
        entry = infra_find_ip_ratedata(infra, repinfo, 1);
        if(entry) {
-               int premax = infra_rate_max(entry->data, timenow);
-               int* cur = infra_rate_find_second(entry->data, timenow);
+               int premax = infra_rate_max(entry->data, timenow, backoff);
+               int* cur = infra_rate_give_second(entry->data, timenow);
                (*cur)++;
-               max = infra_rate_max(entry->data, timenow);
+               max = infra_rate_max(entry->data, timenow, backoff);
                lock_rw_unlock(&entry->lock);
 
                if(premax < infra_ip_ratelimit && max >= infra_ip_ratelimit) {

diff --git a/sbin/unwind/libunbound/services/cache/infra.h b/sbin/unwind/libunbound/services/cache/infra.h
index 14f97c4..6a2371a 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/infra.h
+++ b/sbin/unwind/libunbound/services/cache/infra.h
@@ -368,6 +368,7 @@ long long infra_get_host_rto(struct infra_cache* infra,
  * @param name: zone name
  * @param namelen: zone name length
  * @param timenow: what time it is now.
+ * @param backoff: if backoff is enabled.
  * @param qinfo: for logging, query name.
  * @param replylist: for logging, querier's address (if any).
  * @return 1 if it could be incremented. 0 if the increment overshot the
@@ -375,7 +376,7 @@ long long infra_get_host_rto(struct infra_cache* infra,
  * Failures like alloc failures are not returned (probably as 1).
  */
 int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
-       size_t namelen, time_t timenow, struct query_info* qinfo,
+       size_t namelen, time_t timenow, int backoff, struct query_info* qinfo,
        struct comm_reply* replylist);
 
 /**
@@ -398,13 +399,15 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
  * @param name: zone name
  * @param namelen: zone name length
  * @param timenow: what time it is now.
+ * @param backoff: if backoff is enabled.
  * @return true if exceeded.
  */
 int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
-       size_t namelen, time_t timenow);
+       size_t namelen, time_t timenow, int backoff);
 
-/** find the maximum rate stored, not too old. 0 if no information. */
-int infra_rate_max(void* data, time_t now);
+/** find the maximum rate stored. 0 if no information.
+ *  When backoff is enabled look for the maximum in the whole RATE_WINDOW. */
+int infra_rate_max(void* data, time_t now, int backoff);
 
 /** find the ratelimit in qps for a domain. 0 if no limit for domain. */
 int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
@@ -415,11 +418,12 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
  *  @param infra: infra cache
  *  @param repinfo: information about client
  *  @param timenow: what time it is now.
+ *  @param backoff: if backoff is enabled.
  *  @param buffer: with query for logging.
  *  @return 1 if it could be incremented. 0 if the increment overshot the
  *  ratelimit and the query should be dropped. */
 int infra_ip_ratelimit_inc(struct infra_cache* infra,
-       struct comm_reply* repinfo, time_t timenow,
+       struct comm_reply* repinfo, time_t timenow, int backoff,
        struct sldns_buffer* buffer);
 
 /**

diff --git a/sbin/unwind/libunbound/services/cache/rrset.h b/sbin/unwind/libunbound/services/cache/rrset.h
index 35a0d73..7c36d40 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/rrset.h
+++ b/sbin/unwind/libunbound/services/cache/rrset.h
@@ -120,7 +120,7 @@ void rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
  *     the new rrset. The reference may be changed if the cached rrset is
  *     superior.
  *     Before calling the rrset is presumed newly allocated and changeable.
- *     Afer calling you do not hold a lock, and the rrset is inserted in
+ *     After calling you do not hold a lock, and the rrset is inserted in
  *     the hashtable so you need a lock to change it.
  * @param alloc: how to allocate (and deallocate) the special rrset key.
  * @param timenow: current time (to see if ttl in cache is expired).
@@ -143,7 +143,7 @@ int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
  * @param rrset: which rrset to cache as wildcard. This rrset is left 
  *     untouched.
  * @param ce: the closest encloser, will be uses to generate the wildcard dname.
- * @param ce_len: the closest encloser lenght.
+ * @param ce_len: the closest encloser length.
  * @param alloc: how to allocate (and deallocate) the special rrset key.
  * @param timenow: current time (to see if ttl in cache is expired).
  */

diff --git a/sbin/unwind/libunbound/services/listen_dnsport.c b/sbin/unwind/libunbound/services/listen_dnsport.c
index b43def5..d6a90f1 100644 (file)
--- a/sbin/unwind/libunbound/services/listen_dnsport.c
+++ b/sbin/unwind/libunbound/services/listen_dnsport.c
@@ -869,9 +869,14 @@ set_ip_dscp(int socket, int addrfamily, int dscp)
        ds = dscp << 2;
        switch(addrfamily) {
        case AF_INET6:
-               if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds, sizeof(ds)) < 0)
+       #ifdef IPV6_TCLASS
+               if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds,
+                       sizeof(ds)) < 0)
                        return sock_strerror(errno);
                break;
+       #else
+               return "IPV6_TCLASS not defined on this system";
+       #endif
        default:
                if(setsockopt(socket, IPPROTO_IP, IP_TOS, (void*)&ds, sizeof(ds)) < 0)
                        return sock_strerror(errno);
@@ -1306,6 +1311,38 @@ listen_cp_insert(struct comm_point* c, struct listen_dnsport* front)
        return 1;
 }
 
+void listen_setup_locks(void)
+{
+       if(!stream_wait_lock_inited) {
+               lock_basic_init(&stream_wait_count_lock);
+               stream_wait_lock_inited = 1;
+       }
+       if(!http2_query_buffer_lock_inited) {
+               lock_basic_init(&http2_query_buffer_count_lock);
+               http2_query_buffer_lock_inited = 1;
+       }
+       if(!http2_response_buffer_lock_inited) {
+               lock_basic_init(&http2_response_buffer_count_lock);
+               http2_response_buffer_lock_inited = 1;
+       }
+}
+
+void listen_desetup_locks(void)
+{
+       if(stream_wait_lock_inited) {
+               stream_wait_lock_inited = 0;
+               lock_basic_destroy(&stream_wait_count_lock);
+       }
+       if(http2_query_buffer_lock_inited) {
+               http2_query_buffer_lock_inited = 0;
+               lock_basic_destroy(&http2_query_buffer_count_lock);
+       }
+       if(http2_response_buffer_lock_inited) {
+               http2_response_buffer_lock_inited = 0;
+               lock_basic_destroy(&http2_response_buffer_count_lock);
+       }
+}
+
 struct listen_dnsport* 
 listen_create(struct comm_base* base, struct listen_port* ports,
        size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
@@ -1327,57 +1364,44 @@ listen_create(struct comm_base* base, struct listen_port* ports,
                free(front);
                return NULL;
        }
-       if(!stream_wait_lock_inited) {
-               lock_basic_init(&stream_wait_count_lock);
-               stream_wait_lock_inited = 1;
-       }
-       if(!http2_query_buffer_lock_inited) {
-               lock_basic_init(&http2_query_buffer_count_lock);
-               http2_query_buffer_lock_inited = 1;
-       }
-       if(!http2_response_buffer_lock_inited) {
-               lock_basic_init(&http2_response_buffer_count_lock);
-               http2_response_buffer_lock_inited = 1;
-       }
 
        /* create comm points as needed */
        while(ports) {
                struct comm_point* cp = NULL;
                if(ports->ftype == listen_type_udp ||
-                  ports->ftype == listen_type_udp_dnscrypt)
-                       cp = comm_point_create_udp(base, ports->fd, 
+                  ports->ftype == listen_type_udp_dnscrypt) {
+                       cp = comm_point_create_udp(base, ports->fd,
                                front->udp_buff, cb, cb_arg, ports->socket);
-               else if(ports->ftype == listen_type_tcp ||
-                               ports->ftype == listen_type_tcp_dnscrypt)
-                       cp = comm_point_create_tcp(base, ports->fd, 
+               } else if(ports->ftype == listen_type_tcp ||
+                               ports->ftype == listen_type_tcp_dnscrypt) {
+                       cp = comm_point_create_tcp(base, ports->fd,
                                tcp_accept_count, tcp_idle_timeout,
                                harden_large_queries, 0, NULL,
                                tcp_conn_limit, bufsize, front->udp_buff,
                                ports->ftype, cb, cb_arg, ports->socket);
-               else if(ports->ftype == listen_type_ssl ||
+               } else if(ports->ftype == listen_type_ssl ||
                        ports->ftype == listen_type_http) {
-                       cp = comm_point_create_tcp(base, ports->fd, 
+                       cp = comm_point_create_tcp(base, ports->fd,
                                tcp_accept_count, tcp_idle_timeout,
                                harden_large_queries,
                                http_max_streams, http_endpoint,
                                tcp_conn_limit, bufsize, front->udp_buff,
                                ports->ftype, cb, cb_arg, ports->socket);
-                       if(http_notls && ports->ftype == listen_type_http)
-                               cp->ssl = NULL;
-                       else
-                               cp->ssl = sslctx;
                        if(ports->ftype == listen_type_http) {
                                if(!sslctx && !http_notls) {
-                                 log_warn("HTTPS port configured, but no TLS "
-                                       "tls-service-key or tls-service-pem "
-                                       "set");
+                                       log_warn("HTTPS port configured, but "
+                                               "no TLS tls-service-key or "
+                                               "tls-service-pem set");
                                }
 #ifndef HAVE_SSL_CTX_SET_ALPN_SELECT_CB
-                               if(!http_notls)
-                                 log_warn("Unbound is not compiled with an "
-                                       "OpenSSL version supporting ALPN "
-                                       " (OpenSSL >= 1.0.2). This is required "
-                                       "to use DNS-over-HTTPS");
+                               if(!http_notls) {
+                                       log_warn("Unbound is not compiled "
+                                               "with an OpenSSL version "
+                                               "supporting ALPN "
+                                               "(OpenSSL >= 1.0.2). This "
+                                               "is required to use "
+                                               "DNS-over-HTTPS");
+                               }
 #endif
 #ifndef HAVE_NGHTTP2_NGHTTP2_H
                                log_warn("Unbound is not compiled with "
@@ -1386,14 +1410,25 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 #endif
                        }
                } else if(ports->ftype == listen_type_udpancil ||
-                                 ports->ftype == listen_type_udpancil_dnscrypt)
-                       cp = comm_point_create_udp_ancil(base, ports->fd, 
+                                 ports->ftype == listen_type_udpancil_dnscrypt) {
+                       cp = comm_point_create_udp_ancil(base, ports->fd,
                                front->udp_buff, cb, cb_arg, ports->socket);
+               }
                if(!cp) {
-                       log_err("can't create commpoint");      
+                       log_err("can't create commpoint");
                        listen_delete(front);
                        return NULL;
                }
+               if((http_notls && ports->ftype == listen_type_http) ||
+                       (ports->ftype == listen_type_tcp) ||
+                       (ports->ftype == listen_type_udp) ||
+                       (ports->ftype == listen_type_udpancil) ||
+                       (ports->ftype == listen_type_tcp_dnscrypt) ||
+                       (ports->ftype == listen_type_udp_dnscrypt) ||
+                       (ports->ftype == listen_type_udpancil_dnscrypt))
+                       cp->ssl = NULL;
+               else
+                       cp->ssl = sslctx;
                cp->dtenv = dtenv;
                cp->do_not_close = 1;
 #ifdef USE_DNSCRYPT
@@ -1454,18 +1489,6 @@ listen_delete(struct listen_dnsport* front)
 #endif
        sldns_buffer_free(front->udp_buff);
        free(front);
-       if(stream_wait_lock_inited) {
-               stream_wait_lock_inited = 0;
-               lock_basic_destroy(&stream_wait_count_lock);
-       }
-       if(http2_query_buffer_lock_inited) {
-               http2_query_buffer_lock_inited = 0;
-               lock_basic_destroy(&http2_query_buffer_count_lock);
-       }
-       if(http2_response_buffer_lock_inited) {
-               http2_response_buffer_lock_inited = 0;
-               lock_basic_destroy(&http2_response_buffer_count_lock);
-       }
 }
 
 #ifdef HAVE_GETIFADDRS
@@ -2610,7 +2633,7 @@ static int http2_req_begin_headers_cb(nghttp2_session* session,
        int ret;
        if(frame->hd.type != NGHTTP2_HEADERS ||
                frame->headers.cat != NGHTTP2_HCAT_REQUEST) {
-               /* only interrested in request headers */
+               /* only interested in request headers */
                return 0;
        }
        if(!(h2_stream = http2_stream_create(frame->hd.stream_id))) {
@@ -2738,7 +2761,7 @@ static int http2_req_header_cb(nghttp2_session* session,
         * the HEADER */
        if(frame->hd.type != NGHTTP2_HEADERS ||
                frame->headers.cat != NGHTTP2_HCAT_REQUEST) {
-               /* only interrested in request headers */
+               /* only interested in request headers */
                return 0;
        }
        if(!(h2_stream = nghttp2_session_get_stream_user_data(session,
@@ -2834,7 +2857,7 @@ static int http2_req_header_cb(nghttp2_session* session,
                        h2_stream->query_too_large = 1;
                        return 0;
                }
-               /* guaranteed to only contian digits and be null terminated */
+               /* guaranteed to only contain digits and be null terminated */
                h2_stream->content_length = atoi((const char*)value);
                if(h2_stream->content_length >
                        h2_session->c->http2_stream_max_qbuffer_size) {
@@ -2874,7 +2897,7 @@ static int http2_req_data_chunk_recv_cb(nghttp2_session* ATTR_UNUSED(session),
                        /* setting this to msg-buffer-size can result in a lot
                         * of memory consuption. Most queries should fit in a
                         * single DATA frame, and most POST queries will
-                        * containt content-length which does not impose this
+                        * contain content-length which does not impose this
                         * limit. */
                        qlen = len;
                }

diff --git a/sbin/unwind/libunbound/services/listen_dnsport.h b/sbin/unwind/libunbound/services/listen_dnsport.h
index 1e51be9..0e63236 100644 (file)
--- a/sbin/unwind/libunbound/services/listen_dnsport.h
+++ b/sbin/unwind/libunbound/services/listen_dnsport.h
@@ -199,6 +199,11 @@ listen_create(struct comm_base* base, struct listen_port* ports,
  */
 void listen_delete(struct listen_dnsport* listen);
 
+/** setup the locks for the listen ports */
+void listen_setup_locks(void);
+/** desetup the locks for the listen ports */
+void listen_desetup_locks(void);
+
 /**
  * delete listen_list of commpoints. Calls commpointdelete() on items.
  * This may close the fds or not depending on flags.

diff --git a/sbin/unwind/libunbound/services/localzone.c b/sbin/unwind/libunbound/services/localzone.c
index 54f55ab..3e3a71a 100644 (file)
--- a/sbin/unwind/libunbound/services/localzone.c
+++ b/sbin/unwind/libunbound/services/localzone.c
@@ -56,6 +56,44 @@
  * with 16 bytes for an A record, a 64K packet has about 4000 max */
 #define LOCALZONE_RRSET_COUNT_MAX 4096
 
+/** print all RRsets in local zone */
+static void
+local_zone_out(struct local_zone* z)
+{
+       struct local_data* d;
+       struct local_rrset* p;
+       RBTREE_FOR(d, struct local_data*, &z->data) {
+               for(p = d->rrsets; p; p = p->next) {
+                       log_nametypeclass(NO_VERBOSE, "rrset", d->name,
+                               ntohs(p->rrset->rk.type),
+                               ntohs(p->rrset->rk.rrset_class));
+               }
+       }
+}
+
+static void
+local_zone_print(struct local_zone* z)
+{
+       char buf[64];
+       lock_rw_rdlock(&z->lock);
+       snprintf(buf, sizeof(buf), "%s zone",
+               local_zone_type2str(z->type));
+       log_nametypeclass(NO_VERBOSE, buf, z->name, 0, z->dclass);
+       local_zone_out(z);
+       lock_rw_unlock(&z->lock);
+}
+
+void local_zones_print(struct local_zones* zones)
+{
+       struct local_zone* z;
+       lock_rw_rdlock(&zones->lock);
+       log_info("number of auth zones %u", (unsigned)zones->ztree.count);
+       RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
+               local_zone_print(z);
+       }
+       lock_rw_unlock(&zones->lock);
+}
+
 struct local_zones* 
 local_zones_create(void)
 {
@@ -465,7 +503,7 @@ lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
 
 /* Mark the SOA record for the zone. This only marks the SOA rrset; the data
  * for the RR is entered later on local_zone_enter_rr() as with the other
- * records. An artifical soa_negative record with a modified TTL (minimum of
+ * records. An artificial soa_negative record with a modified TTL (minimum of
  * the TTL and the SOA.MINIMUM) is also created and marked for usage with
  * negative answers and to avoid allocations during those answers. */
 static int
@@ -898,6 +936,11 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
                }
                lock_rw_unlock(&z->lock);
        }
+       /* home.arpa. zone (RFC 8375) */
+       if(!add_empty_default(zones, cfg, "home.arpa.")) {
+               log_err("out of memory adding default zone");
+               return 0;
+       }
        /* onion. zone (RFC 7686) */
        if(!add_empty_default(zones, cfg, "onion.")) {
                log_err("out of memory adding default zone");
@@ -1005,6 +1048,38 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
                lock_rw_rdlock(&zones->lock);
                if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
                        rr_type)) {
+                       /* Check if there is a zone that this could go
+                        * under but for different class; created zones are
+                        * always for LDNS_RR_CLASS_IN. Create the zone with
+                        * a different class but the same configured
+                        * local_zone_type. */
+                       struct local_zone* z = local_zones_lookup(zones,
+                               rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type);
+                       if(z) {
+                               uint8_t* name = memdup(z->name, z->namelen);
+                               size_t znamelen = z->namelen;
+                               int znamelabs = z->namelabs;
+                               enum localzone_type ztype = z->type;
+                               lock_rw_unlock(&zones->lock);
+                               if(!name) {
+                                       log_err("out of memory");
+                                       free(rr_name);
+                                       return 0;
+                               }
+                               if(!(
+#ifndef THREADS_DISABLED
+                                       z =
+#endif
+                                       lz_enter_zone_dname(zones, name,
+                                               znamelen, znamelabs,
+                                               ztype, rr_class))) {
+                                       free(rr_name);
+                                       return 0;
+                               }
+                               lock_rw_unlock(&z->lock);
+                               free(rr_name);
+                               continue;
+                       }
                        if(!have_name) {
                                dclass = rr_class;
                                nm = rr_name;
@@ -1215,38 +1290,6 @@ local_zones_find_le(struct local_zones* zones,
        return (struct local_zone*)node;
 }
 
-/** print all RRsets in local zone */
-static void 
-local_zone_out(struct local_zone* z)
-{
-       struct local_data* d;
-       struct local_rrset* p;
-       RBTREE_FOR(d, struct local_data*, &z->data) {
-               for(p = d->rrsets; p; p = p->next) {
-                       log_nametypeclass(NO_VERBOSE, "rrset", d->name,
-                               ntohs(p->rrset->rk.type),
-                               ntohs(p->rrset->rk.rrset_class));
-               }
-       }
-}
-
-void local_zones_print(struct local_zones* zones)
-{
-       struct local_zone* z;
-       lock_rw_rdlock(&zones->lock);
-       log_info("number of auth zones %u", (unsigned)zones->ztree.count);
-       RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
-               char buf[64];
-               lock_rw_rdlock(&z->lock);
-               snprintf(buf, sizeof(buf), "%s zone",
-                       local_zone_type2str(z->type));
-               log_nametypeclass(NO_VERBOSE, buf, z->name, 0, z->dclass);
-               local_zone_out(z);
-               lock_rw_unlock(&z->lock);
-       }
-       lock_rw_unlock(&zones->lock);
-}
-
 /** encode answer consisting of 1 rrset */
 static int
 local_encode(struct query_info* qinfo, struct module_env* env,
@@ -1294,7 +1337,7 @@ local_error_encode(struct query_info* qinfo, struct module_env* env,
 
        if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
                rcode, edns, repinfo, temp, env->now_tv))
-               edns->opt_list = NULL;
+               edns->opt_list_inplace_cb_out = NULL;
        error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf),
                sldns_buffer_read_u16_at(buf, 2), edns);
 }
@@ -1521,7 +1564,7 @@ local_data_answer(struct local_zone* z, struct module_env* env,
                        /* write qname */
                        memmove(d->rr_data[0] + sizeof(uint16_t), qinfo->qname,
                                qinfo->qname_len - 1);
-                       /* write cname target wilcard wildcard label */
+                       /* write cname target wildcard label */
                        memmove(d->rr_data[0] + sizeof(uint16_t) +
                                qinfo->qname_len - 1, ctarget + 2,
                                ctargetlen - 2);
@@ -1570,6 +1613,15 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo,
        return (lr == NULL);
 }
 
+static inline int
+local_zone_is_udp_query(struct comm_reply* repinfo) {
+       return repinfo != NULL
+                       ? (repinfo->c != NULL
+                               ? repinfo->c->type == comm_udp
+                               : 0)
+                       : 0;
+}
+
 int
 local_zones_zone_answer(struct local_zone* z, struct module_env* env,
        struct query_info* qinfo, struct edns_data* edns,
@@ -1592,7 +1644,9 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
                lz_type == local_zone_redirect ||
                lz_type == local_zone_inform_redirect ||
                lz_type == local_zone_always_nxdomain ||
-               lz_type == local_zone_always_nodata) {
+               lz_type == local_zone_always_nodata ||
+               (lz_type == local_zone_truncate
+                       && local_zone_is_udp_query(repinfo))) {
                /* for static, reply nodata or nxdomain
                 * for redirect, reply nodata */
                /* no additional section processing,
@@ -1602,9 +1656,11 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
                 */
                int rcode = (ld || lz_type == local_zone_redirect ||
                        lz_type == local_zone_inform_redirect ||
-                       lz_type == local_zone_always_nodata)?
+                       lz_type == local_zone_always_nodata ||
+                       lz_type == local_zone_truncate)?
                        LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
-               if(z->soa && z->soa_negative)
+               rcode = (lz_type == local_zone_truncate ? (rcode|BIT_TC) : rcode);
+               if(z != NULL && z->soa && z->soa_negative)
                        return local_encode(qinfo, env, edns, repinfo, buf, temp,
                                z->soa_negative, 0, rcode);
                local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
@@ -1661,7 +1717,7 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
         * does not, then we should make this noerror/nodata */
        if(ld && ld->rrsets) {
                int rcode = LDNS_RCODE_NOERROR;
-               if(z->soa && z->soa_negative)
+               if(z != NULL && z->soa && z->soa_negative)
                        return local_encode(qinfo, env, edns, repinfo, buf, temp,
                                z->soa_negative, 0, rcode);
                local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
@@ -1860,6 +1916,7 @@ const char* local_zone_type2str(enum localzone_type t)
                case local_zone_always_deny: return "always_deny";
                case local_zone_always_null: return "always_null";
                case local_zone_noview: return "noview";
+               case local_zone_truncate: return "truncate";
                case local_zone_invalid: return "invalid";
        }
        return "badtyped"; 
@@ -1899,6 +1956,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
                *t = local_zone_always_null;
        else if(strcmp(type, "noview") == 0)
                *t = local_zone_noview;
+       else if(strcmp(type, "truncate") == 0)
+               *t = local_zone_truncate;
        else if(strcmp(type, "nodefault") == 0)
                *t = local_zone_nodefault;
        else return 0;

diff --git a/sbin/unwind/libunbound/services/localzone.h b/sbin/unwind/libunbound/services/localzone.h
index b52d81d..19534f7 100644 (file)
--- a/sbin/unwind/libunbound/services/localzone.h
+++ b/sbin/unwind/libunbound/services/localzone.h
@@ -101,6 +101,8 @@ enum localzone_type {
        local_zone_always_null,
        /** answer not from the view, but global or no-answer */
        local_zone_noview,
+       /** truncate the response; client should retry via tcp */
+       local_zone_truncate,
        /** Invalid type, cannot be used to generate answer */
        local_zone_invalid
 };
@@ -255,7 +257,7 @@ void local_zone_delete(struct local_zone* z);
  * @param dclass: class to lookup.
  * @param dtype: type to lookup, if type DS a zone higher is used for zonecuts.
  * @param taglist: taglist to lookup.
- * @param taglen: lenth of taglist.
+ * @param taglen: length of taglist.
  * @param ignoretags: lookup zone by name and class, regardless the
  * local-zone's tags.
  * @return closest local_zone or NULL if no covering zone is found.
@@ -563,6 +565,8 @@ enum respip_action {
        respip_always_nodata = local_zone_always_nodata,
         /** answer with nodata response */
        respip_always_deny = local_zone_always_deny,
+       /** RPZ: truncate answer in order to force switch to tcp */
+       respip_truncate = local_zone_truncate,
 
        /* The rest of the values are only possible as
         * access-control-tag-action */

diff --git a/sbin/unwind/libunbound/services/mesh.c b/sbin/unwind/libunbound/services/mesh.c
index 5679a8b..cdcfedd 100644 (file)
--- a/sbin/unwind/libunbound/services/mesh.c
+++ b/sbin/unwind/libunbound/services/mesh.c
@@ -461,7 +461,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
        struct edns_data* edns, struct comm_reply* rep, uint16_t qid)
 {
        struct mesh_state* s = NULL;
-       int unique = unique_mesh_state(edns->opt_list, mesh->env);
+       int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
        int was_detached = 0;
        int was_noreply = 0;
        int added = 0;
@@ -505,7 +505,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
                        log_err("mesh_state_create: out of memory; SERVFAIL");
                        if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
                                LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
-                                       edns->opt_list = NULL;
+                                       edns->opt_list_inplace_cb_out = NULL;
                        error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
                                qinfo, qid, qflags, edns);
                        comm_point_send_reply(rep);
@@ -514,14 +514,14 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
                if(unique)
                        mesh_state_make_unique(s);
                /* copy the edns options we got from the front */
-               if(edns->opt_list) {
-                       s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list,
+               if(edns->opt_list_in) {
+                       s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
                                s->s.region);
                        if(!s->s.edns_opts_front_in) {
                                log_err("mesh_state_create: out of memory; SERVFAIL");
                                if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
                                        NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
-                                               edns->opt_list = NULL;
+                                               edns->opt_list_inplace_cb_out = NULL;
                                error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
                                        qinfo, qid, qflags, edns);
                                comm_point_send_reply(rep);
@@ -594,7 +594,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 servfail_mem:
        if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
                NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
-                       edns->opt_list = NULL;
+                       edns->opt_list_inplace_cb_out = NULL;
        error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
                qinfo, qid, qflags, edns);
        comm_point_send_reply(rep);
@@ -609,7 +609,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
        uint16_t qid, mesh_cb_func_type cb, void* cb_arg)
 {
        struct mesh_state* s = NULL;
-       int unique = unique_mesh_state(edns->opt_list, mesh->env);
+       int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
        int timeout = mesh->env->cfg->serve_expired?
                mesh->env->cfg->serve_expired_client_timeout:0;
        int was_detached = 0;
@@ -632,8 +632,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
                }
                if(unique)
                        mesh_state_make_unique(s);
-               if(edns->opt_list) {
-                       s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list,
+               if(edns->opt_list_in) {
+                       s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
                                s->s.region);
                        if(!s->s.edns_opts_front_in) {
                                return 0;
@@ -1145,11 +1145,11 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
                if(rcode == LDNS_RCODE_SERVFAIL) {
                        if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
                                rep, rcode, &r->edns, NULL, m->s.region, start_time))
-                                       r->edns.opt_list = NULL;
+                                       r->edns.opt_list_inplace_cb_out = NULL;
                } else {
                        if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
                                &r->edns, NULL, m->s.region, start_time))
-                                       r->edns.opt_list = NULL;
+                                       r->edns.opt_list_inplace_cb_out = NULL;
                }
                fptr_ok(fptr_whitelist_mesh_cb(r->cb));
                (*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked, NULL,
@@ -1183,6 +1183,22 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
        m->s.env->mesh->num_reply_addrs--;
 }
 
+static inline int
+mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m)
+{
+       struct respip_action_info const* respip_info = m->s.respip_action_info;
+       return respip_info == NULL
+                       ? 0
+                       : (respip_info->rpz_used
+                       && !respip_info->rpz_disabled
+                       && respip_info->action == respip_truncate);
+}
+
+static inline int
+mesh_is_udp(struct mesh_reply const* r) {
+       return r->query_reply.c->type == comm_udp;
+}
+
 /**
  * Send reply to mesh reply entry
  * @param m: mesh state to send it for.
@@ -1201,15 +1217,17 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
        struct timeval end_time;
        struct timeval duration;
        int secure;
-       /* Copy the client's EDNS for later restore, to make sure the edns
-        * compare is with the correct edns options. */
-       struct edns_data edns_bak = r->edns;
        /* briefly set the replylist to null in case the
         * meshsendreply calls tcpreqinfo sendreply that
         * comm_point_drops because of size, and then the
         * null stops the mesh state remove and thus
         * reply_list modification and accounting */
        struct mesh_reply* rlist = m->reply_list;
+
+       /* rpz: apply actions */
+       rcode = mesh_is_udp(r) && mesh_is_rpz_respip_tcponly_action(m)
+                       ? (rcode|BIT_TC) : rcode;
+
        /* examine security status */
        if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
                m->s.env->cfg->ignore_cd) && rep && 
@@ -1248,8 +1266,9 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                prev->edns.edns_present == r->edns.edns_present &&
                prev->edns.bits == r->edns.bits &&
                prev->edns.udp_size == r->edns.udp_size &&
-               edns_opt_list_compare(prev->edns.opt_list, r->edns.opt_list)
-               == 0) {
+               edns_opt_list_compare(prev->edns.opt_list_out, r->edns.opt_list_out) == 0 &&
+               edns_opt_list_compare(prev->edns.opt_list_inplace_cb_out, r->edns.opt_list_inplace_cb_out) == 0
+               ) {
                /* if the previous reply is identical to this one, fix ID */
                if(prev_buffer != r_buffer)
                        sldns_buffer_copy(r_buffer, prev_buffer);
@@ -1265,11 +1284,11 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                if(rcode == LDNS_RCODE_SERVFAIL) {
                        if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
                                rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))
-                                       r->edns.opt_list = NULL;
+                                       r->edns.opt_list_inplace_cb_out = NULL;
                } else { 
                        if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
                                &r->edns, &r->query_reply, m->s.region, &r->start_time))
-                                       r->edns.opt_list = NULL;
+                                       r->edns.opt_list_inplace_cb_out = NULL;
                }
                error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
                        r->qflags, &r->edns);
@@ -1286,9 +1305,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                m->s.qinfo.local_alias = r->local_alias;
                if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
                        LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||
-                       !apply_edns_options(&r->edns, &edns_bak,
-                               m->s.env->cfg, r->query_reply.c,
-                               m->s.region) ||
                        !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
                        r->qflags, r_buffer, 0, 1, m->s.env->scratch,
                        udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),
@@ -1296,11 +1312,10 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                {
                        if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
                        rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))
-                               r->edns.opt_list = NULL;
+                               r->edns.opt_list_inplace_cb_out = NULL;
                        error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
                                &m->s.qinfo, r->qid, r->qflags, &r->edns);
                }
-               r->edns = edns_bak;
                m->reply_list = NULL;
                comm_point_send_reply(&r->query_reply);
                m->reply_list = rlist;
@@ -1346,7 +1361,7 @@ void mesh_query_done(struct mesh_state* mstate)
        }
        if(mstate->s.return_rcode == LDNS_RCODE_SERVFAIL ||
                (rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL)) {
-               /* we are SERVFAILing; check for expired asnwer here */
+               /* we are SERVFAILing; check for expired answer here */
                mesh_serve_expired_callback(mstate);
                if((mstate->reply_list || mstate->cb_list)
                && mstate->s.env->cfg->log_servfail
@@ -1488,12 +1503,15 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
        r->cb = cb;
        r->cb_arg = cb_arg;
        r->edns = *edns;
-       if(edns->opt_list) {
-               r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
-                       s->s.region);
-               if(!r->edns.opt_list)
-                       return 0;
-       }
+       if(edns->opt_list_in && !(r->edns.opt_list_in =
+                       edns_opt_copy_region(edns->opt_list_in, s->s.region)))
+               return 0;
+       if(edns->opt_list_out && !(r->edns.opt_list_out =
+                       edns_opt_copy_region(edns->opt_list_out, s->s.region)))
+               return 0;
+       if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out =
+                       edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region)))
+               return 0;
        r->qid = qid;
        r->qflags = qflags;
        r->next = s->cb_list;
@@ -1512,12 +1530,15 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
                return 0;
        r->query_reply = *rep;
        r->edns = *edns;
-       if(edns->opt_list) {
-               r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
-                       s->s.region);
-               if(!r->edns.opt_list)
-                       return 0;
-       }
+       if(edns->opt_list_in && !(r->edns.opt_list_in =
+                       edns_opt_copy_region(edns->opt_list_in, s->s.region)))
+               return 0;
+       if(edns->opt_list_out && !(r->edns.opt_list_out =
+                       edns_opt_copy_region(edns->opt_list_out, s->s.region)))
+               return 0;
+       if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out =
+                       edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region)))
+               return 0;
        r->qid = qid;
        r->qflags = qflags;
        r->start_time = *s->s.env->now_tv;
@@ -1563,7 +1584,7 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
                        return 0;
 
                /* the rrset is not packed, like in the cache, but it is
-                * individualy allocated with an allocator from localzone. */
+                * individually allocated with an allocator from localzone. */
                d = regional_alloc_zero(s->s.region, sizeof(*d));
                if(!d)
                        return 0;

diff --git a/sbin/unwind/libunbound/services/outbound_list.h b/sbin/unwind/libunbound/services/outbound_list.h
index ad59e42..73c137d 100644 (file)
--- a/sbin/unwind/libunbound/services/outbound_list.h
+++ b/sbin/unwind/libunbound/services/outbound_list.h
@@ -79,7 +79,7 @@ void outbound_list_init(struct outbound_list* list);
  * Clear the user owner outbound list structure.
  * Deletes serviced queries.
  * @param list: the list structure. It is cleared, but the list struct itself
- *     is callers responsability to delete.
+ *     is callers responsibility to delete.
  */
 void outbound_list_clear(struct outbound_list* list);
 

diff --git a/sbin/unwind/libunbound/services/outside_network.c b/sbin/unwind/libunbound/services/outside_network.c
index a3f982e..a7e5fa3 100644 (file)
--- a/sbin/unwind/libunbound/services/outside_network.c
+++ b/sbin/unwind/libunbound/services/outside_network.c
@@ -94,6 +94,16 @@ static void waiting_list_remove(struct outside_network* outnet,
 static uint16_t tcp_select_id(struct outside_network* outnet,
        struct reuse_tcp* reuse);
 
+/** Perform serviced query UDP sending operation */
+static int serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff);
+
+/** Send serviced query over TCP return false on initial failure */
+static int serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff);
+
+/** call the callbacks for a serviced query */
+static void serviced_callbacks(struct serviced_query* sq, int error,
+       struct comm_point* c, struct comm_reply* rep);
+
 int 
 pending_cmp(const void* key1, const void* key2)
 {
@@ -836,6 +846,7 @@ outnet_add_tcp_waiting_first(struct outside_network* outnet,
        if(w->on_tcp_waiting_list)
                return;
        w->next_waiting = outnet->tcp_wait_first;
+       log_assert(w->next_waiting != w);
        if(!outnet->tcp_wait_last)
                outnet->tcp_wait_last = w;
        outnet->tcp_wait_first = w;
@@ -1136,6 +1147,22 @@ static void reuse_cb_readwait_for_failure(rbtree_type* tree_by_id, int err)
        }
 }
 
+/** mark the entry for being in the cb_and_decommission stage */
+static void mark_for_cb_and_decommission(rbnode_type* node,
+       void* ATTR_UNUSED(arg))
+{
+       struct waiting_tcp* w = (struct waiting_tcp*)node->key;
+       /* Mark the waiting_tcp to signal later code (serviced_delete) that
+        * this item is part of the backed up tree_by_id and will be deleted
+        * later. */
+       w->in_cb_and_decommission = 1;
+       /* Mark the serviced_query for deletion so that later code through
+        * callbacks (iter_clear .. outnet_serviced_query_stop) won't
+        * prematurely delete it. */
+       if(w->cb)
+               ((struct serviced_query*)w->cb_arg)->to_be_deleted = 1;
+}
+
 /** perform callbacks for failure and also decommission pending tcp.
  * the callbacks remove references in sq->pending to the waiting_tcp
  * members of the tree_by_id in the pending tcp.  The pending_tcp is
@@ -1151,6 +1178,9 @@ static void reuse_cb_and_decommission(struct outside_network* outnet,
        pend->reuse.write_wait_first = NULL;
        pend->reuse.write_wait_last = NULL;
        decommission_pending_tcp(outnet, pend);
+       if(store.root != NULL && store.root != RBTREE_NULL) {
+               traverse_postorder(&store, &mark_for_cb_and_decommission, NULL);
+       }
        reuse_cb_readwait_for_failure(&store, error);
        reuse_del_readwait(&store);
 }
@@ -1248,6 +1278,12 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
                                c->buffer));
                        /* find the query the reply is for */
                        w = reuse_tcp_by_id_find(&pend->reuse, id);
+                       /* Make sure that the reply we got is at least for a
+                        * sent query with the same ID; the waiting_tcp that
+                        * gets a reply is assumed to not be waiting to be
+                        * sent. */
+                       if(w && (w->on_tcp_waiting_list || w->write_wait_queued))
+                               w = NULL;
                }
        }
        if(error == NETEVENT_NOERROR && !w) {
@@ -1265,6 +1301,8 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
                }
        }
        if(w) {
+               log_assert(!w->on_tcp_waiting_list);
+               log_assert(!w->write_wait_queued);
                reuse_tree_by_id_delete(&pend->reuse, w);
                verbose(VERB_CLIENT, "outnet tcp callback query err %d buflen %d",
                        error, (int)sldns_buffer_limit(c->buffer));
@@ -1324,7 +1362,7 @@ outnet_send_wait_udp(struct outside_network* outnet)
 {
        struct pending* pend;
        /* process waiting queries */
-       while(outnet->udp_wait_first && outnet->unused_fds 
+       while(outnet->udp_wait_first && outnet->unused_fds
                && !outnet->want_to_quit) {
                pend = outnet->udp_wait_first;
                outnet->udp_wait_first = pend->next_waiting;
@@ -1333,8 +1371,10 @@ outnet_send_wait_udp(struct outside_network* outnet)
                sldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len);
                sldns_buffer_flip(outnet->udp_buff);
                free(pend->pkt); /* freeing now makes get_mem correct */
-               pend->pkt = NULL; 
+               pend->pkt = NULL;
                pend->pkt_len = 0;
+               log_assert(!pend->sq->busy);
+               pend->sq->busy = 1;
                if(!randomize_and_send_udp(pend, outnet->udp_buff,
                        pend->timeout)) {
                        /* callback error on pending */
@@ -1344,6 +1384,8 @@ outnet_send_wait_udp(struct outside_network* outnet)
                                        NETEVENT_CLOSED, NULL);
                        }
                        pending_delete(outnet, pend);
+               } else {
+                       pend->sq->busy = 0;
                }
        }
 }
@@ -1454,7 +1496,6 @@ calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6,
                                (*num_ip4)++;
                }
        }
-
 }
 
 void
@@ -1708,16 +1749,9 @@ static void
 serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg))
 {
        struct serviced_query* sq = (struct serviced_query*)node;
-       struct service_callback* p = sq->cblist, *np;
-       free(sq->qbuf);
-       free(sq->zone);
-       free(sq->tls_auth_name);
-       edns_opt_list_free(sq->opt_list);
-       while(p) {
-               np = p->next;
-               free(p);
-               p = np;
-       }
+       alloc_reg_release(sq->alloc, sq->region);
+       if(sq->timer)
+               comm_timer_delete(sq->timer);
        free(sq);
 }
 
@@ -1935,7 +1969,7 @@ select_id(struct outside_network* outnet, struct pending* pend,
                LDNS_ID_SET(sldns_buffer_begin(packet), pend->id);
                id_tries++;
                if(id_tries == MAX_ID_RETRY) {
-                       pend->id=99999; /* non existant ID */
+                       pend->id=99999; /* non existent ID */
                        log_err("failed to generate unique ID, drop msg");
                        return 0;
                }
@@ -1962,6 +1996,7 @@ static int udp_connect_needs_log(int err)
        case ENETDOWN:
 #  endif
        case EPERM:
+       case EACCES:
                if(verbosity >= VERB_ALGO)
                        return 1;
                return 0;
@@ -2173,10 +2208,13 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
                sq->outnet->udp_wait_last = pend;
                return pend;
        }
+       log_assert(!sq->busy);
+       sq->busy = 1;
        if(!randomize_and_send_udp(pend, packet, timeout)) {
                pending_delete(sq->outnet, pend);
                return NULL;
        }
+       sq->busy = 0;
        return pend;
 }
 
@@ -2246,7 +2284,7 @@ reuse_tcp_select_id(struct reuse_tcp* reuse, struct outside_network* outnet)
        }
 
        /* equally pick a random unused element from the tree that is
-        * not in use.  Pick a the n-th index of an ununused number,
+        * not in use.  Pick a the n-th index of an unused number,
         * then loop over the empty spaces in the tree and find it */
        log_assert(reuse->tree_by_id.count < 0xffff);
        select = ub_random_max(outnet->rnd, 0xffff - reuse->tree_by_id.count);
@@ -2359,6 +2397,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 #ifdef USE_DNSTAP
        w->sq = NULL;
 #endif
+       w->in_cb_and_decommission = 0;
        if(pend) {
                /* we have a buffer available right now */
                if(reuse) {
@@ -2455,30 +2494,62 @@ lookup_serviced(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
        return (struct serviced_query*)rbtree_search(outnet->serviced, &key);
 }
 
+void
+serviced_timer_cb(void* arg)
+{
+       struct serviced_query* sq = (struct serviced_query*)arg;
+       struct outside_network* outnet = sq->outnet;
+       verbose(VERB_ALGO, "serviced send timer");
+       /* By the time this cb is called, if we don't have any registered
+        * callbacks for this serviced_query anymore; do not send. */
+       if(!sq->cblist)
+               goto delete;
+       /* perform first network action */
+       if(outnet->do_udp && !(sq->tcp_upstream || sq->ssl_upstream)) {
+               if(!serviced_udp_send(sq, outnet->udp_buff))
+                       goto delete;
+       } else {
+               if(!serviced_tcp_send(sq, outnet->udp_buff))
+                       goto delete;
+       }
+       /* Maybe by this time we don't have callbacks attached anymore. Don't
+        * proactively try to delete; let it run and maybe another callback
+        * will get attached by the time we get an answer. */
+       return;
+delete:
+       serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
+}
+
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
        int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
        char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
        uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list,
-       size_t pad_queries_block_size)
+       size_t pad_queries_block_size, struct alloc_cache* alloc,
+       struct regional* region)
 {
        struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
+       struct timeval t;
 #ifdef UNBOUND_DEBUG
        rbnode_type* ins;
 #endif
        if(!sq) 
                return NULL;
        sq->node.key = sq;
-       sq->qbuf = memdup(sldns_buffer_begin(buff), sldns_buffer_limit(buff));
+       sq->alloc = alloc;
+       sq->region = region;
+       sq->qbuf = regional_alloc_init(region, sldns_buffer_begin(buff),
+               sldns_buffer_limit(buff));
        if(!sq->qbuf) {
+               alloc_reg_release(alloc, region);
                free(sq);
                return NULL;
        }
        sq->qbuflen = sldns_buffer_limit(buff);
-       sq->zone = memdup(zone, zonelen);
+       sq->zone = regional_alloc_init(region, zone, zonelen);
        if(!sq->zone) {
-               free(sq->qbuf);
+               alloc_reg_release(alloc, region);
                free(sq);
                return NULL;
        }
@@ -2490,10 +2561,9 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
        sq->tcp_upstream = tcp_upstream;
        sq->ssl_upstream = ssl_upstream;
        if(tls_auth_name) {
-               sq->tls_auth_name = strdup(tls_auth_name);
+               sq->tls_auth_name = regional_strdup(region, tls_auth_name);
                if(!sq->tls_auth_name) {
-                       free(sq->zone);
-                       free(sq->qbuf);
+                       alloc_reg_release(alloc, region);
                        free(sq);
                        return NULL;
                }
@@ -2502,17 +2572,16 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
        }
        memcpy(&sq->addr, addr, addrlen);
        sq->addrlen = addrlen;
-       sq->opt_list = NULL;
-       if(opt_list) {
-               sq->opt_list = edns_opt_copy_alloc(opt_list);
-               if(!sq->opt_list) {
-                       free(sq->tls_auth_name);
-                       free(sq->zone);
-                       free(sq->qbuf);
-                       free(sq);
-                       return NULL;
-               }
+       sq->opt_list = opt_list;
+       sq->busy = 0;
+       sq->timer = comm_timer_create(outnet->base, serviced_timer_cb, sq);
+       if(!sq->timer) {
+               alloc_reg_release(alloc, region);
+               free(sq);
+               return NULL;
        }
+       memset(&t, 0, sizeof(t));
+       comm_timer_set(sq->timer, &t);
        sq->outnet = outnet;
        sq->cblist = NULL;
        sq->pending = NULL;
@@ -2521,7 +2590,7 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
        sq->to_be_deleted = 0;
        sq->padding_block_size = pad_queries_block_size;
 #ifdef UNBOUND_DEBUG
-       ins = 
+       ins =
 #else
        (void)
 #endif
@@ -2619,29 +2688,38 @@ serviced_delete(struct serviced_query* sq)
                        struct waiting_tcp* w = (struct waiting_tcp*)
                                sq->pending;
                        verbose(VERB_CLIENT, "serviced_delete: TCP");
+                       log_assert(!(w->write_wait_queued && w->on_tcp_waiting_list));
                        /* if on stream-write-waiting list then
                         * remove from waiting list and waiting_tcp_delete */
                        if(w->write_wait_queued) {
                                struct pending_tcp* pend =
                                        (struct pending_tcp*)w->next_waiting;
                                verbose(VERB_CLIENT, "serviced_delete: writewait");
-                               reuse_tree_by_id_delete(&pend->reuse, w);
+                               if(!w->in_cb_and_decommission)
+                                       reuse_tree_by_id_delete(&pend->reuse, w);
                                reuse_write_wait_remove(&pend->reuse, w);
-                               waiting_tcp_delete(w);
+                               if(!w->in_cb_and_decommission)
+                                       waiting_tcp_delete(w);
                        } else if(!w->on_tcp_waiting_list) {
                                struct pending_tcp* pend =
                                        (struct pending_tcp*)w->next_waiting;
                                verbose(VERB_CLIENT, "serviced_delete: tcpreusekeep");
+                               /* w needs to stay on tree_by_id to not assign
+                                * the same ID; remove the callback since its
+                                * serviced_query will be gone. */
+                               w->cb = NULL;
                                if(!reuse_tcp_remove_serviced_keep(w, sq)) {
-                                       reuse_cb_and_decommission(sq->outnet,
-                                               pend, NETEVENT_CLOSED);
+                                       if(!w->in_cb_and_decommission)
+                                               reuse_cb_and_decommission(sq->outnet,
+                                                       pend, NETEVENT_CLOSED);
                                        use_free_buffer(sq->outnet);
                                }
                                sq->pending = NULL;
                        } else {
                                verbose(VERB_CLIENT, "serviced_delete: tcpwait");
                                waiting_list_remove(sq->outnet, w);
-                               waiting_tcp_delete(w);
+                               if(!w->in_cb_and_decommission)
+                                       waiting_tcp_delete(w);
                        }
                }
        }
@@ -2708,7 +2786,9 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
                edns.edns_present = 1;
                edns.ext_rcode = 0;
                edns.edns_version = EDNS_ADVERTISED_VERSION;
-               edns.opt_list = sq->opt_list;
+               edns.opt_list_in = NULL;
+               edns.opt_list_out = sq->opt_list;
+               edns.opt_list_inplace_cb_out = NULL;
                if(sq->status == serviced_query_UDP_EDNS_FRAG) {
                        if(addr_is_ip6(&sq->addr, sq->addrlen)) {
                                if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
@@ -2731,8 +2811,8 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
                        padding_option.opt_code = LDNS_EDNS_PADDING;
                        padding_option.opt_len = 0;
                        padding_option.opt_data = NULL;
-                       padding_option.next = edns.opt_list;
-                       edns.opt_list = &padding_option;
+                       padding_option.next = edns.opt_list_out;
+                       edns.opt_list_out = &padding_option;
                        edns.padding_block_size = sq->padding_block_size;
                }
                attach_edns_record(buff, &edns);
@@ -2889,7 +2969,8 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
                 * use secondary buffer to store the query.
                 * This is a data copy, but faster than packet to server */
                backlen = sldns_buffer_limit(c->buffer);
-               backup_p = memdup(sldns_buffer_begin(c->buffer), backlen);
+               backup_p = regional_alloc_init(sq->region,
+                       sldns_buffer_begin(c->buffer), backlen);
                if(!backup_p) {
                        log_err("malloc failure in serviced query callbacks");
                        error = NETEVENT_CLOSED;
@@ -2907,10 +2988,8 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
                }
                fptr_ok(fptr_whitelist_serviced_query(p->cb));
                (void)(*p->cb)(c, p->cb_arg, error, rep);
-               free(p);
        }
        if(backup_p) {
-               free(backup_p);
                sq->outnet->svcd_overhead = 0;
        }
        verbose(VERB_ALGO, "svcd callbacks end");
@@ -2928,7 +3007,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
        struct waiting_tcp* w = (struct waiting_tcp*)sq->pending;
        struct pending_tcp* pend_tcp = NULL;
        struct port_if* pi = NULL;
-       if(!w->on_tcp_waiting_list && w->next_waiting) {
+       if(w && !w->on_tcp_waiting_list && w->next_waiting) {
                pend_tcp = (struct pending_tcp*)w->next_waiting;
                pi = pend_tcp->pi;
        }
@@ -3024,8 +3103,11 @@ serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
                sq->status==serviced_query_TCP_EDNS?"EDNS":"");
        serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
        sq->last_sent_time = *sq->outnet->now_tv;
+       log_assert(!sq->busy);
+       sq->busy = 1;
        sq->pending = pending_tcp_query(sq, buff, sq->outnet->tcp_auth_query_timeout,
                serviced_tcp_callback, sq);
+       sq->busy = 0;
        if(!sq->pending) {
                /* delete from tree so that a retry by above layer does not
                 * clash with this entry */
@@ -3057,8 +3139,11 @@ serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff)
        } else {
                timeout = sq->outnet->tcp_auth_query_timeout;
        }
+       log_assert(!sq->busy);
+       sq->busy = 1;
        sq->pending = pending_tcp_query(sq, buff, timeout,
                serviced_tcp_callback, sq);
+       sq->busy = 0;
        return sq->pending != NULL;
 }
 
@@ -3109,7 +3194,6 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
        struct timeval now = *sq->outnet->now_tv;
 #ifdef USE_DNSTAP
        struct pending* p = (struct pending*)sq->pending;
-       struct port_if* pi = p->pc->pif;
 #endif
 
        sq->pending = NULL; /* removed after callback */
@@ -3151,14 +3235,16 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
        /*
         * sending src (local service)/dst (upstream) addresses over DNSTAP
         */
-       if(error == NETEVENT_NOERROR && outnet->dtenv &&
-          (outnet->dtenv->log_resolver_response_messages ||
-           outnet->dtenv->log_forwarder_response_messages)) {
+       if(error == NETEVENT_NOERROR && outnet->dtenv && p->pc &&
+               (outnet->dtenv->log_resolver_response_messages ||
+               outnet->dtenv->log_forwarder_response_messages)) {
                log_addr(VERB_ALGO, "response from upstream", &sq->addr, sq->addrlen);
-               log_addr(VERB_ALGO, "to local addr", &pi->addr, pi->addrlen);
-               dt_msg_send_outside_response(outnet->dtenv, &sq->addr, &pi->addr, c->type,
-                 sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
-                 &sq->last_sent_time, sq->outnet->now_tv, c->buffer);
+               log_addr(VERB_ALGO, "to local addr", &p->pc->pif->addr,
+                       p->pc->pif->addrlen);
+               dt_msg_send_outside_response(outnet->dtenv, &sq->addr,
+                       &p->pc->pif->addr, c->type, sq->zone, sq->zonelen,
+                       sq->qbuf, sq->qbuflen, &sq->last_sent_time,
+                       sq->outnet->now_tv, c->buffer);
        }
 #endif
        if( (sq->status == serviced_query_UDP_EDNS 
@@ -3248,64 +3334,117 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
        struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-       int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-       struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-       size_t zonelen, struct module_qstate* qstate,
-       comm_point_callback_type* callback, void* callback_arg, sldns_buffer* buff,
-       struct module_env* env)
+       int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream,
+       char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
+       uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
+       comm_point_callback_type* callback, void* callback_arg,
+       sldns_buffer* buff, struct module_env* env, int* was_ratelimited)
 {
        struct serviced_query* sq;
        struct service_callback* cb;
        struct edns_string_addr* client_string_addr;
-
-       if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen,
-               qstate, qstate->region))
+       struct regional* region;
+       struct edns_option* backed_up_opt_list = qstate->edns_opts_back_out;
+       struct edns_option* per_upstream_opt_list = NULL;
+       time_t timenow = 0;
+
+       /* If we have an already populated EDNS option list make a copy since
+        * we may now add upstream specific EDNS options. */
+       /* Use a region that could be attached to a serviced_query, if it needs
+        * to be created. If an existing one is found then this region will be
+        * destroyed here. */
+       region = alloc_reg_obtain(env->alloc);
+       if(!region) return NULL;
+       if(qstate->edns_opts_back_out) {
+               per_upstream_opt_list = edns_opt_copy_region(
+                       qstate->edns_opts_back_out, region);
+               if(!per_upstream_opt_list) {
+                       alloc_reg_release(env->alloc, region);
                        return NULL;
+               }
+               qstate->edns_opts_back_out = per_upstream_opt_list;
+       }
+
+       if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone,
+               zonelen, qstate, region)) {
+               alloc_reg_release(env->alloc, region);
+               return NULL;
+       }
+       /* Restore the option list; we can explicitly use the copied one from
+        * now on. */
+       per_upstream_opt_list = qstate->edns_opts_back_out;
+       qstate->edns_opts_back_out = backed_up_opt_list;
 
        if((client_string_addr = edns_string_addr_lookup(
                &env->edns_strings->client_strings, addr, addrlen))) {
-               edns_opt_list_append(&qstate->edns_opts_back_out,
+               edns_opt_list_append(&per_upstream_opt_list,
                        env->edns_strings->client_string_opcode,
                        client_string_addr->string_len,
-                       client_string_addr->string, qstate->region);
+                       client_string_addr->string, region);
        }
 
        serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
                qinfo->qclass, flags);
        sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
-               qstate->edns_opts_back_out);
-       /* duplicate entries are included in the callback list, because
-        * there is a counterpart registration by our caller that needs to
-        * be doubly-removed (with callbacks perhaps). */
-       if(!(cb = (struct service_callback*)malloc(sizeof(*cb))))
-               return NULL;
+               per_upstream_opt_list);
        if(!sq) {
+               /* Check ratelimit only for new serviced_query */
+               if(check_ratelimit) {
+                       timenow = *env->now;
+                       if(!infra_ratelimit_inc(env->infra_cache, zone,
+                               zonelen, timenow, env->cfg->ratelimit_backoff,
+                               &qstate->qinfo, qstate->reply)) {
+                               /* Can we pass through with slip factor? */
+                               if(env->cfg->ratelimit_factor == 0 ||
+                                       ub_random_max(env->rnd,
+                                       env->cfg->ratelimit_factor) != 1) {
+                                       *was_ratelimited = 1;
+                                       alloc_reg_release(env->alloc, region);
+                                       return NULL;
+                               }
+                               log_nametypeclass(VERB_ALGO,
+                                       "ratelimit allowed through for "
+                                       "delegation point", zone,
+                                       LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+                       }
+               }
                /* make new serviced query entry */
                sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps,
                        tcp_upstream, ssl_upstream, tls_auth_name, addr,
                        addrlen, zone, zonelen, (int)qinfo->qtype,
-                       qstate->edns_opts_back_out,
+                       per_upstream_opt_list,
                        ( ssl_upstream && env->cfg->pad_queries
-                       ? env->cfg->pad_queries_block_size : 0 ));
+                       ? env->cfg->pad_queries_block_size : 0 ),
+                       env->alloc, region);
                if(!sq) {
-                       free(cb);
+                       if(check_ratelimit) {
+                               infra_ratelimit_dec(env->infra_cache,
+                                       zone, zonelen, timenow);
+                       }
+                       alloc_reg_release(env->alloc, region);
                        return NULL;
                }
-               /* perform first network action */
-               if(outnet->do_udp && !(tcp_upstream || ssl_upstream)) {
-                       if(!serviced_udp_send(sq, buff)) {
-                               (void)rbtree_delete(outnet->serviced, sq);
-                               serviced_node_del(&sq->node, NULL);
-                               free(cb);
-                               return NULL;
-                       }
-               } else {
-                       if(!serviced_tcp_send(sq, buff)) {
-                               (void)rbtree_delete(outnet->serviced, sq);
-                               serviced_node_del(&sq->node, NULL);
-                               free(cb);
-                               return NULL;
+               if(!(cb = (struct service_callback*)regional_alloc(
+                       sq->region, sizeof(*cb)))) {
+                       if(check_ratelimit) {
+                               infra_ratelimit_dec(env->infra_cache,
+                                       zone, zonelen, timenow);
                        }
+                       (void)rbtree_delete(outnet->serviced, sq);
+                       serviced_node_del(&sq->node, NULL);
+                       return NULL;
+               }
+               /* No network action at this point; it will be invoked with the
+                * serviced_query timer instead to run outside of the mesh. */
+       } else {
+               /* We don't need this region anymore. */
+               alloc_reg_release(env->alloc, region);
+               /* duplicate entries are included in the callback list, because
+                * there is a counterpart registration by our caller that needs
+                * to be doubly-removed (with callbacks perhaps). */
+               if(!(cb = (struct service_callback*)regional_alloc(
+                       sq->region, sizeof(*cb)))) {
+                       return NULL;
                }
        }
        /* add callback to list of callbacks */
@@ -3325,7 +3464,6 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg)
                if((*pp)->cb_arg == cb_arg) {
                        struct service_callback* del = *pp;
                        *pp = del->next;
-                       free(del);
                        return;
                }
                pp = &(*pp)->next;
@@ -3334,13 +3472,13 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg)
 
 void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
 {
-       if(!sq) 
+       if(!sq)
                return;
        callback_list_remove(sq, cb_arg);
        /* if callbacks() routine scheduled deletion, let it do that */
-       if(!sq->cblist && !sq->to_be_deleted) {
+       if(!sq->cblist && !sq->busy && !sq->to_be_deleted) {
                (void)rbtree_delete(sq->outnet->serviced, sq);
-               serviced_delete(sq); 
+               serviced_delete(sq);
        }
 }
 

diff --git a/sbin/unwind/libunbound/services/outside_network.h b/sbin/unwind/libunbound/services/outside_network.h
index d0d532e..4c5b96f 100644 (file)
--- a/sbin/unwind/libunbound/services/outside_network.h
+++ b/sbin/unwind/libunbound/services/outside_network.h
@@ -43,7 +43,9 @@
 #ifndef OUTSIDE_NETWORK_H
 #define OUTSIDE_NETWORK_H
 
+#include "util/alloc.h"
 #include "util/rbtree.h"
+#include "util/regional.h"
 #include "util/netevent.h"
 #include "dnstap/dnstap_config.h"
 struct pending;
@@ -412,6 +414,8 @@ struct waiting_tcp {
        char* tls_auth_name;
        /** the packet was involved in an error, to stop looping errors */
        int error_count;
+       /** if true, the item is at the cb_and_decommission stage */
+       int in_cb_and_decommission;
 #ifdef USE_DNSTAP
        /** serviced query pointer for dnstap to get logging info, if nonNULL*/
        struct serviced_query* sq;
@@ -512,6 +516,15 @@ struct serviced_query {
        void* pending;
        /** block size with which to pad encrypted queries (default: 128) */
        size_t padding_block_size;
+       /** region for this serviced query. Will be cleared when this
+        * serviced_query will be deleted */
+       struct regional* region;
+       /** allocation service for the region */
+       struct alloc_cache* alloc;
+       /** flash timer to start the net I/O as a separate event */
+       struct comm_timer* timer;
+       /** true if serviced_query is currently doing net I/O and may block */
+       int busy;
 };
 
 /**
@@ -619,6 +632,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  * @param want_dnssec: signatures are needed, without EDNS the answer is
  *     likely to be useless.
  * @param nocaps: ignore use_caps_for_id and use unperturbed qname.
+ * @param check_ratelimit: if set, will check ratelimit before sending out.
  * @param tcp_upstream: use TCP for upstream queries.
  * @param ssl_upstream: use SSL for upstream queries.
  * @param tls_auth_name: when ssl_upstream is true, use this name to check
@@ -635,16 +649,18 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  * @param callback_arg: user argument to callback function.
  * @param buff: scratch buffer to create query contents in. Empty on exit.
  * @param env: the module environment.
+ * @param was_ratelimited: it will signal back if the query failed to pass the
+ *     ratelimit check.
  * @return 0 on error, or pointer to serviced query that is used to answer
  *     this serviced query may be shared with other callbacks as well.
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
        struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-       int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-       struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-       size_t zonelen, struct module_qstate* qstate,
+       int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream,
+       char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
+       uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
        comm_point_callback_type* callback, void* callback_arg,
-       struct sldns_buffer* buff, struct module_env* env);
+       struct sldns_buffer* buff, struct module_env* env, int* was_ratelimited);
 
 /**
  * Remove service query callback.
@@ -785,6 +801,9 @@ void pending_udp_timer_delay_cb(void *arg);
 /** callback for outgoing TCP timer event */
 void outnet_tcptimer(void* arg);
 
+/** callback to send serviced queries */
+void serviced_timer_cb(void *arg);
+
 /** callback for serviced query UDP answers */
 int serviced_udp_callback(struct comm_point* c, void* arg, int error,
         struct comm_reply* rep);

diff --git a/sbin/unwind/libunbound/services/rpz.c b/sbin/unwind/libunbound/services/rpz.c
index 3a1ec00..322e9d1 100644 (file)
--- a/sbin/unwind/libunbound/services/rpz.c
+++ b/sbin/unwind/libunbound/services/rpz.c
@@ -50,45 +50,50 @@
 #include "util/data/dname.h"
 #include "util/locks.h"
 #include "util/regional.h"
+#include "util/data/msgencode.h"
+#include "services/cache/dns.h"
+#include "iterator/iterator.h"
+#include "iterator/iter_delegpt.h"
+#include "daemon/worker.h"
+
+typedef struct resp_addr rpz_aclnode_type;
+
+struct matched_delegation_point {
+       uint8_t* dname;
+       size_t dname_len;
+};
 
 /** string for RPZ action enum */
 const char*
 rpz_action_to_string(enum rpz_action a)
 {
        switch(a) {
-       case RPZ_NXDOMAIN_ACTION:       return "nxdomain";
-       case RPZ_NODATA_ACTION:         return "nodata";
-       case RPZ_PASSTHRU_ACTION:       return "passthru";
-       case RPZ_DROP_ACTION:           return "drop";
-       case RPZ_TCP_ONLY_ACTION:       return "tcp_only";
-       case RPZ_INVALID_ACTION:        return "invalid";
-       case RPZ_LOCAL_DATA_ACTION:     return "local_data";
-       case RPZ_DISABLED_ACTION:       return "disabled";
-       case RPZ_CNAME_OVERRIDE_ACTION: return "cname_override";
-       case RPZ_NO_OVERRIDE_ACTION:    return "no_override";
+       case RPZ_NXDOMAIN_ACTION: return "rpz-nxdomain";
+       case RPZ_NODATA_ACTION: return "rpz-nodata";
+       case RPZ_PASSTHRU_ACTION: return "rpz-passthru";
+       case RPZ_DROP_ACTION: return "rpz-drop";
+       case RPZ_TCP_ONLY_ACTION: return "rpz-tcp-only";
+       case RPZ_INVALID_ACTION: return "rpz-invalid";
+       case RPZ_LOCAL_DATA_ACTION: return "rpz-local-data";
+       case RPZ_DISABLED_ACTION: return "rpz-disabled";
+       case RPZ_CNAME_OVERRIDE_ACTION: return "rpz-cname-override";
+       case RPZ_NO_OVERRIDE_ACTION: return "rpz-no-override";
+       default: return "rpz-unknown-action";
        }
-       return "unknown";
 }
 
 /** RPZ action enum for config string */
 static enum rpz_action
 rpz_config_to_action(char* a)
 {
-       if(strcmp(a, "nxdomain") == 0)
-               return RPZ_NXDOMAIN_ACTION;
-       else if(strcmp(a, "nodata") == 0)
-               return RPZ_NODATA_ACTION;
-       else if(strcmp(a, "passthru") == 0)
-               return RPZ_PASSTHRU_ACTION;
-       else if(strcmp(a, "drop") == 0)
-               return RPZ_DROP_ACTION;
-       else if(strcmp(a, "tcp_only") == 0)
-               return RPZ_TCP_ONLY_ACTION;
-       else if(strcmp(a, "cname") == 0)
-               return RPZ_CNAME_OVERRIDE_ACTION;
-       else if(strcmp(a, "disabled") == 0)
-               return RPZ_DISABLED_ACTION;
-       return RPZ_INVALID_ACTION;
+       if(strcmp(a, "nxdomain") == 0) return RPZ_NXDOMAIN_ACTION;
+       else if(strcmp(a, "nodata") == 0) return RPZ_NODATA_ACTION;
+       else if(strcmp(a, "passthru") == 0) return RPZ_PASSTHRU_ACTION;
+       else if(strcmp(a, "drop") == 0) return RPZ_DROP_ACTION;
+       else if(strcmp(a, "tcp_only") == 0) return RPZ_TCP_ONLY_ACTION;
+       else if(strcmp(a, "cname") == 0) return RPZ_CNAME_OVERRIDE_ACTION;
+       else if(strcmp(a, "disabled") == 0) return RPZ_DISABLED_ACTION;
+       else return RPZ_INVALID_ACTION;
 }
 
 /** string for RPZ trigger enum */
@@ -96,14 +101,14 @@ static const char*
 rpz_trigger_to_string(enum rpz_trigger r)
 {
        switch(r) {
-       case RPZ_QNAME_TRIGGER:         return "qname";
-       case RPZ_CLIENT_IP_TRIGGER:     return "client_ip";
-       case RPZ_RESPONSE_IP_TRIGGER:   return "response_ip";
-       case RPZ_NSDNAME_TRIGGER:       return "nsdname";
-       case RPZ_NSIP_TRIGGER:          return "nsip";
-       case RPZ_INVALID_TRIGGER:       return "invalid";
+       case RPZ_QNAME_TRIGGER: return "rpz-qname";
+       case RPZ_CLIENT_IP_TRIGGER: return "rpz-client-ip";
+       case RPZ_RESPONSE_IP_TRIGGER: return "rpz-response-ip";
+       case RPZ_NSDNAME_TRIGGER: return "rpz-nsdname";
+       case RPZ_NSIP_TRIGGER: return "rpz-nsip";
+       case RPZ_INVALID_TRIGGER: return "rpz-invalid";
+       default: return "rpz-unknown-trigger";
        }
-       return "unknown";
 }
 
 /**
@@ -137,6 +142,31 @@ get_tld_label(uint8_t* dname, size_t maxdnamelen)
        return prevlab;
 }
 
+/**
+ * The RR types that are to be ignored.
+ * DNSSEC RRs at the apex, and SOA and NS are ignored.
+ */
+static int
+rpz_type_ignored(uint16_t rr_type)
+{
+       switch(rr_type) {
+               case LDNS_RR_TYPE_SOA:
+               case LDNS_RR_TYPE_NS:
+               case LDNS_RR_TYPE_DNAME:
+               /* all DNSSEC-related RRs must be ignored */
+               case LDNS_RR_TYPE_DNSKEY:
+               case LDNS_RR_TYPE_DS:
+               case LDNS_RR_TYPE_RRSIG:
+               case LDNS_RR_TYPE_NSEC:
+               case LDNS_RR_TYPE_NSEC3:
+               case LDNS_RR_TYPE_NSEC3PARAM:
+                       return 1;
+               default:
+                       break;
+       }
+       return 0;
+}
+
 /**
  * Classify RPZ action for RR type/rdata
  * @param rr_type: the RR type
@@ -208,15 +238,15 @@ static enum localzone_type
 rpz_action_to_localzone_type(enum rpz_action a)
 {
        switch(a) {
-       case RPZ_NXDOMAIN_ACTION:       return local_zone_always_nxdomain;
-       case RPZ_NODATA_ACTION:         return local_zone_always_nodata;
-       case RPZ_DROP_ACTION:           return local_zone_always_deny;
-       case RPZ_PASSTHRU_ACTION:       return local_zone_always_transparent;
+       case RPZ_NXDOMAIN_ACTION: return local_zone_always_nxdomain;
+       case RPZ_NODATA_ACTION: return local_zone_always_nodata;
+       case RPZ_DROP_ACTION: return local_zone_always_deny;
+       case RPZ_PASSTHRU_ACTION: return local_zone_always_transparent;
        case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
        case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
-       case RPZ_INVALID_ACTION:        /* fallthrough */
-       case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
-       default:                        return local_zone_invalid;
+       case RPZ_TCP_ONLY_ACTION: return local_zone_truncate;
+       case RPZ_INVALID_ACTION: /* fallthrough */
+       default: return local_zone_invalid;
        }
 }
 
@@ -224,15 +254,15 @@ enum respip_action
 rpz_action_to_respip_action(enum rpz_action a)
 {
        switch(a) {
-       case RPZ_NXDOMAIN_ACTION:       return respip_always_nxdomain;
-       case RPZ_NODATA_ACTION:         return respip_always_nodata;
-       case RPZ_DROP_ACTION:           return respip_always_deny;
-       case RPZ_PASSTHRU_ACTION:       return respip_always_transparent;
-       case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
+       case RPZ_NXDOMAIN_ACTION: return respip_always_nxdomain;
+       case RPZ_NODATA_ACTION: return respip_always_nodata;
+       case RPZ_DROP_ACTION: return respip_always_deny;
+       case RPZ_PASSTHRU_ACTION: return respip_always_transparent;
+       case RPZ_LOCAL_DATA_ACTION: /* fallthrough */
        case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
-       case RPZ_INVALID_ACTION:        /* fallthrough */
-       case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
-       default:                        return respip_invalid;
+       case RPZ_TCP_ONLY_ACTION: return respip_truncate;
+       case RPZ_INVALID_ACTION: /* fallthrough */
+       default: return respip_invalid;
        }
 }
 
@@ -240,14 +270,14 @@ static enum rpz_action
 localzone_type_to_rpz_action(enum localzone_type lzt)
 {
        switch(lzt) {
-       case local_zone_always_nxdomain:        return RPZ_NXDOMAIN_ACTION;
-       case local_zone_always_nodata:          return RPZ_NODATA_ACTION;
-       case local_zone_always_deny:            return RPZ_DROP_ACTION;
-       case local_zone_always_transparent:     return RPZ_PASSTHRU_ACTION;
-       case local_zone_redirect:               return RPZ_LOCAL_DATA_ACTION;
-       case local_zone_invalid:
-       default:
-               return RPZ_INVALID_ACTION;
+       case local_zone_always_nxdomain: return RPZ_NXDOMAIN_ACTION;
+       case local_zone_always_nodata: return RPZ_NODATA_ACTION;
+       case local_zone_always_deny: return RPZ_DROP_ACTION;
+       case local_zone_always_transparent: return RPZ_PASSTHRU_ACTION;
+       case local_zone_redirect: return RPZ_LOCAL_DATA_ACTION;
+       case local_zone_truncate: return RPZ_TCP_ONLY_ACTION;
+       case local_zone_invalid: /* fallthrough */
+       default: return RPZ_INVALID_ACTION;
        }
 }
 
@@ -255,14 +285,14 @@ enum rpz_action
 respip_action_to_rpz_action(enum respip_action a)
 {
        switch(a) {
-       case respip_always_nxdomain:    return RPZ_NXDOMAIN_ACTION;
-       case respip_always_nodata:      return RPZ_NODATA_ACTION;
-       case respip_always_deny:        return RPZ_DROP_ACTION;
-       case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
-       case respip_redirect:           return RPZ_LOCAL_DATA_ACTION;
-       case respip_invalid:
-       default:
-               return RPZ_INVALID_ACTION;
+       case respip_always_nxdomain: return RPZ_NXDOMAIN_ACTION;
+       case respip_always_nodata: return RPZ_NODATA_ACTION;
+       case respip_always_deny: return RPZ_DROP_ACTION;
+       case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
+       case respip_redirect: return RPZ_LOCAL_DATA_ACTION;
+       case respip_truncate: return RPZ_TCP_ONLY_ACTION;
+       case respip_invalid: /* fallthrough */
+       default: return RPZ_INVALID_ACTION;
        }
 }
 
@@ -298,12 +328,55 @@ rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
        return RPZ_QNAME_TRIGGER;
 }
 
-void rpz_delete(struct rpz* r)
+static inline struct clientip_synthesized_rrset*
+rpz_clientip_synthesized_set_create(void)
+{
+       struct clientip_synthesized_rrset* set = calloc(1, sizeof(*set));
+       if(set == NULL) {
+               return NULL;
+       }
+       set->region = regional_create();
+       if(set->region == NULL) {
+               free(set);
+               return NULL;
+       }
+       addr_tree_init(&set->entries);
+       lock_rw_init(&set->lock);
+       return set;
+}
+
+static void
+rpz_clientip_synthesized_rr_delete(rbnode_type* n, void* ATTR_UNUSED(arg))
+{
+       struct clientip_synthesized_rr* r = (struct clientip_synthesized_rr*)n->key;
+       lock_rw_destroy(&r->lock);
+#ifdef THREADS_DISABLED
+       (void)r;
+#endif
+}
+
+static inline void
+rpz_clientip_synthesized_set_delete(struct clientip_synthesized_rrset* set)
+{
+       if(set == NULL) {
+               return;
+       }
+       lock_rw_destroy(&set->lock);
+       traverse_postorder(&set->entries, rpz_clientip_synthesized_rr_delete, NULL);
+       regional_destroy(set->region);
+       free(set);
+}
+
+void
+rpz_delete(struct rpz* r)
 {
        if(!r)
                return;
        local_zones_delete(r->local_zones);
+       local_zones_delete(r->nsdname_zones);
        respip_set_delete(r->respip_set);
+       rpz_clientip_synthesized_set_delete(r->client_set);
+       rpz_clientip_synthesized_set_delete(r->ns_set);
        regional_destroy(r->region);
        free(r->taglist);
        free(r->log_name);
@@ -315,13 +388,31 @@ rpz_clear(struct rpz* r)
 {
        /* must hold write lock on auth_zone */
        local_zones_delete(r->local_zones);
+       r->local_zones = NULL;
+       local_zones_delete(r->nsdname_zones);
+       r->nsdname_zones = NULL;
        respip_set_delete(r->respip_set);
+       r->respip_set = NULL;
+       rpz_clientip_synthesized_set_delete(r->client_set);
+       r->client_set = NULL;
+       rpz_clientip_synthesized_set_delete(r->ns_set);
+       r->ns_set = NULL;
        if(!(r->local_zones = local_zones_create())){
                return 0;
        }
+       r->nsdname_zones = local_zones_create();
+       if(r->nsdname_zones == NULL) {
+               return 0;
+       }
        if(!(r->respip_set = respip_set_create())) {
                return 0;
        }
+       if(!(r->client_set = rpz_clientip_synthesized_set_create())) {
+               return 0;
+       }
+       if(!(r->ns_set = rpz_clientip_synthesized_set_create())) {
+               return 0;
+       }
        return 1;
 }
 
@@ -331,6 +422,14 @@ rpz_finish_config(struct rpz* r)
        lock_rw_wrlock(&r->respip_set->lock);
        addr_tree_init_parents(&r->respip_set->ip_tree);
        lock_rw_unlock(&r->respip_set->lock);
+
+       lock_rw_wrlock(&r->client_set->lock);
+       addr_tree_init_parents(&r->client_set->entries);
+       lock_rw_unlock(&r->client_set->lock);
+
+       lock_rw_wrlock(&r->ns_set->lock);
+       addr_tree_init_parents(&r->ns_set->entries);
+       lock_rw_unlock(&r->ns_set->lock);
 }
 
 /** new rrset containing CNAME override, does not yet contain a dname */
@@ -394,9 +493,26 @@ rpz_create(struct config_auth* p)
        if(!(r->local_zones = local_zones_create())){
                goto err;
        }
+
+       r->nsdname_zones = local_zones_create();
+       if(r->local_zones == NULL){
+               goto err;
+       }
+
        if(!(r->respip_set = respip_set_create())) {
                goto err;
        }
+
+       r->client_set = rpz_clientip_synthesized_set_create();
+       if(r->client_set == NULL) {
+               goto err;
+       }
+
+       r->ns_set = rpz_clientip_synthesized_set_create();
+       if(r->ns_set == NULL) {
+               goto err;
+       }
+
        r->taglistlen = p->rpz_taglistlen;
        r->taglist = memdup(p->rpz_taglist, r->taglistlen);
        if(p->rpz_action_override) {
@@ -426,6 +542,7 @@ rpz_create(struct config_auth* p)
                }
        }
        r->log = p->rpz_log;
+       r->signal_nxdomain_ra = p->rpz_signal_nxdomain_ra;
        if(p->rpz_log_name) {
                if(!(r->log_name = strdup(p->rpz_log_name))) {
                        log_err("malloc failure on RPZ log_name strdup");
@@ -437,8 +554,14 @@ err:
        if(r) {
                if(r->local_zones)
                        local_zones_delete(r->local_zones);
+               if(r->nsdname_zones)
+                       local_zones_delete(r->nsdname_zones);
                if(r->respip_set)
                        respip_set_delete(r->respip_set);
+               if(r->client_set != NULL)
+                       rpz_clientip_synthesized_set_delete(r->client_set);
+               if(r->ns_set != NULL)
+                       rpz_clientip_synthesized_set_delete(r->ns_set);
                if(r->taglist)
                        free(r->taglist);
                if(r->region)
@@ -467,19 +590,17 @@ strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
        return newdnamelen + 1; /* + 1 for root label */
 }
 
-/** Insert RR into RPZ's local-zone */
 static void
-rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
-       enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
+       size_t dnamelen, enum rpz_action a, uint16_t rrtype, uint16_t rrclass,
+       uint32_t ttl, uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 {
        struct local_zone* z;
        enum localzone_type tp = local_zone_always_transparent;
        int dnamelabs = dname_count_labels(dname);
-       char* rrstr;
        int newzone = 0;
 
-       if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
+       if(a == RPZ_INVALID_ACTION) {
                char str[255+1];
                if(rrtype == LDNS_RR_TYPE_SOA || rrtype == LDNS_RR_TYPE_NS ||
                        rrtype == LDNS_RR_TYPE_DNAME ||
@@ -499,237 +620,542 @@ rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
                return;
        }
 
-       lock_rw_wrlock(&r->local_zones->lock);
+       lock_rw_wrlock(&lz->lock);
        /* exact match */
-       z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
-               LDNS_RR_CLASS_IN);
-       if(z && a != RPZ_LOCAL_DATA_ACTION) {
-               rrstr = sldns_wire2str_rr(rr, rr_len);
-               if(!rrstr) {
-                       log_err("malloc error while inserting RPZ qname "
-                               "trigger");
+       z = local_zones_find(lz, dname, dnamelen, dnamelabs, LDNS_RR_CLASS_IN);
+       if(z != NULL && a != RPZ_LOCAL_DATA_ACTION) {
+               char* rrstr = sldns_wire2str_rr(rr, rr_len);
+               if(rrstr == NULL) {
+                       log_err("malloc error while inserting rpz nsdname trigger");
                        free(dname);
-                       lock_rw_unlock(&r->local_zones->lock);
+                       lock_rw_unlock(&lz->lock);
                        return;
                }
-               verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
-                       rrstr);
+               if(rrstr[0])
+                       rrstr[strlen(rrstr)-1]=0; /* remove newline */
+               verbose(VERB_ALGO, "rpz: skipping duplicate record: '%s'", rrstr);
                free(rrstr);
                free(dname);
-               lock_rw_unlock(&r->local_zones->lock);
+               lock_rw_unlock(&lz->lock);
                return;
        }
-       if(!z) {
+       if(z == NULL) {
                tp = rpz_action_to_localzone_type(a);
-               if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
-                       dnamelabs, rrclass, tp))) {
-                       log_warn("RPZ create failed");
-                       lock_rw_unlock(&r->local_zones->lock);
+               z = local_zones_add_zone(lz, dname, dnamelen,
+                                        dnamelabs, rrclass, tp);
+               if(z == NULL) {
+                       log_warn("rpz: create failed");
+                       lock_rw_unlock(&lz->lock);
                        /* dname will be free'd in failed local_zone_create() */
                        return;
                }
                newzone = 1;
        }
        if(a == RPZ_LOCAL_DATA_ACTION) {
-               rrstr = sldns_wire2str_rr(rr, rr_len);
-               if(!rrstr) {
-                       log_err("malloc error while inserting RPZ qname "
-                               "trigger");
+               char* rrstr = sldns_wire2str_rr(rr, rr_len);
+               if(rrstr == NULL) {
+                       log_err("malloc error while inserting rpz nsdname trigger");
                        free(dname);
-                       lock_rw_unlock(&r->local_zones->lock);
+                       lock_rw_unlock(&lz->lock);
                        return;
                }
                lock_rw_wrlock(&z->lock);
-               local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
-                       rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
+               local_zone_enter_rr(z, dname, dnamelen, dnamelabs, rrtype,
+                                   rrclass, ttl, rdata, rdata_len, rrstr);
                lock_rw_unlock(&z->lock);
                free(rrstr);
        }
-       if(!newzone)
+       if(!newzone) {
                free(dname);
-       lock_rw_unlock(&r->local_zones->lock);
-       return;
+       }
+       lock_rw_unlock(&lz->lock);
 }
 
-/** Insert RR into RPZ's respip_set */
-static int
-rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+static void
+rpz_log_dname(char const* msg, uint8_t* dname, size_t dname_len)
+{
+       char buf[LDNS_MAX_DOMAINLEN+1];
+       (void)dname_len;
+       dname_str(dname, buf);
+       verbose(VERB_ALGO, "rpz: %s: <%s>", msg, buf);
+}
+
+static void
+rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
        enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
        uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 {
-       struct resp_addr* node;
-       struct sockaddr_storage addr;
-       socklen_t addrlen;
-       int net, af;
-       char* rrstr;
-       enum respip_action respa = rpz_action_to_respip_action(a);
+       if(a == RPZ_INVALID_ACTION) {
+               verbose(VERB_ALGO, "rpz: skipping invalid action");
+               free(dname);
+               return;
+       }
 
-       if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
-               respa == respip_invalid) {
-               char str[255+1];
-               dname_str(dname, str);
-               verbose(VERB_ALGO, "RPZ: respip trigger, %s skipping unsupported action: %s",
-                       str, rpz_action_to_string(a));
+       rpz_insert_local_zones_trigger(r->local_zones, dname, dnamelen, a, rrtype,
+                                      rrclass, ttl, rdata, rdata_len, rr, rr_len);
+}
+
+static int
+rpz_strip_nsdname_suffix(uint8_t* dname, size_t maxdnamelen,
+       uint8_t** stripdname, size_t* stripdnamelen)
+{
+       uint8_t* tldstart = get_tld_label(dname, maxdnamelen);
+       uint8_t swap;
+       if(tldstart == NULL) {
+               if(dname == NULL) {
+                       *stripdname = NULL;
+                       *stripdnamelen = 0;
+                       return 0;
+               }
+               *stripdname = memdup(dname, maxdnamelen);
+               if(!*stripdname) {
+                       *stripdnamelen = 0;
+                       log_err("malloc failure for rpz strip suffix");
+                       return 0;
+               }
+               *stripdnamelen = maxdnamelen;
+               return 1;
+       }
+       /* shorten the domain name briefly,
+        * then we allocate a new name with the correct length */
+       swap = *tldstart;
+       *tldstart = 0;
+       (void)dname_count_size_labels(dname, stripdnamelen);
+       *stripdname = memdup(dname, *stripdnamelen);
+       *tldstart = swap;
+       if(!*stripdname) {
+               *stripdnamelen = 0;
+               log_err("malloc failure for rpz strip suffix");
                return 0;
        }
+       return 1;
+}
 
-       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
-               return 0;
+static void
+rpz_insert_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+       uint8_t* dname_stripped = NULL;
+       size_t dnamelen_stripped = 0;
 
-       lock_rw_wrlock(&r->respip_set->lock);
+       rpz_strip_nsdname_suffix(dname, dnamelen, &dname_stripped,
+               &dnamelen_stripped);
+       if(a == RPZ_INVALID_ACTION) {
+               verbose(VERB_ALGO, "rpz: skipping invalid action");
+               free(dname_stripped);
+               return;
+       }
+
+       /* dname_stripped is consumed or freed by the insert routine */
+       rpz_insert_local_zones_trigger(r->nsdname_zones, dname_stripped,
+               dnamelen_stripped, a, rrtype, rrclass, ttl, rdata, rdata_len,
+               rr, rr_len);
+}
+
+static int
+rpz_insert_ipaddr_based_trigger(struct respip_set* set, struct sockaddr_storage* addr,
+       socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype,
+       uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len,
+       uint8_t* rr, size_t rr_len)
+{
+       struct resp_addr* node;
+       char* rrstr;
+       enum respip_action respa = rpz_action_to_respip_action(a);
+
+       lock_rw_wrlock(&set->lock);
        rrstr = sldns_wire2str_rr(rr, rr_len);
-       if(!rrstr) {
-               log_err("malloc error while inserting RPZ respip trigger");
-               lock_rw_unlock(&r->respip_set->lock);
+       if(rrstr == NULL) {
+               log_err("malloc error while inserting rpz ipaddr based trigger");
+               lock_rw_unlock(&set->lock);
                return 0;
        }
-       if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
-               net, 1, rrstr))) {
-               lock_rw_unlock(&r->respip_set->lock);
+
+       node = respip_sockaddr_find_or_create(set, addr, addrlen, net, 1, rrstr);
+       if(node == NULL) {
+               lock_rw_unlock(&set->lock);
                free(rrstr);
                return 0;
        }
 
        lock_rw_wrlock(&node->lock);
-       lock_rw_unlock(&r->respip_set->lock);
+       lock_rw_unlock(&set->lock);
+
        node->action = respa;
 
        if(a == RPZ_LOCAL_DATA_ACTION) {
-               respip_enter_rr(r->respip_set->region, node, rrtype,
-                       rrclass, ttl, rdata, rdata_len, rrstr, "");
+               respip_enter_rr(set->region, node, rrtype,
+                               rrclass, ttl, rdata, rdata_len, rrstr, "");
        }
+
        lock_rw_unlock(&node->lock);
        free(rrstr);
        return 1;
 }
 
-int
-rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
-       size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
-       uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
+static inline struct clientip_synthesized_rr*
+rpz_clientip_ensure_entry(struct clientip_synthesized_rrset* set,
+       struct sockaddr_storage* addr, socklen_t addrlen, int net)
 {
-       size_t policydnamelen;
-       /* name is free'd in local_zone delete */
-       enum rpz_trigger t;
-       enum rpz_action a;
-       uint8_t* policydname;
+       int insert_ok;
+       struct clientip_synthesized_rr* node =
+               (struct clientip_synthesized_rr*)addr_tree_find(&set->entries,
+                                                               addr, addrlen, net);
 
-       if(!dname_subdomain_c(dname, azname)) {
-               char* dname_str = sldns_wire2str_dname(dname, dnamelen);
-               char* azname_str = sldns_wire2str_dname(azname, aznamelen);
-               if(dname_str && azname_str) {
-                       log_err("RPZ: name of record (%s) to insert into RPZ is not a "
-                               "subdomain of the configured name of the RPZ zone (%s)",
-                               dname_str, azname_str);
-               } else {
-                       log_err("RPZ: name of record to insert into RPZ is not a "
-                               "subdomain of the configured name of the RPZ zone");
-               }
-               free(dname_str);
-               free(azname_str);
-               return 0;
+       if(node != NULL) { return node; }
+
+       /* node does not yet exist => allocate one */
+       node = regional_alloc_zero(set->region, sizeof(*node));
+       if(node == NULL) {
+               log_err("out of memory");
+               return NULL;
        }
 
-       log_assert(dnamelen >= aznamelen);
-       if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) {
-               log_err("malloc error while inserting RPZ RR");
-               return 0;
+       lock_rw_init(&node->lock);
+       node->action = RPZ_INVALID_ACTION;
+       insert_ok = addr_tree_insert(&set->entries, &node->node,
+                                    addr, addrlen, net);
+       if (!insert_ok) {
+               log_warn("rpz: unexpected: unable to insert clientip address node");
+               /* we can not free the just allocated node.
+                * theoretically a memleak */
+               return NULL;
        }
 
-       a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
-       if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
-               policydname, (dnamelen-aznamelen)+1))) {
-               free(policydname);
-               return 0;
+       return node;
+}
+
+static void
+rpz_report_rrset_error(const char* msg, uint8_t* rr, size_t rr_len) {
+       char* rrstr = sldns_wire2str_rr(rr, rr_len);
+       if(rrstr == NULL) {
+               log_err("malloc error while inserting rpz clientip based record");
+               return;
        }
-       t = rpz_dname_to_trigger(policydname, policydnamelen);
-       if(t == RPZ_INVALID_TRIGGER) {
-               free(policydname);
-               verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
-               return 1;
+       log_err("rpz: unexpected: unable to insert %s: %s", msg, rrstr);
+       free(rrstr);
+}
+
+/* from localzone.c; difference is we don't have a dname */
+static struct local_rrset*
+rpz_clientip_new_rrset(struct regional* region,
+       struct clientip_synthesized_rr* raddr, uint16_t rrtype, uint16_t rrclass)
+{
+       struct packed_rrset_data* pd;
+       struct local_rrset* rrset = (struct local_rrset*)
+               regional_alloc_zero(region, sizeof(*rrset));
+       if(rrset == NULL) {
+               log_err("out of memory");
+               return NULL;
        }
-       if(t == RPZ_QNAME_TRIGGER) {
-               rpz_insert_qname_trigger(r, policydname, policydnamelen,
-                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-                       rr_len);
+       rrset->next = raddr->data;
+       raddr->data = rrset;
+       rrset->rrset = (struct ub_packed_rrset_key*)
+               regional_alloc_zero(region, sizeof(*rrset->rrset));
+       if(rrset->rrset == NULL) {
+               log_err("out of memory");
+               return NULL;
        }
-       else if(t == RPZ_RESPONSE_IP_TRIGGER) {
-               rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
-                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-                       rr_len);
-               free(policydname);
+       rrset->rrset->entry.key = rrset->rrset;
+       pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
+       if(pd == NULL) {
+               log_err("out of memory");
+               return NULL;
        }
-       else {
-               free(policydname);
-               verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s",
-                       rpz_trigger_to_string(t));
+       pd->trust = rrset_trust_prim_noglue;
+       pd->security = sec_status_insecure;
+       rrset->rrset->entry.data = pd;
+       rrset->rrset->rk.type = htons(rrtype);
+       rrset->rrset->rk.rrset_class = htons(rrclass);
+       rrset->rrset->rk.dname = regional_alloc_zero(region, 1);
+       if(rrset->rrset->rk.dname == NULL) {
+               log_err("out of memory");
+               return NULL;
        }
-       return 1;
+       rrset->rrset->rk.dname_len = 1;
+       return rrset;
 }
 
-/**
- * Find RPZ local-zone by qname.
- * @param r: rpz containing local-zone tree
- * @param qname: qname
- * @param qname_len: length of qname
- * @param qclass: qclass
- * @param only_exact: if 1 only excact (non wildcard) matches are returned
- * @param wr: get write lock for local-zone if 1, read lock if 0
- * @param zones_keep_lock: if set do not release the r->local_zones lock, this
- *       makes the caller of this function responsible for releasing the lock.
- * @return: NULL or local-zone holding rd or wr lock
- */
-static struct local_zone*
-rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
-       int only_exact, int wr, int zones_keep_lock)
+static int
+rpz_clientip_enter_rr(struct regional* region, struct clientip_synthesized_rr* raddr,
+       uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
+       size_t rdata_len)
 {
-       uint8_t* ce;
-       size_t ce_len;
-       int ce_labs;
-       uint8_t wc[LDNS_MAX_DOMAINLEN+1];
-       int exact;
-       struct local_zone* z = NULL;
-       if(wr) {
-               lock_rw_wrlock(&r->local_zones->lock);
-       } else {
-               lock_rw_rdlock(&r->local_zones->lock);
-       }
-       z = local_zones_find_le(r->local_zones, qname, qname_len,
-               dname_count_labels(qname),
-               LDNS_RR_CLASS_IN, &exact);
-       if(!z || (only_exact && !exact)) {
-               lock_rw_unlock(&r->local_zones->lock);
-               return NULL;
-       }
-       if(wr) {
-               lock_rw_wrlock(&z->lock);
-       } else {
-               lock_rw_rdlock(&z->lock);
+       struct local_rrset* rrset;
+       if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data != NULL) {
+               log_err("CNAME response-ip data can not co-exist with other "
+                       "client-ip data");
+               return 0;
        }
-       if(!zones_keep_lock) {
-               lock_rw_unlock(&r->local_zones->lock);
+
+       rrset = rpz_clientip_new_rrset(region, raddr, rrtype, rrclass);
+       if(raddr->data == NULL) {
+               return 0;
        }
 
-       if(exact)
-               return z;
+       return rrset_insert_rr(region, rrset->rrset->entry.data, rdata, rdata_len, ttl, "");
+}
 
-       /* No exact match found, lookup wildcard. closest encloser must
-        * be the shared parent between the qname and the best local
-        * zone match, append '*' to that and do another lookup. */
+static int
+rpz_clientip_insert_trigger_rr(struct clientip_synthesized_rrset* set, struct sockaddr_storage* addr,
+       socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype,
+       uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len,
+       uint8_t* rr, size_t rr_len)
+{
+       struct clientip_synthesized_rr* node;
 
-       ce = dname_get_shared_topdomain(z->name, qname);
-       if(!ce /* should not happen */) {
-               lock_rw_unlock(&z->lock);
-               if(zones_keep_lock) {
-                       lock_rw_unlock(&r->local_zones->lock);
-               }
-               return NULL;
+       lock_rw_wrlock(&set->lock);
+
+       node = rpz_clientip_ensure_entry(set, addr, addrlen, net);
+       if(node == NULL) {
+               lock_rw_unlock(&set->lock);
+               rpz_report_rrset_error("client ip address", rr, rr_len);
+               return 0;
+       }
+
+       lock_rw_wrlock(&node->lock);
+       lock_rw_unlock(&set->lock);
+
+       node->action = a;
+       if(a == RPZ_LOCAL_DATA_ACTION) {
+               if(!rpz_clientip_enter_rr(set->region, node, rrtype,
+                       rrclass, ttl, rdata, rdata_len)) {
+                       verbose(VERB_ALGO, "rpz: unable to insert clientip rr");
+                       lock_rw_unlock(&node->lock);
+                       return 0;
+               }
+
+       }
+
+       lock_rw_unlock(&node->lock);
+
+       return 1;
+}
+
+static int
+rpz_insert_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+       struct sockaddr_storage addr;
+       socklen_t addrlen;
+       int net, af;
+
+       if(a == RPZ_INVALID_ACTION) {
+               return 0;
+       }
+
+       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) {
+               verbose(VERB_ALGO, "rpz: unable to parse client ip");
+               return 0;
+       }
+
+       return rpz_clientip_insert_trigger_rr(r->client_set, &addr, addrlen, net,
+                       a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+}
+
+static int
+rpz_insert_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+       struct sockaddr_storage addr;
+       socklen_t addrlen;
+       int net, af;
+
+       if(a == RPZ_INVALID_ACTION) {
+               return 0;
+       }
+
+       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) {
+               verbose(VERB_ALGO, "rpz: unable to parse ns ip");
+               return 0;
+       }
+
+       return rpz_clientip_insert_trigger_rr(r->ns_set, &addr, addrlen, net,
+                       a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+}
+
+/** Insert RR into RPZ's respip_set */
+static int
+rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
+       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+{
+       struct sockaddr_storage addr;
+       socklen_t addrlen;
+       int net, af;
+
+       if(a == RPZ_INVALID_ACTION) {
+               return 0;
+       }
+
+       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) {
+               verbose(VERB_ALGO, "rpz: unable to parse response ip");
+               return 0;
+       }
+
+       if(a == RPZ_INVALID_ACTION ||
+               rpz_action_to_respip_action(a) == respip_invalid) {
+               char str[255+1];
+               dname_str(dname, str);
+               verbose(VERB_ALGO, "RPZ: respip trigger, %s skipping unsupported action: %s",
+                       str, rpz_action_to_string(a));
+               return 0;
+       }
+
+       return rpz_insert_ipaddr_based_trigger(r->respip_set, &addr, addrlen, net,
+                       a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+}
+
+int
+rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
+       size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+       uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
+{
+       size_t policydnamelen;
+       /* name is free'd in local_zone delete */
+       enum rpz_trigger t;
+       enum rpz_action a;
+       uint8_t* policydname;
+
+       if(rpz_type_ignored(rr_type)) {
+               /* this rpz action is not valid, eg. this is the SOA or NS RR */
+               return 1;
+       }
+       if(!dname_subdomain_c(dname, azname)) {
+               char* dname_str = sldns_wire2str_dname(dname, dnamelen);
+               char* azname_str = sldns_wire2str_dname(azname, aznamelen);
+               if(dname_str && azname_str) {
+                       log_err("rpz: name of record (%s) to insert into RPZ is not a "
+                               "subdomain of the configured name of the RPZ zone (%s)",
+                               dname_str, azname_str);
+               } else {
+                       log_err("rpz: name of record to insert into RPZ is not a "
+                               "subdomain of the configured name of the RPZ zone");
+               }
+               free(dname_str);
+               free(azname_str);
+               return 0;
+       }
+
+       log_assert(dnamelen >= aznamelen);
+       if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) {
+               log_err("malloc error while inserting RPZ RR");
+               return 0;
+       }
+
+       a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
+       if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
+               policydname, (dnamelen-aznamelen)+1))) {
+               free(policydname);
+               return 0;
+       }
+       t = rpz_dname_to_trigger(policydname, policydnamelen);
+       if(t == RPZ_INVALID_TRIGGER) {
+               free(policydname);
+               verbose(VERB_ALGO, "rpz: skipping invalid trigger");
+               return 1;
+       }
+       if(t == RPZ_QNAME_TRIGGER) {
+               /* policydname will be consumed, no free */
+               rpz_insert_qname_trigger(r, policydname, policydnamelen,
+                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+                       rr_len);
+       } else if(t == RPZ_RESPONSE_IP_TRIGGER) {
+               rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
+                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+                       rr_len);
+               free(policydname);
+       } else if(t == RPZ_CLIENT_IP_TRIGGER) {
+               rpz_insert_clientip_trigger(r, policydname, policydnamelen,
+                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+                       rr_len);
+               free(policydname);
+       } else if(t == RPZ_NSIP_TRIGGER) {
+               rpz_insert_nsip_trigger(r, policydname, policydnamelen,
+                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+                       rr_len);
+               free(policydname);
+       } else if(t == RPZ_NSDNAME_TRIGGER) {
+               rpz_insert_nsdname_trigger(r, policydname, policydnamelen,
+                       a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
+                       rr_len);
+               free(policydname);
+       } else {
+               free(policydname);
+               verbose(VERB_ALGO, "rpz: skipping unsupported trigger: %s",
+                       rpz_trigger_to_string(t));
+       }
+       return 1;
+}
+
+/**
+ * Find RPZ local-zone by qname.
+ * @param zones: local-zone tree
+ * @param qname: qname
+ * @param qname_len: length of qname
+ * @param qclass: qclass
+ * @param only_exact: if 1 only exact (non wildcard) matches are returned
+ * @param wr: get write lock for local-zone if 1, read lock if 0
+ * @param zones_keep_lock: if set do not release the r->local_zones lock, this
+ *       makes the caller of this function responsible for releasing the lock.
+ * @return: NULL or local-zone holding rd or wr lock
+ */
+static struct local_zone*
+rpz_find_zone(struct local_zones* zones, uint8_t* qname, size_t qname_len, uint16_t qclass,
+       int only_exact, int wr, int zones_keep_lock)
+{
+       uint8_t* ce;
+       size_t ce_len;
+       int ce_labs;
+       uint8_t wc[LDNS_MAX_DOMAINLEN+1];
+       int exact;
+       struct local_zone* z = NULL;
+
+       if(wr) {
+               lock_rw_wrlock(&zones->lock);
+       } else {
+               lock_rw_rdlock(&zones->lock);
+       }
+       z = local_zones_find_le(zones, qname, qname_len,
+               dname_count_labels(qname),
+               LDNS_RR_CLASS_IN, &exact);
+       if(!z || (only_exact && !exact)) {
+               if(!zones_keep_lock) {
+                       lock_rw_unlock(&zones->lock);
+               }
+               return NULL;
+       }
+       if(wr) {
+               lock_rw_wrlock(&z->lock);
+       } else {
+               lock_rw_rdlock(&z->lock);
+       }
+       if(!zones_keep_lock) {
+               lock_rw_unlock(&zones->lock);
+       }
+
+       if(exact)
+               return z;
+
+       /* No exact match found, lookup wildcard. closest encloser must
+        * be the shared parent between the qname and the best local
+        * zone match, append '*' to that and do another lookup. */
+
+       ce = dname_get_shared_topdomain(z->name, qname);
+       if(!ce /* should not happen */) {
+               lock_rw_unlock(&z->lock);
+               if(zones_keep_lock) {
+                       lock_rw_unlock(&zones->lock);
+               }
+               return NULL;
        }
        ce_labs = dname_count_size_labels(ce, &ce_len);
        if(ce_len+2 > sizeof(wc)) {
                lock_rw_unlock(&z->lock);
                if(zones_keep_lock) {
-                       lock_rw_unlock(&r->local_zones->lock);
+                       lock_rw_unlock(&zones->lock);
                }
                return NULL;
        }
@@ -740,15 +1166,15 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
 
        if(!zones_keep_lock) {
                if(wr) {
-                       lock_rw_wrlock(&r->local_zones->lock);
+                       lock_rw_wrlock(&zones->lock);
                } else {
-                       lock_rw_rdlock(&r->local_zones->lock);
+                       lock_rw_rdlock(&zones->lock);
                }
        }
-       z = local_zones_find_le(r->local_zones, wc,
+       z = local_zones_find_le(zones, wc,
                ce_len+2, ce_labs+1, qclass, &exact);
        if(!z || !exact) {
-               lock_rw_unlock(&r->local_zones->lock);
+               lock_rw_unlock(&zones->lock);
                return NULL;
        }
        if(wr) {
@@ -757,7 +1183,7 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
                lock_rw_rdlock(&z->lock);
        }
        if(!zones_keep_lock) {
-               lock_rw_unlock(&r->local_zones->lock);
+               lock_rw_unlock(&zones->lock);
        }
        return z;
 }
@@ -766,7 +1192,7 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
  * Remove RR from RPZ's local-data
  * @param z: local-zone for RPZ, holding write lock
  * @param policydname: dname of RR to remove
- * @param policydnamelen: lenth of policydname
+ * @param policydnamelen: length of policydname
  * @param rr_type: RR type of RR to remove
  * @param rdata: rdata of RR to remove
  * @param rdatalen: length of rdata
@@ -852,10 +1278,10 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 {
        struct local_zone* z;
        int delete_zone = 1;
-       z = rpz_find_zone(r, dname, dnamelen, rr_class,
+       z = rpz_find_zone(r->local_zones, dname, dnamelen, rr_class,
                1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
        if(!z) {
-               verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
+               verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, "
                        "RPZ domain not found");
                return;
        }
@@ -891,7 +1317,7 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
        lock_rw_wrlock(&r->respip_set->lock);
        if(!(node = (struct resp_addr*)addr_tree_find(
                &r->respip_set->ip_tree, &addr, addrlen, net))) {
-               verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
+               verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, "
                        "RPZ domain not found");
                lock_rw_unlock(&r->respip_set->lock);
                return;
@@ -944,118 +1370,1009 @@ rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
 
 /** print log information for an applied RPZ policy. Based on local-zone's
  * lz_inform_print().
+ * The repinfo contains the reply address. If it is NULL, the module
+ * state is used to report the first IP address (if any).
+ * The dname is used, for the applied rpz, if NULL, addrnode is used.
  */
 static void
-log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
-       struct comm_reply* repinfo, char* log_name)
+log_rpz_apply(char* trigger, uint8_t* dname, struct addr_tree_node* addrnode,
+       enum rpz_action a, struct query_info* qinfo,
+       struct comm_reply* repinfo, struct module_qstate* ms, char* log_name)
 {
-       char ip[128], txt[512];
+       char ip[128], txt[512], portstr[32];
        char dnamestr[LDNS_MAX_DOMAINLEN+1];
-       uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
-       dname_str(dname, dnamestr);
-       addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
-       if(log_name)
-               snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
-                       log_name, dnamestr, rpz_action_to_string(a), ip,
-                       (unsigned)port);
-       else
-               snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
-                       dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
+       uint16_t port = 0;
+       if(dname) {
+               dname_str(dname, dnamestr);
+       } else if(addrnode) {
+               char addrbuf[128];
+               addr_to_str(&addrnode->addr, addrnode->addrlen, addrbuf, sizeof(addrbuf));
+               snprintf(dnamestr, sizeof(dnamestr), "%s/%d", addrbuf, addrnode->net);
+       } else {
+               dnamestr[0]=0;
+       }
+       if(repinfo) {
+               addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
+               port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
+       } else if(ms && ms->mesh_info && ms->mesh_info->reply_list) {
+               addr_to_str(&ms->mesh_info->reply_list->query_reply.addr, ms->mesh_info->reply_list->query_reply.addrlen, ip, sizeof(ip));
+               port = ntohs(((struct sockaddr_in*)&ms->mesh_info->reply_list->query_reply.addr)->sin_port);
+       } else {
+               ip[0]=0;
+               port = 0;
+       }
+       snprintf(portstr, sizeof(portstr), "@%u", (unsigned)port);
+       snprintf(txt, sizeof(txt), "rpz: applied %s%s%s%s%s%s %s %s%s",
+               (log_name?"[":""), (log_name?log_name:""), (log_name?"] ":""),
+               (strcmp(trigger,"qname")==0?"":trigger),
+               (strcmp(trigger,"qname")==0?"":" "),
+               dnamestr, rpz_action_to_string(a),
+               (ip[0]?ip:""), (ip[0]?portstr:""));
        log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 }
 
-int
-rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
-       struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
-       struct regional* temp, struct comm_reply* repinfo,
-       uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
+static struct clientip_synthesized_rr*
+rpz_ipbased_trigger_lookup(struct clientip_synthesized_rrset* set,
+       struct sockaddr_storage* addr, socklen_t addrlen, char* triggername)
+{
+       struct clientip_synthesized_rr* raddr = NULL;
+       enum rpz_action action = RPZ_INVALID_ACTION;
+
+       lock_rw_rdlock(&set->lock);
+
+       raddr = (struct clientip_synthesized_rr*)addr_tree_lookup(&set->entries,
+                       addr, addrlen);
+       if(raddr != NULL) {
+               lock_rw_rdlock(&raddr->lock);
+               action = raddr->action;
+               if(verbosity >= VERB_ALGO) {
+                       char ip[256], net[256];
+                       addr_to_str(addr, addrlen, ip, sizeof(ip));
+                       addr_to_str(&raddr->node.addr, raddr->node.addrlen,
+                               net, sizeof(net));
+                       verbose(VERB_ALGO, "rpz: trigger %s %s/%d on %s action=%s",
+                               triggername, net, raddr->node.net, ip, rpz_action_to_string(action));
+               }
+       }
+       lock_rw_unlock(&set->lock);
+
+       return raddr;
+}
+
+static inline
+struct clientip_synthesized_rr*
+rpz_resolve_client_action_and_zone(struct auth_zones* az, struct query_info* qinfo,
+       struct comm_reply* repinfo, uint8_t* taglist, size_t taglen,
+       struct ub_server_stats* stats,
+       /* output parameters */
+       struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out)
 {
+       struct clientip_synthesized_rr* node = NULL;
+       struct auth_zone* a = NULL;
        struct rpz* r = NULL;
-       struct auth_zone* a;
-       int ret;
-       enum localzone_type lzt;
        struct local_zone* z = NULL;
-       struct local_data* ld = NULL;
+
        lock_rw_rdlock(&az->rpz_lock);
+
        for(a = az->rpz_first; a; a = a->rpz_az_next) {
                lock_rw_rdlock(&a->lock);
                r = a->rpz;
-               if(!r->disabled && (!r->taglist || taglist_intersect(r->taglist,
-                       r->taglistlen, taglist, taglen))) {
-                       z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
-                               qinfo->qclass, 0, 0, 0);
-                       if(z && r->action_override == RPZ_DISABLED_ACTION) {
-                               if(r->log)
-                                       log_rpz_apply(z->name,
-                                               r->action_override,
-                                               qinfo, repinfo, r->log_name);
-                               /* TODO only register stats when stats_extended?
-                                * */
-                               stats->rpz_action[r->action_override]++;
+               if(r->disabled) {
+                       lock_rw_unlock(&a->lock);
+                       continue;
+               }
+               if(r->taglist && !taglist_intersect(r->taglist,
+                                       r->taglistlen, taglist, taglen)) {
+                       lock_rw_unlock(&a->lock);
+                       continue;
+               }
+               z = rpz_find_zone(r->local_zones, qinfo->qname, qinfo->qname_len,
+                       qinfo->qclass, 0, 0, 0);
+               node = rpz_ipbased_trigger_lookup(r->client_set, &repinfo->addr, repinfo->addrlen, "clientip");
+               if((z || node) && r->action_override == RPZ_DISABLED_ACTION) {
+                       if(r->log)
+                               log_rpz_apply((node?"clientip":"qname"),
+                                       (z?z->name:NULL),
+                                       (node?&node->node:NULL),
+                                       r->action_override,
+                                       qinfo, repinfo, NULL, r->log_name);
+                       stats->rpz_action[r->action_override]++;
+                       if(z != NULL) {
                                lock_rw_unlock(&z->lock);
                                z = NULL;
                        }
-                       if(z)
-                               break;
+                       if(node != NULL) {
+                               lock_rw_unlock(&node->lock);
+                               node = NULL;
+                       }
+               }
+               if(z || node) {
+                       break;
                }
-               lock_rw_unlock(&a->lock); /* not found in this auth_zone */
+               /* not found in this auth_zone */
+               lock_rw_unlock(&a->lock);
        }
+
        lock_rw_unlock(&az->rpz_lock);
-       if(!z)
-               return 0; /* not holding auth_zone.lock anymore */
 
-       log_assert(r);
-       if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
-               lzt = z->type;
-       else
-               lzt = rpz_action_to_localzone_type(r->action_override);
+       *r_out = r;
+       *a_out = a;
+       *z_out = z;
+
+       return node;
+}
+
+static inline int
+rpz_is_udp_query(struct comm_reply* repinfo) {
+       return repinfo != NULL
+                       ? (repinfo->c != NULL
+                               ? repinfo->c->type == comm_udp
+                               : 0)
+                       : 0;
+}
+
+/** encode answer consisting of 1 rrset */
+static int
+rpz_local_encode(struct module_env* env, struct query_info* qinfo,
+       struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
+       struct regional* temp, struct ub_packed_rrset_key* rrset, int ansec,
+       int rcode, struct ub_packed_rrset_key* soa_rrset)
+{
+       struct reply_info rep;
+       uint16_t udpsize;
+       struct ub_packed_rrset_key* rrsetlist[3];
+
+       memset(&rep, 0, sizeof(rep));
+       rep.flags = (uint16_t)((BIT_QR | BIT_AA | BIT_RA) | rcode);
+       rep.qdcount = 1;
+       rep.rrset_count = ansec;
+       rep.rrsets = rrsetlist;
+       if(ansec > 0) {
+               rep.an_numrrsets = 1;
+               rep.rrsets[0] = rrset;
+               rep.ttl = ((struct packed_rrset_data*)rrset->entry.data)->rr_ttl[0];
+       }
+       if(soa_rrset != NULL) {
+               rep.ar_numrrsets = 1;
+               rep.rrsets[rep.rrset_count] = soa_rrset;
+               rep.rrset_count ++;
+               if(rep.ttl < ((struct packed_rrset_data*)soa_rrset->entry.data)->rr_ttl[0]) {
+                       rep.ttl = ((struct packed_rrset_data*)soa_rrset->entry.data)->rr_ttl[0];
+               }
+       }
+
+       udpsize = edns->udp_size;
+       edns->edns_version = EDNS_ADVERTISED_VERSION;
+       edns->udp_size = EDNS_ADVERTISED_SIZE;
+       edns->ext_rcode = 0;
+       edns->bits &= EDNS_DO;
+       if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
+               repinfo, temp, env->now_tv) ||
+         !reply_info_answer_encode(qinfo, &rep,
+               *(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
+               buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
+               error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
+                       *(uint16_t*)sldns_buffer_begin(buf),
+                       sldns_buffer_read_u16_at(buf, 2), edns);
+       }
+
+       return 1;
+}
+
+static struct local_rrset*
+rpz_find_synthesized_rrset(int qtype, struct clientip_synthesized_rr* data) {
+       struct local_rrset* cursor = data->data;
+       while( cursor != NULL) {
+               struct packed_rrset_key* packed_rrset = &cursor->rrset->rk;
+               if(htons(qtype) == packed_rrset->type) {
+                       return cursor;
+               }
+               cursor = cursor->next;
+       }
+       return NULL;
+}
 
+/** allocate SOA record ubrrsetkey in region */
+static struct ub_packed_rrset_key*
+make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa,
+       struct regional* temp)
+{
+       struct ub_packed_rrset_key csoa;
+       if(!soa)
+               return NULL;
+       memset(&csoa, 0, sizeof(csoa));
+       csoa.entry.key = &csoa;
+       csoa.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+       csoa.rk.type = htons(LDNS_RR_TYPE_SOA);
+       csoa.rk.flags |= PACKED_RRSET_FIXEDTTL
+               | PACKED_RRSET_RPZ;
+       csoa.rk.dname = auth_zone->name;
+       csoa.rk.dname_len = auth_zone->namelen;
+       csoa.entry.hash = rrset_key_hash(&csoa.rk);
+       csoa.entry.data = soa->data;
+       return respip_copy_rrset(&csoa, temp);
+}
+
+static void
+rpz_apply_clientip_localdata_action(struct clientip_synthesized_rr* raddr,
+       struct module_env* env, struct query_info* qinfo,
+       struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
+       struct regional* temp, struct auth_zone* auth_zone)
+{
+       struct local_rrset* rrset;
+       enum rpz_action action = RPZ_INVALID_ACTION;
+       struct ub_packed_rrset_key* rp = NULL;
+       struct ub_packed_rrset_key* rsoa = NULL;
+       int rcode = LDNS_RCODE_NOERROR|BIT_AA;
+       int rrset_count = 1;
+
+       /* prepare synthesized answer for client */
+       action = raddr->action;
+       if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL ) {
+               verbose(VERB_ALGO, "rpz: bug: local-data action but no local data");
+               return;
+       }
+
+       /* check query type / rr type */
+       rrset = rpz_find_synthesized_rrset(qinfo->qtype, raddr);
+       if(rrset == NULL) {
+               verbose(VERB_ALGO, "rpz: unable to find local-data for query");
+               rrset_count = 0;
+               goto nodata;
+       }
+
+       rp = respip_copy_rrset(rrset->rrset, temp);
+       if(!rp) {
+               verbose(VERB_ALGO, "rpz: local data action: out of memory");
+               return;
+       }
+
+       rp->rk.flags |= PACKED_RRSET_FIXEDTTL | PACKED_RRSET_RPZ;
+       rp->rk.dname = qinfo->qname;
+       rp->rk.dname_len = qinfo->qname_len;
+       rp->entry.hash = rrset_key_hash(&rp->rk);
+nodata:
+       if(auth_zone) {
+               struct auth_rrset* soa = NULL;
+               soa = auth_zone_get_soa_rrset(auth_zone);
+               if(soa) {
+                       rsoa = make_soa_ubrrset(auth_zone, soa, temp);
+                       if(!rsoa) {
+                               verbose(VERB_ALGO, "rpz: local data action soa: out of memory");
+                               return;
+                       }
+               }
+       }
+
+       rpz_local_encode(env, qinfo, edns, repinfo, buf, temp, rp,
+               rrset_count, rcode, rsoa);
+}
+
+/** add additional section SOA record to the reply.
+ * Since this gets fed into the normal iterator answer creation, it
+ * gets minimal-responses applied to it, that can remove the additional SOA
+ * again. */
+static int
+rpz_add_soa(struct reply_info* rep, struct module_qstate* ms,
+       struct auth_zone* az)
+{
+       struct auth_rrset* soa = NULL;
+       struct ub_packed_rrset_key* rsoa = NULL;
+       struct ub_packed_rrset_key** prevrrsets;
+       if(!az) return 1;
+       soa = auth_zone_get_soa_rrset(az);
+       if(!soa) return 1;
+       if(!rep) return 0;
+       rsoa = make_soa_ubrrset(az, soa, ms->region);
+       if(!rsoa) return 0;
+       prevrrsets = rep->rrsets;
+       rep->rrsets = regional_alloc_zero(ms->region,
+               sizeof(*rep->rrsets)*(rep->rrset_count+1));
+       if(!rep->rrsets)
+               return 0;
+       if(prevrrsets && rep->rrset_count > 0)
+               memcpy(rep->rrsets, prevrrsets, rep->rrset_count*sizeof(*rep->rrsets));
+       rep->rrset_count++;
+       rep->ar_numrrsets++;
+       rep->rrsets[rep->rrset_count-1] = rsoa;
+       return 1;
+}
+
+static inline struct dns_msg*
+rpz_dns_msg_new(struct regional* region)
+{
+       struct dns_msg* msg =
+                       (struct dns_msg*)regional_alloc(region,
+                                                       sizeof(struct dns_msg));
+       if(msg == NULL) { return NULL; }
+       memset(msg, 0, sizeof(struct dns_msg));
+
+       return msg;
+}
+
+static inline struct dns_msg*
+rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms,
+       struct query_info* qinfo, struct auth_zone* az)
+{
+       struct dns_msg* msg = rpz_dns_msg_new(ms->region);
+       if(msg == NULL) { return msg; }
+       msg->qinfo = *qinfo;
+       msg->rep = construct_reply_info_base(ms->region,
+                                            LDNS_RCODE_NOERROR | BIT_QR | BIT_AA | BIT_RA,
+                                            1, /* qd */
+                                            0, /* ttl */
+                                            0, /* prettl */
+                                            0, /* expttl */
+                                            0, /* an */
+                                            0, /* ns */
+                                            0, /* ar */
+                                            0, /* total */
+                                            sec_status_insecure);
+       if(msg->rep)
+               msg->rep->authoritative = 1;
+       if(!rpz_add_soa(msg->rep, ms, az))
+               return NULL;
+       return msg;
+}
+
+static inline struct dns_msg*
+rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms,
+       struct query_info* qinfo, struct auth_zone* az)
+{
+       struct dns_msg* msg = rpz_dns_msg_new(ms->region);
+       uint16_t flags;
+       if(msg == NULL) { return msg; }
+       msg->qinfo = *qinfo;
+       flags = LDNS_RCODE_NXDOMAIN | BIT_QR | BIT_AA | BIT_RA;
+       if(r->signal_nxdomain_ra)
+               flags &= ~BIT_RA;
+       msg->rep = construct_reply_info_base(ms->region,
+                                            flags,
+                                            1, /* qd */
+                                            0, /* ttl */
+                                            0, /* prettl */
+                                            0, /* expttl */
+                                            0, /* an */
+                                            0, /* ns */
+                                            0, /* ar */
+                                            0, /* total */
+                                            sec_status_insecure);
+       if(msg->rep)
+               msg->rep->authoritative = 1;
+       if(!rpz_add_soa(msg->rep, ms, az))
+               return NULL;
+       return msg;
+}
+
+static inline struct dns_msg*
+rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms,
+       struct query_info* qi, struct local_rrset* rrset, struct auth_zone* az)
+{
+       struct dns_msg* msg = NULL;
+       struct reply_info* new_reply_info;
+       struct ub_packed_rrset_key* rp;
+
+
+       msg = rpz_dns_msg_new(ms->region);
+       if(msg == NULL) { return NULL; }
+
+        new_reply_info = construct_reply_info_base(ms->region,
+                                                   LDNS_RCODE_NOERROR | BIT_QR | BIT_AA | BIT_RA,
+                                                   1, /* qd */
+                                                   0, /* ttl */
+                                                   0, /* prettl */
+                                                   0, /* expttl */
+                                                   1, /* an */
+                                                   0, /* ns */
+                                                   0, /* ar */
+                                                   1, /* total */
+                                                   sec_status_insecure);
+       if(new_reply_info == NULL) {
+               log_err("out of memory");
+               return NULL;
+       }
+       new_reply_info->authoritative = 1;
+       rp = respip_copy_rrset(rrset->rrset, ms->region);
+       if(rp == NULL) {
+               log_err("out of memory");
+               return NULL;
+       }
+       rp->rk.dname = qi->qname;
+       rp->rk.dname_len = qi->qname_len;
+       /* this rrset is from the rpz data, or synthesized.
+        * It is not actually from the network, so we flag it with this
+        * flags as a fake RRset. If later the cache is used to look up
+        * rrsets, then the fake ones are not returned (if you look without
+        * the flag). For like CNAME lookups from the iterator or A, AAAA
+        * lookups for nameserver targets, it would use the without flag
+        * actual data. So that the actual network data and fake data
+        * are kept track of separately. */
+       rp->rk.flags |= PACKED_RRSET_RPZ;
+       new_reply_info->rrsets[0] = rp;
+       msg->rep = new_reply_info;
+       if(!rpz_add_soa(msg->rep, ms, az))
+               return NULL;
+       return msg;
+}
+
+static inline struct dns_msg*
+rpz_synthesize_nsip_localdata(struct rpz* r, struct module_qstate* ms,
+       struct clientip_synthesized_rr* data, struct auth_zone* az)
+{
+       struct query_info* qi = &ms->qinfo;
+       struct local_rrset* rrset;
+
+       rrset = rpz_find_synthesized_rrset(qi->qtype, data);
+       if(rrset == NULL) {
+               verbose(VERB_ALGO, "rpz: nsip: no matching local data found");
+               return NULL;
+       }
+
+       return rpz_synthesize_localdata_from_rrset(r, ms, &ms->qinfo, rrset, az);
+}
+
+/* copy'n'paste from localzone.c */
+static struct local_rrset*
+local_data_find_type(struct local_data* data, uint16_t type, int alias_ok)
+{
+       struct local_rrset* p;
+       type = htons(type);
+       for(p = data->rrsets; p; p = p->next) {
+               if(p->rrset->rk.type == type)
+                       return p;
+               if(alias_ok && p->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME))
+                       return p;
+       }
+       return NULL;
+}
+
+/* based on localzone.c:local_data_answer() */
+static inline struct dns_msg*
+rpz_synthesize_nsdname_localdata(struct rpz* r, struct module_qstate* ms,
+       struct local_zone* z, struct matched_delegation_point const* match,
+       struct auth_zone* az)
+{
+       struct local_data key;
+       struct local_data* ld;
+       struct local_rrset* rrset;
+
+       if(match->dname == NULL) { return NULL; }
+
+       key.node.key = &key;
+       key.name = match->dname;
+       key.namelen = match->dname_len;
+       key.namelabs = dname_count_labels(match->dname);
+
+       rpz_log_dname("nsdname local data", key.name, key.namelen);
+
+       ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+       if(ld == NULL) {
+               verbose(VERB_ALGO, "rpz: nsdname: impossible: qname not found");
+               return NULL;
+       }
+
+       rrset = local_data_find_type(ld, ms->qinfo.qtype, 1);
+       if(rrset == NULL) {
+               verbose(VERB_ALGO, "rpz: nsdname: no matching local data found");
+               return NULL;
+       }
+
+       return rpz_synthesize_localdata_from_rrset(r, ms, &ms->qinfo, rrset, az);
+}
+
+/* like local_data_answer for qname triggers after a cname */
+static struct dns_msg*
+rpz_synthesize_qname_localdata_msg(struct rpz* r, struct module_qstate* ms,
+       struct query_info* qinfo, struct local_zone* z, struct auth_zone* az)
+{
+       struct local_data key;
+       struct local_data* ld;
+       struct local_rrset* rrset;
+       key.node.key = &key;
+       key.name = qinfo->qname;
+       key.namelen = qinfo->qname_len;
+       key.namelabs = dname_count_labels(qinfo->qname);
+       ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+       if(ld == NULL) {
+               verbose(VERB_ALGO, "rpz: qname after cname: name not found");
+               return NULL;
+       }
+       rrset = local_data_find_type(ld, qinfo->qtype, 1);
+       if(rrset == NULL) {
+               verbose(VERB_ALGO, "rpz: qname after cname: type not found");
+               return NULL;
+       }
+       return rpz_synthesize_localdata_from_rrset(r, ms, qinfo, rrset, az);
+}
+
+static int
+rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r,
+       struct local_zone* z, enum localzone_type lzt, struct query_info* qinfo,
+       struct edns_data* edns, sldns_buffer* buf, struct regional* temp,
+       struct comm_reply* repinfo, struct ub_server_stats* stats)
+{
+       struct local_data* ld = NULL;
+       int ret = 0;
        if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
-               qinfo->local_alias =
-                       regional_alloc_zero(temp, sizeof(struct local_rrset));
-               if(!qinfo->local_alias) {
-                       lock_rw_unlock(&z->lock);
-                       lock_rw_unlock(&a->lock);
+               qinfo->local_alias = regional_alloc_zero(temp, sizeof(struct local_rrset));
+               if(qinfo->local_alias == NULL) {
                        return 0; /* out of memory */
                }
-               qinfo->local_alias->rrset =
-                       regional_alloc_init(temp, r->cname_override,
-                               sizeof(*r->cname_override));
-               if(!qinfo->local_alias->rrset) {
-                       lock_rw_unlock(&z->lock);
-                       lock_rw_unlock(&a->lock);
+               qinfo->local_alias->rrset = regional_alloc_init(temp, r->cname_override,
+                                                               sizeof(*r->cname_override));
+               if(qinfo->local_alias->rrset == NULL) {
                        return 0; /* out of memory */
                }
                qinfo->local_alias->rrset->rk.dname = qinfo->qname;
                qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
-               if(r->log)
-                       log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION, 
-                               qinfo, repinfo, r->log_name);
+               if(r->log) {
+                       log_rpz_apply("qname", z->name, NULL, RPZ_CNAME_OVERRIDE_ACTION,
+                                     qinfo, repinfo, NULL, r->log_name);
+               }
                stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
-               lock_rw_unlock(&z->lock);
-               lock_rw_unlock(&a->lock);
                return 0;
        }
 
        if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
                edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
                &ld, lzt, -1, NULL, 0, NULL, 0)) {
-               if(r->log)
-                       log_rpz_apply(z->name,
+               if(r->log) {
+                       log_rpz_apply("qname", z->name, NULL,
                                localzone_type_to_rpz_action(lzt), qinfo,
-                               repinfo, r->log_name);
+                               repinfo, NULL, r->log_name);
+               }
                stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
-               lock_rw_unlock(&z->lock);
-               lock_rw_unlock(&a->lock);
                return !qinfo->local_alias;
        }
 
        ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
                0 /* no local data used */, lzt);
-       if(r->log)
-               log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
-                       qinfo, repinfo, r->log_name);
+       if(r->signal_nxdomain_ra && LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
+               == LDNS_RCODE_NXDOMAIN)
+               LDNS_RA_CLR(sldns_buffer_begin(buf));
+       if(r->log) {
+               log_rpz_apply("qname", z->name, NULL, localzone_type_to_rpz_action(lzt),
+                             qinfo, repinfo, NULL, r->log_name);
+       }
        stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
+       return ret;
+}
+
+static struct clientip_synthesized_rr*
+rpz_delegation_point_ipbased_trigger_lookup(struct rpz* rpz, struct iter_qstate* is)
+{
+       struct delegpt_addr* cursor;
+       struct clientip_synthesized_rr* action = NULL;
+       if(is->dp == NULL) { return NULL; }
+       for(cursor = is->dp->target_list;
+           cursor != NULL;
+           cursor = cursor->next_target) {
+               if(cursor->bogus) { continue; }
+               action = rpz_ipbased_trigger_lookup(rpz->ns_set, &cursor->addr,
+                                                   cursor->addrlen, "nsip");
+               if(action != NULL) { return action; }
+       }
+       return NULL;
+}
+
+static struct dns_msg*
+rpz_apply_nsip_trigger(struct module_qstate* ms, struct rpz* r,
+       struct clientip_synthesized_rr* raddr, struct auth_zone* az)
+{
+       enum rpz_action action = raddr->action;
+       struct dns_msg* ret = NULL;
+
+       if(r->action_override != RPZ_NO_OVERRIDE_ACTION) {
+               verbose(VERB_ALGO, "rpz: using override action=%s (replaces=%s)",
+                       rpz_action_to_string(r->action_override), rpz_action_to_string(action));
+               action = r->action_override;
+       }
+
+       if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL) {
+               verbose(VERB_ALGO, "rpz: bug: nsip local data action but no local data");
+               ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az);
+               goto done;
+       }
+
+       switch(action) {
+       case RPZ_NXDOMAIN_ACTION:
+               ret = rpz_synthesize_nxdomain(r, ms, &ms->qinfo, az);
+               break;
+       case RPZ_NODATA_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az);
+               break;
+       case RPZ_TCP_ONLY_ACTION:
+               /* basically a passthru here but the tcp-only will be
+                * honored before the query gets sent. */
+               ms->respip_action_info->action = respip_truncate;
+               ret = NULL;
+               break;
+       case RPZ_DROP_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az);
+               ms->is_drop = 1;
+               break;
+       case RPZ_LOCAL_DATA_ACTION:
+               ret = rpz_synthesize_nsip_localdata(r, ms, raddr, az);
+               if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); }
+               break;
+       case RPZ_PASSTHRU_ACTION:
+               ret = NULL;
+               break;
+       default:
+               verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
+                       rpz_action_to_string(action));
+               ret = NULL;
+       }
+
+done:
+       if(r->log)
+               log_rpz_apply("nsip", NULL, &raddr->node,
+                       action, &ms->qinfo, NULL, ms, r->log_name);
+       if(ms->env->worker)
+               ms->env->worker->stats.rpz_action[action]++;
+       lock_rw_unlock(&raddr->lock);
+       return ret;
+}
+
+static struct dns_msg*
+rpz_apply_nsdname_trigger(struct module_qstate* ms, struct rpz* r,
+       struct local_zone* z, struct matched_delegation_point const* match,
+       struct auth_zone* az)
+{
+       struct dns_msg* ret = NULL;
+       enum rpz_action action = localzone_type_to_rpz_action(z->type);
+
+       if(r->action_override != RPZ_NO_OVERRIDE_ACTION) {
+               verbose(VERB_ALGO, "rpz: using override action=%s (replaces=%s)",
+                       rpz_action_to_string(r->action_override), rpz_action_to_string(action));
+               action = r->action_override;
+       }
+
+       switch(action) {
+       case RPZ_NXDOMAIN_ACTION:
+               ret = rpz_synthesize_nxdomain(r, ms, &ms->qinfo, az);
+               break;
+       case RPZ_NODATA_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az);
+               break;
+       case RPZ_TCP_ONLY_ACTION:
+               /* basically a passthru here but the tcp-only will be
+                * honored before the query gets sent. */
+               ms->respip_action_info->action = respip_truncate;
+               ret = NULL;
+               break;
+       case RPZ_DROP_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az);
+               ms->is_drop = 1;
+               break;
+       case RPZ_LOCAL_DATA_ACTION:
+               ret = rpz_synthesize_nsdname_localdata(r, ms, z, match, az);
+               if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); }
+               break;
+       case RPZ_PASSTHRU_ACTION:
+               ret = NULL;
+               break;
+       default:
+               verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
+                       rpz_action_to_string(action));
+               ret = NULL;
+       }
+
+       if(r->log)
+               log_rpz_apply("nsdname", match->dname, NULL,
+                       action, &ms->qinfo, NULL, ms, r->log_name);
+       if(ms->env->worker)
+               ms->env->worker->stats.rpz_action[action]++;
+       lock_rw_unlock(&z->lock);
+       return ret;
+}
+
+static struct local_zone*
+rpz_delegation_point_zone_lookup(struct delegpt* dp, struct local_zones* zones,
+       uint16_t qclass,
+       /* output parameter */
+       struct matched_delegation_point* match)
+{
+       struct delegpt_ns* nameserver;
+       struct local_zone* z = NULL;
+
+       /* the rpz specs match the nameserver names (NS records), not the
+        * name of the delegation point itself, to the nsdname triggers */
+       for(nameserver = dp->nslist;
+           nameserver != NULL;
+           nameserver = nameserver->next) {
+               z = rpz_find_zone(zones, nameserver->name, nameserver->namelen,
+                                 qclass, 0, 0, 0);
+               if(z != NULL) {
+                       match->dname = nameserver->name;
+                       match->dname_len = nameserver->namelen;
+                       if(verbosity >= VERB_ALGO) {
+                               char nm[255+1], zn[255+1];
+                               dname_str(match->dname, nm);
+                               dname_str(z->name, zn);
+                               if(strcmp(nm, zn) != 0)
+                                       verbose(VERB_ALGO, "rpz: trigger nsdname %s on %s action=%s",
+                                               zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(z->type)));
+                               else
+                                       verbose(VERB_ALGO, "rpz: trigger nsdname %s action=%s",
+                                               nm, rpz_action_to_string(localzone_type_to_rpz_action(z->type)));
+                       }
+                       break;
+               }
+       }
+
+       return z;
+}
+
+struct dns_msg*
+rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate* is)
+{
+       struct auth_zones* az;
+       struct auth_zone* a;
+       struct clientip_synthesized_rr* raddr = NULL;
+       struct rpz* r = NULL;
+       struct local_zone* z = NULL;
+       struct matched_delegation_point match = {0};
+
+       if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; }
+
+       az = ms->env->auth_zones;
+
+       verbose(VERB_ALGO, "rpz: iterator module callback: have_rpz=%d", az->rpz_first != NULL);
+
+       lock_rw_rdlock(&az->rpz_lock);
+
+       /* precedence of RPZ works, loosely, like this:
+        * CNAMEs in order of the CNAME chain. rpzs in the order they are
+        * configured. In an RPZ: first client-IP addr, then QNAME, then
+        * response IP, then NSDNAME, then NSIP. Longest match first. Smallest
+        * one from a set. */
+       /* we use the precedence rules for the topics and triggers that
+        * are pertinent at this stage of the resolve processing */
+       for(a = az->rpz_first; a != NULL; a = a->rpz_az_next) {
+               lock_rw_rdlock(&a->lock);
+               r = a->rpz;
+               if(r->disabled) {
+                       lock_rw_unlock(&a->lock);
+                       continue;
+               }
+
+               /* the nsdname has precedence over the nsip triggers */
+               z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
+                                                    ms->qinfo.qclass, &match);
+               if(z != NULL) {
+                       lock_rw_unlock(&a->lock);
+                       break;
+               }
+
+               raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is);
+               if(raddr != NULL) {
+                       lock_rw_unlock(&a->lock);
+                       break;
+               }
+               lock_rw_unlock(&a->lock);
+       }
+
+       lock_rw_unlock(&az->rpz_lock);
+
+       if(raddr == NULL && z == NULL) { return NULL; }
+       else if(raddr != NULL) {
+               if(z) {
+                       lock_rw_unlock(&z->lock);
+               }
+               return rpz_apply_nsip_trigger(ms, r, raddr, a);
+       } else if(z != NULL) {
+               if(raddr) {
+                       lock_rw_unlock(&raddr->lock);
+               }
+               return rpz_apply_nsdname_trigger(ms, r, z, &match, a);
+       } else { return NULL; }
+}
+
+struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
+       struct iter_qstate* is)
+{
+       struct auth_zones* az;
+       struct auth_zone* a = NULL;
+       struct rpz* r = NULL;
+       struct local_zone* z = NULL;
+       enum localzone_type lzt;
+       struct dns_msg* ret = NULL;
+
+       if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; }
+       az = ms->env->auth_zones;
+
+       lock_rw_rdlock(&az->rpz_lock);
+
+       for(a = az->rpz_first; a; a = a->rpz_az_next) {
+               lock_rw_rdlock(&a->lock);
+               r = a->rpz;
+               if(r->disabled) {
+                       lock_rw_unlock(&a->lock);
+                       continue;
+               }
+               z = rpz_find_zone(r->local_zones, is->qchase.qname,
+                       is->qchase.qname_len, is->qchase.qclass, 0, 0, 0);
+               if(z && r->action_override == RPZ_DISABLED_ACTION) {
+                       if(r->log)
+                               log_rpz_apply("qname", z->name, NULL,
+                                       r->action_override,
+                                       &ms->qinfo, NULL, ms, r->log_name);
+                       if(ms->env->worker)
+                               ms->env->worker->stats.rpz_action[r->action_override]++;
+                       lock_rw_unlock(&z->lock);
+                       z = NULL;
+               }
+               if(z) {
+                       break;
+               }
+               /* not found in this auth_zone */
+               lock_rw_unlock(&a->lock);
+       }
+       lock_rw_unlock(&az->rpz_lock);
+
+       if(z == NULL)
+               return NULL;
+       if(r->action_override == RPZ_NO_OVERRIDE_ACTION) {
+               lzt = z->type;
+       } else {
+               lzt = rpz_action_to_localzone_type(r->action_override);
+       }
+
+       if(verbosity >= VERB_ALGO) {
+               char nm[255+1], zn[255+1];
+               dname_str(is->qchase.qname, nm);
+               dname_str(z->name, zn);
+               if(strcmp(zn, nm) != 0)
+                       verbose(VERB_ALGO, "rpz: qname trigger after cname %s on %s, with action=%s",
+                               zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt)));
+               else
+                       verbose(VERB_ALGO, "rpz: qname trigger after cname %s, with action=%s",
+                               nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt)));
+       }
+       switch(localzone_type_to_rpz_action(lzt)) {
+       case RPZ_NXDOMAIN_ACTION:
+               ret = rpz_synthesize_nxdomain(r, ms, &is->qchase, a);
+               break;
+       case RPZ_NODATA_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
+               break;
+       case RPZ_TCP_ONLY_ACTION:
+               /* basically a passthru here but the tcp-only will be
+                * honored before the query gets sent. */
+               ms->respip_action_info->action = respip_truncate;
+               ret = NULL;
+               break;
+       case RPZ_DROP_ACTION:
+               ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
+               ms->is_drop = 1;
+               break;
+       case RPZ_LOCAL_DATA_ACTION:
+               ret = rpz_synthesize_qname_localdata_msg(r, ms, &is->qchase, z, a);
+               if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); }
+               break;
+       case RPZ_PASSTHRU_ACTION:
+               ret = NULL;
+               break;
+       default:
+               verbose(VERB_ALGO, "rpz: qname trigger after cname: bug: unhandled or invalid action: '%s'",
+                       rpz_action_to_string(localzone_type_to_rpz_action(lzt)));
+               ret = NULL;
+       }
+       lock_rw_unlock(&z->lock);
+       lock_rw_unlock(&a->lock);
+       return ret;
+}
+
+static int
+rpz_apply_maybe_clientip_trigger(struct auth_zones* az, struct module_env* env,
+       struct query_info* qinfo, struct edns_data* edns, struct comm_reply* repinfo,
+       uint8_t* taglist, size_t taglen, struct ub_server_stats* stats,
+       sldns_buffer* buf, struct regional* temp,
+       /* output parameters */
+       struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out)
+{
+       int ret = 0;
+       enum rpz_action client_action;
+       struct clientip_synthesized_rr* node = rpz_resolve_client_action_and_zone(
+               az, qinfo, repinfo, taglist, taglen, stats, z_out, a_out, r_out);
+
+       client_action = ((node == NULL) ? RPZ_INVALID_ACTION : node->action);
+
+       if(*z_out == NULL || (client_action != RPZ_INVALID_ACTION &&
+                             client_action != RPZ_PASSTHRU_ACTION)) {
+               if(client_action == RPZ_PASSTHRU_ACTION
+                       || client_action == RPZ_INVALID_ACTION
+                       || (client_action == RPZ_TCP_ONLY_ACTION
+                               && !rpz_is_udp_query(repinfo))) {
+                       ret = 0;
+                       goto done;
+               }
+               stats->rpz_action[client_action]++;
+               if(client_action == RPZ_LOCAL_DATA_ACTION) {
+                       rpz_apply_clientip_localdata_action(node, env, qinfo,
+                               edns, repinfo, buf, temp, *a_out);
+               } else {
+                       if(*r_out && (*r_out)->log)
+                               log_rpz_apply(
+                                       (node?"clientip":"qname"),
+                                       ((*z_out)?(*z_out)->name:NULL),
+                                       (node?&node->node:NULL),
+                                       client_action, qinfo, repinfo, NULL,
+                                       (*r_out)->log_name);
+                       local_zones_zone_answer(*z_out /*likely NULL, no zone*/, env, qinfo, edns,
+                               repinfo, buf, temp, 0 /* no local data used */,
+                               rpz_action_to_localzone_type(client_action));
+                       if(*r_out && (*r_out)->signal_nxdomain_ra &&
+                               LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
+                               == LDNS_RCODE_NXDOMAIN)
+                               LDNS_RA_CLR(sldns_buffer_begin(buf));
+               }
+               ret = 1;
+               goto done;
+       }
+       ret = -1;
+done:
+       if(node != NULL) {
+               lock_rw_unlock(&node->lock);
+       }
+       return ret;
+}
+
+int
+rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
+       struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
+       struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
+       size_t taglen, struct ub_server_stats* stats)
+{
+       struct rpz* r = NULL;
+       struct auth_zone* a = NULL;
+       struct local_zone* z = NULL;
+       int ret;
+       enum localzone_type lzt;
+
+       int clientip_trigger = rpz_apply_maybe_clientip_trigger(az, env, qinfo,
+               edns, repinfo, taglist, taglen, stats, buf, temp, &z, &a, &r);
+       if(clientip_trigger >= 0) {
+               if(a) {
+                       lock_rw_unlock(&a->lock);
+               }
+               if(z) {
+                       lock_rw_unlock(&z->lock);
+               }
+               return clientip_trigger;
+       }
+
+       if(z == NULL) {
+               if(a) {
+                       lock_rw_unlock(&a->lock);
+               }
+               return 0;
+       }
+
+       log_assert(r);
+
+       if(r->action_override == RPZ_NO_OVERRIDE_ACTION) {
+               lzt = z->type;
+       } else {
+               lzt = rpz_action_to_localzone_type(r->action_override);
+       }
+
+       if(verbosity >= VERB_ALGO) {
+               char nm[255+1], zn[255+1];
+               dname_str(qinfo->qname, nm);
+               dname_str(z->name, zn);
+               if(strcmp(zn, nm) != 0)
+                       verbose(VERB_ALGO, "rpz: qname trigger %s on %s with action=%s",
+                               zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt)));
+               else
+                       verbose(VERB_ALGO, "rpz: qname trigger %s with action=%s",
+                               nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt)));
+       }
+
+       ret = rpz_synthesize_qname_localdata(env, r, z, lzt, qinfo, edns, buf, temp,
+                                            repinfo, stats);
+
        lock_rw_unlock(&z->lock);
        lock_rw_unlock(&a->lock);
 

diff --git a/sbin/unwind/libunbound/services/rpz.h b/sbin/unwind/libunbound/services/rpz.h
index d5996a6..c29d30d 100644 (file)
--- a/sbin/unwind/libunbound/services/rpz.h
+++ b/sbin/unwind/libunbound/services/rpz.h
@@ -50,6 +50,7 @@
 #include "sldns/sbuffer.h"
 #include "daemon/stats.h"
 #include "respip/respip.h"
+struct iter_qstate;
 
 /**
  * RPZ triggers, only the QNAME trigger is currently supported in Unbound.
@@ -83,6 +84,27 @@ enum rpz_action {
        RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/
 };
 
+struct clientip_synthesized_rrset{
+       struct regional* region;
+       struct rbtree_type entries;
+       lock_rw_type lock;      /* lock on the respip tree */
+};
+
+struct clientip_synthesized_rr {
+       /** node in address tree */
+       struct addr_tree_node node;
+       /** lock on the node item */
+       lock_rw_type lock;
+       /** tag bitlist */
+       uint8_t* taglist;
+       /** length of the taglist (in bytes) */
+       size_t taglen;
+       /** action for this address span */
+       enum rpz_action action;
+       /** "local data" for this node */
+       struct local_rrset* data;
+};
+
 /**
  * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a
  * linked list to keep configuration order. Iterating or changing the linked
@@ -92,12 +114,17 @@ enum rpz_action {
 struct rpz {
        struct local_zones* local_zones;
        struct respip_set* respip_set;
+       struct clientip_synthesized_rrset* client_set;
+       struct clientip_synthesized_rrset* ns_set;
+       struct local_zones* nsdname_zones;
        uint8_t* taglist;
        size_t taglistlen;
        enum rpz_action action_override;
        struct ub_packed_rrset_key* cname_override;
        int log;
        char* log_name;
+       /** signal NXDOMAIN blocked with unset RA flag */
+       int signal_nxdomain_ra;
        struct regional* region;
        int disabled;
 };
@@ -147,15 +174,38 @@ void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
  * @param temp: scratchpad
  * @param repinfo: reply info
  * @param taglist: taglist to lookup.
- * @param taglen: lenth of taglist.
+ * @param taglen: length of taglist.
  * @param stats: worker stats struct
  * @return: 1 if client answer is ready, 0 to continue resolving
  */
-int rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
+int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
        struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
        struct regional* temp, struct comm_reply* repinfo,
        uint8_t* taglist, size_t taglen, struct ub_server_stats* stats);
 
+/**
+ * Callback to process when the iterator module is about to send queries.
+ * Checks for nsip and nsdname triggers.
+ * @param qstate: the query state.
+ * @param iq: iterator module query state.
+ * @return NULL if nothing is done. Or a new message with the contents from
+ *     the rpz, based on the delegation point. It is allocated in the
+ *     qstate region.
+ */
+struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate,
+       struct iter_qstate* iq);
+
+/**
+ * Callback to process when the iterator module has followed a cname.
+ * There can be a qname trigger for the new query name.
+ * @param qstate: the query state.
+ * @param iq: iterator module query state.
+ * @return NULL if nothing is done. Or a new message with the contents from
+ *     the rpz, based on the iq.qchase. It is allocated in the qstate region.
+ */
+struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate,
+       struct iter_qstate* iq);
+
 /**
  * Delete RPZ
  * @param r: RPZ struct to delete
@@ -186,7 +236,7 @@ enum rpz_action
 respip_action_to_rpz_action(enum respip_action a);
 
 /**
- * Prepare RPZ after procesing feed content.
+ * Prepare RPZ after processing feed content.
  * @param r: RPZ to use
  */
 void rpz_finish_config(struct rpz* r);

diff --git a/sbin/unwind/libunbound/sldns/keyraw.c b/sbin/unwind/libunbound/sldns/keyraw.c
index a40f1e8..befe1f7 100644 (file)
--- a/sbin/unwind/libunbound/sldns/keyraw.c
+++ b/sbin/unwind/libunbound/sldns/keyraw.c
@@ -250,7 +250,8 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
        if(!(dsa = DSA_new())) {
                return NULL;
        }
-#if OPENSSL_VERSION_NUMBER < 0x10100000
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || \
+        (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f)
 #ifndef S_SPLINT_S
        dsa->p = P;
        dsa->q = Q;
@@ -428,7 +429,8 @@ sldns_key_buf2rsa_raw(unsigned char* key, size_t len)
                BN_free(modulus);
                return NULL;
        }
-#if OPENSSL_VERSION_NUMBER < 0x10100000
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || \
+        (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f)
 #ifndef S_SPLINT_S
        rsa->n = modulus;
        rsa->e = exponent;

diff --git a/sbin/unwind/libunbound/sldns/parseutil.h b/sbin/unwind/libunbound/sldns/parseutil.h
index 74d7c72..208fd2f 100644 (file)
--- a/sbin/unwind/libunbound/sldns/parseutil.h
+++ b/sbin/unwind/libunbound/sldns/parseutil.h
@@ -58,7 +58,7 @@ time_t sldns_mktime_from_utc(const struct tm *tm);
  * The function interprets time as the number of seconds since epoch
  * with respect to now using serial arithmetics (rfc1982).
  * That number of seconds is then converted to broken-out time information.
- * This is especially usefull when converting the inception and expiration
+ * This is especially useful when converting the inception and expiration
  * fields of RRSIG records.
  *
  * \param[in] time number of seconds since epoch (midnight, January 1st, 1970)

diff --git a/sbin/unwind/libunbound/sldns/str2wire.c b/sbin/unwind/libunbound/sldns/str2wire.c
index 293abf7..d2cefae 100644 (file)
--- a/sbin/unwind/libunbound/sldns/str2wire.c
+++ b/sbin/unwind/libunbound/sldns/str2wire.c
@@ -25,8 +25,10 @@
 #include <netdb.h>
 #endif
 
+/** bits for the offset */
+#define RET_OFFSET_MASK (((unsigned)(~LDNS_WIREPARSE_MASK))>>LDNS_WIREPARSE_SHIFT)
 /** return an error */
-#define RET_ERR(e, off) ((int)((e)|((off)<<LDNS_WIREPARSE_SHIFT)))
+#define RET_ERR(e, off) ((int)(((e)&LDNS_WIREPARSE_MASK)|(((off)&RET_OFFSET_MASK)<<LDNS_WIREPARSE_SHIFT)))
 /** Move parse error but keep its ID */
 #define RET_ERR_SHIFT(e, move) RET_ERR(LDNS_WIREPARSE_ERROR(e), LDNS_WIREPARSE_OFFSET(e)+(move));
 
@@ -543,9 +545,10 @@ sldns_parse_rdf_token(sldns_buffer* strbuf, char* token, size_t token_len,
 {
        size_t slen;
 
-       /* skip spaces */
+       /* skip spaces and tabs */
        while(sldns_buffer_remaining(strbuf) > 0 && !*quoted &&
-               *(sldns_buffer_current(strbuf)) == ' ') {
+               (*(sldns_buffer_current(strbuf)) == ' ' ||
+               *(sldns_buffer_current(strbuf)) == '\t')) {
                sldns_buffer_skip(strbuf, 1);
        }
 
@@ -601,7 +604,10 @@ sldns_affix_token(sldns_buffer* strbuf, char* token, size_t* token_len,
        size_t addstrlen = 0;
 
        /* add space */
-       if(addlen < 1) return 0;
+       /* when addlen < 2, the token buffer is full considering the NULL byte
+        * from strlen and will lead to buffer overflow with the second
+        * assignement below. */
+       if(addlen < 2) return 0;
        token[*token_strlen] = ' ';
        token[++(*token_strlen)] = 0;
 
@@ -1427,7 +1433,7 @@ sldns_str2wire_svcbparam_parse_next_unescaped_comma(const char *val)
 }
 
 /* The source is already properly unescaped, this double unescaping is purely to allow for
- * comma's in comma seperated alpn lists.
+ * comma's in comma separated alpn lists.
  * 
  * In draft-ietf-dnsop-svcb-https-06 Section 7:
  * To enable simpler parsing, this SvcParamValue MUST NOT contain escape sequences.

diff --git a/sbin/unwind/libunbound/sldns/str2wire.h b/sbin/unwind/libunbound/sldns/str2wire.h
index 0c31649..baee423 100644 (file)
--- a/sbin/unwind/libunbound/sldns/str2wire.h
+++ b/sbin/unwind/libunbound/sldns/str2wire.h
@@ -187,7 +187,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len);
 #define LDNS_WIREPARSE_MASK 0x0fff
 #define LDNS_WIREPARSE_SHIFT 12
 #define LDNS_WIREPARSE_ERROR(e) ((e)&LDNS_WIREPARSE_MASK)
-#define LDNS_WIREPARSE_OFFSET(e) (((e)&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT)
+#define LDNS_WIREPARSE_OFFSET(e) ((((unsigned)(e))&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT)
 /* use lookuptable to get error string, sldns_wireparse_errors */
 #define LDNS_WIREPARSE_ERR_OK 0
 #define LDNS_WIREPARSE_ERR_GENERAL 342

diff --git a/sbin/unwind/libunbound/sldns/wire2str.c b/sbin/unwind/libunbound/sldns/wire2str.c
index 6a177ec..b70efe2 100644 (file)
--- a/sbin/unwind/libunbound/sldns/wire2str.c
+++ b/sbin/unwind/libunbound/sldns/wire2str.c
@@ -817,6 +817,7 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
        unsigned i, counter=0;
        unsigned maxcompr = MAX_COMPRESS_PTRS; /* loop detection, max compr ptrs */
        int in_buf = 1;
+       size_t dname_len = 0;
        if(comprloop) {
                if(*comprloop != 0)
                        maxcompr = 30; /* for like ipv6 reverse name, per label */
@@ -872,6 +873,16 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
                        labellen = (uint8_t)*dlen;
                else if(!in_buf && pos+(size_t)labellen > pkt+pktlen)
                        labellen = (uint8_t)(pkt + pktlen - pos);
+               dname_len += ((size_t)labellen)+1;
+               if(dname_len > LDNS_MAX_DOMAINLEN) {
+                       /* dname_len counts the uncompressed length we have
+                        * seen so far, and the domain name has become too
+                        * long, prevent the loop from printing overly long
+                        * content. */
+                       w += sldns_str_print(s, slen,
+                               "ErrorDomainNameTooLong");
+                       return w;
+               }
                for(i=0; i<(unsigned)labellen; i++) {
                        w += dname_char_print(s, slen, *pos++);
                }

diff --git a/sbin/unwind/libunbound/sldns/wire2str.h b/sbin/unwind/libunbound/sldns/wire2str.h
index b1ad459..548c663 100644 (file)
--- a/sbin/unwind/libunbound/sldns/wire2str.h
+++ b/sbin/unwind/libunbound/sldns/wire2str.h
@@ -59,7 +59,7 @@ char* sldns_wire2str_pkt(uint8_t* data, size_t len);
 char* sldns_wire2str_rr(uint8_t* rr, size_t len);
 
 /**
- * Conver wire dname to a string.
+ * Convert wire dname to a string.
  * @param dname: the dname in uncompressed wireformat.
  * @param dname_len: length of the dname.
  * @return string or NULL on failure.

diff --git a/sbin/unwind/libunbound/util/config_file.c b/sbin/unwind/libunbound/util/config_file.c
index 4725e7d..15a090c 100644 (file)
--- a/sbin/unwind/libunbound/util/config_file.c
+++ b/sbin/unwind/libunbound/util/config_file.c
@@ -260,7 +260,7 @@ config_create(void)
        cfg->val_log_level = 0;
        cfg->val_log_squelch = 0;
        cfg->val_permissive_mode = 0;
-       cfg->aggressive_nsec = 0;
+       cfg->aggressive_nsec = 1;
        cfg->ignore_cd = 0;
        cfg->serve_expired = 0;
        cfg->serve_expired_ttl = 0;
@@ -330,6 +330,9 @@ config_create(void)
        cfg->ratelimit_below_domain = NULL;
        cfg->ip_ratelimit_factor = 10;
        cfg->ratelimit_factor = 10;
+       cfg->ip_ratelimit_backoff = 0;
+       cfg->ratelimit_backoff = 0;
+       cfg->outbound_msg_retry = 5;
        cfg->qname_minimisation = 1;
        cfg->qname_minimisation_strict = 0;
        cfg->shm_enable = 0;
@@ -530,11 +533,17 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive)
        else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout)
        else S_YNO("ssl-upstream:", ssl_upstream)
+       else S_YNO("tls-upstream:", ssl_upstream)
        else S_STR("ssl-service-key:", ssl_service_key)
+       else S_STR("tls-service-key:", ssl_service_key)
        else S_STR("ssl-service-pem:", ssl_service_pem)
+       else S_STR("tls-service-pem:", ssl_service_pem)
        else S_NUMBER_NONZERO("ssl-port:", ssl_port)
+       else S_NUMBER_NONZERO("tls-port:", ssl_port)
+       else S_STR("ssl-cert-bundle:", tls_cert_bundle)
        else S_STR("tls-cert-bundle:", tls_cert_bundle)
        else S_YNO("tls-win-cert:", tls_win_cert)
+       else S_STRLIST("additional-ssl-port:", tls_additional_port)
        else S_STRLIST("additional-tls-port:", tls_additional_port)
        else S_STRLIST("tls-additional-ports:", tls_additional_port)
        else S_STRLIST("tls-additional-port:", tls_additional_port)
@@ -752,6 +761,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_POW2("ratelimit-slabs:", ratelimit_slabs)
        else S_NUMBER_OR_ZERO("ip-ratelimit-factor:", ip_ratelimit_factor)
        else S_NUMBER_OR_ZERO("ratelimit-factor:", ratelimit_factor)
+       else S_YNO("ip-ratelimit-backoff:", ip_ratelimit_backoff)
+       else S_YNO("ratelimit-backoff:", ratelimit_backoff)
+       else S_NUMBER_NONZERO("outbound-msg-retry:", outbound_msg_retry)
        else S_SIZET_NONZERO("fast-server-num:", fast_server_num)
        else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil)
        else S_YNO("qname-minimisation:", qname_minimisation)
@@ -1027,11 +1039,19 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive)
        else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout)
        else O_YNO(opt, "ssl-upstream", ssl_upstream)
+       else O_YNO(opt, "tls-upstream", ssl_upstream)
        else O_STR(opt, "ssl-service-key", ssl_service_key)
+       else O_STR(opt, "tls-service-key", ssl_service_key)
        else O_STR(opt, "ssl-service-pem", ssl_service_pem)
+       else O_STR(opt, "tls-service-pem", ssl_service_pem)
        else O_DEC(opt, "ssl-port", ssl_port)
+       else O_DEC(opt, "tls-port", ssl_port)
+       else O_STR(opt, "ssl-cert-bundle", tls_cert_bundle)
        else O_STR(opt, "tls-cert-bundle", tls_cert_bundle)
        else O_YNO(opt, "tls-win-cert", tls_win_cert)
+       else O_LST(opt, "additional-ssl-port", tls_additional_port)
+       else O_LST(opt, "additional-tls-port", tls_additional_port)
+       else O_LST(opt, "tls-additional-ports", tls_additional_port)
        else O_LST(opt, "tls-additional-port", tls_additional_port)
        else O_LST(opt, "tls-session-ticket-keys", tls_session_ticket_keys.first)
        else O_STR(opt, "tls-ciphers", tls_ciphers)
@@ -1195,6 +1215,9 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_LS2(opt, "ratelimit-below-domain", ratelimit_below_domain)
        else O_DEC(opt, "ip-ratelimit-factor", ip_ratelimit_factor)
        else O_DEC(opt, "ratelimit-factor", ratelimit_factor)
+       else O_YNO(opt, "ip-ratelimit-backoff", ip_ratelimit_backoff)
+       else O_YNO(opt, "ratelimit-backoff", ratelimit_backoff)
+       else O_UNS(opt, "outbound-msg-retry", outbound_msg_retry)
        else O_DEC(opt, "fast-server-num", fast_server_num)
        else O_DEC(opt, "fast-server-permil", fast_server_permil)
        else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min)

diff --git a/sbin/unwind/libunbound/util/config_file.h b/sbin/unwind/libunbound/util/config_file.h
index aed6812..c7c9a0a 100644 (file)
--- a/sbin/unwind/libunbound/util/config_file.h
+++ b/sbin/unwind/libunbound/util/config_file.h
@@ -565,6 +565,10 @@ struct config_file {
        size_t ip_ratelimit_size;
        /** ip_ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
        int ip_ratelimit_factor;
+       /** ratelimit backoff, when on, if the limit is reached it is
+        *  considered an attack and it backs off until 'demand' decreases over
+        *  the RATE_WINDOW. */
+       int ip_ratelimit_backoff;
 
        /** ratelimit for domains. 0 is off, otherwise qps (unless overridden) */
        int ratelimit;
@@ -578,6 +582,13 @@ struct config_file {
        struct config_str2list* ratelimit_below_domain;
        /** ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
        int ratelimit_factor;
+       /** ratelimit backoff, when on, if the limit is reached it is
+        *  considered an attack and it backs off until 'demand' decreases over
+        *  the RATE_WINDOW. */
+       int ratelimit_backoff;
+
+       /** number of retries on outgoing queries */
+       int outbound_msg_retry;
        /** minimise outgoing QNAME and hide original QTYPE if possible */
        int qname_minimisation;
        /** minimise QNAME in strict mode, minimise according to RFC.
@@ -697,6 +708,8 @@ struct config_stub {
        int isprime;
        /** if forward-first is set (failover to without if fails) */
        int isfirst;
+       /** use tcp for queries to this stub */
+       int tcp_upstream;
        /** use SSL for queries to this stub */
        int ssl_upstream;
        /*** no cache */
@@ -741,6 +754,8 @@ struct config_auth {
        /** Always reply with this CNAME target if the cname override action is
         * used */
        char* rpz_cname;
+       /** signal nxdomain block with unset RA */
+       int rpz_signal_nxdomain_ra;
        /** Check ZONEMD records for this zone */
        int zonemd_check;
        /** Reject absence of ZONEMD records, zone must have one */
@@ -1106,7 +1121,7 @@ int cfg_count_numbers(const char* str);
 int cfg_parse_memsize(const char* str, size_t* res);
 
 /**
- * Parse nsid from string into binary nsid. nsid is either a hexidecimal
+ * Parse nsid from string into binary nsid. nsid is either a hexadecimal
  * string or an ascii string prepended with ascii_ in which case the
  * characters after ascii_ are simply copied.
  * @param str: the string to parse.

diff --git a/sbin/unwind/libunbound/util/configlexer.c b/sbin/unwind/libunbound/util/configlexer.c
index 186860b..ed17129 100644 (file)
--- a/sbin/unwind/libunbound/util/configlexer.c
+++ b/sbin/unwind/libunbound/util/configlexer.c
@@ -5,7 +5,7 @@
 
 #define  YY_INT_ALIGNED short int
 
-/*     $OpenBSD: configlexer.c,v 1.11 2021/08/14 07:32:46 florian Exp $        */
+/*     $OpenBSD: configlexer.c,v 1.12 2022/03/01 18:34:22 florian Exp $        */
 
 /* A lexical scanner generated by flex */
 
@@ -27,7 +27,7 @@
 
 /* end standard C headers. */
 
-/* $OpenBSD: configlexer.c,v 1.11 2021/08/14 07:32:46 florian Exp $ */
+/* $OpenBSD: configlexer.c,v 1.12 2022/03/01 18:34:22 florian Exp $ */
 
 /* flex integer type definitions */
 
@@ -368,8 +368,8 @@ static void yy_fatal_error (yyconst char msg[]  );
        *yy_cp = '\0'; \
        (yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 352
-#define YY_END_OF_BUFFER 353
+#define YY_NUM_RULES 358
+#define YY_END_OF_BUFFER 359
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -377,391 +377,399 @@ struct yy_trans_info
        flex_int32_t yy_verify;
        flex_int32_t yy_nxt;
        };
-static yyconst flex_int16_t yy_accept[3484] =
+static yyconst flex_int16_t yy_accept[3558] =
     {   0,
-        1,    1,  326,  326,  330,  330,  334,  334,  338,  338,
-        1,    1,  342,  342,  346,  346,  353,  350,    1,  324,
-      324,  351,    2,  351,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  326,  327,  327,  328,
-      351,  330,  331,  331,  332,  351,  337,  334,  335,  335,
-      336,  351,  338,  339,  339,  340,  351,  349,  325,    2,
-      329,  351,  349,  345,  342,  343,  343,  344,  351,  346,
-      347,  347,  348,  351,  350,    0,    1,    2,    2,    2,
-        2,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  326,
-        0,  330,    0,  337,    0,  334,  338,    0,  349,    0,
-        2,    2,  349,  345,    0,  342,  346,    0,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  349,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  128,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  137,
-      350,  350,  350,  350,  350,  350,  350,  349,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  112,  350,  323,
-      350,  350,  350,  350,  350,  350,  350,    8,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  129,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  142,  350,  350,  349,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  316,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  349,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   67,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  248,  350,   14,   15,  350,   19,   18,  350,
-      350,  232,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  135,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      230,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-        3,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  349,
-      350,  350,  350,  350,  350,  350,  350,  310,  350,  350,
-      309,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      333,  350,  350,  350,  350,  350,  350,  350,  350,   66,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,   70,  350,  279,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  317,  318,
-      350,  350,  350,  350,  350,  350,  350,   71,  350,  350,
-      136,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  132,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  219,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   21,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  162,
-      350,  350,  350,  350,  350,  349,  333,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  110,  350,
-      350,  350,  350,  350,  350,  350,  287,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  188,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  161,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  109,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,   35,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,   36,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,   68,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      134,  350,  350,  350,  349,  350,  350,  350,  350,  350,
-      127,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,   69,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  252,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  189,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,   57,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  270,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   61,  350,   62,
-
-      350,  350,  350,  350,  350,  113,  350,  114,  350,  350,
-      350,  350,  111,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,    7,  350,  350,  350,  350,
-      349,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  241,
-      350,  350,  350,  350,  165,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  253,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-       48,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-       58,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  211,  350,  210,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   16,   17,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,   72,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  218,  350,  350,  350,  350,
-      350,  350,  116,  350,  115,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  202,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  143,
-      350,  350,  350,  349,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  104,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,   92,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      231,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,   97,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,   65,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  205,  206,  350,  350,  350,  281,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,    6,  350,  350,  350,  350,  350,  350,  300,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  285,  350,  350,  350,
-      350,  350,  350,  311,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   45,  350,  350,
-      350,  350,   47,  350,  350,  350,   93,  350,  350,  350,
-      350,  350,   55,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  349,  350,  198,  350,  350,  350,
-      138,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  223,  350,  199,  350,  350,  350,  238,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,   56,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  140,
-      121,  350,  122,  350,  350,  350,  120,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  158,  350,  350,   53,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  269,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  200,  350,  350,
-      350,  350,  350,  203,  350,  209,  350,  350,  350,  350,
-      350,  350,  237,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  108,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  133,  350,
-      350,  350,  350,  350,  350,  350,   63,  350,  350,  350,
-       29,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,   20,  350,  350,  350,  350,  350,  350,   30,
-       39,  350,  170,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  196,  350,  350,
-      349,  350,  350,  350,  350,  350,  350,   80,   82,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  289,  350,  350,  350,  350,  249,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      123,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  157,  350,   49,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  304,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  164,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  298,
-
-      350,  350,  350,  229,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  314,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  182,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  117,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  177,  350,  190,
-      350,  350,  350,  350,  350,  350,  350,  349,  350,  146,
-      350,  350,  350,  350,  350,  103,  350,  350,  350,  350,
-      221,  350,  350,  350,  350,  350,  350,  239,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  261,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  139,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  181,  350,  350,  350,  350,  350,  350,   83,
-      350,   84,  350,  350,  350,  350,  350,   64,  307,  350,
-      350,  350,  350,  350,   91,  191,  350,  212,  350,  242,
-      350,  350,  204,  282,  350,  350,  350,  350,  350,  350,
-       76,  350,  193,  350,  350,  350,  350,  350,    9,  350,
-      350,  350,  350,  350,  107,  350,  350,  350,  350,  274,
-      350,  350,  350,  350,  220,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  349,  350,  350,  350,
-      350,  180,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  166,  350,  288,  350,  350,  350,  350,  350,
-      260,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  233,  350,  350,  350,  350,  350,  280,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  163,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  308,  350,  192,  350,  350,  350,  350,  350,  350,
-      350,  350,   75,   77,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  106,  350,  350,  350,  350,  272,  350,
-      350,  350,  350,  284,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  225,   37,   31,   33,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,   38,  350,   32,   34,  350,  350,  350,  350,  350,
-      350,  350,  350,  102,  350,  176,  350,  350,  350,  350,
-
-      350,  350,  350,  349,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  227,  224,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,   74,  350,  350,  350,  141,
-      350,  124,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  159,   50,  350,  350,  350,  341,   13,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  302,  350,
-      305,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,   12,  350,  350,   22,  350,  350,  350,  350,
-      350,  278,  350,  350,  350,  350,  286,  350,  350,  350,
-
-       78,  350,  235,  350,  350,  350,  350,  350,  226,  350,
-      350,   73,  350,  350,  350,  350,  350,   23,  350,  350,
-       46,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  175,  174,  350,  350,  341,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  228,  222,  350,
-      240,  350,  350,  290,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,   85,  350,  350,
-      350,  350,  273,  350,  350,  350,  350,  208,  350,  350,
-
-      350,  350,  350,  234,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  312,  313,  172,  350,  350,
-       79,  350,  350,  350,  350,  183,  350,  350,  350,  118,
-      119,  350,  350,  350,   25,  350,  350,  167,  350,  169,
-      350,  213,  350,  350,  350,  350,  173,  350,  350,  350,
-      350,  243,  350,  350,  350,  350,  350,  350,  350,  148,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  251,  350,  350,  350,  350,  350,  350,  350,
-      321,  350,   27,  350,  283,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-
-       89,  214,  350,  350,  271,  350,  306,  350,  207,  350,
-      350,  350,  350,  350,   59,  350,  350,  350,  350,  350,
-      350,    4,  350,  350,  350,  350,  131,  147,  350,  350,
-      350,  187,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      246,   40,   41,  350,  350,  350,  350,  350,  350,  350,
-      291,  350,  350,  350,  350,  350,  350,  350,  259,  350,
-      350,  350,  350,  350,  350,  350,  350,  217,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,   88,  350,   60,  277,  350,  247,  350,  350,  350,
-
-      350,  350,   11,  350,  350,  350,  350,  350,  350,  350,
-      350,  130,  350,  350,  350,  350,  215,   94,  350,  350,
-       43,  350,  350,  350,  350,  350,  350,  350,  350,  179,
-      350,  350,  350,  350,  350,  350,  350,  150,  350,  350,
-      350,  350,  250,  350,  350,  350,  350,  350,  258,  350,
-      350,  350,  350,  144,  350,  350,  350,  125,  126,  350,
-      350,  350,   96,  100,   95,  160,  350,  350,  350,  350,
-       86,  350,  350,  350,  350,  350,  350,   10,  350,  350,
-      350,  350,  350,  275,  315,  350,  350,  350,  350,  350,
-      320,   42,  350,  350,  350,  350,  350,  178,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  101,   99,  350,   54,  350,  350,   87,
-      303,  350,  350,  350,  350,   24,  350,  350,  350,  350,
-      350,  201,  350,  350,  350,  350,  350,  216,  350,  350,
-      350,  350,  350,  350,  350,  350,  197,  350,  350,  168,
-       81,  350,  350,  350,  350,  350,  292,  350,  350,  350,
-      350,  350,  350,  350,  255,  350,  350,  254,  145,  350,
-      350,   98,   51,  350,  151,  152,  155,  156,  153,  154,
-       90,  301,  350,  350,  276,  350,  350,  350,   26,  350,
-
-      171,  350,  350,  350,  350,  195,  350,  245,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  185,  184,
-       44,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  299,  350,  350,  350,  350,  105,  350,
-      244,  350,  268,  296,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  322,  350,   52,    5,  350,
-      350,  236,  350,  350,  297,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  256,   28,  350,  350,  350,  350,
-
-      350,  350,  350,  350,  350,  350,  350,  350,  257,  350,
-      350,  350,  149,  350,  350,  350,  350,  350,  350,  350,
-      350,  186,  350,  194,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  293,  350,  350,  350,  350,  350,  350,
-      350,  350,  350,  350,  350,  350,  350,  350,  350,  350,
-      350,  319,  350,  350,  264,  350,  350,  350,  350,  350,
-      294,  350,  350,  350,  350,  350,  350,  295,  350,  350,
-      350,  262,  350,  265,  266,  350,  350,  350,  350,  350,
-      263,  267,    0
+        1,    1,  332,  332,  336,  336,  340,  340,  344,  344,
+        1,    1,  348,  348,  352,  352,  359,  356,    1,  330,
+      330,  357,    2,  357,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  332,  333,  333,  334,
+      357,  336,  337,  337,  338,  357,  343,  340,  341,  341,
+      342,  357,  344,  345,  345,  346,  357,  355,  331,    2,
+      335,  357,  355,  351,  348,  349,  349,  350,  357,  352,
+      353,  353,  354,  357,  356,    0,    1,    2,    2,    2,
+        2,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  332,
+        0,  336,    0,  343,    0,  340,  344,    0,  355,    0,
+        2,    2,  355,  351,    0,  348,  352,    0,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  355,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  130,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      140,  356,  356,  356,  356,  356,  356,  356,  355,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  112,  356,
+      329,  356,  356,  356,  356,  356,  356,  356,  356,    8,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      131,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  145,  356,  356,  355,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  322,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  355,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,   67,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  251,  356,   14,
+       15,  356,   19,   18,  356,  356,  235,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      138,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  233,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,    3,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  355,  356,  356,
+      356,  356,  356,  356,  356,  316,  356,  356,  315,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  339,  356,
+
+      356,  356,  356,  356,  356,  356,  356,   66,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   70,  356,  285,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  323,  324,  356,  356,
+      356,  356,  356,  356,  356,  356,   71,  356,  356,  139,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  134,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  222,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,   21,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      165,  356,  356,  356,  356,  356,  355,  339,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  110,
+      356,  356,  356,  356,  356,  356,  356,  293,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  191,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  164,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  109,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   35,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,   36,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,   68,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  137,  356,  356,  356,  355,  356,
+      356,  356,  356,  356,  129,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+       69,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  255,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  192,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,   57,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  273,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   61,  356,   62,  356,  356,  356,
+      356,  356,  113,  356,  114,  356,  356,  356,  356,  356,
+      111,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,    7,  356,  356,  356,  356,  355,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  244,  356,  356,
+      356,  356,  168,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  256,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,   48,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,   58,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  214,  356,  213,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,   16,   17,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,   72,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  221,  356,  356,  356,
+      356,  356,  356,  116,  356,  115,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  205,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  146,  356,  356,  356,  355,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  104,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,   92,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  234,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,   97,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,   65,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  208,  209,  356,  356,  356,
+
+      287,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,    6,  356,  356,  356,  356,  356,
+      356,  356,  306,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  291,  356,  356,  356,  356,  356,  356,  356,  317,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   45,  356,  356,  356,  356,   47,
+      356,  356,  356,   93,  356,  356,  356,  356,  356,   55,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  355,  356,  201,  356,  356,  356,  141,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  226,  356,
+      202,  356,  356,  356,  241,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,   56,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  143,  122,  356,  123,
+      356,  356,  356,  356,  121,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  161,  356,  356,   53,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  272,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  203,  356,  356,  356,  356,
+      356,  206,  356,  212,  356,  356,  356,  356,  356,  356,
+      240,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  108,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  135,  356,
+      356,  356,  356,  356,  356,  356,  356,   63,  356,  356,
+      356,   29,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   20,  356,  356,  356,  356,  356,
+      356,   30,   39,  356,  173,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  199,
+      356,  356,  355,  356,  356,  356,  356,  356,  356,   80,
+       82,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  295,  356,  356,  356,  356,  252,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  124,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  160,  356,   49,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      310,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      167,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  304,  356,  356,  356,  232,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  320,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  185,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  117,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  180,  356,  193,  356,  356,
+
+      356,  356,  356,  356,  356,  355,  356,  149,  356,  356,
+      356,  356,  356,  103,  356,  356,  356,  356,  224,  356,
+      356,  356,  356,  356,  356,  242,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  264,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  142,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  184,  356,  356,  356,  356,  356,  356,   83,  356,
+       84,  356,  356,  356,  356,  356,  356,   64,  313,  356,
+      356,  356,  356,  356,   91,  194,  356,  215,  356,  245,
+
+      356,  356,  207,  288,  356,  356,  356,  356,  356,  356,
+       76,  356,  196,  356,  356,  356,  356,  356,  356,    9,
+      356,  356,  356,  356,  356,  107,  356,  356,  356,  356,
+      356,  277,  356,  356,  356,  356,  223,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      355,  356,  356,  356,  356,  183,  356,  356,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  169,  356,  294,  356,
+      356,  356,  356,  356,  263,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  236,  356,  356,  356,
+      356,  356,  286,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      166,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  314,  356,  195,
+      356,  356,  356,  356,  356,  356,  356,  356,   75,   77,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      106,  356,  356,  356,  356,  356,  275,  356,  356,  356,
+
+      356,  290,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  228,   37,   31,   33,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,   38,  356,   32,   34,  356,  356,  356,  356,  356,
+      356,  356,  356,  102,  356,  179,  356,  356,  356,  356,
+      356,  356,  356,  355,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  230,  227,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,   74,  356,  356,  356,  144,
+      356,  125,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  162,   50,  356,  356,  356,  347,   13,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      308,  356,  311,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,   12,  356,  356,   22,  356,
+      356,  356,  356,  356,  356,  281,  356,  356,  356,  356,
+      292,  356,  356,  356,  356,   78,  356,  238,  356,  356,
+      356,  356,  356,  229,  356,  356,   73,  356,  356,  356,
+      356,  356,  356,   23,  356,  356,   46,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  178,
+      177,  356,  356,  347,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  356,  231,  225,  356,  243,  356,  356,  296,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,   85,  356,  356,  356,  356,  356,
+      276,  356,  356,  356,  356,  211,  356,  356,  356,  356,
+      356,  237,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  283,  356,  356,  356,  318,  319,  175,  356,  356,
+      356,   79,  356,  356,  356,  356,  186,  356,  356,  356,
+      118,  120,  119,  356,  356,  356,   25,  356,  356,  170,
+
+      356,  172,  356,  216,  356,  356,  356,  356,  176,  356,
+      356,  356,  356,  246,  356,  356,  356,  356,  356,  356,
+      356,  151,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  254,  356,  356,  356,  356,  356,
+      356,  356,  327,  356,   27,  356,  289,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,   89,  217,  356,  356,  356,  274,  356,
+      312,  356,  210,  356,  356,  356,  356,  356,  284,   59,
+      356,  356,  356,  356,  356,  356,    4,  356,  356,  356,
+      356,  133,  356,  150,  356,  356,  356,  190,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  249,   40,   41,  356,
+      356,  356,  356,  356,  356,  356,  297,  356,  356,  356,
+      356,  356,  356,  356,  262,  356,  356,  356,  356,  356,
+      356,  356,  356,  220,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,   88,  356,
+       60,  356,  280,  356,  250,  356,  356,  356,  356,  356,
+       11,  356,  356,  356,  356,  356,  356,  356,  356,  132,
+      356,  356,  356,  356,  356,  218,   94,  356,  356,   43,
+      356,  356,  356,  356,  356,  356,  356,  356,  182,  356,
+
+      356,  356,  356,  356,  356,  356,  153,  356,  356,  356,
+      356,  253,  356,  356,  356,  356,  356,  261,  356,  356,
+      356,  356,  147,  356,  356,  356,  126,  128,  127,  356,
+      356,  356,   96,  100,   95,  163,  356,  356,  356,  356,
+       86,  282,  356,  356,  356,  356,  356,  356,   10,  356,
+      356,  356,  356,  356,  278,  321,  356,  356,  356,  356,
+      356,  356,  326,   42,  356,  356,  356,  356,  356,  181,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  101,   99,  356,   54,  356,
+
+      356,   87,  309,  356,  356,  356,  356,   24,  356,  356,
+      356,  356,  356,  204,  356,  356,  356,  356,  356,  356,
+      219,  356,  356,  356,  356,  356,  356,  356,  356,  200,
+      356,  356,  171,   81,  356,  356,  356,  356,  356,  298,
+      356,  356,  356,  356,  356,  356,  356,  258,  356,  356,
+      257,  148,  356,  356,   98,   51,  356,  154,  155,  158,
+      159,  156,  157,   90,  307,  356,  356,  279,  136,  356,
+      356,  356,   26,  356,  174,  356,  356,  356,  356,  198,
+      356,  248,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+
+      356,  356,  188,  187,   44,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  305,  356,  356,
+      356,  356,  105,  356,  247,  356,  271,  302,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  328,
+      356,   52,    5,  356,  356,  239,  356,  356,  303,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  259,   28,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  260,  356,  356,  356,  152,  356,  356,  356,
+      356,  356,  356,  356,  356,  189,  356,  197,  356,  356,
+
+      356,  356,  356,  356,  356,  356,  356,  299,  356,  356,
+      356,  356,  356,  356,  356,  356,  356,  356,  356,  356,
+      356,  356,  356,  356,  356,  325,  356,  356,  267,  356,
+      356,  356,  356,  356,  300,  356,  356,  356,  356,  356,
+      356,  301,  356,  356,  356,  265,  356,  268,  269,  356,
+      356,  356,  356,  356,  266,  270,    0
     } ;
 
 static yyconst flex_int32_t yy_ec[256] =
@@ -804,17 +812,17 @@ static yyconst flex_int32_t yy_meta[41] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_int16_t yy_base[3502] =
+static yyconst flex_int16_t yy_base[3576] =
     {   0,
         0,    0,   38,   41,   44,   46,   59,   65,   71,   77,
-       90,  112,   96,  118,  124,  136, 5204, 5022,   81, 6793,
-     6793, 6793,  129,   52,  130,   63,  131,  152,   70,  140,
+       90,  112,   96,  118,  124,  136, 3060, 2545,   81, 6947,
+     6947, 6947,  129,   52,  130,   63,  131,  152,   70,  140,
       149,  156,   57,   88,   76,  173,  175,   95,  197,  145,
-      185,  199,  208,  213,  178,  123, 4580, 6793, 6793, 6793,
-      107, 3835, 6793, 6793, 6793,  154, 3459, 3338, 6793, 6793,
-     6793,  245, 3159, 6793, 6793, 6793,  163, 2930, 6793,  249,
-     6793,  253,  148, 2502, 2483, 6793, 6793, 6793,  257, 2236,
-     6793, 6793, 6793,  233, 1695,  263,  201,    0,  267,    0,
+      185,  199,  208,  213,  178,  123, 2505, 6947, 6947, 6947,
+      107, 2460, 6947, 6947, 6947,  154, 2315, 2089, 6947, 6947,
+     6947,  245, 2007, 6947, 6947, 6947,  163, 1936, 6947,  249,
+     6947,  253,  148, 1835, 1793, 6947, 6947, 6947,  257, 1696,
+     6947, 6947, 6947,  233, 1543,  263,  201,    0,  267,    0,
         0,  165,  191,  221,  252,  205,  181,  265,   92,  261,
 
       216,  263,  271,  272,  210,  279,  274,  282,  278,  291,
@@ -822,8 +830,8 @@ static yyconst flex_int16_t yy_base[3502] =
       317,  311,  315,  319,  321,  331,  327,  332,  336,  322,
       339,  337,  346,  345,  347,  348,  353,  351,  357,  284,
       358,  359,  369,  360,  380,  365,  381,  379,  375,  366,
-      367,  389,  390,  394,  393,  395,  396,  403,  404, 1436,
-      419, 1297,  422, 1003,  429,  930,  888,  433,  775,  437,
+      367,  389,  390,  394,  393,  395,  396,  403,  404, 1277,
+      419, 1241,  422, 1199,  429, 1020,  925,  433,  779,  437,
       441,    0,  433,  705,  447,  479,  287,  452,  411,  445,
       426,  446,  447,  448,  449,  450,  451,  453,  452,  456,
       470,  234,  463,  473,  481,  479,  476,  483,  486,  487,
@@ -831,760 +839,774 @@ static yyconst flex_int16_t yy_base[3502] =
       488,  489,  491,  492,  501,  500,  502,  505,  508,  510,
       511,  460,  509,  513,  527,  515,  516,  519,  538,  529,
       540,  543,  539,  548,  555,  400,  550,  551,  558,  553,
-      560,  561,  569,  562,  565,  566,  567,  570,  572,  574,
-      576,  579,  578,  582,  577,  590,  591,  585,  595,  594,
-      606,  601,  608,  604,  605,  362,  607,  611,  615,  623,
-      612,  627,  613,  614,  629,  633,  640,  641,  636,  622,
-      637,  639,  643,  644,  646,  648,  647,  656,  660,  659,
-      663,  667,  657,  665,  669,  671,  673,  649,  682,  675,
-      684,  688,  680,  683,  690,  692,  694,  696,  695,  699,
-
-      697,  700,  708,  704,  713,  712,  721,  716,  722,  719,
-      731,  732,  727,  717,  728,  729,  733,  736,  730,  740,
-      738,  741,  745,  743,  750,  752,  760,  755,  756,  771,
-      763,  766,  762,  774,  773,  765,  769,  794,  799,  782,
-      787,  800,  801,  804,  802,  803,  806,  808,  809,  814,
-      818,  819,  823,  807,  825,  827,  834,  829, 6793,  831,
-      838,  846,  839,  847,  850,  848,  854,  856,  836,  866,
-      864,  867,  876,  898,  849,  871,  868,  878,  881, 6793,
-      884,  882,  922,  890,  891,  908,  910,  859,  909,  911,
-      904,  912,  933,  906,  920,  915,  945,  942,  930,  943,
-
-      944,  946,  952,  954,  955,  953,  957,  958,  966,  861,
-      961,  970,  981,  962,  964,  968,  971,  974,  986,  983,
-      990,  991,  993,  995,  997,  996, 1001,  999, 1022, 1004,
-     1002, 1000, 1016, 1017, 1024, 1023, 1025, 1028, 1030, 1029,
-     1037, 1041, 1038, 1046, 1047, 1048, 1049, 1059, 1054, 1055,
-     1056, 1060, 1062, 1063, 1066, 1068, 1069, 1071, 1073, 1074,
-     1080, 1081, 1085, 1089, 1075, 1090, 1082, 6793, 1097, 6793,
-     1092, 1095, 1099, 1100, 1101, 1102, 1105, 6793, 1107, 1110,
-     1109, 1112, 1120, 1115, 1136, 1111, 1118, 1123, 1135, 1119,
-     1137, 1145, 1140, 1141, 1148, 1143, 1146, 1147, 1149, 1150,
-
-     1153, 1156, 1159, 1161, 1155, 1162, 1178, 6793, 1163, 1167,
-     1165, 1168, 1176, 1182, 1173, 1181, 1191, 1190, 1201, 1193,
-     1199, 1213, 1202, 1203, 1211, 1210, 1215, 1220, 1216, 1222,
-     1224, 1225, 1227, 1228, 1226, 1230, 1231, 1234, 1232, 1238,
-     1240, 6793, 1247, 1244, 1250, 1255, 1257, 1258, 1259, 1260,
-     1261, 1262, 1263, 1264, 1266,  517, 1271, 1282, 1289, 1272,
-     1291, 1275, 1290, 1286, 1288, 1265, 1292, 1296, 1294, 1307,
-     1298, 1309, 1314, 1322, 1318, 1320, 1327, 1329, 1304, 1324,
-     1299, 1326, 1330, 1332, 1334, 1333, 1335, 1341, 1339, 1348,
-     1344, 1346, 1345, 1347, 1351, 1353, 1355, 1356, 1357, 1359,
-
-     1366, 1361, 1373, 1369, 1371, 1372, 1368, 1387, 1376, 1379,
-     1391, 1392, 1389, 1390, 6793, 1399, 1398, 1401, 1402, 1408,
-     1409, 1410, 1400, 1411, 1414, 1417, 1418, 1419, 1425, 1422,
-     1426, 1420, 1427, 1433, 1432, 1440, 1446, 1435, 1450, 1451,
-     1453, 1437, 1449, 1456, 1457, 1465, 1462, 1466, 1468, 1464,
-     1469, 1478, 1470, 1473, 1475, 1485, 1481, 1482, 1487, 1484,
-     1496, 1498, 1490, 1507, 1499, 1509, 1516, 1502, 1488, 1517,
-     1506, 1518, 1512, 1521, 1522, 1523, 1526, 1533, 1528, 1529,
-     1534, 1535, 1536, 1537, 1531, 1544, 1547, 1545, 1548, 1551,
-     1552, 1553, 1557, 1560, 1555, 1561, 1566, 1567, 1568, 1570,
-
-     1558, 1578, 1588, 1569, 1580, 1582, 1581, 1589, 1590, 1591,
-     1596, 1597, 1598, 1600, 1601, 1608, 1611, 1602, 1605, 1614,
-     1615, 1617, 1618, 1627, 1619, 1628, 1632, 1633, 1634, 1622,
-     1635, 1638, 1640, 1641, 1645, 1646, 1648, 6793, 1652, 1660,
-     1653, 1658, 1655, 1656, 1661, 1669, 1664, 1668, 1665, 1666,
-     1670, 1692, 6793, 1674, 6793, 6793, 1676, 6793, 6793, 1677,
-     1678, 6793, 1682, 1687, 1699, 1698, 1705, 1707, 1709, 1685,
-     1710, 1680, 1719, 1725, 1716, 1717, 1718, 1723, 1730, 1721,
-     1731, 1728, 1738, 1742, 1740, 1746, 1749, 1754, 1756, 1758,
-     1750, 1761, 1767, 1764, 1770, 1772, 1775, 1760, 1776, 1778,
-
-     1779, 1780, 1782, 1781, 1784, 1787, 1790, 1791, 1793, 1786,
-     1794, 1805, 1803, 1796, 1813, 6793, 1809, 1821, 1806, 1823,
-     1819, 1826, 1827, 1822, 1810, 1832, 1834, 1829, 1835, 1836,
-     1838, 1839, 1840, 1842, 1844, 1846, 1850, 1848, 1860, 1849,
-     6793, 1862, 1863, 1851, 1859, 1865, 1866, 1873, 1867, 1852,
-     1870, 1876, 1886, 1882, 1884, 1887, 1888, 1890, 1891, 1892,
-     6793, 1894, 1901, 1898, 1902, 1904, 1893, 1908, 1905, 1910,
-     1911, 1912, 1917, 1915, 1918, 1922, 1923, 1924, 1926, 1929,
-     1934, 1931, 1938, 1941, 1948, 1942, 1944, 1949, 1950, 1951,
-     1953, 1954, 1955, 1957, 1962, 1966, 1965, 1969, 1967, 1968,
-
-     1978, 1986, 1971, 1982, 1983, 1984, 1985, 1990, 1993, 1998,
-     1994, 1996, 1999, 2008, 2000, 2005, 2007, 2010, 2013, 2023,
-     2009, 2026, 2018, 2011, 2021, 2027, 2028, 6793, 2034, 2035,
-     6793, 2037, 2036, 2038, 2060, 2039, 2042, 2051, 2044, 2045,
-     2048, 2053, 2061, 2057, 2064, 2073, 2074, 2077, 2080, 2079,
-     2082, 2086, 2085, 2088, 2089, 2092, 2095, 2093, 2100, 2107,
-     2109, 2055, 2113, 2117, 2112, 2114, 2118, 2137, 2115, 2116,
-     2125, 2119, 2122, 2124, 2120, 2126, 2130, 2135, 2140, 2132,
-     2147, 2150, 2146, 2149, 2152, 2153, 2160, 2162, 2165, 2164,
-     6793, 2172, 2170, 2174, 2175, 2176, 2183, 2181, 2179, 6793,
-
-     2182, 2185, 2187, 2196, 2188, 2192, 2195, 2199, 2201, 2202,
-     2204, 2205, 2208, 2206, 2207, 2226, 6793, 2209, 6793, 2213,
-     2210, 2218, 2221, 2228, 2229, 2231, 2232, 2233, 6793, 6793,
-     2234, 2235, 2248, 2251, 2241, 2243, 2252, 6793, 2253, 2260,
-     6793, 2262, 2261, 2256, 2255, 2257, 2267, 2268, 2271, 2278,
-     2274, 2282, 2277, 2279, 2283, 6793, 2287, 2280, 2288, 2291,
-     2289, 2295, 2298, 2302, 2299, 6793, 2300, 2308, 2309, 2316,
-     2313, 2314, 2317, 2318, 2319, 2322, 2325, 2326, 2327, 2328,
-     2337, 2338, 2329, 2342, 2339, 2343, 2351, 6793, 2349, 2350,
-     2336, 2358, 2355, 2362, 2357, 2363, 2353, 2359, 2364, 2370,
-
-     2365, 2369, 2375, 2377, 2379, 2386, 2387, 2382, 2383, 2385,
-     2390, 2391, 2392, 2394, 2399, 2396, 2401, 2400, 2402, 6793,
-     2403, 2407, 2408, 2413, 2415, 2411,  171, 2421, 2417, 2424,
-     2423, 2425, 2430, 2426, 2439, 2443, 2438, 2440, 2442, 2447,
-     2441, 2448, 2451, 2449, 2450, 2453, 2457, 2458, 6793, 2466,
-     2459, 2461, 2463, 2468, 2467, 2470, 6793, 2476, 2481, 2483,
-     2491, 2485, 2493, 2494, 2495, 2498, 2496, 2499, 2500, 2501,
-     2503, 2506, 2510, 2509, 6793, 2512, 2517, 2518, 2515, 2524,
-     2526, 2525, 2527, 2531, 2532, 2533, 2537, 2536, 2538, 2539,
-     2540, 2541, 2547, 2548, 2555, 2544, 2554, 2556, 2557, 2560,
-
-     2566, 2562, 2567, 2568, 2575, 2570, 6793, 2577, 2573, 2580,
-     2576, 2582, 2585, 2586, 2587, 2604, 2589, 2593, 2596, 2605,
-     2610, 2600, 2612, 2620, 2616, 2622, 2625, 2630, 2626, 2632,
-     2635, 2628, 2638, 2640, 2641, 2642, 2650, 2646, 2647, 2648,
-     2651, 2652, 2662, 2663, 2654, 2664, 2666, 2669, 2658, 2676,
-     2681, 2683, 6793, 2685, 2673, 2687, 2690, 2697, 2692, 2671,
-     2695, 2698, 2702, 2703, 2704, 2706, 2713, 2708, 2710, 2714,
-     2716, 2715, 2717, 2724, 2719, 2725, 2727, 2734, 2730, 2736,
-     2595, 6793, 2738, 2739, 2740, 2742, 2747, 2743, 2749, 2752,
-     2755, 2754, 2756, 2758, 2761, 2762, 2764, 2765, 2772, 2768,
-
-     2769, 2774, 2770, 6793, 2780, 2771, 2782, 2784, 2789, 2791,
-     2790, 2793, 2792, 2800, 2802, 2803, 2804, 2805, 2806, 6793,
-     2814, 2815, 2811, 2813, 2823, 2820, 2822, 2824, 2826, 2827,
-     6793, 2828, 2830, 2832, 2831, 2834, 2836, 2843, 2844, 2839,
-     6793, 2855, 2850, 2840, 2851, 2853, 2852, 2856, 2857, 2861,
-     2862, 2867, 2863, 2873, 2869, 2875, 6793, 2876, 2883, 2878,
-     2879, 2886, 2884, 2889, 2890, 2901, 2891, 2897, 2893, 6793,
-     2916, 2911, 2902, 2918, 2903, 2914, 2919, 2920, 2921, 2923,
-     2924, 2927, 2928, 6793, 2929, 2931, 2933, 2934, 2938, 2936,
-     2939, 2952, 2945, 2947, 2950, 2953, 2955, 2956, 2960, 2962,
-
-     2967, 2959, 2961, 2971, 2973, 2963, 2976, 2979, 2983, 2987,
-     2992, 2988, 2989, 2994, 2991, 2995, 2996, 2998, 3006, 3007,
-     3010, 3008, 3012, 6793, 3015, 3016, 3018, 3005, 3019, 3021,
-     3022, 3025, 3028, 3024, 3026, 3033, 3036, 3030, 3046, 3048,
-     3039, 3051, 3041, 3043, 3054, 3053, 3055, 3056, 3057, 3067,
-     3064, 3065, 3066, 3077, 3068, 3072, 3079, 3070, 3080, 3081,
-     3082, 3083, 3084, 3088, 3090, 3093, 3094, 3095, 3086, 3107,
-     3109, 3110, 3112, 3104, 3102, 3118, 3119, 6793, 3122, 3123,
-     3120, 3124, 3126, 3130, 3127, 3139, 3134, 3137, 3136, 3143,
-     3148, 3145, 3146, 3151, 3153, 3161, 3157, 6793, 3154, 6793,
-
-     3158, 3162, 3168, 3176, 3163, 6793, 3175, 6793, 3177, 3182,
-     3171, 3178, 6793, 3185, 3184, 3166, 3189, 3190, 3191, 3193,
-     3195, 3196, 3197, 3199, 3200, 3203, 3204, 3206, 3207, 3209,
-     3217, 3211, 3219, 3223, 3220, 3227, 3230, 3224, 3238, 3214,
-     3231, 3240, 3241, 3233, 3242, 6793, 3249, 3243, 3253, 3254,
-     3255, 3256, 3258, 3257, 3261, 3260, 3262, 3264, 3267, 3268,
-     3279, 3273, 3265, 3280, 3281, 3284, 3292, 3290, 3297, 6793,
-     3293, 3295, 3296, 3298, 6793, 3301, 3299, 3302, 3308, 3305,
-     3311, 3312, 3313, 3317, 3314, 3321, 3320, 3325, 3330, 3334,
-     3335, 6793, 3336, 3337, 3322, 3341, 3349, 3352, 3356, 3353,
-
-     3359, 3361, 3357, 3363, 3364, 3355, 3365, 3366, 3367, 3375,
-     3378, 3371, 3380, 3379, 3382, 3389, 3385, 3381, 3383, 3391,
-     3392, 3393, 3394, 3395, 3396, 3397, 3400, 3411, 3398, 3416,
-     6793, 3406, 3415, 3419, 3426, 3401, 3424, 3405, 3428, 3429,
-     6793, 3431, 3433, 3434, 3435, 3436, 3441, 3438, 3443, 3444,
-     3445, 3446, 3448, 3451, 3449, 6793, 3457, 6793, 3458, 3466,
-     3471, 3474, 3464, 3468, 3475, 3480, 3481, 3482, 3484, 3485,
-     3487, 3490, 3491, 3493, 3495, 3496, 3497, 3504, 3500, 3503,
-     3511, 3510, 3512, 3513, 3521, 3517, 3518, 6793, 6793, 3516,
-     3519, 3531, 3527, 3525, 3533, 3535, 3539, 3540, 3542, 3544,
-
-     3546, 3553, 6793, 3549, 3554, 3555, 3556, 3568, 3557, 3559,
-     3572, 3571, 3567, 3579, 3574, 6793, 3570, 3578, 3588, 3583,
-     3584, 3591, 6793, 3586, 6793, 3589, 3595, 3597, 3598, 3600,
-     3599, 3601, 3602, 3604, 3606, 3617, 3613, 3625, 3611, 3622,
-     3623, 3626, 3627, 3629, 3632, 3636, 3631, 3633, 3634, 6793,
-     3640, 3635, 3637, 3642, 3648, 3651, 3654, 3657, 3650, 6793,
-     3658, 3661, 3660, 3662, 3664, 3672, 3665, 3675, 3667, 3677,
-     3678, 3681, 3682, 3683, 6793, 3680, 3685, 3696, 3689, 3691,
-     3697, 3707, 3708, 3713, 6793, 3693, 3710, 3720, 3716, 3717,
-     3700, 3718, 3704, 3722, 3723, 3725, 3726, 3727, 3728, 3730,
-
-     3733, 3734, 3736, 3735, 3747, 3746, 3738, 3750, 3760, 3740,
-     6793, 3756, 3757, 3762, 3763, 3764, 3765, 3767, 3770, 3772,
-     3773, 3785, 3786, 3774, 3777, 3789, 3790, 3797, 3796, 6793,
-     3806, 3792, 3807, 3803, 3780, 3809, 3814, 3782, 3811, 3818,
-     3804, 3815, 3820, 3821, 3822, 3824, 3833, 3828, 3830, 3831,
-     3832, 3843, 3834, 6793, 3845, 3846, 3838, 3855, 3848, 3851,
-     3862, 3858, 3861, 3863, 3865, 3868, 3869, 3871, 3873, 3874,
-     3877, 3872, 6793, 6793, 3879, 3880, 3887, 6793, 3888, 3882,
-     3889, 3885, 3899, 3886, 3893, 3902, 3904, 3890, 3910, 3900,
-     3906, 6793, 3912, 3920, 3915, 3918, 3927, 3928, 6793, 3919,
-
-     3929, 3932, 3934, 3924, 3936, 3940, 3937, 3941, 3942, 3943,
-     3945, 3953, 3954, 3950, 3951, 3957, 6793, 3952, 3958, 3962,
-     3964, 3955, 3968, 6793, 3965, 3971, 3978, 3976, 3981, 3986,
-     3987, 3988, 3993, 3973, 3989, 3995, 3996, 3997, 3998, 4006,
-     4002, 4007, 4005, 4008, 4012, 4015, 4009, 6793, 4019, 4023,
-     4024, 4026, 6793, 4030, 4033, 4037, 6793, 4041, 4036, 4038,
-     4040, 4048, 6793, 4045, 4046, 4047, 4053, 4049, 4061, 4051,
-     4064, 4066, 4056, 4060, 4063, 4067, 6793, 4069, 4070, 4071,
-     6793, 4082, 4077, 4084, 4087, 4072, 4094, 4090, 4093, 4091,
-     4095, 6793, 4100, 6793, 4099, 4101, 4106, 6793, 4103, 4108,
-
-     4109, 4111, 4112, 4117, 4118, 4116, 4125, 4126, 4127, 4129,
-     4130, 4128, 4133, 4137, 4134, 4135, 4139, 4140, 6793, 4141,
-     4143, 4150, 4145, 4155, 4151, 4158, 4148, 4162, 4163, 6793,
-     6793, 4172, 6793, 4174, 4164, 4166, 6793, 4168, 4173, 4181,
-     4178, 4184, 4186, 4179, 4190, 4191, 6793, 4193, 4200, 6793,
-     4194, 4196, 4204, 4205, 4203, 4206, 4207, 4208, 4211, 4212,
-     4213, 4214, 4215, 4222, 4216, 4221, 4218, 6793, 4223, 4229,
-     4232, 4239, 4231, 4235, 4245, 4241, 4240, 6793, 4251, 4257,
-     4247, 4253, 4254, 6793, 4262, 6793, 4250, 4263, 4264, 4267,
-     4266, 4279, 6793, 4275, 4270, 4281, 4274, 4278, 4286, 4282,
-
-     4289, 4290, 4291, 4298, 4296, 4293, 4295, 4303, 4304, 6793,
-     4299, 4305, 4310, 4313, 4315, 4316, 4323, 4320, 4322, 4321,
-     4326, 4328, 4329, 4331, 4337, 4335, 4340, 4333, 6793, 4343,
-     4346, 4347, 4359, 4349, 4354, 4350, 6793, 4357, 4360, 4366,
-     6793, 4364, 4356, 4370, 4373, 4367, 4374, 4375, 4378, 4380,
-     4381, 4382, 6793, 4383, 4386, 4384, 4388, 4397, 4390, 6793,
-     6793, 4400, 6793, 4401, 4389, 4405, 4408, 4409, 4413, 4411,
-     4414, 4416, 4417, 4418, 4421, 4424, 4427, 6793, 4428, 4436,
-     4431, 4439, 4448, 4449, 4441, 4446, 4432, 6793, 6793, 4451,
-     4455, 4457, 4459, 4460, 4462, 4445, 4471, 4464, 4467, 4473,
-
-     4475, 4482, 6793, 4479, 4477, 4484, 4478, 6793, 4485, 4486,
-     4489, 4487, 4490, 4493, 4492, 4494, 4496, 4499, 4504, 4505,
-     4500, 4513, 4506, 4507, 4516, 4517, 4519, 4520, 4522, 4527,
-     6793, 4523, 4529, 4530, 4534, 4535, 4537, 4539, 4538, 4541,
-     4551, 6793, 4543, 6793, 4542, 4547, 4546, 4563, 4544, 4554,
-     4566, 4567, 4568, 4569, 4572, 4573, 4576, 4577, 4587, 4578,
-     4582, 4588, 4590, 4592, 4597, 4598, 6793, 4600, 4584, 4594,
-     4601, 4607, 4609, 4610, 4612, 4615, 4617, 4619, 4618, 4621,
-     4625, 4622, 4626, 4627, 4628, 4630, 6793, 4632, 4639, 4631,
-     4641, 4643, 4645, 4652, 4646, 4654, 4648, 4656, 4657, 6793,
-
-     4658, 4660, 4664, 6793, 4665, 4666, 4668, 4670, 4676, 4669,
-     4672, 4678, 4680, 6793, 4682, 4684, 4687, 4686, 4690, 4691,
-     4692, 4696, 4698, 4699, 4702, 6793, 4712, 4703, 4711, 4714,
-     4710, 4713, 4717, 4723, 4721, 6793, 4724, 4725, 4727, 4737,
-     4739, 4732, 4734, 4746, 4736, 4743, 4744, 4745, 4751, 4750,
-     4752, 4755, 4756, 4757, 4766, 4768, 4763, 6793, 4770, 6793,
-     4772, 4773, 4774, 4783, 4778, 4776, 4780, 4784, 4786, 6793,
-     4788, 4791, 4794, 4795, 4796, 6793, 4797, 4798, 4800, 4799,
-     6793, 4813, 4812, 4801, 4818, 4803, 4819, 6793, 4823, 4824,
-     4826, 4834, 4835, 4832, 4837, 4825, 4842, 4833, 4838, 4840,
-
-     4846, 4850, 4848, 4849, 6793, 4851, 4853, 4858, 4860, 4861,
-     4863, 4864, 4867, 4869, 4866, 6793, 4873, 4874, 4875, 4876,
-     4877, 4880, 4882, 4889, 4885, 4892, 4886, 4888, 4896, 4897,
-     4898, 4906, 6793, 4899, 4901, 4903, 4916, 4912, 4921, 6793,
-     4909, 6793, 4913, 4924, 4926, 4914, 4930, 6793, 6793, 4928,
-     4939, 4922, 4936, 4937, 6793, 6793, 4942, 6793, 4938, 6793,
-     4943, 4944, 6793, 6793, 4945, 4947, 4948, 4949, 4953, 4952,
-     6793, 4962, 6793, 4965, 4963, 4955, 4966, 4967, 6793, 4968,
-     4974, 4970, 4978, 4976, 6793, 4980, 4985, 4981, 4983, 6793,
-     4992, 4993, 4984, 4986, 6793, 4994, 5001, 4997, 5005, 5006,
-
-     5007, 5008, 5011, 5013, 5009, 5014, 5016, 5017, 5024, 5031,
-     5033, 5035, 5039, 5028, 5026, 5041, 5042, 5047, 5045, 5049,
-     5050, 5051, 5052, 5054, 5056, 5053, 5059, 5061, 5063, 5064,
-     5068, 5065, 5066, 5078, 5067, 5079, 5081, 5082, 5085, 5088,
-     5089, 5090, 5092, 5093, 5095, 5018, 5094, 5096, 5101, 5098,
-     5100, 6793, 5102, 5104, 5105, 5108, 5118, 5119, 5122, 5130,
-     5134, 5135, 6793, 5137, 6793, 5139, 5123, 5131, 5125, 5143,
-     6793, 5145, 5146, 5147, 5148, 5112, 5150, 5149, 5152, 5153,
-     5155, 5156, 6793, 5160, 5161, 5154, 5174, 5163, 6793, 5177,
-     5167, 5178, 5179, 5180, 5184, 5182, 5185, 5188, 5189, 5191,
-
-     5193, 5195, 5181, 5202, 5205, 6793, 5207, 5210, 5218, 5213,
-     5214, 5215, 5216, 5217, 5219, 5221, 5223, 5224, 5233, 5225,
-     5236, 6793, 5237, 6793, 5238, 5240, 5242, 5243, 5244, 5245,
-     5246, 5248, 6793, 6793, 5251, 5252, 5258, 5253, 5260, 5262,
-     5264, 5265, 5269, 6793, 5270, 5272, 5282, 5274, 6793, 5277,
-     5279, 5283, 5289, 6793, 5284, 5286, 5290, 5298, 5291, 5301,
-     5302, 5304, 5293, 5305, 5306, 5312, 6793, 6793, 6793, 6793,
-     5314, 5308, 5319, 5316, 5320, 5322, 5323, 5325, 5328, 5321,
-     5324, 6793, 5336, 6793, 6793, 5337, 5338, 5340, 5344, 5345,
-     5346, 5347, 5350, 6793, 5348, 6793, 5352, 5355, 5351, 5362,
-
-     5368, 5359, 5369, 5371, 5372, 5373, 5374, 5375, 5382, 5380,
-     5383, 5381, 5386, 5390, 5395, 6793, 6793, 5387, 5398, 5399,
-     5407, 5403, 5404, 5405, 5416, 5411, 5412, 5413, 5414, 5418,
-     5420, 5427, 5430, 5423, 5425, 6793, 5431, 5434, 5432, 6793,
-     5433, 6793, 5442, 5443, 5436, 5440, 5446, 5449, 5450, 5452,
-     5457, 6793, 6793, 5456, 5465, 5460, 6793, 6793, 5444, 5464,
-     5467, 5469, 5470, 5471, 5472, 5473, 5476, 5478, 6793, 5479,
-     6793, 5480, 5483, 5492, 5482, 5495, 5499, 5485, 5502, 5505,
-     5498, 5508, 6793, 5501, 5509, 6793, 5517, 5512, 5514, 5516,
-     5519, 6793, 5520, 5523, 5525, 5527, 6793, 5529, 5531, 5532,
-
-     6793, 5539, 6793, 5533, 5540, 5536, 5550, 5542, 6793, 5543,
-     5546, 6793, 5552, 5556, 5557, 5558, 5559, 6793, 5562, 5564,
-     6793, 5565, 5567, 5568, 5574, 5575, 5577, 5570, 5578, 5579,
-     5586, 5588, 5591, 6793, 6793, 5598, 5584,  135, 5600, 5581,
-     5597, 5601, 5602, 5609, 5605, 5606, 5612, 6793, 6793, 5613,
-     6793, 5607, 5616, 6793, 5614, 5620, 5624, 5626, 5622, 5628,
-     5629, 5631, 5633, 5634, 5647, 5637, 5635, 5652, 5642, 5662,
-     5638, 5664, 5665, 5667, 5669, 5671, 5659, 5673, 5674, 5653,
-     5676, 5677, 5680, 5681, 5683, 5684, 5685, 6793, 5688, 5696,
-     5697, 5689, 6793, 5702, 5691, 5709, 5706, 6793, 5713, 5710,
-
-     5714, 5715, 5716, 6793, 5703, 5718, 5722, 5720, 5727, 5728,
-     5640, 5736, 5731, 5732, 5733, 6793, 6793, 6793, 5738, 5748,
-     6793, 5750, 5740, 5734, 5742, 6793, 5752, 5753, 5745, 6793,
-     6793, 5755, 5756, 5758, 6793, 5763, 5770, 6793, 5765, 6793,
-     5766, 6793, 5768, 5769, 5771, 5775, 6793, 5776, 5778, 5779,
-     5785, 6793, 5795, 5797, 5799, 5792, 5782, 5788, 5800, 6793,
-     5809, 5806, 5808, 5815, 5804, 5812, 5810, 5816, 5817, 5825,
-     5818, 5827, 6793, 5828, 5829, 5833, 5836, 5820, 5830, 5840,
-     6793, 5841, 6793, 5847, 6793, 5844, 5849, 5848, 5842, 5850,
-     5853, 5856, 5854, 5858, 5867, 5860, 5863, 5865, 5871, 5873,
-
-     6793, 6793, 5875, 5877, 6793, 5879, 6793, 5883, 6793, 5880,
-     5885, 5884, 5886, 5888, 6793, 5895, 5887, 5890, 5903, 5898,
-     5904, 6793, 5905, 5908, 5909, 5911, 6793, 6793, 5912, 5919,
-     5915, 6793, 5914, 5917, 5925, 5918, 5926, 5930, 5927, 5931,
-     5934, 5941, 5937, 5939, 5942, 5944, 5945, 5947, 5952, 5957,
-     6793, 6793, 6793, 5953, 5948, 5967, 5964, 5966, 5976, 5959,
-     6793, 5973, 5972, 5974, 5975, 5986, 5981, 5983, 6793, 5984,
-     5985, 5987, 5988, 5990, 5991, 5992, 5993, 6793, 6005, 6007,
-     5995, 5997, 6009, 6016, 6018, 6020, 6022, 6013, 6023, 6030,
-     6027, 6793, 6029, 6793, 6793, 6025, 6793, 6031, 6033, 6035,
-
-     6034, 6036, 6793, 6039, 6040, 6041, 6043, 6042, 6050, 6046,
-     6048, 6793, 6058, 6051, 6061, 6063, 6793, 6793, 6064, 6070,
-     6793, 6073, 6074, 6067, 6082, 6065, 6075, 6087, 6084, 6793,
-     6088, 6090, 6078, 6091, 6094, 6093, 6096, 6793, 6100, 6097,
-     6101, 6103, 6793, 6104, 6109, 6110, 6112, 6113, 6793, 6114,
-     6106, 6130, 6115, 6793, 6117, 6129, 6131, 6793, 6793, 6135,
-     6139, 6136, 6793, 6793, 6793, 6793, 6142, 6143, 6145, 6147,
-     6793, 6150, 6154, 6158, 6160, 6165, 6153, 6793, 6161, 6167,
-     6169, 6170, 6171, 6793, 6793, 6172, 6173, 6174, 6178, 6175,
-     6793, 6793, 6180, 6182, 6183, 6181, 6184, 6793, 6186, 6191,
-
-     6198, 6194, 6200, 6207, 6209, 6202, 6210, 6211, 6219, 6222,
-     6212, 6214, 6221, 6225, 6226, 6224, 6228, 6238, 6233, 6235,
-     6241, 6236, 6244, 6793, 6793, 6246, 6793, 6248, 6250, 6793,
-     6793, 6253, 6255, 6257, 6261, 6793, 6263, 6265, 6267, 6269,
-     6258, 6793, 6270, 6272, 6273, 6274, 6275, 6793, 6277, 6278,
-     6281, 6283, 6287, 6289, 6290, 6293, 6793, 6288, 6305, 6793,
-     6793, 6294, 6296, 6285, 6306, 6302, 6793, 6310, 6314, 6309,
-     6316, 6315, 6317, 6322, 6793, 6318, 6319, 6793, 6793, 6325,
-     6326, 6793, 6793, 6327, 6793, 6793, 6793, 6793, 6793, 6793,
-     6793, 6793, 6331, 6330, 6793, 6332, 6340, 6343, 6793, 6347,
-
-     6793, 6337, 6348, 6350, 6344, 6793, 6349, 6793, 6351, 6355,
-     6356, 6365, 6358, 6368, 6359, 6352, 6362, 6370, 6375, 6376,
-     6378, 6377, 6379, 6381, 6383, 6393, 6385, 6390, 6793, 6793,
-     6793, 6382, 6394, 6398, 6399, 6404, 6406, 6410, 6412, 6401,
-     6413, 6415, 6416, 6417, 6419, 6423, 6430, 6425, 6428, 6426,
-     6435, 6427, 6437, 6793, 6442, 6443, 6429, 6446, 6793, 6449,
-     6793, 6432, 6793, 6793, 6452, 6453, 6455, 6456, 6465, 6466,
-     6457, 6461, 6462, 6467, 6469, 6793, 6477, 6793, 6793, 6470,
-     6473, 6793, 6478, 6479, 6793, 6480, 6482, 6484, 6485, 6486,
-     6488, 6489, 6490, 6497, 6793, 6793, 6501, 6502, 6504, 6506,
-
-     6508, 6515, 6510, 6512, 6514, 6522, 6516, 6524, 6793, 6526,
-     6528, 6530, 6793, 6532, 6531, 6534, 6537, 6538, 6545, 6540,
-     6542, 6793, 6543, 6793, 6547, 6549, 6548, 6551, 6552, 6554,
-     6562, 6560, 6564, 6793, 6566, 6568, 6572, 6573, 6575, 6578,
-     6579, 6580, 6582, 6584, 6585, 6594, 6588, 6590, 6596, 6598,
-     6600, 6793, 6602, 6604, 6793, 6605, 6606, 6607, 6608, 6612,
-     6793, 6617, 6609, 6614, 6620, 6625, 6622, 6793, 6631, 6635,
-     6632, 6793, 6636, 6793, 6793, 6637, 6638, 6640, 6644, 6646,
-     6793, 6793, 6793, 6673, 6680, 6687, 6694, 6701, 6708, 6715,
-       88, 6722, 6729, 6736, 6743, 6750, 6757, 6764, 6771, 6778,
-
-     6785
+      560,  561,  571,  562,  566,  567,  570,  569,  573,  577,
+      574,  580,  578,  583,  584,  598,  595,  585,  601,  586,
+      594,  596,  612,  602,  611,  362,  607,  610,  619,  624,
+      609,  627,  620,  623,  629,  634,  631,  641,  636,  639,
+      640,  642,  644,  643,  646,  647,  648,  656,  659,  660,
+      664,  667,  657,  668,  658,  670,  673,  674,  683,  675,
+      685,  679,  689,  688,  690,  692,  694,  696,  695,  697,
+
+      700,  703,  708,  704,  713,  714,  721,  719,  724,  717,
+      726,  733,  728,  729,  730,  731,  734,  736,  732,  737,
+      738,  742,  745,  743,  753,  754,  755,  759,  758,  774,
+      763,  764,  771,  784,  765,  767,  769,  775,  796,  785,
+      798,  799,  800,  803,  804,  801,  808,  807,  809,  811,
+      823,  813,  820,  826,  827,  829,  830,  837,  832, 6947,
+      834,  836,  848,  847,  850,  853,  843,  859,  860,  839,
+      870,  866,  863,  881,  903,  867,  871,  873,  876,  872,
+     6947,  893,  883,  927,  885,  889,  911,  895,  907,  913,
+      916,  909,  914,  921,  923,  917,  920,  944,  945,  935,
+
+      936,  947,  952,  951,  959,  960,  954,  958,  963,  971,
+      964,  967,  973,  982,  972,  969,  975,  976,  877,  984,
+      993,  994,  995,  981,  988,  999, 1001, 1002, 1009, 1032,
+     1011, 1012, 1020, 1006, 1014, 1028, 1026, 1024, 1034, 1033,
+     1035, 1007, 1041, 1039, 1044, 1051, 1048, 1054, 1063, 1058,
+     1059, 1060, 1064, 1065, 1066, 1068, 1071, 1072, 1073, 1076,
+     1077, 1083, 1084, 1088, 1092, 1078, 1093, 1086, 6947, 1100,
+     6947, 1095, 1098, 1102, 1103, 1104, 1105, 1107, 1109, 6947,
+     1111, 1114, 1113, 1120, 1124, 1117, 1128, 1130, 1136, 1137,
+     1138, 1139, 1140, 1142, 1149, 1144, 1154, 1152, 1147, 1158,
+
+     1156, 1159, 1115, 1160, 1162, 1166, 1167, 1168, 1169, 1188,
+     6947, 1172, 1174, 1175, 1181, 1179, 1186, 1184, 1193, 1201,
+     1203, 1211, 1205, 1213, 1215, 1212, 1217, 1173, 1219, 1223,
+     1225, 1228, 1229, 1231, 1232, 1234, 1235, 1237, 1238, 1240,
+     1239, 1247, 1250, 1251, 6947, 1252, 1254, 1255, 1268, 1263,
+     1264, 1267, 1269, 1270, 1271, 1272, 1274, 1278,  517, 1273,
+     1291, 1288, 1284, 1298, 1293, 1294, 1295, 1299, 1301, 1300,
+     1302, 1304, 1313, 1310, 1316, 1325, 1328, 1327, 1330, 1337,
+     1339, 1319, 1332, 1342, 1336, 1334, 1335, 1346, 1347, 1348,
+     1350, 1351, 1360, 1356, 1357, 1359, 1358, 1364, 1365, 1367,
+
+     1362, 1368, 1370, 1372, 1374, 1381, 1379, 1385, 1390, 1386,
+     1391, 1387, 1380, 1395, 1403, 1397, 1406, 6947, 1413, 1308,
+     1409, 1410, 1415, 1416, 1417, 1418, 1423, 1424, 1425, 1427,
+     1426, 1429, 1430, 1433, 1435, 1437, 1440, 1442, 1450, 1445,
+     1455, 1462, 1461, 1443, 1447, 1457, 1463, 1467, 1466, 1474,
+     1470, 1479, 1478, 1469, 1482, 1489, 1480, 1484, 1486, 1496,
+     1476, 1492, 1498, 1499, 1507, 1502, 1504, 1510, 1518, 1514,
+     1515, 1522, 1523, 1500, 1527, 1517, 1531, 1532, 1534, 1535,
+     1537, 1538, 1545, 1540, 1542, 1546, 1547, 1541, 1548, 1554,
+     1549, 1569, 1555, 1560, 1565, 1568, 1570, 1571, 1572, 1578,
+
+     1573, 1579, 1580, 1581, 1583, 1592, 1584, 1582, 1593, 1594,
+     1601, 1595, 1603, 1602, 1604, 1611, 1610, 1614, 1615, 1605,
+     1616, 1620, 1626, 1627, 1628, 1631, 1630, 1635, 1638, 1636,
+     1640, 1642, 1648, 1649, 1650, 1652, 1633, 1656, 1659, 1664,
+     1667, 1661, 6947, 1657, 1675, 1651, 1673, 1674, 1653, 1679,
+     1687, 1680, 1682, 1683, 1684, 1685, 1710, 6947, 1691, 6947,
+     6947, 1690, 6947, 6947, 1693, 1692, 6947, 1694, 1695, 1708,
+     1699, 1713, 1716, 1720, 1718, 1711, 1721, 1733, 1742, 1728,
+     1734, 1726, 1735, 1751, 1738, 1752, 1740, 1750, 1758, 1759,
+     1757, 1764, 1771, 1766, 1775, 1768, 1779, 1777, 1780, 1786,
+
+     1787, 1791, 1793, 1788, 1794, 1797, 1796, 1798, 1799, 1802,
+     1804, 1723, 1805, 1808, 1809, 1810, 1818, 1815, 1823, 1830,
+     6947, 1828, 1831, 1827, 1840, 1836, 1843, 1811, 1838, 1839,
+     1849, 1851, 1845, 1842, 1852, 1854, 1855, 1856, 1859, 1861,
+     1864, 1867, 1865, 1869, 1872, 1870, 6947, 1877, 1878, 1871,
+     1879, 1881, 1882, 1883, 1891, 1892, 1893, 1894, 1904, 1896,
+     1899, 1897, 1901, 1906, 1908, 1909, 1911, 6947, 1916, 1924,
+     1913, 1921, 1919, 1925, 1928, 1929, 1930, 1933, 1931, 1935,
+     1937, 1938, 1947, 1943, 1944, 1946, 1949, 1953, 1958, 1961,
+     1959, 1960, 1971, 1963, 1966, 1972, 1974, 1975, 1976, 1977,
+
+     1978, 1980, 1985, 1990, 1987, 1995, 1988, 1991, 1998, 2009,
+     2004, 1993, 2005, 2010, 2006, 2013, 2022, 2024, 2020, 2019,
+     2021, 2032, 2028, 2030, 2031, 2033, 2036, 2041, 2042, 2043,
+     2044, 2046, 2050, 2051, 2053, 6947, 2055, 2059, 6947, 2058,
+     2060, 2061, 2083, 2062, 2065, 2066, 2075, 2064, 2087, 2078,
+     2076, 2095, 2084, 2102, 2097, 2103, 2105, 2107, 2108, 2112,
+     2110, 2111, 2114, 2116, 2118, 2120, 2128, 2137, 2138, 2140,
+     2134, 2142, 2119, 2143, 2067, 2163, 2144, 2145, 2146, 2147,
+     2148, 2152, 2153, 2151, 2154, 2155, 2165, 2170, 2172, 2173,
+     2175, 2158, 2179, 2180, 2181, 2191, 2188, 2185, 6947, 2200,
+
+     2193, 2197, 2201, 2202, 2209, 2207, 2204, 6947, 2208, 2210,
+     2211, 2220, 2213, 2218, 2221, 2224, 2225, 2228, 2229, 2231,
+     2233, 2230, 2232, 2251, 6947, 2234, 6947, 2238, 2235, 2253,
+     2243, 2246, 2247, 2254, 2256, 2259, 6947, 6947, 2263, 2257,
+     2270, 2273, 2278, 2274, 2275, 2276, 6947, 2277, 2285, 6947,
+     2287, 2292, 2280, 2281, 2282, 2286, 2296, 2297, 2305, 2300,
+     2308, 2303, 2306, 2307, 6947, 2313, 2316, 2310, 2317, 2323,
+     2324, 2325, 2327, 2330, 2326, 6947, 2333, 2329, 2336, 2343,
+     2347, 2341, 2344, 2348, 2352, 2349, 2354, 2355, 2356, 2357,
+     2364, 2366, 2369, 2371, 2372, 2374, 2378, 2385, 6947, 2381,
+
+     2380, 2382, 2390, 2387, 2389, 2391, 2394, 2393, 2395, 2396,
+     2401, 2397, 2405, 2406, 2407, 2409, 2418, 2421, 2416, 2417,
+     2426, 2413, 2420, 2423, 2427, 2365, 2429, 2430, 2433, 2436,
+     6947, 2437, 2441, 2438, 2443, 2444, 2442,  171, 2450, 2451,
+     2453, 2454, 2458, 2469, 2455, 2463, 2476, 2471, 2472, 2478,
+     2474, 2481, 2482, 2483, 2484, 2473, 2486, 2485, 2489, 6947,
+     2491, 2497, 2494, 2498, 2501, 2502, 2504, 6947, 2506, 2514,
+     2516, 2525, 2519, 2503, 2527, 2528, 2531, 2529, 2532, 2533,
+     2534, 2535, 2536, 2542, 2539, 6947, 2544, 2551, 2554, 2541,
+     2555, 2562, 2548, 2563, 2564, 2565, 2568, 2567, 2569, 2573,
+
+     2570, 2572, 2574, 2575, 2583, 2594, 2577, 2586, 2587, 2590,
+     2591, 2595, 2599, 2600, 2601, 2608, 2603, 6947, 2615, 2604,
+     2612, 2613, 2611, 2614, 2617, 2620, 2634, 2624, 2627, 2629,
+     2635, 2644, 2637, 2638, 2646, 2654, 2651, 2639, 2664, 2660,
+     2661, 2668, 2659, 2670, 2672, 2662, 2673, 2684, 2674, 2676,
+     2681, 2679, 2685, 2694, 2695, 2687, 2697, 2698, 2690, 2700,
+     2702, 2712, 2717, 2707, 6947, 2719, 2709, 2720, 2721, 2728,
+     2725, 2726, 2731, 2729, 2732, 2733, 2735, 2737, 2745, 2746,
+     2744, 2742, 2749, 2753, 2755, 2757, 2760, 2759, 2740, 2768,
+     2762, 2764, 2771, 2772, 6947, 2775, 2776, 2780, 2782, 2784,
+
+     2785, 2787, 2788, 2790, 2792, 2793, 2794, 2797, 2798, 2800,
+     2801, 2802, 2809, 2806, 2807, 2808, 2812, 6947, 2820, 2819,
+     2821, 2824, 2827, 2825, 2831, 2837, 2839, 2828, 2841, 2835,
+     2842, 2843, 2845, 6947, 2855, 2857, 2847, 2854, 2862, 2860,
+     2861, 2863, 2865, 2866, 6947, 2867, 2870, 2868, 2875, 2871,
+     2873, 2882, 2883, 2879, 6947, 2887, 2884, 2889, 2892, 2893,
+     2894, 2895, 2899, 2897, 2901, 2902, 2906, 2915, 2907, 2916,
+     6947, 2903, 2924, 2910, 2925, 2919, 2929, 2931, 2932, 2933,
+     2935, 2937, 2940, 6947, 2942, 2945, 2948, 2957, 2952, 2953,
+     2955, 2958, 2960, 2962, 2961, 2964, 2966, 6947, 2968, 2967,
+
+     2970, 2974, 2972, 2977, 2978, 2989, 2984, 2987, 2990, 2991,
+     2992, 2993, 2994, 2999, 3010, 3001, 2998, 3000, 3002, 3014,
+     3012, 3019, 3018, 3022, 3026, 3030, 3025, 3031, 3034, 3029,
+     3036, 3037, 3040, 3047, 3048, 3049, 3050, 3053, 6947, 3056,
+     3057, 3059, 3044, 3060, 3063, 3064, 3066, 3069, 3065, 3067,
+     3071, 3074, 3078, 3087, 3090, 3080, 3082, 3091, 3092, 3093,
+     3094, 3095, 3096, 3101, 3104, 3103, 3105, 3106, 3113, 3109,
+     3112, 3121, 3117, 3120, 3122, 3123, 3124, 3126, 3127, 3129,
+     3130, 3134, 3133, 3135, 3138, 3146, 3156, 3153, 3147, 3149,
+     3157, 3159, 3161, 6947, 3160, 3164, 3168, 3165, 3170, 3174,
+
+     3171, 3181, 3177, 3182, 3190, 3188, 3187, 3194, 3179, 3189,
+     3196, 3197, 3206, 3202, 6947, 3203, 6947, 3204, 3208, 3209,
+     3218, 3211, 6947, 3215, 6947, 3216, 3223, 3220, 3224, 3226,
+     6947, 3227, 3228, 3232, 3229, 3233, 3234, 3239, 3237, 3241,
+     3243, 3245, 3246, 3255, 3244, 3250, 3251, 3257, 3266, 3256,
+     3261, 3263, 3269, 3272, 3274, 3273, 3280, 3275, 3282, 3283,
+     3285, 3286, 3287, 6947, 3291, 3295, 3296, 3299, 3300, 3288,
+     3303, 3302, 3310, 3307, 3311, 3308, 3314, 3315, 3319, 3320,
+     3323, 3325, 3331, 3336, 3343, 3326, 3344, 6947, 3339, 3348,
+     3330, 3350, 6947, 3352, 3327, 3354, 3358, 3360, 3361, 3362,
+
+     3363, 3364, 3367, 3368, 3369, 3370, 3378, 3381, 3384, 6947,
+     3382, 3390, 3371, 3394, 3393, 3404, 3405, 3401, 3407, 3409,
+     3417, 3413, 3402, 3412, 3400, 3414, 3420, 3422, 3427, 3431,
+     3424, 3432, 3428, 3433, 3436, 3437, 3439, 3440, 3443, 3441,
+     3444, 3445, 3449, 3446, 3447, 3448, 3340, 3450, 3466, 6947,
+     3453, 3455, 3468, 3476, 3454, 3471, 3475, 3477, 3478, 6947,
+     3480, 3482, 3483, 3484, 3485, 3489, 3492, 3490, 3493, 3494,
+     3497, 3498, 3501, 3500, 6947, 3507, 6947, 3508, 3515, 3520,
+     3524, 3509, 3517, 3525, 3530, 3526, 3531, 3532, 3538, 3540,
+     3534, 3536, 3542, 3543, 3546, 3547, 3554, 3560, 3557, 3549,
+
+     3561, 3563, 3565, 3566, 3573, 3570, 3568, 6947, 6947, 3571,
+     3576, 3577, 3583, 3584, 3585, 3587, 3589, 3592, 3591, 3595,
+     3600, 3611, 6947, 3603, 3604, 3606, 3607, 3608, 3620, 3613,
+     3624, 3621, 3625, 3626, 3633, 3629, 6947, 3632, 3634, 3642,
+     3637, 3638, 3645, 6947, 3375, 6947, 3643, 3644, 3646, 3649,
+     3651, 3655, 3653, 3658, 3659, 3654, 3660, 3670, 3677, 3679,
+     3675, 3681, 3676, 3682, 3678, 3684, 3685, 3692, 3687, 3689,
+     3690, 6947, 3694, 3695, 3699, 3701, 3702, 3707, 3711, 3704,
+     3710, 6947, 3714, 3717, 3718, 3719, 3720, 3724, 3727, 3728,
+     3729, 3737, 3730, 3732, 3738, 3741, 6947, 3742, 3734, 3749,
+
+     3745, 3747, 3752, 3756, 3759, 3764, 6947, 3766, 3751, 3773,
+     3769, 3770, 3772, 3775, 3776, 3777, 3779, 3780, 3781, 3783,
+     3784, 3789, 3785, 3787, 3794, 3790, 3802, 3804, 3791, 3812,
+     3819, 3805, 6947, 3808, 3815, 3817, 3818, 3820, 3821, 3823,
+     3829, 3831, 3825, 3840, 3841, 3832, 3836, 3843, 3847, 3844,
+     3855, 3851, 6947, 3856, 3852, 3865, 3858, 3860, 3866, 3862,
+     3867, 3868, 3872, 3874, 3875, 3876, 3877, 3878, 3883, 3886,
+     3890, 3891, 3892, 3893, 3900, 3895, 6947, 3907, 3884, 3897,
+     3914, 3908, 3905, 3923, 3918, 3921, 3922, 3925, 3926, 3928,
+     3930, 3931, 3932, 3935, 3936, 6947, 6947, 3938, 3939, 3940,
+
+     6947, 3942, 3944, 3954, 3945, 3947, 3955, 3957, 3959, 3958,
+     3960, 3962, 3968, 3969, 6947, 3977, 3970, 3979, 3978, 3974,
+     3988, 3987, 6947, 3980, 3990, 3992, 3995, 3993, 3983, 3996,
+     4001, 3997, 4005, 4006, 4007, 4010, 4018, 4019, 4014, 4016,
+     4017, 6947, 4020, 4022, 4023, 4026, 4027, 4029, 4030, 6947,
+     4035, 4032, 4038, 4041, 4043, 4050, 4042, 4053, 4056, 4057,
+     4058, 4060, 4061, 4062, 4063, 4065, 4073, 4059, 4071, 4070,
+     4068, 4088, 4089, 4076, 6947, 4084, 4091, 4074, 4096, 6947,
+     4098, 4105, 4106, 6947, 4109, 4092, 4108, 4110, 4117, 6947,
+     4112, 4115, 4114, 4120, 4116, 4129, 4125, 4133, 4131, 4132,
+
+     4128, 4134, 4137, 6947, 4138, 4135, 4140, 6947, 4143, 4152,
+     4156, 4158, 4142, 4165, 4160, 4163, 4161, 4164, 6947, 4169,
+     6947, 4172, 4170, 4176, 6947, 4171, 4178, 4179, 4181, 4185,
+     4186, 4187, 4193, 4189, 4195, 4197, 4198, 4199, 4200, 4202,
+     4209, 4201, 4205, 4208, 4210, 6947, 4211, 4213, 4220, 4217,
+     4221, 4225, 4227, 4228, 4230, 4232, 6947, 6947, 4241, 6947,
+     4233, 4238, 4242, 4243, 6947, 4246, 4248, 4250, 4247, 4251,
+     4253, 4256, 4266, 4136, 6947, 4268, 4269, 6947, 4257, 4271,
+     4278, 4273, 4275, 4263, 4276, 4283, 4279, 4260, 4286, 4289,
+     4290, 4291, 4292, 4293, 4300, 6947, 4294, 4297, 4295, 4310,
+
+     4299, 4304, 4312, 4311, 4313, 6947, 4321, 4323, 4322, 4327,
+     4328, 6947, 4329, 6947, 4330, 4334, 4337, 4339, 4331, 4342,
+     6947, 4344, 4345, 4352, 4347, 4353, 4354, 4355, 4357, 4361,
+     4363, 4364, 4371, 4367, 4369, 4366, 4376, 4377, 6947, 4368,
+     4374, 4390, 4391, 4383, 4380, 4386, 4399, 4396, 4398, 4397,
+     4402, 4404, 4405, 4407, 4411, 4413, 4409, 4416, 6947, 4419,
+     4420, 4424, 4421, 4431, 4427, 4428, 4433, 6947, 4435, 4436,
+     4438, 6947, 4440, 4444, 4446, 4449, 4450, 4451, 4452, 4456,
+     4454, 4457, 4458, 4460, 6947, 4462, 4463, 4461, 4477, 4478,
+     4467, 6947, 6947, 4480, 6947, 4484, 4466, 4485, 4487, 4488,
+
+     4492, 4494, 4495, 4497, 4491, 4498, 4502, 4503, 4507, 6947,
+     4510, 4518, 4511, 4522, 4525, 4530, 4523, 4527, 4514, 6947,
+     6947, 4532, 4536, 4538, 4540, 4541, 4543, 4528, 4550, 4548,
+     4556, 4559, 4549, 4566, 6947, 4561, 4552, 4563, 4564, 6947,
+     4545, 4568, 4569, 4571, 4574, 4575, 4578, 4576, 4577, 4580,
+     4588, 4581, 4583, 4590, 4589, 4591, 4599, 4597, 4600, 4601,
+     4603, 4607, 6947, 4604, 4608, 4610, 4613, 4617, 4618, 4619,
+     4620, 4622, 4623, 4630, 6947, 4628, 6947, 4626, 4631, 4646,
+     4633, 4636, 4648, 4649, 4650, 4651, 4655, 4657, 4658, 4661,
+     4663, 4667, 4662, 4668, 4671, 4673, 4675, 4679, 4683, 4680,
+
+     6947, 4686, 4676, 4688, 4625, 4690, 4693, 4694, 4698, 4699,
+     4701, 4695, 4702, 4704, 4706, 4709, 4711, 4712, 4714, 4715,
+     6947, 4716, 4719, 4722, 4725, 4726, 4727, 4730, 4735, 4739,
+     4743, 4731, 4733, 4745, 6947, 4737, 4746, 4754, 6947, 4749,
+     4751, 4756, 4757, 4758, 4760, 4761, 4763, 4767, 4770, 6947,
+     4774, 4764, 4771, 4775, 4776, 4777, 4781, 4783, 4786, 4788,
+     4790, 4798, 6947, 4799, 4791, 4800, 4802, 4804, 4806, 4810,
+     4808, 4811, 6947, 4812, 4815, 4821, 4823, 4828, 4830, 4814,
+     4825, 4833, 4834, 4836, 4832, 4842, 4843, 4844, 4845, 4847,
+     4849, 4848, 4865, 4866, 4863, 6947, 4850, 6947, 4851, 4852,
+
+     4868, 4878, 4873, 4875, 4876, 4880, 4879, 6947, 4881, 4886,
+     4888, 4883, 4891, 6947, 4892, 4889, 4893, 4894, 6947, 4907,
+     4890, 4896, 4903, 4912, 4913, 6947, 4918, 4919, 4920, 4927,
+     4929, 4924, 4931, 4926, 4934, 4932, 4928, 4936, 4937, 4945,
+     4943, 4941, 6947, 4947, 4949, 4954, 4956, 4950, 4958, 4948,
+     4960, 4963, 4965, 6947, 4966, 4969, 4970, 4972, 4973, 4975,
+     4974, 4976, 4983, 4980, 4984, 4982, 4988, 4991, 4993, 4995,
+     4997, 6947, 4999, 5001, 5003, 5012, 5005, 5002, 6947, 5009,
+     6947, 5014, 5019, 5021, 5022, 5015, 5026, 6947, 6947, 5029,
+     5036, 5023, 5032, 5034, 6947, 6947, 5038, 6947, 5039, 6947,
+
+     5040, 5042, 6947, 6947, 5044, 5045, 5046, 5047, 5048, 5051,
+     6947, 5056, 6947, 5065, 5060, 5061, 5063, 5064, 5068, 6947,
+     5066, 5069, 5070, 5075, 5077, 6947, 5074, 5078, 5094, 5081,
+     5089, 6947, 5091, 5092, 5093, 5096, 6947, 5097, 5101, 5102,
+     5103, 5106, 5105, 5108, 5109, 5110, 5116, 5117, 5120, 5119,
+     5122, 5123, 5127, 5132, 5134, 5136, 5137, 5138, 5140, 5143,
+     5146, 5150, 5141, 5148, 5152, 5154, 5155, 5157, 5159, 5160,
+     5162, 5166, 5167, 5163, 5170, 5169, 5171, 5180, 5172, 5182,
+     5184, 5186, 5188, 5189, 5190, 5193, 5194, 5197, 5198, 5199,
+     5196, 5203, 5200, 5207, 5212, 6947, 5205, 5213, 5214, 5216,
+
+     5217, 5221, 5224, 5233, 5239, 5240, 6947, 5242, 6947, 5244,
+     5228, 5225, 5230, 5247, 6947, 5234, 5248, 5250, 5251, 5252,
+     5253, 5255, 5256, 5259, 5260, 5263, 6947, 5268, 5265, 5258,
+     5274, 5270, 6947, 5275, 5282, 5285, 5286, 5287, 5288, 5291,
+     5289, 5290, 5293, 5292, 5294, 5297, 5299, 5300, 5310, 5312,
+     6947, 5314, 5316, 5323, 5319, 5321, 5322, 5324, 5325, 5326,
+     5329, 5327, 5334, 5331, 5343, 5348, 5345, 6947, 5332, 6947,
+     5349, 5335, 5352, 5353, 5355, 5356, 5357, 5359, 6947, 6947,
+     5362, 5363, 5365, 5367, 5369, 5370, 5372, 5374, 5375, 5376,
+     6947, 5379, 5383, 5387, 5393, 5386, 6947, 5395, 5396, 5397,
+
+     5401, 6947, 5402, 5398, 5404, 5405, 5412, 5403, 5419, 5415,
+     5421, 5409, 5423, 5413, 5427, 6947, 6947, 6947, 6947, 5428,
+     5424, 5432, 5434, 5436, 5437, 5439, 5442, 5443, 5441, 5438,
+     5444, 6947, 5454, 6947, 6947, 5455, 5456, 5457, 5462, 5464,
+     5463, 5465, 5468, 6947, 5466, 6947, 5470, 5473, 5469, 5480,
+     5486, 5483, 5477, 5490, 5487, 5492, 5491, 5493, 5501, 5498,
+     5499, 5502, 5505, 5507, 5513, 6947, 6947, 5508, 5515, 5516,
+     5524, 5520, 5522, 5526, 5534, 5529, 5530, 5532, 5531, 5536,
+     5537, 5545, 5548, 5538, 5547, 6947, 5549, 5550, 5551, 6947,
+     5552, 6947, 5557, 5560, 5561, 5553, 5563, 5568, 5569, 5572,
+
+     5570, 5575, 6947, 6947, 5567, 5587, 5582, 6947, 6947, 5574,
+     5583, 5586, 5590, 5584, 5592, 5595, 5594, 5597, 5599, 5596,
+     6947, 5601, 6947, 5600, 5602, 5608, 5610, 5619, 5623, 5614,
+     5624, 5622, 5625, 5626, 5629, 6947, 5627, 5628, 6947, 5637,
+     5639, 5640, 5638, 5646, 5643, 6947, 5647, 5649, 5654, 5656,
+     6947, 5660, 5657, 5663, 5662, 6947, 5665, 6947, 5630, 5669,
+     5666, 5676, 5672, 6947, 5673, 5679, 6947, 5682, 5686, 5688,
+     5689, 5677, 5683, 6947, 5695, 5691, 6947, 5697, 5699, 5700,
+     5703, 5704, 5706, 5707, 5708, 5710, 5718, 5714, 5711, 6947,
+     6947, 5722, 5723,  135, 5731, 5721, 5727, 5729, 5732, 5739,
+
+     5734, 5736, 5742, 6947, 6947, 5743, 6947, 5737, 5750, 6947,
+     5735, 5751, 5755, 5746, 5752, 5758, 5761, 5765, 5767, 5768,
+     5769, 5770, 5771, 5775, 5792, 5794, 5777, 5774, 5797, 5799,
+     5801, 5803, 5805, 5762, 5807, 5789, 5785, 5808, 5810, 5795,
+     5813, 5816, 5817, 5819, 6947, 5821, 5824, 5826, 5827, 5828,
+     6947, 5831, 5834, 5836, 5838, 6947, 5845, 5840, 5842, 5847,
+     5848, 6947, 5832, 5853, 5855, 5858, 5859, 5860, 5861, 5863,
+     5870, 6947, 5867, 5865, 5871, 6947, 6947, 6947, 5876, 5883,
+     5873, 6947, 5885, 5877, 5886, 5888, 6947, 5890, 5892, 5893,
+     6947, 6947, 6947, 5894, 5895, 5898, 6947, 5896, 5903, 6947,
+
+     5902, 6947, 5899, 6947, 5904, 5908, 5917, 5912, 6947, 5910,
+     5922, 5923, 5924, 6947, 5927, 5930, 5932, 5933, 5934, 5936,
+     5938, 6947, 5945, 5941, 5944, 5948, 5940, 5950, 5951, 5952,
+     5953, 5965, 5956, 5961, 6947, 5963, 5964, 5968, 5974, 5966,
+     5976, 5977, 6947, 5970, 6947, 5979, 6947, 5980, 5982, 5983,
+     5984, 5989, 5986, 5987, 5997, 5994, 6000, 6003, 6001, 6007,
+     6008, 6012, 6009, 6947, 6947, 6014, 6015, 6017, 6947, 6018,
+     6947, 6023, 6947, 6019, 6024, 6026, 6027, 6032, 6947, 6947,
+     6030, 6033, 6036, 6044, 6041, 6042, 6947, 6046, 6048, 6049,
+     6051, 6947, 6058, 6947, 6054, 6063, 6055, 6947, 6056, 6066,
+
+     6070, 6067, 6059, 6072, 6073, 6076, 6075, 6083, 6080, 6081,
+     6086, 6088, 6089, 6094, 6098, 6102, 6947, 6947, 6947, 6096,
+     6090, 6111, 6113, 6114, 6115, 6100, 6947, 6116, 6120, 6122,
+     6107, 6129, 6124, 6131, 6947, 6125, 6128, 6132, 6134, 6136,
+     6133, 6138, 6139, 6947, 6144, 6150, 6156, 6140, 6151, 6153,
+     6160, 6162, 6164, 6167, 6168, 6169, 6176, 6172, 6947, 6174,
+     6947, 6179, 6947, 6171, 6947, 6175, 6180, 6182, 6183, 6184,
+     6947, 6187, 6188, 6189, 6192, 6191, 6194, 6199, 6210, 6947,
+     6200, 6213, 6196, 6193, 6215, 6947, 6947, 6204, 6222, 6947,
+     6224, 6226, 6219, 6234, 6217, 6227, 6237, 6238, 6947, 6240,
+
+     6241, 6230, 6232, 6242, 6239, 6248, 6947, 6245, 6249, 6255,
+     6256, 6947, 6259, 6257, 6261, 6260, 6258, 6947, 6262, 6264,
+     6271, 6269, 6947, 6266, 6280, 6272, 6947, 6947, 6947, 6288,
+     6290, 6291, 6947, 6947, 6947, 6947, 6293, 6294, 6282, 6297,
+     6947, 6947, 6303, 6307, 6311, 6313, 6317, 6306, 6947, 6316,
+     6318, 6320, 6322, 6323, 6947, 6947, 6324, 6326, 6328, 6329,
+     6331, 6332, 6947, 6947, 6333, 6335, 6339, 6336, 6338, 6947,
+     6341, 6344, 6351, 6347, 6354, 6361, 6363, 6357, 6364, 6365,
+     6376, 6373, 6366, 6368, 6371, 6379, 6380, 6378, 6382, 6393,
+     6388, 6390, 6396, 6386, 6398, 6947, 6947, 6400, 6947, 6405,
+
+     6402, 6947, 6947, 6407, 6409, 6413, 6415, 6947, 6417, 6419,
+     6421, 6423, 6410, 6947, 6424, 6426, 6428, 6429, 6430, 6431,
+     6947, 6435, 6437, 6440, 6432, 6441, 6443, 6444, 6449, 6947,
+     6446, 6453, 6947, 6947, 6450, 6457, 6458, 6462, 6459, 6947,
+     6464, 6471, 6466, 6469, 6470, 6472, 6475, 6947, 6473, 6476,
+     6947, 6947, 6478, 6481, 6947, 6947, 6483, 6947, 6947, 6947,
+     6947, 6947, 6947, 6947, 6947, 6487, 6494, 6947, 6947, 6486,
+     6501, 6503, 6947, 6505, 6947, 6488, 6498, 6506, 6493, 6947,
+     6508, 6947, 6495, 6512, 6514, 6298, 6515, 6516, 6520, 6521,
+     6524, 6525, 6526, 6528, 6527, 6532, 6529, 6531, 6545, 6538,
+
+     6535, 6548, 6947, 6947, 6947, 6546, 6539, 6557, 6549, 6562,
+     6563, 6566, 6568, 6554, 6569, 6571, 6570, 6572, 6576, 6578,
+     6585, 6580, 6583, 6581, 6588, 6582, 6591, 6947, 6597, 6584,
+     6592, 6604, 6947, 6598, 6947, 6600, 6947, 6947, 6606, 6607,
+     6609, 6610, 6620, 6621, 6612, 6619, 6616, 6622, 6624, 6947,
+     6631, 6947, 6947, 6625, 6628, 6947, 6633, 6634, 6947, 6636,
+     6637, 6639, 6640, 6641, 6643, 6644, 6645, 6652, 6947, 6947,
+     6655, 6659, 6657, 6661, 6663, 6670, 6665, 6667, 6669, 6673,
+     6671, 6685, 6947, 6681, 6682, 6684, 6947, 6688, 6686, 6689,
+     6691, 6693, 6700, 6695, 6698, 6947, 6701, 6947, 6704, 6697,
+
+     6708, 6699, 6707, 6715, 6716, 6719, 6720, 6947, 6721, 6722,
+     6725, 6729, 6731, 6734, 6735, 6727, 6737, 6738, 6748, 6741,
+     6745, 6749, 6751, 6753, 6754, 6947, 6760, 6755, 6947, 6757,
+     6761, 6763, 6764, 6767, 6947, 6772, 6765, 6769, 6775, 6778,
+     6779, 6947, 6781, 6790, 6785, 6947, 6791, 6947, 6947, 6793,
+     6787, 6794, 6800, 6802, 6947, 6947, 6947, 6827, 6834, 6841,
+     6848, 6855, 6862, 6869,   88, 6876, 6883, 6890, 6897, 6904,
+     6911, 6918, 6925, 6932, 6939
     } ;
 
-static yyconst flex_int16_t yy_def[3502] =
+static yyconst flex_int16_t yy_def[3576] =
     {   0,
-     3483,    1, 3484, 3484, 3485, 3485, 3486, 3486, 3487, 3487,
-     3488, 3488, 3489, 3489, 3490, 3490, 3483, 3491, 3483, 3483,
-     3483, 3483, 3492, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3493, 3483, 3483, 3483,
-     3493, 3494, 3483, 3483, 3483, 3494, 3495, 3483, 3483, 3483,
-     3483, 3495, 3496, 3483, 3483, 3483, 3496, 3497, 3483, 3498,
-     3483, 3497, 3497, 3499, 3483, 3483, 3483, 3483, 3499, 3500,
-     3483, 3483, 3483, 3500, 3491, 3491, 3483, 3501, 3492, 3501,
-     3492, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3493,
-     3493, 3494, 3494, 3495, 3495, 3483, 3496, 3496, 3497, 3497,
-     3498, 3498, 3497, 3499, 3499, 3483, 3500, 3500, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3483, 3483, 3491, 3483, 3483, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3497, 3497, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483,
-
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3497, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3483, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3497, 3491, 3483, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3483, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3497, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491,
-     3491, 3491, 3491, 3491, 3483, 3483, 3491, 3483, 3491, 3483,
-     3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3483, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3483, 3491, 3491, 3491, 3483, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-
-     3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3483, 3491, 3491, 3497, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491,
-     3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3483, 3483, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483,
-     3483, 3491, 3491, 3491, 3483, 3491, 3491, 3483, 3491, 3483,
-     3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-
-     3483, 3483, 3491, 3491, 3483, 3491, 3483, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3483, 3491, 3483, 3491, 3491, 3491,
-
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483, 3483, 3491,
-     3491, 3491, 3483, 3483, 3483, 3483, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491,
-     3483, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3483, 3491, 3483, 3491, 3491, 3483,
-     3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483,
-     3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483, 3483, 3491,
-     3491, 3483, 3483, 3491, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3483, 3491,
-
-     3483, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491,
-     3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3483, 3491,
-     3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491,
-
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491,
-     3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491,
-     3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491,
-     3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491,
-     3491, 3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491,
-     3483, 3483,    0, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-
-     3483
+     3557,    1, 3558, 3558, 3559, 3559, 3560, 3560, 3561, 3561,
+     3562, 3562, 3563, 3563, 3564, 3564, 3557, 3565, 3557, 3557,
+     3557, 3557, 3566, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3567, 3557, 3557, 3557,
+     3567, 3568, 3557, 3557, 3557, 3568, 3569, 3557, 3557, 3557,
+     3557, 3569, 3570, 3557, 3557, 3557, 3570, 3571, 3557, 3572,
+     3557, 3571, 3571, 3573, 3557, 3557, 3557, 3557, 3573, 3574,
+     3557, 3557, 3557, 3574, 3565, 3565, 3557, 3575, 3566, 3575,
+     3566, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3567,
+     3567, 3568, 3568, 3569, 3569, 3557, 3570, 3570, 3571, 3571,
+     3572, 3572, 3571, 3573, 3573, 3557, 3574, 3574, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3571, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557,
+     3557, 3565, 3557, 3557, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3571, 3571, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3571, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3571, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3571, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565,
+
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3571, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3557, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3571, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565, 3557,
+
+     3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3571, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3557, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3557,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3557, 3557, 3565, 3565, 3565, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3557, 3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3557, 3557, 3557, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3557, 3557, 3557, 3565, 3565, 3565, 3557, 3565, 3565, 3557,
+
+     3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3557, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3557, 3565,
+     3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3557, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3557, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3557, 3557, 3557, 3565,
+     3565, 3565, 3557, 3557, 3557, 3557, 3565, 3565, 3565, 3565,
+     3557, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565,
+
+     3565, 3557, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565,
+     3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3557, 3557, 3565, 3565, 3557, 3557, 3565, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3565, 3565, 3557, 3557, 3565,
+     3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3557,
+     3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+
+     3565, 3565, 3557, 3557, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3557, 3565, 3557, 3565, 3557, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557,
+     3565, 3557, 3557, 3565, 3565, 3557, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565,
+
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565,
+     3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565,
+     3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565,
+     3565, 3557, 3565, 3565, 3565, 3557, 3565, 3557, 3557, 3565,
+     3565, 3565, 3565, 3565, 3557, 3557,    0, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557
     } ;
 
-static yyconst flex_int16_t yy_nxt[6834] =
+static yyconst flex_int16_t yy_nxt[6988] =
     {   0,
        18,   19,   20,   21,   22,   23,   22,   18,   18,   18,
        18,   18,   22,   24,   25,   26,   27,   28,   29,   30,
@@ -1626,7 +1648,7 @@ static yyconst flex_int16_t yy_nxt[6834] =
        86,  227,  225,  223,   86,   86,  216,  229,  224,   86,
        86,  219,   86,  222,  230,  232,  233,  228,   86,   86,
        86,   86,  231,  235,   86,  237,   86,  240,  234,  238,
-       86,   86,   86,   86,  242,   86,  236,  370,   86,   86,
+       86,   86,   86,   86,  242,   86,  236,  371,   86,   86,
        86,  239,   86,  243,  241,  248,  251,  252,   86,  244,
       253,  247,   86,   86,   86,  254,  249,  246,  260,  257,
 
@@ -1646,701 +1668,717 @@ static yyconst flex_int16_t yy_nxt[6834] =
       311,   86,   86,   86,   86,  307,   86,  318,   86,   86,
        86,  319,   86,  325,  312,  313,  315,  309,  314,  316,
        86,  320,   86,  329,  321,  328,  322,  330,  327,  326,
-      332,   86,   86,   86,  736,  334,   86,  338,  323,  331,
+      332,   86,   86,   86,  741,  334,   86,  338,  323,  331,
       324,   86,  335,   86,   86,  340,   86,  342,   86,  339,
-      341,   86,  333,   86,   86,   86,  344,  336,   86,   86,
-       86,  343,   86,   86,  346,   86,  348,   86,  345,   86,
-       86,   86,   86,  351,  353,   86,  349,  358,   86,  347,
-
-      352,  354,  359,   86,   86,  350,  355,   86,   86,  360,
-      357,  356,  362,  364,   86,  367,  361,   86,   86,   86,
-       86,   86,  373,  369,   86,   86,   86,   86,   86,  363,
-      374,  372,  365,  366,  376,   86,   86,  368,  377,  371,
-       86,  378,   86,  379,  375,  380,   86,  381,  383,   86,
-       86,  384,  170,   86,   86,  387,   86,   86,  386,   86,
-       86,   86,   86,  394,  388,  390,  392,  395,  385,   86,
-       86,  382,   86,   86,  398,  389,   86,  396,   86,  391,
-       86,  397,   86,  393,   86,  399,   86,  404,   86,  405,
-      409,  406,  400,   86,  403,   86,   86,   86,  402,  407,
-
-      401,   86,  408,   86,  411,   86,  412,   86,   86,   86,
-       86,  415,   86,   86,  410,  419,  416,   86,  175,  417,
-      421,   86,  418,  413,  414,   86,   86,  422,  423,   86,
-       86,  420,   86,  424,   86,   86,  426,  427,  428,  429,
-       86,   86,   86,   86,   86,   86,   86,  435,  432,   86,
-      425,   86,  436,   86,   86,  434,   86,  438,   86,  441,
-      431,  437,  433,   86,  430,   86,  443,  446,   86,   86,
-      439,  447,  440,   86,  442,   86,   86,  445,   86,   86,
-      457,  448,   86,  444,   86,  455,   86,   86,  170,  462,
-      458,  463,  459,  449,  464,   86,  450,  456,  469,  470,
-
-       86,  451,  452,  453,  454,  460,  467,   86,  461,  465,
-      466,  468,   86,   86,   86,   86,   86,   86,  478,   86,
-       86,   86,   86,  480,  476,  477,  479,   86,  481,  473,
-      471,   86,   86,  472,  474,  475,   86,  483,   86,  485,
-       86,  488,   86,  489,   86,  490,  482,   86,  484,   86,
-      506,   86,   86,  494,  491,  487,  493,  495,  486,   86,
-       86,   86,   86,   86,  492,  496,  498,   86,  499,   86,
-      501,  497,  170,  507,   86,  500,  508,   86,  505,   86,
-       86,   86,  522,  502,   86,  509,  503,  523,  504,   86,
-      510,   86,  511,  545,   86,   86,  525,   86,  512,  569,
-
-      528,  168,  513,   86,   86,  524,  526,  514,  527,  530,
-      515,   86,  516,  540,  517,  541,  529,   86,  539,   86,
-      542,   86,   86,   86,   86,   86,  548,  518,   86,  543,
-      519,  166,  520,   86,  521,   86,  544,  531,  532,  547,
-      550,  546,  553,   86,  549,  551,   86,  533,  534,  535,
-      536,  537,  554,  552,  538,   86,   86,   86,   86,   86,
-      556,  563,  555,  558,  561,   86,   86,   86,   86,  564,
-       86,   86,  560,  568,   86,   86,  559,   86,  557,   86,
-      562,   86,  566,   86,   86,  567,  565,   86,  571,  578,
-      570,  572,  573,  575,   86,  574,   86,  576,  577,   86,
-
-      582,  579,  580,   86,   86,  585,   86,  583,   86,   86,
-       86,  601,   86,   86,   86,   86,  165,   86,  603,  581,
-      591,  592,  584,  587,  602,  586,  588,  589,  590,   86,
-       86,  606,  593,  604,  594,   86,   86,   86,   86,  605,
-      595,   86,   86,   86,  608,  609,  610,  611,  596,  597,
-       86,   86,  598,  599,   86,  613,  600,  607,  615,   86,
-       86,   86,   86,  618,  614,  616,  619,   86,   86,   86,
-      612,  620,   86,   86,  617,   86,   86,  625,  623,   86,
-      624,   86,   86,  621,   86,  626,   86,   86,   86,  631,
-      622,  627,  632,   86,   86,   86,  630,  633,   86,  635,
-
-      629,  628,   86,   86,  638,   86,  634,  636,   86,  637,
-       86,  640,   86,   86,   86,   86,  642,  639,   86,  645,
-       86,  643,   86,   86,   86,   86,  641,  653,   86,  656,
-      647,   86,   86,   86,  644,  646,   86,  654,  648,  652,
-      649,  650,  651,  655,  658,  657,  661,  659,   86,   86,
-       86,  660,  663,   86,   86,  666,   86,  665,   86,   86,
-       86,   86,   86,   86,  669,  662,   86,  672,   86,   86,
-      668,  673,   86,  664,   86,   86,   86,  675,   86,  667,
-       86,   86,  670,  671,  674,  690,   86,  677,  678,   86,
-      676,   86,  679,  689,   86,   86,  687,  680,  694,  681,
-
-      692,  688,  693,   86,   86,  682,   86,  683,  691,  695,
-      684,  685,   86,  696,   86,   86,   86,  686,  697,  698,
-      702,  701,  699,   86,   86,  700,   86,  706,   86,   86,
-      704,  703,  705,   86,  709,   86,  711,   86,   86,   86,
-       86,   86,  715,   86,   86,   86,  707,   86,  708,  718,
-      713,   86,  712,   86,  710,  714,  719,   86,  716,  722,
-       86,  724,  726,  170,  720,  717,  721,  725,   86,  723,
-       86,   86,   86,   86,   86,   86,   86,   86,   86,   86,
-      733,  735,  727,  746,   86,   86,  728,  730,   86,  731,
-      734,  729,  737,  732,  738,   86,  739,  740,  741,   86,
-
-      742,   86,   86,   86,   86,   86,  743,   86,  747,   86,
-      163,   86,   86,  744,  752,  765,  745,   86,  748,  753,
-       86,  755,   86,  751,  754,  749,  756,   86,  750,  757,
-      758,   86,  759,   86,  760,   86,  761,   86,  763,   86,
-       86,  762,   86,   86,  766,   86,   86,   86,   86,  764,
-      769,  770,   86,  768,   86,  774,  773,   86,   86,   86,
-       86,   86,  767,  776,   86,  778,   86,  780,   86,   86,
-       86,  771,   86,  772,   86,  783,  777,  775,  779,   86,
-      787,   86,   86,  781,   86,   86,   86,  788,  790,   86,
-      782,  784,   86,  791,  786,  785,  792,  793,  789,  794,
-
-       86,  795,   86,   86,   86,   86,  802,  796,  797,  798,
-      799,   86,   86,   86,   86,   86,  800,  804,  801,  805,
-      803,   86,   86,   86,   86,  808,  807,   86,  809,  810,
-       86,   86,   86,   86,  812,   86,  814,  816,   86,   86,
-       86,  806,  811,  813,  817,   86,   86,  823,   86,  161,
-       86,  825,  815,   86,  819,  821,  820,  822,  818,   86,
-      826,  827,   86,   86,   86,  824,   86,  828,  830,   86,
-       86,  829,  834,  836,  832,   86,  831,   86,   86,   86,
-      835,   86,   86,   86,  837,  840,   86,  839,   86,  833,
-      841,   86,  847,  844,   86,   86,  842,   86,   86,  843,
-
-       86,   86,  838,   86,  849,  850,  854,  845,  846,   86,
-      852,   86,   86,  848,  856,   86,  862,  851,  853,   86,
-       86,  855,   86,  860,  857,   86,  863,  858,  861,   86,
-       86,   86,  864,  866,   86,   86,   86,  859,  865,   86,
-      872,   86,   86,  867,   86,  873,   86,   86,   86,   86,
-       86,  874,  868,  869,  881,  870,  879,   86,   86,  871,
-       86,   86,  875,  876,   86,   86,   86,  877,   86,  878,
-       86,   86,  880,   86,   86,  883,  884,  888,  882,   86,
-       86,   86,   86,   86,  885,  896,  889,  886,  895,  887,
-      890,   86,  897,   86,   86,   86,  899,  891,  892,  893,
-
-      894,   86,   86,   86,   86,  898,  901,  903,  902,   86,
-       86,   86,  900,   86,   86,   86,  908,  907,   86,  904,
-      909,   86,  906,  905,   86,  914,  911,   86,   86,  912,
-       86,   86,  170,  913,  919,   86,  915,  920,  910,  917,
-       86,   86,  916,  918,  921,   86,   86,   86,   86,  922,
-      925,   86,  928,   86,   86,  929,  924,  931,   86,   86,
-      923,   86,  926,  930,  932,   86,   86,  935,   86,   86,
-      933,   86,  927,   86,   86,  937,  941,   86,   86,   86,
-      938,   86,   86,   86,  934,  942,  936,   86,  943,   86,
-       86,   86,  940,   86,  939,   86,  944,  957,   86,  956,
-
-       86,  958,  954,  946,  945,   86,  955,  947,   86,  959,
-      948,   86,   86,  967,  949,  961,  965,  950,   86,  962,
-       86,  963,   86,   86,  951,  952,  968,  953,  960,   86,
-       86,   86,   86,  964,   86,  977,   86,  966,   86,  969,
-      970,   86,  971,   86,   86,  972,  984,  980,  982,  976,
-      973,   86,  978,   86,  979,   86,  974,  975,  981,   86,
-      986,  990,   86,   86,  983,  989,  991,   86,  987,   86,
-      985,   86,  993,   86,   86, 1001,  992,   86,  994,  995,
-       86,  996,  997,   86,  988,   86,  998, 1000,   86,   86,
-      999,   86,   86,   86,   86,   86, 1004,   86, 1008,   86,
-
-       86, 1002, 1007,   86,   86, 1011,   86,   86, 1017,   86,
-     1003, 1013, 1015, 1005, 1006, 1009,   86, 1010,   86,   86,
-     1018, 1016,   86,   86, 1012, 1019,   86, 1020, 1021, 1014,
-     1023, 1028,   86, 1025,   86,   86,   86, 1024, 1022,   86,
-       86, 1027,   86, 1026, 1029,   86, 1030,   86,   86,   86,
-     1031,   86,   86,   86, 1033,   86, 1038,   86, 1034,   86,
-     1041,   86,   86,   86,   86,   86, 1032, 1042, 1039, 1036,
-     1035, 1040,   86,   86, 1037,   86,   86, 1047,   86,   86,
-       86, 1043, 1049,   86, 1044, 1045,   86, 1048, 1046,   86,
-     1052, 1050, 1053, 1055, 1051,   86, 1057,   86, 1056,   86,
-
-       86,   86, 1054,   86,   86,   86,   86,   86, 1063, 1065,
-     1060,   86, 1058, 1066,   86,   86, 1064,   86,   86, 1059,
-     1068,   86, 1062,   86,   86,   86, 1070, 1061,   86, 1079,
-       86,   86, 1067, 1074, 1076,   86,   86,   86, 1069,   86,
-     1072, 1071,   86, 1073,   86, 1080, 1077,   86, 1075, 1081,
-     1078,   86, 1085, 1084,   86,   86, 1083,   86, 1082, 1087,
-     1088,   86,   86,   86,   86, 1086,   86,   86,   86, 1098,
-       86, 1091, 1093, 1099, 1089,   86, 1101, 1090,   86,   86,
-       86,   86,   86, 1092,   86, 1104, 1094, 1096, 1106, 1095,
-     1097,   86, 1100, 1105, 1102,   86,   86,   86,   86,   86,
-
-     1113, 1103, 1110,   86, 1112, 1114,   86,   86, 1108,   86,
-     1115,   86,   86,   86, 1107, 1118, 1109, 1120,   86, 1111,
-       86,   86,   86,   86,   86, 1117,   86, 1116, 1122, 1123,
-     1126,   86, 1130, 1119,   86, 1127,  170, 1128, 1121,   86,
-       86,   86, 1124, 1129, 1125, 1133, 1131,   86,   86,   86,
-       86,   86,   86, 1146, 1132,   86, 1149,   86,   86, 1147,
-     1134,   86, 1136, 1137,   86, 1151,   86, 1175,   86, 1138,
-       86, 1135, 1139,   86,   86, 1154, 1140,   86, 1141, 1148,
-     1156, 1152, 1142, 1150, 1143, 1157,   86,   86, 1153, 1144,
-       86, 1155,   86,   86, 1145,   86, 1158, 1160,   86,   86,
-
-     1163,   86,   86, 1166, 1159,   86,   86, 1162,   86, 1161,
-     1164, 1165, 1171,   86, 1173, 1167, 1174, 1170, 1172, 1169,
-       86, 1176,   86, 1168, 1177,   86,   86,   86,   86,   86,
-       86,   86,   86,   86, 1189,   86, 1192,   86,   86,   86,
-     1188, 1194, 1193,   86, 1191,   86, 1179, 1178,   86, 1180,
-       86, 1181, 1190,   86, 1200, 1195, 1182, 1196, 1183,   86,
-       86, 1199,   86,   86, 1184,   86,   86, 1197, 1201, 1185,
-     1186, 1202, 1198,   86, 1207,   86, 1187,   86,   86, 1210,
-     1203, 1204, 1208,   86, 1205,   86, 1211,   86,   86,   86,
-     1215, 1206,   86, 1213,   86,   86,   86, 1209,   86, 1216,
-
-       86,   86, 1214, 1221, 1218,   86, 1212, 1219,   86,   86,
-     1222, 1217,   86, 1224,   86,   86, 1220,   86,   86,   86,
-       86,   86,   86,   86, 1223, 1231,   86, 1229, 1226, 1228,
-     1230,   86, 1225, 1233,   86, 1227, 1237, 1232, 1234,   86,
-     1235,   86,   86, 1236,   86,   86,   86,   86,   86,  178,
-     1242, 1243, 1244, 1238,   86, 1239,   86, 1245, 1247, 1241,
-     1240,   86, 1246, 1248,   86,   86,   86, 1252,   86,   86,
-       86, 1249, 1253,   86,   86,   86, 1254, 1256, 1250, 1255,
-       86,   86, 1251, 1257,   86, 1263, 1259,   86, 1258, 1265,
-       86,   86,   86,   86, 1261,   86,   86, 1267, 1260, 1262,
-
-       86,   86,   86, 1269,   86, 1266, 1271, 1264,   86, 1272,
-     1268,   86,   86,   86, 1270,   86, 1275, 1274, 1273, 1278,
-     1276,   86,   86, 1281, 1277, 1282,   86,   86, 1280,   86,
-       86,   86,   86, 1286, 1285,   86, 1283, 1279,   86,   86,
-       86,   86,   86, 1290, 1292, 1293, 1296, 1294, 1284,   86,
-       86,   86,   86, 1287, 1291,   86,   86, 1288, 1298, 1289,
-     1295, 1297,   86,   86,   86, 1302,   86, 1299,   86, 1301,
-       86,   86,   86, 1303, 1304,   86,   86,   86,   86, 1305,
-     1309, 1300,   86,   86, 1307, 1306, 1310, 1312,   86, 1311,
-       86, 1308,   86, 1316, 1317,   86,   86, 1320,   86,   86,
-
-       86, 1319, 1314,   86,   86,   86, 1313,   86, 1325,   86,
-     1318, 1315,   86,   86,   86,   86,   86, 1323, 1322, 1331,
-       86,   86, 1321, 1327,  170, 1324,   86, 1326,   86, 1332,
-       86, 1333, 1328, 1334,   86, 1330,   86,   86,   86,   86,
-     1329, 1339, 1341,   86, 1335, 1337, 1343, 1340, 1336, 1338,
-     1344,   86,   86,   86,   86,   86,   86, 1347, 1346, 1342,
-       86,   86,   86,   86,   86, 1348,   86, 1345, 1349, 1351,
-       86,   86,   86, 1354,   86, 1350,   86, 1352, 1357,   86,
-       86,   86, 1353,   86,  176, 1355, 1358, 1361, 1363,   86,
-     1356, 1360, 1359, 1367,   86, 1368,   86, 1364,   86, 1365,
-
-     1362, 1369, 1366, 1370,   86, 1371,   86,   86,   86,   86,
-     1373,   86,   86,   86,   86,  175,   86, 1377, 1376,   86,
-     1372, 1380,   86,   86, 1384,   86, 1379, 1374,   86, 1375,
-       86,   86, 1378, 1381, 1382, 1385, 1386,   86,   86,   86,
-       86, 1383, 1388, 1389,   86,   86,   86, 1390, 1387,   86,
-       86,   86,   86,   86,   86, 1391, 1396,   86, 1394, 1392,
-       86,   86, 1403, 1397, 1393, 1395, 1401,   86,   86,   86,
-       86, 1398, 1400,   86, 1399,   86, 1402, 1404, 1406,   86,
-       86,   86, 1413,   86, 1415, 1407,   86, 1405,   86,   86,
-       86, 1409, 1408,   86, 1410,   86, 1412, 1418,   86,   86,
-
-       86, 1416,   86, 1414, 1421, 1411,   86, 1417,   86,   86,
-     1501, 1423, 1422,   86, 1420, 1419, 1424,   86,   86, 1428,
-     1426, 1425, 1427,   86, 1429,   86, 1436, 1438, 1430,   86,
-     1439, 1431, 1432,   86, 1437,   86, 1433, 1442,   86,   86,
-     1440,   86, 1434,   86, 1443,   86, 1435, 1441,   86, 1445,
-     1444,   86, 1447,   86,   86,   86, 1448, 1452, 1449,   86,
-       86,   86, 1446,   86,   86,   86, 1455,   86, 1453, 1458,
-     1459,   86, 1460, 1451, 1450,   86,   86,   86, 1456,   86,
-     1454, 1461,   86, 1457,   86, 1468,   86, 1467, 1462,   86,
-     1469, 1470, 1471, 1463,   86, 1464,   86, 1465,   86, 1466,
-
-       86, 1474, 1473,   86, 1477,   86, 1480, 1472,   86, 1478,
-       86,   86, 1476, 1481, 1479,   86,   86,   86, 1475,   86,
-     1487,   86, 1488,   86, 1483, 1482,   86,   86,   86,   86,
-       86, 1489,   86, 1486, 1491, 1484, 1485,   86,   86, 1493,
-       86, 1490, 1492,   86, 1494, 1497, 1498,   86, 1500,   86,
-     1495,   86,   86,   86, 1502,   86,   86, 1503, 1499, 1506,
-       86, 1508,   86, 1496, 1505,   86, 1509,   86,   86,   86,
-     1513,   86, 1504, 1510,   86,   86, 1507,   86,   86, 1518,
-     1516,   86,   86,   86,   86,   86, 1519,   86, 1511, 1521,
-     1512, 1520, 1515,   86, 1514,   86, 1523,   86, 1517, 1524,
-
-     1525, 1522,   86,   86,   86,   86,   86, 1527, 1529, 1530,
-     1531, 1526, 1528,   86, 1532,   86,   86,   86,   86,   86,
-     1533, 1538, 1539, 1535,   86, 1536,   86,   86,   86, 1540,
-     1542, 1541, 1537,   86, 1534,   86,   86,   86, 1546,   86,
-       86,   86, 1543,   86,  170,   86, 1548,   86, 1545,   86,
-     1554, 1555,   86,   86, 1544, 1550,   86,   86, 1556, 1551,
-     1547, 1549, 1557,   86,   86,   86,   86, 1552,   86,   86,
-       86, 1565, 1553, 1560,   86,   86,   86, 1558, 1562, 1563,
-       86, 1569,   86, 1559, 1561, 1570,   86, 1564,   86,   86,
-     1574,   86,   86, 1572, 1566, 1575,   86,   86, 1568,   86,
-
-     1567, 1577,   86,   86,   86, 1571,   86, 1578, 1573, 1576,
-       86, 1579, 1586, 1585,   86,   86,   86, 1580, 1581, 1583,
-     1587, 1582, 1584, 1588,   86, 1591, 1590,   86, 1589,   86,
-     1592,   86,   86,   86,   86, 1593,   86,   86, 1596, 1597,
-       86,   86,   86,  170,   86, 1600,   86,   86, 1605,   86,
-     1595,   86,   86, 1594, 1598, 1606, 1602, 1599,   86, 1609,
-       86, 1601, 1603,   86, 1604,   86,   86, 1607,   86,   86,
-     1610, 1608,   86,   86,   86,   86,   86, 1612, 1616, 1611,
-       86, 1613, 1617, 1614,   86, 1618,   86, 1622, 1615,   86,
-     1619, 1623,   86, 1621, 1627, 1620,   86, 1626, 1624, 1628,
-
-       86,   86,   86, 1630,   86,   86, 1631,   86,   86,   86,
-     1632,   86, 1625, 1636, 1637, 1629, 1635, 1638,   86,   86,
-       86,   86, 1639,   86, 1633,   86, 1640, 1641,   86,   86,
-     1634,   86,   86, 1642,   86,   86, 1644,   86,   86,   86,
-     1643,   86, 1649,   86, 1645, 1648,   86, 1651, 1646,   86,
-     1647, 1652,   86, 1655,   86, 1657,   86, 1650, 1656,   86,
-     1658,   86, 1654, 1653,   86, 1660,   86,   86,   86,   86,
-       86, 1664, 1659, 1661, 1668, 1662, 1663,   86,   86,   86,
-       86,   86, 1669,   86, 1672,   86, 1675, 1665, 1667, 1666,
-       86, 1674,   86,   86,   86,   86,   86,   86, 1670,   86,
-
-     1673,   86, 1676,   86, 1683, 1671,   86,   86,   86, 1684,
-     1680, 1687, 1677, 1678, 1679,   86, 1682,   86, 1681, 1688,
-       86, 1689,   86,   86, 1693,   86, 1685, 1686, 1690, 1691,
-     1692,   86,   86,   86, 1695,   86,   86,   86, 1696,   86,
-       86, 1699, 1703,   86, 1694, 1704, 1705,   86, 1700,   86,
-       86, 1697,   86, 1698, 1708, 1702,   86, 1701,   86,   86,
-     1709,   86, 1706, 1707,   86, 1710,   86,   86, 1715, 1716,
-       86,   86,  168, 1713,   86,   86,   86, 1712, 1711,   86,
-     1719,   86, 1720, 1721,   86, 1717, 1714, 1723,   86,   86,
-       86,   86, 1718, 1724, 1725,   86, 1722,   86,   86, 1730,
-
-     1726, 1728,   86,   86,   86, 1733,   86, 1727,   86,   86,
-       86, 1731,   86,   86, 1739, 1737,   86,   86, 1729,   86,
-       86, 1734,   86, 1732,   86, 1740, 1738,   86, 1736, 1735,
-       86, 1745,   86,   86, 1742, 1741,   86,   86, 1746, 1750,
-       86, 1748, 1744,   86,   86, 1743,   86, 1751, 1749, 1754,
-     1747,   86, 1753,   86,   86,   86,   86, 1752, 1757, 1761,
-     1759, 1760,   86, 1755, 1756, 1758,   86,   86,  170,   86,
-       86,   86, 1763,   86,   86,   86, 1771,   86,   86, 1762,
-       86,   86, 1772, 1777, 1764, 1766,   86, 1765, 1769, 1767,
-     1768, 1775,   86,   86,   86, 1776, 1779,   86, 1770, 1781,
-
-     1773, 1774, 1780,   86, 1783,   86,   86, 1785,   86,   86,
-       86,   86,   86, 1778,   86,   86, 1790, 1787,   86, 1788,
-     1784,   86, 1791, 1782,   86,   86,   86,   86, 1786, 1795,
-       86, 1796, 1792,   86,   86,   86, 1789, 1803,   86,  166,
-     1794, 1800, 1793,   86, 1801, 1797, 1798,   86,   86,   86,
-       86, 1805, 1804, 1799,   86, 1808, 1802, 1810, 1807, 1812,
-     1809, 1811,   86, 1813, 1817,   86,   86, 1806,   86,   86,
-       86, 1814,   86, 1815,   86, 1816,   86,   86,   86,   86,
-       86, 1818, 1824, 1823,   86, 1825, 1820, 1827,   86, 1826,
-     1819,   86,   86,   86,   86,   86,   86, 1821,   86, 1822,
-
-     1829, 1830,   86, 1831,   86,   86,   86,   86,   86,   86,
-       86,   86, 1832,   86,   86, 1828, 1833, 1841,   86,   86,
-     1836, 1837, 1838, 1834,   86, 1835, 1842, 1839,   86,   86,
-     1843, 1845,   86, 1848, 1849, 1840, 1844,   86, 1851,   86,
-     1846,   86,   86, 1854,   86, 1847,   86,   86,   86,   86,
-     1858,   86, 1856, 1850,   86, 1852,   86,   86,   86,   86,
-     1857,   86,   86, 1853,   86, 1860, 1855, 1863, 1865, 1859,
-       86,   86,  165, 1866, 1864, 1862, 1867,   86, 1868,   86,
-     1861,   86, 1872, 1873,   86, 1869, 1874,   86,   86, 1875,
-     1870, 1877, 1878,   86,   86,   86, 1871,   86,   86, 1876,
-
-       86, 1882, 1881,   86,   86, 1883,   86, 1879,   86,   86,
-       86, 1891, 1892,   86, 1880, 1886,   86,   86, 1888, 1890,
-     1885, 1889, 1884,   86,   86,   86,   86, 1887, 1898,   86,
-       86,   86,   86, 1899,   86, 1900, 1893, 1894,   86, 1896,
-       86, 1895, 1897, 1901,   86, 1904,   86, 1906,   86, 1908,
-     1903, 1907,   86,   86, 1902,   86, 1905,   86, 1912,   86,
-     1916, 1910,   86, 1909, 1911, 1917,   86,   86,   86,   86,
-       86, 1924,   86, 1913, 1921, 1922, 1918, 1915, 1914, 1925,
-       86,   86, 1919,   86,   86,   86, 1928,   86, 1923, 1926,
-     1920,   86,   86, 1929, 1927, 1932,   86,   86, 1936,   86,
-
-     1934,   86,   86, 1930,   86, 1931, 1935, 1937,   86, 1933,
-       86,   86,   86,   86,   86,   86, 1941,   86, 1940,   86,
-     1950, 1938, 1942, 1944,   86, 1943,   86, 1939, 1945, 1948,
-       86, 1946, 1951, 1947, 1953,   86,   86, 1952,   86,   86,
-       86, 1957,   86, 1959,   86,   86,   86,   86,   86,   86,
-       86, 1949, 1963,   86, 1965,   86, 1954, 1955, 1958, 1956,
-     1966,   86, 1961,   86,   86, 1962, 1960,   86, 1964, 1968,
-       86,   86, 1969,   86,   86,  170, 1974,   86,   86, 1970,
-       86, 1967, 1972, 1973, 1977,   86, 1971, 1975,   86, 1981,
-       86,   86, 1976,   86,   86,   86,   86, 1978,   86, 1980,
-
-     1979, 1983,   86, 1988,   86, 1982,   86, 1984, 1985,   86,
-       86, 1995, 1986,   86, 1989, 2000, 1991,   86, 1987, 1992,
-       86,   86, 1990,   86, 1993, 1994,   86, 1997, 1998,   86,
-       86,   86, 1996,   86, 2001,   86,   86, 2002,   86,   86,
-       86,   86, 1999,   86, 2006, 2007,   86,   86,   86,   86,
-     2008,   86, 2011,   86, 2004, 2009, 2005, 2003, 2012,   86,
-       86, 2010, 2019,   86, 2017, 2015, 2018, 2020, 2014,   86,
-       86, 2013, 2016,   86, 2021,   86,   86,   86,   86, 2026,
-       86, 2029, 2030,   86, 2031,   86,   86,   86, 2022, 2023,
-       86, 2024, 2027,   86, 2028,   86, 2025, 2033,   86,   86,
-
-     2034, 2037,   86,   86, 2039,   86, 2032, 2038, 2035,   86,
-       86, 2036, 2040, 2041, 2043, 2048,   86,   86, 2045,   86,
-       86, 2044,   86, 2042,   86, 2046, 2047,   86,   86, 2049,
-     2050,   86, 2051,   86,   86,   86, 2055,   86, 2053, 2054,
-     2057,   86, 2056,   86,   86,   86,   86,   86,  163, 2052,
-     2065,   86, 2067, 2058, 2059, 2060,   86, 2068,   86,   86,
-     2061,   86, 2063, 2062,   86, 2064, 2070, 2066,   86, 2074,
-     2071,   86, 2072, 2069,   86,   86,   86, 2078,   86, 2073,
-     2075,   86,   86, 2080,   86,   86,   86,   86, 2083, 2084,
-       86, 2086,   86,   86, 2076,   86, 2091, 2077,   86,   86,
-
-       86,   86,   86,   86, 2081, 2085,   86, 2079, 2082, 2088,
-     2089, 2093,   86,   86, 2092,   86, 2090,   86, 2087,   86,
-     2094, 2095, 2096,   86, 2099,   86, 2097, 2103,   86, 2098,
-     2102,   86,   86,   86, 2106, 2101, 2109,   86, 2105, 2100,
-       86,   86,   86, 2107, 2110,   86, 2112,   86, 2104,   86,
-       86, 2108, 2111,   86,   86,   86,   86, 2116,   86, 2119,
-     2120, 2121, 2115,   86,   86,   86,   86,   86,   86, 2113,
-       86,   86, 2114, 2117, 2124,   86, 2129,   86,   86, 2123,
-     2128,   86, 2118, 2122,   86, 2126,   86, 2130, 2133,   86,
-     2125,   86, 2134, 2127,   86, 2135, 2131, 2132, 2137,   86,
-
-       86,   86,   86, 2136, 2138, 2141,   86, 2142,   86,   86,
-       86,   86, 2139, 2148, 2145,   86, 2143, 2140,   86,   86,
-       86,   86,   86, 2151, 2153,   86, 2155, 2144,   86, 2154,
-     2146, 2147,   86, 2149, 2152, 2150,   86,   86, 2160,   86,
-     2162, 2156, 2161,   86, 2164, 2163,   86, 2157, 2165,   86,
-       86,   86, 2158,   86,   86, 2169, 2167, 2159,   86,   86,
-       86,   86,   86, 2171,   86, 2168,   86, 2173, 2175,   86,
-     2170, 2177, 2172,   86,   86, 2166,  170,   86, 2178,   86,
-       86, 2181,   86,   86,   86,   86, 2176, 2174, 2179, 2185,
-       86, 2187, 2182, 2180, 2183,   86, 2188,   86, 2186, 2189,
-
-       86, 2191, 2184,   86,   86, 2190,   86,   86,   86, 2192,
-     2194, 2193,   86,   86,   86, 2197,   86, 2195, 2196,   86,
-     2199,   86,   86, 2203,   86,   86, 2198, 2202, 2200,   86,
-       86,   86, 2207, 2201, 2204, 2205, 2206, 2208,   86,   86,
-       86,   86,   86,   86, 2215, 2213,   86,   86,   86, 2210,
-       86, 2214,   86,   86,   86, 2220,   86, 2217,   86, 2209,
-     2211,   86, 2212,   86,   86, 2216, 2221, 2219,   86, 2225,
-     2218,   86, 2223, 2226, 2222,   86,   86,   86, 2224,   86,
-     2229,   86, 2228, 2227, 2231,   86,   86,   86, 2237, 2230,
-     2232,   86,   86, 2233,   86, 2234, 2235,   86, 2239,   86,
-
-     2236, 2240, 2242,   86,   86, 2244,   86,   86, 2238,   86,
-     2241, 2248, 2243,   86, 2245, 2247,   86,   86,   86,   86,
-       86,   86, 2253, 2250,   86,   86,   86,   86,   86,   86,
-     2246,   86, 2249, 2254,   86,   86,   86, 2262, 2256, 2257,
-     2252, 2251,   86, 2258,   86,   86, 2255, 2259,   86, 2261,
-     2263, 2267,   86,   86,   86, 2260, 2264, 2266,   86, 2271,
-       86, 2270, 2268,   86,   86, 2265,   86,   86, 2269, 2273,
-       86, 2276, 2274, 2272, 2277,   86,   86,   86, 2275,   86,
-       86, 2279, 2282,   86, 2278, 2280, 2284,   86,   86, 2281,
-     2285,   86,   86, 2287,   86,   86, 2289, 2286, 2283,   86,
-
-     2291, 2290,   86,   86,   86, 2295,   86, 2292,   86,   86,
-     2299,   86,   86, 2288, 2296, 2300,   86,   86,   86, 2297,
-     2298, 2293, 2304,   86, 2294, 2301,   86, 2305,   86,   86,
-     2308, 2302, 2303,   86,   86,   86,   86, 2310, 2309,   86,
-     2314,   86,   86, 2306,   86, 2316,   86, 2312,   86, 2307,
-       86, 2317, 2311,   86, 2315, 2313,   86, 2318, 2319,   86,
-       86, 2323,   86,   86, 2320, 2321, 2325,   86, 2322,   86,
-       86, 2326,   86,   86, 2327, 2329, 2328,   86, 2331,   86,
-       86, 2324, 2330,   86, 2332, 2336,   86,   86,   86, 2334,
-     2333,   86, 2335,   86,   86,   86,   86,   86, 2337,   86,
-
-     2343,   86,   86,   86, 2339, 2338, 2347, 2341, 2344, 2342,
-       86, 2345, 2349,   86,   86, 2348, 2340, 2346,   86, 2350,
-     2352,   86,   86, 2358,   86, 2353,   86,   86, 2360,   86,
-       86,   86, 2351, 2354,   86, 2357, 2359,   86, 2363, 2355,
-       86,   86, 2364, 2367,  170,   86, 2369, 2356, 2361,   86,
-     2362, 2370,   86, 2365,   86, 2371, 2372, 2373,   86,   86,
-     2366,   86,   86, 2376,   86, 2375, 2368, 2374,   86, 2377,
-       86, 2381,   86,   86, 2382,   86, 2384,   86, 2385, 2380,
-       86, 2387, 2386, 2378,   86, 2388,   86, 2383,   86, 2390,
-       86,   86,   86, 2389, 2379,   86, 2391,   86,   86,   86,
-
-       86, 2393,   86,   86, 2396,   86,   86,   86, 2399,   86,
-     2392, 2394,   86,   86, 2403, 2398, 2405,   86,   86,   86,
-       86, 2401, 2406, 2395, 2400, 2397,   86, 2402, 2407,   86,
-       86, 2408,   86,   86, 2404,   86,   86, 2413, 2410, 2416,
-       86, 2411,   86,   86, 2417, 2409, 2414,   86,   86, 2412,
-       86,   86,   86, 2415,   86,   86,   86,   86, 2426,   86,
-       86, 2418, 2419, 2424,   86, 2430, 2433,   86, 2428, 2422,
-     2420, 2427, 2421, 2423, 2429, 2425,   86, 2432, 2431,   86,
-       86,   86,   86, 2435, 2434,   86,   86, 2439, 2440,   86,
-       86,   86, 2441,  161, 2436,   86, 2437,   86, 2438, 2442,
-
-       86,   86, 2445,   86, 2448,   86, 2443,   86, 2444, 2449,
-       86,   86, 2446,   86,   86, 2447, 2450, 2452, 2451, 2455,
-       86, 2456,   86,   86, 2458,   86, 2454, 2453,   86, 2460,
-       86,   86,   86, 2463,   86,   86, 2462, 2464,   86,   86,
-       86,   86, 2457,   86,   86,   86, 2459, 2461, 2466, 2465,
-     2470, 2471,   86, 2473,   86, 2468,   86, 2467,   86,   86,
-     2477,   86, 2469, 2472, 2475,   86, 2479,   86, 2476,   86,
-       86,   86, 2482,   86, 2474, 2478, 2485,   86,   86,   86,
-     2480,   86,   86,   86, 2481,   86, 2483, 2489, 2490,   86,
-     2492,   86, 2484,   86, 2495,   86, 2488,   86, 2486,   86,
-
-       86, 2491, 2487,   86,   86,   86, 2493, 2497, 2494,   86,
-     2502,   86,   86, 2498, 2504,   86,   86, 2496, 2505, 2508,
-     2503, 2499, 2500,   86,   86,   86,   86,   86, 2509, 2510,
-       86, 2501, 2511, 2506,   86, 2507,   86,   86,   86, 2513,
-       86, 2515, 2517, 2518, 2520,   86, 2521,   86, 2512,   86,
-       86, 2514,   86, 2524, 2525, 2519,   86,   86,   86,   86,
-     2516, 2526, 2523,   86,   86,   86, 2522, 2529,   86,   86,
-       86, 2528, 2530, 2535, 2531, 2536,   86, 2532, 2533,   86,
-     2537,   86, 2527,   86, 2534,   86,   86,   86, 2541,   86,
-     2542,   86, 2543,   86, 2546, 2540,   86,  170, 2545,   86,
-
-     2544,   86, 2547, 2538,   86, 2539, 2552,   86,   86,   86,
-       86,   86,   86,   86,   86, 2563,   86, 2550, 2554, 2548,
-     2551, 2549, 2555, 2553, 2558,   86,   86, 2556, 2557, 2559,
-     2560,   86,   86, 2564, 2561, 2565,   86,   86,   86,   86,
-     2566, 2568, 2569, 2562, 2567,   86,   86,   86,   86, 2571,
-       86,   86, 2572,   86, 2570,   86, 2573, 2578, 2574,   86,
-     2577,   86,   86,   86,   86, 2575,   86, 2580, 2581, 2582,
-     2583,   86, 2576,   86,   86, 2579,   86,   86, 2584,   86,
-       86, 2589,   86, 2585, 2588, 2586,   86,   86,   86,   86,
-       86, 2591, 2590,   86, 2595,   86, 2598, 2587,   86,   86,
-
-     2597,   86,   86, 2594, 2599,   86, 2600, 2592, 2593,   86,
-       86,   86,   86, 2596,   86, 2604,   86, 2601, 2606,   86,
-     2602, 2609,   86, 2610, 2607,   86,   86,   86, 2603,   86,
-     2608, 2613, 2605, 2611,   86,   86, 2612,   86, 2615,   86,
-     2614,   86, 2616,   86, 2618, 2619, 2620, 2621, 2622,   86,
-       86,   86,   86, 2617, 2624,   86,   86,   86,   86, 2623,
-       86,   86,   86, 2628, 2633,   86,   86, 2631,   86, 2625,
-     2626, 2632, 2635, 2627, 2634,   86,   86, 2636,   86,   86,
-       86,   86, 2630,   86, 2637, 2639, 2629,   86, 2644,   86,
-     2641,   86, 2646,   86,   86, 2642,   86,   86,   86,   86,
-
-     2640, 2638, 2645, 2643, 2649,   86,   86,   86, 2653, 2650,
-       86, 2648, 2647, 2654,   86, 2655, 2651, 2652,   86,   86,
-       86,   86,   86, 2659,   86, 2658,   86,   86, 2657,   86,
-       86,   86, 2663, 2703, 2662,   86, 2656,   86, 2660,   86,
-     2661,   86, 2666, 2667,   86, 2668,   86, 2669,   86, 2664,
-     2665, 2670,   86, 2671,   86,   86, 2674, 2672,   86, 2673,
-       86, 2675,   86,   86,   86,   86,   86,   86, 2682,   86,
-     2676, 2684,   86, 2685,   86, 2678,   86,   86,   86,   86,
-       86,   86, 2677, 2681, 2679, 2683, 2680, 2686, 2688, 2687,
-     2689,   86,   86, 2694,   86,   86, 2691, 2696,   86, 2690,
-
-     2692,   86,   86,   86, 2695,   86,   86,  170,   86,   86,
-     2705,   86, 2693,   86,   86,   86, 2699,   86,   86, 2704,
-     2701,   86, 2698, 2706, 2712,   86, 2707, 2697, 2708, 2700,
-     2702,   86,   86, 2709, 2729,   86,   86, 2714,   86, 2710,
-     2715, 2711, 2716,   86,   86, 2713, 2717,   86,   86, 2718,
-       86, 2719,   86, 2720, 2721, 2722,   86, 2723,   86,   86,
-       86,   86,   86,   86, 2731,   86,   86,   86,   86,   86,
-     2735, 2724, 2736,   86,   86, 2740,   86, 2726, 2725, 2742,
-       86, 2728, 2727, 2730, 2733, 2732, 2734,   86, 2737, 2738,
-       86,   86,   86,   86,   86,   86, 2739,   86,   86, 2741,
-
-     2745,   86,   86, 3483,   86, 2752,   86, 2753,   86, 2743,
-     2744, 2751, 2746, 2747, 2754,   86, 2748, 2749,   86, 2757,
-       86, 2750, 2758,   86, 2756, 2759,   86,   86,   86,   86,
-       86,   86,   86, 2755,   86, 2764,   86,   86,   86, 2768,
-     2770, 2767, 2761, 2763, 2760, 2769,   86, 2762, 2771,   86,
-       86,   86, 2765,   86, 2766,   86,   86,   86,   86,   86,
-     2773,   86, 2777, 2778,   86,   86,   86, 2775, 2782, 2772,
-     2783,   86, 2774,   86, 2786,   86, 2776,   86,   86, 2779,
-     2780, 2784,   86,   86, 2781,   86, 2789,   86, 2787, 2791,
-       86, 2785,   86, 2788, 2792,   86,   86,   86, 2790,   86,
-
-     2793, 2797,   86,   86,   86, 2794,   86, 2800, 2799, 2798,
-     2801,   86, 2795, 2803,   86,   86, 2796,   86,   86,   86,
-     2804,   86, 2806, 2802, 2809,   86, 2805,   86, 2810,   86,
-     2807, 2812,   86,   86,   86,   86,   86,   86,   86, 2808,
-     2818,   86, 2813, 2811, 2815, 2816, 2814, 2817, 2821,   86,
-       86,   86, 2820,   86, 2819, 2822, 2823,   86,   86,   86,
-       86,   86, 2825,   86,   86,   86, 2826, 2824,   86, 2828,
-     2831, 2829,   86, 2832, 2834,   86, 2830, 2836, 2827, 2833,
-     2835,   86,   86, 2838,  170,   86,   86,   86,   86, 2843,
-     3483, 2840, 2839,   86,   86,   86,   86, 2845, 2844,   86,
-
-       86, 2837, 2848,   86, 2847, 2841, 2842, 2849,   86, 2846,
-     2851,   86,   86, 2850, 2853, 2852,   86,   86,   86, 2854,
-       86, 2855, 2856, 2858,   86,   86,   86,   86, 2859,   86,
-     2860,   86, 2857,   86, 2865, 2861,   86, 2866,   86, 2863,
-       86, 2867, 2862,   86,   86,   86,   86,   86, 2871,   86,
-     2868, 2869, 2870,   86, 2864,   86,   86,   86, 2872,   86,
-     2873, 2874,   86,   86, 2879,   86, 2876, 2875, 2877,   86,
-       86, 2878, 2883,   86, 2880, 2881, 2885,   86,   86, 2884,
-       86, 2888,   86,   86,   86,   86,   86, 2882, 2893,   86,
-     2889,   86,   86,   86, 2891,   86,   86, 2886,   86, 2887,
-
-     2897, 2892, 2900, 2890, 2898,   86, 2901, 2895,   86, 2903,
-     2894,   86,   86, 2896,   86,   86, 2902, 2904,   86, 2905,
-     2899,   86,   86, 2907, 2909,   86, 2906,   86, 2910,   86,
-       86, 2911,   86,   86, 2914, 2908,   86, 2916,   86, 2917,
-       86, 2918,   86, 2912,   86,   86,   86, 2913, 2919,   86,
-     2920, 2921,   86,   86, 2915,   86,   86, 2925, 2923,   86,
-     2929, 2924, 2926,   86, 2930,   86, 2922, 2927, 2931,   86,
-       86,   86,   86, 2932, 2935,   86, 2928,   86,   86, 2938,
-       86,   86, 2939,   86, 2933, 2934, 2940,   86,   86, 2942,
-       86,   86,   86, 2946,   86, 2936, 2943,   86, 2937,   86,
-
-     2947,   86, 2950, 2941,   86, 2949, 2945, 2951, 2948, 2944,
-       86,   86, 2952,   86,   86,   86, 2957, 2953,   86,   86,
-       86, 2956,   86, 2959, 2960,   86,   86,   86, 2962,   86,
-     2954, 2961, 2963,   86, 2955,   86, 2965,   86, 2966,   86,
-     2969,   86,   86, 2958,   86, 2973,   86,   86,   86, 2980,
-       86,   86, 2964,   86, 2981,   86, 2967, 2968, 2972, 2970,
-       86, 2974, 2971, 2975, 2977,   86,   86, 2978, 3020, 2982,
-     2984, 2976,   86, 2979, 2983,   86, 2985,   86,   86, 2986,
-       86, 2987,   86, 2988,   86, 2989,   86,   86, 2990,   86,
-       86, 2991, 2993,   86,   86, 2995,   86,   86,   86, 2997,
-
-     3001,   86,   86, 2994,   86, 2998, 3483, 2992, 3002,   86,
-       86, 3006, 2996, 3003, 3005,   86,   86, 2999, 3000,   86,
-     3004, 3007,   86,   86, 3008, 3009,   86,   86,   86,   86,
-     3015,   86, 3010,   86, 3014,   86, 3011, 3012, 3013, 3016,
-       86,   86, 3017, 3021,   86,   86,   86,   86, 3022,   86,
-     3025,   86, 3019,   86, 3024,   86, 3026, 3023,   86, 3018,
-     3027,   86, 3028,   86, 3032,   86,   86, 3029,   86,   86,
-     3034,   86, 3030, 3031, 3036, 3033,   86, 3039,   86,   86,
-     3037,   86,   86,   86,   86, 3044, 3042, 3043,   86,   86,
-     3040,   86,   86, 3035, 3046,   86, 3038, 3045,   86, 3049,
-
-     3041,   86, 3050, 3483, 3047,   86, 3048, 3051,   86, 3052,
-       86, 3053,   86,   86, 3054, 3055, 3058,   86, 3057,   86,
-     3056,   86,   86,   86, 3059,   86, 3060, 3061,   86,   86,
-       86,   86, 3067,   86, 3065, 3062, 3483, 3063,   86, 3069,
-       86,   86,   86,   86, 3064, 3070,   86, 3071, 3066,   86,
-     3073, 3072, 3074,   86,   86,   86, 3068,   86, 3075, 3078,
-       86,   86,   86,   86, 3082, 3081,   86,   86, 3076,   86,
-     3079,   86, 3086,   86, 3077, 3080,   86, 3085,   86, 3083,
-       86, 3088, 3089, 3092,   86, 3084,   86, 3094,   86, 3095,
-       86, 3087,   86,   86, 3090, 3097,   86,   86,   86,   86,
-
-       86,   86, 3100,   86, 3091, 3093, 3102, 3103,   86, 3098,
-     3106,   86, 3105, 3096, 3099, 3101,   86,   86,   86, 3109,
-     3104,   86,   86, 3112,   86,   86, 3114,   86,   86, 3117,
-       86,   86,   86, 3115, 3107, 3110, 3108, 3118,   86,   86,
-       86, 3111, 3121,   86,   86, 3113, 3119,   86, 3126, 3116,
-       86, 3123,   86, 3124,   86,   86, 3130,   86,   86, 3120,
-       86,   86, 3122, 3132, 3128,   86,   86, 3125, 3133, 3127,
-       86, 3134,   86, 3131, 3137, 3129, 3138,   86, 3135,   86,
-       86, 3136, 3139, 3140, 3143,   86,   86,   86,   86,   86,
-     3141, 3142, 3144, 3146,   86, 3149,   86,   86,   86,   86,
-
-       86,   86, 3154,   86,   86,   86,   86, 3145,   86, 3150,
-       86, 3147, 3148, 3160, 3153, 3157, 3151, 3158,   86, 3159,
-       86, 3156,   86, 3155, 3161, 3152,   86, 3162, 3163,   86,
-     3164,   86, 3165,   86, 3166,   86,   86, 3169,   86, 3167,
-       86, 3171,   86,   86,   86, 3170,   86,   86,   86,   86,
-     3177, 3178,   86,   86,   86,   86,   86, 3172, 3184,   86,
-     3185,   86, 3168,   86,   86, 3186, 3173, 3175, 3174, 3176,
-     3181,   86, 3183, 3180,   86, 3182,   86,   86,   86, 3179,
-       86, 3189, 3191,   86, 3187, 3192,   86,   86,   86, 3195,
-     3196,   86, 3193, 3188, 3194,   86, 3197,   86, 3190, 3198,
-
-       86,   86, 3199,   86,   86, 3200,   86,   86, 3201,   86,
-       86, 3202, 3204,   86,   86, 3206,   86,   86, 3205,   86,
-     3483, 3207,   86,   86, 3203,   86,   86,   86,   86, 3208,
-       86, 3216, 3217, 3220, 3209, 3211, 3210, 3219, 3212, 3218,
-     3213, 3214,   86,   86,   86, 3222, 3215, 3224,   86,   86,
-     3221, 3225,   86, 3226, 3227,   86,   86, 3223,   86, 3230,
-       86, 3228, 3231,   86, 3232, 3233,   86,   86, 3234, 3235,
-     3239,   86, 3236,   86,   86, 3237, 3238, 3229,   86, 3240,
-       86, 3242,   86,   86,   86,   86,   86,   86,   86, 3241,
-     3248,   86, 3247,   86,   86,   86,   86,   86, 3244,   86,
-
-     3252, 3243, 3251, 3253,   86, 3245, 3246,   86, 3249, 3256,
-     3257,   86, 3254,   86, 3259,   86, 3258, 3255, 3250, 3260,
-       86, 3261,   86,   86,   86,   86, 3266,   86, 3263, 3268,
-     3262, 3267,   86, 3264,   86,   86, 3265,   86,   86,   86,
-     3275,   86, 3270, 3272, 3273, 3276,   86, 3278,   86,   86,
-     3269,   86, 3277, 3279,   86, 3271, 3274,   86, 3282,   86,
-     3283,   86, 3281,   86, 3280, 3285,   86, 3286,   86, 3287,
-       86,   86, 3284, 3288,   86, 3289,   86, 3290,   86, 3291,
-       86, 3292,   86,   86, 3295,   86,   86,   86,   86, 3299,
-       86,   86, 3294, 3301,   86, 3296,   86, 3293,   86, 3297,
-
-       86,   86,   86,   86, 3305, 3306,   86,   86, 3298,   86,
-     3300, 3302, 3310, 3303, 3304,   86, 3307, 3308,   86,   86,
-     3312, 3315,   86,   86, 3311, 3309, 3314,   86,   86,   86,
-       86,   86,   86, 3313, 3317,   86, 3316, 3321,   86,   86,
-       86, 3322, 3323,   86,   86,   86, 3327, 3318, 3319, 3326,
-       86, 3320, 3329,   86, 3324, 3330,   86,   86, 3328, 3331,
-       86,   86,   86,   86,   86,   86, 3325, 3334,   86,   86,
-     3333,   86,   86, 3332, 3339,   86, 3336, 3335,   86, 3338,
-     3340,   86, 3342,   86, 3344, 3343, 3341, 3337,   86,   86,
-       86,   86,   86, 3345,   86,   86,   86, 3351,   86, 3346,
-
-     3349, 3353, 3350,   86, 3348, 3354,   86,   86, 3356, 3357,
-     3359,   86,   86, 3347,   86, 3352, 3361,   86, 3355,   86,
-     3362, 3360, 3363,   86, 3364,   86,   86, 3358,   86,   86,
-       86, 3367,   86, 3365, 3368, 3369,   86, 3372,   86,   86,
-       86,   86,   86,   86, 3375,   86, 3366, 3376,   86, 3378,
-       86, 3371, 3373, 3374, 3379,   86,   86, 3370, 3382,   86,
-     3377, 3381,   86, 3384, 3385,   86,   86, 3386,   86,   86,
-       86, 3380, 3389, 3390,   86,   86, 3387, 3383,   86,   86,
-       86, 3395,   86,   86, 3391, 3394,   86, 3392, 3388, 3396,
-       86,   86,   86,   86, 3393,   86, 3400,   86,   86,   86,
-
-     3402,   86,   86,   86, 3397, 3399, 3398, 3407, 3408, 3409,
-       86, 3404, 3405, 3401,   86,   86, 3403,   86, 3413,   86,
-     3406,   86, 3415,   86, 3416,   86, 3414,   86,   86,   86,
-     3417, 3421, 3418, 3411, 3410,   86, 3412,   86, 3422,   86,
-     3419,   86, 3424,   86,   86,   86, 3423,   86, 3420, 3425,
-       86,   86, 3430,   86, 3427,   86,   86, 3433,   86, 3434,
-       86,   86,   86, 3426,   86,   86, 3437,   86, 3432, 3428,
-     3429, 3435, 3431,   86, 3436,   86, 3441,   86, 3442,   86,
-     3440,   86, 3445, 3438, 3439,   86,   86, 3447,   86, 3448,
-     3443,   86,   86,   86, 3452,   86, 3449,   86,   86, 3450,
-
-     3454,   86, 3453,   86, 3446, 3444, 3455,   86, 3456,   86,
-     3457,   86, 3451,   86, 3461,   86, 3459,   86,   86,   86,
-       86,   86,   86, 3463, 3464,   86, 3467,   86, 3458, 3468,
-       86, 3483, 3460,   86, 3471,   86, 3462, 3472,   86, 3465,
-     3466, 3469, 3473, 3474,   86,   86, 3470, 3475,   86,   86,
-       86,   86, 3476,   86, 3477, 3478, 3481,   86, 3482,   86,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3479, 3483, 3480,   47,   47,   47,   47,   47,   47,   47,
-       52,   52,   52,   52,   52,   52,   52,   57,   57,   57,
-       57,   57,   57,   57,   63,   63,   63,   63,   63,   63,
-
-       63,   68,   68,   68,   68,   68,   68,   68,   74,   74,
-       74,   74,   74,   74,   74,   80,   80,   80,   80,   80,
-       80,   80,   89,   89, 3483,   89,   89,   89,   89,  160,
-      160, 3483, 3483, 3483,  160,  160,  162,  162, 3483, 3483,
-      162, 3483,  162,  164, 3483, 3483, 3483, 3483, 3483,  164,
-      167,  167, 3483, 3483, 3483,  167,  167,  169, 3483, 3483,
-     3483, 3483, 3483,  169,  171,  171, 3483,  171,  171,  171,
-      171,  174, 3483, 3483, 3483, 3483, 3483,  174,  177,  177,
-     3483, 3483, 3483,  177,  177,   90,   90, 3483,   90,   90,
-       90,   90,   17, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483
+      341,   86,  333,   86,   86,   86,  343,  336,  345,   86,
+       86,  344,   86,   86,   86,  347,   86,   86,  346,  349,
+       86,   86,  354,   86,  352,  350,   86,   86,   86,   86,
+
+      348,  365,  355,  353,  351,  359,  356,   86,   86,   86,
+      360,   86,  357,  361,   86,   86,  362,  358,  363,  368,
+       86,  364,   86,   86,   86,   86,  374,  366,  367,  370,
+      373,  375,   86,   86,  377,  369,   86,   86,  382,  372,
+       86,  376,   86,  380,   86,  378,  381,   86,  384,   86,
+      379,  385,   86,   86,   86,  170,   86,   86,  388,   86,
+       86,   86,  383,  395,  391,  393,  396,  389,  386,   86,
+       86,   86,   86,   86,  399,  387,  390,   86,  397,  392,
+       86,   86,  398,   86,  394,  400,   86,   86,   86,  402,
+      406,  407,   86,  409,  404,  401,   86,  403,   86,  410,
+
+      408,   86,   86,   86,  412,   86,  413,   86,   86,   86,
+       86,  416,  405,   86,  417,  420,   86,   86,  175,  411,
+      422,   86,  418,  414,  415,  419,   86,   86,  424,  423,
+       86,  421,   86,  429,   86,  428,  425,   86,  427,   86,
+      430,   86,   86,   86,   86,   86,   86,   86,  436,   86,
+       86,   86,  437,  426,  439,   86,   86,  435,   86,  442,
+      433,  432,  447,  438,  434,  431,   86,   86,   86,  444,
+      440,   86,   86,  441,  443,  448,   86,   86,   86,  446,
+       86,  463,   86,  449,   86,  456,  445,   86,   86,  458,
+      466,  467,  170,  464,  465,  457,  450,   86,   86,  451,
+
+      459,  470,  460,  468,  452,  453,  454,  455,  469,   86,
+      471,   86,   86,   86,   86,  461,   86,   86,  462,  480,
+       86,   86,   86,  478,   86,  482,   86,  481,  474,  472,
+      479,  475,  473,   86,  476,  477,   86,  483,  485,   86,
+       86,  484,   86,   86,  490,   86,  491,   86,  492,   86,
+       86,  486,   86,  509,  496,  497,   86,  493,  489,  487,
+       86,   86,  488,   86,  494,  498,   86,  495,  499,  501,
+      503,  502,   86,   86,  500,  504,   86,  510,  511,   86,
+       86,  512,  508,   86,   86,   86,   86,  526,  505,   86,
+       86,  506,  581,  507,   86,  513,   86,  514,   86,  530,
+
+      525,  528,   86,  515,  529,  527,   86,  516,   86,  531,
+      533,  543,  517,  542,  546,  518,   86,  519,  544,  520,
+      170,  547,   86,  545,   86,  532,   86,   86,  553,   86,
+       86,  551,  521,   86,   86,  522,   86,  523,  168,  524,
+       86,  548,  534,  535,  550,  549,  552,  556,   86,   86,
+      555,  557,  536,  537,  538,  539,  540,   86,   86,  541,
+       86,  558,  554,  559,   86,   86,  566,   86,  561,  562,
+      564,   86,   86,   86,  567,  563,   86,   86,  571,  565,
+       86,  560,   86,  569,   86,   86,   86,  568,   86,   86,
+      570,  574,  575,  576,   86,   86,  573,   86,  578,  582,
+
+      583,   86,  572,  580,  579,  577,   86,   86,   86,  588,
+      585,  586,   86,  589,   86,   86,  590,  584,  604,   86,
+       86,  166,   86,  607,   86,   86,  587,   86,  591,  593,
+      594,  595,  592,   86,  605,  609,  608,   86,  606,   86,
+      615,   86,  596,  611,  597,   86,   86,   86,   86,  613,
+      598,  612,   86,  614,   86,  616,  618,   86,  599,  600,
+      610,   86,  601,  602,   86,  617,  603,   86,  621,  619,
+      622,   86,   86,   86,  620,  623,   86,   86,   86,   86,
+      628,   86,  626,  627,   86,   86,   86,  624,  629,   86,
+       86,   86,  634,  630,  625,  635,   86,   86,  633,   86,
+
+      636,   86,  638,  632,  631,   86,   86,  641,   86,  637,
+      639,   86,  640,   86,  643,   86,   86,   86,   86,  645,
+       86,  642,   86,  649,   86,  647,   86,   86,   86,  644,
+       86,  657,  677,   86,  651,  659,  646,   86,  648,  658,
+      650,   86,  652,   86,  653,  654,  655,  656,  660,   86,
+       86,   86,   86,   86,  664,   86,  668,   86,  662,  671,
+       86,  663,   86,  661,  667,   86,  665,   86,  666,   86,
+      670,   86,   86,   86,  673,   86,  674,  669,  678,   86,
+       86,   86,   86,  672,  680,   86,   86,   86,   86,  711,
+      679,  675,   86,  676,   86,  683,  681,   86,  695,   86,
+
+      682,   86,  684,  694,  697,  692,   86,  685,  693,  686,
+      699,  696,  165,  698,   86,  687,   86,  688,   86,  700,
+      689,  690,  707,  701,   86,   86,   86,  691,   86,  703,
+       86,  702,   86,  708,  704,  706,   86,  705,   86,  714,
+      709,   86,   86,  716,   86,   86,  710,   86,   86,  720,
+       86,   86,   86,   86,  163,  712,  713,  718,  723,  717,
+       86,  724,  719,   86,   86,   86,  715,   86,  170,  721,
+      727,  729,  730,  722,  728,  731,   86,   86,  726,  725,
+       86,   86,   86,   86,   86,   86,   86,   86,  732,  738,
+      161,   86,  733,  740,  742,  744,  735,   86,  736,  734,
+
+      739,   86,  737,  743,   86,  746,   86,   86,   86,  745,
+      748,   86,   86,   86,   86,   86,  752,   86,  747,  751,
+      757,   86,  749,   86,  753,  758,   86,  750,  760,   86,
+      808,  754,   86,  756,  755,  762,  759,  761,   86,  763,
+       86,   86,  764,   86,  765,   86,  766,   86,   86,   86,
+       86,  767,   86,  768,  771,   86,  773,  769,  770,   86,
+       86,   86,  774,   86,   86,  775,  772,  779,  778,   86,
+       86,   86,   86,   86,  781,   86,  783,   86,   86,  785,
+       86,   86,  777,   86,  776,   86,  788,   86,  792,  780,
+      782,  784,   86,   86,   86,  786,  787,  793,   86,   86,
+
+       86,  790,  789,   86,   86,  800,  795,  791,   86,  802,
+       86,  796,  794,  803,  797,  798,   86,  799,  801,   86,
+      807,  804,   86,   86,  805,  809,   86,  810,   86,   86,
+       86,   86,  813,  812,  806,  814,   86,   86,   86,   86,
+       86,  821,   86,   86,  817,  819,   86,  815,   86,  811,
+       86,  818,  822,   86,  816,   86,   86,  828,   86,  820,
+       86,  834,  826,   86,  829,  823,  825,  827,   86,  824,
+       86,  830,  831,  832,   86,   86,   86,  833,  835,   86,
+       86,  840,   86,   86,  836,  838,  842,   86,  841,   86,
+      837,   86,   86,   86,  843,   86,  846,   86,  839,   86,
+
+      845,  847,   86,  853,  850,   86,  848,  844,  854,   86,
+      849,   86,   86,   86,  855,   86,  856,   86,  851,  852,
+       86,  858,  859,   86,  860,  863,  861,   86,   86,  867,
+       86,   86,  857,  865,  868,   86,   86,  869,  870,  864,
+       86,  862,  871,  866,   86,   86,  873,   86,   86,  872,
+       86,   86,  879,   86,   86,   86,   86,  880,   86,   86,
+       86,   86,   86,  874,  881,  875,  876,   86,   86,  877,
+      886,  878,  884,   86,  882,  883,  889,  888,   86,  887,
+      885,   86,   86,   86,   86,   86,   86,  891,  890,  896,
+      892,   86,   86,   86,   86,   86,   86,   86,  905,  906,
+
+      893,  903,  898,  895,  894,   86,   86,   86,   86,  897,
+      899,  900,  901,  902,   86,   86,   86,   86,   86,  904,
+      907,  911,  910,   86,   86,  909,  908,   86,   86,   86,
+      915,  912,  916,   86,  919,  917,  913,  914,  920,   86,
+       86,   86,  918,   86,   86,  927,   86,  922,   86,  170,
+      923,   86,  925,   86,  928,   86,  929,  921,  924,  930,
+      926,   86,   86,   86,   86,   86,   86,  935,  936,   86,
+       86,  932,   86,  937,   86,  931,  939,   86,  933,  934,
+       86,  938,  943,  941,  944,  940,   86,   86,   86,  942,
+      945,  947,   86,   86,  949,   86,   86,   86,   86,  946,
+
+       86,  950,  951,   86,   86,   86,   86,   86,   86,  178,
+      948,  965,   86,  966,  952,  964,  969,  967,  954,  962,
+      963,   86,  953,   86,   86,  955,   86,  970,  956,   86,
+      971,   86,  957,   86,   86,  958,   86,  968,  974,   86,
+      976,   86,  959,  960,  972,  961,   86,   86,   86,  973,
+     1018,   86,  985,   86,  975,   86,  977,  978,  992,  979,
+      986,  984,  980,   86,   86,   86,  987,  981,  988,  990,
+       86,   86,   86,  982,  983,  989,  994,   86,  998,   86,
+      997,   86,  993,  999,   86,  991, 1000,  995,   86, 1001,
+       86, 1004,   86,   86,  176,  996, 1002, 1003, 1005,   86,
+
+       86,   86, 1006, 1008,   86, 1007,   86,   86, 1009,   86,
+       86,   86,   86, 1010, 1012,   86, 1016,   86,   86, 1019,
+     1015,   86,   86,   86,   86, 1023, 1011, 1034,   86, 1013,
+     1014,   86, 1017, 1024, 1021, 1025,   86, 1026, 1029, 1020,
+       86,   86, 1027,   86,   86, 1022, 1028, 1031,  175,   86,
+     1033,   86,   86,   86, 1032,   86,   86, 1035,   86, 1030,
+     1036, 1037,   86, 1038,   86,   86, 1039,   86,   86,   86,
+     1041, 1042,   86, 1040,   86, 1043, 1047,   86,   86, 1051,
+       86, 1050,   86,   86,   86,   86, 1049, 1044, 1045, 1048,
+       86,   86,   86, 1046,   86,   86,   86, 1056, 1058, 1053,
+
+     1054, 1059, 1052, 1057,   86,   86,   86,   86, 1055,   86,
+       86, 1064,   86, 1067,   86, 1062, 1065,   86, 1060,   86,
+     1063,   86,   86, 1066,   86, 1068,   86, 1073, 1070,   86,
+     1061, 1075,   86, 1069,   86, 1074, 1076,   86,   86, 1078,
+     1072,   86,   86,   86,   86, 1071,   86, 1077,   86,  170,
+       86,   86, 1086, 1079, 1089, 1084,   86,   86, 1080,   86,
+       86, 1081,   86, 1083, 1082, 1090,   86, 1085, 1087, 1091,
+     1088,   86,   86,   86,   86, 1092,   86, 1095, 1098,   86,
+     1094, 1093, 1096, 1099,   86,   86, 1097,   86,   86,   86,
+       86,   86, 1109,   86, 1102, 1100, 1104, 1110,   86, 1101,
+
+       86,   86, 1112,   86,   86, 1115,   86, 1103,   86, 1105,
+     1107,   86, 1106, 1108, 1111, 1113, 1116,   86,   86,   86,
+      168, 1117,   86,   86, 1114, 1118,   86, 1123, 1121, 1124,
+     1119, 1125,   86,   86,   86,   86, 1126,   86, 1120, 1129,
+     1122,   86, 1131,   86,   86,   86,   86, 1128, 1137,   86,
+     1127, 1133, 1134, 1138,  170,   86,   86,   86, 1141,   86,
+     1140, 1130, 1132,   86,   86, 1135,   86, 1136,   86, 1144,
+     1139,   86,   86,   86,   86,   86, 1157,   86,   86,   86,
+       86, 1142, 1158, 1143, 1148, 1145, 1147, 1160,   86,   86,
+      166,   86, 1146, 1149, 1159, 1150,   86,   86, 1191, 1151,
+
+       86, 1152, 1161, 1164, 1162, 1153, 1163, 1154,   86, 1167,
+       86, 1166, 1155, 1165, 1168,   86,   86, 1156,   86, 1169,
+       86,   86, 1171,   86,   86,   86, 1174,   86, 1177,   86,
+     1170,   86,   86,   86, 1172, 1173, 1175, 1176, 1178, 1182,
+     1181,   86, 1187, 1180, 1184, 1185, 1183,   86, 1179, 1188,
+       86,   86, 1186,   86, 1189,   86,   86,   86,   86,   86,
+       86,   86, 1203, 1200,   86,   86,   86,   86,   86, 1199,
+     1204,   86, 1202, 1201, 1205, 1190,   86, 1192,   86, 1211,
+     1206, 1207, 1193,   86, 1194,   86,   86, 1208,   86, 1214,
+     1195, 1212,   86,   86,   86, 1196, 1197, 1209,   86, 1210,
+
+     1213,   86, 1198, 1218,   86, 1219,   86, 1221, 1215, 1222,
+       86, 1216, 1217,   86,   86,   86, 1226,   86, 1220, 1224,
+       86,   86,   86,   86,   86, 1227,   86, 1232, 1225, 1223,
+     1229,   86, 1230,   86,   86, 1233, 1228,   86,   86, 1235,
+     1231,   86,   86,   86,   86,   86,   86,   86,   86, 1242,
+     1234,   86, 1237, 1240, 1239, 1241,   86, 1236, 1244,   86,
+       86, 1238, 1243, 1245,   86, 1246,   86,   86, 1247,   86,
+       86, 1248,   86, 1250, 1253, 1249,   86, 1254, 1251, 1256,
+     1258, 1255, 1252,   86, 1257, 1259,   86,   86,   86,   86,
+       86,   86, 1264,   86,   86,   86, 1260, 1265,   86,   86,
+
+       86, 1266, 1262, 1261, 1267,   86, 1263, 1269, 1268,   86,
+       86, 1271, 1275,   86, 1270, 1277,   86, 1272,   86,   86,
+       86,   86, 1273,   86, 1279, 1274,   86, 1281,  165,   86,
+       86, 1278, 1282, 1276, 1280, 1284,   86,   86,   86,   86,
+       86, 1285,   86,   86, 1283, 1288,   86, 1287, 1289,   86,
+     1294, 1290, 1291, 1286,   86, 1293,   86,   86, 1292, 1295,
+       86,   86,   86, 1296, 1298,   86, 1299,   86,   86,   86,
+       86, 1305, 1303, 1306, 1339, 1297, 1307,   86,   86,   86,
+     1300, 1310,   86, 1304,   86,   86, 1301,   86, 1302, 1308,
+     1309,   86, 1312,   86,   86,   86, 1311, 1316,   86, 1313,
+
+       86, 1318,   86,   86,   86, 1317,   86,   86,   86,   86,
+       86, 1314, 1323, 1319,   86, 1315, 1320, 1324,   86,   86,
+       86, 1325,   86, 1326, 1321, 1330,   86, 1322, 1331,   86,
+       86,   86, 1328,   86,   86, 1333,   86, 1327, 1334,   86,
+       86, 1329,   86,   86, 1332, 1335,   86, 1336, 1337,   86,
+       86,   86, 1341, 1345,   86,  170,   86,   86, 1338, 1346,
+     1340, 1347, 1348,   86,   86, 1342,   86,   86,   86, 1344,
+     1357,   86, 1353,  163, 1343, 1349,   86, 1350, 1352, 1351,
+     1354, 1355,   86, 1358,   86,   86,   86,   86, 1356,   86,
+     1360,   86, 1362, 1361,   86,   86,   86,   86,   86,   86,
+
+     1359, 1365,   86, 1371,   86, 1367, 1368,   86, 1363, 1364,
+       86,   86, 1366, 1369,   86,   86,   86,   86,  161,   86,
+     1375, 1370, 1377, 1381, 1372, 1373, 1374,   86, 1382,   86,
+     1386, 1378,   86, 1379, 1383, 1376, 1380, 1384,   86, 1385,
+       86,   86,   86, 1387,   86,   86,   86,   86,   86,   86,
+     1391, 1390,   86, 1394,   86,   86, 1398,   86,   86, 1393,
+     1388,   86, 1389, 1395,   86, 1392, 1396,   86,   86, 1399,
+     1404, 1397, 1400, 1402, 1401,   86,   86,   86,   86, 1403,
+       86,   86,   86,   86, 1408,   86,   86,   86,   86, 1411,
+       86, 1405, 1406, 1409, 1416, 1410,   86, 1407, 1412,   86,
+
+       86, 1418, 1413,   86,   86, 1415, 1414,   86,   86, 1421,
+     1419, 1417,   86,   86,   86, 1428,   86,   86, 1422, 1420,
+     1424,   86, 1430, 1423,   86,   86,   86,   86,   86, 1427,
+       86, 1425, 1431,   86, 1433, 1436, 1429,   86, 1426, 1432,
+       86, 1438,   86, 1435, 1434, 1437, 1439,   86,   86, 1443,
+       86,   86,   86, 1453, 1441, 1442, 1440,   86, 1444,   86,
+     1452, 1456, 1445, 1451,   86, 1446, 1447,   86, 1454, 1455,
+     1448, 1457,   86,   86,   86,   86, 1449,   86, 1458, 1459,
+     1450,   86, 1460,   86, 1462,   86,   86,   86, 1463,   86,
+     1464, 1467,   86, 1461,   86, 1465, 1468,   86,   86, 1470,
+
+       86, 1473, 1474,   86, 1466, 1475, 1471,   86,   86, 1469,
+       86,   86, 1478,   86, 1476,   86, 1472, 1479, 1483, 1480,
+       86, 1481,   86, 1482, 1477,   86, 1485, 1486, 1487, 1484,
+       86, 1488,   86,   86,   86, 1493, 1489, 1490,   86,   86,
+     1494,   86,   86, 1492,   86,   86,   86, 1495,   86, 1497,
+       86, 1491, 1503,   86, 1499,   86, 1498,   86,   86,   86,
+     1504, 1496,   86, 1506, 1502, 1500,   86, 1501,   86, 1505,
+       86, 1508,   86,   86, 1515,   86, 1507,   86, 1513, 1510,
+     1511,   86, 1509, 1517,   86,   86, 1514, 1518,   86,   86,
+     1512, 1519, 1516,   86, 1520,   86, 1523,   86,   86, 1525,
+
+       86,   86, 1526,   86, 1522,   86,   86,   86, 1527, 1531,
+       86,   86, 1521,   86,   86,   86, 1536, 1534, 1524,   86,
+       86,   86,   86, 1539, 1537,   86, 1528, 1529, 1530, 1538,
+     1533, 1532,   86,   86,   86, 1535, 1541,   86,   86, 1543,
+       86,   86, 1550, 1540,   86, 1545, 1546, 1542,   86, 1547,
+       86, 1544,   86, 1548,   86,   86,   86, 1549,   86, 1551,
+       86, 1553, 1556, 1554, 1557, 1558, 1552,   86,   86, 1560,
+       86, 1555, 1559,   86,   86,   86,   86, 1564,   86,   86,
+       86,   86, 1561,   86,   86, 1566,   86, 1563,  170, 1572,
+     1573, 1568,   86, 1562, 1575,   86,   86,   86, 1574, 1565,
+
+       86, 1567,   86, 1569, 1570,   86,   86,   86,   86, 1571,
+       86, 1576,   86, 1583,   86,   86,   86, 1577, 1580,   86,
+       86, 1581, 1578,   86, 1587, 1579, 1582, 1588,   86,   86,
+     1584, 1592,   86, 1586, 1590, 1591, 1593,   86,   86, 1585,
+     1596, 1594,   86, 1589,   86,   86,   86, 1595,   86, 1606,
+       86, 1601, 1604,   86, 1602,   86, 1597, 1603,   86, 1598,
+     1599,   86, 1607, 1600, 1609,   86,   86, 1605,   86, 1610,
+       86,   86, 1608,   86,   86,   86, 1614,   86, 1615,   86,
+       86,   86, 1618,   86, 1611,   86, 1613,   86, 1623, 1624,
+       86,   86, 1612, 1616, 1617, 1620, 1627,   86, 1621, 1619,
+
+       86, 1622,   86,   86,   86,   86,   86,   86, 1625, 1628,
+     1626,   86,   86,   86,   86,   86, 1629, 1635, 1631, 1637,
+     1632, 1633, 1630,   86, 1640,   86, 1634,   86, 1641, 1638,
+     1636,   86,   86, 1646, 1639,   86, 1645, 1647,   86,   86,
+     1642, 1643,   86,   86,   86, 1649, 1650,   86, 1651,   86,
+       86, 1644, 1648,   86, 1655, 1656, 1657,   86, 1654, 3557,
+       86,   86,   86,   86, 1658, 1652,   86, 1659, 1660,   86,
+       86, 1653,   86,   86, 1661, 1663,   86,   86,   86,   86,
+       86, 1662,   86, 1668,   86, 1664, 1667,   86, 1670, 1671,
+     1665,   86, 1666,   86, 1674,   86, 1679, 1676, 1669, 1675,
+
+       86, 1672, 1677,   86,   86,   86,   86,   86,   86,   86,
+     1673, 1687, 1683, 1678,   86, 1682,   86,   86,   86,   86,
+     1691, 1688,   86, 1680, 1681,   86,   86, 1684, 1694, 1685,
+       86, 1693, 1686,   86,   86,   86,   86,   86, 1689,   86,
+       86, 1692,   86,   86, 1703, 1690,   86,   86,   86, 1695,
+     1704,   86, 1696, 1700, 1697, 1698, 1699, 1702, 1708,   86,
+       86, 1701,   86, 1707, 1711, 1705,   86, 1706, 1709,   86,
+       86, 1710,   86,   86,   86, 1712, 1715,   86,   86, 1713,
+     1716,   86, 1719,   86,   86, 1714, 1723,   86, 1725, 1724,
+       86, 1718,   86, 1717,   86,   86, 1720, 1728, 1721, 1722,
+
+       86,   86,   86,   86, 1730, 1726, 1729,   86, 1727,   86,
+       86, 1731, 1732, 1736, 1737,   86,   86,   86, 1734,   86,
+     1733,   86,   86, 1741,   86, 1742, 1740, 1744,   86,   86,
+     1735,   86, 1745,   86, 1738, 1746,   86,   86, 1739,   86,
+       86,   86,   86, 1750, 1743,   86,   86,   86, 1755, 1747,
+       86, 1753,   86, 1748,   86, 1749,   86,   86,   86,   86,
+     1761, 1759, 1751,   86,   86, 1752, 1754, 1756,   86,   86,
+       86, 1757, 1760, 1758,   86, 1763,   86, 1762, 1764,   86,
+     1767, 1770,   86, 1768, 1772,   86,   86,   86,   86, 1765,
+     1766, 1773, 1769,   86, 1775,   86,   86, 1771,   86,   86,
+
+       86,   86, 1779, 1782,   86, 1781, 1774, 1778,   86,   86,
+     1776, 1783,   86,  170, 1777,   86,   86, 1785, 1780, 1787,
+       86,   86, 1784,   86,   86, 1793, 1794,   86,   86, 1786,
+     1788, 1797,   86,   86, 1789, 1790,   86, 1791,   86,   86,
+       86, 1799, 1798,   86,   86, 1792, 1801, 1795, 1796,   86,
+     1803, 1805,   86,   86, 1802, 1865,   86,   86, 1800, 1804,
+     1807,   86, 1808,   86, 1811,   86, 1806,   86, 1812, 1809,
+     1810,   86, 1813,   86,   86,   86,   86,   86, 1818, 1817,
+       86,   86,   86,   86,   86, 1825, 1822, 1814,   86, 1823,
+     1816,   86, 1815, 1820,   86,   86, 1963,   86, 1819, 1826,
+
+     1827, 1824, 1821,   86, 1829, 1833,   86,   86, 1830, 1831,
+     1832, 1834, 1835,   86,   86,   86, 1828,   86,   86, 1836,
+       86, 1837,   86, 1838, 1839,   86,   86,   86, 1841, 1846,
+       86, 1840, 1843,   86, 1847,   86, 1845,   86, 1848, 1850,
+       86,   86, 1849, 1842,   86,   86,   86, 1844, 1853,   86,
+       86, 1852,   86,   86,   86, 1854,   86,   86,   86,   86,
+       86,   86,   86,   86, 1851, 1864,   86,   86,   86, 3557,
+     1855, 1859, 1860, 1856, 1858, 1857, 1861, 1862, 1868,   86,
+     1869,   86, 1866, 1871,   86, 1863, 1867, 1872,   86,   86,
+       86,   86, 1877,   86, 1870,   86,   86,   86,   86, 1881,
+
+     1873, 1879,   86,   86, 1875,   86,   86,   86, 1874, 1880,
+       86,   86, 1876,   86,   86, 1878, 1886, 1882, 1888, 1883,
+       86,   86,   86, 1889, 1885, 1887, 1890, 1884,   86, 1891,
+       86, 1895, 1896,   86, 1898, 1892, 1897,   86,   86,   86,
+     1893, 1900, 1901,   86,   86,   86, 1894,   86, 1899,   86,
+     1904,   86, 1902,   86, 1905,   86,   86, 3557, 1906,   86,
+       86, 1914,   86, 1903, 1909, 1908, 1907,   86, 1911, 1913,
+       86, 1912, 1915,   86,   86, 1910,   86, 1916,   86,   86,
+     1922,   86, 1917,   86,   86, 1923,   86, 1918, 1924,   86,
+       86, 1928, 1920, 1925, 1919, 1921,   86,   86,   86, 1931,
+
+       86, 1933,   86, 1932,   86,   86, 1930, 1927,   86, 1926,
+     1937, 1935, 1929,   86, 1936, 1934,   86,   86, 1941,   86,
+       86,   86, 1938, 1942,   86, 1946,   86, 1948, 1951, 1939,
+     1943, 1940, 1944,   86,   86, 1947, 1950,   86,   86,   86,
+     1954, 1945,   86, 1952, 1949,   86,   86,   86, 1955, 1958,
+       86,   86, 1962, 1953, 1960,   86,   86,   86,   86,   86,
+     1961, 1957,   86, 1959,   86, 1956,   86,   86,   86, 1968,
+     1967,   86,   86,   86, 3557, 1964, 1965, 1969, 1966, 1970,
+     1971, 1973, 1975,   86, 1977, 1972, 1978, 1974,   86,   86,
+       86,   86,   86, 1980,   86,   86, 1984,   86,   86, 1986,
+
+       86, 1979,   86,   86, 1976,   86, 1990,   86,   86, 1981,
+     1983, 1985,   86, 1982,   86,   86, 1992,   86, 1988, 1993,
+       86, 1989, 1987,   86,   86, 1995, 1997,   86, 1991, 1996,
+       86,   86,  170,   86, 2001, 1994, 2004,   86, 1999, 2000,
+       86,   86,   86,   86, 2002,   86, 1998,   86, 2003, 2008,
+       86,   86, 2010, 2006,   86,   86, 2015, 2009,   86, 2005,
+       86, 2007,   86, 2011,   86,   86, 2012, 2014, 2019,   86,
+     2016, 2018,   86, 2023, 2013, 2020, 2021,   86, 2017,   86,
+     2024, 2025,   86,   86, 2022,   86,   86, 2027,   86,   86,
+       86, 2028,   86,   86,   86, 2026,   86,   86,   86, 2033,
+
+       86, 2034,   86,   86,   86, 2038, 2035,   86, 3557, 2029,
+     2031, 2032, 2030, 2037, 2036,   86, 2039,   86,   86, 2045,
+     2042,   86, 2044, 2041, 2046,   86, 2047, 2043,   86, 2040,
+       86,   86,   86,   86,   86, 2053,   86, 2056,   86, 2048,
+     2049, 2057,   86, 2058,   86,   86, 2051, 2050, 2054,   86,
+     2055, 2052, 2060,   86,   86, 2061,   86,   86, 2059, 2065,
+       86, 2066, 2067, 2069,   86,   86, 2062, 2068,   86,   86,
+     2063,   86, 2071,   86, 2075,   86, 2072, 2064,   86,   86,
+       86,   86, 2074, 2070, 2078,   86, 2077,   86,   86,   86,
+       86,   86, 2083, 2085, 2081, 2082,   86,   86, 2073,   86,
+
+     2076, 2084, 2079,   86,   86,   86,   86, 2093,   86, 2080,
+       86, 2097, 3557,   86, 2095, 2086, 2087, 2088,   86, 2096,
+       86,   86, 2089, 2091, 2090, 2098, 2092,   86, 2094, 2099,
+     2102,   86, 2100, 2101,   86,   86,   86, 2106,   86,   86,
+     2103,   86, 2108,   86,   86,   86, 2111, 2112,   86,   86,
+     2114,   86,   86,   86, 2104,   86, 2105,   86,   86, 2121,
+       86, 2119, 2116, 2109, 2117, 2107, 2110,   86,   86, 2113,
+       86,   86,   86,   86, 2120,   86, 2127, 2115, 2118, 2124,
+     2125,   86,   86,   86, 2130, 2123, 2132,   86, 2131, 2122,
+       86,   86,   86,   86, 2134, 2135,   86, 2138, 2129, 2126,
+
+       86,   86, 2136,   86, 2139,   86,   86, 2128,   86,   86,
+       86, 2133, 2137, 2140,   86, 2141, 2142, 2144,   86,   86,
+       86, 2146, 2145,   86, 2149, 2150, 2151,   86, 2143,   86,
+       86,   86,   86,   86, 2154,   86,   86, 2147, 2159,   86,
+       86, 2158,   86,   86, 2153,   86, 2148, 2152,   86, 2164,
+     2155,   86, 2165, 2156,   86,   86,   86, 2157, 2162, 2169,
+     2166, 2161, 2168,   86, 2160, 2167,   86, 2163, 2172,   86,
+       86,   86,   86,   86,   86,   86,   86, 2170,   86, 2176,
+     2180,   86, 2171,   86,   86, 2174,   86,   86, 2183,   86,
+     2181, 2173, 2175, 2187, 2184, 2177, 2178,   86, 2179, 2182,
+
+     2185,   86,   86, 2186,   86,   86, 2188, 2191, 2192,   86,
+     2193,   86, 2194, 2196, 3557, 2189, 2197, 2195,   86,   86,
+     2190,   86,   86,   86, 2201,   86, 2199,   86,   86,   86,
+       86, 2198, 2203,   86, 2205, 2200, 2207, 2202,   86, 2204,
+     2209,   86,   86, 2210,   86,   86,   86,  170,   86,   86,
+       86,   86, 2213,   86, 2206,   86,   86, 2276, 2217, 2218,
+     2208, 2212, 2214, 2215, 2211,   86, 2219, 2216, 2220,   86,
+     2221,   86, 2223,   86,   86, 2222,   86,   86,   86, 2224,
+     2226, 2225,   86,   86,   86,   86, 2227, 2228, 2229,   86,
+     2231,   86,   86, 2235,   86, 2230, 2232, 2234,   86,   86,
+
+       86, 2240,   86, 2233, 2237, 2238,   86, 2236,   86, 2239,
+       86,   86,   86,   86,   86,   86, 2247, 2245,   86, 2242,
+     2246,   86,   86,   86,   86, 2252,   86, 2249, 2241, 2243,
+       86, 2244, 2248,   86,   86, 2257, 2253, 2251,   86, 2250,
+       86,   86, 2255,   86, 2254,   86,   86, 2258, 2261, 2264,
+     2256,   86, 2259, 2263,   86,   86,   86, 2270, 2262,   86,
+       86,   86, 2260,   86,   86, 2272,   86, 2265, 2273,   86,
+       86, 2266, 2267,   86, 2268, 2269,   86, 2271, 2275,   86,
+     2277,   86,   86, 2278,   86, 2281,   86, 2274,   86,   86,
+     2280,   86,   86, 2279, 2288, 2283,   86, 2286, 2284,   86,
+
+     2282, 2287,   86,   86,   86,   86,   86,   86,   86, 2285,
+       86, 2289,   86,   86, 2290, 2295, 2292,   86, 2291, 2296,
+     2300, 2294, 2301,   86,   86,   86,   86, 2298, 2304, 2305,
+     2302, 2293, 2297, 2299,   86,   86,   86, 2303, 2308, 2307,
+       86,   86,   86,   86,   86, 2310, 2306,   86, 2311, 2318,
+       86, 2312,   86, 2309, 2316,   86, 2314,   86,   86, 2319,
+       86, 2313, 2315, 2317, 2321,   86,   86,   86,   86, 2324,
+       86, 2323, 2320, 2325,   86, 2326,   86,   86, 2330,   86,
+       86,   86,   86, 2334,   86, 2331, 2322,   86, 2335,   86,
+       86, 2333, 2327,   86, 2328, 2332,   86, 2329, 2336,   86,
+
+     2337, 2338, 2339,   86,   86, 2340, 2344, 2341, 2342,   86,
+       86,   86,   86, 2346, 2345,   86, 2350,   86,   86, 2343,
+       86, 2352,   86, 2348,   86, 2353,   86, 2355, 2347,   86,
+     2351, 2349,   86,   86,   86, 2354, 2357,   86, 2362, 2360,
+       86,   86, 2358, 2363,   86, 2359,   86, 2356,   86,   86,
+     2365,   86, 2364,   86, 2368, 2361, 2369,   86, 2366,   86,
+     2367, 2373,   86,   86,   86,   86, 2370,   86, 2372,   86,
+       86,   86, 3557,   86,   86,   86,   86, 2371, 2381,   86,
+       86, 2374, 2375, 2376, 2379, 2377, 2380, 2382, 2383, 2387,
+       86,   86, 2378,   86, 2384, 2385, 2386,   86,   86, 2388,
+
+       86,   86, 2391, 2390,   86,   86, 2396,   86,   86, 2398,
+       86,   86, 2389, 2392, 2395,   86,   86, 2397, 2393, 2401,
+       86, 2402, 2399,   86,  170, 2405, 2394,   86, 3557, 2407,
+     2400,   86, 2409, 2403, 2408,   86,   86, 2410,   86, 2411,
+       86,   86, 2404,   86, 2414,   86, 2406, 2413, 2412,   86,
+     2415,   86, 2419,   86,   86, 2420,   86, 2423,   86, 2422,
+     2418,   86,   86,   86, 2416,   86, 2424, 2427, 2421,   86,
+     2425, 2426,   86, 2428,   86, 2417,   86,   86, 2429,   86,
+     2431,   86,   86, 2433,   86, 2430, 2434,   86,   86,   86,
+       86,   86, 2437,   86,   86, 2441,   86, 2432, 2444, 2436,
+
+     2443,   86,   86,   86,   86, 2435, 2438, 2439, 2446, 2440,
+       86, 2445,   86,   86,   86, 2442,   86,   86, 2451, 2454,
+       86,   86, 2448,   86, 2449, 2455,   86, 2452, 2447, 2450,
+       86,   86,   86,   86, 2453,   86,   86, 2465,   86,   86,
+     2456,   86, 2457,   86,   86, 2458,   86, 2463, 2470,   86,
+     2494, 2461, 2467, 2459, 2462, 2460, 2466, 2464, 2468,   86,
+     2472,   86,   86,   86,   86, 2469, 2474, 2473,   86, 2471,
+       86,   86, 2478, 2479,   86,   86,   86, 2475, 2480, 2481,
+       86,   86, 2476, 2477,   86, 2484,   86, 2485,   86,   86,
+     2482, 2488,   86,   86, 2483, 2489,   86, 2486, 2490,   86,
+
+     2487,   86, 2495,   86, 2491, 2496,   86,   86,   86, 2492,
+     2498,   86,   86, 2500,   86,   86, 2503,   86, 2504,   86,
+     2502, 2493,   86, 2501,   86,   86, 2497,   86,   86,   86,
+     2499, 2511,   86, 2506, 2510,   86, 2505, 2513,   86,   86,
+       86, 2508, 2507,   86,   86, 2515,   86, 2509,   86, 2516,
+       86, 2517,   86, 2518, 2512, 2520,   86, 2514,   86,   86,
+     2523, 2522,   86, 2521,   86, 2524, 2526,   86, 2519,   86,
+       86,   86, 2532,   86,   86, 2531,   86,   86, 2525, 2528,
+       86, 2534, 2527,   86,   86, 2530, 2537,   86,   86,   86,
+       86, 2539, 2529, 2533,   86, 2535,   86, 2538, 2536,   86,
+
+     2545,   86, 2540,   86,   86, 2547, 2551, 2541, 2542, 2543,
+     2546,   86,   86,   86, 2548,   86, 2552,   86, 2553,   86,
+     2554,   86, 2544,   86,   86,   86, 2558,   86,   86, 2549,
+     2560, 2550, 2556, 2561,   86, 2564,   86, 2565,   86, 2562,
+     2568,   86, 2555,   86, 2557,   86,   86,   86, 2566,   86,
+     2559, 2563, 2569, 2567, 2570,   86,   86,   86,   86, 2573,
+       86,   86,   86,   86,   86,   86, 2574, 2575, 2572, 2576,
+     2571, 2577, 2579, 2580, 2584, 2578,   86, 3557,   86,   86,
+     2581,   86, 2585, 2582, 2583, 2586,   86, 2587,   86,   86,
+     2590,   86,   86,  170,   86, 2588,   86, 2589, 2591,   86,
+
+     2596,   86,   86,   86,   86,   86,   86,   86, 2604,   86,
+     2594, 2597, 2592, 2598, 2593, 2595,   86, 2599, 2600, 2602,
+       86, 2601, 3557, 2603, 2607,   86,   86, 2608, 2606, 2605,
+     2609,   86,   86,   86, 2612, 2610, 2613,   86, 2611,   86,
+       86,   86,   86, 2615,   86,   86, 2614,   86, 2617,   86,
+       86, 2621, 2622, 2616,   86, 2619,   86, 2618,   86, 2624,
+       86,   86,   86,   86, 2625, 2626, 2627,   86, 2620,   86,
+     2623,   86, 2629,   86, 2628, 2633,   86, 2632,   86,   86,
+     2630, 2631,   86,   86, 2635,   86,   86,   86,   86,   86,
+     2643, 2634, 2640,   86, 2642,   86,   86,   86, 2645, 2644,
+
+     2639,   86, 2636, 2637,   86, 2638,   86, 2641,   86, 2651,
+       86, 2649,   86, 2646,   86,   86,   86, 2657,   86, 2655,
+     2647, 2654,   86, 2648, 2652,   86, 2656,   86,   86, 2650,
+     2653, 2658,   86, 2660,   86,   86,   86, 2661, 2662,   86,
+     2664, 2659,   86, 2666, 2668,   86, 2665,   86, 2667,   86,
+     2670,   86,   86,   86, 2663,   86, 2669,   86,   86,   86,
+       86,   86, 2674, 2679,   86, 2677, 2678, 2672, 2680,   86,
+     2671, 2673, 2681,   86,   86, 2683,   86,   86,   86,   86,
+     2676,   86,   86,   86, 2675, 2688, 2686,   86,   86, 2691,
+       86,   86, 2684, 2682,   86, 2689, 2692, 2693, 2687, 2685,
+
+     2690, 2694,   86, 2697,   86,   86,   86,   86, 2698,   86,
+       86, 2701, 2695, 2702,   86,   86,   86, 2696,   86,   86,
+     2703,   86,   86,   86, 2708, 2699, 2707, 2700, 2705,   86,
+       86, 2706,   86,   86, 2704,   86,   86, 2709, 2712, 2716,
+       86, 2715, 2711, 2710, 2717,   86, 2718,   86, 2719,   86,
+       86,   86, 2713,   86,   86, 2714,   86, 2723, 2722,   86,
+     2724,   86, 2720,   86, 2725,   86, 2726,   86,   86, 2721,
+       86, 2732,   86,   86, 2734,   86,   86, 2728, 2735,   86,
+       86, 2727,   86,   86,   86,   86, 2731, 2729, 2737, 2730,
+     2738, 2736, 2733,   86, 2739,   86, 2744,   86, 2741,   86,
+
+     2746,   86,   86,   86, 2740, 2742,   86,   86, 2745,  170,
+       86,   86,   86,   86, 2753, 2743,   86, 2755,   86, 2749,
+       86, 2754, 2756, 2748, 2751,   86,   86,   86, 2747,   86,
+       86, 2750, 2762, 2752,   86, 2757, 2759,   86,   86, 2764,
+     2758,   86, 2765,   86, 2763, 2766,   86,   86, 2760, 2772,
+     2761, 2767,   86,   86, 2768,   86, 2769,   86, 2770, 2771,
+       86,   86, 2773,   86,   86,   86,   86, 2775,   86,   86,
+     2781,   86,   86,   86, 2779, 2774,   86, 2785,   86, 2776,
+     2786,   86, 2790,   86, 2778, 2777, 2780,   86,   86, 2782,
+     2783, 2784, 2787, 2788, 2792,   86, 2789, 2791,   86,   86,
+
+       86,   86,   86,   86,   86,   86,   86,   86, 2796, 2803,
+       86, 2804,   86,   86, 2802, 3557, 2793, 2794, 2795, 2797,
+     2798, 2799, 2800,   86, 2801,   86, 2808,   86, 2809,   86,
+     2810, 2807,   86, 2805,   86,   86,   86,   86,   86,   86,
+       86, 2806,   86, 2815,   86,   86, 2820,   86,   86, 2812,
+     2811, 2814, 2819, 2817, 2813, 2821,   86, 2823,   86, 2816,
+     2818,   86,   86, 2822, 2824,   86,   86, 2826,   86,   86,
+       86, 2825,   86, 2829, 2830,   86,   86, 2827,   86, 2836,
+       86, 2835,   86,   86, 2839,   86, 2828,   86,   86,   86,
+     2831, 2832,   86, 2842, 2834, 2833,   86, 2837, 2840,   86,
+
+       86, 2838, 2844, 2841, 2845, 2846,   86, 2843,   86,   86,
+       86,   86, 2847, 2851,   86,   86,   86,   86,   86, 2855,
+     2853, 2854,   86, 2848, 2856,   86,   86, 2852,   86, 2849,
+     2850, 2858,   86, 2859,   86, 2857,   86,   86, 2861, 2864,
+       86,   86, 2865, 2860, 2867,   86, 2863,   86, 2862,   86,
+       86,   86,   86, 2874,   86,   86,   86,   86, 3557, 2866,
+     2868, 2871, 2869, 2870, 2872, 2873, 2877,   86,   86,   86,
+       86, 2875, 2876, 2878, 2879,   86,   86,   86,   86,   86,
+     2881,   86,   86,   86, 2880, 2882,   86, 2884, 2887, 2885,
+       86, 2888, 2890,   86, 2886, 2883,   86, 2889, 2891,   86,
+
+       86, 2892, 2894,  170,   86,   86,   86, 2895, 2899, 2893,
+     2896,   86,   86, 2901,   86,   86, 2900, 3557,   86, 2904,
+       86,   86, 2897, 2903, 2898, 2905,   86, 2907,   86,   86,
+     2902, 2909, 2908,   86, 2906,   86, 2910,   86, 2911,   86,
+     2912, 2914,   86,   86,   86,   86, 2915,   86, 2916,   86,
+       86,   86, 2921, 2913, 2917, 2922, 2923, 2919,   86, 2918,
+       86,   86,   86,   86,   86,   86,   86, 2927, 2926, 2925,
+       86, 2920, 2924,   86,   86, 2929,   86, 2928, 2930, 2931,
+       86,   86,   86,   86, 2932,   86, 2936,   86,   86, 2933,
+     2934, 2935, 2937, 2938, 2940,   86,   86,   86, 2939,   86,
+
+       86, 2941, 2945,   86, 2946,   86, 2942,   86,   86,   86,
+       86, 2951,   86,   86,   86,   86, 2943, 2948, 2944, 2955,
+     2956,   86, 2949,   86, 2947, 2950, 2958,   86, 2952, 2953,
+     2959, 2961,   86, 2954, 2962,   86,   86,   86,   86,   86,
+       86,   86,   86,   86, 2968, 2960, 2963, 2965, 2957, 2966,
+       86,   86,   86,   86, 2967, 2969,   86, 2970, 2972,   86,
+       86, 2974,   86, 2983, 2964, 2971, 2976,   86, 2977,   86,
+       86, 2973, 2978,   86, 2979,   86,   86, 2982,   86,   86,
+     2975, 2980,   86, 2986, 2981,   86,   86, 2984, 2987,   86,
+       86, 2985,   86, 2990, 2991,   86,   86, 2988, 2992,   86,
+
+     2993,   86,   86, 2995,   86, 2994, 2989, 2997,   86, 2996,
+       86, 3000,   86,   86, 3001, 3002,   86,   86, 3004,   86,
+       86,   86, 2998,   86,   86, 3008, 3009,   86, 3010, 3011,
+     2999,   86, 3003, 3005,   86,   86,   86, 3007, 3013, 3006,
+       86, 3012,   86, 3014,   86,   86, 3019,   86,   86,   86,
+       86, 3018,   86, 3021, 3022,   86,   86, 3015, 3024,   86,
+     3016, 3023, 3017,   86,   86,   86, 3025, 3027,   86, 3028,
+     3031,   86, 3020, 3026,   86,   86, 3029, 3030,   86, 3035,
+       86,   86,   86,   86,   86, 3037, 3047,   86,   86, 3032,
+       86, 3053, 3034, 3038, 3033, 3036, 3041, 3039,   86, 3042,
+
+     3557, 3044,   86, 3040, 3043,   86, 3045,   86,   86, 3046,
+       86, 3048,   86, 3049,   86, 3050,   86, 3051,   86, 3052,
+       86,   86, 3055,   86, 3056, 3054,   86, 3059, 3058,   86,
+       86, 3060,   86, 3064,   86, 3057, 3065,   86, 3061,   86,
+       86,   86, 3066, 3069,   86,   86, 3067,   86, 3071,   86,
+     3062,   86, 3063,   86, 3070,   86, 3072, 3073,   86, 3068,
+       86,   86, 3074, 3078, 3075, 3079,   86, 3080,   86, 3076,
+     3077,   86,   86,   86,   86, 3081,   86, 3086,   86, 3557,
+       86, 3082, 3087,   86,   86, 3084,   86, 3089, 3090,   86,
+       86, 3085, 3083, 3088, 3091, 3092,   86, 3094,   86,   86,
+
+     3093,   86, 3098,   86, 3095,   86,   86,   86,   86,   86,
+     3105,   86,   86, 3102, 3099,   86,   86,   86, 3100, 3097,
+     3103,   86, 3108,   86, 3096,   86, 3109, 3106, 3112, 3104,
+       86, 3110, 3101, 3107, 3111,   86,   86,   86, 3115, 3117,
+       86, 3116, 3118,   86, 3119,   86,   86,   86, 3113,   86,
+     3114,   86, 3124,   86,   86, 3120, 3123,   86,   86, 3125,
+     3127,   86, 3126,   86,   86,   86,   86, 3121, 3122,   86,
+     3131, 3128, 3133, 3135,   86, 3129,   86,   86,   86,   86,
+     3136,   86, 3137,   86, 3132, 3130, 3138,   86, 3139,   86,
+       86, 3144,   86,   86, 3134,   86,   86,   86, 3140,   86,
+
+       86, 3148,   86, 3143, 3141, 3142, 3145,   86, 3146, 3147,
+       86, 3149, 3153,   86,   86, 3150,   86, 3155, 3152, 3151,
+       86,   86,   86, 3156, 3159,   86, 3161,   86,   86, 3163,
+       86,   86,   86, 3154, 3162, 3165,   86,   86, 3157,   86,
+       86, 3160, 3171,   86, 3168,   86,   86, 3158, 3166,   86,
+     3170, 3174, 3164, 3167,   86,   86, 3169,   86, 3173,   86,
+     3177,   86,   86, 3180,   86, 3181, 3172,   86,   86,   86,
+     3183,   86,   86, 3184, 3176, 3178,   86, 3175, 3186,   86,
+       86, 3179, 3187,   86, 3190,   86,   86, 3182,   86,   86,
+     3195, 3185, 3189,   86,   86, 3188,   86, 3192, 3193,   86,
+
+     3199,   86,   86,   86, 3191, 3557, 3197,   86, 3194,   86,
+     3201,   86, 3196,   86, 3202,   86, 3203, 3200, 3206, 3198,
+       86, 3204, 3209, 3205,   86, 3207,   86,   86,   86,   86,
+     3208, 3210, 3212,   86, 3211,   86, 3215,   86,   86, 3214,
+     3213,   86,   86, 3218,   86,   86,   86,   86, 3223,   86,
+     3219,   86,   86,   86, 3216, 3217, 3227,   86, 3230, 3220,
+     3222, 3226, 3228,   86,   86, 3224,   86, 3225, 3229,   86,
+     3221, 3232, 3233,   86, 3234,   86, 3235,   86, 3231, 3236,
+       86,   86,   86, 3239,   86,   86, 3241,   86,   86,   86,
+     3240, 3242,   86,   86, 3237,   86,   86,   86, 3248, 3249,
+
+       86,   86,   86, 3243,   86,   86,   86,   86, 3238,   86,
+     3244, 3255,   86,   86, 3246, 3245, 3254,   86, 3247, 3252,
+     3258, 3251, 3256,   86, 3253, 3260,   86, 3250,   86, 3259,
+       86, 3257,   86, 3261, 3263,   86, 3264,   86, 3262,   86,
+       86, 3267, 3268,   86, 3265,   86, 3266,   86, 3269, 3270,
+       86,   86,   86,   86,   86,   86, 3271, 3272,   86, 3273,
+     3276,   86,   86, 3274, 3277, 3275, 3279, 3278,   86,   86,
+       86,   86,   86,   86,   86,   86, 3288,   86, 3291,   86,
+     3289, 3280,   86, 3557,   86,   86, 3284, 3292, 3281, 3282,
+     3283, 3285, 3286,   86, 3287,   86, 3294, 3290, 3295, 3293,
+
+     3296,   86, 3297,   86,   86, 3299,   86,   86, 3298, 3302,
+       86,   86, 3300, 3414, 3301, 3303,   86, 3304, 3305,   86,
+       86, 3306, 3307, 3311,   86, 3308,   86, 3309, 3310,   86,
+       86,   86, 3314,   86, 3312,   86,   86,   86, 3317,   86,
+     3313,   86,   86, 3321,   86,   86,   86, 3320,   86,   86,
+     3316,   86,   86, 3315,   86, 3324, 3325,   86, 3326, 3318,
+       86, 3319, 3329, 3330,   86, 3322, 3327,   86, 3332, 3331,
+       86, 3323, 3328, 3333,   86, 3334,   86,   86,   86,   86,
+     3341,   86, 3336, 3339,   86, 3335,   86, 3337, 3340,   86,
+     3338,   86,   86,   86, 3348,   86, 3343, 3345, 3346,   86,
+
+     3349,   86, 3351,   86, 3342, 3344,   86, 3350, 3352,   86,
+     3347,   86, 3355,   86, 3353,   86, 3354, 3356,   86, 3358,
+       86, 3359,   86,   86, 3357, 3360,   86, 3361,   86, 3362,
+       86, 3363,   86, 3364,   86, 3365,   86,   86, 3368,   86,
+     3369,   86,   86,   86,   86,   86, 3367, 3373,   86, 3366,
+       86, 3370, 3375,   86,   86, 3371,   86,   86, 3379,   86,
+     3376, 3380,   86,   86, 3372, 3382,   86, 3377, 3378, 3374,
+       86,   86,   86, 3384, 3381,   86, 3386,   86, 3389,   86,
+     3388, 3383,   86,   86,   86,   86,   86, 3391,   86,   86,
+     3387,   86, 3395, 3390,   86, 3397,   86, 3385, 3396,   86,
+
+       86,   86, 3392, 3393, 3394, 3400,   86,   86,   86, 3398,
+     3401,   86, 3402, 3403,   86, 3404,   86, 3405,   86,   86,
+     3407,   86, 3399, 3408, 3406,   86, 3409,   86,   86,   86,
+     3416, 3411, 3413,   86,   86, 3410, 3412,   86,   86,   86,
+       86,   86,   86, 3415,   86,   86, 3417, 3425,   86, 3423,
+     3428,   86,   86, 3418, 3420, 3419, 3422, 3424,   86,   86,
+     3557,   86,   86, 3427, 3421, 3426, 3430,   86, 3429, 3433,
+       86, 3434, 3432, 3431, 3435,   86,   86, 3436, 3437,   86,
+     3438,   86,   86,   86,   86,   86, 3439, 3441, 3442,   86,
+     3443,   86, 3446,   86,   86,   86,   86,   86,   86, 3449,
+
+     3450,   86, 3440, 3452,   86,   86, 3445, 3447, 3448, 3453,
+       86,   86, 3454,   86, 3444, 3451, 3456,   86, 3459,   86,
+       86, 3460,   86,   86, 3455,   86, 3457, 3463, 3464,   86,
+     3461, 3458,   86,   86,   86,   86, 3469,   86,   86, 3465,
+     3468,   86, 3462, 3470,   86, 3466,   86,   86, 3467,   86,
+       86, 3474,   86,   86,   86, 3476,   86,   86,   86, 3471,
+     3473, 3472, 3481, 3482, 3483,   86, 3478, 3479,   86, 3475,
+       86, 3477,   86, 3487,   86, 3480,   86, 3489,   86, 3490,
+       86, 3488,   86,   86,   86, 3491,   86, 3492, 3484, 3486,
+     3485, 3493, 3495, 3496,   86,   86, 3498,   86,   86,   86,
+
+     3497,   86,   86, 3494,   86, 3499,   86, 3504,   86, 3501,
+       86,   86,   86,   86,   86, 3507, 3508,   86, 3500, 3509,
+       86,   86, 3510, 3502, 3506, 3503, 3511, 3505,   86,   86,
+     3515, 3512,   86,   86,   86,   86, 3519, 3516,   86, 3513,
+       86, 3514,   86, 3521,   86, 3522, 3517,   86,   86, 3526,
+       86,   86, 3523, 3529,   86, 3524, 3527, 3520,   86, 3525,
+     3518,   86,   86, 3528,   86, 3530,   86,   86,   86, 3531,
+       86, 3533, 3535,   86,   86, 3537,   86,   86,   86, 3538,
+       86, 3541,   86, 3532, 3542,   86, 3534, 3536,   86, 3545,
+     3546,   86,   86, 3548,   86, 3539, 3540, 3543,   86, 3547,
+
+       86, 3544, 3549,   86,   86, 3550,   86,   86, 3557, 3551,
+     3557, 3552, 3555,   86, 3556,   86, 3557, 3557, 3557, 3553,
+     3557, 3557, 3557, 3557, 3557, 3557, 3554,   47,   47,   47,
+       47,   47,   47,   47,   52,   52,   52,   52,   52,   52,
+       52,   57,   57,   57,   57,   57,   57,   57,   63,   63,
+       63,   63,   63,   63,   63,   68,   68,   68,   68,   68,
+       68,   68,   74,   74,   74,   74,   74,   74,   74,   80,
+       80,   80,   80,   80,   80,   80,   89,   89, 3557,   89,
+       89,   89,   89,  160,  160, 3557, 3557, 3557,  160,  160,
+      162,  162, 3557, 3557,  162, 3557,  162,  164, 3557, 3557,
+
+     3557, 3557, 3557,  164,  167,  167, 3557, 3557, 3557,  167,
+      167,  169, 3557, 3557, 3557, 3557, 3557,  169,  171,  171,
+     3557,  171,  171,  171,  171,  174, 3557, 3557, 3557, 3557,
+     3557,  174,  177,  177, 3557, 3557, 3557,  177,  177,   90,
+       90, 3557,   90,   90,   90,   90,   17, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557
     } ;
 
-static yyconst flex_int16_t yy_chk[6834] =
+static yyconst flex_int16_t yy_chk[6988] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -2350,18 +2388,18 @@ static yyconst flex_int16_t yy_chk[6834] =
         5,    3,    6,   24,    4,   24,   24,    5,   24,    6,
         7,    7,    7,    7,   24,    7,    8,    8,    8,    8,
        33,    8,    7,    9,    9,    9,   26,   26,    8,   10,
-       10,   10,   19,   29,    9,   33,   19,   29, 3491,   35,
+       10,   10,   19,   29,    9,   33,   19,   29, 3565,   35,
        10,   11,   11,   11,   11,   11,   11,   13,   13,   13,
 
        13,   34,   13,   11,   35,   99,   34,   29,   38,   13,
        51,   51,   11,   12,   12,   12,   12,   12,   12,   14,
        14,   14,   14,   99,   14,   12,   15,   15,   15,   38,
        23,   14,   23,   23,   12,   23,   46,   15,   16,   16,
-       16,   23,   23,   25,   27,   27,   25,   25, 2838,   16,
+       16,   23,   23,   25,   27,   27,   25,   25, 2894,   16,
        25,   46,   27,   30,   30,   25,   27,   56,   40,   27,
        56,   73,   31,   31,   25,   28,   67,   67,   30,   32,
        28,   31,   40,   32,   28,   73,   32,   28,   92,   28,
-       28,   92,   31,   32, 1127,   32,   36,   36,   37,   37,
+       28,   92,   31,   32, 1138,   32,   36,   36,   37,   37,
        28,   45,   45,   37,   97,   36,   45,   97,   41,   41,
 
        45,   36,   87,   41,   93,   36,   87,   37,   93,   37,
@@ -2400,700 +2438,716 @@ static yyconst flex_int16_t yy_chk[6834] =
       200,  201,  202,  197,  203,  204,  201,  202,  205,  197,
       197,  199,  196,  206,  205,  207,  203,  206,  208,  200,
       207,  209,  213,  210,  211,  204,  214,  213,  216,  217,
-      556,  214,  218,  216,  208,  209,  211,  205,  210,  211,
+      559,  214,  218,  216,  208,  209,  211,  205,  210,  211,
       215,  215,  220,  220,  215,  219,  215,  221,  218,  217,
-      222,  219,  223,  221,  556,  224,  222,  227,  215,  221,
+      222,  219,  223,  221,  559,  224,  222,  227,  215,  221,
       215,  224,  225,  227,  228,  229,  230,  231,  225,  228,
-      230,  229,  223,  231,  232,  234,  233,  225,  235,  236,
-      237,  232,  233,  238,  235,  239,  237,  240,  234,  241,
-      245,  243,  242,  239,  241,  244,  238,  246,  248,  236,
-
-      240,  242,  246,  246,  247,  238,  243,  250,  249,  247,
-      245,  244,  249,  251,  252,  253,  248,  254,  255,  251,
-      257,  253,  259,  255,  258,  261,  263,  264,  259,  250,
-      260,  258,  252,  252,  262,  270,  260,  254,  263,  257,
-      262,  264,  265,  265,  261,  266,  266,  267,  268,  269,
-      271,  269,  272,  267,  268,  271,  273,  274,  270,  275,
-      277,  276,  288,  278,  272,  274,  276,  279,  269,  278,
-      283,  267,  280,  279,  282,  273,  281,  280,  284,  275,
-      282,  281,  285,  277,  286,  283,  287,  288,  290,  289,
-      293,  290,  284,  293,  287,  289,  294,  291,  286,  291,
-
-      285,  292,  292,  295,  295,  296,  296,  297,  299,  298,
-      301,  299,  300,  302,  294,  303,  300,  304,  174,  301,
-      305,  303,  302,  297,  298,  306,  305,  306,  307,  308,
-      314,  304,  310,  308,  307,  309,  309,  310,  311,  312,
-      313,  315,  316,  319,  311,  312,  317,  317,  314,  318,
-      308,  321,  318,  320,  322,  316,  324,  320,  323,  323,
-      313,  319,  315,  325,  312,  326,  325,  327,  328,  329,
-      321,  328,  322,  327,  324,  333,  331,  326,  336,  332,
-      333,  329,  337,  325,  330,  331,  335,  334,  169,  335,
-      334,  336,  334,  330,  337,  340,  330,  332,  340,  341,
-
-      341,  330,  330,  330,  330,  334,  339,  338,  334,  338,
-      338,  339,  339,  342,  343,  345,  346,  344,  347,  347,
-      354,  348,  349,  349,  345,  346,  348,  350,  350,  343,
-      342,  351,  352,  342,  344,  344,  353,  352,  355,  354,
-      356,  357,  358,  358,  360,  358,  351,  357,  353,  369,
-      369,  361,  363,  362,  358,  356,  361,  363,  355,  362,
-      364,  366,  375,  365,  360,  364,  365,  367,  365,  368,
-      367,  364,  388,  370,  410,  366,  371,  371,  368,  370,
-      372,  377,  375,  367,  376,  372,  367,  376,  367,  373,
-      373,  378,  373,  388,  379,  382,  377,  381,  373,  410,
-
-      381,  167,  373,  384,  385,  376,  378,  373,  379,  382,
-      373,  374,  374,  385,  374,  386,  381,  391,  384,  394,
-      386,  386,  389,  387,  390,  392,  391,  374,  396,  387,
-      374,  166,  374,  395,  374,  383,  387,  383,  383,  390,
-      393,  389,  396,  399,  392,  394,  393,  383,  383,  383,
-      383,  383,  397,  395,  383,  398,  400,  401,  397,  402,
-      398,  404,  397,  399,  402,  403,  406,  404,  405,  405,
-      407,  408,  401,  409,  411,  414,  400,  415,  398,  409,
-      403,  416,  407,  412,  417,  408,  406,  418,  412,  418,
-      411,  413,  413,  415,  413,  414,  420,  416,  417,  419,
-
-      420,  419,  419,  421,  422,  422,  423,  421,  424,  426,
-      425,  430,  428,  432,  427,  431,  164,  430,  432,  419,
-      428,  428,  421,  424,  431,  423,  425,  426,  427,  433,
-      434,  435,  428,  433,  428,  429,  436,  435,  437,  434,
-      429,  438,  440,  439,  437,  438,  439,  440,  429,  429,
-      441,  443,  429,  429,  442,  442,  429,  436,  444,  444,
-      445,  446,  447,  447,  443,  445,  448,  449,  450,  451,
-      441,  449,  448,  452,  446,  453,  454,  454,  452,  455,
-      453,  456,  457,  450,  458,  454,  459,  460,  465,  459,
-      451,  455,  460,  461,  462,  467,  458,  461,  463,  463,
-
-      457,  456,  464,  466,  466,  471,  462,  464,  472,  465,
-      469,  469,  473,  474,  475,  476,  472,  467,  477,  475,
-      479,  473,  481,  480,  486,  482,  471,  483,  484,  486,
-      477,  487,  490,  483,  474,  476,  488,  484,  479,  482,
-      479,  480,  481,  485,  488,  487,  490,  488,  489,  485,
-      491,  489,  492,  493,  494,  495,  496,  494,  492,  497,
-      498,  495,  499,  500,  497,  491,  501,  500,  505,  502,
-      496,  501,  503,  493,  504,  506,  509,  503,  511,  495,
-      510,  512,  498,  499,  502,  512,  515,  505,  506,  513,
-      504,  507,  507,  511,  516,  514,  509,  507,  516,  507,
-
-      514,  510,  515,  518,  517,  507,  520,  507,  513,  517,
-      507,  507,  521,  517,  519,  523,  524,  507,  518,  519,
-      522,  521,  520,  526,  525,  520,  522,  525,  527,  529,
-      523,  522,  524,  528,  528,  530,  530,  531,  532,  535,
-      533,  534,  534,  536,  537,  539,  526,  538,  527,  537,
-      532,  540,  531,  541,  529,  533,  538,  544,  535,  541,
-      543,  544,  546,  545,  539,  536,  540,  545,  546,  543,
-      547,  548,  549,  550,  551,  552,  553,  554,  566,  555,
-      553,  555,  547,  566,  557,  560,  548,  550,  562,  551,
-      554,  549,  557,  552,  558,  558,  559,  560,  561,  564,
-
-      562,  565,  559,  563,  561,  567,  563,  569,  567,  568,
-      162,  571,  581,  564,  570,  581,  565,  579,  568,  570,
-      570,  572,  572,  569,  571,  568,  573,  573,  568,  574,
-      575,  575,  576,  576,  577,  574,  578,  580,  579,  582,
-      577,  578,  578,  583,  582,  584,  586,  585,  587,  580,
-      585,  586,  589,  584,  588,  590,  589,  591,  593,  592,
-      594,  590,  583,  592,  595,  594,  596,  596,  597,  598,
-      599,  587,  600,  588,  602,  599,  593,  591,  595,  601,
-      603,  607,  604,  597,  605,  606,  603,  604,  606,  609,
-      598,  600,  610,  606,  602,  601,  606,  606,  605,  607,
-
-      608,  608,  613,  614,  611,  612,  616,  609,  610,  611,
-      612,  617,  616,  623,  618,  619,  613,  618,  614,  619,
-      617,  620,  621,  622,  624,  621,  620,  625,  622,  623,
-      626,  627,  628,  632,  625,  630,  627,  629,  629,  631,
-      633,  619,  624,  626,  630,  635,  634,  636,  638,  160,
-      642,  638,  628,  636,  632,  634,  633,  635,  631,  637,
-      639,  639,  643,  639,  640,  637,  641,  640,  642,  644,
-      645,  641,  646,  648,  644,  647,  643,  650,  646,  648,
-      647,  649,  651,  653,  649,  652,  654,  651,  655,  645,
-      652,  652,  656,  655,  657,  658,  653,  660,  656,  654,
-
-      659,  669,  650,  663,  658,  659,  663,  655,  655,  661,
-      661,  662,  665,  657,  664,  668,  668,  660,  662,  671,
-      664,  663,  666,  667,  665,  673,  669,  666,  667,  667,
-      670,  672,  670,  672,  674,  675,  676,  666,  671,  677,
-      678,  679,  680,  673,  685,  679,  678,  681,  682,  683,
-      684,  680,  674,  675,  687,  676,  685,  686,  688,  677,
-      687,  689,  681,  682,  690,  691,  692,  683,  695,  684,
-      693,  701,  686,  694,  696,  689,  690,  694,  688,  697,
-      698,  699,  704,  700,  691,  701,  695,  692,  700,  693,
-      696,  702,  702,  705,  707,  706,  704,  697,  698,  698,
-
-      699,  703,  708,  709,  710,  703,  706,  708,  707,  711,
-      712,  713,  705,  714,  715,  718,  713,  712,  719,  709,
-      714,  716,  711,  710,  717,  719,  716,  720,  721,  717,
-      722,  723,  725,  718,  724,  730,  720,  725,  715,  722,
-      724,  726,  721,  723,  726,  727,  728,  729,  731,  727,
-      730,  732,  733,  733,  734,  734,  729,  735,  735,  736,
-      728,  737,  731,  734,  736,  739,  741,  740,  743,  744,
-      737,  742,  732,  740,  745,  742,  746,  747,  749,  750,
-      743,  748,  746,  751,  739,  747,  741,  754,  748,  757,
-      760,  761,  745,  772,  744,  763,  749,  761,  770,  760,
-
-      764,  763,  754,  751,  750,  752,  757,  752,   85,  764,
-      752,  766,  765,  772,  752,  766,  770,  752,  767,  767,
-      768,  768,  769,  771,  752,  752,  773,  752,  765,  775,
-      776,  777,  773,  769,  780,  776,  778,  771,  774,  774,
-      774,  782,  774,  779,  781,  774,  782,  779,  781,  775,
-      774,  783,  777,  785,  778,  784,  774,  774,  780,  786,
-      784,  788,  787,  791,  781,  787,  788,  788,  785,  789,
-      783,  790,  790,  798,  792,  798,  789,  794,  791,  792,
-      793,  793,  794,  795,  786,  796,  795,  797,  797,  799,
-      796,  800,  801,  802,  804,  803,  801,  805,  805,  810,
-
-      806,  799,  804,  807,  808,  808,  809,  811,  814,  814,
-      800,  810,  812,  802,  803,  806,  813,  807,  812,  819,
-      815,  813,  817,  825,  809,  815,  815,  817,  818,  811,
-      820,  825,  821,  822,  818,  824,  820,  821,  819,  822,
-      823,  824,  828,  823,  826,  826,  827,  827,  829,  830,
-      828,  831,  832,  833,  830,  834,  835,  835,  831,  836,
-      838,  838,  840,  837,  844,  850,  829,  839,  836,  833,
-      832,  837,  845,  839,  834,  842,  843,  845,  846,  847,
-      849,  840,  847,  851,  842,  843,  848,  846,  844,  852,
-      850,  848,  851,  853,  849,  854,  854,  855,  853,  853,
-
-      856,  857,  852,  858,  859,  860,  867,  862,  860,  862,
-      857,  864,  855,  863,  863,  865,  860,  866,  869,  856,
-      865,  868,  859,  870,  871,  872,  867,  858,  874,  876,
-      873,  875,  864,  871,  873,  876,  877,  878,  866,  879,
-      869,  868,  880,  870,  882,  877,  874,  881,  872,  878,
-      875,  883,  882,  881,  884,  886,  880,  887,  879,  884,
-      885,  885,  888,  889,  890,  883,  891,  892,  893,  895,
-      894,  888,  890,  896,  886,  895,  898,  887,  897,  896,
-      899,  900,  898,  889,  903,  901,  891,  893,  903,  892,
-      894,  901,  897,  902,  899,  904,  905,  906,  907,  902,
-
-      909,  900,  906,  908,  908,  910,  909,  911,  905,  912,
-      911,  910,  913,  915,  904,  914,  905,  916,  916,  907,
-      917,  914,  921,  918,  924,  913,  919,  912,  918,  919,
-      920,  923,  923,  915,  925,  920,  920,  921,  917,  922,
-      926,  927,  919,  922,  919,  926,  924,  929,  930,  933,
-      932,  934,  936,  936,  925,  937,  939,  939,  940,  937,
-      927,  941,  930,  932,  938,  941,  942,  962,  962,  933,
-      944,  929,  934,  935,  943,  944,  935,  945,  935,  938,
-      946,  942,  935,  940,  935,  946,  946,  947,  943,  935,
-      948,  945,  950,  949,  935,  951,  947,  949,  953,  952,
-
-      951,  954,  955,  953,  948,  956,  958,  950,  957,  949,
-      951,  952,  958,  959,  960,  954,  961,  957,  959,  956,
-      960,  963,  961,  955,  964,  965,  963,  966,  969,  970,
-      964,  967,  972,  975,  970,  973,  973,  974,  971,  976,
-      969,  975,  974,  977,  972,  980,  966,  965,  978,  967,
-      968,  968,  971,  979,  981,  976,  968,  977,  968,  983,
-      981,  980,  984,  982,  968,  985,  986,  978,  982,  968,
-      968,  983,  979,  987,  988,  988,  968,  990,  989,  992,
-      984,  985,  989,  993,  986,  992,  993,  994,  995,  996,
-      997,  987,  999,  995,  998, 1001,  997,  990, 1002,  998,
-
-     1003, 1005,  996, 1004, 1001, 1006,  994, 1002, 1007, 1004,
-     1005,  999, 1008, 1007, 1009, 1010, 1003, 1011, 1012, 1014,
-     1015, 1013, 1018, 1021, 1006, 1014, 1020, 1012, 1009, 1011,
-     1013, 1022, 1008, 1016, 1023, 1010, 1022, 1015, 1018, 1016,
-     1020, 1024, 1025, 1021, 1026, 1027, 1028, 1031, 1032,   80,
-     1027, 1028, 1031, 1023, 1035, 1024, 1036, 1032, 1034, 1026,
-     1025, 1033, 1033, 1035, 1034, 1037, 1039, 1040, 1045, 1044,
-     1046, 1036, 1040, 1040, 1043, 1042, 1042, 1043, 1037, 1042,
-     1047, 1048, 1039, 1044, 1049, 1050, 1046, 1051, 1045, 1052,
-     1053, 1050, 1054, 1058, 1048, 1052, 1055, 1054, 1047, 1049,
-
-     1057, 1059, 1061, 1057, 1060, 1053, 1059, 1051, 1062, 1060,
-     1055, 1063, 1065, 1067, 1058, 1064, 1063, 1062, 1061, 1067,
-     1064, 1068, 1069, 1070, 1065, 1071, 1071, 1072, 1069, 1070,
-     1073, 1074, 1075, 1075, 1074, 1076, 1072, 1068, 1077, 1078,
-     1079, 1080, 1083, 1079, 1081, 1082, 1085, 1083, 1073, 1091,
-     1081, 1082, 1085, 1076, 1080, 1084, 1086, 1077, 1087, 1078,
-     1084, 1086, 1089, 1090, 1087, 1092, 1097, 1089, 1093, 1091,
-     1095, 1092, 1098, 1093, 1094, 1094, 1096, 1099, 1101, 1095,
-     1099, 1090, 1102, 1100, 1097, 1096, 1100, 1102, 1103, 1101,
-     1104, 1098, 1105, 1106, 1107, 1108, 1109, 1110, 1110, 1106,
-
-     1107, 1109, 1104, 1111, 1112, 1113, 1103, 1114, 1115, 1116,
-     1108, 1105, 1115, 1118, 1117, 1119, 1121, 1113, 1112, 1122,
-     1122, 1123, 1111, 1117, 1126, 1114, 1124, 1116, 1125, 1123,
-     1129, 1124, 1118, 1125, 1128, 1121, 1131, 1130, 1132, 1134,
-     1119, 1131, 1133, 1133, 1126, 1129, 1135, 1132, 1128, 1130,
-     1136, 1137, 1135, 1138, 1141, 1139, 1136, 1139, 1138, 1134,
-     1140, 1142, 1144, 1145, 1143, 1140, 1146, 1137, 1141, 1143,
-     1147, 1148, 1151, 1146, 1152, 1142, 1153, 1144, 1150, 1150,
-     1155, 1154, 1145, 1156,   75, 1147, 1151, 1154, 1156, 1158,
-     1148, 1153, 1152, 1158, 1159, 1159, 1160, 1156, 1162, 1156,
-
-     1155, 1160, 1156, 1161, 1161, 1162, 1163, 1164, 1165, 1167,
-     1164, 1166, 1168, 1169, 1170,   74, 1171, 1168, 1167, 1172,
-     1163, 1171, 1174, 1173, 1176, 1176, 1170, 1165, 1179, 1166,
-     1177, 1178, 1169, 1172, 1173, 1177, 1178, 1180, 1182, 1181,
-     1183, 1174, 1180, 1181, 1184, 1185, 1186, 1182, 1179, 1188,
-     1187, 1189, 1190, 1191, 1192, 1183, 1188, 1196, 1186, 1184,
-     1193, 1194, 1195, 1189, 1185, 1187, 1193, 1197, 1195, 1198,
-     1199, 1190, 1192, 1200, 1191, 1202, 1194, 1196, 1198, 1201,
-     1203, 1204, 1205, 1206, 1208, 1199, 1209, 1197, 1205, 1211,
-     1208, 1201, 1200, 1210, 1202, 1212, 1204, 1211, 1213, 1214,
-
-     1215, 1209, 1217, 1206, 1214, 1203, 1218, 1210, 1281, 1219,
-     1281, 1216, 1215, 1222, 1213, 1212, 1216, 1216, 1220, 1220,
-     1218, 1217, 1219, 1221, 1221, 1223, 1222, 1224, 1221, 1225,
-     1225, 1221, 1221, 1224, 1223, 1226, 1221, 1228, 1227, 1229,
-     1226, 1232, 1221, 1228, 1229, 1230, 1221, 1227, 1231, 1231,
-     1230, 1233, 1233, 1234, 1235, 1236, 1234, 1237, 1234, 1238,
-     1239, 1240, 1232, 1237, 1241, 1242, 1240, 1245, 1238, 1243,
-     1244, 1249, 1245, 1236, 1235, 1243, 1244, 1246, 1241, 1247,
-     1239, 1246, 1248, 1242, 1260, 1249, 1255, 1248, 1247, 1250,
-     1250, 1251, 1251, 1247, 1251, 1247, 1252, 1247, 1254, 1247,
-
-     1256, 1255, 1254, 1257, 1258, 1259, 1260, 1252, 1261, 1258,
-     1258, 1262, 1257, 1261, 1259, 1263, 1264, 1265, 1256, 1266,
-     1267, 1268, 1268, 1269, 1263, 1262, 1267, 1270, 1272, 1271,
-     1273, 1269, 1275, 1266, 1271, 1264, 1265, 1274, 1276, 1273,
-     1277, 1270, 1272, 1279, 1274, 1277, 1278, 1278, 1280, 1280,
-     1275, 1283, 1284, 1285, 1283, 1286, 1288, 1284, 1279, 1287,
-     1287, 1289, 1289, 1276, 1286, 1290, 1290, 1292, 1291, 1293,
-     1294, 1294, 1285, 1291, 1295, 1296, 1288, 1297, 1298, 1299,
-     1297, 1300, 1301, 1303, 1306, 1299, 1300, 1302, 1292, 1302,
-     1293, 1301, 1296, 1305, 1295, 1307, 1305, 1308, 1298, 1306,
-
-     1307, 1303, 1309, 1311, 1310, 1313, 1312, 1309, 1311, 1312,
-     1313, 1308, 1310, 1314, 1314, 1315, 1316, 1317, 1318, 1319,
-     1315, 1321, 1322, 1317, 1323, 1318, 1324, 1321, 1322, 1323,
-     1325, 1324, 1319, 1326, 1316, 1327, 1325, 1328, 1329, 1329,
-     1330, 1332, 1326, 1333, 1335, 1334, 1332, 1336, 1328, 1337,
-     1338, 1339, 1340, 1344, 1327, 1334, 1338, 1339, 1340, 1335,
-     1330, 1333, 1342, 1343, 1345, 1347, 1346, 1336, 1342, 1348,
-     1349, 1349, 1337, 1344, 1350, 1351, 1353, 1343, 1346, 1347,
-     1352, 1353, 1355, 1343, 1345, 1354, 1354, 1348, 1356, 1358,
-     1359, 1360, 1361, 1356, 1350, 1359, 1359, 1363, 1352, 1362,
-
-     1351, 1361, 1364, 1365, 1367, 1355, 1369, 1362, 1358, 1360,
-     1368, 1363, 1368, 1367, 1366, 1373, 1375, 1364, 1365, 1366,
-     1369, 1365, 1366, 1371, 1372, 1374, 1373, 1376, 1372, 1371,
-     1374, 1374, 1377, 1378, 1379, 1375, 1380, 1381, 1378, 1379,
-     1382, 1383, 1385,   68, 1386, 1382, 1387, 1388, 1388, 1390,
-     1377, 1389, 1391, 1376, 1380, 1389, 1385, 1381, 1393, 1392,
-     1394, 1383, 1386, 1395, 1387, 1392, 1396, 1390, 1397, 1398,
-     1393, 1391, 1402, 1399, 1403, 1400, 1406, 1395, 1399, 1394,
-     1401, 1396, 1400, 1397, 1404, 1401, 1405, 1405, 1398, 1407,
-     1402, 1406, 1408, 1404, 1410, 1403, 1409, 1409, 1407, 1411,
-
-     1410, 1412, 1413, 1413, 1415, 1411, 1414, 1414, 1416, 1417,
-     1415, 1418, 1408, 1419, 1420, 1412, 1418, 1421, 1428, 1419,
-     1420, 1422, 1422, 1421, 1416, 1423, 1423, 1425, 1425, 1426,
-     1417, 1427, 1429, 1426, 1430, 1431, 1428, 1434, 1432, 1435,
-     1427, 1433, 1433, 1438, 1429, 1432, 1436, 1435, 1430, 1437,
-     1431, 1436, 1441, 1439, 1443, 1440, 1444, 1434, 1439, 1439,
-     1440, 1440, 1438, 1437, 1442, 1442, 1446, 1445, 1447, 1448,
-     1449, 1446, 1441, 1443, 1450, 1444, 1445, 1451, 1452, 1453,
-     1450, 1455, 1451, 1458, 1454, 1456, 1457, 1447, 1449, 1448,
-     1454, 1456, 1457, 1459, 1460, 1461, 1462, 1463, 1452, 1469,
-
-     1455, 1464, 1458, 1465, 1465, 1453, 1466, 1467, 1468, 1466,
-     1462, 1469, 1459, 1460, 1461, 1475, 1464, 1474, 1463, 1470,
-     1470, 1471, 1471, 1472, 1475, 1473, 1467, 1468, 1472, 1473,
-     1474, 1476, 1477, 1481, 1477, 1479, 1480, 1482, 1477, 1483,
-     1485, 1480, 1484, 1484, 1476, 1485, 1486, 1487, 1481, 1489,
-     1488, 1477, 1486, 1479, 1489, 1483, 1490, 1482, 1492, 1493,
-     1490, 1491, 1487, 1488, 1494, 1491, 1495, 1499, 1496, 1497,
-     1497, 1501,   63, 1494, 1496, 1502, 1505, 1493, 1492, 1516,
-     1502, 1503, 1503, 1504, 1511, 1499, 1495, 1507, 1507, 1504,
-     1509, 1512, 1501, 1509, 1510, 1510, 1505, 1515, 1514, 1516,
-
-     1511, 1514, 1517, 1518, 1519, 1519, 1520, 1512, 1521, 1522,
-     1523, 1517, 1524, 1525, 1525, 1523, 1526, 1527, 1515, 1528,
-     1529, 1520, 1530, 1518, 1532, 1526, 1524, 1540, 1522, 1521,
-     1531, 1531, 1533, 1535, 1528, 1527, 1534, 1538, 1532, 1536,
-     1536, 1534, 1530, 1537, 1541, 1529, 1544, 1537, 1535, 1540,
-     1533, 1539, 1539, 1542, 1543, 1545, 1548, 1538, 1543, 1548,
-     1545, 1547, 1547, 1541, 1542, 1544, 1549, 1550, 1551, 1552,
-     1554, 1553, 1550, 1556, 1555, 1557, 1557, 1558, 1563, 1549,
-     1559, 1560, 1558, 1563, 1551, 1553, 1562, 1552, 1555, 1554,
-     1554, 1561, 1561, 1564, 1565, 1562, 1565, 1566, 1556, 1567,
-
-     1559, 1560, 1566, 1568, 1569, 1567, 1571, 1572, 1572, 1573,
-     1569, 1574, 1577, 1564, 1576, 1578, 1578, 1574, 1580, 1576,
-     1571, 1579, 1579, 1568, 1581, 1582, 1583, 1585, 1573, 1583,
-     1584, 1584, 1580, 1587, 1586, 1595, 1577, 1589, 1588,   58,
-     1582, 1588, 1581, 1589, 1588, 1585, 1586, 1590, 1591, 1593,
-     1594, 1591, 1590, 1587, 1596, 1594, 1588, 1596, 1593, 1598,
-     1595, 1597, 1597, 1599, 1603, 1598, 1600, 1591, 1606, 1599,
-     1603, 1600, 1601, 1601, 1602, 1602, 1604, 1605, 1607, 1608,
-     1609, 1604, 1610, 1609, 1612, 1611, 1606, 1613, 1610, 1612,
-     1605, 1611, 1614, 1613, 1618, 1615, 1619, 1607, 1617, 1608,
-
-     1615, 1616, 1616, 1617, 1620, 1621, 1622, 1623, 1624, 1625,
-     1626, 1629, 1618, 1627, 1636, 1614, 1619, 1627, 1638, 1632,
-     1622, 1623, 1624, 1620, 1628, 1621, 1628, 1625, 1633, 1630,
-     1629, 1632, 1634, 1635, 1636, 1626, 1630, 1637, 1638, 1635,
-     1633, 1639, 1640, 1642, 1642, 1634, 1643, 1644, 1645, 1646,
-     1646, 1648, 1644, 1637, 1647, 1639, 1649, 1650, 1651, 1652,
-     1645, 1653, 1655, 1640, 1654, 1648, 1643, 1651, 1653, 1647,
-     1657, 1659,   57, 1654, 1652, 1650, 1654, 1663, 1655, 1660,
-     1649, 1664, 1660, 1661, 1661, 1657, 1662, 1662, 1665, 1663,
-     1657, 1665, 1666, 1666, 1667, 1668, 1659, 1669, 1670, 1664,
-
-     1671, 1670, 1669, 1672, 1673, 1671, 1674, 1667, 1675, 1676,
-     1677, 1678, 1679, 1679, 1668, 1674, 1680, 1678, 1676, 1677,
-     1673, 1676, 1672, 1682, 1681, 1683, 1684, 1675, 1685, 1690,
-     1686, 1687, 1691, 1685, 1685, 1686, 1680, 1681, 1694, 1683,
-     1693, 1682, 1684, 1687, 1692, 1692, 1695, 1694, 1696, 1696,
-     1691, 1695, 1697, 1698, 1690, 1699, 1693, 1700, 1698, 1701,
-     1702, 1697, 1704, 1696, 1697, 1702, 1702, 1705, 1706, 1707,
-     1709, 1710, 1710, 1699, 1707, 1708, 1704, 1701, 1700, 1711,
-     1713, 1708, 1705, 1717, 1712, 1711, 1714, 1715, 1709, 1712,
-     1706, 1718, 1714, 1715, 1713, 1719, 1720, 1721, 1722, 1724,
-
-     1721, 1719, 1726, 1717, 1722, 1718, 1721, 1724, 1727, 1720,
-     1728, 1729, 1731, 1730, 1732, 1733, 1729, 1734, 1728, 1735,
-     1737, 1726, 1730, 1732, 1739, 1731, 1737, 1727, 1733, 1736,
-     1736, 1734, 1738, 1735, 1740, 1740, 1741, 1739, 1738, 1742,
-     1743, 1744, 1744, 1746, 1747, 1745, 1748, 1749, 1752, 1746,
-     1753, 1736, 1751, 1751, 1753, 1754, 1741, 1742, 1745, 1743,
-     1754, 1755, 1748, 1759, 1756, 1749, 1747, 1757, 1752, 1756,
-     1758, 1761, 1757, 1763, 1762, 1764, 1763, 1765, 1767, 1758,
-     1769, 1755, 1761, 1762, 1766, 1766, 1759, 1764, 1768, 1770,
-     1770, 1771, 1765, 1776, 1772, 1773, 1774, 1767, 1777, 1769,
-
-     1768, 1772, 1779, 1778, 1780, 1771, 1786, 1773, 1774, 1778,
-     1781, 1786, 1776, 1791, 1779, 1791, 1781, 1793, 1777, 1782,
-     1782, 1783, 1780, 1787, 1783, 1784, 1784, 1788, 1789, 1789,
-     1790, 1792, 1787, 1788, 1792, 1794, 1795, 1793, 1796, 1797,
-     1798, 1799, 1790, 1800, 1797, 1798, 1801, 1802, 1804, 1803,
-     1799, 1807, 1802, 1810, 1795, 1800, 1796, 1794, 1803, 1806,
-     1805, 1801, 1808, 1808, 1806, 1805, 1807, 1809, 1804, 1812,
-     1813, 1803, 1805, 1809, 1810, 1814, 1815, 1816, 1817, 1816,
-     1818, 1818, 1819, 1819, 1820, 1820, 1821, 1824, 1812, 1813,
-     1825, 1814, 1817, 1835, 1817, 1838, 1815, 1822, 1822, 1823,
-
-     1823, 1826, 1826, 1827, 1828, 1832, 1821, 1827, 1824, 1829,
-     1828, 1825, 1829, 1831, 1833, 1838, 1834, 1841, 1835, 1831,
-     1833, 1834, 1836, 1832, 1839, 1836, 1837, 1837, 1842, 1839,
-     1840, 1840, 1841, 1843, 1844, 1845, 1845, 1846, 1843, 1844,
-     1847, 1848, 1846, 1849, 1850, 1851, 1847, 1853,   52, 1842,
-     1852, 1857, 1855, 1848, 1848, 1848, 1852, 1855, 1855, 1856,
-     1848, 1859, 1850, 1849, 1860, 1851, 1857, 1853, 1858, 1861,
-     1858, 1862, 1859, 1856, 1863, 1861, 1864, 1865, 1865, 1860,
-     1862, 1866, 1867, 1867, 1868, 1872, 1869, 1870, 1870, 1871,
-     1871, 1875, 1875, 1876, 1863, 1880, 1881, 1864, 1882, 1884,
-
-     1877, 1879, 1881, 1888, 1868, 1872, 1885, 1866, 1869, 1877,
-     1879, 1883, 1883, 1890, 1882, 1886, 1880, 1887, 1876, 1891,
-     1884, 1885, 1886, 1889, 1889, 1893, 1887, 1894, 1895, 1888,
-     1893, 1896, 1900, 1894, 1897, 1891, 1901, 1904, 1896, 1890,
-     1897, 1898, 1901, 1898, 1902, 1902, 1904, 1903, 1895, 1905,
-     1907, 1900, 1903, 1906, 1908, 1909, 1910, 1908, 1911, 1911,
-     1912, 1913, 1907, 1914, 1915, 1918, 1912, 1913, 1922, 1905,
-     1916, 1919, 1906, 1909, 1916, 1920, 1921, 1921, 1925, 1915,
-     1920, 1923, 1910, 1914, 1926, 1918, 1934, 1922, 1926, 1928,
-     1916, 1927, 1927, 1919, 1929, 1928, 1923, 1925, 1930, 1930,
-
-     1931, 1932, 1935, 1929, 1931, 1933, 1933, 1934, 1936, 1937,
-     1938, 1939, 1932, 1940, 1937, 1941, 1935, 1932, 1943, 1940,
-     1942, 1944, 1947, 1943, 1945, 1945, 1947, 1936, 1946, 1946,
-     1938, 1939, 1949, 1941, 1944, 1942, 1950, 1951, 1952, 1952,
-     1955, 1949, 1954, 1954, 1956, 1955, 1955, 1950, 1958, 1959,
-     1956, 1960, 1950, 1961, 1958, 1962, 1960, 1951, 1964, 1965,
-     1966, 1962, 1968, 1965, 1970, 1961, 1967, 1967, 1969, 1973,
-     1964, 1971, 1966, 1974, 1969, 1959, 1975, 1971, 1972, 1972,
-     1976, 1975, 1978, 1979, 1980, 1986, 1970, 1968, 1973, 1980,
-     1983, 1983, 1976, 1974, 1978, 1982, 1984, 1984, 1982, 1985,
-
-     1985, 1987, 1979, 1988, 1990, 1986, 1989, 1987, 1991, 1988,
-     1990, 1989, 1995, 1993, 1996, 1995, 1999, 1991, 1993, 1997,
-     1997, 2000, 2001, 2002, 2002, 2003, 1996, 2001, 1999, 2006,
-     2004, 2005, 2006, 2000, 2003, 2004, 2005, 2007, 2007, 2008,
-     2009, 2012, 2010, 2011, 2014, 2012, 2013, 2015, 2016, 2009,
-     2014, 2013, 2017, 2018, 2020, 2020, 2021, 2016, 2023, 2008,
-     2010, 2027, 2011, 2022, 2025, 2015, 2020, 2018, 2024, 2024,
-     2017, 2026, 2022, 2025, 2021, 2028, 2029, 2035, 2023, 2036,
-     2028, 2038, 2027, 2026, 2032, 2032, 2039, 2034, 2040, 2029,
-     2034, 2041, 2044, 2035, 2040, 2036, 2038, 2042, 2042, 2043,
-
-     2039, 2043, 2045, 2045, 2046, 2048, 2048, 2051, 2041, 2052,
-     2044, 2053, 2046, 2049, 2049, 2052, 2055, 2053, 2054, 2056,
-     2057, 2058, 2058, 2055, 2059, 2060, 2061, 2062, 2063, 2065,
-     2051, 2067, 2054, 2059, 2066, 2064, 2069, 2067, 2061, 2062,
-     2057, 2056, 2070, 2063, 2073, 2071, 2060, 2064, 2074, 2066,
-     2067, 2072, 2072, 2077, 2076, 2065, 2069, 2071, 2075, 2076,
-     2081, 2075, 2073, 2087, 2079, 2070, 2082, 2083, 2074, 2079,
-     2080, 2082, 2080, 2077, 2083, 2085, 2088, 2089, 2081, 2091,
-     2090, 2087, 2090, 2095, 2085, 2088, 2092, 2097, 2094, 2089,
-     2094, 2098, 2092, 2096, 2096, 2100, 2098, 2095, 2091, 2099,
-
-     2100, 2099, 2101, 2102, 2103, 2104, 2106, 2101, 2107, 2105,
-     2108, 2104, 2111, 2097, 2105, 2108, 2108, 2109, 2112, 2106,
-     2107, 2102, 2113, 2113, 2103, 2109, 2114, 2114, 2115, 2116,
-     2117, 2111, 2112, 2118, 2120, 2119, 2117, 2119, 2118, 2121,
-     2122, 2122, 2123, 2115, 2124, 2124, 2128, 2121, 2126, 2116,
-     2125, 2125, 2120, 2127, 2123, 2121, 2130, 2126, 2127, 2131,
-     2132, 2131, 2134, 2136, 2128, 2130, 2133, 2135, 2130, 2143,
-     2138, 2133, 2133, 2139, 2134, 2136, 2135, 2142, 2139, 2140,
-     2146, 2132, 2138, 2144, 2140, 2145, 2145, 2147, 2148, 2143,
-     2142, 2149, 2144, 2150, 2151, 2152, 2154, 2156, 2146, 2155,
-
-     2152, 2157, 2165, 2159, 2148, 2147, 2157, 2150, 2154, 2151,
-     2158, 2155, 2159, 2162, 2164, 2158, 2149, 2156, 2166, 2162,
-     2164, 2167, 2168, 2170, 2170, 2165, 2169, 2171, 2172, 2172,
-     2173, 2174, 2162, 2166, 2175, 2169, 2171, 2176, 2175, 2167,
-     2177, 2179, 2176, 2180, 2181, 2187, 2182, 2168, 2173, 2180,
-     2174, 2182, 2182, 2177, 2185, 2183, 2184, 2185, 2196, 2186,
-     2179, 2183, 2184, 2190, 2190, 2187, 2181, 2186, 2191, 2191,
-     2192, 2193, 2193, 2194, 2194, 2195, 2196, 2198, 2197, 2192,
-     2199, 2199, 2198, 2191, 2197, 2200, 2200, 2195, 2201, 2202,
-     2205, 2207, 2204, 2201, 2191, 2202, 2204, 2206, 2209, 2210,
-
-     2212, 2206, 2211, 2213, 2210, 2215, 2214, 2216, 2213, 2217,
-     2205, 2207, 2218, 2221, 2217, 2212, 2219, 2219, 2220, 2223,
-     2224, 2215, 2220, 2209, 2214, 2211, 2222, 2216, 2221, 2225,
-     2226, 2222, 2227, 2228, 2218, 2229, 2232, 2227, 2224, 2230,
-     2230, 2225, 2233, 2234, 2232, 2223, 2228, 2235, 2236, 2226,
-     2237, 2239, 2238, 2229, 2240, 2245, 2243, 2249, 2241, 2247,
-     2246, 2233, 2234, 2239, 2241, 2247, 2250, 2250, 2245, 2237,
-     2235, 2243, 2236, 2238, 2246, 2240, 2248, 2249, 2248, 2251,
-     2252, 2253, 2254, 2252, 2251, 2255, 2256, 2256, 2257, 2257,
-     2258, 2260, 2258,   47, 2253, 2261, 2254, 2269, 2255, 2259,
-
-     2259, 2262, 2262, 2263, 2264, 2264, 2260, 2270, 2261, 2265,
-     2265, 2266, 2263, 2268, 2271, 2263, 2266, 2269, 2268, 2272,
-     2272, 2273, 2273, 2274, 2275, 2275, 2271, 2270, 2276, 2277,
-     2277, 2279, 2278, 2280, 2280, 2282, 2279, 2281, 2281, 2283,
-     2284, 2285, 2274, 2286, 2290, 2288, 2276, 2278, 2283, 2282,
-     2288, 2289, 2289, 2291, 2291, 2285, 2292, 2284, 2293, 2295,
-     2295, 2297, 2286, 2290, 2293, 2294, 2296, 2296, 2294, 2298,
-     2299, 2301, 2299, 2302, 2292, 2295, 2303, 2303, 2305, 2306,
-     2297, 2307, 2310, 2308, 2298, 2311, 2301, 2308, 2309, 2309,
-     2311, 2312, 2302, 2313, 2315, 2315, 2307, 2316, 2305, 2318,
-
-     2317, 2310, 2306, 2319, 2320, 2321, 2312, 2317, 2313, 2322,
-     2322, 2323, 2324, 2318, 2324, 2325, 2328, 2316, 2325, 2327,
-     2323, 2319, 2320, 2331, 2329, 2327, 2332, 2330, 2328, 2329,
-     2333, 2321, 2330, 2325, 2335, 2325, 2334, 2337, 2338, 2332,
-     2339, 2334, 2337, 2338, 2340, 2342, 2341, 2343, 2331, 2345,
-     2340, 2333, 2341, 2344, 2345, 2339, 2346, 2347, 2348, 2344,
-     2335, 2346, 2343, 2350, 2349, 2351, 2342, 2349, 2352, 2353,
-     2354, 2348, 2350, 2355, 2351, 2356, 2357, 2352, 2353, 2355,
-     2357, 2356, 2347, 2359, 2354, 2361, 2362, 2363, 2363, 2366,
-     2364, 2365, 2365, 2367, 2367, 2362, 2364, 2368, 2366, 2369,
-
-     2365, 2371, 2368, 2359, 2372, 2361, 2373, 2373, 2374, 2375,
-     2377, 2378, 2380, 2379, 2384, 2386, 2386, 2371, 2375, 2369,
-     2372, 2369, 2377, 2374, 2380, 2383, 2382, 2378, 2379, 2382,
-     2383, 2385, 2387, 2387, 2384, 2389, 2389, 2390, 2396, 2391,
-     2390, 2392, 2393, 2385, 2391, 2394, 2398, 2392, 2393, 2395,
-     2395, 2399, 2396, 2400, 2394, 2397, 2397, 2402, 2398, 2401,
-     2401, 2403, 2404, 2402, 2406, 2399, 2407, 2404, 2406, 2407,
-     2408, 2408, 2400, 2409, 2410, 2403, 2411, 2412, 2409, 2415,
-     2413, 2414, 2414, 2410, 2413, 2411, 2417, 2418, 2419, 2420,
-     2421, 2417, 2415, 2422, 2421, 2423, 2424, 2412, 2425, 2427,
-
-     2423, 2428, 2424, 2420, 2425, 2426, 2426, 2418, 2419, 2429,
-     2430, 2431, 2434, 2422, 2435, 2430, 2436, 2427, 2432, 2432,
-     2428, 2436, 2441, 2437, 2434, 2438, 2443, 2446, 2429, 2437,
-     2435, 2441, 2431, 2438, 2439, 2452, 2439, 2444, 2444, 2445,
-     2443, 2450, 2445, 2447, 2447, 2450, 2451, 2452, 2453, 2453,
-     2454, 2459, 2451, 2446, 2457, 2457, 2461, 2462, 2465, 2454,
-     2466, 2467, 2468, 2465, 2470, 2470, 2469, 2468, 2476, 2459,
-     2461, 2469, 2474, 2462, 2472, 2472, 2475, 2475, 2474, 2477,
-     2478, 2480, 2467, 2482, 2476, 2478, 2466, 2481, 2484, 2484,
-     2481, 2483, 2487, 2486, 2488, 2482, 2489, 2493, 2487, 2494,
-
-     2480, 2477, 2486, 2483, 2491, 2491, 2492, 2496, 2496, 2492,
-     2498, 2489, 2488, 2497, 2497, 2498, 2493, 2494, 2499, 2500,
-     2501, 2502, 2505, 2502, 2503, 2501, 2504, 2506, 2500, 2507,
-     2508, 2546, 2506, 2546, 2505,   18, 2499, 2509, 2503, 2515,
-     2504, 2514, 2509, 2510, 2510, 2511, 2511, 2512, 2512, 2507,
-     2508, 2513, 2513, 2514, 2516, 2517, 2517, 2515, 2519, 2516,
-     2518, 2518, 2520, 2521, 2522, 2523, 2526, 2524, 2525, 2525,
-     2519, 2527, 2527, 2528, 2528, 2521, 2529, 2530, 2532, 2533,
-     2535, 2531, 2520, 2524, 2522, 2526, 2523, 2529, 2531, 2530,
-     2532, 2534, 2536, 2537, 2537, 2538, 2534, 2539, 2539, 2533,
-
-     2535, 2540, 2541, 2542, 2538, 2543, 2544, 2547, 2545, 2548,
-     2548, 2550, 2536, 2551, 2549, 2553, 2542, 2554, 2555, 2547,
-     2544, 2556, 2541, 2549, 2556, 2576, 2550, 2540, 2551, 2543,
-     2545, 2557, 2558, 2553, 2576, 2559, 2567, 2558, 2569, 2554,
-     2559, 2555, 2560, 2560, 2568, 2557, 2561, 2561, 2562, 2562,
-     2564, 2564, 2566, 2566, 2567, 2568, 2570, 2569, 2572, 2573,
-     2574, 2575, 2578, 2577, 2578, 2579, 2580, 2586, 2581, 2582,
-     2582, 2570, 2584, 2584, 2585, 2588, 2588, 2573, 2572, 2591,
-     2591, 2575, 2574, 2577, 2580, 2579, 2581, 2587, 2585, 2586,
-     2590, 2592, 2593, 2594, 2603, 2596, 2587, 2595, 2597, 2590,
-
-     2594, 2598, 2599,   17, 2600, 2601, 2601, 2602, 2602, 2592,
-     2593, 2600, 2595, 2596, 2603, 2604, 2597, 2598, 2605, 2607,
-     2607, 2599, 2608, 2608, 2605, 2609, 2610, 2611, 2612, 2613,
-     2614, 2609, 2615, 2604, 2616, 2614, 2617, 2618, 2620, 2618,
-     2620, 2617, 2611, 2613, 2610, 2619, 2619, 2612, 2621, 2621,
-     2623, 2625, 2615, 2626, 2616, 2627, 2628, 2629, 2630, 2631,
-     2625, 2632, 2629, 2630, 2635, 2636, 2638, 2627, 2636, 2623,
-     2637, 2637, 2626, 2639, 2640, 2640, 2628, 2641, 2642, 2631,
-     2632, 2638, 2643, 2645, 2635, 2646, 2643, 2648, 2641, 2646,
-     2650, 2639, 2651, 2642, 2647, 2647, 2652, 2655, 2645, 2656,
-
-     2648, 2653, 2653, 2657, 2659, 2650, 2663, 2657, 2656, 2655,
-     2658, 2658, 2651, 2660, 2660, 2661, 2652, 2662, 2664, 2665,
-     2661, 2672, 2663, 2659, 2666, 2666, 2662, 2671, 2671, 2674,
-     2664, 2673, 2673, 2675, 2680, 2676, 2677, 2681, 2678, 2665,
-     2679, 2679, 2674, 2672, 2676, 2677, 2675, 2678, 2683, 2683,
-     2686, 2687, 2681, 2688, 2680, 2686, 2687, 2689, 2690, 2691,
-     2692, 2695, 2689, 2693, 2699, 2697, 2690, 2688, 2698, 2692,
-     2697, 2693, 2702, 2698, 2700, 2700, 2695, 2702, 2691, 2699,
-     2701, 2701, 2703, 2704, 2704, 2705, 2706, 2707, 2708, 2709,
-        0, 2706, 2705, 2710, 2712, 2709, 2711, 2711, 2710, 2713,
-
-     2718, 2703, 2714, 2714, 2713, 2707, 2708, 2715, 2715, 2712,
-     2719, 2719, 2720, 2718, 2721, 2720, 2722, 2723, 2724, 2721,
-     2721, 2722, 2723, 2725, 2726, 2727, 2728, 2729, 2726, 2725,
-     2727, 2730, 2724, 2731, 2732, 2728, 2734, 2733, 2735, 2730,
-     2732, 2734, 2729, 2733, 2737, 2739, 2741, 2738, 2739, 2745,
-     2735, 2737, 2738, 2746, 2731, 2743, 2744, 2759, 2741, 2747,
-     2743, 2744, 2748, 2749, 2749, 2750, 2746, 2745, 2747, 2754,
-     2751, 2748, 2755, 2756, 2750, 2751, 2759, 2760, 2755, 2756,
-     2761, 2762, 2762, 2763, 2764, 2765, 2766, 2754, 2767, 2767,
-     2763, 2768, 2770, 2772, 2765, 2775, 2773, 2760, 2778, 2761,
-
-     2773, 2766, 2776, 2764, 2774, 2774, 2777, 2770, 2776, 2779,
-     2768, 2781, 2777, 2772, 2784, 2779, 2778, 2780, 2780, 2781,
-     2775, 2782, 2785, 2784, 2787, 2788, 2782, 2789, 2788, 2790,
-     2787, 2789, 2791, 2793, 2793, 2785, 2794, 2795, 2795, 2796,
-     2796, 2798, 2798, 2790, 2799, 2800, 2804, 2791, 2799, 2806,
-     2800, 2802, 2802, 2805, 2794, 2808, 2810, 2807, 2805, 2811,
-     2811, 2806, 2807, 2807, 2813, 2813, 2804, 2808, 2814, 2814,
-     2815, 2816, 2817, 2815, 2819, 2819, 2810, 2820, 2822, 2823,
-     2823, 2824, 2824, 2828, 2816, 2817, 2825, 2825, 2826, 2827,
-     2827, 2829, 2830, 2831, 2840, 2820, 2828, 2837, 2822, 2831,
-
-     2832, 2832, 2837, 2826, 2833, 2836, 2830, 2839, 2833, 2829,
-     2841, 2836, 2839, 2839, 2842, 2843, 2844, 2840, 2845, 2846,
-     2852, 2843, 2844, 2846, 2847, 2847, 2850, 2855, 2852, 2853,
-     2841, 2850, 2853, 2856, 2842, 2859, 2856, 2857, 2857, 2858,
-     2859, 2860, 2861, 2845, 2862, 2863, 2863, 2864, 2867, 2869,
-     2866, 2871, 2855, 2911, 2869, 2869, 2858, 2858, 2862, 2860,
-     2865, 2864, 2861, 2865, 2866, 2868, 2880, 2867, 2911, 2870,
-     2871, 2865, 2877, 2868, 2870, 2870, 2872, 2872, 2873, 2873,
-     2874, 2874, 2875, 2875, 2876, 2876, 2878, 2879, 2877, 2881,
-     2882, 2878, 2880, 2883, 2884, 2882, 2885, 2886, 2887, 2884,
-
-     2889, 2889, 2892, 2881, 2895, 2885,    0, 2879, 2890, 2890,
-     2891, 2895, 2883, 2891, 2894, 2894, 2905, 2886, 2887, 2897,
-     2892, 2896, 2896, 2900, 2897, 2899, 2899, 2901, 2902, 2903,
-     2906, 2906, 2900, 2908, 2905, 2907, 2901, 2902, 2903, 2907,
-     2909, 2910, 2908, 2912, 2913, 2914, 2915, 2924, 2912, 2912,
-     2915, 2919, 2910, 2923, 2914, 2925, 2919, 2913, 2929, 2909,
-     2920, 2920, 2922, 2922, 2927, 2927, 2928, 2923, 2932, 2933,
-     2929, 2934, 2924, 2925, 2933, 2928, 2936, 2937, 2939, 2941,
-     2934, 2943, 2944, 2937, 2945, 2945, 2943, 2944, 2946, 2948,
-     2939, 2949, 2950, 2932, 2948, 2957, 2936, 2946, 2951, 2951,
-
-     2941, 2958, 2951,    0, 2949, 2956, 2950, 2953, 2953, 2954,
-     2954, 2955, 2955, 2959, 2956, 2957, 2961, 2965, 2959, 2962,
-     2958, 2963, 2961, 2967, 2962, 2966, 2963, 2964, 2964, 2968,
-     2969, 2971, 2970, 2978, 2968, 2965,    0, 2966, 2970, 2972,
-     2972, 2974, 2975, 2979, 2967, 2974, 2976, 2975, 2969, 2977,
-     2977, 2976, 2978, 2980, 2982, 2989, 2971, 2986, 2979, 2984,
-     2984, 2988, 2987, 2990, 2989, 2988, 2991, 2993, 2980, 2992,
-     2986, 2994, 2993, 2996, 2982, 2987, 2997, 2992, 2998, 2990,
-     2995, 2995, 2996, 2999, 2999, 2991, 3000, 3003, 3003, 3004,
-     3004, 2994, 3006, 3010, 2997, 3008, 3008, 3012, 3011, 3013,
-
-     3017, 3014, 3012, 3018, 2998, 3000, 3014, 3016, 3016, 3010,
-     3019, 3020, 3018, 3006, 3011, 3013, 3019, 3021, 3023, 3023,
-     3017, 3024, 3025, 3026, 3026, 3029, 3030, 3033, 3031, 3034,
-     3034, 3036, 3030, 3031, 3020, 3024, 3021, 3035, 3035, 3037,
-     3039, 3025, 3038, 3038, 3040, 3029, 3036, 3041, 3042, 3033,
-     3043, 3039, 3044, 3040, 3042, 3045, 3046, 3046, 3047, 3037,
-     3048, 3055, 3038, 3048, 3044, 3049, 3054, 3041, 3049, 3043,
-     3050, 3050, 3060, 3047, 3056, 3045, 3057, 3057, 3054, 3058,
-     3056, 3055, 3058, 3059, 3063, 3063, 3062, 3064, 3065, 3059,
-     3060, 3062, 3064, 3066, 3067, 3068, 3068, 3070, 3071, 3066,
-
-     3072, 3073, 3074, 3074, 3075, 3076, 3077, 3065, 3081, 3070,
-     3082, 3067, 3067, 3081, 3073, 3077, 3071, 3079, 3079, 3080,
-     3080, 3076, 3083, 3075, 3082, 3072, 3088, 3083, 3084, 3084,
-     3085, 3085, 3086, 3086, 3087, 3087, 3089, 3090, 3096, 3088,
-     3091, 3093, 3093, 3090, 3098, 3091, 3099, 3101, 3100, 3102,
-     3102, 3104, 3104, 3105, 3106, 3108, 3107, 3096, 3110, 3110,
-     3111, 3111, 3089, 3109, 3114, 3113, 3098, 3100, 3099, 3101,
-     3107, 3113, 3109, 3106, 3115, 3108, 3116, 3119, 3126, 3105,
-     3124, 3116, 3120, 3120, 3114, 3122, 3122, 3123, 3127, 3125,
-     3126, 3133, 3123, 3115, 3124, 3125, 3127, 3129, 3119, 3128,
-
-     3128, 3131, 3129, 3132, 3134, 3131, 3136, 3135, 3132, 3137,
-     3140, 3133, 3135, 3139, 3141, 3137, 3142, 3144, 3136, 3151,
-        0, 3139, 3145, 3146, 3134, 3147, 3148, 3150, 3153, 3140,
-     3155, 3148, 3150, 3153, 3141, 3144, 3142, 3152, 3145, 3151,
-     3146, 3146, 3156, 3152, 3157, 3156, 3147, 3160, 3160, 3162,
-     3155, 3161, 3161, 3162, 3167, 3167, 3168, 3157, 3169, 3170,
-     3170, 3168, 3172, 3172, 3173, 3173, 3177, 3173, 3174, 3174,
-     3177, 3174, 3175, 3175, 3179, 3176, 3176, 3169, 3176, 3179,
-     3180, 3181, 3181, 3182, 3183, 3186, 3187, 3188, 3190, 3180,
-     3189, 3189, 3188, 3193, 3196, 3194, 3195, 3197, 3183, 3199,
-
-     3195, 3182, 3194, 3196, 3200, 3186, 3187, 3202, 3190, 3200,
-     3201, 3201, 3197, 3203, 3203, 3206, 3202, 3199, 3193, 3204,
-     3204, 3205, 3205, 3207, 3208, 3211, 3209, 3212, 3207, 3210,
-     3206, 3209, 3209, 3208, 3213, 3210, 3208, 3216, 3214, 3215,
-     3217, 3217, 3212, 3214, 3215, 3218, 3219, 3220, 3220, 3222,
-     3211, 3218, 3219, 3221, 3221, 3213, 3216, 3223, 3226, 3226,
-     3228, 3228, 3223, 3229, 3222, 3232, 3232, 3233, 3233, 3234,
-     3234, 3241, 3229, 3235, 3235, 3237, 3237, 3238, 3238, 3239,
-     3239, 3240, 3240, 3243, 3244, 3244, 3245, 3246, 3247, 3249,
-     3249, 3250, 3243, 3251, 3251, 3245, 3252, 3241, 3264, 3246,
-
-     3253, 3258, 3254, 3255, 3255, 3256, 3256, 3262, 3247, 3263,
-     3250, 3252, 3263, 3253, 3254, 3266, 3258, 3259, 3259, 3265,
-     3265, 3269, 3270, 3268, 3264, 3262, 3268, 3269, 3272, 3271,
-     3273, 3276, 3277, 3266, 3271, 3274, 3270, 3276, 3280, 3281,
-     3284, 3277, 3280, 3294, 3293, 3296, 3294, 3272, 3273, 3293,
-     3302, 3274, 3297, 3297, 3281, 3298, 3298, 3305, 3296, 3300,
-     3300, 3303, 3307, 3304, 3309, 3316, 3284, 3304, 3310, 3311,
-     3303, 3313, 3315, 3302, 3311, 3317, 3307, 3305, 3312, 3310,
-     3312, 3314, 3314, 3318, 3316, 3315, 3313, 3309, 3319, 3320,
-     3322, 3321, 3323, 3317, 3324, 3332, 3325, 3323, 3327, 3318,
-
-     3321, 3325, 3322, 3328, 3320, 3326, 3326, 3333, 3328, 3332,
-     3334, 3334, 3335, 3319, 3340, 3324, 3336, 3336, 3327, 3337,
-     3337, 3335, 3338, 3338, 3339, 3339, 3341, 3333, 3342, 3343,
-     3344, 3342, 3345, 3340, 3343, 3344, 3346, 3347, 3348, 3350,
-     3352, 3349, 3357, 3347, 3350, 3362, 3341, 3351, 3351, 3353,
-     3353, 3346, 3348, 3349, 3355, 3355, 3356, 3345, 3358, 3358,
-     3352, 3357, 3360, 3362, 3365, 3365, 3366, 3366, 3367, 3368,
-     3371, 3356, 3369, 3370, 3372, 3373, 3367, 3360, 3369, 3370,
-     3374, 3375, 3375, 3380, 3371, 3374, 3381, 3372, 3368, 3377,
-     3377, 3383, 3384, 3386, 3373, 3387, 3384, 3388, 3389, 3390,
-
-     3387, 3391, 3392, 3393, 3380, 3383, 3381, 3392, 3393, 3394,
-     3394, 3389, 3390, 3386, 3397, 3398, 3388, 3399, 3400, 3400,
-     3391, 3401, 3402, 3403, 3403, 3404, 3401, 3405, 3402, 3407,
-     3404, 3408, 3405, 3398, 3397, 3406, 3399, 3408, 3410, 3410,
-     3406, 3411, 3412, 3412, 3415, 3414, 3411, 3416, 3407, 3414,
-     3417, 3418, 3419, 3420, 3416, 3421, 3423, 3423, 3419, 3425,
-     3425, 3427, 3426, 3415, 3428, 3429, 3427, 3430, 3421, 3417,
-     3418, 3426, 3420, 3432, 3426, 3431, 3431, 3433, 3432, 3435,
-     3430, 3436, 3436, 3428, 3429, 3437, 3438, 3438, 3439, 3439,
-     3433, 3440, 3441, 3442, 3443, 3443, 3440, 3444, 3445, 3441,
-
-     3445, 3447, 3444, 3448, 3437, 3435, 3446, 3446, 3447, 3449,
-     3448, 3450, 3442, 3451, 3453, 3453, 3450, 3454, 3456, 3457,
-     3458, 3459, 3463, 3456, 3457, 3460, 3460, 3464, 3449, 3462,
-     3462,    0, 3451, 3465, 3465, 3467, 3454, 3466, 3466, 3458,
-     3459, 3463, 3467, 3469, 3469, 3471, 3464, 3470, 3470, 3473,
-     3476, 3477, 3471, 3478, 3473, 3476, 3479, 3479, 3480, 3480,
-        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-     3477,    0, 3478, 3484, 3484, 3484, 3484, 3484, 3484, 3484,
-     3485, 3485, 3485, 3485, 3485, 3485, 3485, 3486, 3486, 3486,
-     3486, 3486, 3486, 3486, 3487, 3487, 3487, 3487, 3487, 3487,
-
-     3487, 3488, 3488, 3488, 3488, 3488, 3488, 3488, 3489, 3489,
-     3489, 3489, 3489, 3489, 3489, 3490, 3490, 3490, 3490, 3490,
-     3490, 3490, 3492, 3492,    0, 3492, 3492, 3492, 3492, 3493,
-     3493,    0,    0,    0, 3493, 3493, 3494, 3494,    0,    0,
-     3494,    0, 3494, 3495,    0,    0,    0,    0,    0, 3495,
-     3496, 3496,    0,    0,    0, 3496, 3496, 3497,    0,    0,
-        0,    0,    0, 3497, 3498, 3498,    0, 3498, 3498, 3498,
-     3498, 3499,    0,    0,    0,    0,    0, 3499, 3500, 3500,
-        0,    0,    0, 3500, 3500, 3501, 3501,    0, 3501, 3501,
-     3501, 3501, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483,
-     3483, 3483, 3483
+      230,  229,  223,  231,  232,  234,  232,  225,  233,  235,
+      236,  232,  238,  237,  233,  235,  239,  241,  234,  237,
+      240,  243,  241,  242,  239,  238,  244,  245,  248,  250,
+
+      236,  251,  242,  240,  238,  246,  243,  251,  247,  252,
+      246,  246,  244,  247,  249,  254,  248,  245,  249,  253,
+      257,  250,  261,  258,  255,  253,  259,  252,  252,  255,
+      258,  260,  259,  263,  262,  254,  264,  260,  267,  257,
+      262,  261,  265,  265,  267,  263,  266,  266,  268,  269,
+      264,  269,  270,  271,  268,  272,  274,  273,  271,  275,
+      276,  277,  267,  278,  274,  276,  279,  272,  269,  278,
+      283,  285,  279,  280,  282,  270,  273,  281,  280,  275,
+      282,  284,  281,  286,  277,  283,  287,  288,  290,  285,
+      289,  290,  292,  292,  287,  284,  289,  286,  291,  293,
+
+      291,  294,  293,  295,  295,  296,  296,  297,  299,  298,
+      300,  299,  288,  301,  300,  303,  302,  304,  174,  294,
+      305,  303,  301,  297,  298,  302,  305,  306,  307,  306,
+      310,  304,  308,  311,  307,  310,  308,  309,  309,  311,
+      312,  313,  314,  315,  316,  319,  312,  317,  317,  318,
+      320,  321,  318,  308,  320,  322,  324,  316,  323,  323,
+      314,  313,  327,  319,  315,  312,  325,  326,  327,  325,
+      321,  329,  328,  322,  324,  328,  331,  332,  335,  326,
+      336,  335,  337,  329,  333,  331,  325,  330,  338,  333,
+      338,  338,  169,  336,  337,  332,  330,  334,  340,  330,
+
+      334,  340,  334,  339,  330,  330,  330,  330,  339,  339,
+      341,  341,  342,  343,  346,  334,  344,  345,  334,  348,
+      348,  347,  349,  346,  350,  350,  352,  349,  343,  342,
+      347,  344,  342,  353,  345,  345,  351,  351,  353,  354,
+      355,  352,  356,  357,  358,  359,  359,  361,  359,  362,
+      358,  354,  370,  370,  362,  363,  367,  359,  357,  355,
+      364,  363,  356,  365,  359,  364,  366,  361,  365,  366,
+      367,  366,  368,  369,  365,  368,  373,  371,  372,  372,
+      376,  373,  369,  371,  377,  380,  378,  377,  368,  379,
+      419,  368,  419,  368,  374,  374,  383,  374,  385,  380,
+
+      376,  378,  386,  374,  379,  377,  382,  374,  388,  382,
+      383,  386,  374,  385,  388,  374,  375,  375,  387,  375,
+      389,  388,  392,  387,  387,  382,  390,  393,  394,  391,
+      396,  392,  375,  397,  394,  375,  395,  375,  167,  375,
+      384,  389,  384,  384,  391,  390,  393,  397,  400,  401,
+      396,  398,  384,  384,  384,  384,  384,  398,  399,  384,
+      402,  398,  395,  399,  404,  403,  405,  407,  400,  401,
+      403,  408,  405,  406,  406,  402,  409,  411,  410,  404,
+      412,  399,  416,  408,  410,  415,  413,  407,  417,  418,
+      409,  413,  414,  414,  424,  414,  412,  420,  416,  420,
+
+      420,  425,  411,  418,  417,  415,  421,  422,  423,  423,
+      421,  422,  426,  424,  427,  428,  425,  420,  431,  434,
+      442,  166,  429,  434,  431,  432,  422,  435,  426,  428,
+      429,  429,  427,  433,  432,  436,  435,  438,  433,  437,
+      442,  436,  429,  438,  429,  430,  440,  439,  441,  440,
+      430,  439,  444,  441,  443,  443,  445,  445,  430,  430,
+      437,  447,  430,  430,  446,  444,  430,  448,  448,  446,
+      449,  450,  451,  452,  447,  450,  449,  453,  454,  455,
+      455,  456,  453,  454,  457,  458,  459,  451,  455,  460,
+      461,  466,  460,  456,  452,  461,  462,  463,  459,  468,
+
+      462,  464,  464,  458,  457,  465,  467,  467,  472,  463,
+      465,  473,  466,  470,  470,  474,  475,  476,  477,  473,
+      478,  468,  479,  477,  481,  475,  483,  482,  503,  472,
+      486,  485,  503,  484,  479,  487,  474,  485,  476,  486,
+      478,  487,  481,  488,  481,  482,  483,  484,  488,  489,
+      490,  491,  492,  493,  491,  494,  495,  496,  490,  498,
+      499,  490,  495,  489,  494,  498,  492,  497,  493,  501,
+      497,  500,  502,  504,  499,  505,  500,  496,  504,  506,
+      507,  508,  509,  498,  506,  512,  528,  513,  514,  528,
+      505,  501,  516,  502,  515,  509,  507,  518,  515,  517,
+
+      508,  510,  510,  514,  517,  512,  519,  510,  513,  510,
+      519,  516,  164,  518,  520,  510,  521,  510,  523,  520,
+      510,  510,  525,  520,  522,  526,  524,  510,  525,  522,
+      527,  521,  529,  525,  523,  524,  530,  523,  531,  531,
+      526,  532,  533,  533,  534,  535,  527,  536,  537,  537,
+      538,  539,  541,  540,  162,  529,  530,  535,  540,  534,
+      542,  541,  536,  543,  544,  546,  532,  547,  548,  538,
+      544,  547,  548,  539,  546,  549,  550,  551,  543,  542,
+      552,  549,  553,  554,  555,  556,  560,  557,  550,  556,
+      160,  558,  551,  558,  560,  562,  553,  563,  554,  552,
+
+      557,  562,  555,  561,  561,  564,  565,  566,  567,  563,
+      566,  564,  568,  570,  569,  571,  570,  572,  565,  569,
+      573,  620,  567,  574,  571,  573,  573,  568,  575,  575,
+      620,  571,  582,  572,  571,  577,  574,  576,  576,  578,
+      578,  577,  579,  579,  580,  583,  581,  586,  587,  585,
+      580,  581,  581,  582,  585,  584,  587,  583,  584,  588,
+      589,  590,  588,  591,  592,  589,  586,  593,  592,  594,
+      595,  597,  596,  593,  595,  601,  597,  598,  599,  599,
+      600,  602,  591,  603,  590,  604,  602,  605,  606,  594,
+      596,  598,  607,  613,  606,  600,  601,  607,  608,  610,
+
+      612,  604,  603,  609,  611,  611,  609,  605,  614,  613,
+      616,  609,  608,  614,  609,  609,  615,  610,  612,  617,
+      619,  615,  621,  622,  616,  621,  619,  622,  623,  624,
+      625,  626,  624,  623,  617,  625,  627,  628,  629,  631,
+      630,  632,  632,  633,  628,  630,  634,  626,  635,  622,
+      636,  629,  633,  637,  627,  638,  644,  639,  640,  631,
+      645,  644,  637,  639,  640,  634,  636,  638,  641,  635,
+      646,  641,  642,  642,  643,  642,  647,  643,  645,  649,
+      648,  650,  654,  651,  646,  648,  652,  650,  651,  661,
+      647,  653,  652,  657,  653,  655,  656,  658,  649,  659,
+
+      655,  656,  656,  660,  659,  662,  657,  654,  661,  660,
+      658,  663,  664,  674,  662,  666,  663,  667,  659,  659,
+      665,  665,  666,  668,  667,  669,  668,  670,  671,  672,
+      676,  669,  664,  671,  672,  672,  673,  673,  674,  670,
+      675,  668,  675,  671,  677,  678,  677,  679,  680,  676,
+      681,  682,  683,  684,  688,  685,   85,  684,  683,  686,
+      687,  689,  691,  678,  685,  679,  680,  690,  693,  681,
+      690,  682,  688,  694,  686,  687,  692,  691,  695,  690,
+      689,  696,  692,  697,  698,  699,  701,  694,  693,  699,
+      695,  700,  702,  703,  704,  708,  705,  707,  707,  708,
+
+      696,  705,  701,  698,  697,  706,  709,  710,  712,  700,
+      702,  703,  703,  704,  711,  714,  713,  715,  720,  706,
+      709,  713,  712,  717,  716,  711,  710,  718,  719,  721,
+      717,  714,  718,  722,  721,  719,  715,  716,  722,  723,
+      724,  725,  720,  727,  726,  729,  737,  724,  728,  730,
+      725,  729,  727,  731,  730,  732,  731,  723,  726,  732,
+      728,  733,  734,  735,  746,  736,  749,  737,  738,  738,
+      744,  734,  739,  739,  742,  733,  740,  740,  735,  736,
+      741,  739,  745,  742,  746,  741,  747,  748,  745,  744,
+      747,  749,  750,  752,  751,  753,  754,  755,  756,  748,
+
+      751,  752,  753,  762,  759,  766,  765,  768,  769,   80,
+      750,  766,  771,  768,  754,  765,  771,  769,  756,  759,
+      762,  770,  755,  757,  776,  757,  772,  772,  757,  773,
+      773,  775,  757,  774,  777,  757,  812,  770,  776,  782,
+      778,  780,  757,  757,  774,  757,  778,  781,  783,  775,
+      812,  785,  781,  787,  777,  779,  779,  779,  787,  779,
+      782,  780,  779,  788,  784,  786,  783,  779,  784,  786,
+      791,  789,  790,  779,  779,  785,  789,  792,  793,  794,
+      792,  796,  788,  793,  793,  786,  794,  790,  795,  795,
+      798,  798,  797,  799,   75,  791,  796,  797,  799,  800,
+
+      801,  804,  800,  802,  802,  801,  803,  805,  803,  807,
+      806,  808,  809,  804,  806,  810,  810,  811,  813,  813,
+      809,  814,  815,  816,  828,  817,  805,  828,  818,  807,
+      808,  817,  811,  818,  815,  819,  819,  820,  823,  814,
+      824,  822,  820,  820,  823,  816,  822,  825,   74,  826,
+      827,  829,  830,  825,  826,  834,  827,  829,  833,  824,
+      830,  831,  831,  832,  832,  835,  833,  836,  837,  838,
+      835,  836,  839,  834,  840,  837,  841,  841,  843,  845,
+      842,  844,  844,  846,  850,  845,  843,  838,  839,  842,
+      848,  849,  851,  840,  852,  853,  854,  851,  853,  848,
+
+      849,  854,  846,  852,  855,  856,  857,  858,  850,  860,
+      862,  859,  861,  861,  863,  857,  859,  859,  855,  864,
+      858,  865,  866,  860,  867,  862,  871,  867,  864,  869,
+      856,  869,  873,  863,  872,  867,  870,  870,  874,  872,
+      866,  875,  876,  877,  879,  865,  878,  871,  880,   68,
+      881,  882,  880,  873,  883,  878,  884,  885,  874,  886,
+      883,  875,  887,  877,  876,  884,  888,  879,  881,  885,
+      882,  889,  891,  892,  890,  886,  894,  889,  892,  895,
+      888,  887,  890,  893,  893,  896,  891,  897,  898,  899,
+      900,  901,  903,  902,  896,  894,  898,  904,  903,  895,
+
+      905,  907,  906,  904,  908,  909,  912,  897,  906,  899,
+      901,  909,  900,  902,  905,  907,  910,  911,  913,  915,
+       63,  911,  910,  914,  908,  912,  916,  916,  914,  917,
+      913,  918,  920,  919,  921,  917,  919,  918,  913,  922,
+      915,  923,  924,  924,  925,  922,  926,  921,  928,  927,
+      920,  926,  927,  928,  928,  929,  930,  931,  931,  932,
+      930,  923,  925,  933,  934,  927,  935,  927,  937,  934,
+      929,  940,  938,  941,  942,  944,  944,  948,  945,  946,
+      975,  932,  945,  933,  940,  935,  938,  947,  947,  951,
+       58,  950,  937,  941,  946,  942,  943,  953,  975,  943,
+
+      949,  943,  948,  951,  949,  943,  950,  943,  952,  954,
+      955,  953,  943,  952,  954,  954,  956,  943,  957,  955,
+      958,  959,  957,  961,  962,  960,  959,  963,  961,  964,
+      956,  965,  973,  966,  957,  958,  959,  960,  962,  966,
+      965,  967,  971,  964,  968,  969,  967,  971,  963,  972,
+      968,  969,  970,  970,  973,  972,  974,  977,  978,  979,
+      980,  981,  981,  978,  984,  982,  983,  985,  986,  977,
+      982,  992,  980,  979,  983,  974,  976,  976,  987,  989,
+      984,  985,  976,  988,  976,  989,  990,  986,  991,  992,
+      976,  990,  993,  994,  995,  976,  976,  987,  998,  988,
+
+      991,  997,  976,  996,  996,  997, 1001, 1000,  993, 1001,
+     1002,  994,  995, 1000, 1003, 1004, 1005, 1007,  998, 1003,
+     1006, 1009, 1005, 1010, 1011, 1006, 1013, 1012, 1004, 1002,
+     1009, 1014, 1010, 1012, 1015, 1013, 1007, 1016, 1017, 1015,
+     1011, 1018, 1019, 1022, 1020, 1023, 1021, 1026, 1029, 1022,
+     1014, 1028, 1017, 1020, 1019, 1021, 1031, 1016, 1024, 1032,
+     1033, 1018, 1023, 1026, 1024, 1028, 1030, 1034, 1029, 1035,
+     1040, 1030, 1036, 1032, 1035, 1031, 1039, 1036, 1033, 1040,
+     1042, 1039, 1034, 1041, 1041, 1043, 1042, 1044, 1045, 1046,
+     1048, 1043, 1049, 1053, 1054, 1055, 1044, 1049, 1049, 1056,
+
+     1051, 1051, 1046, 1045, 1051, 1052, 1048, 1053, 1052, 1057,
+     1058, 1055, 1059, 1060, 1054, 1061, 1062, 1056, 1059, 1063,
+     1064, 1061, 1057, 1068, 1063, 1058, 1066, 1066,   57, 1067,
+     1069, 1062, 1067, 1060, 1064, 1069, 1070, 1071, 1072, 1075,
+     1073, 1070, 1078, 1074, 1068, 1073, 1077, 1072, 1074, 1079,
+     1080, 1075, 1077, 1071, 1082, 1079, 1080, 1083, 1078, 1081,
+     1081, 1084, 1086, 1082, 1084, 1085, 1085, 1087, 1088, 1089,
+     1090, 1091, 1089, 1092, 1126, 1083, 1093, 1091, 1126, 1092,
+     1086, 1096, 1093, 1090, 1094, 1095, 1087, 1096, 1088, 1094,
+     1095, 1097, 1098, 1101, 1100, 1102, 1097, 1103, 1098, 1100,
+
+     1104, 1105, 1105, 1103, 1106, 1104, 1108, 1107, 1109, 1110,
+     1112, 1101, 1110, 1106, 1111, 1102, 1107, 1111, 1113, 1114,
+     1115, 1112, 1116, 1113, 1108, 1117, 1122, 1109, 1118, 1119,
+     1120, 1117, 1115, 1123, 1118, 1120, 1124, 1114, 1121, 1121,
+     1125, 1116, 1127, 1128, 1119, 1122, 1129, 1123, 1124, 1130,
+     1132, 1134, 1128, 1133, 1133, 1137, 1135, 1136, 1125, 1134,
+     1127, 1135, 1136, 1139, 1140, 1129, 1141, 1142, 1145, 1132,
+     1146, 1143, 1142,   52, 1130, 1137, 1146, 1139, 1141, 1140,
+     1143, 1144, 1144, 1147, 1148, 1149, 1156, 1151, 1145, 1147,
+     1149, 1150, 1151, 1150, 1152, 1153, 1154, 1155, 1158, 1157,
+
+     1148, 1154, 1159, 1161, 1161, 1156, 1157, 1163, 1152, 1153,
+     1162, 1164, 1155, 1158, 1165, 1166, 1174, 1167,   47, 1169,
+     1165, 1159, 1167, 1169, 1162, 1163, 1164, 1170, 1170, 1171,
+     1174, 1167, 1173, 1167, 1171, 1166, 1167, 1172, 1172, 1173,
+     1175, 1176, 1178, 1175, 1177, 1179, 1180, 1181, 1182, 1183,
+     1179, 1178, 1185, 1182, 1190, 1184, 1187, 1187,   18, 1181,
+     1176, 1193, 1177, 1183, 1188, 1180, 1184, 1189, 1191, 1188,
+     1193, 1185, 1189, 1191, 1190, 1192, 1194, 1195, 1196, 1192,
+     1198, 1197, 1199, 1201, 1197, 1202, 1200, 1203, 1204, 1199,
+     1207, 1194, 1195, 1197, 1204, 1198, 1205, 1196, 1200, 1208,
+
+     1209, 1206, 1201, 1210, 1211, 1203, 1202, 1206, 1212, 1209,
+     1207, 1205, 1213, 1214, 1215, 1216, 1217, 1220, 1210, 1208,
+     1212, 1216, 1219, 1211, 1223, 1221, 1222, 1224, 1219, 1215,
+     1225, 1213, 1220, 1226, 1222, 1225, 1217, 1228, 1214, 1221,
+     1229, 1227, 1230, 1224, 1223, 1226, 1227, 1227, 1231, 1231,
+     1233, 1234, 1238, 1235, 1229, 1230, 1228, 1232, 1232, 1235,
+     1234, 1238, 1232, 1233, 1237, 1232, 1232, 1236, 1236, 1237,
+     1232, 1239, 1243, 1240, 1241, 1246, 1232, 1239, 1240, 1241,
+     1232, 1242, 1242, 1244, 1244, 1245, 1247, 1249, 1245, 1250,
+     1245, 1248, 1252, 1243, 1251, 1246, 1249, 1248, 1253, 1251,
+
+     1256, 1254, 1255, 1259, 1247, 1256, 1252, 1254, 1255, 1250,
+     1257, 1258, 1259, 1260, 1257, 1261, 1253, 1259, 1260, 1259,
+     1264, 1259, 1267, 1259, 1258, 1262, 1262, 1263, 1263, 1261,
+     1263, 1264, 1266, 1268, 1269, 1270, 1266, 1267, 1271, 1272,
+     1270, 1270, 1274, 1269, 1273, 1275, 1276, 1271, 1277, 1273,
+     1278, 1268, 1279, 1289, 1275, 1282, 1274, 1281, 1279, 1280,
+     1280, 1272, 1283, 1282, 1278, 1276, 1284, 1277, 1285, 1281,
+     1286, 1284, 1288, 1287, 1291, 1291, 1283, 1292, 1289, 1286,
+     1287, 1290, 1285, 1293, 1293, 1294, 1290, 1294, 1296, 1297,
+     1288, 1296, 1292, 1298, 1297, 1299, 1300, 1300, 1301, 1302,
+
+     1302, 1303, 1303, 1304, 1299, 1305, 1306, 1307, 1304, 1308,
+     1308, 1309, 1298, 1310, 1311, 1312, 1313, 1311, 1301, 1314,
+     1315, 1316, 1313, 1316, 1314, 1317, 1305, 1306, 1307, 1315,
+     1310, 1309, 1320, 1319, 1321, 1312, 1319, 1322, 1324, 1321,
+     1323, 1328, 1328, 1317, 1325, 1323, 1324, 1320, 1330, 1325,
+     1326, 1322, 1327, 1326, 1329, 1331, 1332, 1327, 1333, 1329,
+     1337, 1331, 1335, 1332, 1336, 1337, 1330, 1338, 1335, 1339,
+     1336, 1333, 1338, 1340, 1341, 1339, 1342, 1343, 1343, 1344,
+     1346, 1348, 1340, 1347, 1350, 1346, 1351, 1342, 1349, 1352,
+     1353, 1348, 1354, 1341, 1356, 1352, 1353, 1357, 1354, 1344,
+
+     1356, 1347, 1358, 1349, 1350, 1359, 1360, 1361, 1362, 1351,
+     1364, 1357, 1363, 1363, 1365, 1366, 1372, 1357, 1360, 1367,
+     1369, 1361, 1358, 1374, 1367, 1359, 1362, 1368, 1368, 1370,
+     1364, 1373, 1376, 1366, 1370, 1372, 1373, 1373, 1375, 1365,
+     1376, 1374, 1377, 1369, 1378, 1379, 1380, 1375, 1381, 1385,
+     1382, 1380, 1382, 1383, 1380, 1385, 1377, 1381, 1386, 1378,
+     1379, 1387, 1386, 1379, 1388, 1389, 1390, 1383, 1391, 1388,
+     1388, 1392, 1387, 1393, 1395, 1394, 1392, 1396, 1393, 1397,
+     1400, 1399, 1396, 1401, 1389, 1403, 1391, 1402, 1402, 1403,
+     1404, 1405, 1390, 1394, 1395, 1399, 1406, 1407, 1400, 1397,
+
+     1408, 1401, 1406, 1409, 1410, 1411, 1412, 1413, 1404, 1407,
+     1405, 1417, 1414, 1418, 1416, 1419, 1408, 1414, 1410, 1416,
+     1411, 1412, 1409, 1415, 1419, 1421, 1413, 1420, 1420, 1417,
+     1415, 1423, 1422, 1425, 1418, 1424, 1424, 1426, 1427, 1425,
+     1421, 1422, 1430, 1426, 1428, 1428, 1429, 1429, 1430, 1431,
+     1432, 1423, 1427, 1433, 1434, 1435, 1436, 1443, 1433,   17,
+     1434, 1435, 1436, 1437, 1437, 1431, 1438, 1438, 1440, 1440,
+     1441, 1432, 1442, 1444, 1441, 1443, 1445, 1446, 1449, 1447,
+     1450, 1442, 1448, 1448, 1451, 1444, 1447, 1452, 1450, 1451,
+     1445, 1453, 1446, 1456, 1454, 1457, 1457, 1455, 1449, 1454,
+
+     1454, 1452, 1455, 1455, 1458, 1459, 1460, 1461, 1462, 1463,
+     1453, 1465, 1461, 1456, 1464, 1460, 1466, 1465, 1467, 1468,
+     1469, 1466, 1470, 1458, 1459, 1471, 1469, 1462, 1472, 1463,
+     1473, 1471, 1464, 1474, 1472, 1475, 1476, 1477, 1467, 1478,
+     1479, 1470, 1480, 1481, 1481, 1468, 1483, 1482, 1484, 1473,
+     1482, 1485, 1474, 1478, 1475, 1476, 1477, 1480, 1486, 1486,
+     1489, 1479, 1490, 1485, 1489, 1483, 1488, 1484, 1487, 1487,
+     1491, 1488, 1492, 1495, 1493, 1490, 1493, 1496, 1498, 1491,
+     1493, 1497, 1496, 1499, 1501, 1492, 1500, 1500, 1502, 1501,
+     1503, 1495, 1509, 1493, 1502, 1504, 1497, 1505, 1498, 1499,
+
+     1507, 1506, 1510, 1505, 1507, 1503, 1506, 1508, 1504, 1511,
+     1512, 1508, 1509, 1513, 1514, 1514, 1516, 1518, 1511, 1513,
+     1510, 1519, 1520, 1520, 1522, 1521, 1519, 1524, 1524, 1526,
+     1512, 1521, 1526, 1528, 1516, 1527, 1527, 1529, 1518, 1530,
+     1532, 1533, 1535, 1532, 1522, 1534, 1536, 1537, 1537, 1528,
+     1539, 1535, 1538, 1529, 1540, 1530, 1541, 1545, 1542, 1543,
+     1543, 1541, 1533, 1546, 1547, 1534, 1536, 1538, 1544, 1550,
+     1548, 1539, 1542, 1540, 1551, 1545, 1552, 1544, 1546, 1549,
+     1549, 1552, 1553, 1550, 1554, 1554, 1556, 1555, 1558, 1547,
+     1548, 1555, 1551, 1557, 1557, 1559, 1560, 1553, 1561, 1562,
+
+     1563, 1570, 1561, 1565, 1565, 1563, 1556, 1560, 1566, 1567,
+     1558, 1566, 1568, 1569, 1559, 1572, 1571, 1568, 1562, 1570,
+     1574, 1576, 1567, 1573, 1575, 1575, 1576, 1577, 1578, 1569,
+     1571, 1579, 1579, 1580, 1572, 1572, 1581, 1573, 1582, 1586,
+     1595, 1581, 1580, 1591, 1583, 1574, 1583, 1577, 1578, 1584,
+     1585, 1587, 1589, 1647, 1584, 1647, 1585, 1587, 1582, 1586,
+     1590, 1590, 1591, 1592, 1595, 1594, 1589, 1596, 1596, 1592,
+     1594, 1597, 1597, 1598, 1599, 1600, 1601, 1602, 1602, 1601,
+     1603, 1604, 1605, 1606, 1613, 1607, 1606, 1598, 1745, 1606,
+     1600, 1607, 1599, 1604, 1608, 1611, 1745, 1609, 1603, 1608,
+
+     1609, 1606, 1605, 1612, 1611, 1615, 1615, 1614, 1612, 1613,
+     1614, 1616, 1617, 1625, 1618, 1623, 1609, 1616, 1617, 1618,
+     1619, 1619, 1620, 1620, 1621, 1624, 1622, 1626, 1623, 1628,
+     1621, 1622, 1625, 1627, 1629, 1628, 1627, 1631, 1630, 1632,
+     1629, 1633, 1631, 1624, 1630, 1632, 1634, 1626, 1635, 1635,
+     1636, 1634, 1637, 1638, 1640, 1636, 1639, 1641, 1642, 1644,
+     1645, 1646, 1643, 1648, 1633, 1646, 1651, 1655, 1652,    0,
+     1637, 1641, 1642, 1638, 1640, 1639, 1643, 1644, 1651, 1649,
+     1652, 1653, 1648, 1654, 1656, 1645, 1649, 1655, 1657, 1654,
+     1658, 1659, 1661, 1661, 1653, 1662, 1663, 1664, 1665, 1665,
+
+     1656, 1663, 1666, 1668, 1658, 1667, 1669, 1670, 1657, 1664,
+     1671, 1672, 1659, 1674, 1673, 1662, 1670, 1666, 1672, 1667,
+     1676, 1678, 1682, 1673, 1669, 1671, 1673, 1668, 1679, 1674,
+     1683, 1679, 1680, 1680, 1682, 1676, 1681, 1681, 1684, 1686,
+     1676, 1684, 1685, 1685, 1687, 1688, 1678, 1691, 1683, 1692,
+     1688, 1689, 1686, 1690, 1689, 1693, 1694,    0, 1690, 1695,
+     1696, 1697, 1700, 1687, 1693, 1692, 1691, 1697, 1695, 1696,
+     1699, 1695, 1698, 1698, 1701, 1694, 1702, 1699, 1703, 1704,
+     1705, 1707, 1700, 1706, 1710, 1705, 1705, 1701, 1706, 1711,
+     1712, 1712, 1703, 1707, 1702, 1704, 1713, 1714, 1715, 1715,
+
+     1716, 1716, 1717, 1715, 1719, 1718, 1714, 1711, 1720, 1710,
+     1718, 1717, 1713, 1721, 1717, 1716, 1724, 1725, 1722, 1726,
+     1727, 1728, 1719, 1722, 1722, 1727, 1730, 1729, 1732, 1720,
+     1724, 1721, 1725, 1729, 1732, 1728, 1731, 1731, 1733, 1734,
+     1735, 1726, 1736, 1733, 1730, 1738, 1735, 1739, 1736, 1740,
+     1741, 1742, 1743, 1734, 1742, 1740, 1747, 1748, 1743, 1749,
+     1742, 1739, 1750, 1741, 1751, 1738, 1753, 1756, 1752, 1751,
+     1750, 1754, 1755, 1757,    0, 1747, 1748, 1752, 1749, 1753,
+     1754, 1756, 1758, 1758, 1759, 1755, 1760, 1757, 1761, 1763,
+     1759, 1765, 1760, 1762, 1762, 1764, 1766, 1766, 1767, 1768,
+
+     1769, 1761, 1770, 1771, 1758, 1768, 1773, 1773, 1774, 1763,
+     1765, 1767, 1775, 1764, 1776, 1777, 1775, 1780, 1770, 1776,
+     1778, 1771, 1769, 1781, 1779, 1778, 1780, 1783, 1774, 1779,
+     1784, 1785, 1786, 1787, 1785, 1777, 1788, 1788, 1783, 1784,
+     1789, 1790, 1791, 1793, 1786, 1794, 1781, 1799, 1787, 1792,
+     1792, 1795, 1794, 1790, 1796, 1798, 1800, 1793, 1801, 1789,
+     1802, 1791, 1800, 1795, 1809, 1803, 1796, 1799, 1804, 1804,
+     1801, 1803, 1805, 1809, 1798, 1805, 1806, 1806, 1802, 1808,
+     1810, 1811, 1811, 1812, 1808, 1813, 1810, 1813, 1814, 1815,
+     1816, 1814, 1817, 1818, 1819, 1812, 1820, 1821, 1823, 1819,
+
+     1824, 1820, 1822, 1826, 1829, 1824, 1821, 1825,    0, 1815,
+     1817, 1818, 1816, 1823, 1822, 1827, 1825, 1828, 1832, 1829,
+     1827, 1834, 1828, 1826, 1830, 1830, 1831, 1827, 1835, 1825,
+     1836, 1837, 1831, 1838, 1839, 1838, 1840, 1840, 1843, 1832,
+     1834, 1841, 1841, 1842, 1842, 1846, 1836, 1835, 1839, 1847,
+     1839, 1837, 1844, 1844, 1845, 1845, 1848, 1850, 1843, 1849,
+     1849, 1850, 1851, 1854, 1852, 1855, 1846, 1852, 1851, 1854,
+     1847, 1857, 1856, 1858, 1860, 1860, 1857, 1848, 1856, 1859,
+     1861, 1862, 1859, 1855, 1863, 1863, 1862, 1864, 1865, 1866,
+     1867, 1868, 1868, 1870, 1866, 1867, 1869, 1879, 1858, 1870,
+
+     1861, 1869, 1864, 1871, 1872, 1873, 1874, 1875, 1876, 1865,
+     1880, 1879,    0, 1875, 1878, 1871, 1871, 1871, 1883, 1878,
+     1878, 1882, 1871, 1873, 1872, 1880, 1874, 1881, 1876, 1881,
+     1884, 1885, 1882, 1883, 1886, 1887, 1884, 1888, 1888, 1889,
+     1885, 1890, 1890, 1891, 1892, 1893, 1893, 1894, 1894, 1895,
+     1898, 1898, 1899, 1900, 1886, 1902, 1887, 1903, 1905, 1906,
+     1906, 1904, 1900, 1891, 1902, 1889, 1892, 1904, 1907, 1895,
+     1908, 1910, 1909, 1911, 1905, 1912, 1912, 1899, 1903, 1909,
+     1910, 1913, 1914, 1917, 1916, 1908, 1918, 1920, 1917, 1907,
+     1916, 1919, 1918, 1924, 1920, 1921, 1929, 1925, 1914, 1911,
+
+     1922, 1921, 1922, 1925, 1926, 1926, 1928, 1913, 1927, 1930,
+     1932, 1919, 1924, 1927, 1931, 1928, 1929, 1931, 1933, 1934,
+     1935, 1933, 1932, 1936, 1936, 1937, 1938, 1939, 1930, 1940,
+     1941, 1937, 1938, 1943, 1941, 1944, 1945, 1934, 1946, 1946,
+     1947, 1945, 1948, 1949, 1940, 1952, 1935, 1939, 1951, 1952,
+     1941, 1953, 1953, 1943, 1954, 1957, 1955, 1944, 1949, 1957,
+     1954, 1948, 1956, 1956, 1947, 1955, 1958, 1951, 1959, 1959,
+     1960, 1961, 1968, 1962, 1963, 1964, 1965, 1958, 1966, 1963,
+     1967, 1971, 1958, 1970, 1969, 1961, 1967, 1978, 1970, 1974,
+     1968, 1960, 1962, 1974, 1971, 1964, 1965, 1976, 1966, 1969,
+
+     1972, 1972, 1973, 1973, 1977, 1986, 1976, 1978, 1979, 1979,
+     1981, 1981, 1982, 1983,    0, 1977, 1985, 1982, 1982, 1983,
+     1977, 1987, 1985, 1988, 1989, 1991, 1987, 1993, 1992, 1995,
+     1989, 1986, 1992, 1994, 1994, 1988, 1996, 1991, 1997, 1993,
+     1998, 2001, 1996, 1999, 1999, 2000, 1998, 2002, 2006, 2074,
+     2003, 2005, 2002, 2007, 1995, 2013, 2009, 2074, 2007, 2009,
+     1997, 2001, 2003, 2005, 2000, 2010, 2010, 2006, 2011, 2011,
+     2012, 2012, 2014, 2015, 2017, 2013, 2016, 2018, 2014, 2015,
+     2017, 2016, 2020, 2023, 2026, 2022, 2018, 2020, 2022, 2024,
+     2024, 2027, 2028, 2029, 2029, 2023, 2026, 2028, 2030, 2031,
+
+     2032, 2034, 2034, 2027, 2031, 2032, 2033, 2030, 2035, 2033,
+     2036, 2037, 2038, 2039, 2042, 2040, 2041, 2039, 2043, 2036,
+     2040, 2044, 2041, 2045, 2047, 2047, 2048, 2043, 2035, 2037,
+     2050, 2038, 2042, 2049, 2051, 2051, 2047, 2045, 2052, 2044,
+     2053, 2054, 2049, 2055, 2048, 2056, 2061, 2052, 2055, 2061,
+     2050, 2062, 2053, 2059, 2059, 2063, 2064, 2068, 2056, 2066,
+     2069, 2067, 2054, 2068, 2070, 2070, 2071, 2062, 2071, 2072,
+     2079, 2063, 2064, 2088, 2066, 2067, 2084, 2069, 2073, 2073,
+     2076, 2076, 2077, 2077, 2080, 2081, 2082, 2072, 2083, 2085,
+     2080, 2081, 2087, 2079, 2088, 2083, 2086, 2086, 2084, 2089,
+
+     2082, 2087, 2090, 2091, 2092, 2093, 2094, 2097, 2099, 2085,
+     2098, 2089, 2101, 2095, 2090, 2095, 2092, 2102, 2091, 2095,
+     2099, 2094, 2100, 2100, 2104, 2103, 2105, 2097, 2103, 2104,
+     2101, 2093, 2095, 2098, 2107, 2109, 2108, 2102, 2108, 2107,
+     2110, 2111, 2113, 2115, 2119, 2110, 2105, 2116, 2111, 2120,
+     2117, 2113, 2118, 2109, 2118, 2120, 2116, 2122, 2123, 2122,
+     2125, 2115, 2117, 2119, 2124, 2124, 2126, 2127, 2128, 2127,
+     2129, 2126, 2123, 2128, 2130, 2129, 2131, 2132, 2133, 2136,
+     2134, 2140, 2135, 2137, 2133, 2134, 2125, 2141, 2137, 2137,
+     2138, 2136, 2130, 2145, 2131, 2135, 2144, 2132, 2138, 2146,
+
+     2140, 2141, 2142, 2142, 2143, 2143, 2147, 2144, 2145, 2148,
+     2150, 2149, 2147, 2149, 2148, 2151, 2152, 2152, 2153, 2146,
+     2154, 2154, 2157, 2151, 2155, 2155, 2156, 2157, 2150, 2158,
+     2153, 2151, 2160, 2161, 2163, 2156, 2160, 2162, 2164, 2162,
+     2165, 2166, 2161, 2164, 2164, 2161, 2167, 2158, 2169, 2170,
+     2166, 2171, 2165, 2173, 2170, 2163, 2171, 2174, 2167, 2175,
+     2169, 2176, 2176, 2177, 2178, 2179, 2173, 2181, 2175, 2180,
+     2182, 2183,    0, 2184, 2188, 2186, 2187, 2174, 2184, 2197,
+     2191, 2177, 2178, 2179, 2182, 2180, 2183, 2186, 2187, 2191,
+     2189, 2190, 2181, 2194, 2188, 2189, 2190, 2196, 2198, 2194,
+
+     2199, 2200, 2197, 2196, 2205, 2201, 2202, 2202, 2203, 2204,
+     2204, 2206, 2194, 2198, 2201, 2207, 2208, 2203, 2199, 2207,
+     2209, 2208, 2205, 2211, 2213, 2212, 2200, 2219,    0, 2214,
+     2206, 2212, 2215, 2209, 2214, 2214, 2217, 2216, 2215, 2217,
+     2218, 2228, 2211, 2216, 2222, 2222, 2213, 2219, 2218, 2223,
+     2223, 2224, 2225, 2225, 2226, 2226, 2227, 2229, 2241, 2228,
+     2224, 2230, 2233, 2229, 2223, 2237, 2230, 2233, 2227, 2231,
+     2231, 2232, 2232, 2234, 2236, 2223, 2238, 2239, 2236, 2234,
+     2238, 2242, 2243, 2241, 2244, 2237, 2242, 2245, 2246, 2248,
+     2249, 2247, 2245, 2250, 2252, 2249, 2253, 2239, 2252, 2244,
+
+     2251, 2251, 2255, 2254, 2256, 2243, 2246, 2247, 2254, 2248,
+     2258, 2253, 2257, 2259, 2260, 2250, 2261, 2264, 2259, 2262,
+     2262, 2265, 2256, 2266, 2257, 2264, 2267, 2260, 2255, 2258,
+     2268, 2269, 2270, 2271, 2261, 2272, 2273, 2274, 2305, 2278,
+     2265, 2276, 2266, 2274, 2279, 2267, 2281, 2272, 2281, 2282,
+     2305, 2270, 2278, 2268, 2271, 2269, 2276, 2273, 2279, 2280,
+     2283, 2283, 2284, 2285, 2286, 2280, 2285, 2284, 2287, 2282,
+     2288, 2289, 2289, 2290, 2290, 2293, 2291, 2286, 2291, 2292,
+     2292, 2294, 2287, 2288, 2295, 2295, 2296, 2296, 2297, 2303,
+     2293, 2298, 2298, 2300, 2294, 2299, 2299, 2297, 2300, 2302,
+
+     2297, 2304, 2306, 2306, 2302, 2307, 2307, 2308, 2312, 2303,
+     2309, 2309, 2310, 2311, 2311, 2313, 2314, 2314, 2315, 2315,
+     2313, 2304, 2316, 2312, 2317, 2318, 2308, 2319, 2320, 2322,
+     2310, 2323, 2323, 2317, 2322, 2324, 2316, 2325, 2325, 2326,
+     2327, 2319, 2318, 2328, 2332, 2327, 2333, 2320, 2329, 2328,
+     2336, 2329, 2330, 2330, 2324, 2331, 2331, 2326, 2334, 2337,
+     2334, 2333, 2340, 2332, 2341, 2336, 2338, 2338, 2330, 2342,
+     2343, 2344, 2345, 2345, 2346, 2344, 2347, 2352, 2337, 2341,
+     2348, 2347, 2340, 2349, 2353, 2343, 2351, 2351, 2354, 2355,
+     2356, 2353, 2342, 2346, 2357, 2348, 2358, 2352, 2349, 2359,
+
+     2359, 2360, 2354, 2361, 2365, 2361, 2364, 2355, 2356, 2357,
+     2360, 2362, 2364, 2366, 2362, 2367, 2365, 2368, 2366, 2369,
+     2367, 2371, 2358, 2370, 2372, 2374, 2371, 2380, 2375, 2362,
+     2374, 2362, 2369, 2375, 2376, 2378, 2377, 2379, 2381, 2376,
+     2382, 2378, 2368, 2379, 2370, 2385, 2382, 2383, 2380, 2384,
+     2372, 2377, 2383, 2381, 2384, 2386, 2387, 2388, 2389, 2387,
+     2390, 2392, 2391, 2397, 2399, 2400, 2388, 2389, 2386, 2390,
+     2385, 2391, 2393, 2394, 2400, 2392, 2395,    0, 2393, 2394,
+     2395, 2401, 2401, 2397, 2399, 2402, 2403, 2403, 2404, 2405,
+     2405, 2402, 2407, 2406, 2409, 2403, 2412, 2404, 2406, 2410,
+
+     2411, 2411, 2416, 2421, 2413, 2415, 2417, 2418, 2421, 2422,
+     2409, 2412, 2407, 2413, 2407, 2410, 2423, 2415, 2416, 2418,
+     2420, 2417,    0, 2420, 2424, 2424, 2425, 2425, 2423, 2422,
+     2427, 2427, 2428, 2429, 2430, 2428, 2431, 2432, 2429, 2434,
+     2430, 2437, 2431, 2433, 2433, 2436, 2432, 2435, 2435, 2438,
+     2439, 2439, 2440, 2434, 2442, 2437, 2441, 2436, 2440, 2442,
+     2444, 2450, 2445, 2448, 2444, 2445, 2446, 2446, 2438, 2447,
+     2441, 2449, 2448, 2451, 2447, 2452, 2452, 2451, 2453, 2455,
+     2449, 2450, 2456, 2457, 2455, 2458, 2459, 2461, 2460, 2462,
+     2463, 2453, 2460, 2464, 2462, 2466, 2463, 2465, 2465, 2464,
+
+     2459, 2467, 2456, 2457, 2468, 2458, 2469, 2461, 2470, 2471,
+     2471, 2469, 2473, 2466, 2474, 2478, 2475, 2478, 2477, 2476,
+     2467, 2475, 2480, 2468, 2473, 2476, 2477, 2482, 2486, 2470,
+     2474, 2480, 2483, 2483, 2484, 2485, 2492, 2484, 2485, 2487,
+     2487, 2482, 2490, 2491, 2493, 2493, 2490, 2494, 2492, 2491,
+     2497, 2497, 2499, 2501, 2486, 2502, 2494, 2505, 2506, 2507,
+     2508, 2509, 2505, 2510, 2510, 2508, 2509, 2501, 2512, 2512,
+     2499, 2502, 2514, 2515, 2516, 2516, 2517, 2518, 2514, 2521,
+     2507, 2519, 2522, 2523, 2506, 2522, 2519, 2527, 2524, 2525,
+     2525, 2528, 2517, 2515, 2530, 2523, 2527, 2528, 2521, 2518,
+
+     2524, 2529, 2531, 2533, 2533, 2534, 2535, 2529, 2534, 2536,
+     2538, 2538, 2530, 2539, 2539, 2540, 2541, 2531, 2543, 2542,
+     2540, 2544, 2545, 2546, 2545, 2535, 2544, 2536, 2542, 2547,
+     2548, 2543, 2550, 2549, 2541, 2551, 2552, 2546, 2549, 2553,
+     2553, 2552, 2548, 2547, 2554, 2554, 2555, 2555, 2556, 2556,
+     2557, 2558, 2550, 2559, 2563, 2551, 2560, 2560, 2559, 2561,
+     2561, 2564, 2557, 2562, 2562, 2565, 2563, 2566, 2567, 2558,
+     2568, 2569, 2569, 2570, 2571, 2571, 2574, 2565, 2572, 2572,
+     2573, 2564, 2576, 2575, 2577, 2579, 2568, 2566, 2574, 2567,
+     2575, 2573, 2570, 2578, 2576, 2580, 2581, 2581, 2578, 2582,
+
+     2583, 2583, 2584, 2585, 2577, 2579, 2586, 2587, 2582, 2591,
+     2588, 2589, 2590, 2593, 2590, 2580, 2592, 2592, 2597, 2586,
+     2594, 2591, 2593, 2585, 2588, 2595, 2598, 2599, 2584, 2600,
+     2601, 2587, 2600, 2589, 2602, 2594, 2597, 2603, 2612, 2602,
+     2595, 2611, 2603, 2613, 2601, 2604, 2604, 2616, 2598, 2612,
+     2599, 2605, 2605, 2606, 2606, 2608, 2608, 2610, 2610, 2611,
+     2614, 2617, 2613, 2618, 2619, 2620, 2621, 2616, 2622, 2623,
+     2622, 2630, 2624, 2625, 2620, 2614, 2626, 2626, 2629, 2617,
+     2628, 2628, 2632, 2632, 2619, 2618, 2621, 2631, 2634, 2623,
+     2624, 2625, 2629, 2630, 2635, 2635, 2631, 2634, 2636, 2637,
+
+     2638, 2639, 2641, 2642, 2640, 2644, 2643, 2645, 2639, 2646,
+     2646, 2647, 2647, 2648, 2645,    0, 2636, 2637, 2638, 2640,
+     2641, 2642, 2643, 2649, 2644, 2650, 2652, 2652, 2653, 2653,
+     2654, 2650, 2655, 2648, 2656, 2657, 2654, 2658, 2659, 2660,
+     2662, 2649, 2661, 2659, 2664, 2669, 2664, 2663, 2672, 2656,
+     2655, 2658, 2663, 2661, 2657, 2665, 2665, 2667, 2667, 2660,
+     2662, 2666, 2671, 2666, 2669, 2673, 2674, 2672, 2675, 2676,
+     2677, 2671, 2678, 2675, 2676, 2681, 2682, 2673, 2683, 2684,
+     2684, 2683, 2685, 2686, 2687, 2687, 2674, 2688, 2689, 2690,
+     2677, 2678, 2692, 2690, 2682, 2681, 2693, 2685, 2688, 2696,
+
+     2694, 2686, 2693, 2689, 2694, 2695, 2695, 2692, 2698, 2699,
+     2700, 2704, 2696, 2701, 2701, 2703, 2708, 2705, 2706, 2706,
+     2704, 2705, 2712, 2698, 2707, 2707, 2714, 2703, 2710, 2699,
+     2700, 2709, 2709, 2710, 2711, 2708, 2713, 2721, 2712, 2715,
+     2715, 2720, 2720, 2711, 2722, 2722, 2714, 2723, 2713, 2724,
+     2725, 2730, 2726, 2729, 2729, 2727, 2728, 2731,    0, 2721,
+     2723, 2726, 2724, 2725, 2727, 2728, 2733, 2733, 2736, 2737,
+     2738, 2730, 2731, 2736, 2737, 2739, 2741, 2740, 2742, 2745,
+     2739, 2743, 2749, 2747, 2738, 2740, 2748, 2742, 2747, 2743,
+     2753, 2748, 2750, 2750, 2745, 2741, 2752, 2749, 2751, 2751,
+
+     2755, 2752, 2754, 2754, 2757, 2756, 2758, 2755, 2759, 2753,
+     2756, 2760, 2761, 2761, 2759, 2762, 2760,    0, 2763, 2764,
+     2764, 2768, 2757, 2763, 2758, 2765, 2765, 2769, 2769, 2770,
+     2762, 2771, 2770, 2772, 2768, 2773, 2771, 2771, 2772, 2774,
+     2773, 2775, 2776, 2777, 2779, 2778, 2776, 2775, 2777, 2780,
+     2781, 2784, 2782, 2774, 2778, 2783, 2784, 2780, 2782, 2779,
+     2785, 2783, 2787, 2788, 2789, 2791, 2796, 2789, 2788, 2787,
+     2793, 2781, 2785, 2794, 2795, 2793, 2797, 2791, 2794, 2795,
+     2805, 2798, 2799, 2801, 2796, 2800, 2800, 2810, 2802, 2797,
+     2798, 2799, 2801, 2802, 2806, 2807, 2811, 2814, 2805, 2812,
+
+     2806, 2807, 2813, 2813, 2814, 2815, 2810, 2817, 2816, 2820,
+     2818, 2819, 2819, 2824, 2822, 2825, 2811, 2816, 2812, 2825,
+     2826, 2826, 2817, 2827, 2815, 2818, 2828, 2830, 2820, 2822,
+     2829, 2831, 2828, 2824, 2832, 2832, 2829, 2831, 2833, 2834,
+     2837, 2838, 2835, 2859, 2840, 2830, 2833, 2835, 2827, 2837,
+     2840, 2843, 2841, 2842, 2838, 2841, 2845, 2842, 2844, 2844,
+     2847, 2847, 2848, 2859, 2834, 2843, 2849, 2849, 2850, 2850,
+     2853, 2845, 2852, 2852, 2853, 2855, 2854, 2857, 2857, 2861,
+     2848, 2854, 2860, 2862, 2855, 2863, 2865, 2860, 2862, 2862,
+     2872, 2861, 2866, 2866, 2868, 2868, 2873, 2863, 2869, 2869,
+
+     2870, 2870, 2871, 2872, 2876, 2871, 2865, 2875, 2875, 2873,
+     2878, 2879, 2879, 2880, 2880, 2881, 2881, 2882, 2883, 2883,
+     2884, 2885, 2876, 2886, 2889, 2887, 2888, 2888, 2889, 2892,
+     2878, 2887, 2882, 2884, 2896, 2892, 2893, 2886, 2895, 2885,
+     2897, 2893, 2898, 2895, 2895, 2899, 2900, 2901, 2911, 2902,
+     2908, 2899, 2900, 2902, 2903, 2903, 2906, 2896, 2908, 2914,
+     2897, 2906, 2898, 2909, 2912, 2915, 2909, 2912, 2913, 2913,
+     2915, 2916, 2901, 2911, 2917, 2934, 2914, 2914, 2918, 2919,
+     2919, 2920, 2921, 2922, 2923, 2921, 2928, 2928, 2924, 2916,
+     2927, 2934, 2918, 2921, 2917, 2920, 2924, 2922, 2937, 2925,
+
+        0, 2926, 2936, 2923, 2925, 2925, 2926, 2926, 2940, 2927,
+     2929, 2929, 2930, 2930, 2931, 2931, 2932, 2932, 2933, 2933,
+     2935, 2938, 2936, 2939, 2937, 2935, 2941, 2940, 2939, 2942,
+     2943, 2941, 2944, 2946, 2946, 2938, 2947, 2947, 2942, 2948,
+     2949, 2950, 2948, 2952, 2952, 2963, 2949, 2953, 2954, 2954,
+     2943, 2955, 2944, 2958, 2953, 2959, 2955, 2957, 2957, 2950,
+     2960, 2961, 2958, 2963, 2959, 2964, 2964, 2965, 2965, 2960,
+     2961, 2966, 2967, 2968, 2969, 2966, 2970, 2971, 2974,    0,
+     2973, 2967, 2971, 2971, 2975, 2969, 2981, 2974, 2975, 2979,
+     2984, 2970, 2968, 2973, 2979, 2980, 2980, 2983, 2983, 2985,
+
+     2981, 2986, 2988, 2988, 2984, 2989, 2990, 2994, 2995, 2998,
+     2999, 2996, 3003, 2995, 2989, 3001, 2999, 3005, 2990, 2986,
+     2996, 3006, 3005, 3010, 2985, 3008, 3006, 3001, 3010, 2998,
+     3007, 3007, 2994, 3003, 3008, 3011, 3012, 3013, 3013, 3015,
+     3015, 3013, 3016, 3016, 3017, 3017, 3018, 3019, 3011, 3020,
+     3012, 3021, 3023, 3027, 3024, 3018, 3021, 3025, 3023, 3024,
+     3026, 3026, 3025, 3028, 3029, 3030, 3031, 3019, 3020, 3033,
+     3030, 3027, 3032, 3034, 3034, 3028, 3036, 3037, 3032, 3040,
+     3036, 3038, 3037, 3044, 3031, 3029, 3038, 3039, 3039, 3041,
+     3042, 3046, 3046, 3048, 3033, 3049, 3050, 3051, 3040, 3053,
+
+     3054, 3051, 3052, 3044, 3041, 3042, 3048, 3056, 3049, 3050,
+     3055, 3052, 3056, 3057, 3059, 3053, 3058, 3058, 3055, 3054,
+     3060, 3061, 3063, 3059, 3062, 3062, 3066, 3066, 3067, 3068,
+     3068, 3070, 3074, 3057, 3067, 3072, 3072, 3075, 3060, 3076,
+     3077, 3063, 3081, 3081, 3076, 3078, 3082, 3061, 3074, 3083,
+     3078, 3084, 3070, 3075, 3085, 3086, 3077, 3084, 3083, 3088,
+     3088, 3089, 3090, 3091, 3091, 3093, 3082, 3095, 3097, 3099,
+     3096, 3093, 3103, 3097, 3086, 3089, 3096, 3085, 3100, 3100,
+     3102, 3090, 3101, 3101, 3104, 3104, 3105, 3095, 3107, 3106,
+     3108, 3099, 3103, 3109, 3110, 3102, 3108, 3105, 3106, 3111,
+
+     3112, 3112, 3113, 3121, 3104,    0, 3110, 3114, 3107, 3120,
+     3114, 3115, 3109, 3126, 3115, 3116, 3116, 3113, 3122, 3111,
+     3131, 3120, 3125, 3121, 3122, 3123, 3123, 3124, 3125, 3128,
+     3124, 3126, 3129, 3129, 3128, 3130, 3132, 3133, 3136, 3131,
+     3130, 3137, 3132, 3134, 3134, 3138, 3141, 3139, 3140, 3140,
+     3136, 3142, 3143, 3148, 3133, 3133, 3145, 3145, 3148, 3137,
+     3139, 3143, 3146, 3146, 3149, 3141, 3150, 3142, 3147, 3147,
+     3138, 3150, 3151, 3151, 3152, 3152, 3153, 3153, 3149, 3154,
+     3154, 3155, 3156, 3157, 3164, 3158, 3160, 3160, 3166, 3157,
+     3158, 3162, 3162, 3167, 3155, 3168, 3169, 3170, 3170, 3172,
+
+     3172, 3173, 3174, 3164, 3176, 3175, 3184, 3177, 3156, 3183,
+     3166, 3178, 3178, 3181, 3168, 3167, 3177, 3188, 3169, 3175,
+     3182, 3174, 3179, 3179, 3176, 3184, 3182, 3173, 3185, 3183,
+     3195, 3181, 3193, 3185, 3189, 3189, 3191, 3191, 3188, 3192,
+     3196, 3194, 3195, 3202, 3192, 3203, 3193, 3194, 3196, 3197,
+     3197, 3198, 3205, 3200, 3201, 3204, 3198, 3200, 3208, 3201,
+     3204, 3206, 3209, 3202, 3205, 3203, 3208, 3206, 3210, 3211,
+     3214, 3217, 3213, 3216, 3215, 3219, 3217, 3220, 3221, 3224,
+     3219, 3209, 3222,    0, 3221, 3226, 3214, 3222, 3210, 3211,
+     3213, 3215, 3215, 3225, 3216, 3239, 3225, 3220, 3226, 3224,
+
+     3230, 3230, 3231, 3231, 3232, 3237, 3237, 3238, 3232, 3240,
+     3240, 3386, 3238, 3386, 3239, 3243, 3243, 3244, 3244, 3248,
+     3244, 3245, 3245, 3248, 3245, 3246, 3246, 3247, 3247, 3250,
+     3247, 3251, 3252, 3252, 3250, 3253, 3254, 3257, 3257, 3258,
+     3251, 3259, 3260, 3261, 3261, 3262, 3265, 3260, 3266, 3268,
+     3254, 3269, 3267, 3253, 3271, 3266, 3267, 3272, 3268, 3258,
+     3274, 3259, 3272, 3273, 3273, 3262, 3269, 3275, 3275, 3274,
+     3278, 3265, 3271, 3276, 3276, 3277, 3277, 3279, 3280, 3283,
+     3282, 3284, 3279, 3281, 3285, 3278, 3282, 3280, 3281, 3281,
+     3280, 3288, 3286, 3287, 3289, 3289, 3284, 3286, 3287, 3294,
+
+     3290, 3291, 3292, 3292, 3283, 3285, 3290, 3291, 3293, 3293,
+     3288, 3295, 3298, 3298, 3294, 3301, 3295, 3300, 3300, 3304,
+     3304, 3305, 3305, 3313, 3301, 3306, 3306, 3307, 3307, 3309,
+     3309, 3310, 3310, 3311, 3311, 3312, 3312, 3315, 3316, 3316,
+     3317, 3317, 3318, 3319, 3320, 3325, 3315, 3322, 3322, 3313,
+     3323, 3318, 3324, 3324, 3326, 3319, 3327, 3328, 3328, 3331,
+     3325, 3329, 3329, 3335, 3320, 3332, 3332, 3326, 3327, 3323,
+     3336, 3337, 3339, 3336, 3331, 3338, 3338, 3341, 3342, 3343,
+     3341, 3335, 3344, 3345, 3342, 3346, 3349, 3344, 3347, 3350,
+     3339, 3353, 3349, 3343, 3354, 3353, 3357, 3337, 3350, 3370,
+
+     3366, 3376, 3345, 3346, 3347, 3366, 3379, 3367, 3383, 3354,
+     3367, 3377, 3370, 3371, 3371, 3372, 3372, 3374, 3374, 3378,
+     3377, 3381, 3357, 3378, 3376, 3384, 3379, 3385, 3387, 3388,
+     3388, 3383, 3385, 3389, 3390, 3381, 3384, 3391, 3392, 3393,
+     3395, 3394, 3397, 3387, 3398, 3396, 3389, 3397, 3401, 3395,
+     3400, 3400, 3407, 3390, 3392, 3391, 3394, 3396, 3399, 3406,
+        0, 3402, 3409, 3399, 3393, 3398, 3402, 3414, 3401, 3408,
+     3408, 3409, 3407, 3406, 3410, 3410, 3411, 3411, 3412, 3412,
+     3413, 3413, 3415, 3417, 3416, 3418, 3414, 3416, 3417, 3419,
+     3418, 3420, 3421, 3422, 3424, 3426, 3423, 3430, 3421, 3424,
+
+     3425, 3425, 3415, 3427, 3427, 3431, 3420, 3422, 3423, 3429,
+     3429, 3434, 3430, 3436, 3419, 3426, 3432, 3432, 3439, 3439,
+     3440, 3440, 3441, 3442, 3431, 3445, 3434, 3443, 3444, 3447,
+     3441, 3436, 3446, 3443, 3444, 3448, 3449, 3449, 3454, 3445,
+     3448, 3455, 3442, 3451, 3451, 3446, 3457, 3458, 3447, 3460,
+     3461, 3458, 3462, 3463, 3464, 3461, 3465, 3466, 3467, 3454,
+     3457, 3455, 3466, 3467, 3468, 3468, 3463, 3464, 3471, 3460,
+     3473, 3462, 3472, 3474, 3474, 3465, 3475, 3476, 3477, 3477,
+     3478, 3475, 3479, 3476, 3481, 3478, 3480, 3479, 3471, 3473,
+     3472, 3480, 3482, 3484, 3484, 3485, 3486, 3486, 3482, 3489,
+
+     3485, 3488, 3490, 3481, 3491, 3488, 3492, 3493, 3494, 3490,
+     3500, 3495, 3502, 3493, 3497, 3497, 3499, 3499, 3489, 3500,
+     3503, 3501, 3500, 3491, 3495, 3492, 3501, 3494, 3504, 3505,
+     3505, 3502, 3506, 3507, 3509, 3510, 3510, 3506, 3511, 3503,
+     3516, 3504, 3512, 3512, 3513, 3513, 3507, 3514, 3515, 3517,
+     3517, 3518, 3514, 3520, 3520, 3515, 3518, 3511, 3521, 3516,
+     3509, 3519, 3522, 3519, 3523, 3521, 3524, 3525, 3528, 3522,
+     3530, 3524, 3527, 3527, 3531, 3530, 3532, 3533, 3537, 3531,
+     3534, 3534, 3538, 3523, 3536, 3536, 3525, 3528, 3539, 3539,
+     3540, 3540, 3541, 3543, 3543, 3532, 3533, 3537, 3545, 3541,
+
+     3551, 3538, 3544, 3544, 3547, 3545, 3550, 3552,    0, 3547,
+        0, 3550, 3553, 3553, 3554, 3554,    0,    0,    0, 3551,
+        0,    0,    0,    0,    0,    0, 3552, 3558, 3558, 3558,
+     3558, 3558, 3558, 3558, 3559, 3559, 3559, 3559, 3559, 3559,
+     3559, 3560, 3560, 3560, 3560, 3560, 3560, 3560, 3561, 3561,
+     3561, 3561, 3561, 3561, 3561, 3562, 3562, 3562, 3562, 3562,
+     3562, 3562, 3563, 3563, 3563, 3563, 3563, 3563, 3563, 3564,
+     3564, 3564, 3564, 3564, 3564, 3564, 3566, 3566,    0, 3566,
+     3566, 3566, 3566, 3567, 3567,    0,    0,    0, 3567, 3567,
+     3568, 3568,    0,    0, 3568,    0, 3568, 3569,    0,    0,
+
+        0,    0,    0, 3569, 3570, 3570,    0,    0,    0, 3570,
+     3570, 3571,    0,    0,    0,    0,    0, 3571, 3572, 3572,
+        0, 3572, 3572, 3572, 3572, 3573,    0,    0,    0,    0,
+        0, 3573, 3574, 3574,    0,    0,    0, 3574, 3574, 3575,
+     3575,    0, 3575, 3575, 3575, 3575, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557,
+     3557, 3557, 3557, 3557, 3557, 3557, 3557
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -3308,7 +3362,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 3310 "<stdout>"
+#line 3364 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -3526,7 +3580,7 @@ YY_DECL
        {
 #line 211 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 
-#line 3528 "<stdout>"
+#line 3582 "<stdout>"
 
        while ( 1 )             /* loops until end-of-file is reached */
                {
@@ -3559,13 +3613,13 @@ yy_match:
                        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                                {
                                yy_current_state = (int) yy_def[yy_current_state];
-                               if ( yy_current_state >= 3484 )
+                               if ( yy_current_state >= 3558 )
                                        yy_c = yy_meta[(unsigned int) yy_c];
                                }
                        yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
                        ++yy_cp;
                        }
-               while ( yy_base[yy_current_state] != 6793 );
+               while ( yy_base[yy_current_state] != 6947 );
 
 yy_find_action:
                yy_act = yy_accept[yy_current_state];
@@ -4190,32 +4244,32 @@ YY_RULE_SETUP
 case 120:
 YY_RULE_SETUP
 #line 334 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) }
        YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 335 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+{ YDVAR(0, VAR_FORWARD_ZONE) }
        YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 336 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+{ YDVAR(1, VAR_FORWARD_ADDR) }
        YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 337 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+{ YDVAR(1, VAR_FORWARD_HOST) }
        YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 338 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_NO_CACHE) }
+{ YDVAR(1, VAR_FORWARD_FIRST) }
        YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 339 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_FORWARD_NO_CACHE) }
        YY_BREAK
 case 126:
 YY_RULE_SETUP
@@ -4225,1034 +4279,1064 @@ YY_RULE_SETUP
 case 127:
 YY_RULE_SETUP
 #line 341 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_AUTH_ZONE) }
+{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
        YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 342 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_RPZ) }
+{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) }
        YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 343 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TAGS) }
+{ YDVAR(0, VAR_AUTH_ZONE) }
        YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 344 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
+{ YDVAR(0, VAR_RPZ) }
        YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 345 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
+{ YDVAR(1, VAR_TAGS) }
        YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 346 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_LOG) }
+{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
        YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 347 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_LOG_NAME) }
+{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
        YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 348 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEFILE) }
+{ YDVAR(1, VAR_RPZ_LOG) }
        YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 349 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MASTER) }
+{ YDVAR(1, VAR_RPZ_LOG_NAME) }
        YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 350 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MASTER) }
+{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) }
        YY_BREAK
 case 137:
 YY_RULE_SETUP
 #line 351 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_URL) }
+{ YDVAR(1, VAR_ZONEFILE) }
        YY_BREAK
 case 138:
 YY_RULE_SETUP
 #line 352 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ALLOW_NOTIFY) }
+{ YDVAR(1, VAR_MASTER) }
        YY_BREAK
 case 139:
 YY_RULE_SETUP
 #line 353 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
+{ YDVAR(1, VAR_MASTER) }
        YY_BREAK
 case 140:
 YY_RULE_SETUP
 #line 354 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_UPSTREAM) }
+{ YDVAR(1, VAR_URL) }
        YY_BREAK
 case 141:
 YY_RULE_SETUP
 #line 355 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FALLBACK_ENABLED) }
+{ YDVAR(1, VAR_ALLOW_NOTIFY) }
        YY_BREAK
 case 142:
 YY_RULE_SETUP
 #line 356 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_VIEW) }
+{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
        YY_BREAK
 case 143:
 YY_RULE_SETUP
 #line 357 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VIEW_FIRST) }
+{ YDVAR(1, VAR_FOR_UPSTREAM) }
        YY_BREAK
 case 144:
 YY_RULE_SETUP
 #line 358 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(1, VAR_FALLBACK_ENABLED) }
        YY_BREAK
 case 145:
 YY_RULE_SETUP
 #line 359 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(0, VAR_VIEW) }
        YY_BREAK
 case 146:
 YY_RULE_SETUP
 #line 360 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_VIEW_FIRST) }
        YY_BREAK
 case 147:
 YY_RULE_SETUP
 #line 361 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
        YY_BREAK
 case 148:
 YY_RULE_SETUP
 #line 362 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
        YY_BREAK
 case 149:
 YY_RULE_SETUP
 #line 363 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
        YY_BREAK
 case 150:
 YY_RULE_SETUP
 #line 364 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
+{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
        YY_BREAK
 case 151:
 YY_RULE_SETUP
 #line 365 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
        YY_BREAK
 case 152:
 YY_RULE_SETUP
 #line 366 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
        YY_BREAK
 case 153:
 YY_RULE_SETUP
 #line 367 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
        YY_BREAK
 case 154:
 YY_RULE_SETUP
 #line 368 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
        YY_BREAK
 case 155:
 YY_RULE_SETUP
 #line 369 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
        YY_BREAK
 case 156:
 YY_RULE_SETUP
 #line 370 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
        YY_BREAK
 case 157:
 YY_RULE_SETUP
 #line 371 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
        YY_BREAK
 case 158:
 YY_RULE_SETUP
 #line 372 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
        YY_BREAK
 case 159:
 YY_RULE_SETUP
 #line 373 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
        YY_BREAK
 case 160:
 YY_RULE_SETUP
 #line 374 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
        YY_BREAK
 case 161:
 YY_RULE_SETUP
 #line 375 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
        YY_BREAK
 case 162:
 YY_RULE_SETUP
 #line 376 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
        YY_BREAK
 case 163:
 YY_RULE_SETUP
 #line 377 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_USER_AGENT) }
+{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) }
        YY_BREAK
 case 164:
 YY_RULE_SETUP
 #line 378 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_IDENTITY) }
        YY_BREAK
 case 165:
 YY_RULE_SETUP
 #line 379 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_VERSION) }
        YY_BREAK
 case 166:
 YY_RULE_SETUP
 #line 380 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_HTTP_USER_AGENT) }
        YY_BREAK
 case 167:
 YY_RULE_SETUP
 #line 381 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_MODULE_CONF) }
        YY_BREAK
 case 168:
 YY_RULE_SETUP
 #line 382 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
        YY_BREAK
 case 169:
 YY_RULE_SETUP
 #line 383 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
        YY_BREAK
 case 170:
 YY_RULE_SETUP
 #line 384 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
        YY_BREAK
 case 171:
 YY_RULE_SETUP
 #line 385 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
        YY_BREAK
 case 172:
 YY_RULE_SETUP
 #line 386 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
        YY_BREAK
 case 173:
 YY_RULE_SETUP
 #line 387 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
        YY_BREAK
 case 174:
 YY_RULE_SETUP
 #line 388 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
        YY_BREAK
 case 175:
 YY_RULE_SETUP
 #line 389 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
        YY_BREAK
 case 176:
 YY_RULE_SETUP
 #line 390 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_MAX_RESTART) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
        YY_BREAK
 case 177:
 YY_RULE_SETUP
 #line 391 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
        YY_BREAK
 case 178:
 YY_RULE_SETUP
 #line 392 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
        YY_BREAK
 case 179:
 YY_RULE_SETUP
 #line 393 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_VAL_MAX_RESTART) }
        YY_BREAK
 case 180:
 YY_RULE_SETUP
 #line 394 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
        YY_BREAK
 case 181:
 YY_RULE_SETUP
 #line 395 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
        YY_BREAK
 case 182:
 YY_RULE_SETUP
 #line 396 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
        YY_BREAK
 case 183:
 YY_RULE_SETUP
 #line 397 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
+{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
        YY_BREAK
 case 184:
 YY_RULE_SETUP
 #line 398 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
        YY_BREAK
 case 185:
 YY_RULE_SETUP
 #line 399 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
+{ YDVAR(1, VAR_SERVE_EXPIRED) }
        YY_BREAK
 case 186:
 YY_RULE_SETUP
 #line 400 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
        YY_BREAK
 case 187:
 YY_RULE_SETUP
 #line 401 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
        YY_BREAK
 case 188:
 YY_RULE_SETUP
 #line 402 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_DSA) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
        YY_BREAK
 case 189:
 YY_RULE_SETUP
 #line 403 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_SHA1) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
        YY_BREAK
 case 190:
 YY_RULE_SETUP
 #line 404 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) }
        YY_BREAK
 case 191:
 YY_RULE_SETUP
 #line 405 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_FAKE_DSA) }
        YY_BREAK
 case 192:
 YY_RULE_SETUP
 #line 406 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_FAKE_SHA1) }
        YY_BREAK
 case 193:
 YY_RULE_SETUP
 #line 407 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
        YY_BREAK
 case 194:
 YY_RULE_SETUP
 #line 408 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ 
-                                 YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
        YY_BREAK
 case 195:
 YY_RULE_SETUP
-#line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
+#line 409 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
        YY_BREAK
 case 196:
 YY_RULE_SETUP
-#line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_CHECK) }
+#line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
        YY_BREAK
 case 197:
 YY_RULE_SETUP
-#line 412 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) }
+#line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ 
+                                 YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
        YY_BREAK
 case 198:
 YY_RULE_SETUP
 #line 413 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
        YY_BREAK
 case 199:
 YY_RULE_SETUP
 #line 414 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+{ YDVAR(1, VAR_ZONEMD_CHECK) }
        YY_BREAK
 case 200:
 YY_RULE_SETUP
 #line 415 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) }
        YY_BREAK
 case 201:
 YY_RULE_SETUP
 #line 416 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
        YY_BREAK
 case 202:
 YY_RULE_SETUP
 #line 417 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
        YY_BREAK
 case 203:
 YY_RULE_SETUP
 #line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_IDENTITY) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
        YY_BREAK
 case 204:
 YY_RULE_SETUP
 #line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
        YY_BREAK
 case 205:
 YY_RULE_SETUP
 #line 420 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
        YY_BREAK
 case 206:
 YY_RULE_SETUP
 #line 421 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_REPLIES) }
+{ YDVAR(1, VAR_LOG_IDENTITY) }
        YY_BREAK
 case 207:
 YY_RULE_SETUP
 #line 422 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
        YY_BREAK
 case 208:
 YY_RULE_SETUP
 #line 423 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
        YY_BREAK
 case 209:
 YY_RULE_SETUP
 #line 424 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_SERVFAIL) }
+{ YDVAR(1, VAR_LOG_REPLIES) }
        YY_BREAK
 case 210:
 YY_RULE_SETUP
 #line 425 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
        YY_BREAK
 case 211:
 YY_RULE_SETUP
 #line 426 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
        YY_BREAK
 case 212:
 YY_RULE_SETUP
 #line 427 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOG_SERVFAIL) }
        YY_BREAK
 case 213:
 YY_RULE_SETUP
 #line 428 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
        YY_BREAK
 case 214:
 YY_RULE_SETUP
 #line 429 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
        YY_BREAK
 case 215:
 YY_RULE_SETUP
 #line 430 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
        YY_BREAK
 case 216:
 YY_RULE_SETUP
 #line 431 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
        YY_BREAK
 case 217:
 YY_RULE_SETUP
 #line 432 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
        YY_BREAK
 case 218:
 YY_RULE_SETUP
 #line 433 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_ENABLE) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
        YY_BREAK
 case 219:
 YY_RULE_SETUP
 #line 434 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_KEY) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
        YY_BREAK
 case 220:
 YY_RULE_SETUP
 #line 435 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
        YY_BREAK
 case 221:
 YY_RULE_SETUP
 #line 436 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(1, VAR_SHM_ENABLE) }
        YY_BREAK
 case 222:
 YY_RULE_SETUP
 #line 437 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_SHM_KEY) }
        YY_BREAK
 case 223:
 YY_RULE_SETUP
 #line 438 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
        YY_BREAK
 case 224:
 YY_RULE_SETUP
 #line 439 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_USE_CERT) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
        YY_BREAK
 case 225:
 YY_RULE_SETUP
 #line 440 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
        YY_BREAK
 case 226:
 YY_RULE_SETUP
 #line 441 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
        YY_BREAK
 case 227:
 YY_RULE_SETUP
 #line 442 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
        YY_BREAK
 case 228:
 YY_RULE_SETUP
 #line 443 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
        YY_BREAK
 case 229:
 YY_RULE_SETUP
 #line 444 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
        YY_BREAK
 case 230:
 YY_RULE_SETUP
 #line 445 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
        YY_BREAK
 case 231:
 YY_RULE_SETUP
 #line 446 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DYNLIB_FILE) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
        YY_BREAK
 case 232:
 YY_RULE_SETUP
 #line 447 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DYNLIB) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
        YY_BREAK
 case 233:
 YY_RULE_SETUP
 #line 448 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(0, VAR_PYTHON) }
        YY_BREAK
 case 234:
 YY_RULE_SETUP
 #line 449 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(1, VAR_DYNLIB_FILE) }
        YY_BREAK
 case 235:
 YY_RULE_SETUP
 #line 450 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(0, VAR_DYNLIB) }
        YY_BREAK
 case 236:
 YY_RULE_SETUP
 #line 451 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
        YY_BREAK
 case 237:
 YY_RULE_SETUP
 #line 452 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
        YY_BREAK
 case 238:
 YY_RULE_SETUP
 #line 453 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
        YY_BREAK
 case 239:
 YY_RULE_SETUP
 #line 454 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
        YY_BREAK
 case 240:
 YY_RULE_SETUP
 #line 455 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
        YY_BREAK
 case 241:
 YY_RULE_SETUP
 #line 456 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DEFINE_TAG) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
        YY_BREAK
 case 242:
 YY_RULE_SETUP
 #line 457 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
        YY_BREAK
 case 243:
 YY_RULE_SETUP
 #line 458 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
+{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
        YY_BREAK
 case 244:
 YY_RULE_SETUP
 #line 459 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
+{ YDVAR(1, VAR_DEFINE_TAG) }
        YY_BREAK
 case 245:
 YY_RULE_SETUP
 #line 460 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
+{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
        YY_BREAK
 case 246:
 YY_RULE_SETUP
 #line 461 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
        YY_BREAK
 case 247:
 YY_RULE_SETUP
 #line 462 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
        YY_BREAK
 case 248:
 YY_RULE_SETUP
 #line 463 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
        YY_BREAK
 case 249:
 YY_RULE_SETUP
 #line 464 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
        YY_BREAK
 case 250:
 YY_RULE_SETUP
 #line 465 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
+{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
        YY_BREAK
 case 251:
 YY_RULE_SETUP
 #line 466 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(0, VAR_DNSTAP) }
        YY_BREAK
 case 252:
 YY_RULE_SETUP
 #line 467 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IP) }
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
        YY_BREAK
 case 253:
 YY_RULE_SETUP
 #line 468 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS) }
+{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
        YY_BREAK
 case 254:
 YY_RULE_SETUP
 #line 469 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
        YY_BREAK
 case 255:
 YY_RULE_SETUP
 #line 470 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
+{ YDVAR(1, VAR_DNSTAP_IP) }
        YY_BREAK
 case 256:
 YY_RULE_SETUP
 #line 471 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
+{ YDVAR(1, VAR_DNSTAP_TLS) }
        YY_BREAK
 case 257:
 YY_RULE_SETUP
-#line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
+#line 472 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
        YY_BREAK
 case 258:
 YY_RULE_SETUP
-#line 475 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+#line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
        YY_BREAK
 case 259:
 YY_RULE_SETUP
-#line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+#line 474 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
        YY_BREAK
 case 260:
 YY_RULE_SETUP
-#line 477 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+#line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
        YY_BREAK
 case 261:
 YY_RULE_SETUP
 #line 478 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
        YY_BREAK
 case 262:
 YY_RULE_SETUP
 #line 479 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
        YY_BREAK
 case 263:
 YY_RULE_SETUP
-#line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 480 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
        YY_BREAK
 case 264:
 YY_RULE_SETUP
-#line 483 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+#line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
        YY_BREAK
 case 265:
 YY_RULE_SETUP
-#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 482 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
-               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
        YY_BREAK
 case 266:
 YY_RULE_SETUP
-#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 484 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
-               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
        YY_BREAK
 case 267:
 YY_RULE_SETUP
-#line 489 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 486 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
-               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
        YY_BREAK
 case 268:
 YY_RULE_SETUP
-#line 491 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
+#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
        YY_BREAK
 case 269:
 YY_RULE_SETUP
-#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT) }
+#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
        YY_BREAK
 case 270:
 YY_RULE_SETUP
-#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT) }
+#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
        YY_BREAK
 case 271:
 YY_RULE_SETUP
 #line 494 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
+{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
        YY_BREAK
 case 272:
 YY_RULE_SETUP
 #line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+{ YDVAR(1, VAR_IP_RATELIMIT) }
        YY_BREAK
 case 273:
 YY_RULE_SETUP
 #line 496 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
+{ YDVAR(1, VAR_RATELIMIT) }
        YY_BREAK
 case 274:
 YY_RULE_SETUP
 #line 497 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
        YY_BREAK
 case 275:
 YY_RULE_SETUP
 #line 498 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+{ YDVAR(1, VAR_RATELIMIT_SLABS) }
        YY_BREAK
 case 276:
 YY_RULE_SETUP
 #line 499 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
        YY_BREAK
 case 277:
 YY_RULE_SETUP
 #line 500 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
+{ YDVAR(1, VAR_RATELIMIT_SIZE) }
        YY_BREAK
 case 278:
 YY_RULE_SETUP
 #line 501 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
+{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
        YY_BREAK
 case 279:
 YY_RULE_SETUP
 #line 502 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOW_RTT) }
+{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
        YY_BREAK
 case 280:
 YY_RULE_SETUP
 #line 503 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_NUM) }
+{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
        YY_BREAK
 case 281:
 YY_RULE_SETUP
 #line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
        YY_BREAK
 case 282:
 YY_RULE_SETUP
 #line 505 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) }
        YY_BREAK
 case 283:
 YY_RULE_SETUP
 #line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_RATELIMIT_BACKOFF) }
        YY_BREAK
 case 284:
 YY_RULE_SETUP
 #line 507 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
+{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) }
        YY_BREAK
 case 285:
 YY_RULE_SETUP
 #line 508 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP) }
+{ YDVAR(1, VAR_LOW_RTT) }
        YY_BREAK
 case 286:
 YY_RULE_SETUP
 #line 509 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
+{ YDVAR(1, VAR_FAST_SERVER_NUM) }
        YY_BREAK
 case 287:
 YY_RULE_SETUP
 #line 510 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DNSCRYPT) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 288:
 YY_RULE_SETUP
 #line 511 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 289:
 YY_RULE_SETUP
 #line 512 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PORT) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 290:
 YY_RULE_SETUP
 #line 513 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
+{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
        YY_BREAK
 case 291:
 YY_RULE_SETUP
 #line 514 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
+{ YDVAR(2, VAR_RESPONSE_IP) }
        YY_BREAK
 case 292:
 YY_RULE_SETUP
 #line 515 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
+{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
        YY_BREAK
 case 293:
 YY_RULE_SETUP
 #line 516 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
+{ YDVAR(0, VAR_DNSCRYPT) }
        YY_BREAK
 case 294:
 YY_RULE_SETUP
 #line 517 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
+{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
        YY_BREAK
 case 295:
 YY_RULE_SETUP
-#line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
+#line 518 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PORT) }
        YY_BREAK
 case 296:
 YY_RULE_SETUP
-#line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
+#line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
        YY_BREAK
 case 297:
 YY_RULE_SETUP
-#line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
+#line 520 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
        YY_BREAK
 case 298:
 YY_RULE_SETUP
-#line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_RESPONSES) }
+#line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
        YY_BREAK
 case 299:
 YY_RULE_SETUP
-#line 524 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) }
+#line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
        YY_BREAK
 case 300:
 YY_RULE_SETUP
-#line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_QUERIES) }
+#line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
        YY_BREAK
 case 301:
 YY_RULE_SETUP
-#line 526 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) }
+#line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
        YY_BREAK
 case 302:
 YY_RULE_SETUP
 #line 527 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
        YY_BREAK
 case 303:
 YY_RULE_SETUP
 #line 528 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
        YY_BREAK
 case 304:
 YY_RULE_SETUP
 #line 529 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_HOOK) }
+{ YDVAR(1, VAR_PAD_RESPONSES) }
        YY_BREAK
 case 305:
 YY_RULE_SETUP
 #line 530 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
+{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) }
        YY_BREAK
 case 306:
 YY_RULE_SETUP
 #line 531 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+{ YDVAR(1, VAR_PAD_QUERIES) }
        YY_BREAK
 case 307:
 YY_RULE_SETUP
 #line 532 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) }
        YY_BREAK
 case 308:
 YY_RULE_SETUP
 #line 533 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
        YY_BREAK
 case 309:
 YY_RULE_SETUP
 #line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_CACHEDB) }
+{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
        YY_BREAK
 case 310:
 YY_RULE_SETUP
 #line 535 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+{ YDVAR(1, VAR_IPSECMOD_HOOK) }
        YY_BREAK
 case 311:
 YY_RULE_SETUP
 #line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
+{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
        YY_BREAK
 case 312:
 YY_RULE_SETUP
 #line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
        YY_BREAK
 case 313:
 YY_RULE_SETUP
 #line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
        YY_BREAK
 case 314:
 YY_RULE_SETUP
 #line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
+{ YDVAR(1, VAR_IPSECMOD_STRICT) }
        YY_BREAK
 case 315:
 YY_RULE_SETUP
 #line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
+{ YDVAR(0, VAR_CACHEDB) }
        YY_BREAK
 case 316:
 YY_RULE_SETUP
 #line 541 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_IPSET) }
+{ YDVAR(1, VAR_CACHEDB_BACKEND) }
        YY_BREAK
 case 317:
 YY_RULE_SETUP
 #line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V4) }
+{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
        YY_BREAK
 case 318:
 YY_RULE_SETUP
 #line 543 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V6) }
+{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
        YY_BREAK
 case 319:
 YY_RULE_SETUP
 #line 544 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
        YY_BREAK
 case 320:
 YY_RULE_SETUP
 #line 545 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
        YY_BREAK
 case 321:
 YY_RULE_SETUP
 #line 546 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
+{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
        YY_BREAK
 case 322:
 YY_RULE_SETUP
 #line 547 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
+{ YDVAR(0, VAR_IPSET) }
        YY_BREAK
 case 323:
 YY_RULE_SETUP
 #line 548 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NSID ) }
+{ YDVAR(1, VAR_IPSET_NAME_V4) }
        YY_BREAK
 case 324:
-/* rule 324 can match eol */
 YY_RULE_SETUP
 #line 549 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++; }
+{ YDVAR(1, VAR_IPSET_NAME_V6) }
        YY_BREAK
-/* Quoted strings. Strip leading and ending quotes */
 case 325:
 YY_RULE_SETUP
+#line 550 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+       YY_BREAK
+case 326:
+YY_RULE_SETUP
+#line 551 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+       YY_BREAK
+case 327:
+YY_RULE_SETUP
 #line 552 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
+       YY_BREAK
+case 328:
+YY_RULE_SETUP
+#line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
+       YY_BREAK
+case 329:
+YY_RULE_SETUP
+#line 554 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_NSID ) }
+       YY_BREAK
+case 330:
+/* rule 330 can match eol */
+YY_RULE_SETUP
+#line 555 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++; }
+       YY_BREAK
+/* Quoted strings. Strip leading and ending quotes */
+case 331:
+YY_RULE_SETUP
+#line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
        YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
        if(--num_args == 0) { BEGIN(INITIAL); }
        else                { BEGIN(val); }
 }
        YY_BREAK
-case 326:
+case 332:
 YY_RULE_SETUP
-#line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 564 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 327:
-/* rule 327 can match eol */
+case 333:
+/* rule 333 can match eol */
 YY_RULE_SETUP
-#line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 565 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
                          cfg_parser->line++; BEGIN(INITIAL); }
        YY_BREAK
-case 328:
+case 334:
 YY_RULE_SETUP
-#line 561 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 567 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         LEXOUT(("QE "));
        if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5265,34 +5349,34 @@ YY_RULE_SETUP
 }
        YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 329:
+case 335:
 YY_RULE_SETUP
-#line 573 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 579 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
        YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 574 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 580 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
        if(--num_args == 0) { BEGIN(INITIAL); }
        else                { BEGIN(val); }
 }
        YY_BREAK
-case 330:
+case 336:
 YY_RULE_SETUP
-#line 579 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 585 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 331:
-/* rule 331 can match eol */
+case 337:
+/* rule 337 can match eol */
 YY_RULE_SETUP
-#line 580 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 586 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
                             cfg_parser->line++; BEGIN(INITIAL); }
        YY_BREAK
-case 332:
+case 338:
 YY_RULE_SETUP
-#line 582 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 588 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         LEXOUT(("SQE "));
        if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5305,38 +5389,38 @@ YY_RULE_SETUP
 }
        YY_BREAK
 /* include: directive */
-case 333:
+case 339:
 YY_RULE_SETUP
-#line 594 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 600 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { 
        LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
        YY_BREAK
 case YY_STATE_EOF(include):
-#line 596 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
        YY_BREAK
-case 334:
+case 340:
 YY_RULE_SETUP
-#line 600 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 606 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
        YY_BREAK
-case 335:
-/* rule 335 can match eol */
+case 341:
+/* rule 341 can match eol */
 YY_RULE_SETUP
-#line 601 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 607 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
        YY_BREAK
-case 336:
+case 342:
 YY_RULE_SETUP
-#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
        YY_BREAK
-case 337:
+case 343:
 YY_RULE_SETUP
-#line 603 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 609 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("Iunquotedstr(%s) ", yytext));
        config_start_include_glob(yytext, 0);
@@ -5344,27 +5428,27 @@ YY_RULE_SETUP
 }
        YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 614 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
        YY_BREAK
-case 338:
+case 344:
 YY_RULE_SETUP
-#line 612 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 618 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 339:
-/* rule 339 can match eol */
+case 345:
+/* rule 345 can match eol */
 YY_RULE_SETUP
-#line 613 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 619 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
                                  cfg_parser->line++; BEGIN(inc_prev); }
        YY_BREAK
-case 340:
+case 346:
 YY_RULE_SETUP
-#line 615 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 621 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("IQE "));
        yytext[yyleng - 1] = '\0';
@@ -5374,7 +5458,7 @@ YY_RULE_SETUP
        YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 621 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 627 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("LEXEOF "));
        yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -5389,39 +5473,39 @@ case YY_STATE_EOF(val):
 }
        YY_BREAK
 /* include-toplevel: directive */
-case 341:
+case 347:
 YY_RULE_SETUP
-#line 635 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 641 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel);
 }
        YY_BREAK
 case YY_STATE_EOF(include_toplevel):
-#line 638 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("EOF inside include_toplevel directive");
        BEGIN(inc_prev);
 }
        YY_BREAK
-case 342:
+case 348:
 YY_RULE_SETUP
-#line 642 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 648 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITSP ")); /* ignore */ }
        YY_BREAK
-case 343:
-/* rule 343 can match eol */
+case 349:
+/* rule 349 can match eol */
 YY_RULE_SETUP
-#line 643 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 649 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
        YY_BREAK
-case 344:
+case 350:
 YY_RULE_SETUP
-#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 650 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); }
        YY_BREAK
-case 345:
+case 351:
 YY_RULE_SETUP
-#line 645 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 651 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("ITunquotedstr(%s) ", yytext));
        config_start_include_glob(yytext, 1);
@@ -5430,29 +5514,29 @@ YY_RULE_SETUP
 }
        YY_BREAK
 case YY_STATE_EOF(include_toplevel_quoted):
-#line 651 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 657 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("EOF inside quoted string");
        BEGIN(inc_prev);
 }
        YY_BREAK
-case 346:
+case 352:
 YY_RULE_SETUP
-#line 655 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 661 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITSTR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 347:
-/* rule 347 can match eol */
+case 353:
+/* rule 353 can match eol */
 YY_RULE_SETUP
-#line 656 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 662 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("newline before \" in include name");
        cfg_parser->line++; BEGIN(inc_prev);
 }
        YY_BREAK
-case 348:
+case 354:
 YY_RULE_SETUP
-#line 660 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 666 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("ITQE "));
        yytext[yyleng - 1] = '\0';
@@ -5461,33 +5545,33 @@ YY_RULE_SETUP
        return (VAR_FORCE_TOPLEVEL);
 }
        YY_BREAK
-case 349:
+case 355:
 YY_RULE_SETUP
-#line 668 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 674 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
                        if(--num_args == 0) { BEGIN(INITIAL); }
                        yylval.str = strdup(yytext); return STRING_ARG; }
        YY_BREAK
-case 350:
+case 356:
 YY_RULE_SETUP
-#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 678 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        ub_c_error_msg("unknown keyword '%s'", yytext);
        }
        YY_BREAK
-case 351:
+case 357:
 YY_RULE_SETUP
-#line 676 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 682 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        ub_c_error_msg("stray '%s'", yytext);
        }
        YY_BREAK
-case 352:
+case 358:
 YY_RULE_SETUP
-#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 686 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 ECHO;
        YY_BREAK
-#line 5489 "<stdout>"
+#line 5573 "<stdout>"
 
        case YY_END_OF_BUFFER:
                {
@@ -5780,7 +5864,7 @@ static int yy_get_next_buffer (void)
                while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                        {
                        yy_current_state = (int) yy_def[yy_current_state];
-                       if ( yy_current_state >= 3484 )
+                       if ( yy_current_state >= 3558 )
                                yy_c = yy_meta[(unsigned int) yy_c];
                        }
                yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -5808,13 +5892,13 @@ static int yy_get_next_buffer (void)
        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                {
                yy_current_state = (int) yy_def[yy_current_state];
-               if ( yy_current_state >= 3484 )
+               if ( yy_current_state >= 3558 )
                        yy_c = yy_meta[(unsigned int) yy_c];
                }
        yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-       yy_is_jam = (yy_current_state == 3483);
+       yy_is_jam = (yy_current_state == 3557);
 
-               return yy_is_jam ? 0 : yy_current_state;
+       return yy_is_jam ? 0 : yy_current_state;
 }
 
 #ifndef YY_NO_INPUT
@@ -6445,7 +6529,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 686 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 
 
 

diff --git a/sbin/unwind/libunbound/util/configlexer.lex b/sbin/unwind/libunbound/util/configlexer.lex
index dbfc17d..34a0e5d 100644 (file)
--- a/sbin/unwind/libunbound/util/configlexer.lex
+++ b/sbin/unwind/libunbound/util/configlexer.lex
@@ -331,6 +331,7 @@ stub-first{COLON}           { YDVAR(1, VAR_STUB_FIRST) }
 stub-no-cache{COLON}           { YDVAR(1, VAR_STUB_NO_CACHE) }
 stub-ssl-upstream{COLON}       { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
 stub-tls-upstream{COLON}       { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
+stub-tcp-upstream{COLON}       { YDVAR(1, VAR_STUB_TCP_UPSTREAM) }
 forward-zone{COLON}            { YDVAR(0, VAR_FORWARD_ZONE) }
 forward-addr{COLON}            { YDVAR(1, VAR_FORWARD_ADDR) }
 forward-host{COLON}            { YDVAR(1, VAR_FORWARD_HOST) }
@@ -338,6 +339,7 @@ forward-first{COLON}                { YDVAR(1, VAR_FORWARD_FIRST) }
 forward-no-cache{COLON}                { YDVAR(1, VAR_FORWARD_NO_CACHE) }
 forward-ssl-upstream{COLON}    { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
 forward-tls-upstream{COLON}    { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
+forward-tcp-upstream{COLON}    { YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) }
 auth-zone{COLON}               { YDVAR(0, VAR_AUTH_ZONE) }
 rpz{COLON}                     { YDVAR(0, VAR_RPZ) }
 tags{COLON}                    { YDVAR(1, VAR_TAGS) }
@@ -345,6 +347,7 @@ rpz-action-override{COLON}  { YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
 rpz-cname-override{COLON}      { YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
 rpz-log{COLON}                 { YDVAR(1, VAR_RPZ_LOG) }
 rpz-log-name{COLON}            { YDVAR(1, VAR_RPZ_LOG_NAME) }
+rpz-signal-nxdomain-ra{COLON}  { YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) }
 zonefile{COLON}                        { YDVAR(1, VAR_ZONEFILE) }
 master{COLON}                  { YDVAR(1, VAR_MASTER) }
 primary{COLON}                 { YDVAR(1, VAR_MASTER) }
@@ -499,6 +502,9 @@ ratelimit-for-domain{COLON} { YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
 ratelimit-below-domain{COLON}  { YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 ip-ratelimit-factor{COLON}             { YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
 ratelimit-factor{COLON}                { YDVAR(1, VAR_RATELIMIT_FACTOR) }
+ip-ratelimit-backoff{COLON}            { YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) }
+ratelimit-backoff{COLON}               { YDVAR(1, VAR_RATELIMIT_BACKOFF) }
+outbound-msg-retry{COLON}              { YDVAR(1, VAR_OUTBOUND_MSG_RETRY) }
 low-rtt{COLON}                 { YDVAR(1, VAR_LOW_RTT) }
 fast-server-num{COLON}         { YDVAR(1, VAR_FAST_SERVER_NUM) }
 low-rtt-pct{COLON}             { YDVAR(1, VAR_FAST_SERVER_PERMIL) }

diff --git a/sbin/unwind/libunbound/util/configparser.h b/sbin/unwind/libunbound/util/configparser.h
index 5760334..ec40866 100644 (file)
--- a/sbin/unwind/libunbound/util/configparser.h
+++ b/sbin/unwind/libunbound/util/configparser.h
@@ -141,178 +141,184 @@
 #define VAR_STUB_SSL_UPSTREAM 397
 #define VAR_FORWARD_SSL_UPSTREAM 398
 #define VAR_TLS_CERT_BUNDLE 399
-#define VAR_HTTPS_PORT 400
-#define VAR_HTTP_ENDPOINT 401
-#define VAR_HTTP_MAX_STREAMS 402
-#define VAR_HTTP_QUERY_BUFFER_SIZE 403
-#define VAR_HTTP_RESPONSE_BUFFER_SIZE 404
-#define VAR_HTTP_NODELAY 405
-#define VAR_HTTP_NOTLS_DOWNSTREAM 406
-#define VAR_STUB_FIRST 407
-#define VAR_MINIMAL_RESPONSES 408
-#define VAR_RRSET_ROUNDROBIN 409
-#define VAR_MAX_UDP_SIZE 410
-#define VAR_DELAY_CLOSE 411
-#define VAR_UDP_CONNECT 412
-#define VAR_UNBLOCK_LAN_ZONES 413
-#define VAR_INSECURE_LAN_ZONES 414
-#define VAR_INFRA_CACHE_MIN_RTT 415
-#define VAR_INFRA_KEEP_PROBING 416
-#define VAR_DNS64_PREFIX 417
-#define VAR_DNS64_SYNTHALL 418
-#define VAR_DNS64_IGNORE_AAAA 419
-#define VAR_DNSTAP 420
-#define VAR_DNSTAP_ENABLE 421
-#define VAR_DNSTAP_SOCKET_PATH 422
-#define VAR_DNSTAP_IP 423
-#define VAR_DNSTAP_TLS 424
-#define VAR_DNSTAP_TLS_SERVER_NAME 425
-#define VAR_DNSTAP_TLS_CERT_BUNDLE 426
-#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 427
-#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 428
-#define VAR_DNSTAP_SEND_IDENTITY 429
-#define VAR_DNSTAP_SEND_VERSION 430
-#define VAR_DNSTAP_BIDIRECTIONAL 431
-#define VAR_DNSTAP_IDENTITY 432
-#define VAR_DNSTAP_VERSION 433
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 434
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 435
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 436
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 437
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 438
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 439
-#define VAR_RESPONSE_IP_TAG 440
-#define VAR_RESPONSE_IP 441
-#define VAR_RESPONSE_IP_DATA 442
-#define VAR_HARDEN_ALGO_DOWNGRADE 443
-#define VAR_IP_TRANSPARENT 444
-#define VAR_IP_DSCP 445
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 446
-#define VAR_IP_RATELIMIT 447
-#define VAR_IP_RATELIMIT_SLABS 448
-#define VAR_IP_RATELIMIT_SIZE 449
-#define VAR_RATELIMIT 450
-#define VAR_RATELIMIT_SLABS 451
-#define VAR_RATELIMIT_SIZE 452
-#define VAR_RATELIMIT_FOR_DOMAIN 453
-#define VAR_RATELIMIT_BELOW_DOMAIN 454
-#define VAR_IP_RATELIMIT_FACTOR 455
-#define VAR_RATELIMIT_FACTOR 456
-#define VAR_SEND_CLIENT_SUBNET 457
-#define VAR_CLIENT_SUBNET_ZONE 458
-#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 459
-#define VAR_CLIENT_SUBNET_OPCODE 460
-#define VAR_MAX_CLIENT_SUBNET_IPV4 461
-#define VAR_MAX_CLIENT_SUBNET_IPV6 462
-#define VAR_MIN_CLIENT_SUBNET_IPV4 463
-#define VAR_MIN_CLIENT_SUBNET_IPV6 464
-#define VAR_MAX_ECS_TREE_SIZE_IPV4 465
-#define VAR_MAX_ECS_TREE_SIZE_IPV6 466
-#define VAR_CAPS_WHITELIST 467
-#define VAR_CACHE_MAX_NEGATIVE_TTL 468
-#define VAR_PERMIT_SMALL_HOLDDOWN 469
-#define VAR_QNAME_MINIMISATION 470
-#define VAR_QNAME_MINIMISATION_STRICT 471
-#define VAR_IP_FREEBIND 472
-#define VAR_DEFINE_TAG 473
-#define VAR_LOCAL_ZONE_TAG 474
-#define VAR_ACCESS_CONTROL_TAG 475
-#define VAR_LOCAL_ZONE_OVERRIDE 476
-#define VAR_ACCESS_CONTROL_TAG_ACTION 477
-#define VAR_ACCESS_CONTROL_TAG_DATA 478
-#define VAR_VIEW 479
-#define VAR_ACCESS_CONTROL_VIEW 480
-#define VAR_VIEW_FIRST 481
-#define VAR_SERVE_EXPIRED 482
-#define VAR_SERVE_EXPIRED_TTL 483
-#define VAR_SERVE_EXPIRED_TTL_RESET 484
-#define VAR_SERVE_EXPIRED_REPLY_TTL 485
-#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 486
-#define VAR_SERVE_ORIGINAL_TTL 487
-#define VAR_FAKE_DSA 488
-#define VAR_FAKE_SHA1 489
-#define VAR_LOG_IDENTITY 490
-#define VAR_HIDE_TRUSTANCHOR 491
-#define VAR_HIDE_HTTP_USER_AGENT 492
-#define VAR_HTTP_USER_AGENT 493
-#define VAR_TRUST_ANCHOR_SIGNALING 494
-#define VAR_AGGRESSIVE_NSEC 495
-#define VAR_USE_SYSTEMD 496
-#define VAR_SHM_ENABLE 497
-#define VAR_SHM_KEY 498
-#define VAR_ROOT_KEY_SENTINEL 499
-#define VAR_DNSCRYPT 500
-#define VAR_DNSCRYPT_ENABLE 501
-#define VAR_DNSCRYPT_PORT 502
-#define VAR_DNSCRYPT_PROVIDER 503
-#define VAR_DNSCRYPT_SECRET_KEY 504
-#define VAR_DNSCRYPT_PROVIDER_CERT 505
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 506
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 507
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 508
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 509
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 510
-#define VAR_PAD_RESPONSES 511
-#define VAR_PAD_RESPONSES_BLOCK_SIZE 512
-#define VAR_PAD_QUERIES 513
-#define VAR_PAD_QUERIES_BLOCK_SIZE 514
-#define VAR_IPSECMOD_ENABLED 515
-#define VAR_IPSECMOD_HOOK 516
-#define VAR_IPSECMOD_IGNORE_BOGUS 517
-#define VAR_IPSECMOD_MAX_TTL 518
-#define VAR_IPSECMOD_WHITELIST 519
-#define VAR_IPSECMOD_STRICT 520
-#define VAR_CACHEDB 521
-#define VAR_CACHEDB_BACKEND 522
-#define VAR_CACHEDB_SECRETSEED 523
-#define VAR_CACHEDB_REDISHOST 524
-#define VAR_CACHEDB_REDISPORT 525
-#define VAR_CACHEDB_REDISTIMEOUT 526
-#define VAR_CACHEDB_REDISEXPIRERECORDS 527
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 528
-#define VAR_FOR_UPSTREAM 529
-#define VAR_AUTH_ZONE 530
-#define VAR_ZONEFILE 531
-#define VAR_MASTER 532
-#define VAR_URL 533
-#define VAR_FOR_DOWNSTREAM 534
-#define VAR_FALLBACK_ENABLED 535
-#define VAR_TLS_ADDITIONAL_PORT 536
-#define VAR_LOW_RTT 537
-#define VAR_LOW_RTT_PERMIL 538
-#define VAR_FAST_SERVER_PERMIL 539
-#define VAR_FAST_SERVER_NUM 540
-#define VAR_ALLOW_NOTIFY 541
-#define VAR_TLS_WIN_CERT 542
-#define VAR_TCP_CONNECTION_LIMIT 543
-#define VAR_FORWARD_NO_CACHE 544
-#define VAR_STUB_NO_CACHE 545
-#define VAR_LOG_SERVFAIL 546
-#define VAR_DENY_ANY 547
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 548
-#define VAR_LOG_TAG_QUERYREPLY 549
-#define VAR_STREAM_WAIT_SIZE 550
-#define VAR_TLS_CIPHERS 551
-#define VAR_TLS_CIPHERSUITES 552
-#define VAR_TLS_USE_SNI 553
-#define VAR_IPSET 554
-#define VAR_IPSET_NAME_V4 555
-#define VAR_IPSET_NAME_V6 556
-#define VAR_TLS_SESSION_TICKET_KEYS 557
-#define VAR_RPZ 558
-#define VAR_TAGS 559
-#define VAR_RPZ_ACTION_OVERRIDE 560
-#define VAR_RPZ_CNAME_OVERRIDE 561
-#define VAR_RPZ_LOG 562
-#define VAR_RPZ_LOG_NAME 563
-#define VAR_DYNLIB 564
-#define VAR_DYNLIB_FILE 565
-#define VAR_EDNS_CLIENT_STRING 566
-#define VAR_EDNS_CLIENT_STRING_OPCODE 567
-#define VAR_NSID 568
-#define VAR_ZONEMD_PERMISSIVE_MODE 569
-#define VAR_ZONEMD_CHECK 570
-#define VAR_ZONEMD_REJECT_ABSENCE 571
+#define VAR_STUB_TCP_UPSTREAM 400
+#define VAR_FORWARD_TCP_UPSTREAM 401
+#define VAR_HTTPS_PORT 402
+#define VAR_HTTP_ENDPOINT 403
+#define VAR_HTTP_MAX_STREAMS 404
+#define VAR_HTTP_QUERY_BUFFER_SIZE 405
+#define VAR_HTTP_RESPONSE_BUFFER_SIZE 406
+#define VAR_HTTP_NODELAY 407
+#define VAR_HTTP_NOTLS_DOWNSTREAM 408
+#define VAR_STUB_FIRST 409
+#define VAR_MINIMAL_RESPONSES 410
+#define VAR_RRSET_ROUNDROBIN 411
+#define VAR_MAX_UDP_SIZE 412
+#define VAR_DELAY_CLOSE 413
+#define VAR_UDP_CONNECT 414
+#define VAR_UNBLOCK_LAN_ZONES 415
+#define VAR_INSECURE_LAN_ZONES 416
+#define VAR_INFRA_CACHE_MIN_RTT 417
+#define VAR_INFRA_KEEP_PROBING 418
+#define VAR_DNS64_PREFIX 419
+#define VAR_DNS64_SYNTHALL 420
+#define VAR_DNS64_IGNORE_AAAA 421
+#define VAR_DNSTAP 422
+#define VAR_DNSTAP_ENABLE 423
+#define VAR_DNSTAP_SOCKET_PATH 424
+#define VAR_DNSTAP_IP 425
+#define VAR_DNSTAP_TLS 426
+#define VAR_DNSTAP_TLS_SERVER_NAME 427
+#define VAR_DNSTAP_TLS_CERT_BUNDLE 428
+#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 429
+#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 430
+#define VAR_DNSTAP_SEND_IDENTITY 431
+#define VAR_DNSTAP_SEND_VERSION 432
+#define VAR_DNSTAP_BIDIRECTIONAL 433
+#define VAR_DNSTAP_IDENTITY 434
+#define VAR_DNSTAP_VERSION 435
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 436
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 437
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 438
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 439
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 440
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 441
+#define VAR_RESPONSE_IP_TAG 442
+#define VAR_RESPONSE_IP 443
+#define VAR_RESPONSE_IP_DATA 444
+#define VAR_HARDEN_ALGO_DOWNGRADE 445
+#define VAR_IP_TRANSPARENT 446
+#define VAR_IP_DSCP 447
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 448
+#define VAR_IP_RATELIMIT 449
+#define VAR_IP_RATELIMIT_SLABS 450
+#define VAR_IP_RATELIMIT_SIZE 451
+#define VAR_RATELIMIT 452
+#define VAR_RATELIMIT_SLABS 453
+#define VAR_RATELIMIT_SIZE 454
+#define VAR_OUTBOUND_MSG_RETRY 455
+#define VAR_RATELIMIT_FOR_DOMAIN 456
+#define VAR_RATELIMIT_BELOW_DOMAIN 457
+#define VAR_IP_RATELIMIT_FACTOR 458
+#define VAR_RATELIMIT_FACTOR 459
+#define VAR_IP_RATELIMIT_BACKOFF 460
+#define VAR_RATELIMIT_BACKOFF 461
+#define VAR_SEND_CLIENT_SUBNET 462
+#define VAR_CLIENT_SUBNET_ZONE 463
+#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 464
+#define VAR_CLIENT_SUBNET_OPCODE 465
+#define VAR_MAX_CLIENT_SUBNET_IPV4 466
+#define VAR_MAX_CLIENT_SUBNET_IPV6 467
+#define VAR_MIN_CLIENT_SUBNET_IPV4 468
+#define VAR_MIN_CLIENT_SUBNET_IPV6 469
+#define VAR_MAX_ECS_TREE_SIZE_IPV4 470
+#define VAR_MAX_ECS_TREE_SIZE_IPV6 471
+#define VAR_CAPS_WHITELIST 472
+#define VAR_CACHE_MAX_NEGATIVE_TTL 473
+#define VAR_PERMIT_SMALL_HOLDDOWN 474
+#define VAR_QNAME_MINIMISATION 475
+#define VAR_QNAME_MINIMISATION_STRICT 476
+#define VAR_IP_FREEBIND 477
+#define VAR_DEFINE_TAG 478
+#define VAR_LOCAL_ZONE_TAG 479
+#define VAR_ACCESS_CONTROL_TAG 480
+#define VAR_LOCAL_ZONE_OVERRIDE 481
+#define VAR_ACCESS_CONTROL_TAG_ACTION 482
+#define VAR_ACCESS_CONTROL_TAG_DATA 483
+#define VAR_VIEW 484
+#define VAR_ACCESS_CONTROL_VIEW 485
+#define VAR_VIEW_FIRST 486
+#define VAR_SERVE_EXPIRED 487
+#define VAR_SERVE_EXPIRED_TTL 488
+#define VAR_SERVE_EXPIRED_TTL_RESET 489
+#define VAR_SERVE_EXPIRED_REPLY_TTL 490
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 491
+#define VAR_SERVE_ORIGINAL_TTL 492
+#define VAR_FAKE_DSA 493
+#define VAR_FAKE_SHA1 494
+#define VAR_LOG_IDENTITY 495
+#define VAR_HIDE_TRUSTANCHOR 496
+#define VAR_HIDE_HTTP_USER_AGENT 497
+#define VAR_HTTP_USER_AGENT 498
+#define VAR_TRUST_ANCHOR_SIGNALING 499
+#define VAR_AGGRESSIVE_NSEC 500
+#define VAR_USE_SYSTEMD 501
+#define VAR_SHM_ENABLE 502
+#define VAR_SHM_KEY 503
+#define VAR_ROOT_KEY_SENTINEL 504
+#define VAR_DNSCRYPT 505
+#define VAR_DNSCRYPT_ENABLE 506
+#define VAR_DNSCRYPT_PORT 507
+#define VAR_DNSCRYPT_PROVIDER 508
+#define VAR_DNSCRYPT_SECRET_KEY 509
+#define VAR_DNSCRYPT_PROVIDER_CERT 510
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 511
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 512
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 513
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 514
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 515
+#define VAR_PAD_RESPONSES 516
+#define VAR_PAD_RESPONSES_BLOCK_SIZE 517
+#define VAR_PAD_QUERIES 518
+#define VAR_PAD_QUERIES_BLOCK_SIZE 519
+#define VAR_IPSECMOD_ENABLED 520
+#define VAR_IPSECMOD_HOOK 521
+#define VAR_IPSECMOD_IGNORE_BOGUS 522
+#define VAR_IPSECMOD_MAX_TTL 523
+#define VAR_IPSECMOD_WHITELIST 524
+#define VAR_IPSECMOD_STRICT 525
+#define VAR_CACHEDB 526
+#define VAR_CACHEDB_BACKEND 527
+#define VAR_CACHEDB_SECRETSEED 528
+#define VAR_CACHEDB_REDISHOST 529
+#define VAR_CACHEDB_REDISPORT 530
+#define VAR_CACHEDB_REDISTIMEOUT 531
+#define VAR_CACHEDB_REDISEXPIRERECORDS 532
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 533
+#define VAR_FOR_UPSTREAM 534
+#define VAR_AUTH_ZONE 535
+#define VAR_ZONEFILE 536
+#define VAR_MASTER 537
+#define VAR_URL 538
+#define VAR_FOR_DOWNSTREAM 539
+#define VAR_FALLBACK_ENABLED 540
+#define VAR_TLS_ADDITIONAL_PORT 541
+#define VAR_LOW_RTT 542
+#define VAR_LOW_RTT_PERMIL 543
+#define VAR_FAST_SERVER_PERMIL 544
+#define VAR_FAST_SERVER_NUM 545
+#define VAR_ALLOW_NOTIFY 546
+#define VAR_TLS_WIN_CERT 547
+#define VAR_TCP_CONNECTION_LIMIT 548
+#define VAR_FORWARD_NO_CACHE 549
+#define VAR_STUB_NO_CACHE 550
+#define VAR_LOG_SERVFAIL 551
+#define VAR_DENY_ANY 552
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 553
+#define VAR_LOG_TAG_QUERYREPLY 554
+#define VAR_STREAM_WAIT_SIZE 555
+#define VAR_TLS_CIPHERS 556
+#define VAR_TLS_CIPHERSUITES 557
+#define VAR_TLS_USE_SNI 558
+#define VAR_IPSET 559
+#define VAR_IPSET_NAME_V4 560
+#define VAR_IPSET_NAME_V6 561
+#define VAR_TLS_SESSION_TICKET_KEYS 562
+#define VAR_RPZ 563
+#define VAR_TAGS 564
+#define VAR_RPZ_ACTION_OVERRIDE 565
+#define VAR_RPZ_CNAME_OVERRIDE 566
+#define VAR_RPZ_LOG 567
+#define VAR_RPZ_LOG_NAME 568
+#define VAR_DYNLIB 569
+#define VAR_DYNLIB_FILE 570
+#define VAR_EDNS_CLIENT_STRING 571
+#define VAR_EDNS_CLIENT_STRING_OPCODE 572
+#define VAR_NSID 573
+#define VAR_ZONEMD_PERMISSIVE_MODE 574
+#define VAR_ZONEMD_CHECK 575
+#define VAR_ZONEMD_REJECT_ABSENCE 576
+#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 577
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {

diff --git a/sbin/unwind/libunbound/util/configparser.y b/sbin/unwind/libunbound/util/configparser.y
index e22d48d..d4f965f 100644 (file)
--- a/sbin/unwind/libunbound/util/configparser.y
+++ b/sbin/unwind/libunbound/util/configparser.y
@@ -4,24 +4,24 @@
  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -88,13 +88,13 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_TRUST_ANCHOR_FILE VAR_TRUST_ANCHOR VAR_VAL_OVERRIDE_DATE
 %token VAR_BOGUS_TTL VAR_VAL_CLEAN_ADDITIONAL VAR_VAL_PERMISSIVE_MODE
 %token VAR_INCOMING_NUM_TCP VAR_MSG_BUFFER_SIZE VAR_KEY_CACHE_SIZE
-%token VAR_KEY_CACHE_SLABS VAR_TRUSTED_KEYS_FILE 
-%token VAR_VAL_NSEC3_KEYSIZE_ITERATIONS VAR_USE_SYSLOG 
+%token VAR_KEY_CACHE_SLABS VAR_TRUSTED_KEYS_FILE
+%token VAR_VAL_NSEC3_KEYSIZE_ITERATIONS VAR_USE_SYSLOG
 %token VAR_OUTGOING_INTERFACE VAR_ROOT_HINTS VAR_DO_NOT_QUERY_LOCALHOST
 %token VAR_CACHE_MAX_TTL VAR_HARDEN_DNSSEC_STRIPPED VAR_ACCESS_CONTROL
 %token VAR_LOCAL_ZONE VAR_LOCAL_DATA VAR_INTERFACE_AUTOMATIC
 %token VAR_STATISTICS_INTERVAL VAR_DO_DAEMONIZE VAR_USE_CAPS_FOR_ID
-%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
+%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
@@ -113,6 +113,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SSL_UPSTREAM VAR_TCP_AUTH_QUERY_TIMEOUT VAR_SSL_SERVICE_KEY
 %token VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST
 %token VAR_STUB_SSL_UPSTREAM VAR_FORWARD_SSL_UPSTREAM VAR_TLS_CERT_BUNDLE
+%token VAR_STUB_TCP_UPSTREAM VAR_FORWARD_TCP_UPSTREAM
 %token VAR_HTTPS_PORT VAR_HTTP_ENDPOINT VAR_HTTP_MAX_STREAMS
 %token VAR_HTTP_QUERY_BUFFER_SIZE VAR_HTTP_RESPONSE_BUFFER_SIZE
 %token VAR_HTTP_NODELAY VAR_HTTP_NOTLS_DOWNSTREAM
@@ -138,8 +139,10 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DISABLE_DNSSEC_LAME_CHECK
 %token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE
 %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE
+%token VAR_OUTBOUND_MSG_RETRY
 %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN
 %token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR
+%token VAR_IP_RATELIMIT_BACKOFF VAR_RATELIMIT_BACKOFF
 %token VAR_SEND_CLIENT_SUBNET VAR_CLIENT_SUBNET_ZONE
 %token VAR_CLIENT_SUBNET_ALWAYS_FORWARD VAR_CLIENT_SUBNET_OPCODE
 %token VAR_MAX_CLIENT_SUBNET_IPV4 VAR_MAX_CLIENT_SUBNET_IPV6
@@ -185,11 +188,12 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DYNLIB VAR_DYNLIB_FILE VAR_EDNS_CLIENT_STRING
 %token VAR_EDNS_CLIENT_STRING_OPCODE VAR_NSID
 %token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_CHECK VAR_ZONEMD_REJECT_ABSENCE
+%token VAR_RPZ_SIGNAL_NXDOMAIN_RA
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
 toplevelvar: serverstart contents_server | stubstart contents_stub |
-       forwardstart contents_forward | pythonstart contents_py | 
+       forwardstart contents_forward | pythonstart contents_py |
        rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
        dnscstart contents_dnsc | cachedbstart contents_cachedb |
        ipsetstart contents_ipset | authstart contents_auth |
@@ -203,7 +207,7 @@ force_toplevel: VAR_FORCE_TOPLEVEL
        ;
 /* server: declaration */
 serverstart: VAR_SERVER
-       { 
+       {
                OUTYY(("\nP(server:)\n"));
        }
        ;
@@ -215,14 +219,14 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_do_udp | server_do_tcp |
        server_tcp_mss | server_outgoing_tcp_mss | server_tcp_idle_timeout |
        server_tcp_keepalive | server_tcp_keepalive_timeout |
-       server_interface | server_chroot | server_username | 
+       server_interface | server_chroot | server_username |
        server_directory | server_logfile | server_pidfile |
        server_msg_cache_size | server_msg_cache_slabs |
-       server_num_queries_per_thread | server_rrset_cache_size | 
-       server_rrset_cache_slabs | server_outgoing_num_tcp | 
-       server_infra_host_ttl | server_infra_lame_ttl | 
+       server_num_queries_per_thread | server_rrset_cache_size |
+       server_rrset_cache_slabs | server_outgoing_num_tcp |
+       server_infra_host_ttl | server_infra_lame_ttl |
        server_infra_cache_slabs | server_infra_cache_numhosts |
-       server_infra_cache_lame_size | server_target_fetch_policy | 
+       server_infra_cache_lame_size | server_target_fetch_policy |
        server_harden_short_bufsize | server_harden_large_queries |
        server_do_not_query_address | server_hide_identity |
        server_hide_version | server_identity | server_version |
@@ -230,22 +234,22 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_harden_glue | server_module_conf | server_trust_anchor_file |
        server_trust_anchor | server_val_override_date | server_bogus_ttl |
        server_val_clean_additional | server_val_permissive_mode |
-       server_incoming_num_tcp | server_msg_buffer_size | 
-       server_key_cache_size | server_key_cache_slabs | 
+       server_incoming_num_tcp | server_msg_buffer_size |
+       server_key_cache_size | server_key_cache_slabs |
        server_trusted_keys_file | server_val_nsec3_keysize_iterations |
        server_use_syslog | server_outgoing_interface | server_root_hints |
        server_do_not_query_localhost | server_cache_max_ttl |
        server_harden_dnssec_stripped | server_access_control |
        server_local_zone | server_local_data | server_interface_automatic |
-       server_statistics_interval | server_do_daemonize | 
+       server_statistics_interval | server_do_daemonize |
        server_use_caps_for_id | server_statistics_cumulative |
        server_outgoing_port_permit | server_outgoing_port_avoid |
        server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
        server_harden_referral_path | server_private_address |
-       server_private_domain | server_extended_statistics | 
-       server_local_data_ptr | server_jostle_timeout | 
-       server_unwanted_reply_threshold | server_log_time_ascii | 
-       server_domain_insecure | server_val_sig_skew_min | 
+       server_private_domain | server_extended_statistics |
+       server_local_data_ptr | server_jostle_timeout |
+       server_unwanted_reply_threshold | server_log_time_ascii |
+       server_domain_insecure | server_val_sig_skew_min |
        server_val_sig_skew_max | server_val_max_restart |
        server_cache_min_ttl | server_val_log_level |
        server_auto_trust_anchor_file | server_add_holddown |
@@ -269,9 +273,10 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_ip_ratelimit_size | server_ratelimit_size |
        server_ratelimit_for_domain |
        server_ratelimit_below_domain | server_ratelimit_factor |
-       server_ip_ratelimit_factor | server_send_client_subnet |
-       server_client_subnet_zone | server_client_subnet_always_forward |
-       server_client_subnet_opcode |
+       server_ip_ratelimit_factor | server_ratelimit_backoff |
+       server_ip_ratelimit_backoff | server_outbound_msg_retry |
+       server_send_client_subnet | server_client_subnet_zone |
+       server_client_subnet_always_forward | server_client_subnet_opcode |
        server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 |
        server_min_client_subnet_ipv4 | server_min_client_subnet_ipv6 |
        server_max_ecs_tree_size_ipv4 | server_max_ecs_tree_size_ipv6 |
@@ -312,52 +317,55 @@ content_server: server_num_threads | server_verbosity | server_port |
 stubstart: VAR_STUB_ZONE
        {
                struct config_stub* s;
-               OUTYY(("\nP(stub_zone:)\n")); 
+               OUTYY(("\nP(stub_zone:)\n"));
                s = (struct config_stub*)calloc(1, sizeof(struct config_stub));
                if(s) {
                        s->next = cfg_parser->cfg->stubs;
                        cfg_parser->cfg->stubs = s;
-               } else 
+               } else {
                        yyerror("out of memory");
+               }
        }
        ;
-contents_stub: contents_stub content_stub 
+contents_stub: contents_stub content_stub
        | ;
 content_stub: stub_name | stub_host | stub_addr | stub_prime | stub_first |
-       stub_no_cache | stub_ssl_upstream
+       stub_no_cache | stub_ssl_upstream | stub_tcp_upstream
        ;
 forwardstart: VAR_FORWARD_ZONE
        {
                struct config_stub* s;
-               OUTYY(("\nP(forward_zone:)\n")); 
+               OUTYY(("\nP(forward_zone:)\n"));
                s = (struct config_stub*)calloc(1, sizeof(struct config_stub));
                if(s) {
                        s->next = cfg_parser->cfg->forwards;
                        cfg_parser->cfg->forwards = s;
-               } else 
+               } else {
                        yyerror("out of memory");
+               }
        }
        ;
-contents_forward: contents_forward content_forward 
+contents_forward: contents_forward content_forward
        | ;
 content_forward: forward_name | forward_host | forward_addr | forward_first |
-       forward_no_cache | forward_ssl_upstream
+       forward_no_cache | forward_ssl_upstream | forward_tcp_upstream
        ;
 viewstart: VAR_VIEW
        {
                struct config_view* s;
-               OUTYY(("\nP(view:)\n")); 
+               OUTYY(("\nP(view:)\n"));
                s = (struct config_view*)calloc(1, sizeof(struct config_view));
                if(s) {
                        s->next = cfg_parser->cfg->views;
                        if(s->next && !s->next->name)
                                yyerror("view without name");
                        cfg_parser->cfg->views = s;
-               } else 
+               } else {
                        yyerror("out of memory");
+               }
        }
        ;
-contents_view: contents_view content_view 
+contents_view: contents_view content_view
        | ;
 content_view: view_name | view_local_zone | view_local_data | view_first |
                view_response_ip | view_response_ip_data | view_local_data_ptr
@@ -365,7 +373,7 @@ content_view: view_name | view_local_zone | view_local_data | view_first |
 authstart: VAR_AUTH_ZONE
        {
                struct config_auth* s;
-               OUTYY(("\nP(auth_zone:)\n")); 
+               OUTYY(("\nP(auth_zone:)\n"));
                s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
                if(s) {
                        s->next = cfg_parser->cfg->auths;
@@ -377,11 +385,12 @@ authstart: VAR_AUTH_ZONE
                        s->zonemd_check = 0;
                        s->zonemd_reject_absence = 0;
                        s->isrpz = 0;
-               } else 
+               } else {
                        yyerror("out of memory");
+               }
        }
        ;
-contents_auth: contents_auth content_auth 
+contents_auth: contents_auth content_auth
        | ;
 content_auth: auth_name | auth_zonefile | auth_master | auth_url |
        auth_for_downstream | auth_for_upstream | auth_fallback_enabled |
@@ -449,6 +458,15 @@ rpz_log_name: VAR_RPZ_LOG_NAME STRING_ARG
                cfg_parser->cfg->auths->rpz_log_name = $2;
        }
        ;
+rpz_signal_nxdomain_ra: VAR_RPZ_SIGNAL_NXDOMAIN_RA STRING_ARG
+       {
+               OUTYY(("P(rpz_signal_nxdomain_ra:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->auths->rpz_signal_nxdomain_ra = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 
 rpzstart: VAR_RPZ
        {
@@ -463,37 +481,38 @@ rpzstart: VAR_RPZ
                        s->for_upstream = 0;
                        s->fallback_enabled = 0;
                        s->isrpz = 1;
-               } else 
+               } else {
                        yyerror("out of memory");
+               }
        }
        ;
 contents_rpz: contents_rpz content_rpz 
        | ;
 content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url |
           auth_allow_notify | rpz_action_override | rpz_cname_override |
-          rpz_log | rpz_log_name
+          rpz_log | rpz_log_name | rpz_signal_nxdomain_ra | auth_for_downstream
        ;
-server_num_threads: VAR_NUM_THREADS STRING_ARG 
-       { 
-               OUTYY(("P(server_num_threads:%s)\n", $2)); 
+server_num_threads: VAR_NUM_THREADS STRING_ARG
+       {
+               OUTYY(("P(server_num_threads:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->num_threads = atoi($2);
                free($2);
        }
        ;
-server_verbosity: VAR_VERBOSITY STRING_ARG 
-       { 
-               OUTYY(("P(server_verbosity:%s)\n", $2)); 
+server_verbosity: VAR_VERBOSITY STRING_ARG
+       {
+               OUTYY(("P(server_verbosity:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->verbosity = atoi($2);
                free($2);
        }
        ;
-server_statistics_interval: VAR_STATISTICS_INTERVAL STRING_ARG 
-       { 
-               OUTYY(("P(server_statistics_interval:%s)\n", $2)); 
+server_statistics_interval: VAR_STATISTICS_INTERVAL STRING_ARG
+       {
+               OUTYY(("P(server_statistics_interval:%s)\n", $2));
                if(strcmp($2, "") == 0 || strcmp($2, "0") == 0)
                        cfg_parser->cfg->stat_interval = 0;
                else if(atoi($2) == 0)
@@ -529,9 +548,9 @@ server_shm_enable: VAR_SHM_ENABLE STRING_ARG
                free($2);
        }
        ;
-server_shm_key: VAR_SHM_KEY STRING_ARG 
-       { 
-               OUTYY(("P(server_shm_key:%s)\n", $2)); 
+server_shm_key: VAR_SHM_KEY STRING_ARG
+       {
+               OUTYY(("P(server_shm_key:%s)\n", $2));
                if(strcmp($2, "") == 0 || strcmp($2, "0") == 0)
                        cfg_parser->cfg->shm_key = 0;
                else if(atoi($2) == 0)
@@ -704,7 +723,7 @@ server_interface: VAR_INTERFACE STRING_ARG
                OUTYY(("P(server_interface:%s)\n", $2));
                if(cfg_parser->cfg->num_ifs == 0)
                        cfg_parser->cfg->ifs = calloc(1, sizeof(char*));
-               else    cfg_parser->cfg->ifs = realloc(cfg_parser->cfg->ifs,
+               else cfg_parser->cfg->ifs = realloc(cfg_parser->cfg->ifs,
                                (cfg_parser->cfg->num_ifs+1)*sizeof(char*));
                if(!cfg_parser->cfg->ifs)
                        yyerror("out of memory");
@@ -717,8 +736,8 @@ server_outgoing_interface: VAR_OUTGOING_INTERFACE STRING_ARG
                OUTYY(("P(server_outgoing_interface:%s)\n", $2));
                if(cfg_parser->cfg->num_out_ifs == 0)
                        cfg_parser->cfg->out_ifs = calloc(1, sizeof(char*));
-               else    cfg_parser->cfg->out_ifs = realloc(
-                       cfg_parser->cfg->out_ifs, 
+               else cfg_parser->cfg->out_ifs = realloc(
+                       cfg_parser->cfg->out_ifs,
                        (cfg_parser->cfg->num_out_ifs+1)*sizeof(char*));
                if(!cfg_parser->cfg->out_ifs)
                        yyerror("out of memory");
@@ -739,7 +758,7 @@ server_outgoing_range: VAR_OUTGOING_RANGE STRING_ARG
 server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING_ARG
        {
                OUTYY(("P(server_outgoing_port_permit:%s)\n", $2));
-               if(!cfg_mark_ports($2, 1, 
+               if(!cfg_mark_ports($2, 1,
                        cfg_parser->cfg->outgoing_avail_ports, 65536))
                        yyerror("port number or range (\"low-high\") expected");
                free($2);
@@ -748,7 +767,7 @@ server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING_ARG
 server_outgoing_port_avoid: VAR_OUTGOING_PORT_AVOID STRING_ARG
        {
                OUTYY(("P(server_outgoing_port_avoid:%s)\n", $2));
-               if(!cfg_mark_ports($2, 0, 
+               if(!cfg_mark_ports($2, 0,
                        cfg_parser->cfg->outgoing_avail_ports, 65536))
                        yyerror("port number or range (\"low-high\") expected");
                free($2);
@@ -838,10 +857,10 @@ server_prefer_ip6: VAR_PREFER_IP6 STRING_ARG
 server_tcp_mss: VAR_TCP_MSS STRING_ARG
        {
                OUTYY(("P(server_tcp_mss:%s)\n", $2));
-                if(atoi($2) == 0 && strcmp($2, "0") != 0)
-                        yyerror("number expected");
-                else cfg_parser->cfg->tcp_mss = atoi($2);
-                free($2);
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                               yyerror("number expected");
+               else cfg_parser->cfg->tcp_mss = atoi($2);
+               free($2);
        }
        ;
 server_outgoing_tcp_mss: VAR_OUTGOING_TCP_MSS STRING_ARG
@@ -1141,23 +1160,23 @@ server_log_queries: VAR_LOG_QUERIES STRING_ARG
        }
        ;
 server_log_replies: VAR_LOG_REPLIES STRING_ARG
-  {
-       OUTYY(("P(server_log_replies:%s)\n", $2));
-       if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-               yyerror("expected yes or no.");
-       else cfg_parser->cfg->log_replies = (strcmp($2, "yes")==0);
-       free($2);
-  }
-  ;
+       {
+               OUTYY(("P(server_log_replies:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->log_replies = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_log_tag_queryreply: VAR_LOG_TAG_QUERYREPLY STRING_ARG
-  {
-       OUTYY(("P(server_log_tag_queryreply:%s)\n", $2));
-       if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-               yyerror("expected yes or no.");
-       else cfg_parser->cfg->log_tag_queryreply = (strcmp($2, "yes")==0);
-       free($2);
-  }
-  ;
+       {
+               OUTYY(("P(server_log_tag_queryreply:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->log_tag_queryreply = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_log_servfail: VAR_LOG_SERVFAIL STRING_ARG
        {
                OUTYY(("P(server_log_servfail:%s)\n", $2));
@@ -1168,14 +1187,14 @@ server_log_servfail: VAR_LOG_SERVFAIL STRING_ARG
        }
        ;
 server_log_local_actions: VAR_LOG_LOCAL_ACTIONS STRING_ARG
-  {
-       OUTYY(("P(server_log_local_actions:%s)\n", $2));
-       if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-               yyerror("expected yes or no.");
-       else cfg_parser->cfg->log_local_actions = (strcmp($2, "yes")==0);
-       free($2);
-  }
-  ;
+       {
+               OUTYY(("P(server_log_local_actions:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->log_local_actions = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_chroot: VAR_CHROOT STRING_ARG
        {
                OUTYY(("P(server_chroot:%s)\n", $2));
@@ -1209,7 +1228,7 @@ server_directory: VAR_DIRECTORY STRING_ARG
                                cfg_parser->chroot)) == 0)
                                d += strlen(cfg_parser->chroot);
                        if(d[0]) {
-                           if(chdir(d))
+                               if(chdir(d))
                                log_err("cannot chdir to directory: %s (%s)",
                                        d, strerror(errno));
                        }
@@ -1402,35 +1421,35 @@ server_so_sndbuf: VAR_SO_SNDBUF STRING_ARG
        }
        ;
 server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG
-    {
-        OUTYY(("P(server_so_reuseport:%s)\n", $2));
-        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-            yyerror("expected yes or no.");
-        else cfg_parser->cfg->so_reuseport =
-            (strcmp($2, "yes")==0);
-        free($2);
-    }
-    ;
+       {
+               OUTYY(("P(server_so_reuseport:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->so_reuseport =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG
-    {
-        OUTYY(("P(server_ip_transparent:%s)\n", $2));
-        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-            yyerror("expected yes or no.");
-        else cfg_parser->cfg->ip_transparent =
-            (strcmp($2, "yes")==0);
-        free($2);
-    }
-    ;
+       {
+               OUTYY(("P(server_ip_transparent:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->ip_transparent =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_ip_freebind: VAR_IP_FREEBIND STRING_ARG
-    {
-        OUTYY(("P(server_ip_freebind:%s)\n", $2));
-        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-            yyerror("expected yes or no.");
-        else cfg_parser->cfg->ip_freebind =
-            (strcmp($2, "yes")==0);
-        free($2);
-    }
-    ;
+       {
+               OUTYY(("P(server_ip_freebind:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->ip_freebind =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_ip_dscp: VAR_IP_DSCP STRING_ARG
        {
                OUTYY(("P(server_ip_dscp:%s)\n", $2));
@@ -1488,9 +1507,9 @@ server_msg_cache_size: VAR_MSG_CACHE_SIZE STRING_ARG
 server_msg_cache_slabs: VAR_MSG_CACHE_SLABS STRING_ARG
        {
                OUTYY(("P(server_msg_cache_slabs:%s)\n", $2));
-               if(atoi($2) == 0)
+               if(atoi($2) == 0) {
                        yyerror("number expected");
-               else {
+               } else {
                        cfg_parser->cfg->msg_cache_slabs = atoi($2);
                        if(!is_pow2(cfg_parser->cfg->msg_cache_slabs))
                                yyerror("must be a power of 2");
@@ -1539,7 +1558,7 @@ server_unblock_lan_zones: VAR_UNBLOCK_LAN_ZONES STRING_ARG
                OUTYY(("P(server_unblock_lan_zones:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->unblock_lan_zones = 
+               else cfg_parser->cfg->unblock_lan_zones =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1549,7 +1568,7 @@ server_insecure_lan_zones: VAR_INSECURE_LAN_ZONES STRING_ARG
                OUTYY(("P(server_insecure_lan_zones:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->insecure_lan_zones = 
+               else cfg_parser->cfg->insecure_lan_zones =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1565,9 +1584,9 @@ server_rrset_cache_size: VAR_RRSET_CACHE_SIZE STRING_ARG
 server_rrset_cache_slabs: VAR_RRSET_CACHE_SLABS STRING_ARG
        {
                OUTYY(("P(server_rrset_cache_slabs:%s)\n", $2));
-               if(atoi($2) == 0)
+               if(atoi($2) == 0) {
                        yyerror("number expected");
-               else {
+               } else {
                        cfg_parser->cfg->rrset_cache_slabs = atoi($2);
                        if(!is_pow2(cfg_parser->cfg->rrset_cache_slabs))
                                yyerror("must be a power of 2");
@@ -1612,9 +1631,9 @@ server_infra_cache_lame_size: VAR_INFRA_CACHE_LAME_SIZE STRING_ARG
 server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG
        {
                OUTYY(("P(server_infra_cache_slabs:%s)\n", $2));
-               if(atoi($2) == 0)
+               if(atoi($2) == 0) {
                        yyerror("number expected");
-               else {
+               } else {
                        cfg_parser->cfg->infra_cache_slabs = atoi($2);
                        if(!is_pow2(cfg_parser->cfg->infra_cache_slabs))
                                yyerror("must be a power of 2");
@@ -1653,7 +1672,7 @@ server_harden_short_bufsize: VAR_HARDEN_SHORT_BUFSIZE STRING_ARG
                OUTYY(("P(server_harden_short_bufsize:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_short_bufsize = 
+               else cfg_parser->cfg->harden_short_bufsize =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1663,7 +1682,7 @@ server_harden_large_queries: VAR_HARDEN_LARGE_QUERIES STRING_ARG
                OUTYY(("P(server_harden_large_queries:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_large_queries = 
+               else cfg_parser->cfg->harden_large_queries =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1673,7 +1692,7 @@ server_harden_glue: VAR_HARDEN_GLUE STRING_ARG
                OUTYY(("P(server_harden_glue:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_glue = 
+               else cfg_parser->cfg->harden_glue =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1683,7 +1702,7 @@ server_harden_dnssec_stripped: VAR_HARDEN_DNSSEC_STRIPPED STRING_ARG
                OUTYY(("P(server_harden_dnssec_stripped:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_dnssec_stripped = 
+               else cfg_parser->cfg->harden_dnssec_stripped =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1693,7 +1712,7 @@ server_harden_below_nxdomain: VAR_HARDEN_BELOW_NXDOMAIN STRING_ARG
                OUTYY(("P(server_harden_below_nxdomain:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_below_nxdomain = 
+               else cfg_parser->cfg->harden_below_nxdomain =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1703,7 +1722,7 @@ server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG
                OUTYY(("P(server_harden_referral_path:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_referral_path = 
+               else cfg_parser->cfg->harden_referral_path =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1713,7 +1732,7 @@ server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
                OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->harden_algo_downgrade = 
+               else cfg_parser->cfg->harden_algo_downgrade =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1723,7 +1742,7 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
                OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->use_caps_bits_for_id = 
+               else cfg_parser->cfg->use_caps_bits_for_id =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1797,7 +1816,7 @@ server_do_not_query_localhost: VAR_DO_NOT_QUERY_LOCALHOST STRING_ARG
                OUTYY(("P(server_do_not_query_localhost:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->donotquery_localhost = 
+               else cfg_parser->cfg->donotquery_localhost =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1808,8 +1827,8 @@ server_access_control: VAR_ACCESS_CONTROL STRING_ARG STRING_ARG
                if(strcmp($3, "deny")!=0 && strcmp($3, "refuse")!=0 &&
                        strcmp($3, "deny_non_local")!=0 &&
                        strcmp($3, "refuse_non_local")!=0 &&
-                       strcmp($3, "allow_setrd")!=0 && 
-                       strcmp($3, "allow")!=0 && 
+                       strcmp($3, "allow_setrd")!=0 &&
+                       strcmp($3, "allow")!=0 &&
                        strcmp($3, "allow_snoop")!=0) {
                        yyerror("expected deny, refuse, deny_non_local, "
                                "refuse_non_local, allow, allow_setrd or "
@@ -1835,7 +1854,7 @@ server_val_override_date: VAR_VAL_OVERRIDE_DATE STRING_ARG
                if(*$2 == '\0' || strcmp($2, "0") == 0) {
                        cfg_parser->cfg->val_date_override = 0;
                } else if(strlen($2) == 14) {
-                       cfg_parser->cfg->val_date_override = 
+                       cfg_parser->cfg->val_date_override =
                                cfg_convert_timeval($2);
                        if(!cfg_parser->cfg->val_date_override)
                                yyerror("bad date/time specification");
@@ -1927,7 +1946,7 @@ server_val_clean_additional: VAR_VAL_CLEAN_ADDITIONAL STRING_ARG
                OUTYY(("P(server_val_clean_additional:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->val_clean_additional = 
+               else cfg_parser->cfg->val_clean_additional =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -1937,7 +1956,7 @@ server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG
                OUTYY(("P(server_val_permissive_mode:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->val_permissive_mode = 
+               else cfg_parser->cfg->val_permissive_mode =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -2114,9 +2133,9 @@ server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG
 server_key_cache_slabs: VAR_KEY_CACHE_SLABS STRING_ARG
        {
                OUTYY(("P(server_key_cache_slabs:%s)\n", $2));
-               if(atoi($2) == 0)
+               if(atoi($2) == 0) {
                        yyerror("number expected");
-               else {
+               } else {
                        cfg_parser->cfg->key_cache_slabs = atoi($2);
                        if(!is_pow2(cfg_parser->cfg->key_cache_slabs))
                                yyerror("must be a power of 2");
@@ -2171,7 +2190,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
                        free($3);
 #endif
                } else {
-                       if(!cfg_str2list_insert(&cfg_parser->cfg->local_zones, 
+                       if(!cfg_str2list_insert(&cfg_parser->cfg->local_zones,
                                $2, $3))
                                fatal_exit("out of memory adding local-zone");
                }
@@ -2379,19 +2398,18 @@ server_response_ip_tag: VAR_RESPONSE_IP_TAG STRING_ARG STRING_ARG
                }
        }
        ;
-server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG 
-       { 
-               OUTYY(("P(server_ip_ratelimit:%s)\n", $2)); 
+server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG
+       {
+               OUTYY(("P(server_ip_ratelimit:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->ip_ratelimit = atoi($2);
                free($2);
        }
        ;
-
-server_ratelimit: VAR_RATELIMIT STRING_ARG 
-       { 
-               OUTYY(("P(server_ratelimit:%s)\n", $2)); 
+server_ratelimit: VAR_RATELIMIT STRING_ARG
+       {
+               OUTYY(("P(server_ratelimit:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->ratelimit = atoi($2);
@@ -2399,13 +2417,13 @@ server_ratelimit: VAR_RATELIMIT STRING_ARG
        }
        ;
 server_ip_ratelimit_size: VAR_IP_RATELIMIT_SIZE STRING_ARG
-  {
-       OUTYY(("P(server_ip_ratelimit_size:%s)\n", $2));
-       if(!cfg_parse_memsize($2, &cfg_parser->cfg->ip_ratelimit_size))
-               yyerror("memory size expected");
-       free($2);
-  }
-  ;
+       {
+               OUTYY(("P(server_ip_ratelimit_size:%s)\n", $2));
+               if(!cfg_parse_memsize($2, &cfg_parser->cfg->ip_ratelimit_size))
+                       yyerror("memory size expected");
+               free($2);
+       }
+       ;
 server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG
        {
                OUTYY(("P(server_ratelimit_size:%s)\n", $2));
@@ -2415,24 +2433,24 @@ server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG
        }
        ;
 server_ip_ratelimit_slabs: VAR_IP_RATELIMIT_SLABS STRING_ARG
-  {
-       OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", $2));
-       if(atoi($2) == 0)
-               yyerror("number expected");
-       else {
-               cfg_parser->cfg->ip_ratelimit_slabs = atoi($2);
-               if(!is_pow2(cfg_parser->cfg->ip_ratelimit_slabs))
-                       yyerror("must be a power of 2");
-       }
-       free($2);
-  }
-  ;
+       {
+               OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", $2));
+               if(atoi($2) == 0) {
+                       yyerror("number expected");
+               } else {
+                       cfg_parser->cfg->ip_ratelimit_slabs = atoi($2);
+                       if(!is_pow2(cfg_parser->cfg->ip_ratelimit_slabs))
+                               yyerror("must be a power of 2");
+               }
+               free($2);
+       }
+       ;
 server_ratelimit_slabs: VAR_RATELIMIT_SLABS STRING_ARG
        {
                OUTYY(("P(server_ratelimit_slabs:%s)\n", $2));
-               if(atoi($2) == 0)
+               if(atoi($2) == 0) {
                        yyerror("number expected");
-               else {
+               } else {
                        cfg_parser->cfg->ratelimit_slabs = atoi($2);
                        if(!is_pow2(cfg_parser->cfg->ratelimit_slabs))
                                yyerror("must be a power of 2");
@@ -2470,42 +2488,71 @@ server_ratelimit_below_domain: VAR_RATELIMIT_BELOW_DOMAIN STRING_ARG STRING_ARG
                }
        }
        ;
-server_ip_ratelimit_factor: VAR_IP_RATELIMIT_FACTOR STRING_ARG 
-  { 
-       OUTYY(("P(server_ip_ratelimit_factor:%s)\n", $2)); 
-       if(atoi($2) == 0 && strcmp($2, "0") != 0)
-               yyerror("number expected");
-       else cfg_parser->cfg->ip_ratelimit_factor = atoi($2);
-       free($2);
+server_ip_ratelimit_factor: VAR_IP_RATELIMIT_FACTOR STRING_ARG
+       {
+               OUTYY(("P(server_ip_ratelimit_factor:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->ip_ratelimit_factor = atoi($2);
+               free($2);
        }
        ;
-server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG 
-       { 
-               OUTYY(("P(server_ratelimit_factor:%s)\n", $2)); 
+server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG
+       {
+               OUTYY(("P(server_ratelimit_factor:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->ratelimit_factor = atoi($2);
                free($2);
        }
        ;
-server_low_rtt: VAR_LOW_RTT STRING_ARG 
-       { 
+server_ip_ratelimit_backoff: VAR_IP_RATELIMIT_BACKOFF STRING_ARG
+       {
+               OUTYY(("P(server_ip_ratelimit_backoff:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->ip_ratelimit_backoff =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
+server_ratelimit_backoff: VAR_RATELIMIT_BACKOFF STRING_ARG
+       {
+               OUTYY(("P(server_ratelimit_backoff:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->ratelimit_backoff =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
+server_outbound_msg_retry: VAR_OUTBOUND_MSG_RETRY STRING_ARG
+       {
+               OUTYY(("P(server_outbound_msg_retry:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->outbound_msg_retry = atoi($2);
+               free($2);
+       }
+       ;
+server_low_rtt: VAR_LOW_RTT STRING_ARG
+       {
                OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
                free($2);
        }
        ;
-server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG 
-       { 
-               OUTYY(("P(server_fast_server_num:%s)\n", $2)); 
+server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG
+       {
+               OUTYY(("P(server_fast_server_num:%s)\n", $2));
                if(atoi($2) <= 0)
                        yyerror("number expected");
                else cfg_parser->cfg->fast_server_num = atoi($2);
                free($2);
        }
        ;
-server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG 
-       { 
-               OUTYY(("P(server_fast_server_permil:%s)\n", $2)); 
+server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG
+       {
+               OUTYY(("P(server_fast_server_permil:%s)\n", $2));
                if(atoi($2) == 0 && strcmp($2, "0") != 0)
                        yyerror("number expected");
                else cfg_parser->cfg->fast_server_permil = atoi($2);
@@ -2517,7 +2564,7 @@ server_qname_minimisation: VAR_QNAME_MINIMISATION STRING_ARG
                OUTYY(("P(server_qname_minimisation:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->qname_minimisation = 
+               else cfg_parser->cfg->qname_minimisation =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -2527,7 +2574,7 @@ server_qname_minimisation_strict: VAR_QNAME_MINIMISATION_STRICT STRING_ARG
                OUTYY(("P(server_qname_minimisation_strict:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->qname_minimisation_strict = 
+               else cfg_parser->cfg->qname_minimisation_strict =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -2716,17 +2763,27 @@ stub_ssl_upstream: VAR_STUB_SSL_UPSTREAM STRING_ARG
                OUTYY(("P(stub-ssl-upstream:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->stubs->ssl_upstream = 
+               else cfg_parser->cfg->stubs->ssl_upstream =
                        (strcmp($2, "yes")==0);
                free($2);
        }
        ;
+stub_tcp_upstream: VAR_STUB_TCP_UPSTREAM STRING_ARG
+        {
+                OUTYY(("P(stub-tcp-upstream:%s)\n", $2));
+                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                        yyerror("expected yes or no.");
+                else cfg_parser->cfg->stubs->tcp_upstream =
+                        (strcmp($2, "yes")==0);
+                free($2);
+        }
+        ;
 stub_prime: VAR_STUB_PRIME STRING_ARG
        {
                OUTYY(("P(stub-prime:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->stubs->isprime = 
+               else cfg_parser->cfg->stubs->isprime =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -2778,11 +2835,21 @@ forward_ssl_upstream: VAR_FORWARD_SSL_UPSTREAM STRING_ARG
                OUTYY(("P(forward-ssl-upstream:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->forwards->ssl_upstream = 
+               else cfg_parser->cfg->forwards->ssl_upstream =
                        (strcmp($2, "yes")==0);
                free($2);
        }
        ;
+forward_tcp_upstream: VAR_FORWARD_TCP_UPSTREAM STRING_ARG
+        {
+                OUTYY(("P(forward-tcp-upstream:%s)\n", $2));
+                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                        yyerror("expected yes or no.");
+                else cfg_parser->cfg->forwards->tcp_upstream =
+                        (strcmp($2, "yes")==0);
+                free($2);
+        }
+        ;
 auth_name: VAR_NAME STRING_ARG
        {
                OUTYY(("P(name:%s)\n", $2));
@@ -2922,7 +2989,7 @@ view_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 #endif
                } else {
                        if(!cfg_str2list_insert(
-                               &cfg_parser->cfg->views->local_zones, 
+                               &cfg_parser->cfg->views->local_zones,
                                $2, $3))
                                fatal_exit("out of memory adding local-zone");
                }
@@ -2979,11 +3046,11 @@ view_first: VAR_VIEW_FIRST STRING_ARG
        }
        ;
 rcstart: VAR_REMOTE_CONTROL
-       { 
-               OUTYY(("\nP(remote-control:)\n")); 
+       {
+               OUTYY(("\nP(remote-control:)\n"));
        }
        ;
-contents_rc: contents_rc content_rc 
+contents_rc: contents_rc content_rc
        | ;
 content_rc: rc_control_enable | rc_control_interface | rc_control_port |
        rc_server_key_file | rc_server_cert_file | rc_control_key_file |
@@ -2994,7 +3061,7 @@ rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG
                OUTYY(("P(control_enable:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->remote_control_enable = 
+               else cfg_parser->cfg->remote_control_enable =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -3233,8 +3300,8 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
        }
        ;
 pythonstart: VAR_PYTHON
-       { 
-               OUTYY(("\nP(python:)\n")); 
+       {
+               OUTYY(("\nP(python:)\n"));
        }
        ;
 contents_py: contents_py content_py
@@ -3365,44 +3432,44 @@ dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG
        ;
 dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG
   {
-       OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2));
-       if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
-               yyerror("memory size expected");
-       free($2);
+       OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2));
+       if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
+               yyerror("memory size expected");
+       free($2);
   }
   ;
 dnsc_dnscrypt_shared_secret_cache_slabs: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS STRING_ARG
   {
-       OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2));
-       if(atoi($2) == 0)
-               yyerror("number expected");
-       else {
-               cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2);
-               if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs))
-                       yyerror("must be a power of 2");
-       }
-       free($2);
+       OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2));
+       if(atoi($2) == 0) {
+               yyerror("number expected");
+       } else {
+               cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2);
+               if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs))
+                       yyerror("must be a power of 2");
+       }
+       free($2);
   }
   ;
 dnsc_dnscrypt_nonce_cache_size: VAR_DNSCRYPT_NONCE_CACHE_SIZE STRING_ARG
   {
-       OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", $2));
-       if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_nonce_cache_size))
-               yyerror("memory size expected");
-       free($2);
+       OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", $2));
+       if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_nonce_cache_size))
+               yyerror("memory size expected");
+       free($2);
   }
   ;
 dnsc_dnscrypt_nonce_cache_slabs: VAR_DNSCRYPT_NONCE_CACHE_SLABS STRING_ARG
   {
-       OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", $2));
-       if(atoi($2) == 0)
-               yyerror("number expected");
-       else {
-               cfg_parser->cfg->dnscrypt_nonce_cache_slabs = atoi($2);
-               if(!is_pow2(cfg_parser->cfg->dnscrypt_nonce_cache_slabs))
-                       yyerror("must be a power of 2");
-       }
-       free($2);
+       OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", $2));
+       if(atoi($2) == 0) {
+               yyerror("number expected");
+       } else {
+               cfg_parser->cfg->dnscrypt_nonce_cache_slabs = atoi($2);
+               if(!is_pow2(cfg_parser->cfg->dnscrypt_nonce_cache_slabs))
+                       yyerror("must be a power of 2");
+       }
+       free($2);
   }
   ;
 cachedbstart: VAR_CACHEDB

diff --git a/sbin/unwind/libunbound/util/data/msgencode.c b/sbin/unwind/libunbound/util/data/msgencode.c
index 5f297b5..fe21cfb 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgencode.c
+++ b/sbin/unwind/libunbound/util/data/msgencode.c
@@ -796,7 +796,10 @@ calc_edns_field_size(struct edns_data* edns)
        struct edns_option* opt;
        if(!edns || !edns->edns_present)
                return 0;
-       for(opt = edns->opt_list; opt; opt = opt->next) {
+       for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) {
+               rdatalen += 4 + opt->opt_len;
+       }
+       for(opt = edns->opt_list_out; opt; opt = opt->next) {
                rdatalen += 4 + opt->opt_len;
        }
        /* domain root '.' + type + class + ttl + rdatalen */
@@ -827,7 +830,17 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
        rdatapos = sldns_buffer_position(pkt);
        sldns_buffer_write_u16(pkt, 0); /* rdatalen */
        /* write rdata */
-       for(opt=edns->opt_list; opt; opt=opt->next) {
+       for(opt=edns->opt_list_inplace_cb_out; opt; opt=opt->next) {
+               if (opt->opt_code == LDNS_EDNS_PADDING) {
+                       padding_option = opt;
+                       continue;
+               }
+               sldns_buffer_write_u16(pkt, opt->opt_code);
+               sldns_buffer_write_u16(pkt, opt->opt_len);
+               if(opt->opt_len != 0)
+                       sldns_buffer_write(pkt, opt->opt_data, opt->opt_len);
+       }
+       for(opt=edns->opt_list_out; opt; opt=opt->next) {
                if (opt->opt_code == LDNS_EDNS_PADDING) {
                        padding_option = opt;
                        continue;
@@ -860,8 +873,7 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
                        sldns_buffer_skip(pkt, pad_sz);
                }
        }
-       if(edns->opt_list)
-               sldns_buffer_write_u16_at(pkt, rdatapos, 
+       sldns_buffer_write_u16_at(pkt, rdatapos, 
                        sldns_buffer_position(pkt)-rdatapos-2);
        sldns_buffer_flip(pkt);
 }

diff --git a/sbin/unwind/libunbound/util/data/msgparse.c b/sbin/unwind/libunbound/util/data/msgparse.c
index 6ee5559..a600a8c 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgparse.c
+++ b/sbin/unwind/libunbound/util/data/msgparse.c
@@ -37,10 +37,12 @@
  * Routines for message parsing a packet buffer to a descriptive structure.
  */
 #include "config.h"
+#include "util/config_file.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/dname.h"
 #include "util/data/packed_rrset.h"
+#include "util/netevent.h"
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
 #include "sldns/rrdef.h"
@@ -938,11 +940,40 @@ parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region)
        return 0;
 }
 
+static int
+edns_opt_list_append_keepalive(struct edns_option** list, int msec,
+               struct regional* region)
+{
+       uint8_t data[2]; /* For keepalive value */
+       data[0] = (uint8_t)((msec >> 8) & 0xff);
+       data[1] = (uint8_t)(msec & 0xff);
+       return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data),
+                       data, region);
+}
+
 /** parse EDNS options from EDNS wireformat rdata */
 static int
-parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len,
-       struct edns_data* edns, struct regional* region)
+parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+       struct edns_data* edns, struct config_file* cfg, struct comm_point* c,
+       struct regional* region)
 {
+       /* To respond with a Keepalive option, the client connection must have
+        * received one message with a TCP Keepalive EDNS option, and that
+        * option must have 0 length data. Subsequent messages sent on that
+        * connection will have a TCP Keepalive option.
+        *
+        * In the if-statement below, the option is added unsolicited. This
+        * means that the client has sent an KEEPALIVE option earlier. We know
+        * here this is true, because c->tcp_keepalive is set.
+        */
+       if (cfg && cfg->do_tcp_keepalive && c && c->type != comm_udp && c->tcp_keepalive) {
+               if(!edns_opt_list_append_keepalive(&edns->opt_list_out,
+                                       c->tcp_timeout_msec / 100, region)) {
+                       log_err("out of memory");
+                       return LDNS_RCODE_SERVFAIL;
+               }
+       }
+
        /* while still more options, and have code+len to read */
        /* ignores partial content (i.e. rdata len 3) */
        while(rdata_len >= 4) {
@@ -952,20 +983,81 @@ parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len,
                rdata_len -= 4;
                if(opt_len > rdata_len)
                        break; /* option code partial */
-               if(!edns_opt_append(edns, region, opt_code, opt_len,
-                       rdata_ptr)) {
+
+               /* handle parse time edns options here */
+               switch(opt_code) {
+               case LDNS_EDNS_NSID:
+                       if (!cfg || !cfg->nsid)
+                               break;
+                       if(!edns_opt_list_append(&edns->opt_list_out,
+                                               LDNS_EDNS_NSID, cfg->nsid_len,
+                                               cfg->nsid, region)) {
+                               log_err("out of memory");
+                               return LDNS_RCODE_SERVFAIL;
+                       }
+                       break;
+
+               case LDNS_EDNS_KEEPALIVE:
+                       /* To respond with a Keepalive option, the client
+                        * connection must have received one message with a TCP
+                        * Keepalive EDNS option, and that option must have 0
+                        * length data. Subsequent messages sent on that
+                        * connection will have a TCP Keepalive option.
+                        *
+                        * This should be the first time the client sends this
+                        * option, so c->tcp_keepalive is not set.
+                        * Besides adding the reply KEEPALIVE option, 
+                        * c->tcp_keepalive will be set so that the
+                        * option will be added unsolicited in subsequent
+                        * responses (see the comment above the if-statement
+                        * at the start of this function).
+                        */
+                       if (!cfg || !cfg->do_tcp_keepalive || !c ||
+                                       c->type == comm_udp || c->tcp_keepalive)
+                               break;
+                       if(opt_len) {
+                               verbose(VERB_ALGO, "query with bad edns keepalive.");
+                               return LDNS_RCODE_FORMERR;
+                       }
+                       if(!edns_opt_list_append_keepalive(&edns->opt_list_out,
+                                               c->tcp_timeout_msec / 100,
+                                               region)) {
+                               log_err("out of memory");
+                               return LDNS_RCODE_SERVFAIL;
+                       }
+                       c->tcp_keepalive = 1;
+                       break;
+
+               case LDNS_EDNS_PADDING:
+                       if(!cfg || !cfg->pad_responses ||
+                                       !c || c->type != comm_tcp ||!c->ssl)
+                               break;
+                       if(!edns_opt_list_append(&edns->opt_list_out,
+                                               LDNS_EDNS_PADDING,
+                                               0, NULL, region)) {
+                               log_err("out of memory");
+                               return LDNS_RCODE_SERVFAIL;
+                       }
+                       edns->padding_block_size = cfg->pad_responses_block_size;
+                       break;
+
+               default:
+                       break;
+               }
+               if(!edns_opt_list_append(&edns->opt_list_in,
+                               opt_code, opt_len, rdata_ptr, region)) {
                        log_err("out of memory");
-                       return 0;
+                       return LDNS_RCODE_SERVFAIL;
                }
                rdata_ptr += opt_len;
                rdata_len -= opt_len;
        }
-       return 1;
+       return LDNS_RCODE_NOERROR;
 }
 
 int 
-parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
-       struct regional* region)
+parse_extract_edns_from_response_msg(struct msg_parse* msg,
+       struct edns_data* edns, struct regional* region)
 {
        struct rrset_parse* rrset = msg->rrset_first;
        struct rrset_parse* prev = 0;
@@ -1019,18 +1111,35 @@ parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
        edns->edns_version = found->rr_last->ttl_data[1];
        edns->bits = sldns_read_uint16(&found->rr_last->ttl_data[2]);
        edns->udp_size = ntohs(found->rrset_class);
-       edns->opt_list = NULL;
+       edns->opt_list_in = NULL;
+       edns->opt_list_out = NULL;
+       edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
 
        /* take the options */
        rdata_len = found->rr_first->size-2;
        rdata_ptr = found->rr_first->ttl_data+6;
-       if(!parse_edns_options(rdata_ptr, rdata_len, edns, region))
-               return 0;
 
-       /* ignore rrsigs */
+       /* while still more options, and have code+len to read */
+       /* ignores partial content (i.e. rdata len 3) */
+       while(rdata_len >= 4) {
+               uint16_t opt_code = sldns_read_uint16(rdata_ptr);
+               uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+               rdata_ptr += 4;
+               rdata_len -= 4;
+               if(opt_len > rdata_len)
+                       break; /* option code partial */
 
-       return 0;
+               if(!edns_opt_list_append(&edns->opt_list_in,
+                               opt_code, opt_len, rdata_ptr, region)) {
+                       log_err("out of memory");
+                       break;
+               }
+               rdata_ptr += opt_len;
+               rdata_len -= opt_len;
+       }
+       /* ignore rrsigs */
+       return LDNS_RCODE_NOERROR;
 }
 
 /** skip RR in packet */
@@ -1060,8 +1169,8 @@ skip_pkt_rrs(sldns_buffer* pkt, int num)
 }
 
 int 
-parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns,
-       struct regional* region)
+parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
+       struct config_file* cfg, struct comm_point* c, struct regional* region)
 {
        size_t rdata_len;
        uint8_t* rdata_ptr;
@@ -1093,7 +1202,9 @@ parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns,
        edns->ext_rcode = sldns_buffer_read_u8(pkt); /* ttl used for bits */
        edns->edns_version = sldns_buffer_read_u8(pkt);
        edns->bits = sldns_buffer_read_u16(pkt);
-       edns->opt_list = NULL;
+       edns->opt_list_in = NULL;
+       edns->opt_list_out = NULL;
+       edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
 
        /* take the options */
@@ -1101,12 +1212,9 @@ parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns,
        if(sldns_buffer_remaining(pkt) < rdata_len)
                return LDNS_RCODE_FORMERR;
        rdata_ptr = sldns_buffer_current(pkt);
-       if(!parse_edns_options(rdata_ptr, rdata_len, edns, region))
-               return LDNS_RCODE_SERVFAIL;
-
        /* ignore rrsigs */
-
-       return 0;
+       return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg,
+                       c, region);
 }
 
 void

diff --git a/sbin/unwind/libunbound/util/data/msgparse.h b/sbin/unwind/libunbound/util/data/msgparse.h
index d2fd9c8..4c0559a 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgparse.h
+++ b/sbin/unwind/libunbound/util/data/msgparse.h
@@ -70,6 +70,8 @@ struct rrset_parse;
 struct rr_parse;
 struct regional;
 struct edns_option;
+struct config_file;
+struct comm_point;
 
 /** number of buckets in parse rrset hash table. Must be power of 2. */
 #define PARSE_TABLE_SIZE 32
@@ -225,8 +227,15 @@ struct edns_data {
        uint16_t bits;
        /** UDP reassembly size. */
        uint16_t udp_size;
-       /** rdata element list, or NULL if none */
-       struct edns_option* opt_list;
+       /** rdata element list of options of an incoming packet created at
+        * parse time, or NULL if none */
+       struct edns_option* opt_list_in;
+       /** rdata element list of options to encode for outgoing packets,
+        * or NULL if none */
+       struct edns_option* opt_list_out;
+       /** rdata element list of outgoing edns options from modules
+        * or NULL if none */
+       struct edns_option* opt_list_inplace_cb_out;
        /** block size to pad */
        uint16_t padding_block_size;
 };
@@ -281,8 +290,8 @@ int parse_packet(struct sldns_buffer* pkt, struct msg_parse* msg,
  * @return: 0 on success. or an RCODE on an error.
  *     RCODE formerr if OPT in wrong section, and so on.
  */
-int parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
-       struct regional* region);
+int parse_extract_edns_from_response_msg(struct msg_parse* msg,
+       struct edns_data* edns, struct regional* region);
 
 /**
  * If EDNS data follows a query section, extract it and initialize edns struct.
@@ -290,12 +299,14 @@ int parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
  *     section. At end, right after EDNS data or no movement if failed.
  * @param edns: the edns data allocated by the caller. Does not have to be
  *     initialised.
+ * @param cfg: the configuration (with nsid value etc.)
+ * @param c: commpoint to determine transport (if needed)
  * @param region: region to alloc results in (edns option contents)
  * @return: 0 on success, or an RCODE on error.
  *     RCODE formerr if OPT is badly formatted and so on.
  */
-int parse_edns_from_pkt(struct sldns_buffer* pkt, struct edns_data* edns,
-       struct regional* region);
+int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns,
+       struct config_file* cfg, struct comm_point* c, struct regional* region);
 
 /**
  * Calculate hash value for rrset in packet.

diff --git a/sbin/unwind/libunbound/util/data/msgreply.c b/sbin/unwind/libunbound/util/data/msgreply.c
index 00272fd..ec46e47 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgreply.c
+++ b/sbin/unwind/libunbound/util/data/msgreply.c
@@ -166,6 +166,32 @@ reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc,
        return 1;
 }
 
+struct reply_info *
+make_new_reply_info(const struct reply_info* rep, struct regional* region,
+       size_t an_numrrsets, size_t copy_rrsets)
+{
+       struct reply_info* new_rep;
+       size_t i;
+
+       /* create a base struct.  we specify 'insecure' security status as
+        * the modified response won't be DNSSEC-valid.  In our faked response
+        * the authority and additional sections will be empty (except possible
+        * EDNS0 OPT RR in the additional section appended on sending it out),
+        * so the total number of RRsets is an_numrrsets. */
+       new_rep = construct_reply_info_base(region, rep->flags,
+               rep->qdcount, rep->ttl, rep->prefetch_ttl,
+               rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
+               sec_status_insecure);
+       if(!new_rep)
+               return NULL;
+       if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
+               return NULL;
+       for(i=0; i<copy_rrsets; i++)
+               new_rep->rrsets[i] = rep->rrsets[i];
+
+       return new_rep;
+}
+
 /** find the minimumttl in the rdata of SOA record */
 static time_t
 soa_find_minttl(struct rr_parse* rr)
@@ -196,13 +222,17 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
                 * minimum-ttl in the rdata of the SOA record */
                if(*rr_ttl > soa_find_minttl(rr))
                        *rr_ttl = soa_find_minttl(rr);
-               if(*rr_ttl > MAX_NEG_TTL)
-                       *rr_ttl = MAX_NEG_TTL;
        }
        if(!SERVE_ORIGINAL_TTL && (*rr_ttl < MIN_TTL))
                *rr_ttl = MIN_TTL;
        if(!SERVE_ORIGINAL_TTL && (*rr_ttl > MAX_TTL))
                *rr_ttl = MAX_TTL;
+       if(type == LDNS_RR_TYPE_SOA && section == LDNS_SECTION_AUTHORITY) {
+               /* max neg ttl overrides the min and max ttl of everything
+                * else, it is for a more specific record */
+               if(*rr_ttl > MAX_NEG_TTL)
+                       *rr_ttl = MAX_NEG_TTL;
+       }
        if(*rr_ttl < data->ttl)
                data->ttl = *rr_ttl;
 
@@ -488,14 +518,13 @@ int reply_info_parse(sldns_buffer* pkt, struct alloc_cache* alloc,
        if((ret = parse_packet(pkt, msg, region)) != 0) {
                return ret;
        }
-       if((ret = parse_extract_edns(msg, edns, region)) != 0)
+       if((ret = parse_extract_edns_from_response_msg(msg, edns, region)) != 0)
                return ret;
 
        /* parse OK, allocate return structures */
        /* this also performs dname decompression */
        if(!parse_create_msg(pkt, msg, alloc, qinf, rep, NULL)) {
                query_info_clear(qinf);
-               reply_info_parsedelete(*rep, alloc);
                *rep = NULL;
                return LDNS_RCODE_SERVFAIL;
        }
@@ -960,34 +989,6 @@ parse_reply_in_temp_region(sldns_buffer* pkt, struct regional* region,
        return rep;
 }
 
-int edns_opt_append(struct edns_data* edns, struct regional* region,
-       uint16_t code, size_t len, uint8_t* data)
-{
-       struct edns_option** prevp;
-       struct edns_option* opt;
-
-       /* allocate new element */
-       opt = (struct edns_option*)regional_alloc(region, sizeof(*opt));
-       if(!opt)
-               return 0;
-       opt->next = NULL;
-       opt->opt_code = code;
-       opt->opt_len = len;
-       opt->opt_data = NULL;
-       if(len > 0) {
-               opt->opt_data = regional_alloc_init(region, data, len);
-               if(!opt->opt_data)
-                       return 0;
-       }
-       
-       /* append at end of list */
-       prevp = &edns->opt_list;
-       while(*prevp != NULL)
-               prevp = &((*prevp)->next);
-       *prevp = opt;
-       return 1;
-}
-
 int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        uint8_t* data, struct regional* region)
 {
@@ -1068,7 +1069,7 @@ static int inplace_cb_reply_call_generic(
                (void)(*(inplace_cb_reply_func_type*)cb->cb)(qinfo, qstate, rep,
                        rcode, edns, &opt_list_out, repinfo, region, start_time, cb->id, cb->cb_arg);
        }
-       edns->opt_list = opt_list_out;
+       edns->opt_list_inplace_cb_out = opt_list_out;
        return 1;
 }
 

diff --git a/sbin/unwind/libunbound/util/data/msgreply.h b/sbin/unwind/libunbound/util/data/msgreply.h
index c6b220e..81c763f 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgreply.h
+++ b/sbin/unwind/libunbound/util/data/msgreply.h
@@ -382,6 +382,21 @@ struct reply_info* reply_info_copy(struct reply_info* rep,
 int reply_info_alloc_rrset_keys(struct reply_info* rep,
        struct alloc_cache* alloc, struct regional* region);
 
+/*
+ * Create a new reply_info based on 'rep'.  The new info is based on
+ * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
+ * RRsets in the answer section.  These answer rrsets are copied to the
+ * new info, up to 'copy_rrsets' rrsets (which must not be larger than
+ * 'an_numrrsets').  If an_numrrsets > copy_rrsets, the remaining rrsets array
+ * entries will be kept empty so the caller can fill them later.  When rrsets
+ * are copied, they are shallow copied.  The caller must ensure that the
+ * copied rrsets are valid throughout its lifetime and must provide appropriate
+ * mutex if it can be shared by multiple threads.
+ */
+struct reply_info *
+make_new_reply_info(const struct reply_info* rep, struct regional* region,
+       size_t an_numrrsets, size_t copy_rrsets);
+
 /**
  * Copy a parsed rrset into given key, decompressing and allocating rdata.
  * @param pkt: packet for decompression
@@ -503,18 +518,6 @@ void log_reply_info(enum verbosity_value v, struct query_info *qinf,
 void log_query_info(enum verbosity_value v, const char* str, 
        struct query_info* qinf);
 
-/**
- * Append edns option to edns data structure
- * @param edns: the edns data structure to append the edns option to.
- * @param region: region to allocate the new edns option.
- * @param code: the edns option's code.
- * @param len: the edns option's length.
- * @param data: the edns option's data.
- * @return false on failure.
- */
-int edns_opt_append(struct edns_data* edns, struct regional* region,
-       uint16_t code, size_t len, uint8_t* data);
-
 /**
  * Append edns option to edns option list
  * @param list: the edns option list to append the edns option to.

diff --git a/sbin/unwind/libunbound/util/data/packed_rrset.h b/sbin/unwind/libunbound/util/data/packed_rrset.h
index ff95c0a..e1feb22 100644 (file)
--- a/sbin/unwind/libunbound/util/data/packed_rrset.h
+++ b/sbin/unwind/libunbound/util/data/packed_rrset.h
@@ -61,6 +61,13 @@ typedef uint64_t rrset_id_type;
  * updated on encoding in a reply.  This flag is not expected to be set in
  * cached data. */
 #define PACKED_RRSET_FIXEDTTL 0x80000000
+/** This rrset is from RPZ. It is not real, it is synthesized data to block
+ * access. The flag makes lookups, from cache in iterator, ignore the fake
+ * items and only use actual data.  Eg. when the iterator looksup NS, CNAME,
+ * A and AAAA types, it then gets items without this flag that are the
+ * actual network. But messages with these records in it can be stored in
+ * the cache and retrieved for a reply. */
+#define PACKED_RRSET_RPZ 0x8
 
 /** number of rrs and rrsets for integer overflow protection.  More than
  * this is not really possible (64K packet has much less RRs and RRsets) in
@@ -88,6 +95,7 @@ struct packed_rrset_key {
         *      o PACKED_RRSET_PARENT_SIDE
         *      o PACKED_RRSET_SOA_NEG
         *      o PACKED_RRSET_FIXEDTTL (not supposed to be cached)
+        *      o PACKED_RRSET_RPZ
         */
        uint32_t flags;
        /** the rrset type in network format */

diff --git a/sbin/unwind/libunbound/util/edns.c b/sbin/unwind/libunbound/util/edns.c
index 8430844..f55dcb9 100644 (file)
--- a/sbin/unwind/libunbound/util/edns.c
+++ b/sbin/unwind/libunbound/util/edns.c
@@ -128,53 +128,3 @@ edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
        return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen);
 }
 
-static int edns_keepalive(struct edns_data* edns_out, struct edns_data* edns_in,
-               struct comm_point* c, struct regional* region)
-{
-       if(c->type == comm_udp)
-               return 1;
-
-       /* To respond with a Keepalive option, the client connection
-        * must have received one message with a TCP Keepalive EDNS option,
-        * and that option must have 0 length data. Subsequent messages
-        * sent on that connection will have a TCP Keepalive option.
-        */
-       if(c->tcp_keepalive ||
-               edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_KEEPALIVE)) {
-               int keepalive = c->tcp_timeout_msec / 100;
-               uint8_t data[2];
-               data[0] = (uint8_t)((keepalive >> 8) & 0xff);
-               data[1] = (uint8_t)(keepalive & 0xff);
-               if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_KEEPALIVE,
-                       sizeof(data), data, region))
-                       return 0;
-               c->tcp_keepalive = 1;
-       }
-       return 1;
-}
-
-int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in,
-       struct config_file* cfg, struct comm_point* c, struct regional* region)
-{
-       if(cfg->do_tcp_keepalive &&
-               !edns_keepalive(edns_out, edns_in, c, region))
-               return 0;
-
-       if (cfg->nsid && edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_NSID)
-       && !edns_opt_list_append(&edns_out->opt_list,
-                       LDNS_EDNS_NSID, cfg->nsid_len, cfg->nsid, region))
-               return 0;
-
-       if(!cfg->pad_responses || c->type != comm_tcp || !c->ssl
-       || !edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_PADDING)) {
-              ; /* pass */
-       }
-
-       else if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_PADDING
-                                                        , 0, NULL, region))
-               return 0;
-       else
-               edns_out->padding_block_size = cfg->pad_responses_block_size;
-
-       return 1;
-}

diff --git a/sbin/unwind/libunbound/util/edns.h b/sbin/unwind/libunbound/util/edns.h
index 11742eb..d9ded0b 100644 (file)
--- a/sbin/unwind/libunbound/util/edns.h
+++ b/sbin/unwind/libunbound/util/edns.h
@@ -106,16 +106,4 @@ struct edns_string_addr*
 edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
        socklen_t addrlen);
 
-/**
- * Apply common EDNS options.
- *
- * @param edns_out: initialised edns information with outbound edns.
- * @param edns_in: initialised edns information with received edns.
- * @param cfg: configuration.
- * @param c: comm channel.
- * @param region: the region to allocate the edns options in.
- */
-int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in,
-       struct config_file* cfg, struct comm_point* c, struct regional* region);
-
 #endif

diff --git a/sbin/unwind/libunbound/util/fptr_wlist.c b/sbin/unwind/libunbound/util/fptr_wlist.c
index de6dbd0..05a22d4 100644 (file)
--- a/sbin/unwind/libunbound/util/fptr_wlist.c
+++ b/sbin/unwind/libunbound/util/fptr_wlist.c
@@ -138,6 +138,7 @@ fptr_whitelist_comm_timer(void (*fptr)(void*))
        else if(fptr == &auth_xfer_probe_timer_callback) return 1;
        else if(fptr == &auth_xfer_transfer_timer_callback) return 1;
        else if(fptr == &mesh_serve_expired_callback) return 1;
+       else if(fptr == &serviced_timer_cb) return 1;
 #ifdef USE_DNSTAP
        else if(fptr == &mq_wakeup_cb) return 1;
 #endif
@@ -334,9 +335,10 @@ fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr)
 int 
 fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
        struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-       int nocaps, struct sockaddr_storage* addr, socklen_t addrlen,
-       uint8_t* zone, size_t zonelen, int ssl_upstream, char* tls_auth_name,
-       struct module_qstate* q))
+       int nocaps, int check_ratelimit, struct sockaddr_storage* addr,
+       socklen_t addrlen, uint8_t* zone, size_t zonelen, int tcp_upstream,
+       int ssl_upstream, char* tls_auth_name, struct module_qstate* q,
+       int* was_ratelimited))
 {
        if(fptr == &worker_send_query) return 1;
        else if(fptr == &libworker_send_query) return 1;

diff --git a/sbin/unwind/libunbound/util/fptr_wlist.h b/sbin/unwind/libunbound/util/fptr_wlist.h
index cd331fe..a0d9867 100644 (file)
--- a/sbin/unwind/libunbound/util/fptr_wlist.h
+++ b/sbin/unwind/libunbound/util/fptr_wlist.h
@@ -211,9 +211,10 @@ int fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr);
  */
 int fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
        struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-       int nocaps, struct sockaddr_storage* addr, socklen_t addrlen,
-       uint8_t* zone, size_t zonelen, int ssl_upstream, char* tls_auth_name,
-       struct module_qstate* q));
+       int nocaps, int check_ratelimit, struct sockaddr_storage* addr,
+       socklen_t addrlen, uint8_t* zone, size_t zonelen, int tcp_upstream,
+       int ssl_upstream, char* tls_auth_name, struct module_qstate* q,
+       int* was_ratelimited));
 
 /**
  * Check function pointer whitelist for module_env detach_subs callback values.

diff --git a/sbin/unwind/libunbound/util/iana_ports.inc b/sbin/unwind/libunbound/util/iana_ports.inc
index b93af01..c7662dc 100644 (file)
--- a/sbin/unwind/libunbound/util/iana_ports.inc
+++ b/sbin/unwind/libunbound/util/iana_ports.inc
@@ -2499,6 +2499,7 @@
 2870,
 2871,
 2872,
+2873,
 2874,
 2875,
 2876,
@@ -3783,6 +3784,7 @@
 4308,
 4309,
 4310,
+4319,
 4320,
 4321,
 4322,
@@ -4053,7 +4055,6 @@
 5026,
 5027,
 5029,
-5030,
 5031,
 5042,
 5043,

diff --git a/sbin/unwind/libunbound/util/mini_event.c b/sbin/unwind/libunbound/util/mini_event.c
index 661d88d..c05dc66 100644 (file)
--- a/sbin/unwind/libunbound/util/mini_event.c
+++ b/sbin/unwind/libunbound/util/mini_event.c
@@ -337,6 +337,15 @@ int event_del(struct event* ev)
                FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->writes);
                FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->ready);
                FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->content);
+               if(ev->ev_fd == ev->ev_base->maxfd) {
+                        int i = ev->ev_base->maxfd - 1;
+                        for (; i > 3; i--) {
+                                if (NULL != ev->ev_base->fds[i]) {
+                                        break;
+                                }
+                        }
+                        ev->ev_base->maxfd = i;
+                }
        }
        ev->added = 0;
        return 0;

diff --git a/sbin/unwind/libunbound/util/module.h b/sbin/unwind/libunbound/util/module.h
index 81a31a9..7a54800 100644 (file)
--- a/sbin/unwind/libunbound/util/module.h
+++ b/sbin/unwind/libunbound/util/module.h
@@ -350,14 +350,18 @@ struct module_env {
         *      EDNS, the answer is likely to be useless for this domain.
         * @param nocaps: do not use caps_for_id, use the qname as given.
         *      (ignored if caps_for_id is disabled).
+        * @param check_ratelimit: if set, will check ratelimit before sending out.
         * @param addr: where to.
         * @param addrlen: length of addr.
         * @param zone: delegation point name.
         * @param zonelen: length of zone name.
+        * @param tcp_upstream: use TCP for upstream queries.
         * @param ssl_upstream: use SSL for upstream queries.
         * @param tls_auth_name: if ssl_upstream, use this name with TLS
         *      authentication.
-        * @param q: wich query state to reactivate upon return.
+        * @param q: which query state to reactivate upon return.
+        * @param was_ratelimited: it will signal back if the query failed to pass the
+        *      ratelimit check.
         * @return: false on failure (memory or socket related). no query was
         *      sent. Or returns an outbound entry with qsent and qstate set.
         *      This outbound_entry will be used on later module invocations
@@ -365,9 +369,10 @@ struct module_env {
         */
        struct outbound_entry* (*send_query)(struct query_info* qinfo,
                uint16_t flags, int dnssec, int want_dnssec, int nocaps,
+               int check_ratelimit,
                struct sockaddr_storage* addr, socklen_t addrlen,
-               uint8_t* zone, size_t zonelen, int ssl_upstream,
-               char* tls_auth_name, struct module_qstate* q);
+               uint8_t* zone, size_t zonelen, int tcp_upstream, int ssl_upstream,
+               char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
 
        /**
         * Detach-subqueries.

diff --git a/sbin/unwind/libunbound/util/net_help.c b/sbin/unwind/libunbound/util/net_help.c
index f8b6090..8bef568 100644 (file)
--- a/sbin/unwind/libunbound/util/net_help.c
+++ b/sbin/unwind/libunbound/util/net_help.c
@@ -44,6 +44,9 @@
 #ifdef HAVE_NET_IF_H
 #include <net/if.h>
 #endif
+#ifdef HAVE_NETIOAPI_H
+#include <netioapi.h>
+#endif
 #include "util/net_help.h"
 #include "util/log.h"
 #include "util/data/dname.h"
@@ -52,6 +55,7 @@
 #include "util/config_file.h"
 #include "sldns/parseutil.h"
 #include "sldns/wire2str.h"
+#include "sldns/str2wire.h"
 #include <fcntl.h>
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -476,6 +480,42 @@ int authextstrtoaddr(char* str, struct sockaddr_storage* addr,
        return ipstrtoaddr(str, port, addr, addrlen);
 }
 
+uint8_t* authextstrtodname(char* str, int* port, char** auth_name)
+{
+       char* s;
+       uint8_t* dname;
+       size_t dname_len;
+       *port = UNBOUND_DNS_PORT;
+       *auth_name = NULL;
+       if((s=strchr(str, '@'))) {
+               char* hash = strchr(s+1, '#');
+               if(hash) {
+                       *auth_name = hash+1;
+               } else {
+                       *auth_name = NULL;
+               }
+               *port = atoi(s+1);
+               if(*port == 0) {
+                       if(!hash && strcmp(s+1,"0")!=0)
+                               return 0;
+                       if(hash && strncmp(s+1,"0#",2)!=0)
+                               return 0;
+               }
+               *s = 0;
+               dname = sldns_str2wire_dname(str, &dname_len);
+               *s = '@';
+       } else if((s=strchr(str, '#'))) {
+               *port = UNBOUND_DNS_OVER_TLS_PORT;
+               *auth_name = s+1;
+               *s = 0;
+               dname = sldns_str2wire_dname(str, &dname_len);
+               *s = '#';
+       } else {
+               dname = sldns_str2wire_dname(str, &dname_len);
+       }
+       return dname;
+}
+
 /** store port number into sockaddr structure */
 void
 sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen, int port)
@@ -890,6 +930,12 @@ log_cert(unsigned level, const char* str, void* cert)
        BIO_write(bio, &nul, (int)sizeof(nul));
        len = BIO_get_mem_data(bio, &pp);
        if(len != 0 && pp) {
+               /* reduce size of cert printout */
+               char* s;
+               while((s=strstr(pp, "  "))!=NULL)
+                       memmove(s, s+1, strlen(s+1)+1);
+               while((s=strstr(pp, "\t\t"))!=NULL)
+                       memmove(s, s+1, strlen(s+1)+1);
                verbose(level, "%s: \n%s", str, pp);
        }
        BIO_free(bio);
@@ -954,9 +1000,12 @@ listen_sslctx_setup(void* ctxt)
        }
 #endif
 #if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA)
+       /* if we detect system-wide crypto policies, use those */
+       if (access( "/etc/crypto-policies/config", F_OK ) != 0 ) {
        /* if we have sha256, set the cipher list to have no known vulns */
-       if(!SSL_CTX_set_cipher_list(ctx, "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
-               log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
+               if(!SSL_CTX_set_cipher_list(ctx, "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
+                       log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
+       }
 #endif
 
        if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
@@ -1181,6 +1230,7 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
        if((SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION) &
                SSL_OP_NO_RENEGOTIATION) != SSL_OP_NO_RENEGOTIATION) {
                log_crypto_err("could not set SSL_OP_NO_RENEGOTIATION");
+               SSL_CTX_free(ctx);
                return 0;
        }
 #endif

diff --git a/sbin/unwind/libunbound/util/net_help.h b/sbin/unwind/libunbound/util/net_help.h
index 7983527..4dd3984 100644 (file)
--- a/sbin/unwind/libunbound/util/net_help.h
+++ b/sbin/unwind/libunbound/util/net_help.h
@@ -210,17 +210,30 @@ int netblockstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr,
 /**
  * Convert address string, with "@port" appendix, to sockaddr.
  * It can also have an "#tls-auth-name" appendix (after the port).
- * The returned tls-auth-name string is a pointer into the input string.
- * Uses DNS port by default.
+ * The returned auth_name string is a pointer into the input string.
+ * Uses DNS port by default; TLS port when a "#tls-auth-name" is configured.
  * @param str: the string
  * @param addr: where to store sockaddr.
  * @param addrlen: length of stored sockaddr is returned.
  * @param auth_name: returned pointer to tls_auth_name, or NULL if none.
  * @return 0 on error.
  */
-int authextstrtoaddr(char* str, struct sockaddr_storage* addr, 
+int authextstrtoaddr(char* str, struct sockaddr_storage* addr,
        socklen_t* addrlen, char** auth_name);
 
+/**
+ * Convert domain string, with "@port" appendix, to dname.
+ * It can also have an "#tls-auth-name" appendix (after the port).
+ * The return port is the parsed port.
+ * Uses DNS port by default; TLS port when a "#tls-auth-name" is configured.
+ * The returned auth_name string is a pointer into the input string.
+ * @param str: the string
+ * @param port: pointer to be assigned the parsed port value.
+ * @param auth_name: returned pointer to tls_auth_name, or NULL if none.
+ * @return pointer to the dname.
+ */
+uint8_t* authextstrtodname(char* str, int* port, char** auth_name);
+
 /**
  * Store port number into sockaddr structure
  * @param addr: sockaddr structure, ip4 or ip6.

diff --git a/sbin/unwind/libunbound/util/netevent.c b/sbin/unwind/libunbound/util/netevent.c
index 11c642a..b9b7230 100644 (file)
--- a/sbin/unwind/libunbound/util/netevent.c
+++ b/sbin/unwind/libunbound/util/netevent.c
@@ -300,6 +300,7 @@ udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
                case ENETDOWN:
 #  endif
                case EPERM:
+               case EACCES:
                        if(verbosity < VERB_ALGO)
                                return 0;
                default:
@@ -817,6 +818,7 @@ setup_tcp_handler(struct comm_point* c, int fd, int cur, int max)
 #endif
        c->tcp_is_reading = 1;
        c->tcp_byte_count = 0;
+       c->tcp_keepalive = 0;
        /* if more than half the tcp handlers are in use, use a shorter
         * timeout for this TCP connection, we need to make space for
         * other connections to be able to get attention */
@@ -942,7 +944,16 @@ int comm_point_perform_accept(struct comm_point* c,
 
 #ifdef USE_WINSOCK
 static long win_bio_cb(BIO *b, int oper, const char* ATTR_UNUSED(argp),
-        int ATTR_UNUSED(argi), long argl, long retvalue)
+#ifdef HAVE_BIO_SET_CALLBACK_EX
+       size_t ATTR_UNUSED(len),
+#endif
+        int ATTR_UNUSED(argi), long argl,
+#ifndef HAVE_BIO_SET_CALLBACK_EX
+       long retvalue
+#else
+       int retvalue, size_t* ATTR_UNUSED(processed)
+#endif
+       )
 {
        int wsa_err = WSAGetLastError(); /* store errcode before it is gone */
        verbose(VERB_ALGO, "bio_cb %d, %s %s %s", oper,
@@ -972,9 +983,17 @@ comm_point_tcp_win_bio_cb(struct comm_point* c, void* thessl)
 {
        SSL* ssl = (SSL*)thessl;
        /* set them both just in case, but usually they are the same BIO */
+#ifdef HAVE_BIO_SET_CALLBACK_EX
+       BIO_set_callback_ex(SSL_get_rbio(ssl), &win_bio_cb);
+#else
        BIO_set_callback(SSL_get_rbio(ssl), &win_bio_cb);
+#endif
        BIO_set_callback_arg(SSL_get_rbio(ssl), (char*)c->ev->ev);
+#ifdef HAVE_BIO_SET_CALLBACK_EX
+       BIO_set_callback_ex(SSL_get_wbio(ssl), &win_bio_cb);
+#else
        BIO_set_callback(SSL_get_wbio(ssl), &win_bio_cb);
+#endif
        BIO_set_callback_arg(SSL_get_wbio(ssl), (char*)c->ev->ev);
 }
 #endif
@@ -1036,6 +1055,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
        /* clear leftover flags from previous use, and then set the
         * correct event base for the event structure for libevent */
        ub_event_free(c_hdl->ev->ev);
+       c_hdl->ev->ev = NULL;
        if((c_hdl->type == comm_tcp && c_hdl->tcp_req_info) ||
                c_hdl->type == comm_local || c_hdl->type == comm_raw)
                c_hdl->tcp_do_toggle_rw = 0;
@@ -1092,6 +1112,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
        /* grab the tcp handler buffers */
        c->cur_tcp_count++;
        c->tcp_free = c_hdl->tcp_free;
+       c_hdl->tcp_free = NULL;
        if(!c->tcp_free) {
                /* stop accepting incoming queries for now. */
                comm_point_stop_listening(c);
@@ -1113,9 +1134,11 @@ reclaim_tcp_handler(struct comm_point* c)
        }
        comm_point_close(c);
        if(c->tcp_parent) {
-               c->tcp_parent->cur_tcp_count--;
-               c->tcp_free = c->tcp_parent->tcp_free;
-               c->tcp_parent->tcp_free = c;
+               if(c != c->tcp_parent->tcp_free) {
+                       c->tcp_parent->cur_tcp_count--;
+                       c->tcp_free = c->tcp_parent->tcp_free;
+                       c->tcp_parent->tcp_free = c;
+               }
                if(!c->tcp_free) {
                        /* re-enable listening on accept socket */
                        comm_point_start_listening(c->tcp_parent, -1, -1);
@@ -1123,6 +1146,8 @@ reclaim_tcp_handler(struct comm_point* c)
        }
        c->tcp_more_read_again = NULL;
        c->tcp_more_write_again = NULL;
+       c->tcp_byte_count = 0;
+       sldns_buffer_clear(c->buffer);
 }
 
 /** do the callback when writing is done */
@@ -1862,13 +1887,22 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
                        if(errno == EINTR || errno == EAGAIN)
                                return 1;
                        /* Not handling EISCONN here as shouldn't ever hit that case.*/
-                       if(errno != EPIPE && errno != 0 && verbosity < 2)
-                               return 0; /* silence lots of chatter in the logs */
-                       if(errno != EPIPE && errno != 0) {
+                       if(errno != EPIPE
+#ifdef EOPNOTSUPP
+                               /* if /proc/sys/net/ipv4/tcp_fastopen is
+                                * disabled on Linux, sendmsg may return
+                                * 'Operation not supported', if so
+                                * fallthrough to ordinary connect. */
+                               && errno != EOPNOTSUPP
+#endif
+                               && errno != 0) {
+                               if(verbosity < 2)
+                                       return 0; /* silence lots of chatter in the logs */
                                log_err_addr("tcp sendmsg", strerror(errno),
                                        &c->repinfo.addr, c->repinfo.addrlen);
                                return 0;
                        }
+                       verbose(VERB_ALGO, "tcp sendmsg for fastopen failed (with %s), try normal connect", strerror(errno));
                        /* fallthrough to nonFASTOPEN
                         * (MSG_FASTOPEN on Linux 3 produces EPIPE)
                         * we need to perform connect() */
@@ -2201,9 +2235,11 @@ reclaim_http_handler(struct comm_point* c)
        }
        comm_point_close(c);
        if(c->tcp_parent) {
-               c->tcp_parent->cur_tcp_count--;
-               c->tcp_free = c->tcp_parent->tcp_free;
-               c->tcp_parent->tcp_free = c;
+               if(c != c->tcp_parent->tcp_free) {
+                       c->tcp_parent->cur_tcp_count--;
+                       c->tcp_free = c->tcp_parent->tcp_free;
+                       c->tcp_parent->tcp_free = c;
+               }
                if(!c->tcp_free) {
                        /* re-enable listening on accept socket */
                        comm_point_start_listening(c->tcp_parent, -1, -1);
@@ -4140,6 +4176,10 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
                c->timeout->tv_sec = msec/1000;
                c->timeout->tv_usec = (msec%1000)*1000;
 #endif /* S_SPLINT_S */
+       } else {
+               if(msec == 0 || !c->timeout) {
+                       ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT);
+               }
        }
        if(c->type == comm_tcp || c->type == comm_http) {
                ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE);
@@ -4164,6 +4204,7 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
        }
        if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) {
                log_err("event_add failed. in cpsl.");
+               return;
        }
        c->event_added = 1;
 }
@@ -4177,11 +4218,15 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
                }
                c->event_added = 0;
        }
+       if(!c->timeout) {
+               ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT);
+       }
        ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE);
        if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ);
        if(wr) ub_event_add_bits(c->ev->ev, UB_EV_WRITE);
        if(ub_event_add(c->ev->ev, c->timeout) != 0) {
                log_err("event_add failed. in cplf.");
+               return;
        }
        c->event_added = 1;
 }

diff --git a/sbin/unwind/libunbound/util/netevent.h b/sbin/unwind/libunbound/util/netevent.h
index c79f99b..9f4d28b 100644 (file)
--- a/sbin/unwind/libunbound/util/netevent.h
+++ b/sbin/unwind/libunbound/util/netevent.h
@@ -743,7 +743,7 @@ struct comm_signal* comm_signal_create(struct comm_base* base,
        void (*callback)(int, void*), void* cb_arg);
 
 /**
- * Bind signal struct to catch a signal. A signle comm_signal can be bound
+ * Bind signal struct to catch a signal. A single comm_signal can be bound
  * to multiple signals, calling comm_signal_bind multiple times.
  * @param comsig: the communication point, with callback information.
  * @param sig: signal number.

diff --git a/sbin/unwind/libunbound/util/regional.c b/sbin/unwind/libunbound/util/regional.c
index bd67ecf..93e911c 100644 (file)
--- a/sbin/unwind/libunbound/util/regional.c
+++ b/sbin/unwind/libunbound/util/regional.c
@@ -103,6 +103,8 @@ regional_create_custom_large_object(size_t size, size_t large_object_size)
 struct regional*
 regional_create_custom(size_t size)
 {
+       if(size < sizeof(struct regional))
+               size = sizeof(struct regional);
        return regional_create_custom_large_object(size,
                REGIONAL_LARGE_OBJECT_SIZE);
 }

diff --git a/sbin/unwind/libunbound/util/shm_side/shm_main.c b/sbin/unwind/libunbound/util/shm_side/shm_main.c
index 51039ab..6fd1f5e 100644 (file)
--- a/sbin/unwind/libunbound/util/shm_side/shm_main.c
+++ b/sbin/unwind/libunbound/util/shm_side/shm_main.c
@@ -281,7 +281,7 @@ void shm_main_run(struct worker *worker)
                shm_stat->mem.subnet = 0;
 #ifdef CLIENT_SUBNET
                shm_stat->mem.subnet = (long long)mod_get_mem(&worker->env,
-                       "subnet");
+                       "subnetcache");
 #endif
                /* ipsecmod mem value is available in shm, also when not enabled,
                 * to make the struct easier to memmap by other applications,

diff --git a/sbin/unwind/libunbound/util/tube.c b/sbin/unwind/libunbound/util/tube.c
index dc6e3c2..40556e7 100644 (file)
--- a/sbin/unwind/libunbound/util/tube.c
+++ b/sbin/unwind/libunbound/util/tube.c
@@ -363,7 +363,11 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
                }
                d += r;
        }
-       log_assert(*len < 65536*2);
+       if (*len >= 65536*2) {
+               log_err("tube msg length %u is too big", (unsigned)*len);
+               (void)fd_set_nonblock(fd);
+               return 0;
+       }
        *buf = (uint8_t*)malloc(*len);
        if(!*buf) {
                log_err("tube read out of memory");

diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c
index 9643a3d..55e82c1 100644 (file)
--- a/sbin/unwind/libunbound/validator/autotrust.c
+++ b/sbin/unwind/libunbound/validator/autotrust.c
@@ -2377,7 +2377,9 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
        edns.ext_rcode = 0;
        edns.edns_version = 0;
        edns.bits = EDNS_DO;
-       edns.opt_list = NULL;
+       edns.opt_list_in = NULL;
+       edns.opt_list_out = NULL;
+       edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);

diff --git a/sbin/unwind/libunbound/validator/val_utils.c b/sbin/unwind/libunbound/validator/val_utils.c
index dd8d320..bb366d3 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_utils.c
+++ b/sbin/unwind/libunbound/validator/val_utils.c
@@ -767,15 +767,15 @@ val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
                sldns_lookup_table *lt;
                char herr[64], aerr[64];
                lt = sldns_lookup_by_id(sldns_hashes,
-                       (int)ds_get_digest_algo(ds_rrset, i));
+                       (int)ds_get_digest_algo(ds_rrset, 0));
                if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
                else snprintf(herr, sizeof(herr), "%d",
-                       (int)ds_get_digest_algo(ds_rrset, i));
+                       (int)ds_get_digest_algo(ds_rrset, 0));
                lt = sldns_lookup_by_id(sldns_algorithms,
-                       (int)ds_get_key_algo(ds_rrset, i));
+                       (int)ds_get_key_algo(ds_rrset, 0));
                if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
                else snprintf(aerr, sizeof(aerr), "%d",
-                       (int)ds_get_key_algo(ds_rrset, i));
+                       (int)ds_get_key_algo(ds_rrset, 0));
                verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
                        "key algorithm %s %s", herr,
                        (ds_digest_algo_is_supported(ds_rrset, 0)?

diff --git a/sbin/unwind/libunbound/validator/validator.c b/sbin/unwind/libunbound/validator/validator.c
index d4d48d9..e630728 100644 (file)
--- a/sbin/unwind/libunbound/validator/validator.c
+++ b/sbin/unwind/libunbound/validator/validator.c
@@ -140,7 +140,7 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env,
        val_env->max_restart = cfg->val_max_restart;
        c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
        if(c < 1 || (c&1)) {
-               log_err("validator: unparseable or odd nsec3 key "
+               log_err("validator: unparsable or odd nsec3 key "
                        "iterations: %s", cfg->val_nsec3_key_iterations);
                return 0;
        }
@@ -484,7 +484,7 @@ generate_keytag_query(struct module_qstate* qstate, int id,
                return 0;
        }
 
-       /* Not interrested in subquery response. Restore the ext_state,
+       /* Not interested in subquery response. Restore the ext_state,
         * that might be changed by generate_request() */
        qstate->ext_state[id] = ext_state;
 

diff --git a/sbin/unwind/libunbound/validator/validator.h b/sbin/unwind/libunbound/validator/validator.h
index a928e10..a97eab2 100644 (file)
--- a/sbin/unwind/libunbound/validator/validator.h
+++ b/sbin/unwind/libunbound/validator/validator.h
@@ -68,7 +68,7 @@ struct config_strlist;
 #define SENTINEL_IS            "root-key-sentinel-is-ta-"
 /** Root key sentinel is not ta preamble */
 #define SENTINEL_NOT           "root-key-sentinel-not-ta-"
-/** Root key sentinal keytag length */
+/** Root key sentinel keytag length */
 #define SENTINEL_KEYTAG_LEN    5
 
 /**