sync to unbound 1.18.0; heavy lifting by sthen

diff --git a/sbin/unwind/libunbound/config.h b/sbin/unwind/libunbound/config.h
index 8e31919..eac77c3 100644 (file)
--- a/sbin/unwind/libunbound/config.h
+++ b/sbin/unwind/libunbound/config.h
@@ -368,6 +368,9 @@
 /* Define if we have LibreSSL */
 #define HAVE_LIBRESSL 1
 
+/* Define to 1 if you have the <linux/net_tstamp.h> header file. */
+/* #undef HAVE_LINUX_NET_TSTAMP_H */
+
 /* Define to 1 if you have the `localtime_r' function. */
 #define HAVE_LOCALTIME_R 1
 
@@ -773,7 +776,7 @@
 #define PACKAGE_NAME "unbound"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "unbound 1.17.0"
+#define PACKAGE_STRING "unbound 1.18.0"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "unbound"
@@ -782,7 +785,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.17.0"
+#define PACKAGE_VERSION "1.18.0"
 
 /* default pidfile location */
 #define PIDFILE ""
@@ -805,7 +808,7 @@
 #define ROOT_CERT_FILE "/var/unbound/etc/icannbundle.pem"
 
 /* version number for resource files */
-#define RSRC_PACKAGE_VERSION 1,17,0,0
+#define RSRC_PACKAGE_VERSION 1,18,0,0
 
 /* Directory to chdir to */
 #define RUN_DIR "/var/unbound/etc"
@@ -1072,39 +1075,39 @@
 
 #if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
 #define _GNU_SOURCE 1
-#endif 
+#endif
 
 #if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE)
 #define _BSD_SOURCE 1
-#endif 
+#endif
 
 #if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
 #define _DEFAULT_SOURCE 1
-#endif 
+#endif
 
 #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
 #define __EXTENSIONS__ 1
-#endif 
+#endif
 
 #if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE)
 #define _POSIX_C_SOURCE 200112
-#endif 
+#endif
 
 #if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE)
 #define _XOPEN_SOURCE 600
-#endif 
+#endif
 
 #if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED)
 #define _XOPEN_SOURCE_EXTENDED 1
-#endif 
+#endif
 
 #if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE)
 #define _ALL_SOURCE 1
-#endif 
+#endif
 
 #if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE)
 #define _LARGEFILE_SOURCE 1
-#endif 
+#endif
 
 
 
@@ -1188,7 +1191,7 @@
 #endif
 
 
- 
+
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
     __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -1298,7 +1301,7 @@ void* reallocarray(void *ptr, size_t nmemb, size_t size);
 #ifdef HAVE_WINSOCK2_H
 #define FD_SET_T (u_int)
 #else
-#define FD_SET_T 
+#define FD_SET_T
 #endif
 
 

diff --git a/sbin/unwind/libunbound/daemon/acl_list.h b/sbin/unwind/libunbound/daemon/acl_list.h
index c717179..9da43be 100644 (file)
--- a/sbin/unwind/libunbound/daemon/acl_list.h
+++ b/sbin/unwind/libunbound/daemon/acl_list.h
@@ -64,8 +64,12 @@ enum acl_access {
        acl_allow,
        /** allow full access for all queries, recursion and cache snooping */
        acl_allow_snoop,
-       /** allow full access for recursion queries and set RD flag regardless of request */
-       acl_allow_setrd
+       /** allow full access for recursion queries and set RD flag regardless
+        *  of request */
+       acl_allow_setrd,
+       /** allow full access for recursion (+RD) queries if valid cookie
+        *  present or stateful transport */
+       acl_allow_cookie
 };
 
 /**

diff --git a/sbin/unwind/libunbound/daemon/stats.h b/sbin/unwind/libunbound/daemon/stats.h
index 4e5e6cf..47bb20d 100644 (file)
--- a/sbin/unwind/libunbound/daemon/stats.h
+++ b/sbin/unwind/libunbound/daemon/stats.h
@@ -126,4 +126,11 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
  */
 void server_stats_insrcode(struct ub_server_stats* stats, struct sldns_buffer* buf);
 
+/**
+ * Add DNS Cookie stats for this query
+ * @param stats: the stats
+ * @param edns: edns record
+ */
+void server_stats_downstream_cookie(struct ub_server_stats* stats,
+       struct edns_data* edns);
 #endif /* DAEMON_STATS_H */

diff --git a/sbin/unwind/libunbound/daemon/worker.h b/sbin/unwind/libunbound/daemon/worker.h
index 3fb52ab..ab2fc72 100644 (file)
--- a/sbin/unwind/libunbound/daemon/worker.h
+++ b/sbin/unwind/libunbound/daemon/worker.h
@@ -118,7 +118,7 @@ struct worker {
        /** do we need to restart or quit (on signal) */
        int need_to_exit;
        /** allocation cache for this thread */
-       struct alloc_cache alloc;
+       struct alloc_cache *alloc;
        /** per thread statistics */
        struct ub_server_stats stats;
        /** thread scratch regional */
@@ -131,6 +131,8 @@ struct worker {
        /** dnstap environment, changed for this thread */
        struct dt_env dtenv;
 #endif
+       /** reuse existing cache on reload if other conditions allow it. */
+       int reuse_cache;
 };
 
 /**

diff --git a/sbin/unwind/libunbound/dns64/dns64.c b/sbin/unwind/libunbound/dns64/dns64.c
index 4b98b60..1e31f51 100644 (file)
--- a/sbin/unwind/libunbound/dns64/dns64.c
+++ b/sbin/unwind/libunbound/dns64/dns64.c
@@ -59,7 +59,7 @@
  ******************************************************************************/
 
 /**
- * This is the default DNS64 prefix that is used whent he dns64 module is listed
+ * This is the default DNS64 prefix that is used when the dns64 module is listed
  * in module-config but when the dns64-prefix variable is not present.
  */
 static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";
@@ -841,7 +841,7 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
        cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
                rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
                rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
-               rep->rrset_count, rep->security);
+               rep->rrset_count, rep->security, LDNS_EDE_NONE);
        if(!cp)
                return;
 

diff --git a/sbin/unwind/libunbound/dnstap/dnstap.h b/sbin/unwind/libunbound/dnstap/dnstap.h
index 449fae7..169bdc2 100644 (file)
--- a/sbin/unwind/libunbound/dnstap/dnstap.h
+++ b/sbin/unwind/libunbound/dnstap/dnstap.h
@@ -126,13 +126,15 @@ dt_delete(struct dt_env *env);
  * @param rsock: local (service) address/port.
  * @param cptype: comm_udp or comm_tcp.
  * @param qmsg: query message.
+ * @param tstamp: timestamp or NULL if none provided.
  */
 void
 dt_msg_send_client_query(struct dt_env *env,
                         struct sockaddr_storage *qsock,
                         struct sockaddr_storage *rsock,
                         enum comm_point_type cptype,
-                        struct sldns_buffer *qmsg);
+                        struct sldns_buffer *qmsg,
+                        struct timeval* tstamp);
 
 /**
  * Create and send a new dnstap "Message" event of type CLIENT_RESPONSE.

diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.c b/sbin/unwind/libunbound/iterator/iter_delegpt.c
index fd07aaa..c8b9a3f 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_delegpt.c
+++ b/sbin/unwind/libunbound/iterator/iter_delegpt.c
@@ -321,6 +321,45 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
        }
 }
 
+int
+delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find)
+{
+       struct delegpt_addr* a = dp->result_list;
+       while(a) {
+               if(a == find)
+                       return 1;
+               a = a->next_result;
+       }
+       return 0;
+}
+
+void
+delegpt_usable_list_remove_addr(struct delegpt* dp, struct delegpt_addr* del)
+{
+       struct delegpt_addr* usa = dp->usable_list, *prev = NULL;
+       while(usa) {
+               if(usa == del) {
+                       /* snip off the usable list */
+                       if(prev)
+                               prev->next_usable = usa->next_usable;
+                       else    dp->usable_list = usa->next_usable;
+                       return;
+               }
+               prev = usa;
+               usa = usa->next_usable;
+       }
+}
+
+void
+delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a)
+{
+       if(delegpt_addr_on_result_list(dp, a))
+               return;
+       delegpt_usable_list_remove_addr(dp, a);
+       a->next_result = dp->result_list;
+       dp->result_list = a;
+}
+
 void 
 delegpt_add_unused_targets(struct delegpt* dp)
 {

diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.h b/sbin/unwind/libunbound/iterator/iter_delegpt.h
index 586597a..49f6f6b 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_delegpt.h
+++ b/sbin/unwind/libunbound/iterator/iter_delegpt.h
@@ -457,4 +457,29 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen,
 /** get memory in use by dp */
 size_t delegpt_get_mem(struct delegpt* dp);
 
+/**
+ * See if the addr is on the result list.
+ * @param dp: delegation point.
+ * @param find: the pointer is searched for on the result list.
+ * @return 1 if found, 0 if not found.
+ */
+int delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find);
+
+/**
+ * Remove the addr from the usable list.
+ * @param dp: the delegation point.
+ * @param del: the addr to remove from the list, the pointer is searched for.
+ */
+void delegpt_usable_list_remove_addr(struct delegpt* dp,
+       struct delegpt_addr* del);
+
+/**
+ * Add the delegpt_addr back to the result list, if it is not already on
+ * the result list. Also removes it from the usable list.
+ * @param dp: delegation point.
+ * @param a: addr to add, nothing happens if it is already on the result list.
+ *     It is removed from the usable list.
+ */
+void delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */

diff --git a/sbin/unwind/libunbound/iterator/iter_resptype.c b/sbin/unwind/libunbound/iterator/iter_resptype.c
index c2b824a..e85595b 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_resptype.c
+++ b/sbin/unwind/libunbound/iterator/iter_resptype.c
@@ -284,6 +284,13 @@ response_type_from_server(int rdset,
 
        /* If we've gotten this far, this is NOERROR/NODATA (which could 
         * be an entirely empty message) */
+       /* but ignore entirely empty messages, noerror/nodata has a soa
+        * negative ttl value in the authority section, this makes it try
+        * again at another authority. And turns it from a 5 second empty
+        * message into a 5 second servfail response. */
+       if(msg->rep->an_numrrsets == 0 && msg->rep->ns_numrrsets == 0 &&
+               msg->rep->ar_numrrsets == 0)
+               return RESPONSE_TYPE_THROWAWAY;
        /* check if recursive answer; saying it has empty cache */
        if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset)
                return RESPONSE_TYPE_REC_LAME;

diff --git a/sbin/unwind/libunbound/iterator/iter_scrub.c b/sbin/unwind/libunbound/iterator/iter_scrub.c
index f093c1b..d1fedcd 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_scrub.c
+++ b/sbin/unwind/libunbound/iterator/iter_scrub.c
@@ -346,6 +346,26 @@ soa_in_auth(struct msg_parse* msg)
        return 0;
 }
 
+/** Check if type is allowed in the authority section */
+static int
+type_allowed_in_authority_section(uint16_t tp)
+{
+       if(tp == LDNS_RR_TYPE_SOA || tp == LDNS_RR_TYPE_NS ||
+               tp == LDNS_RR_TYPE_DS || tp == LDNS_RR_TYPE_NSEC ||
+               tp == LDNS_RR_TYPE_NSEC3)
+               return 1;
+       return 0;
+}
+
+/** Check if type is allowed in the additional section */
+static int
+type_allowed_in_additional_section(uint16_t tp)
+{
+       if(tp == LDNS_RR_TYPE_A || tp == LDNS_RR_TYPE_AAAA)
+               return 1;
+       return 0;
+}
+
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -355,11 +375,13 @@ soa_in_auth(struct msg_parse* msg)
  * @param msg: msg to normalize.
  * @param qinfo: original query.
  * @param region: where to allocate synthesized CNAMEs.
+ * @param env: module env with config options.
  * @return 0 on error.
  */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
-       struct query_info* qinfo, struct regional* region)
+       struct query_info* qinfo, struct regional* region,
+       struct module_env* env)
 {
        uint8_t* sname = qinfo->qname;
        size_t snamelen = qinfo->qname_len;
@@ -511,6 +533,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 
        /* Mark additional names from AUTHORITY */
        while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
+               /* protect internals of recursor by making sure to del these */
                if(rrset->type==LDNS_RR_TYPE_DNAME ||
                        rrset->type==LDNS_RR_TYPE_CNAME ||
                        rrset->type==LDNS_RR_TYPE_A ||
@@ -519,6 +542,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                "RRset:", pkt, msg, prev, &rrset);
                        continue;
                }
+               /* Allowed list of types in the authority section */
+               if(env->cfg->harden_unknown_additional &&
+                       !type_allowed_in_authority_section(rrset->type)) {
+                       remove_rrset("normalize: removing irrelevant "
+                               "RRset:", pkt, msg, prev, &rrset);
+                       continue;
+               }
                /* only one NS set allowed in authority section */
                if(rrset->type==LDNS_RR_TYPE_NS) {
                        /* NS set must be pertinent to the query */
@@ -576,7 +606,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
         * found in ANSWER and AUTHORITY. */
        /* These records have not been marked OK previously */
        while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
-               /* FIXME: what about other types? */
                if(rrset->type==LDNS_RR_TYPE_A || 
                        rrset->type==LDNS_RR_TYPE_AAAA) 
                {
@@ -589,6 +618,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                continue;
                        }
                }
+               /* protect internals of recursor by making sure to del these */
                if(rrset->type==LDNS_RR_TYPE_DNAME || 
                        rrset->type==LDNS_RR_TYPE_CNAME ||
                        rrset->type==LDNS_RR_TYPE_NS) {
@@ -596,6 +626,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                "RRset:", pkt, msg, prev, &rrset);
                        continue;
                }
+               /* Allowed list of types in the additional section */
+               if(env->cfg->harden_unknown_additional &&
+                       !type_allowed_in_additional_section(rrset->type)) {
+                       remove_rrset("normalize: removing irrelevant "
+                               "RRset:", pkt, msg, prev, &rrset);
+                       continue;
+               }
                prev = rrset;
                rrset = rrset->rrset_all_next;
        }
@@ -846,7 +883,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
        }
 
        /* normalize the response, this cleans up the additional.  */
-       if(!scrub_normalize(pkt, msg, qinfo, region))
+       if(!scrub_normalize(pkt, msg, qinfo, region, env))
                return 0;
        /* delete all out-of-zone information */
        if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))

diff --git a/sbin/unwind/libunbound/iterator/iter_utils.c b/sbin/unwind/libunbound/iterator/iter_utils.c
index 56b184a..10a8ec3 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_utils.c
+++ b/sbin/unwind/libunbound/iterator/iter_utils.c
@@ -71,6 +71,11 @@
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
 
+/** if NAT64 is enabled and no NAT64 prefix is configured, first fall back to
+ * DNS64 prefix.  If that is not configured, fall back to this default value.
+ */
+static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96";
+
 /** fillup fetch policy array */
 static void
 fetch_fill(struct iter_env* ie, const char* str)
@@ -142,6 +147,7 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 int
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
+       const char *nat64_prefix;
        int i;
        /* target fetch policy */
        if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
@@ -172,9 +178,35 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
                }
 
        }
+
+       nat64_prefix = cfg->nat64_prefix;
+       if(!nat64_prefix)
+               nat64_prefix = cfg->dns64_prefix;
+       if(!nat64_prefix)
+               nat64_prefix = DEFAULT_NAT64_PREFIX;
+       if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr,
+               &iter_env->nat64_prefix_addrlen,
+               &iter_env->nat64_prefix_net)) {
+               log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
+               return 0;
+       }
+       if(!addr_is_ip6(&iter_env->nat64_prefix_addr,
+               iter_env->nat64_prefix_addrlen)) {
+               log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
+               return 0;
+       }
+       if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) {
+               log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+                       nat64_prefix);
+               return 0;
+       }
+
        iter_env->supports_ipv6 = cfg->do_ip6;
        iter_env->supports_ipv4 = cfg->do_ip4;
+       iter_env->use_nat64 = cfg->do_nat64;
        iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
+       iter_env->max_sent_count = cfg->max_sent_count;
+       iter_env->max_query_restarts = cfg->max_query_restarts;
        return 1;
 }
 
@@ -238,7 +270,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
        if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
                return -1; /* there is no ip6 available */
        }
-       if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
+       if(!iter_env->supports_ipv4 && !iter_env->use_nat64 &&
+          !addr_is_ip6(&a->addr, a->addrlen)) {
                return -1; /* there is no ip4 available */
        }
        /* check lameness - need zone , class info */
@@ -745,10 +778,15 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 
 int
 iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-       struct delegpt* dp, int supports_ipv4, int supports_ipv6)
+       struct delegpt* dp, int supports_ipv4, int supports_ipv6,
+       int use_nat64)
 {
        struct delegpt_ns* ns;
        struct delegpt_addr* a;
+
+       if(supports_ipv6 && use_nat64)
+               supports_ipv4 = 1;
+
        /* check:
         *      o RD qflag is on.
         *      o no addresses are provided.
@@ -1308,8 +1346,7 @@ void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry)
        for(a=dp->target_list; a; a = a->next_target) {
                if(a->attempts >= outbound_msg_retry) {
                        /* add back to result list */
-                       a->next_result = dp->result_list;
-                       dp->result_list = a;
+                       delegpt_add_to_result_list(dp, a);
                }
                if(a->attempts > d)
                        a->attempts -= d;

diff --git a/sbin/unwind/libunbound/iterator/iter_utils.h b/sbin/unwind/libunbound/iterator/iter_utils.h
index 850be96..fa860fa 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iter_utils.h
+++ b/sbin/unwind/libunbound/iterator/iter_utils.h
@@ -189,10 +189,13 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
  *     if not, then the IPv4 addresses are useless.
  * @param supports_ipv6: if we support ipv6 for lookups to the target.
  *     if not, then the IPv6 addresses are useless.
+ * @param use_nat64: if we support NAT64 for lookups to the target.
+ *     if yes, IPv4 addresses are useful even if we don't support IPv4.
  * @return true if dp is useless.
  */
-int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
-       struct delegpt* dp, int supports_ipv4, int supports_ipv6);
+int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
+       struct delegpt* dp, int supports_ipv4, int supports_ipv6,
+       int use_nat64);
 
 /**
  * See if qname has DNSSEC needs.  This is true if there is a trust anchor above

diff --git a/sbin/unwind/libunbound/iterator/iterator.c b/sbin/unwind/libunbound/iterator/iterator.c
index 2f3ad06..1548dfc 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iterator.c
+++ b/sbin/unwind/libunbound/iterator/iterator.c
@@ -255,7 +255,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
                                log_err("out of memory adding missing");
                }
                delegpt_mark_neg(dpns, qstate->qinfo.qtype);
-               if((dpns->got4 == 2 || !ie->supports_ipv4) &&
+               if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) &&
                        (dpns->got6 == 2 || !ie->supports_ipv6)) {
                        dpns->resolved = 1; /* mark as failed */
                        target_count_increase_nx(super_iq, 1);
@@ -302,81 +302,65 @@ error_response(struct module_qstate* qstate, int id, int rcode)
 static int
 error_response_cache(struct module_qstate* qstate, int id, int rcode)
 {
-       if(!qstate->no_cache_store) {
-               /* store in cache */
-               struct reply_info err;
-               if(qstate->prefetch_leeway > NORR_TTL) {
-                       verbose(VERB_ALGO, "error response for prefetch in cache");
-                       /* attempt to adjust the cache entry prefetch */
-                       if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
-                               NORR_TTL, qstate->query_flags))
-                               return error_response(qstate, id, rcode);
-                       /* if that fails (not in cache), fall through to store err */
+       struct reply_info err;
+       struct msgreply_entry* msg;
+       if(qstate->no_cache_store) {
+               return error_response(qstate, id, rcode);
+       }
+       if(qstate->prefetch_leeway > NORR_TTL) {
+               verbose(VERB_ALGO, "error response for prefetch in cache");
+               /* attempt to adjust the cache entry prefetch */
+               if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
+                       NORR_TTL, qstate->query_flags))
+                       return error_response(qstate, id, rcode);
+               /* if that fails (not in cache), fall through to store err */
+       }
+       if((msg=msg_cache_lookup(qstate->env,
+               qstate->qinfo.qname, qstate->qinfo.qname_len,
+               qstate->qinfo.qtype, qstate->qinfo.qclass,
+               qstate->query_flags, 0,
+               qstate->env->cfg->serve_expired_ttl_reset)) != NULL) {
+               struct reply_info* rep = (struct reply_info*)msg->entry.data;
+               if(qstate->env->cfg->serve_expired &&
+                       qstate->env->cfg->serve_expired_ttl_reset && rep &&
+                       *qstate->env->now + qstate->env->cfg->serve_expired_ttl
+                       > rep->serve_expired_ttl) {
+                       verbose(VERB_ALGO, "reset serve-expired-ttl for "
+                               "response in cache");
+                       rep->serve_expired_ttl = *qstate->env->now +
+                               qstate->env->cfg->serve_expired_ttl;
                }
-               if(qstate->env->cfg->serve_expired) {
-                       /* if serving expired contents, and such content is
-                        * already available, don't overwrite this servfail */
-                       struct msgreply_entry* msg;
-                       if((msg=msg_cache_lookup(qstate->env,
-                               qstate->qinfo.qname, qstate->qinfo.qname_len,
-                               qstate->qinfo.qtype, qstate->qinfo.qclass,
-                               qstate->query_flags, 0,
-                               qstate->env->cfg->serve_expired_ttl_reset))
-                               != NULL) {
-                               if(qstate->env->cfg->serve_expired_ttl_reset) {
-                                       struct reply_info* rep =
-                                               (struct reply_info*)msg->entry.data;
-                                       if(rep && *qstate->env->now +
-                                               qstate->env->cfg->serve_expired_ttl  >
-                                               rep->serve_expired_ttl) {
-                                               rep->serve_expired_ttl =
-                                                       *qstate->env->now +
-                                                       qstate->env->cfg->serve_expired_ttl;
-                                       }
-                               }
-                               lock_rw_unlock(&msg->entry.lock);
-                               return error_response(qstate, id, rcode);
-                       }
-                       /* serving expired contents, but nothing is cached
-                        * at all, so the servfail cache entry is useful
-                        * (stops waste of time on this servfail NORR_TTL) */
-               } else {
-                       /* don't overwrite existing (non-expired) data in
-                        * cache with a servfail */
-                       struct msgreply_entry* msg;
-                       if((msg=msg_cache_lookup(qstate->env,
-                               qstate->qinfo.qname, qstate->qinfo.qname_len,
-                               qstate->qinfo.qtype, qstate->qinfo.qclass,
-                               qstate->query_flags, *qstate->env->now, 0))
-                               != NULL) {
-                               struct reply_info* rep = (struct reply_info*)
-                                       msg->entry.data;
-                               if(FLAGS_GET_RCODE(rep->flags) ==
-                                       LDNS_RCODE_NOERROR ||
-                                       FLAGS_GET_RCODE(rep->flags) ==
-                                       LDNS_RCODE_NXDOMAIN) {
-                                       /* we have a good entry,
-                                        * don't overwrite */
-                                       lock_rw_unlock(&msg->entry.lock);
-                                       return error_response(qstate, id, rcode);
-                               }
-                               lock_rw_unlock(&msg->entry.lock);
-                       }
-                       
+               if(rep && (FLAGS_GET_RCODE(rep->flags) ==
+                       LDNS_RCODE_NOERROR ||
+                       FLAGS_GET_RCODE(rep->flags) ==
+                       LDNS_RCODE_NXDOMAIN ||
+                       FLAGS_GET_RCODE(rep->flags) ==
+                       LDNS_RCODE_YXDOMAIN) &&
+                       (qstate->env->cfg->serve_expired ||
+                       *qstate->env->now <= rep->ttl)) {
+                       /* we have a good entry, don't overwrite */
+                       lock_rw_unlock(&msg->entry.lock);
+                       return error_response(qstate, id, rcode);
                }
-               memset(&err, 0, sizeof(err));
-               err.flags = (uint16_t)(BIT_QR | BIT_RA);
-               FLAGS_SET_RCODE(err.flags, rcode);
-               err.qdcount = 1;
-               err.ttl = NORR_TTL;
-               err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
-               err.serve_expired_ttl = NORR_TTL;
-               /* do not waste time trying to validate this servfail */
-               err.security = sec_status_indeterminate;
-               verbose(VERB_ALGO, "store error response in message cache");
-               iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-                       qstate->query_flags, qstate->qstarttime);
-       }
+               lock_rw_unlock(&msg->entry.lock);
+               /* nothing interesting is cached (already error response or
+                * expired good record when we don't serve expired), so this
+                * servfail cache entry is useful (stops waste of time on this
+                * servfail NORR_TTL) */
+       }
+       /* store in cache */
+       memset(&err, 0, sizeof(err));
+       err.flags = (uint16_t)(BIT_QR | BIT_RA);
+       FLAGS_SET_RCODE(err.flags, rcode);
+       err.qdcount = 1;
+       err.ttl = NORR_TTL;
+       err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
+       err.serve_expired_ttl = NORR_TTL;
+       /* do not waste time trying to validate this servfail */
+       err.security = sec_status_indeterminate;
+       verbose(VERB_ALGO, "store error response in message cache");
+       iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
+               qstate->query_flags, qstate->qstarttime);
        return error_response(qstate, id, rcode);
 }
 
@@ -590,6 +574,54 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
        return 1;
 }
 
+/** fill fail address for later recovery */
+static void
+fill_fail_addr(struct iter_qstate* iq, struct sockaddr_storage* addr,
+       socklen_t addrlen)
+{
+       if(addrlen == 0) {
+               iq->fail_addr_type = 0;
+               return;
+       }
+       if(((struct sockaddr_in*)addr)->sin_family == AF_INET) {
+               iq->fail_addr_type = 4;
+               memcpy(&iq->fail_addr.in,
+                       &((struct sockaddr_in*)addr)->sin_addr,
+                       sizeof(iq->fail_addr.in));
+       }
+#ifdef AF_INET6
+       else if(((struct sockaddr_in*)addr)->sin_family == AF_INET6) {
+               iq->fail_addr_type = 6;
+               memcpy(&iq->fail_addr.in6,
+                       &((struct sockaddr_in6*)addr)->sin6_addr,
+                       sizeof(iq->fail_addr.in6));
+       }
+#endif
+       else {
+               iq->fail_addr_type = 0;
+       }
+}
+
+/** print fail addr to string */
+static void
+print_fail_addr(struct iter_qstate* iq, char* buf, size_t len)
+{
+       if(iq->fail_addr_type == 4) {
+               if(inet_ntop(AF_INET, &iq->fail_addr.in, buf,
+                       (socklen_t)len) == 0)
+                       (void)strlcpy(buf, "(inet_ntop error)", len);
+       }
+#ifdef AF_INET6
+       else if(iq->fail_addr_type == 6) {
+               if(inet_ntop(AF_INET6, &iq->fail_addr.in6, buf,
+                       (socklen_t)len) == 0)
+                       (void)strlcpy(buf, "(inet_ntop error)", len);
+       }
+#endif
+       else
+               (void)strlcpy(buf, "", len);
+}
+
 /** add response specific error information for log servfail */
 static void
 errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq)
@@ -597,16 +629,14 @@ errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq)
        if(qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail)
                return;
        if((qstate->reply && qstate->reply->remote_addrlen != 0) ||
-               (iq->fail_reply && iq->fail_reply->remote_addrlen != 0)) {
+               (iq->fail_addr_type != 0)) {
                char from[256], frm[512];
                if(qstate->reply && qstate->reply->remote_addrlen != 0)
                        addr_to_str(&qstate->reply->remote_addr,
                                qstate->reply->remote_addrlen, from,
                                sizeof(from));
                else
-                       addr_to_str(&iq->fail_reply->remote_addr,
-                               iq->fail_reply->remote_addrlen, from,
-                               sizeof(from));
+                       print_fail_addr(iq, from, sizeof(from));
                snprintf(frm, sizeof(frm), "from %s", from);
                errinf(qstate, frm);
        }
@@ -1137,7 +1167,7 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
  * Generate a NS check request to obtain authoritative information
  * on an NS rrset.
  *
- * @param qstate: the qtstate that triggered the need to prime.
+ * @param qstate: the qstate that triggered the need to prime.
  * @param iq: iterator query state.
  * @param id: module id.
  */
@@ -1314,7 +1344,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 
        /* We enforce a maximum number of query restarts. This is primarily a
         * cheap way to prevent CNAME loops. */
-       if(iq->query_restart_count > MAX_RESTART_COUNT) {
+       if(iq->query_restart_count > ie->max_query_restarts) {
                verbose(VERB_QUERY, "request has exceeded the maximum number"
                        " of query restarts with %d", iq->query_restart_count);
                errinf(qstate, "request has exceeded the maximum number "
@@ -1451,6 +1481,19 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
                        errinf(qstate, "malloc failure for forward zone");
                        return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
                }
+               if((qstate->query_flags&BIT_RD)==0) {
+                       /* If the server accepts RD=0 queries and forwards
+                        * with RD=1, then if the server is listed as an NS
+                        * entry, it starts query loops. Stop that loop by
+                        * disallowing the query. The RD=0 was previously used
+                        * to check the cache with allow_snoop. For stubs,
+                        * the iterator pass would have primed the stub and
+                        * then cached information can be used for further
+                        * queries. */
+                       verbose(VERB_ALGO, "cannot forward RD=0 query, to stop query loops");
+                       errinf(qstate, "cannot forward RD=0 query");
+                       return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+               }
                iq->refetch_glue = 0;
                iq->minimisation_state = DONOT_MINIMISE_STATE;
                /* the request has been forwarded.
@@ -1560,18 +1603,19 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 
                /* see if this dp not useless.
                 * It is useless if:
-                *      o all NS items are required glue. 
+                *      o all NS items are required glue.
                 *        or the query is for NS item that is required glue.
                 *      o no addresses are provided.
                 *      o RD qflag is on.
                 * Instead, go up one level, and try to get even further
-                * If the root was useless, use safety belt information. 
+                * If the root was useless, use safety belt information.
                 * Only check cache returns, because replies for servers
                 * could be useless but lead to loops (bumping into the
                 * same server reply) if useless-checked.
                 */
-               if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, 
-                       iq->dp, ie->supports_ipv4, ie->supports_ipv6)) {
+               if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
+                       iq->dp, ie->supports_ipv4, ie->supports_ipv6,
+                       ie->use_nat64)) {
                        struct delegpt* retdp = NULL;
                        if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) {
                                if(retdp) {
@@ -1932,7 +1976,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
                                break;
                }
                /* Send the A request. */
-               if(ie->supports_ipv4 &&
+               if((ie->supports_ipv4 || ie->use_nat64) &&
                        ((ns->lame && !ns->done_pside4) ||
                        (!ns->lame && !ns->got4))) {
                        if(!generate_target_query(qstate, iq, id, 
@@ -2085,14 +2129,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
                /* if this nameserver is at a delegation point, but that
                 * delegation point is a stub and we cannot go higher, skip*/
                if( ((ie->supports_ipv6 && !ns->done_pside6) ||
-                   (ie->supports_ipv4 && !ns->done_pside4)) &&
+                   ((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4)) &&
                    !can_have_last_resort(qstate->env, ns->name, ns->namelen,
                        iq->qchase.qclass, NULL)) {
                        log_nametypeclass(VERB_ALGO, "cannot pside lookup ns "
                                "because it is also a stub/forward,",
                                ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
                        if(ie->supports_ipv6) ns->done_pside6 = 1;
-                       if(ie->supports_ipv4) ns->done_pside4 = 1;
+                       if(ie->supports_ipv4 || ie->use_nat64) ns->done_pside4 = 1;
                        continue;
                }
                /* query for parent-side A and AAAA for nameservers */
@@ -2117,7 +2161,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
                                return 0;
                        }
                }
-               if(ie->supports_ipv4 && !ns->done_pside4) {
+               if((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4) {
                        /* Send the A request. */
                        if(!generate_parentside_target_query(qstate, iq, id, 
                                ns->name, ns->namelen, 
@@ -2259,6 +2303,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        int tf_policy;
        struct delegpt_addr* target;
        struct outbound_entry* outq;
+       struct sockaddr_storage real_addr;
+       socklen_t real_addrlen;
        int auth_fallback = 0;
        uint8_t* qout_orig = NULL;
        size_t qout_orig_len = 0;
@@ -2276,14 +2322,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                iq->num_current_queries, iq->sent_count);
 
        /* Make sure that we haven't run away */
-       /* FIXME: is this check even necessary? */
        if(iq->referral_count > MAX_REFERRAL_COUNT) {
                verbose(VERB_QUERY, "request has exceeded the maximum "
                        "number of referrrals with %d", iq->referral_count);
                errinf(qstate, "exceeded the maximum of referrals");
                return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
        }
-       if(iq->sent_count > MAX_SENT_COUNT) {
+       if(iq->sent_count > ie->max_sent_count) {
                verbose(VERB_QUERY, "request has exceeded the maximum "
                        "number of sends with %d", iq->sent_count);
                errinf(qstate, "exceeded the maximum number of sends");
@@ -2385,7 +2430,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        }
        if(!ie->supports_ipv6)
                delegpt_no_ipv6(iq->dp);
-       if(!ie->supports_ipv4)
+       if(!ie->supports_ipv4 && !ie->use_nat64)
                delegpt_no_ipv4(iq->dp);
        delegpt_log(VERB_ALGO, iq->dp);
 
@@ -2630,7 +2675,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                 * the original query is one that matched too, so we have
                 * caps_server+1 number of matching queries now */
                if(iq->caps_server+1 >= naddr*3 ||
-                       iq->caps_server*2+2 >= MAX_SENT_COUNT) {
+                       iq->caps_server*2+2 >= (size_t)ie->max_sent_count) {
                        /* *2 on sentcount check because ipv6 may fail */
                        /* we're done, process the response */
                        verbose(VERB_ALGO, "0x20 fallback had %d responses "
@@ -2806,12 +2851,24 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
        /* We have a valid target. */
        if(verbosity >= VERB_QUERY) {
                log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
-               log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
+               log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
                        &target->addr, target->addrlen);
                verbose(VERB_ALGO, "dnssec status: %s%s",
                        iq->dnssec_expected?"expected": "not expected",
                        iq->dnssec_lame_query?" but lame_query anyway": "");
        }
+
+       real_addr = target->addr;
+       real_addrlen = target->addrlen;
+
+       if(ie->use_nat64 && target->addr.ss_family == AF_INET) {
+               addr_to_nat64(&target->addr, &ie->nat64_prefix_addr,
+                       ie->nat64_prefix_addrlen, ie->nat64_prefix_net,
+                       &real_addr, &real_addrlen);
+               log_name_addr(VERB_QUERY, "applied NAT64:",
+                       iq->dp->name, &real_addr, real_addrlen);
+       }
+
        fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
        outq = (*qstate->env->send_query)(&iq->qinfo_out,
                iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
@@ -2822,7 +2879,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
                &iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
                iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-               ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
+               ie, iq), sq_check_ratelimit, &real_addr, real_addrlen,
                iq->dp->name, iq->dp->namelen,
                (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
                (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
@@ -2839,7 +2896,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                        return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
                }
                log_addr(VERB_QUERY, "error sending query to auth server",
-                       &target->addr, target->addrlen);
+                       &real_addr, real_addrlen);
                if(qstate->env->cfg->qname_minimisation)
                        iq->minimisation_state = SKIP_MINIMISE_STATE;
                return next_state(iq, QUERYTARGETS_STATE);
@@ -2883,7 +2940,7 @@ static int
 processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
        struct iter_env* ie, int id)
 {
-       int dnsseclame = 0;
+       int dnsseclame = 0, origtypecname = 0;
        enum response_type type;
 
        iq->num_current_queries--;
@@ -2966,6 +3023,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                /* YXDOMAIN is a permanent error, no need to retry */
                type = RESPONSE_TYPE_ANSWER;
        }
+       if(type == RESPONSE_TYPE_CNAME)
+               origtypecname = 1;
        if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1
                && ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) {
                uint8_t* sname = NULL;
@@ -3051,11 +3110,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                                iq->minimisation_state = DONOT_MINIMISE_STATE;
                        }
                        if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
-                               LDNS_RCODE_NXDOMAIN) {
+                               LDNS_RCODE_NXDOMAIN && !origtypecname) {
                                /* Stop resolving when NXDOMAIN is DNSSEC
                                 * signed. Based on assumption that nameservers
                                 * serving signed zones do not return NXDOMAIN
                                 * for empty-non-terminals. */
+                               /* If this response is actually a CNAME type,
+                                * the nxdomain rcode may not be for the qname,
+                                * and so it is not the final response. */
                                if(iq->dnssec_expected)
                                        return final_state(iq);
                                /* Make subrequest to validate intermediate
@@ -3183,7 +3245,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                (*qstate->env->detach_subs)(qstate);
                iq->num_target_queries = 0;
                iq->response = NULL;
-               iq->fail_reply = NULL;
+               iq->fail_addr_type = 0;
                verbose(VERB_ALGO, "cleared outbound list for next round");
                return next_state(iq, QUERYTARGETS_STATE);
        } else if(type == RESPONSE_TYPE_CNAME) {
@@ -3565,7 +3627,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
        } else {
                verbose(VERB_ALGO, "iterator TargetResponse failed");
                delegpt_mark_neg(dpns, qstate->qinfo.qtype);
-               if((dpns->got4 == 2 || !ie->supports_ipv4) &&
+               if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) &&
                        (dpns->got6 == 2 || !ie->supports_ipv6)) {
                        dpns->resolved = 1; /* fail the target */
                        /* do not count cached answers */
@@ -3810,6 +3872,9 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
        /* make sure QR flag is on */
        iq->response->rep->flags |= BIT_QR;
 
+       /* explicitly set the EDE string to NULL */
+       iq->response->rep->reason_bogus_str = NULL;
+
        /* we have finished processing this query */
        qstate->ext_state[id] = module_finished;
 
@@ -3988,7 +4053,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
        }
 
        /* parse message */
-       iq->fail_reply = qstate->reply;
+       fill_fail_addr(iq, &qstate->reply->remote_addr,
+               qstate->reply->remote_addrlen);
        prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, 
                sizeof(struct msg_parse));
        if(!prs) {

diff --git a/sbin/unwind/libunbound/iterator/iterator.h b/sbin/unwind/libunbound/iterator/iterator.h
index e35718c..fad7f03 100644 (file)
--- a/sbin/unwind/libunbound/iterator/iterator.h
+++ b/sbin/unwind/libunbound/iterator/iterator.h
@@ -63,12 +63,8 @@ struct rbtree_type;
 /** max number of nxdomains allowed for target lookups for a query and
  * its subqueries when fallback has kicked in */
 #define MAX_TARGET_NX_FALLBACK (MAX_TARGET_NX*2)
-/** max number of query restarts. Determines max number of CNAME chain. */
-#define MAX_RESTART_COUNT      11
 /** max number of referrals. Makes sure resolver does not run away */
 #define MAX_REFERRAL_COUNT     130
-/** max number of queries-sent-out.  Make sure large NS set does not loop */
-#define MAX_SENT_COUNT         32
 /** max number of queries for which to perform dnsseclameness detection,
  * (rrsigs missing detection) after that, just pick up that response */
 #define DNSSEC_LAME_DETECT_COUNT 4
@@ -107,7 +103,7 @@ extern int BLACKLIST_PENALTY;
 #define RTT_BAND 400
 
 /**
- * Global state for the iterator. 
+ * Global state for the iterator.
  */
 struct iter_env {
        /** A flag to indicate whether or not we have an IPv6 route */
@@ -116,6 +112,18 @@ struct iter_env {
        /** A flag to indicate whether or not we have an IPv4 route */
        int supports_ipv4;
 
+       /** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */
+       int use_nat64;
+
+       /** NAT64 prefix address, cf. dns64_env->prefix_addr */
+       struct sockaddr_storage nat64_prefix_addr;
+
+       /** sizeof(sockaddr_in6) */
+       socklen_t nat64_prefix_addrlen;
+
+       /** CIDR mask length of NAT64 prefix */
+       int nat64_prefix_net;
+
        /** A set of inetaddrs that should never be queried. */
        struct iter_donotq* donotq;
 
@@ -145,6 +153,12 @@ struct iter_env {
 
        /** number of retries on outgoing queries */
        int outbound_msg_retry;
+
+       /** number of queries_sent */
+       int max_sent_count;
+
+       /** max number of query restarts to limit length of CNAME chain */
+       int max_query_restarts;
 };
 
 /**
@@ -437,7 +451,14 @@ struct iter_qstate {
        /** true if there have been parse failures of reply packets */
        int parse_failures;
        /** a failure printout address for last received answer */
-       struct comm_reply* fail_reply;
+       union {
+               struct in_addr in;
+#ifdef AF_INET6
+               struct in6_addr in6;
+#endif
+       } fail_addr;
+       /** which fail_addr, 0 is nothing, 4 or 6 */
+       int fail_addr_type;
 };
 
 /**

diff --git a/sbin/unwind/libunbound/libunbound/context.c b/sbin/unwind/libunbound/libunbound/context.c
index c8d911f..f7c0a2c 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/context.c
+++ b/sbin/unwind/libunbound/libunbound/context.c
@@ -70,6 +70,7 @@ context_finalize(struct ub_ctx* ctx)
        } else {
                log_init(cfg->logfile, cfg->use_syslog, NULL);
        }
+       ctx->pipe_pid = getpid();
        cfg_apply_local_port_policy(cfg, 65536);
        config_apply(cfg);
        if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))

diff --git a/sbin/unwind/libunbound/libunbound/context.h b/sbin/unwind/libunbound/libunbound/context.h
index c0c86fb..c0fc80e 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/context.h
+++ b/sbin/unwind/libunbound/libunbound/context.h
@@ -89,6 +89,12 @@ struct ub_ctx {
        pid_t bg_pid;
        /** tid of bg worker thread */
        ub_thread_type bg_tid;
+       /** pid when pipes are created. This was the process when the
+        * setup was called. Helps with clean up, so we can tell after a fork
+        * which side of the fork the delete is on. */
+       pid_t pipe_pid;
+       /** when threaded, the worker that exists in the created thread. */
+       struct libworker* thread_worker;
 
        /** do threading (instead of forking) for async resolution */
        int dothread;

diff --git a/sbin/unwind/libunbound/libunbound/libunbound.c b/sbin/unwind/libunbound/libunbound/libunbound.c
index ea5ef24..80a82bb 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/libunbound.c
+++ b/sbin/unwind/libunbound/libunbound/libunbound.c
@@ -305,11 +305,31 @@ ub_ctx_delete(struct ub_ctx* ctx)
        int do_stop = 1;
        if(!ctx) return;
 
+       /* if the delete is called but it has forked, and before the fork
+        * the context was finalized, then the bg worker is not stopped
+        * from here. There is one worker, but two contexts that refer to
+        * it and only one should clean up, the one with getpid == pipe_pid.*/
+       if(ctx->created_bg && ctx->pipe_pid != getpid()) {
+               do_stop = 0;
+#ifndef USE_WINSOCK
+               /* Stop events from getting deregistered, if the backend is
+                * epoll, the epoll fd is the same as the other process.
+                * That process should deregister them. */
+               if(ctx->qq_pipe->listen_com)
+                       ctx->qq_pipe->listen_com->event_added = 0;
+               if(ctx->qq_pipe->res_com)
+                       ctx->qq_pipe->res_com->event_added = 0;
+               if(ctx->rr_pipe->listen_com)
+                       ctx->rr_pipe->listen_com->event_added = 0;
+               if(ctx->rr_pipe->res_com)
+                       ctx->rr_pipe->res_com->event_added = 0;
+#endif
+       }
        /* see if bg thread is created and if threads have been killed */
        /* no locks, because those may be held by terminated threads */
        /* for processes the read pipe is closed and we see that on read */
 #ifdef HAVE_PTHREAD
-       if(ctx->created_bg && ctx->dothread) {
+       if(ctx->created_bg && ctx->dothread && do_stop) {
                if(pthread_kill(ctx->bg_tid, 0) == ESRCH) {
                        /* thread has been killed */
                        do_stop = 0;
@@ -318,6 +338,23 @@ ub_ctx_delete(struct ub_ctx* ctx)
 #endif /* HAVE_PTHREAD */
        if(do_stop)
                ub_stop_bg(ctx);
+       if(ctx->created_bg && ctx->pipe_pid != getpid() && ctx->thread_worker) {
+               /* This delete is happening from a different process. Delete
+                * the thread worker from this process memory space. The
+                * thread is not there to do so, so it is freed here. */
+               struct ub_event_base* evbase = comm_base_internal(
+                       ctx->thread_worker->base);
+               libworker_delete_event(ctx->thread_worker);
+               ctx->thread_worker = NULL;
+#ifdef USE_MINI_EVENT
+               ub_event_base_free(evbase);
+#else
+               /* cannot event_base_free, because the epoll_fd cleanup
+                * in libevent could stop the original event_base in the
+                * other process from working. */
+               free(evbase);
+#endif
+       }
        libworker_delete_event(ctx->event_worker);
 
        modstack_desetup(&ctx->mods, ctx->env);

diff --git a/sbin/unwind/libunbound/libunbound/libworker.c b/sbin/unwind/libunbound/libunbound/libworker.c
index 11bf5f9..1042449 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/libworker.c
+++ b/sbin/unwind/libunbound/libunbound/libworker.c
@@ -168,14 +168,12 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
                hints_delete(w->env->hints);
                w->env->hints = NULL;
        }
-       if(cfg->ssl_upstream || (cfg->tls_cert_bundle && cfg->tls_cert_bundle[0]) || cfg->tls_win_cert) {
-               w->sslctx = connect_sslctx_create(NULL, NULL,
-                       cfg->tls_cert_bundle, cfg->tls_win_cert);
-               if(!w->sslctx) {
-                       /* to make the setup fail after unlock */
-                       hints_delete(w->env->hints);
-                       w->env->hints = NULL;
-               }
+       w->sslctx = connect_sslctx_create(NULL, NULL,
+               cfg->tls_cert_bundle, cfg->tls_win_cert);
+       if(!w->sslctx) {
+               /* to make the setup fail after unlock */
+               hints_delete(w->env->hints);
+               w->env->hints = NULL;
        }
        if(!w->is_bg || w->is_bg_thread) {
                lock_basic_unlock(&ctx->cfglock);
@@ -395,6 +393,7 @@ int libworker_bg(struct ub_ctx* ctx)
                w = libworker_setup(ctx, 1, NULL);
                if(!w) return UB_NOMEM;
                w->is_bg_thread = 1;
+               ctx->thread_worker = w;
 #ifdef ENABLE_LOCK_CHECKS
                w->thread_num = 1; /* for nicer DEBUG checklocks */
 #endif
@@ -604,6 +603,8 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
        edns->opt_list_out = NULL;
        edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
+       edns->cookie_present = 0;
+       edns->cookie_valid = 0;
        if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
                edns->udp_size = (uint16_t)sldns_buffer_capacity(
                        w->back->udp_buff);

diff --git a/sbin/unwind/libunbound/libunbound/unbound-event.h b/sbin/unwind/libunbound/libunbound/unbound-event.h
index a5d5c03..5ca8190 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/unbound-event.h
+++ b/sbin/unwind/libunbound/libunbound/unbound-event.h
@@ -52,8 +52,8 @@
  * unbound was compiled with, otherwise it wouldn't work, the event and
  * event_base structures would be different.
  */
-#ifndef _UB_UNBOUND_EVENT_H
-#define _UB_UNBOUND_EVENT_H
+#ifndef UB_UNBOUND_EVENT_H
+#define UB_UNBOUND_EVENT_H
 
 #ifdef __cplusplus
 extern "C" {
@@ -230,7 +230,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
  * @param callback: this is called on completion of the resolution.
  *     It is called as:
  *     void callback(void* mydata, int rcode, void* packet, int packet_len,
- *             int sec, char* why_bogus)
+ *             int sec, char* why_bogus, int was_ratelimited)
  *     with mydata: the same as passed here, you may pass NULL,
  *     with rcode: 0 on no error, nonzero for mostly SERVFAIL situations,
  *             this is a DNS rcode.
@@ -241,6 +241,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
  *     with packet_len: length in bytes of the packet buffer.
  *     with sec: 0 if insecure, 1 if bogus, 2 if DNSSEC secure.
  *     with why_bogus: text string explaining why it is bogus (or NULL).
+ *     with was_ratelimited: if the query was ratelimited.
  *     These point to buffers inside unbound; do not deallocate the packet or
  *     error string.
  *
@@ -261,4 +262,4 @@ int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 }
 #endif
 
-#endif /* _UB_UNBOUND_H */
+#endif /* UB_UNBOUND_EVENT_H */

diff --git a/sbin/unwind/libunbound/libunbound/unbound.h b/sbin/unwind/libunbound/libunbound/unbound.h
index c779d18..bb8e8ac 100644 (file)
--- a/sbin/unwind/libunbound/libunbound/unbound.h
+++ b/sbin/unwind/libunbound/libunbound/unbound.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file contains functions to resolve DNS queries and 
+ * This file contains functions to resolve DNS queries and
  * validate the answers. Synchronously and asynchronously.
  *
  * Several ways to use this interface from an application wishing
@@ -65,7 +65,7 @@
  *     ... or process() calls my_callback() with results.
  *
  *      ... if the application has nothing more to do, wait for answer
- *      ub_wait(ctx); 
+ *      ub_wait(ctx);
  *
  * Application threaded. Blocking.
  *     Blocking, same as above. The current thread does the work.
@@ -83,7 +83,7 @@
  * CRYPTO_set_id_callback and CRYPTO_set_locking_callback.
  *
  * If no threading is compiled in, the above async example uses fork(2) to
- * create a process to perform the work. The forked process exits when the 
+ * create a process to perform the work. The forked process exits when the
  * calling process exits, or ctx_delete() is called.
  * Otherwise, for asynchronous with threading, a worker thread is created.
  *
@@ -94,8 +94,8 @@
  * The second calls another worker thread (or process) to perform the work.
  * And no buffers need to be set up, but a context-switch happens.
  */
-#ifndef _UB_UNBOUND_H
-#define _UB_UNBOUND_H
+#ifndef UB_UNBOUND_H
+#define UB_UNBOUND_H
 
 #ifdef __cplusplus
 extern "C" {
@@ -128,10 +128,10 @@ struct ub_result {
        /** the class asked for */
        int qclass;
 
-       /** 
-        * a list of network order DNS rdata items, terminated with a 
+       /**
+        * a list of network order DNS rdata items, terminated with a
         * NULL pointer, so that data[0] is the first result entry,
-        * data[1] the second, and the last entry is NULL. 
+        * data[1] the second, and the last entry is NULL.
         * If there was no data, data[0] is NULL.
         */
        char** data;
@@ -139,8 +139,8 @@ struct ub_result {
        /** the length in bytes of the data items, len[i] for data[i] */
        int* len;
 
-       /** 
-        * canonical name for the result (the final cname). 
+       /**
+        * canonical name for the result (the final cname).
         * zero terminated string.
         * May be NULL if no canonical name exists.
         */
@@ -165,9 +165,9 @@ struct ub_result {
         */
        int havedata;
 
-       /** 
+       /**
         * If there was no data, and the domain did not exist, this is true.
-        * If it is false, and there was no data, then the domain name 
+        * If it is false, and there was no data, then the domain name
         * is purported to exist, but the requested data type is not available.
         */
        int nxdomain;
@@ -182,19 +182,19 @@ struct ub_result {
         */
        int secure;
 
-       /** 
-        * If the result was not secure (secure==0), and this result is due 
+       /**
+        * If the result was not secure (secure==0), and this result is due
         * to a security failure, bogus is true.
         * This means the data has been actively tampered with, signatures
-        * failed, expected signatures were not present, timestamps on 
+        * failed, expected signatures were not present, timestamps on
         * signatures were out of date and so on.
         *
-        * If !secure and !bogus, this can happen if the data is not secure 
-        * because security is disabled for that domain name. 
+        * If !secure and !bogus, this can happen if the data is not secure
+        * because security is disabled for that domain name.
         * This means the data is from a domain where data is not signed.
         */
        int bogus;
-       
+
        /**
         * If the result is bogus this contains a string (zero terminated)
         * that describes the failure.  There may be other errors as well
@@ -222,7 +222,7 @@ struct ub_result {
  * The readable function definition looks like:
  * void my_callback(void* my_arg, int err, struct ub_result* result);
  * It is called with
- *     void* my_arg: your pointer to a (struct of) data of your choice, 
+ *     void* my_arg: your pointer to a (struct of) data of your choice,
  *             or NULL.
  *     int err: if 0 all is OK, otherwise an error occurred and no results
  *          are forthcoming.
@@ -301,8 +301,8 @@ int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val);
  *     This is a power-users interface that lets you specify all sorts
  *     of options.
  * @param str: the string is malloced and returned here. NULL on error.
- *     The caller must free() the string.  In cases with multiple 
- *     entries (auto-trust-anchor-file), a newline delimited list is 
+ *     The caller must free() the string.  In cases with multiple
+ *     entries (auto-trust-anchor-file), a newline delimited list is
  *     returned in the string.
  * @return 0 if OK else an error code (malloc failure, syntax error).
  */
@@ -321,10 +321,10 @@ int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str);
 int ub_ctx_config(struct ub_ctx* ctx, const char* fname);
 
 /**
- * Set machine to forward DNS queries to, the caching resolver to use. 
- * IP4 or IP6 address. Forwards all DNS requests to that machine, which 
- * is expected to run a recursive resolver. If the proxy is not 
- * DNSSEC-capable, validation may fail. Can be called several times, in 
+ * Set machine to forward DNS queries to, the caching resolver to use.
+ * IP4 or IP6 address. Forwards all DNS requests to that machine, which
+ * is expected to run a recursive resolver. If the proxy is not
+ * DNSSEC-capable, validation may fail. Can be called several times, in
  * that case the addresses are used as backup servers.
  *
  * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
@@ -389,7 +389,7 @@ int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname);
 
 /**
  * Read list of hosts from the filename given.
- * Usually "/etc/hosts". 
+ * Usually "/etc/hosts".
  * These addresses are not flagged as DNSSEC secure when queried for.
  *
  * @param ctx: context.
@@ -403,7 +403,7 @@ int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname);
 /**
  * Add a trust anchor to the given context.
  * The trust anchor is a string, on one line, that holds a valid DNSKEY or
- * DS RR. 
+ * DS RR.
  * @param ctx: context.
  *     At this time it is only possible to add trusted keys before the
  *     first resolve is done.
@@ -465,7 +465,7 @@ int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
  * Set debug verbosity for the context
  * Output is directed to stderr.
  * @param ctx: context.
- * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 
+ * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed,
  *     and 3 is lots.
  * @return 0 if OK, else error.
  */
@@ -474,10 +474,10 @@ int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
 /**
  * Set a context behaviour for asynchronous action.
  * @param ctx: context.
- * @param dothread: if true, enables threading and a call to resolve_async() 
+ * @param dothread: if true, enables threading and a call to resolve_async()
  *     creates a thread to handle work in the background.
  *     If false, a process is forked to handle work in the background.
- *     Changes to this setting after async() calls have been made have 
+ *     Changes to this setting after async() calls have been made have
  *     no effect (delete and re-create the context to change).
  * @return 0 if OK, else error.
  */
@@ -495,7 +495,7 @@ int ub_poll(struct ub_ctx* ctx);
 
 /**
  * Wait for a context to finish with results. Calls ub_process() after
- * the wait for you. After the wait, there are no more outstanding 
+ * the wait for you. After the wait, there are no more outstanding
  * asynchronous queries.
  * @param ctx: context.
  * @return: 0 if OK, else error.
@@ -530,11 +530,11 @@ int ub_process(struct ub_ctx* ctx);
  * @param rrtype: type of RR in host order, 1 is A (address).
  * @param rrclass: class of RR in host order, 1 is IN (for internet).
  * @param result: the result data is returned in a newly allocated result
- *     structure. May be NULL on return, return value is set to an error 
+ *     structure. May be NULL on return, return value is set to an error
  *     in that case (out of memory).
  * @return 0 if OK, else error.
  */
-int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 
+int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
        int rrclass, struct ub_result** result);
 
 /**
@@ -561,11 +561,11 @@ int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
  *     If an error happens during processing, your callback will be called
  *     with error set to a nonzero value (and result==NULL).
  * @param async_id: if you pass a non-NULL value, an identifier number is
- *     returned for the query as it is in progress. It can be used to 
+ *     returned for the query as it is in progress. It can be used to
  *     cancel the query.
  * @return 0 if OK, else error.
  */
-int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
+int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
        int rrclass, void* mydata, ub_callback_type callback, int* async_id);
 
 /**
@@ -589,7 +589,7 @@ int ub_cancel(struct ub_ctx* ctx, int async_id);
  */
 void ub_resolve_free(struct ub_result* result);
 
-/** 
+/**
  * Convert error value to a human readable string.
  * @param err: error code from one of the libunbound functions.
  *     The error codes are from the type enum ub_ctx_err.
@@ -605,7 +605,7 @@ const char* ub_strerror(int err);
 int ub_ctx_print_local_zones(struct ub_ctx* ctx);
 
 /**
- * Add a new zone with the zonetype to the local authority info of the 
+ * Add a new zone with the zonetype to the local authority info of the
  * library.
  * @param ctx: context.  Is finalized by the routine.
  * @param zone_name: name of the zone in text, "example.com"
@@ -613,7 +613,7 @@ int ub_ctx_print_local_zones(struct ub_ctx* ctx);
  * @param zone_type: type of the zone (like for unbound.conf) in text.
  * @return 0 if OK, else error.
  */
-int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 
+int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
        const char *zone_type);
 
 /**
@@ -649,7 +649,7 @@ int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data);
  */
 const char* ub_version(void);
 
-/** 
+/**
  * Some global statistics that are not in struct stats_info,
  * this struct is shared on a shm segment (shm-key in unbound.conf)
  */
@@ -695,13 +695,22 @@ struct ub_server_stats {
        long long num_queries;
        /** number of queries that have been dropped/ratelimited by ip. */
        long long num_queries_ip_ratelimited;
+       /** number of queries with a valid DNS Cookie. */
+       long long num_queries_cookie_valid;
+       /** number of queries with only the client part of the DNS Cookie. */
+       long long num_queries_cookie_client;
+       /** number of queries with invalid DNS Cookie. */
+       long long num_queries_cookie_invalid;
        /** number of queries that had a cache-miss. */
        long long num_queries_missed_cache;
        /** number of prefetch queries - cachehits with prefetch */
        long long num_queries_prefetch;
-
+       /** number of queries which are too late to process */
+       long long num_queries_timed_out;
+       /** the longest wait time in the queue */
+       long long max_query_time_us;
        /**
-        * Sum of the querylistsize of the worker for 
+        * Sum of the querylistsize of the worker for
         * every query that missed cache. To calculate average.
         */
        long long sum_query_list_size;
@@ -773,12 +782,12 @@ struct ub_server_stats {
        long long tcp_accept_usage;
        /** expired answers served from cache */
        long long ans_expired;
-       /** histogram data exported to array 
+       /** histogram data exported to array
         * if the array is the same size, no data is lost, and
         * if all histograms are same size (is so by default) then
         * adding up works well. */
        long long hist[UB_STATS_BUCKET_NUM];
-       
+
        /** number of message cache entries */
        long long msg_cache_count;
        /** number of rrset cache entries */
@@ -788,6 +797,11 @@ struct ub_server_stats {
        /** number of key cache entries */
        long long key_cache_count;
 
+       /** maximum number of collisions in the msg cache */
+       long long msg_cache_max_collisions;
+       /** maximum number of collisions in the rrset cache */
+       long long rrset_cache_max_collisions;
+
        /** number of queries that used dnscrypt */
        long long num_query_dnscrypt_crypted;
        /** number of queries that queried dnscrypt certificates */
@@ -819,6 +833,8 @@ struct ub_server_stats {
        /** number of queries answered from edns-subnet specific data, and
         * the answer was from the edns-subnet cache. */
        long long num_query_subnet_cache;
+       /** number of queries served from cachedb */
+       long long num_query_cachedb;
        /** number of bytes in the stream wait buffers */
        long long mem_stream_wait;
        /** number of bytes in the HTTP2 query buffers */
@@ -831,7 +847,7 @@ struct ub_server_stats {
        long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
 };
 
-/** 
+/**
  * Statistics to send over the control pipe when asked
  * This struct is made to be memcopied, sent in binary.
  * shm mapped with (number+1) at num_threads+1, with first as total
@@ -860,4 +876,4 @@ struct ub_stats_info {
 }
 #endif
 
-#endif /* _UB_UNBOUND_H */
+#endif /* UB_UNBOUND_H */

diff --git a/sbin/unwind/libunbound/services/authzone.c b/sbin/unwind/libunbound/services/authzone.c
index 6de1e43..cd3ef8d 100644 (file)
--- a/sbin/unwind/libunbound/services/authzone.c
+++ b/sbin/unwind/libunbound/services/authzone.c
@@ -1306,8 +1306,8 @@ az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
                auth_data_delete(node);
        }
        if(z->rpz) {
-               rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type,
-                       rr_class, rdata, rdatalen);
+               rpz_remove_rr(z->rpz, z->name, z->namelen, dname, dname_len,
+                       rr_type, rr_class, rdata, rdatalen);
        }
        return 1;
 }
@@ -2756,6 +2756,7 @@ az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname,
                        == 0) {
                        msg->rep->rrsets[i]->rk.dname = newname;
                        msg->rep->rrsets[i]->rk.dname_len = newlen;
+                       msg->rep->rrsets[i]->entry.hash = rrset_key_hash(&msg->rep->rrsets[i]->rk);
                }
        }
 }
@@ -5419,6 +5420,8 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
        edns.opt_list_out = NULL;
        edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
+       edns.cookie_present = 0;
+       edns.cookie_valid = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
        else    edns.udp_size = 65535;
@@ -6612,6 +6615,8 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
        edns.opt_list_out = NULL;
        edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
+       edns.cookie_present = 0;
+       edns.cookie_valid = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
        else    edns.udp_size = 65535;
@@ -7509,7 +7514,7 @@ static void add_rrlist_rrsigs_into_data(struct packed_rrset_data* data,
                size_t j;
                if(!rrlist[i])
                        continue;
-               if(rrlist[i] && rrlist[i]->type == LDNS_RR_TYPE_ZONEMD &&
+               if(rrlist[i]->type == LDNS_RR_TYPE_ZONEMD &&
                        query_dname_compare(z->name, node->name)==0) {
                        /* omit RRSIGs over type ZONEMD at apex */
                        continue;

diff --git a/sbin/unwind/libunbound/services/cache/dns.c b/sbin/unwind/libunbound/services/cache/dns.c
index b6e5697..9b4ad58 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/dns.c
+++ b/sbin/unwind/libunbound/services/cache/dns.c
@@ -132,31 +132,6 @@ msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
        slabhash_remove(env->msg_cache, h, &k);
 }
 
-/** remove servfail msg cache entry */
-static void
-msg_del_servfail(struct module_env* env, struct query_info* qinfo,
-       uint32_t flags)
-{
-       struct msgreply_entry* e;
-       /* see if the entry is servfail, and then remove it, so that
-        * lookups move from the cacheresponse stage to the recursionresponse
-        * stage */
-       e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
-               qinfo->qtype, qinfo->qclass, flags, 0, 0);
-       if(!e) return;
-       /* we don't check for the ttl here, also expired servfail entries
-        * are removed.  If the user uses serve-expired, they would still be
-        * used to answer from cache */
-       if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags)
-               != LDNS_RCODE_SERVFAIL) {
-               lock_rw_unlock(&e->entry.lock);
-               return;
-       }
-       lock_rw_unlock(&e->entry.lock);
-       msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype,
-               qinfo->qclass, flags);
-}
-
 void 
 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
        hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
@@ -182,13 +157,20 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
                /* we do not store the message, but we did store the RRs,
                 * which could be useful for delegation information */
                verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
-               free(rep);
-               /* if the message is SERVFAIL in cache, remove that SERVFAIL,
+               reply_info_delete(rep, NULL);
+               /* if the message is in the cache, remove that msg,
                 * so that the TTL 0 response can be returned for future
-                * responses (i.e. don't get answered by the servfail from
+                * responses (i.e. don't get answered from
                 * cache, but instead go to recursion to get this TTL0
-                * response). */
-               msg_del_servfail(env, qinfo, flags);
+                * response).
+                * Possible messages that could be in the cache:
+                * - SERVFAIL
+                * - NXDOMAIN
+                * - NODATA
+                * - an older record that is expired
+                * - an older record that did not yet expire */
+               msg_cache_remove(env, qinfo->qname, qinfo->qname_len,
+                       qinfo->qtype, qinfo->qclass, flags);
                return;
        }
 
@@ -610,6 +592,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
        if(!msg->rep)
                return NULL;
        msg->rep->reason_bogus = LDNS_EDE_NONE;
+       msg->rep->reason_bogus_str = NULL;
        if(num > RR_COUNT_MAX)
                return NULL; /* integer overflow protection */
        msg->rep->rrsets = (struct ub_packed_rrset_key**)
@@ -636,6 +619,14 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
                                r->serve_expired_ttl < now) {
                                return NULL;
                        }
+                       /* Ignore expired failure answers */
+                       if(FLAGS_GET_RCODE(r->flags) !=
+                               LDNS_RCODE_NOERROR &&
+                               FLAGS_GET_RCODE(r->flags) !=
+                               LDNS_RCODE_NXDOMAIN &&
+                               FLAGS_GET_RCODE(r->flags) !=
+                               LDNS_RCODE_YXDOMAIN)
+                               return 0;
                } else {
                        return NULL;
                }
@@ -664,6 +655,10 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
        msg->rep->rrset_count = r->rrset_count;
        msg->rep->authoritative = r->authoritative;
        msg->rep->reason_bogus = r->reason_bogus;
+       if(r->reason_bogus_str) {
+               msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str);
+       }
+
        if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
                return NULL;
        }
@@ -1067,7 +1062,6 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
        /* ttl must be relative ;i.e. 0..86400 not  time(0)+86400.
         * the env->now is added to message and RRsets in this routine. */
        /* the leeway is used to invalidate other rrsets earlier */
-
        if(is_referral) {
                /* store rrsets */
                struct rrset_ref ref;
@@ -1084,7 +1078,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
                                ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
                                 && !pside) ? qstarttime:*env->now + leeway));
                }
-               free(rep);
+               reply_info_delete(rep, NULL);
                return 1;
        } else {
                /* store msg, and rrsets */

diff --git a/sbin/unwind/libunbound/services/cache/infra.c b/sbin/unwind/libunbound/services/cache/infra.c
index 537cb94..31462d1 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/infra.c
+++ b/sbin/unwind/libunbound/services/cache/infra.c
@@ -67,6 +67,11 @@ int infra_dp_ratelimit = 0;
  *  in queries per second. */
 int infra_ip_ratelimit = 0;
 
+/** ratelimit value for client ip addresses,
+ *  in queries per second.
+ *  For clients with a valid DNS Cookie. */
+int infra_ip_ratelimit_cookie = 0;
+
 size_t 
 infra_sizefunc(void* k, void* ATTR_UNUSED(d))
 {
@@ -1051,9 +1056,50 @@ infra_get_mem(struct infra_cache* infra)
        return s;
 }
 
+/* Returns 1 if the limit has not been exceeded, 0 otherwise. */
+static int
+check_ip_ratelimit(struct sockaddr_storage* addr, socklen_t addrlen,
+       struct sldns_buffer* buffer, int premax, int max, int has_cookie)
+{
+       int limit;
+
+       if(has_cookie) limit = infra_ip_ratelimit_cookie;
+       else           limit = infra_ip_ratelimit;
+
+       /* Disabled */
+       if(limit == 0) return 1;
+
+       if(premax <= limit && max > limit) {
+               char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12];
+               addr_to_str(addr, addrlen, client_ip, sizeof(client_ip));
+               qnm[0]=0;
+               if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE &&
+                       LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) {
+                       (void)sldns_wire2str_rrquestion_buf(
+                               sldns_buffer_at(buffer, LDNS_HEADER_SIZE),
+                               sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE,
+                               qnm, sizeof(qnm));
+                       if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n')
+                               qnm[strlen(qnm)-1] = 0; /*remove newline*/
+                       if(strchr(qnm, '\t'))
+                               *strchr(qnm, '\t') = ' ';
+                       if(strchr(qnm, '\t'))
+                               *strchr(qnm, '\t') = ' ';
+                       verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s %s",
+                               client_ip, limit,
+                               has_cookie?"(cookie)":"", qnm);
+               } else {
+                       verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s (no query name)",
+                               client_ip, limit,
+                               has_cookie?"(cookie)":"");
+               }
+       }
+       return (max <= limit);
+}
+
 int infra_ip_ratelimit_inc(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow,
-       int backoff, struct sldns_buffer* buffer)
+       int has_cookie, int backoff, struct sldns_buffer* buffer)
 {
        int max;
        struct lruhash_entry* entry;
@@ -1070,31 +1116,8 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra,
                (*cur)++;
                max = infra_rate_max(entry->data, timenow, backoff);
                lock_rw_unlock(&entry->lock);
-
-               if(premax <= infra_ip_ratelimit && max > infra_ip_ratelimit) {
-                       char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12];
-                       addr_to_str(addr, addrlen, client_ip, sizeof(client_ip));
-                       qnm[0]=0;
-                       if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE &&
-                               LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) {
-                               (void)sldns_wire2str_rrquestion_buf(
-                                       sldns_buffer_at(buffer, LDNS_HEADER_SIZE),
-                                       sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE,
-                                       qnm, sizeof(qnm));
-                               if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n')
-                                       qnm[strlen(qnm)-1] = 0; /*remove newline*/
-                               if(strchr(qnm, '\t'))
-                                       *strchr(qnm, '\t') = ' ';
-                               if(strchr(qnm, '\t'))
-                                       *strchr(qnm, '\t') = ' ';
-                               verbose(VERB_OPS, "ip_ratelimit exceeded %s %d %s",
-                                       client_ip, infra_ip_ratelimit, qnm);
-                       } else {
-                               verbose(VERB_OPS, "ip_ratelimit exceeded %s %d (no query name)",
-                                       client_ip, infra_ip_ratelimit);
-                       }
-               }
-               return (max <= infra_ip_ratelimit);
+               return check_ip_ratelimit(addr, addrlen, buffer, premax, max,
+                       has_cookie);
        }
 
        /* create */

diff --git a/sbin/unwind/libunbound/services/cache/infra.h b/sbin/unwind/libunbound/services/cache/infra.h
index faf7fd2..525073b 100644 (file)
--- a/sbin/unwind/libunbound/services/cache/infra.h
+++ b/sbin/unwind/libunbound/services/cache/infra.h
@@ -153,6 +153,8 @@ struct rate_key {
 
 /** ip ratelimit, 0 is off */
 extern int infra_ip_ratelimit;
+/** ip ratelimit for DNS Cookie clients, 0 is off */
+extern int infra_ip_ratelimit_cookie;
 
 /**
  * key for ip_ratelimit lookups, a source IP.
@@ -419,13 +421,14 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
  *  @param addr: client address
  *  @param addrlen: client address length
  *  @param timenow: what time it is now.
+ *  @param has_cookie: if the request came with a DNS Cookie.
  *  @param backoff: if backoff is enabled.
  *  @param buffer: with query for logging.
  *  @return 1 if it could be incremented. 0 if the increment overshot the
  *  ratelimit and the query should be dropped. */
 int infra_ip_ratelimit_inc(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow,
-       int backoff, struct sldns_buffer* buffer);
+       int has_cookie, int backoff, struct sldns_buffer* buffer);
 
 /**
  * Get memory used by the infra cache.

diff --git a/sbin/unwind/libunbound/services/listen_dnsport.c b/sbin/unwind/libunbound/services/listen_dnsport.c
index 95606af..60f9b41 100644 (file)
--- a/sbin/unwind/libunbound/services/listen_dnsport.c
+++ b/sbin/unwind/libunbound/services/listen_dnsport.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -79,9 +79,11 @@
 #ifdef HAVE_NET_IF_H
 #include <net/if.h>
 #endif
-
+#ifdef HAVE_LINUX_NET_TSTAMP_H
+#include <linux/net_tstamp.h>
+#endif
 /** number of queued TCP connections for listen() */
-#define TCP_BACKLOG 256 
+#define TCP_BACKLOG 256
 
 #ifndef THREADS_DISABLED
 /** lock on the counter of stream buffer memory */
@@ -187,7 +189,7 @@ systemd_get_activated(int family, int socktype, int listen,
                        log_err("systemd sd_listen_fds(): %s", strerror(-r));
                return -1;
        }
-       
+
        for(i = 0; i < r; i++) {
                if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) {
                        s = SD_LISTEN_FDS_START + i;
@@ -253,7 +255,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                        return -1;
                }
 #else
-               if(WSAGetLastError() == WSAEAFNOSUPPORT || 
+               if(WSAGetLastError() == WSAEAFNOSUPPORT ||
                        WSAGetLastError() == WSAEPROTONOSUPPORT) {
                        *noproto = 1;
                        return -1;
@@ -270,7 +272,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #endif
        if(listen) {
 #ifdef SO_REUSEADDR
-               if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
+               if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
                        (socklen_t)sizeof(on)) < 0) {
                        log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
                                sock_strerror(errno));
@@ -368,9 +370,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                socklen_t slen = (socklen_t)sizeof(got);
 #  ifdef SO_RCVBUFFORCE
                /* Linux specific: try to use root permission to override
-                * system limits on rcvbuf. The limit is stored in 
+                * system limits on rcvbuf. The limit is stored in
                 * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */
-               if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, 
+               if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv,
                        (socklen_t)sizeof(rcv)) < 0) {
                        if(errno != EPERM) {
                                log_err("setsockopt(..., SO_RCVBUFFORCE, "
@@ -381,7 +383,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                                return -1;
                        }
 #  endif /* SO_RCVBUFFORCE */
-                       if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, 
+                       if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv,
                                (socklen_t)sizeof(rcv)) < 0) {
                                log_err("setsockopt(..., SO_RCVBUF, "
                                        "...) failed: %s", sock_strerror(errno));
@@ -392,7 +394,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                        }
                        /* check if we got the right thing or if system
                         * reduced to some system max.  Warn if so */
-                       if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, 
+                       if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got,
                                &slen) >= 0 && got < rcv/2) {
                                log_warn("so-rcvbuf %u was not granted. "
                                        "Got %u. To fix: start with "
@@ -413,9 +415,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                socklen_t slen = (socklen_t)sizeof(got);
 #  ifdef SO_SNDBUFFORCE
                /* Linux specific: try to use root permission to override
-                * system limits on sndbuf. The limit is stored in 
+                * system limits on sndbuf. The limit is stored in
                 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
-               if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 
+               if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd,
                        (socklen_t)sizeof(snd)) < 0) {
                        if(errno != EPERM) {
                                log_err("setsockopt(..., SO_SNDBUFFORCE, "
@@ -426,7 +428,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                                return -1;
                        }
 #  endif /* SO_SNDBUFFORCE */
-                       if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 
+                       if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd,
                                (socklen_t)sizeof(snd)) < 0) {
                                log_err("setsockopt(..., SO_SNDBUF, "
                                        "...) failed: %s", sock_strerror(errno));
@@ -437,7 +439,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                        }
                        /* check if we got the right thing or if system
                         * reduced to some system max.  Warn if so */
-                       if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, 
+                       if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got,
                                &slen) >= 0 && got < snd/2) {
                                log_warn("so-sndbuf %u was not granted. "
                                        "Got %u. To fix: start with "
@@ -469,7 +471,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #   endif
                        ) {
                        int val=(v6only==2)?0:1;
-                       if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
+                       if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
                                (void*)&val, (socklen_t)sizeof(val)) < 0) {
                                log_err("setsockopt(..., IPV6_V6ONLY"
                                        ", ...) failed: %s", sock_strerror(errno));
@@ -576,7 +578,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                int action;
 #   if defined(IP_PMTUDISC_OMIT)
                action = IP_PMTUDISC_OMIT;
-               if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
+               if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
                        &action, (socklen_t)sizeof(action)) < 0) {
 
                        if (errno != EINVAL) {
@@ -609,7 +611,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                /* the IP_DONTFRAG option if defined in the 11.0 OSX headers,
                 * but does not work on that version, so we exclude it */
                int off = 0;
-               if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, 
+               if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG,
                        &off, (socklen_t)sizeof(off)) < 0) {
                        log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
                                strerror(errno));
@@ -647,7 +649,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
                if(WSAGetLastError() != WSAEADDRINUSE &&
                        WSAGetLastError() != WSAEADDRNOTAVAIL &&
                        !(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
-                       log_err_addr("can't bind socket", 
+                       log_err_addr("can't bind socket",
                                wsa_strerror(WSAGetLastError()),
                                (struct sockaddr_storage*)addr, addrlen);
                }
@@ -749,7 +751,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
     }
 #endif
 #ifdef SO_REUSEADDR
-       if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
+       if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
                (socklen_t)sizeof(on)) < 0) {
                log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
                        sock_strerror(errno));
@@ -793,7 +795,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
                && !got_fd_from_systemd
 #  endif
                ) {
-               if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
+               if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
                        (void*)&on, (socklen_t)sizeof(on)) < 0) {
                        log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
                                sock_strerror(errno));
@@ -845,7 +847,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
                                addr->ai_addrlen);
                }
 #else
-               log_err_addr("can't bind socket", 
+               log_err_addr("can't bind socket",
                        wsa_strerror(WSAGetLastError()),
                        (struct sockaddr_storage*)addr->ai_addr,
                        addr->ai_addrlen);
@@ -873,7 +875,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
        /* 5 is recommended on linux */
        qlen = 5;
 #endif
-       if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, 
+       if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen,
                  sizeof(qlen))) == -1 ) {
 #ifdef ENOPROTOOPT
                /* squelch ENOPROTOOPT: freebsd server mode with kernel support
@@ -999,7 +1001,7 @@ err:
  * Create socket from getaddrinfo results
  */
 static int
-make_sock(int stype, const char* ifname, const char* port, 
+make_sock(int stype, const char* ifname, const char* port,
        struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
        int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
        int use_systemd, int dscp, struct unbound_socket* ub_sock)
@@ -1015,10 +1017,10 @@ make_sock(int stype, const char* ifname, const char* port,
                        return -1;
                }
 #endif
-               log_err("node %s:%s getaddrinfo: %s %s", 
+               log_err("node %s:%s getaddrinfo: %s %s",
                        ifname?ifname:"default", port, gai_strerror(r),
 #ifdef EAI_SYSTEM
-                       r==EAI_SYSTEM?(char*)strerror(errno):""
+                       (r==EAI_SYSTEM?(char*)strerror(errno):"")
 #else
                        ""
 #endif
@@ -1055,7 +1057,7 @@ make_sock(int stype, const char* ifname, const char* port,
 
 /** make socket and first see if ifname contains port override info */
 static int
-make_sock_port(int stype, const char* ifname, const char* port, 
+make_sock_port(int stype, const char* ifname, const char* port,
        struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
        int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
        int use_systemd, int dscp, struct unbound_socket* ub_sock)
@@ -1114,9 +1116,28 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype,
        return 1;
 }
 
+/** set fd to receive software timestamps */
+static int
+set_recvtimestamp(int s)
+{
+#ifdef HAVE_LINUX_NET_TSTAMP_H
+       int opt = SOF_TIMESTAMPING_RX_SOFTWARE | SOF_TIMESTAMPING_SOFTWARE;
+       if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMPNS, (void*)&opt, (socklen_t)sizeof(opt)) < 0) {
+               log_err("setsockopt(..., SO_TIMESTAMPNS, ...) failed: %s",
+                       strerror(errno));
+               return 0;
+       }
+       return 1;
+#else
+       log_err("packets timestamping is not supported on this platform");
+       (void)s;
+       return 0;
+#endif
+}
+
 /** set fd to receive source address packet info */
 static int
-set_recvpktinfo(int s, int family) 
+set_recvpktinfo(int s, int family)
 {
 #if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
        int on = 1;
@@ -1214,6 +1235,9 @@ if_is_ssl(const char* ifname, const char* port, int ssl_port,
  * @param use_systemd: if true, fetch sockets from systemd.
  * @param dnscrypt_port: dnscrypt service port number
  * @param dscp: DSCP to use.
+ * @param sock_queue_timeout: the sock_queue_timeout from config. Seconds to
+ *     wait to discard if UDP packets have waited for long in the socket
+ *     buffer.
  * @return: returns false on error.
  */
 static int
@@ -1223,7 +1247,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
        struct config_strlist* tls_additional_port, int https_port,
        struct config_strlist* proxy_protocol_port,
        int* reuseport, int transparent, int tcp_mss, int freebind,
-       int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp)
+       int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp,
+       int sock_queue_timeout)
 {
        int s, noip6=0;
        int is_https = if_is_https(ifname, port, https_port);
@@ -1252,7 +1277,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
                        &noip6, rcv, snd, reuseport, transparent,
                        tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        if(noip6) {
                                log_warn("IPv6 protocol not available");
@@ -1263,15 +1289,20 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                /* getting source addr packet info is highly non-portable */
                if(!set_recvpktinfo(s, hints->ai_family)) {
                        sock_close(s);
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        return 0;
                }
+               if (sock_queue_timeout && !set_recvtimestamp(s)) {
+                       log_warn("socket timestamping is not available");
+               }
                if(!port_insert(list, s, is_dnscrypt
                        ?listen_type_udpancil_dnscrypt:listen_type_udpancil,
                        is_pp2, ub_sock)) {
                        sock_close(s);
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        return 0;
                }
@@ -1283,7 +1314,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
                        &noip6, rcv, snd, reuseport, transparent,
                        tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        if(noip6) {
                                log_warn("IPv6 protocol not available");
@@ -1291,11 +1323,15 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                        }
                        return 0;
                }
+               if (sock_queue_timeout && !set_recvtimestamp(s)) {
+                       log_warn("socket timestamping is not available");
+               }
                if(!port_insert(list, s, is_dnscrypt
                        ?listen_type_udp_dnscrypt:listen_type_udp,
                        is_pp2, ub_sock)) {
                        sock_close(s);
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        return 0;
                }
@@ -1318,7 +1354,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1,
                        &noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay,
                        freebind, use_systemd, dscp, ub_sock)) == -1) {
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        if(noip6) {
                                /*log_warn("IPv6 protocol not available");*/
@@ -1330,7 +1367,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
                        verbose(VERB_ALGO, "setup TCP for SSL service");
                if(!port_insert(list, s, port_type, is_pp2, ub_sock)) {
                        sock_close(s);
-                       freeaddrinfo(ub_sock->addr);
+                       if(ub_sock->addr)
+                               freeaddrinfo(ub_sock->addr);
                        free(ub_sock);
                        return 0;
                }
@@ -1338,7 +1376,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
        return 1;
 }
 
-/** 
+/**
  * Add items to commpoint list in front.
  * @param c: commpoint to add.
  * @param front: listen struct.
@@ -1389,7 +1427,7 @@ void listen_desetup_locks(void)
        }
 }
 
-struct listen_dnsport* 
+struct listen_dnsport*
 listen_create(struct comm_base* base, struct listen_port* ports,
        size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
        int harden_large_queries, uint32_t http_max_streams,
@@ -1525,10 +1563,10 @@ listen_list_delete(struct listen_list* list)
        }
 }
 
-void 
+void
 listen_delete(struct listen_dnsport* front)
 {
-       if(!front) 
+       if(!front)
                return;
        listen_list_delete(front->cps);
 #ifdef USE_DNSCRYPT
@@ -1802,7 +1840,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                                reuseport, cfg->ip_transparent,
                                                cfg->tcp_mss, cfg->ip_freebind,
                                                cfg->http_nodelay, cfg->use_systemd,
-                                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                                listening_ports_free(list);
                                                return NULL;
                                        }
@@ -1819,7 +1857,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                                reuseport, cfg->ip_transparent,
                                                cfg->tcp_mss, cfg->ip_freebind,
                                                cfg->http_nodelay, cfg->use_systemd,
-                                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                                listening_ports_free(list);
                                                return NULL;
                                        }
@@ -1838,7 +1876,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                reuseport, cfg->ip_transparent,
                                cfg->tcp_mss, cfg->ip_freebind,
                                cfg->http_nodelay, cfg->use_systemd,
-                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                listening_ports_free(list);
                                return NULL;
                        }
@@ -1854,7 +1892,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                reuseport, cfg->ip_transparent,
                                cfg->tcp_mss, cfg->ip_freebind,
                                cfg->http_nodelay, cfg->use_systemd,
-                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                listening_ports_free(list);
                                return NULL;
                        }
@@ -1872,7 +1910,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                reuseport, cfg->ip_transparent,
                                cfg->tcp_mss, cfg->ip_freebind,
                                cfg->http_nodelay, cfg->use_systemd,
-                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                listening_ports_free(list);
                                return NULL;
                        }
@@ -1888,7 +1926,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
                                reuseport, cfg->ip_transparent,
                                cfg->tcp_mss, cfg->ip_freebind,
                                cfg->http_nodelay, cfg->use_systemd,
-                               cfg->dnscrypt_port, cfg->ip_dscp)) {
+                               cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) {
                                listening_ports_free(list);
                                return NULL;
                        }
@@ -1908,7 +1946,8 @@ void listening_ports_free(struct listen_port* list)
                }
                /* rc_ports don't have ub_socket */
                if(list->socket) {
-                       freeaddrinfo(list->socket->addr);
+                       if(list->socket->addr)
+                               freeaddrinfo(list->socket->addr);
                        free(list->socket);
                }
                free(list);
@@ -1919,8 +1958,8 @@ void listening_ports_free(struct listen_port* list)
 size_t listen_get_mem(struct listen_dnsport* listen)
 {
        struct listen_list* p;
-       size_t s = sizeof(*listen) + sizeof(*listen->base) + 
-               sizeof(*listen->udp_buff) + 
+       size_t s = sizeof(*listen) + sizeof(*listen->base) +
+               sizeof(*listen->udp_buff) +
                sldns_buffer_capacity(listen->udp_buff);
 #ifdef USE_DNSCRYPT
        s += sizeof(*listen->dnscrypt_udp_buff);
@@ -2001,7 +2040,7 @@ void tcp_req_info_clear(struct tcp_req_info* req)
        }
        req->open_req_list = NULL;
        req->num_open_req = 0;
-       
+
        /* free pending writable result packets */
        item = req->done_req_list;
        while(item) {
@@ -2060,7 +2099,7 @@ tcp_req_info_setup_listen(struct tcp_req_info* req)
                wr = 1;
        if(!req->read_is_closed)
                rd = 1;
-       
+
        if(wr) {
                req->cp->tcp_is_reading = 0;
                comm_point_stop_listening(req->cp);
@@ -2196,7 +2235,7 @@ tcp_req_info_handle_readdone(struct tcp_req_info* req)
        }
        req->in_worker_handle = 0;
        /* it should be waiting in the mesh for recursion.
-        * If mesh failed to add a new entry and called commpoint_drop_reply. 
+        * If mesh failed to add a new entry and called commpoint_drop_reply.
         * Then the mesh state has been cleared. */
        if(req->is_drop) {
                /* the reply has been dropped, stream has been closed. */
@@ -2256,7 +2295,7 @@ tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len)
        last = req->done_req_list;
        while(last && last->next)
                last = last->next;
-       
+
        /* create new element */
        item = (struct tcp_req_done_item*)malloc(sizeof(*item));
        if(!item) {
@@ -2615,7 +2654,7 @@ static int http2_query_read_done(struct http2_session* h2_session,
                        "buffer already assigned to stream");
                return -1;
        }
-    
+
     /* the c->buffer might be used by mesh_send_reply and no be cleard
         * need to be cleared before use */
        sldns_buffer_clear(h2_session->c->buffer);

diff --git a/sbin/unwind/libunbound/services/localzone.c b/sbin/unwind/libunbound/services/localzone.c
index 3536b7a..44da22d 100644 (file)
--- a/sbin/unwind/libunbound/services/localzone.c
+++ b/sbin/unwind/libunbound/services/localzone.c
@@ -1308,6 +1308,7 @@ local_encode(struct query_info* qinfo, struct module_env* env,
        else    rep.ns_numrrsets = 1;
        rep.rrset_count = 1;
        rep.rrsets = &rrset;
+       rep.reason_bogus = LDNS_EDE_NONE;
        udpsize = edns->udp_size;
        edns->edns_version = EDNS_ADVERTISED_VERSION;
        edns->udp_size = EDNS_ADVERTISED_SIZE;
@@ -1603,7 +1604,7 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo,
        struct local_data key;
        struct local_data* ld = NULL;
        struct local_rrset* lr = NULL;
-       if(z->type == local_zone_always_transparent)
+       if(z->type == local_zone_always_transparent || z->type == local_zone_block_a)
                return 1;
        if(z->type != local_zone_transparent
                && z->type != local_zone_typetransparent
@@ -1679,6 +1680,16 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
        } else if(lz_type == local_zone_typetransparent
                || lz_type == local_zone_always_transparent) {
                /* no NODATA or NXDOMAINS for this zone type */
+               return 0;
+       } else if(lz_type == local_zone_block_a) {
+               /* Return NODATA for all A queries */
+               if(qinfo->qtype == LDNS_RR_TYPE_A) {
+                       local_error_encode(qinfo, env, edns, repinfo, buf, temp,
+                               LDNS_RCODE_NOERROR, (LDNS_RCODE_NOERROR|BIT_AA),
+                               LDNS_EDE_NONE, NULL);
+                               return 1;
+               }
+
                return 0;
        } else if(lz_type == local_zone_always_null) {
                /* 0.0.0.0 or ::0 or noerror/nodata for this zone type,
@@ -1846,7 +1857,8 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
                if(z && (lzt == local_zone_transparent ||
                        lzt == local_zone_typetransparent ||
                        lzt == local_zone_inform ||
-                       lzt == local_zone_always_transparent) &&
+                       lzt == local_zone_always_transparent ||
+                       lzt == local_zone_block_a) &&
                        local_zone_does_not_cover(z, qinfo, labs)) {
                        lock_rw_unlock(&z->lock);
                        z = NULL;
@@ -1894,6 +1906,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 
        if(lzt != local_zone_always_refuse
                && lzt != local_zone_always_transparent
+               && lzt != local_zone_block_a
                && lzt != local_zone_always_nxdomain
                && lzt != local_zone_always_nodata
                && lzt != local_zone_always_deny
@@ -1924,6 +1937,7 @@ const char* local_zone_type2str(enum localzone_type t)
                case local_zone_inform_deny: return "inform_deny";
                case local_zone_inform_redirect: return "inform_redirect";
                case local_zone_always_transparent: return "always_transparent";
+               case local_zone_block_a: return "block_a";
                case local_zone_always_refuse: return "always_refuse";
                case local_zone_always_nxdomain: return "always_nxdomain";
                case local_zone_always_nodata: return "always_nodata";
@@ -1958,6 +1972,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
                *t = local_zone_inform_redirect;
        else if(strcmp(type, "always_transparent") == 0)
                *t = local_zone_always_transparent;
+       else if(strcmp(type, "block_a") == 0)
+               *t = local_zone_block_a;
        else if(strcmp(type, "always_refuse") == 0)
                *t = local_zone_always_refuse;
        else if(strcmp(type, "always_nxdomain") == 0)

diff --git a/sbin/unwind/libunbound/services/localzone.h b/sbin/unwind/libunbound/services/localzone.h
index 19534f7..4456893 100644 (file)
--- a/sbin/unwind/libunbound/services/localzone.h
+++ b/sbin/unwind/libunbound/services/localzone.h
@@ -88,6 +88,8 @@ enum localzone_type {
        local_zone_inform_redirect,
        /** resolve normally, even when there is local data */  
        local_zone_always_transparent,
+       /** resolve normally, even when there is local data but return NODATA for A queries */
+       local_zone_block_a,
        /** answer with error, even when there is local data */ 
        local_zone_always_refuse,
        /** answer with nxdomain, even when there is local data */

diff --git a/sbin/unwind/libunbound/services/mesh.c b/sbin/unwind/libunbound/services/mesh.c
index 9007b6e..52d14a2 100644 (file)
--- a/sbin/unwind/libunbound/services/mesh.c
+++ b/sbin/unwind/libunbound/services/mesh.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -63,82 +63,13 @@
 #include "util/data/dname.h"
 #include "respip/respip.h"
 #include "services/listen_dnsport.h"
+#include "util/timeval_func.h"
 
 #ifdef CLIENT_SUBNET
 #include "edns-subnet/subnetmod.h"
 #include "edns-subnet/edns-subnet.h"
 #endif
 
-/** subtract timers and the values do not overflow or become negative */
-static void
-timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
-{
-#ifndef S_SPLINT_S
-       time_t end_usec = end->tv_usec;
-       d->tv_sec = end->tv_sec - start->tv_sec;
-       if(end_usec < start->tv_usec) {
-               end_usec += 1000000;
-               d->tv_sec--;
-       }
-       d->tv_usec = end_usec - start->tv_usec;
-#endif
-}
-
-/** add timers and the values do not overflow or become negative */
-static void
-timeval_add(struct timeval* d, const struct timeval* add)
-{
-#ifndef S_SPLINT_S
-       d->tv_sec += add->tv_sec;
-       d->tv_usec += add->tv_usec;
-       if(d->tv_usec >= 1000000 ) {
-               d->tv_usec -= 1000000;
-               d->tv_sec++;
-       }
-#endif
-}
-
-/** divide sum of timers to get average */
-static void
-timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
-{
-#ifndef S_SPLINT_S
-       size_t leftover;
-       if(d <= 0) {
-               avg->tv_sec = 0;
-               avg->tv_usec = 0;
-               return;
-       }
-       avg->tv_sec = sum->tv_sec / d;
-       avg->tv_usec = sum->tv_usec / d;
-       /* handle fraction from seconds divide */
-       leftover = sum->tv_sec - avg->tv_sec*d;
-       if(leftover <= 0)
-               leftover = 0;
-       avg->tv_usec += (((long long)leftover)*((long long)1000000))/d;
-       if(avg->tv_sec < 0)
-               avg->tv_sec = 0;
-       if(avg->tv_usec < 0)
-               avg->tv_usec = 0;
-#endif
-}
-
-/** histogram compare of time values */
-static int
-timeval_smaller(const struct timeval* x, const struct timeval* y)
-{
-#ifndef S_SPLINT_S
-       if(x->tv_sec < y->tv_sec)
-               return 1;
-       else if(x->tv_sec == y->tv_sec) {
-               if(x->tv_usec <= y->tv_usec)
-                       return 1;
-               else    return 0;
-       }
-       else    return 0;
-#endif
-}
-
 /**
  * Compare two response-ip client info entries for the purpose of mesh state
  * compare.  It returns 0 if ci_a and ci_b are considered equal; otherwise
@@ -249,7 +180,7 @@ mesh_state_ref_compare(const void* ap, const void* bp)
        return mesh_state_compare(a->s, b->s);
 }
 
-struct mesh_area* 
+struct mesh_area*
 mesh_create(struct module_stack* stack, struct module_env* env)
 {
        struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));
@@ -275,6 +206,7 @@ mesh_create(struct module_stack* stack, struct module_env* env)
        mesh->stats_jostled = 0;
        mesh->stats_dropped = 0;
        mesh->ans_expired = 0;
+       mesh->ans_cachedb = 0;
        mesh->max_reply_states = env->cfg->num_queries_per_thread;
        mesh->max_forever_states = (mesh->max_reply_states+1)/2;
 #ifndef S_SPLINT_S
@@ -298,7 +230,7 @@ mesh_delete_helper(rbnode_type* n)
         * traversal and rbtree rebalancing do not work together */
 }
 
-void 
+void
 mesh_delete(struct mesh_area* mesh)
 {
        if(!mesh)
@@ -341,7 +273,7 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
        if(m && m->reply_list && m->list_select == mesh_jostle_list) {
                /* how old is it? */
                struct timeval age;
-               timeval_subtract(&age, mesh->env->now_tv, 
+               timeval_subtract(&age, mesh->env->now_tv,
                        &m->reply_list->start_time);
                if(timeval_smaller(&mesh->jostle_max, &age)) {
                        /* its a goner */
@@ -517,6 +449,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
                        comm_point_send_reply(rep);
                        return;
                }
+               /* set detached (it is now) */
+               mesh->num_detached_states++;
                if(unique)
                        mesh_state_make_unique(s);
                s->s.rpz_passthru = rpz_passthru;
@@ -525,13 +459,14 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
                        s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
                                s->s.region);
                        if(!s->s.edns_opts_front_in) {
-                               log_err("mesh_state_create: out of memory; SERVFAIL");
+                               log_err("edns_opt_copy_region: out of memory; SERVFAIL");
                                if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
                                        NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
                                                edns->opt_list_inplace_cb_out = NULL;
                                error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
                                        qinfo, qid, qflags, edns);
                                comm_point_send_reply(rep);
+                               mesh_state_delete(&s->s);
                                return;
                        }
                }
@@ -543,8 +478,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 #endif
                rbtree_insert(&mesh->all, &s->node);
                log_assert(n != NULL);
-               /* set detached (it is now) */
-               mesh->num_detached_states++;
                added = 1;
        }
        if(!s->reply_list && !s->cb_list) {
@@ -585,11 +518,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
                /* move to either the forever or the jostle_list */
                if(mesh->num_forever_states < mesh->max_forever_states) {
                        mesh->num_forever_states ++;
-                       mesh_list_insert(s, &mesh->forever_first, 
+                       mesh_list_insert(s, &mesh->forever_first,
                                &mesh->forever_last);
                        s->list_select = mesh_forever_list;
                } else {
-                       mesh_list_insert(s, &mesh->jostle_first, 
+                       mesh_list_insert(s, &mesh->jostle_first,
                                &mesh->jostle_last);
                        s->list_select = mesh_jostle_list;
                }
@@ -610,9 +543,9 @@ servfail_mem:
        return;
 }
 
-int 
+int
 mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
-       uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, 
+       uint16_t qflags, struct edns_data* edns, sldns_buffer* buf,
        uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru)
 {
        struct mesh_state* s = NULL;
@@ -637,6 +570,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
                if(!s) {
                        return 0;
                }
+               /* set detached (it is now) */
+               mesh->num_detached_states++;
                if(unique)
                        mesh_state_make_unique(s);
                s->s.rpz_passthru = rpz_passthru;
@@ -644,6 +579,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
                        s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
                                s->s.region);
                        if(!s->s.edns_opts_front_in) {
+                               mesh_state_delete(&s->s);
                                return 0;
                        }
                }
@@ -654,8 +590,6 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 #endif
                rbtree_insert(&mesh->all, &s->node);
                log_assert(n != NULL);
-               /* set detached (it is now) */
-               mesh->num_detached_states++;
                added = 1;
        }
        if(!s->reply_list && !s->cb_list) {
@@ -672,6 +606,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
        }
        /* add serve expired timer if not already there */
        if(timeout && !mesh_serve_expired_init(s, timeout)) {
+               if(added)
+                       mesh_state_delete(&s->s);
                return 0;
        }
        /* update statistics */
@@ -773,7 +709,7 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
  * attached its own ECS data. */
 static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
        struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
-       int rpz_passthru, struct comm_reply* rep, struct edns_option* edns_list)
+       int rpz_passthru, struct sockaddr_storage* addr, struct edns_option* edns_list)
 {
        struct mesh_state* s = NULL;
        struct edns_option* opt = NULL;
@@ -803,20 +739,10 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
                        return;
                }
        } else {
-               /* Fake the ECS data from the client's IP */
-               struct ecs_data ecs;
-               memset(&ecs, 0, sizeof(ecs));
-               subnet_option_from_ss(&rep->client_addr, &ecs, mesh->env->cfg);
-               if(ecs.subnet_validdata == 0) {
-                       log_err("prefetch_subnet subnet_option_from_ss: invalid data");
-                       return;
-               }
-               subnet_ecs_opt_list_append(&ecs, &s->s.edns_opts_front_in,
-                       &s->s, s->s.region);
-               if(!s->s.edns_opts_front_in) {
-                       log_err("prefetch_subnet subnet_ecs_opt_list_append: out of memory");
-                       return;
-               }
+               /* Store the client's address. Later in the subnet module,
+                * it is decided whether to include an ECS option or not.
+                */
+               s->s.client_addr =  *addr;
        }
 #ifdef UNBOUND_DEBUG
        n =
@@ -863,14 +789,14 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
 
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
        uint16_t qflags, time_t leeway, int rpz_passthru,
-       struct comm_reply* rep, struct edns_option* opt_list)
+       struct sockaddr_storage* addr, struct edns_option* opt_list)
 {
+       (void)addr;
        (void)opt_list;
-       (void)rep;
 #ifdef CLIENT_SUBNET
-       if(rep)
+       if(addr)
                mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1,
-                       rpz_passthru, rep, opt_list);
+                       rpz_passthru, addr, opt_list);
        else
 #endif
                mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1,
@@ -900,7 +826,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
        int i;
        if(!region)
                return NULL;
-       mstate = (struct mesh_state*)regional_alloc(region, 
+       mstate = (struct mesh_state*)regional_alloc(region,
                sizeof(struct mesh_state));
        if(!mstate) {
                alloc_reg_release(env->alloc, region);
@@ -970,19 +896,13 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
        return mstate;
 }
 
-int
-mesh_state_is_unique(struct mesh_state* mstate)
-{
-       return mstate->unique != NULL;
-}
-
 void
 mesh_state_make_unique(struct mesh_state* mstate)
 {
        mstate->unique = mstate;
 }
 
-void 
+void
 mesh_state_cleanup(struct mesh_state* mstate)
 {
        struct mesh_area* mesh;
@@ -1028,7 +948,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
        alloc_reg_release(mstate->s.env->alloc, mstate->s.region);
 }
 
-void 
+void
 mesh_state_delete(struct module_qstate* qstate)
 {
        struct mesh_area* mesh;
@@ -1041,10 +961,10 @@ mesh_state_delete(struct module_qstate* qstate)
        mesh_detach_subs(&mstate->s);
        if(mstate->list_select == mesh_forever_list) {
                mesh->num_forever_states --;
-               mesh_list_remove(mstate, &mesh->forever_first, 
+               mesh_list_remove(mstate, &mesh->forever_first,
                        &mesh->forever_last);
        } else if(mstate->list_select == mesh_jostle_list) {
-               mesh_list_remove(mstate, &mesh->jostle_first, 
+               mesh_list_remove(mstate, &mesh->jostle_first,
                        &mesh->jostle_last);
        }
        if(!mstate->reply_list && !mstate->cb_list
@@ -1116,7 +1036,7 @@ void mesh_detach_subs(struct module_qstate* qstate)
                if(!ref->s->reply_list && !ref->s->cb_list
                        && ref->s->super_set.count == 0) {
                        mesh->num_detached_states++;
-                       log_assert(mesh->num_detached_states + 
+                       log_assert(mesh->num_detached_states +
                                mesh->num_reply_states <= mesh->all.count);
                }
        }
@@ -1181,7 +1101,7 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
        if(!mesh_state_attachment(qstate->mesh_info, sub))
                return 0;
        /* if it was a duplicate  attachment, the count was not zero before */
-       if(!sub->reply_list && !sub->cb_list && was_detached && 
+       if(!sub->reply_list && !sub->cb_list && was_detached &&
                sub->super_set.count == 1) {
                /* it used to be detached, before this one got added */
                log_assert(mesh->num_detached_states > 0);
@@ -1251,7 +1171,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
        else    secure = 0;
        if(!rep && rcode == LDNS_RCODE_NOERROR)
                rcode = LDNS_RCODE_SERVFAIL;
-       if(!rcode && (rep->security == sec_status_bogus ||
+       if(!rcode && rep && (rep->security == sec_status_bogus ||
                rep->security == sec_status_secure_sentinel_fail)) {
                if(!(reason = errinf_to_str_bogus(&m->s)))
                        rcode = LDNS_RCODE_SERVFAIL;
@@ -1280,10 +1200,10 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 
                if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
                        LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||
-                       !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
-                       r->qflags, r->buf, 0, 1, 
-                       m->s.env->scratch, udp_size, &r->edns, 
-                       (int)(r->edns.bits & EDNS_DO), secure)) 
+                       !reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
+                       r->qflags, r->buf, 0, 1,
+                       m->s.env->scratch, udp_size, &r->edns,
+                       (int)(r->edns.bits & EDNS_DO), secure))
                {
                        fptr_ok(fptr_whitelist_mesh_cb(r->cb));
                        (*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
@@ -1291,7 +1211,8 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
                } else {
                        fptr_ok(fptr_whitelist_mesh_cb(r->cb));
                        (*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
-                               rep->security, reason, was_ratelimited);
+                               (rep?rep->security:sec_status_unchecked),
+                               reason, was_ratelimited);
                }
        }
        free(reason);
@@ -1311,10 +1232,36 @@ mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m)
 }
 
 static inline int
-mesh_is_udp(struct mesh_reply const* r) {
+mesh_is_udp(struct mesh_reply const* r)
+{
        return r->query_reply.c->type == comm_udp;
 }
 
+static inline void
+mesh_find_and_attach_ede_and_reason(struct mesh_state* m,
+       struct reply_info* rep, struct mesh_reply* r)
+{
+       /* OLD note:
+        * During validation the EDE code can be received via two
+        * code paths. One code path fills the reply_info EDE, and
+        * the other fills it in the errinf_strlist. These paths
+        * intersect at some points, but where is opaque due to
+        * the complexity of the validator. At the time of writing
+        * we make the choice to prefer the EDE from errinf_strlist
+        * but a compelling reason to do otherwise is just as valid
+        * NEW note:
+        * The compelling reason is that with caching support, the value
+        * in the reply_info is cached.
+        * The reason members of the reply_info struct should be
+        * updated as they are already cached. No reason to
+        * try and find the EDE information in errinf anymore.
+        */
+       if(rep->reason_bogus != LDNS_EDE_NONE) {
+               edns_opt_list_append_ede(&r->edns.opt_list_out,
+                       m->s.region, rep->reason_bogus, rep->reason_bogus_str);
+       }
+}
+
 /**
  * Send reply to mesh reply entry
  * @param m: mesh state to send it for.
@@ -1346,7 +1293,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 
        /* examine security status */
        if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
-               m->s.env->cfg->ignore_cd) && rep && 
+               m->s.env->cfg->ignore_cd) && rep &&
                (rep->security <= sec_status_bogus ||
                rep->security == sec_status_secure_sentinel_fail)) {
                rcode = LDNS_RCODE_SERVFAIL;
@@ -1401,40 +1348,17 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                        if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
                                rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))
                                        r->edns.opt_list_inplace_cb_out = NULL;
-               } else { 
+               } else {
                        if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
                                &r->edns, &r->query_reply, m->s.region, &r->start_time))
                                        r->edns.opt_list_inplace_cb_out = NULL;
                }
-               /* Send along EDE BOGUS EDNS0 option when answer is bogus */
-               if(m->s.env->cfg->ede && rcode == LDNS_RCODE_SERVFAIL &&
-                       m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
-                       m->s.env->cfg->ignore_cd) && rep &&
-                       (rep->security <= sec_status_bogus ||
-                       rep->security == sec_status_secure_sentinel_fail)) {
-                       char *reason = m->s.env->cfg->val_log_level >= 2
-                               ? errinf_to_str_bogus(&m->s) : NULL;
-
-                       /* During validation the EDE code can be received via two
-                        * code paths. One code path fills the reply_info EDE, and
-                        * the other fills it in the errinf_strlist. These paths
-                        * intersect at some points, but where is opaque due to
-                        * the complexity of the validator. At the time of writing
-                        * we make the choice to prefer the EDE from errinf_strlist
-                        * but a compelling reason to do otherwise is just as valid
-                        */
-                       sldns_ede_code reason_bogus = errinf_to_reason_bogus(&m->s);
-                       if ((reason_bogus == LDNS_EDE_DNSSEC_BOGUS &&
-                               rep->reason_bogus != LDNS_EDE_NONE) ||
-                               reason_bogus == LDNS_EDE_NONE) {
-                                       reason_bogus = rep->reason_bogus;
-                       }
-
-                       if(reason_bogus != LDNS_EDE_NONE) {
-                               edns_opt_list_append_ede(&r->edns.opt_list_out,
-                                       m->s.region, reason_bogus, reason);
-                       }
-                       free(reason);
+               /* Send along EDE EDNS0 option when SERVFAILing; usually
+                * DNSSEC validation failures */
+               /* Since we are SERVFAILing here, CD bit and rep->security
+                * is already handled. */
+               if(m->s.env->cfg->ede && rep) {
+                       mesh_find_and_attach_ede_and_reason(m, rep, r);
                }
                error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
                        r->qflags, &r->edns);
@@ -1449,12 +1373,22 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
                r->edns.bits &= EDNS_DO;
                m->s.qinfo.qname = r->qname;
                m->s.qinfo.local_alias = r->local_alias;
+
+               /* Attach EDE without SERVFAIL if the validation failed.
+                * Need to explicitly check for rep->security otherwise failed
+                * validation paths may attach to a secure answer. */
+               if(m->s.env->cfg->ede && rep &&
+                       (rep->security <= sec_status_bogus ||
+                       rep->security == sec_status_secure_sentinel_fail)) {
+                       mesh_find_and_attach_ede_and_reason(m, rep, r);
+               }
+
                if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
                        LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||
-                       !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
+                       !reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
                        r->qflags, r_buffer, 0, 1, m->s.env->scratch,
                        udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),
-                       secure)) 
+                       secure))
                {
                        if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
                        rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))
@@ -1503,6 +1437,7 @@ void mesh_query_done(struct mesh_state* mstate)
        struct reply_info* rep = (mstate->s.return_msg?
                mstate->s.return_msg->rep:NULL);
        struct timeval tv = {0, 0};
+       int i = 0;
        /* No need for the serve expired timer anymore; we are going to reply. */
        if(mstate->s.serve_expired_data) {
                comm_timer_delete(mstate->s.serve_expired_data->timer);
@@ -1522,6 +1457,7 @@ void mesh_query_done(struct mesh_state* mstate)
                }
        }
        for(r = mstate->reply_list; r; r = r->next) {
+               i++;
                tv = r->start_time;
 
                /* if a response-ip address block has been stored the
@@ -1533,16 +1469,6 @@ void mesh_query_done(struct mesh_state* mstate)
                                mstate->s.qinfo.qclass, r->local_alias,
                                &r->query_reply.client_addr,
                                r->query_reply.client_addrlen);
-                       if(mstate->s.env->cfg->stat_extended &&
-                               mstate->s.respip_action_info->rpz_used) {
-                               if(mstate->s.respip_action_info->rpz_disabled)
-                                       mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
-                               if(mstate->s.respip_action_info->rpz_cname_override)
-                                       mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
-                               else
-                                       mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action(
-                                               mstate->s.respip_action_info->action)]++;
-                       }
                }
 
                /* if this query is determined to be dropped during the
@@ -1573,6 +1499,27 @@ void mesh_query_done(struct mesh_state* mstate)
                        prev_buffer = r_buffer;
                }
        }
+       /* Account for each reply sent. */
+       if(i > 0 && mstate->s.respip_action_info &&
+               mstate->s.respip_action_info->addrinfo &&
+               mstate->s.env->cfg->stat_extended &&
+               mstate->s.respip_action_info->rpz_used) {
+               if(mstate->s.respip_action_info->rpz_disabled)
+                       mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i;
+               if(mstate->s.respip_action_info->rpz_cname_override)
+                       mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i;
+               else
+                       mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action(
+                               mstate->s.respip_action_info->action)] += i;
+       }
+       if(!mstate->s.is_drop && i > 0) {
+               if(mstate->s.env->cfg->stat_extended
+                       && mstate->s.is_cachedb_answer) {
+                       mstate->s.env->mesh->ans_cachedb += i;
+               }
+       }
+
+       /* Mesh area accounting */
        if(mstate->reply_list) {
                mstate->reply_list = NULL;
                if(!mstate->reply_list && !mstate->cb_list) {
@@ -1585,6 +1532,7 @@ void mesh_query_done(struct mesh_state* mstate)
                        mstate->s.env->mesh->num_detached_states++;
        }
        mstate->replies_sent = 1;
+
        while((c = mstate->cb_list) != NULL) {
                /* take this cb off the list; so that the list can be
                 * changed, eg. by adds from the callback routine */
@@ -1611,7 +1559,7 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
                /* callback the function to inform super of result */
                fptr_ok(fptr_whitelist_mod_inform_super(
                        mesh->mods.mod[ref->s->s.curmod]->inform_super));
-               (*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, 
+               (*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s,
                        ref->s->s.curmod, &ref->s->s);
                /* copy state that is always relevant to super */
                copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s);
@@ -1635,7 +1583,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
         * desire aggregation).*/
        key.unique = NULL;
        key.s.client_info = cinfo;
-       
+
        result = (struct mesh_state*)rbtree_search(&mesh->all, &key);
        return result;
 }
@@ -1644,7 +1592,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
         sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,
        uint16_t qid, uint16_t qflags)
 {
-       struct mesh_cb* r = regional_alloc(s->s.region, 
+       struct mesh_cb* r = regional_alloc(s->s.region,
                sizeof(struct mesh_cb));
        if(!r)
                return 0;
@@ -1776,7 +1724,7 @@ mesh_copy_qinfo(struct mesh_state* mstate, struct query_info** qinfop,
  * Handles module finished.
  * @param mesh: the mesh area.
  * @param mstate: currently active mesh state.
- *     Deleted if finished, calls _done and _supers to 
+ *     Deleted if finished, calls _done and _supers to
  *     send replies to clients and inform other mesh states.
  *     This in turn may create additional runnable mesh states.
  * @param s: state at which the current module exited.
@@ -1810,7 +1758,7 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
                }
                if(s == module_restart_next) {
                        int curmod = mstate->s.curmod;
-                       for(; mstate->s.curmod < mesh->mods.num; 
+                       for(; mstate->s.curmod < mesh->mods.num;
                                mstate->s.curmod++) {
                                fptr_ok(fptr_whitelist_mod_clear(
                                        mesh->mods.mod[mstate->s.curmod]->clear));
@@ -1842,9 +1790,21 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
        if(s == module_finished) {
                if(mstate->s.curmod == 0) {
                        struct query_info* qinfo = NULL;
+                       struct edns_option* opt_list = NULL;
+                       struct sockaddr_storage addr;
                        uint16_t qflags;
                        int rpz_p = 0;
 
+#ifdef CLIENT_SUBNET
+                       struct edns_option* ecs;
+                       if(mstate->s.need_refetch && mstate->reply_list &&
+                               modstack_find(&mesh->mods, "subnetcache") != -1 &&
+                               mstate->s.env->unique_mesh) {
+                               addr = mstate->reply_list->query_reply.client_addr;
+                       } else
+#endif
+                               memset(&addr, 0, sizeof(addr));
+
                        mesh_query_done(mstate);
                        mesh_walk_supers(mesh, mstate);
 
@@ -1854,13 +1814,28 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
                         * we need to make a copy of the query info here. */
                        if(mstate->s.need_refetch) {
                                mesh_copy_qinfo(mstate, &qinfo, &qflags);
+#ifdef CLIENT_SUBNET
+                               /* Make also a copy of the ecs option if any */
+                               if((ecs = edns_opt_list_find(
+                                       mstate->s.edns_opts_front_in,
+                                       mstate->s.env->cfg->client_subnet_opcode)) != NULL) {
+                                       (void)edns_opt_list_append(&opt_list,
+                                               ecs->opt_code, ecs->opt_len,
+                                               ecs->opt_data,
+                                               mstate->s.env->scratch);
+                               }
+#endif
                                rpz_p = mstate->s.rpz_passthru;
                        }
 
-                       mesh_state_delete(&mstate->s);
                        if(qinfo) {
-                               mesh_schedule_prefetch(mesh, qinfo, qflags,
-                                       0, 1, rpz_p);
+                               mesh_state_delete(&mstate->s);
+                               mesh_new_prefetch(mesh, qinfo, qflags, 0,
+                                       rpz_p,
+                                       addr.ss_family!=AF_UNSPEC?&addr:NULL,
+                                       opt_list);
+                       } else {
+                               mesh_state_delete(&mstate->s);
                        }
                        return 0;
                }
@@ -1888,7 +1863,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
                mstate->s.reply = NULL;
                regional_free_all(mstate->s.env->scratch);
                s = mstate->s.ext_state[mstate->s.curmod];
-               verbose(VERB_ALGO, "mesh_run: %s module exit state is %s", 
+               verbose(VERB_ALGO, "mesh_run: %s module exit state is %s",
                        mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));
                e = NULL;
                if(mesh_continue(mesh, mstate, s, &ev))
@@ -1908,14 +1883,14 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
        }
 }
 
-void 
+void
 mesh_log_list(struct mesh_area* mesh)
 {
        char buf[30];
        struct mesh_state* m;
        int num = 0;
        RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
-               snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", 
+               snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s",
                        num++, (m->s.is_priming)?"p":"",  /* prime */
                        (m->s.is_valrec)?"v":"",  /* prime */
                        (m->s.query_flags&BIT_RD)?"RD":"",
@@ -1924,18 +1899,18 @@ mesh_log_list(struct mesh_area* mesh)
                        (m->sub_set.count!=0)?"c":"",  /* children */
                        m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/
                        (m->cb_list)?"cb":"" /* callbacks */
-                       ); 
+                       );
                log_query_info(VERB_ALGO, buf, &m->s.qinfo);
        }
 }
 
-void 
+void
 mesh_stats(struct mesh_area* mesh, const char* str)
 {
        verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
                "%u detached), %u waiting replies, %u recursion replies "
-               "sent, %d replies dropped, %d states jostled out", 
-               str, (unsigned)mesh->all.count, 
+               "sent, %d replies dropped, %d states jostled out",
+               str, (unsigned)mesh->all.count,
                (unsigned)mesh->num_reply_states,
                (unsigned)mesh->num_detached_states,
                (unsigned)mesh->num_reply_addrs,
@@ -1944,7 +1919,7 @@ mesh_stats(struct mesh_area* mesh, const char* str)
                (unsigned)mesh->stats_jostled);
        if(mesh->replies_sent > 0) {
                struct timeval avg;
-               timeval_divide(&avg, &mesh->replies_sum_wait, 
+               timeval_divide(&avg, &mesh->replies_sum_wait,
                        mesh->replies_sent);
                log_info("average recursion processing time "
                        ARG_LL "d.%6.6d sec",
@@ -1954,7 +1929,7 @@ mesh_stats(struct mesh_area* mesh, const char* str)
        }
 }
 
-void 
+void
 mesh_stats_clear(struct mesh_area* mesh)
 {
        if(!mesh)
@@ -1968,12 +1943,13 @@ mesh_stats_clear(struct mesh_area* mesh)
        mesh->ans_secure = 0;
        mesh->ans_bogus = 0;
        mesh->ans_expired = 0;
+       mesh->ans_cachedb = 0;
        memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM);
        memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
        mesh->ans_nodata = 0;
 }
 
-size_t 
+size_t
 mesh_get_mem(struct mesh_area* mesh)
 {
        struct mesh_state* m;
@@ -1987,7 +1963,7 @@ mesh_get_mem(struct mesh_area* mesh)
        return s;
 }
 
-int 
+int
 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
        uint16_t flags, int prime, int valrec)
 {
@@ -2104,6 +2080,7 @@ mesh_serve_expired_callback(void* arg)
        struct timeval tv = {0, 0};
        int must_validate = (!(qstate->query_flags&BIT_CD)
                || qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
+       int i = 0;
        if(!qstate->serve_expired_data) return;
        verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");
        comm_timer_delete(qstate->serve_expired_data->timer);
@@ -2175,6 +2152,7 @@ mesh_serve_expired_callback(void* arg)
                log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
        for(r = mstate->reply_list; r; r = r->next) {
+               i++;
                tv = r->start_time;
 
                /* If address info is returned, it means the action should be an
@@ -2184,16 +2162,6 @@ mesh_serve_expired_callback(void* arg)
                                qstate->qinfo.qtype, qstate->qinfo.qclass,
                                r->local_alias, &r->query_reply.client_addr,
                                r->query_reply.client_addrlen);
-
-                       if(qstate->env->cfg->stat_extended && actinfo.rpz_used) {
-                               if(actinfo.rpz_disabled)
-                                       qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
-                               if(actinfo.rpz_cname_override)
-                                       qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
-                               else
-                                       qstate->env->mesh->rpz_action[
-                                               respip_action_to_rpz_action(actinfo.action)]++;
-                       }
                }
 
                /* Add EDE Stale Answer (RCF8914). Ignore global ede as this is
@@ -2213,11 +2181,23 @@ mesh_serve_expired_callback(void* arg)
                        tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
                prev = r;
                prev_buffer = r_buffer;
-
-               /* Account for each reply sent. */
-               mesh->ans_expired++;
-
        }
+       /* Account for each reply sent. */
+       if(i > 0) {
+               mesh->ans_expired += i;
+               if(actinfo.addrinfo && qstate->env->cfg->stat_extended &&
+                       actinfo.rpz_used) {
+                       if(actinfo.rpz_disabled)
+                               qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i;
+                       if(actinfo.rpz_cname_override)
+                               qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i;
+                       else
+                               qstate->env->mesh->rpz_action[
+                                       respip_action_to_rpz_action(actinfo.action)] += i;
+               }
+       }
+
+       /* Mesh area accounting */
        if(mstate->reply_list) {
                mstate->reply_list = NULL;
                if(!mstate->reply_list && !mstate->cb_list) {
@@ -2228,6 +2208,7 @@ mesh_serve_expired_callback(void* arg)
                        }
                }
        }
+
        while((c = mstate->cb_list) != NULL) {
                /* take this cb off the list; so that the list can be
                 * changed, eg. by adds from the callback routine */

diff --git a/sbin/unwind/libunbound/services/mesh.h b/sbin/unwind/libunbound/services/mesh.h
index 25121a6..d926cfc 100644 (file)
--- a/sbin/unwind/libunbound/services/mesh.h
+++ b/sbin/unwind/libunbound/services/mesh.h
@@ -114,6 +114,8 @@ struct mesh_area {
        size_t stats_dropped;
        /** stats, number of expired replies sent */
        size_t ans_expired;
+       /** stats, number of cached replies from cachedb */
+       size_t ans_cachedb;
        /** number of replies sent */
        size_t replies_sent;
        /** sum of waiting times for the replies */
@@ -335,13 +337,13 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
  * @param leeway: TTL leeway what to expire earlier for this update.
  * @param rpz_passthru: if true, the rpz passthru was previously found and
  *     further rpz processing is stopped.
- * @param rep: comm_reply for the client; to be used when subnet is enabled.
+ * @param addr: sockaddr_storage for the client; to be used with subnet.
  * @param opt_list: edns opt_list from the client; to be used when subnet is
  *     enabled.
  */
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
        uint16_t qflags, time_t leeway, int rpz_passthru,
-       struct comm_reply* rep, struct edns_option* opt_list);
+       struct sockaddr_storage* addr, struct edns_option* opt_list);
 
 /**
  * Handle new event from the wire. A serviced query has returned.
@@ -478,14 +480,6 @@ struct mesh_state* mesh_state_create(struct module_env* env,
        struct query_info* qinfo, struct respip_client_info* cinfo,
        uint16_t qflags, int prime, int valrec);
 
-/**
- * Check if the mesh state is unique.
- * A unique mesh state uses it's unique member to point to itself, else NULL.
- * @param mstate: mesh state to check.
- * @return true if the mesh state is unique, false otherwise.
- */
-int mesh_state_is_unique(struct mesh_state* mstate);
-
 /**
  * Make a mesh state unique.
  * A unique mesh state uses it's unique member to point to itself.

diff --git a/sbin/unwind/libunbound/services/modstack.c b/sbin/unwind/libunbound/services/modstack.c
index da8e623..a90d717 100644 (file)
--- a/sbin/unwind/libunbound/services/modstack.c
+++ b/sbin/unwind/libunbound/services/modstack.c
@@ -120,12 +120,16 @@ modstack_config(struct module_stack* stack, const char* module_conf)
                stack->mod[i] = module_factory(&module_conf);
                if(!stack->mod[i]) {
                        char md[256];
+                       char * s = md;
                        snprintf(md, sizeof(md), "%s", module_conf);
-                       if(strchr(md, ' ')) *(strchr(md, ' ')) = 0;
-                       if(strchr(md, '\t')) *(strchr(md, '\t')) = 0;
+                       /* Leading spaces are present on errors. */
+                       while (*s && isspace((unsigned char)*s))
+                               s++;
+                       if(strchr(s, ' ')) *(strchr(s, ' ')) = 0;
+                       if(strchr(s, '\t')) *(strchr(s, '\t')) = 0;
                        log_err("Unknown value in module-config, module: '%s'."
                                " This module is not present (not compiled in),"
-                               " See the list of linked modules with unbound -V", md);
+                               " See the list of linked modules with unbound -V", s);
                        return 0;
                }
        }

diff --git a/sbin/unwind/libunbound/services/outside_network.c b/sbin/unwind/libunbound/services/outside_network.c
index a4529ad..2a219cb 100644 (file)
--- a/sbin/unwind/libunbound/services/outside_network.c
+++ b/sbin/unwind/libunbound/services/outside_network.c
@@ -551,8 +551,27 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
                log_assert(&key_p != ((struct reuse_tcp*)result)->pending);
        }
        /* not found, return null */
+
+       /* It is possible that we search for something before the first element
+        * in the tree. Replace a null pointer with the first element.
+        */
+       if (!result) {
+               verbose(VERB_CLIENT, "reuse_tcp_find: taking first");
+               result = rbtree_first(&outnet->tcp_reuse);
+       }
+
        if(!result || result == RBTREE_NULL)
                return NULL;
+
+       /* It is possible that we got the previous address, but that the
+        * address we are looking for is in the tree. If the address we got
+        * is less than the address we are looking, then take the next entry.
+        */
+       if (reuse_cmp_addrportssl(result->key, &key_p.reuse) < 0) {
+               verbose(VERB_CLIENT, "reuse_tcp_find: key too low");
+               result = rbtree_next(result);
+       }
+
        verbose(VERB_CLIENT, "reuse_tcp_find check inexact match");
        /* inexact match, find one of possibly several connections to the
         * same destination address, with the correct port, ssl, and
@@ -620,6 +639,15 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
        log_assert(w->addrlen > 0);
        pend->c->tcp_do_toggle_rw = 0;
        pend->c->tcp_do_close = 0;
+
+       /* Consistency check, if we have ssl_upstream but no sslctx, then
+        * log an error and return failure.
+        */
+       if (w->ssl_upstream && !w->outnet->sslctx) {
+               log_err("SSL upstream requested but no SSL context");
+               return 0;
+       }
+
        /* open socket */
        s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss, w->outnet->ip_dscp);
 

diff --git a/sbin/unwind/libunbound/services/rpz.c b/sbin/unwind/libunbound/services/rpz.c
index e876f3f..6ce83cb 100644 (file)
--- a/sbin/unwind/libunbound/services/rpz.c
+++ b/sbin/unwind/libunbound/services/rpz.c
@@ -1188,6 +1188,22 @@ rpz_find_zone(struct local_zones* zones, uint8_t* qname, size_t qname_len, uint1
        return z;
 }
 
+/** Find entry for RR type in the list of rrsets for the clientip. */
+static struct local_rrset*
+rpz_find_synthesized_rrset(uint16_t qtype,
+       struct clientip_synthesized_rr* data)
+{
+       struct local_rrset* cursor = data->data;
+       while( cursor != NULL) {
+               struct packed_rrset_key* packed_rrset = &cursor->rrset->rk;
+               if(htons(qtype) == packed_rrset->type) {
+                       return cursor;
+               }
+               cursor = cursor->next;
+       }
+       return NULL;
+}
+
 /**
  * Remove RR from RPZ's local-data
  * @param z: local-zone for RPZ, holding write lock
@@ -1270,15 +1286,15 @@ rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 
 }
 
-/** Remove RR from RPZ's local-zone */
+/** Remove RR from rpz localzones structure */
 static void
-rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
-       enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
-       uint8_t* rdatawl, size_t rdatalen)
+rpz_remove_local_zones_trigger(struct local_zones* zones, uint8_t* dname,
+       size_t dnamelen, enum rpz_action a, uint16_t rr_type,
+       uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
 {
        struct local_zone* z;
        int delete_zone = 1;
-       z = rpz_find_zone(r->local_zones, dname, dnamelen, rr_class,
+       z = rpz_find_zone(zones, dname, dnamelen, rr_class,
                1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
        if(!z) {
                verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, "
@@ -1290,15 +1306,24 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
                        dnamelen, rr_type, rdatawl, rdatalen);
        else if(a != localzone_type_to_rpz_action(z->type)) {
                lock_rw_unlock(&z->lock);
-               lock_rw_unlock(&r->local_zones->lock);
+               lock_rw_unlock(&zones->lock);
                return;
        }
        lock_rw_unlock(&z->lock); 
        if(delete_zone) {
-               local_zones_del_zone(r->local_zones, z);
+               local_zones_del_zone(zones, z);
        }
-       lock_rw_unlock(&r->local_zones->lock); 
-       return;
+       lock_rw_unlock(&zones->lock);
+}
+
+/** Remove RR from RPZ's local-zone */
+static void
+rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
+       uint8_t* rdatawl, size_t rdatalen)
+{
+       rpz_remove_local_zones_trigger(r->local_zones, dname, dnamelen,
+               a, rr_type, rr_class, rdatawl, rdatalen);
 }
 
 static void
@@ -1335,15 +1360,159 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
        lock_rw_unlock(&r->respip_set->lock);
 }
 
+/** find and remove type from list of local_rrset entries*/
+static void
+del_local_rrset_from_list(struct local_rrset** list_head, uint16_t dtype)
+{
+       struct local_rrset* prev=NULL, *p=*list_head;
+       while(p && ntohs(p->rrset->rk.type) != dtype) {
+               prev = p;
+               p = p->next;
+       }
+       if(!p)
+               return; /* rrset type not found */
+       /* unlink it */
+       if(prev) prev->next = p->next;
+       else *list_head = p->next;
+       /* no memory recycling for zone deletions ... */
+}
+
+/** Delete client-ip trigger RR from its RRset and perhaps also the rrset
+ * from the linked list. Returns if the local data is empty and the node can
+ * be deleted too, or not. */
+static int rpz_remove_clientip_rr(struct clientip_synthesized_rr* node,
+       uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+       struct local_rrset* rrset;
+       struct packed_rrset_data* d;
+       size_t index;
+       rrset = rpz_find_synthesized_rrset(rr_type, node);
+       if(rrset == NULL)
+               return 0; /* type not found, ignore */
+       d = (struct packed_rrset_data*)rrset->rrset->entry.data;
+       if(!packed_rrset_find_rr(d, rdatawl, rdatalen, &index))
+               return 0; /* RR not found, ignore */
+       if(d->count == 1) {
+               /* regional alloc'd */
+               /* delete the type entry from the list */
+               del_local_rrset_from_list(&node->data, rr_type);
+               /* if the list is empty, the node can be removed too */
+               if(node->data == NULL)
+                       return 1;
+       } else if (d->count > 1) {
+               if(!local_rrset_remove_rr(d, index))
+                       return 0;
+       }
+       return 0;
+}
+
+/** remove trigger RR from clientip_syntheized set tree. */
+static void
+rpz_clientip_remove_trigger_rr(struct clientip_synthesized_rrset* set,
+       struct sockaddr_storage* addr, socklen_t addrlen, int net,
+       enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+       struct clientip_synthesized_rr* node;
+       int delete_node = 1;
+
+       lock_rw_wrlock(&set->lock);
+       node = (struct clientip_synthesized_rr*)addr_tree_find(&set->entries,
+               addr, addrlen, net);
+       if(node == NULL) {
+               /* netblock not found */
+               verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, "
+                       "RPZ address, netblock not found");
+               lock_rw_unlock(&set->lock);
+               return;
+       }
+       lock_rw_wrlock(&node->lock);
+       if(a == RPZ_LOCAL_DATA_ACTION) {
+               /* remove RR, signal whether entry can be removed */
+               delete_node = rpz_remove_clientip_rr(node, rr_type, rdatawl,
+                       rdatalen);
+       } else if(a != node->action) {
+               /* ignore the RR with different action specification */
+               delete_node = 0;
+       }
+       if(delete_node) {
+               rbtree_delete(&set->entries, node->node.node.key);
+       }
+       lock_rw_unlock(&set->lock);
+       lock_rw_unlock(&node->lock);
+       if(delete_node) {
+               lock_rw_destroy(&node->lock);
+       }
+}
+
+/** Remove clientip trigger RR from RPZ. */
+static void
+rpz_remove_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+       struct sockaddr_storage addr;
+       socklen_t addrlen;
+       int net, af;
+       if(a == RPZ_INVALID_ACTION)
+               return;
+       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
+               return;
+       rpz_clientip_remove_trigger_rr(r->client_set, &addr, addrlen, net,
+               a, rr_type, rdatawl, rdatalen);
+}
+
+/** Remove nsip trigger RR from RPZ. */
+static void
+rpz_remove_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+       struct sockaddr_storage addr;
+       socklen_t addrlen;
+       int net, af;
+       if(a == RPZ_INVALID_ACTION)
+               return;
+       if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
+               return;
+       rpz_clientip_remove_trigger_rr(r->ns_set, &addr, addrlen, net,
+               a, rr_type, rdatawl, rdatalen);
+}
+
+/** Remove nsdname trigger RR from RPZ. */
+static void
+rpz_remove_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
+       enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
+       uint8_t* rdatawl, size_t rdatalen)
+{
+       uint8_t* dname_stripped = NULL;
+       size_t dnamelen_stripped = 0;
+       if(a == RPZ_INVALID_ACTION)
+               return;
+       if(!rpz_strip_nsdname_suffix(dname, dnamelen, &dname_stripped,
+               &dnamelen_stripped))
+               return;
+       rpz_remove_local_zones_trigger(r->nsdname_zones, dname_stripped,
+               dnamelen_stripped, a, rr_type, rr_class, rdatawl, rdatalen);
+       free(dname_stripped);
+}
+
 void
-rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
-       uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
+rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
+       size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl,
+       size_t rdatalen)
 {
        size_t policydnamelen;
        enum rpz_trigger t;
        enum rpz_action a;
        uint8_t* policydname;
 
+       if(rpz_type_ignored(rr_type)) {
+               /* this rpz action is not valid, eg. this is the SOA or NS RR */
+               return;
+       }
+       if(!dname_subdomain_c(dname, azname)) {
+               /* not subdomain of the RPZ zone. */
+               return;
+       }
+
        if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
                return;
 
@@ -1358,13 +1527,28 @@ rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
                return;
        }
        t = rpz_dname_to_trigger(policydname, policydnamelen);
+       if(t == RPZ_INVALID_TRIGGER) {
+               /* skipping invalid trigger */
+               free(policydname);
+               return;
+       }
        if(t == RPZ_QNAME_TRIGGER) {
                rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
                        rr_type, rr_class, rdatawl, rdatalen);
        } else if(t == RPZ_RESPONSE_IP_TRIGGER) {
                rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
                        a, rr_type, rdatawl, rdatalen);
+       } else if(t == RPZ_CLIENT_IP_TRIGGER) {
+               rpz_remove_clientip_trigger(r, policydname, policydnamelen, a,
+                       rr_type, rdatawl, rdatalen);
+       } else if(t == RPZ_NSIP_TRIGGER) {
+               rpz_remove_nsip_trigger(r, policydname, policydnamelen, a,
+                       rr_type, rdatawl, rdatalen);
+       } else if(t == RPZ_NSDNAME_TRIGGER) {
+               rpz_remove_nsdname_trigger(r, policydname, policydnamelen, a,
+                       rr_type, rr_class, rdatawl, rdatalen);
        }
+       /* else it was an unsupported trigger, also skipped. */
        free(policydname);
 }
 
@@ -1563,21 +1747,6 @@ rpz_local_encode(struct module_env* env, struct query_info* qinfo,
        return 1;
 }
 
-static struct local_rrset*
-rpz_find_synthesized_rrset(uint16_t qtype,
-       struct clientip_synthesized_rr* data)
-{
-       struct local_rrset* cursor = data->data;
-       while( cursor != NULL) {
-               struct packed_rrset_key* packed_rrset = &cursor->rrset->rk;
-               if(htons(qtype) == packed_rrset->type) {
-                       return cursor;
-               }
-               cursor = cursor->next;
-       }
-       return NULL;
-}
-
 /** allocate SOA record ubrrsetkey in region */
 static struct ub_packed_rrset_key*
 make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa,
@@ -1713,7 +1882,8 @@ rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms,
                                             0, /* ns */
                                             0, /* ar */
                                             0, /* total */
-                                            sec_status_insecure);
+                                            sec_status_insecure,
+                                            LDNS_EDE_NONE);
        if(msg->rep)
                msg->rep->authoritative = 1;
        if(!rpz_add_soa(msg->rep, ms, az))
@@ -1742,7 +1912,8 @@ rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms,
                                             0, /* ns */
                                             0, /* ar */
                                             0, /* total */
-                                            sec_status_insecure);
+                                            sec_status_insecure,
+                                            LDNS_EDE_NONE);
        if(msg->rep)
                msg->rep->authoritative = 1;
        if(!rpz_add_soa(msg->rep, ms, az))
@@ -1772,7 +1943,8 @@ rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qs
                                                    0, /* ns */
                                                    0, /* ar */
                                                    1, /* total */
-                                                   sec_status_insecure);
+                                                   sec_status_insecure,
+                                                   LDNS_EDE_NONE);
        if(new_reply_info == NULL) {
                log_err("out of memory");
                return NULL;

diff --git a/sbin/unwind/libunbound/services/rpz.h b/sbin/unwind/libunbound/services/rpz.h
index 5378119..e6d8bf5 100644 (file)
--- a/sbin/unwind/libunbound/services/rpz.h
+++ b/sbin/unwind/libunbound/services/rpz.h
@@ -84,10 +84,11 @@ enum rpz_action {
        RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/
 };
 
-struct clientip_synthesized_rrset{
+struct clientip_synthesized_rrset {
        struct regional* region;
        struct rbtree_type entries;
-       lock_rw_type lock;      /* lock on the respip tree */
+       /** lock on the entries tree */
+       lock_rw_type lock;
 };
 
 struct clientip_synthesized_rr {
@@ -95,10 +96,6 @@ struct clientip_synthesized_rr {
        struct addr_tree_node node;
        /** lock on the node item */
        lock_rw_type lock;
-       /** tag bitlist */
-       uint8_t* taglist;
-       /** length of the taglist (in bytes) */
-       size_t taglen;
        /** action for this address span */
        enum rpz_action action;
        /** "local data" for this node */
@@ -152,6 +149,7 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna
 /**
  * Delete policy matching RR, used for IXFR.
  * @param r: the rpz to add the policy to.
+ * @param azname: dname of the auth-zone
  * @param aznamelen: the length of the auth-zone name
  * @param dname: dname of the RR
  * @param dnamelen: length of the dname
@@ -160,9 +158,9 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna
  * @param rdatawl: rdata of the RR, prepended with the rdata size
  * @param rdatalen: length if the RR, including the prepended rdata size
  */
-void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
-       size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl,
-       size_t rdatalen);
+void rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen,
+       uint8_t* dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class,
+       uint8_t* rdatawl, size_t rdatalen);
 
 /**
  * Walk over the RPZ zones to find and apply a QNAME trigger policy.

diff --git a/sbin/unwind/libunbound/sldns/rrdef.c b/sbin/unwind/libunbound/sldns/rrdef.c
index 322eff0..e81ebb1 100644 (file)
--- a/sbin/unwind/libunbound/sldns/rrdef.c
+++ b/sbin/unwind/libunbound/sldns/rrdef.c
@@ -702,7 +702,11 @@ sldns_get_rr_type_by_name(const char *name)
 
        /* TYPEXX representation */
        if (strlen(name) > 4 && strncasecmp(name, "TYPE", 4) == 0) {
-               return atoi(name + 4);
+               unsigned int a = atoi(name + 4);
+               if (a > LDNS_RR_TYPE_LAST) {
+                       return (enum sldns_enum_rr_type)0;
+               }
+               return a;
        }
 
        /* Normal types */
@@ -740,7 +744,11 @@ sldns_get_rr_class_by_name(const char *name)
 
        /* CLASSXX representation */
        if (strlen(name) > 5 && strncasecmp(name, "CLASS", 5) == 0) {
-               return atoi(name + 5);
+               unsigned int a = atoi(name + 5);
+               if (a > LDNS_RR_CLASS_LAST) {
+                       return (enum sldns_enum_rr_class)0;
+               }
+               return a;
        }
 
        /* Normal types */

diff --git a/sbin/unwind/libunbound/sldns/rrdef.h b/sbin/unwind/libunbound/sldns/rrdef.h
index 999c223..1a5091d 100644 (file)
--- a/sbin/unwind/libunbound/sldns/rrdef.h
+++ b/sbin/unwind/libunbound/sldns/rrdef.h
@@ -433,10 +433,12 @@ enum sldns_enum_edns_option
        LDNS_EDNS_DHU = 6, /* RFC6975 */
        LDNS_EDNS_N3U = 7, /* RFC6975 */
        LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
+       LDNS_EDNS_COOKIE = 10, /* RFC7873 */
        LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/
        LDNS_EDNS_PADDING = 12, /* RFC7830 */
        LDNS_EDNS_EDE = 15, /* RFC8914 */
-       LDNS_EDNS_CLIENT_TAG = 16 /* draft-bellis-dnsop-edns-tags-01 */
+       LDNS_EDNS_CLIENT_TAG = 16, /* draft-bellis-dnsop-edns-tags-01 */
+       LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST = 65534
 };
 typedef enum sldns_enum_edns_option sldns_edns_option;
 
@@ -482,6 +484,9 @@ typedef enum sldns_enum_ede_code sldns_ede_code;
 #define LDNS_TSIG_ERROR_BADNAME  20
 #define LDNS_TSIG_ERROR_BADALG   21
 
+/** DNS Cookie extended rcode */
+#define LDNS_EXT_RCODE_BADCOOKIE 23
+
 /**
  * Contains all information about resource record types.
  *

diff --git a/sbin/unwind/libunbound/sldns/str2wire.c b/sbin/unwind/libunbound/sldns/str2wire.c
index 303d49b..45e2476 100644 (file)
--- a/sbin/unwind/libunbound/sldns/str2wire.c
+++ b/sbin/unwind/libunbound/sldns/str2wire.c
@@ -357,7 +357,7 @@ rrinternal_get_delims(sldns_rdf_type rdftype, size_t r_cnt, size_t r_max)
                                        break;
        default                       : break;
        }
-       return "\n\t "; 
+       return "\n\t ";
 }
 
 /* Syntactic sugar for sldns_rr_new_frm_str_internal */
@@ -448,7 +448,7 @@ rrinternal_parse_unknown(sldns_buffer* strbuf, char* token, size_t token_len,
                        sldns_buffer_position(strbuf));
        }
        hex_data_size = (size_t)atoi(token);
-       if(hex_data_size > LDNS_MAX_RDFLEN || 
+       if(hex_data_size > LDNS_MAX_RDFLEN ||
                *rr_cur_len + hex_data_size > *rr_len) {
                return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,
                        sldns_buffer_position(strbuf));
@@ -567,7 +567,7 @@ sldns_parse_rdf_token(sldns_buffer* strbuf, char* token, size_t token_len,
        /* check if not quoted yet, and we have encountered quotes */
        if(!*quoted && sldns_rdf_type_maybe_quoted(rdftype) &&
                slen >= 2 &&
-               (token[0] == '"' || token[0] == '\'') && 
+               (token[0] == '"' || token[0] == '\'') &&
                (token[slen-1] == '"' || token[slen-1] == '\'')) {
                /* move token two smaller (quotes) with endnull */
                memmove(token, token+1, slen-2);
@@ -698,7 +698,7 @@ static int sldns_str2wire_check_svcbparams(uint8_t* rdata, uint16_t rdata_len)
                                mandatory = svcparams[i];
                }
 
-               /* 4. verify that all the SvcParamKeys in mandatory are present */
+               /* Verify that all the SvcParamKeys in mandatory are present */
                if(mandatory) {
                        /* Divide by sizeof(uint16_t)*/
                        uint16_t mandatory_nkeys = sldns_read_uint16(mandatory + 2) / sizeof(uint16_t);
@@ -785,7 +785,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
                        token[2]=='\t')) {
                        was_unknown_rr_format = 1;
                        if((status=rrinternal_parse_unknown(strbuf, token,
-                               token_len, rr, rr_len, &rr_cur_len, 
+                               token_len, rr, rr_len, &rr_cur_len,
                                pre_data_pos)) != 0)
                                return status;
                } else if(token_strlen > 0 || quoted) {
@@ -844,7 +844,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
        if (rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS) {
                size_t rdata_len = rr_cur_len - dname_len - 10;
                uint8_t *rdata = rr+dname_len + 10;
-               
+
                /* skip 1st rdata field SvcPriority (uint16_t) */
                if (rdata_len < sizeof(uint16_t))
                        return LDNS_WIREPARSE_ERR_OK;
@@ -1123,36 +1123,40 @@ sldns_str2wire_svcparam_key_lookup(const char *key, size_t key_len)
                        return key_value;
 
        } else switch (key_len) {
-       case sizeof("mandatory")-1:
-               if (!strncmp(key, "mandatory", sizeof("mandatory")-1))
-                       return SVCB_KEY_MANDATORY;
-               if (!strncmp(key, "echconfig", sizeof("echconfig")-1))
-                       return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */
+       case 3:
+               if (!strncmp(key, "ech", key_len))
+                       return SVCB_KEY_ECH;
                break;
 
-       case sizeof("alpn")-1:
-               if (!strncmp(key, "alpn", sizeof("alpn")-1))
+       case 4:
+               if (!strncmp(key, "alpn", key_len))
                        return SVCB_KEY_ALPN;
-               if (!strncmp(key, "port", sizeof("port")-1))
+               if (!strncmp(key, "port", key_len))
                        return SVCB_KEY_PORT;
                break;
 
-       case sizeof("no-default-alpn")-1:
-               if (!strncmp( key  , "no-default-alpn"
-                           , sizeof("no-default-alpn")-1))
-                       return SVCB_KEY_NO_DEFAULT_ALPN;
+       case 7:
+               if (!strncmp(key, "dohpath", key_len))
+                       return SVCB_KEY_DOHPATH;
                break;
 
-       case sizeof("ipv4hint")-1:
-               if (!strncmp(key, "ipv4hint", sizeof("ipv4hint")-1))
+       case 8:
+               if (!strncmp(key, "ipv4hint", key_len))
                        return SVCB_KEY_IPV4HINT;
-               if (!strncmp(key, "ipv6hint", sizeof("ipv6hint")-1))
+               if (!strncmp(key, "ipv6hint", key_len))
                        return SVCB_KEY_IPV6HINT;
                break;
 
-       case sizeof("ech")-1:
-               if (!strncmp(key, "ech", sizeof("ech")-1))
-                       return SVCB_KEY_ECH;
+       case 9:
+               if (!strncmp(key, "mandatory", key_len))
+                       return SVCB_KEY_MANDATORY;
+               if (!strncmp(key, "echconfig", key_len))
+                       return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */
+               break;
+
+       case 15:
+               if (!strncmp(key, "no-default-alpn", key_len))
+                       return SVCB_KEY_NO_DEFAULT_ALPN;
                break;
 
        default:
@@ -1477,7 +1481,7 @@ sldns_str2wire_svcbparam_alpn_value(const char* val,
        size_t      str_len;
        size_t      dst_len;
        size_t      val_len;
-       
+
        val_len = strlen(val);
 
        if (val_len > sizeof(unescaped_dst)) {
@@ -1511,7 +1515,34 @@ sldns_str2wire_svcbparam_alpn_value(const char* val,
        sldns_write_uint16(rd + 2, dst_len);
        memcpy(rd + 4, unescaped_dst, dst_len);
        *rd_len = 4 + dst_len;
-       
+
+       return LDNS_WIREPARSE_ERR_OK;
+}
+
+static int
+sldns_str2wire_svcbparam_dohpath_value(const char* val,
+       uint8_t* rd, size_t* rd_len)
+{
+       size_t val_len;
+
+       /* RFC6570#section-2.1
+        * "The characters outside of expressions in a URI Template string are
+        * intended to be copied literally"
+        * Practically this means we do not have to look for "double escapes"
+        * like in the alpn value list.
+        */
+
+       val_len = strlen(val);
+
+       if (*rd_len < 4 + val_len) {
+               return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL;
+       }
+
+       sldns_write_uint16(rd, SVCB_KEY_DOHPATH);
+       sldns_write_uint16(rd + 2, val_len);
+       memcpy(rd + 4, val, val_len);
+       *rd_len = 4 + val_len;
+
        return LDNS_WIREPARSE_ERR_OK;
 }
 
@@ -1535,6 +1566,7 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len,
                case SVCB_KEY_PORT:
                case SVCB_KEY_IPV4HINT:
                case SVCB_KEY_IPV6HINT:
+               case SVCB_KEY_DOHPATH:
                        return LDNS_WIREPARSE_ERR_SVCB_MISSING_PARAM;
 #endif
                default:
@@ -1566,6 +1598,8 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len,
                return sldns_str2wire_svcbparam_ech_value(val, rd, rd_len);
        case SVCB_KEY_ALPN:
                return sldns_str2wire_svcbparam_alpn_value(val, rd, rd_len);
+       case SVCB_KEY_DOHPATH:
+               return sldns_str2wire_svcbparam_dohpath_value(val, rd, rd_len);
        default:
                str_len = strlen(val);
                if (*rd_len < 4 + str_len)
@@ -1593,7 +1627,7 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_
        /* case: key=value */
        if (eq_pos != NULL && eq_pos[1]) {
                val_in = eq_pos + 1;
-               
+
                /* unescape characters and "" blocks */
                if (*val_in == '"') {
                        val_in++;
@@ -1610,11 +1644,11 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_
                }
                *val_out = 0;
 
-               return sldns_str2wire_svcparam_value(str, eq_pos - str, 
-                                                        unescaped_val[0] ? unescaped_val : NULL, rd, rd_len);
+               return sldns_str2wire_svcparam_value(str, eq_pos - str,
+                       unescaped_val[0] ? unescaped_val : NULL, rd, rd_len);
        }
        /* case: key= */
-       else if (eq_pos != NULL && !(eq_pos[1])) { 
+       else if (eq_pos != NULL && !(eq_pos[1])) {
                return sldns_str2wire_svcparam_value(str, eq_pos - str, NULL, rd, rd_len);
        }
        /* case: key */

diff --git a/sbin/unwind/libunbound/sldns/str2wire.h b/sbin/unwind/libunbound/sldns/str2wire.h
index baee423..5e4d146 100644 (file)
--- a/sbin/unwind/libunbound/sldns/str2wire.h
+++ b/sbin/unwind/libunbound/sldns/str2wire.h
@@ -38,7 +38,8 @@ struct sldns_struct_lookup_table;
 #define SVCB_KEY_IPV4HINT              4
 #define SVCB_KEY_ECH                   5
 #define SVCB_KEY_IPV6HINT              6
-#define SVCPARAMKEY_COUNT              7
+#define SVCB_KEY_DOHPATH               7
+#define SVCPARAMKEY_COUNT              8
 
 #define MAX_NUMBER_OF_SVCPARAMS        64
 
@@ -236,6 +237,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len);
 #define LDNS_WIREPARSE_ERR_SVCB_NO_DEFAULT_ALPN_VALUE 385
 #define LDNS_WIREPARSE_ERR_SVCPARAM_BROKEN_RDATA 386
 
+
 /**
  * Get reference to a constant string for the (parse) error.
  * @param e: error return value

diff --git a/sbin/unwind/libunbound/sldns/wire2str.c b/sbin/unwind/libunbound/sldns/wire2str.c
index 74d1b62..e6278ff 100644 (file)
--- a/sbin/unwind/libunbound/sldns/wire2str.c
+++ b/sbin/unwind/libunbound/sldns/wire2str.c
@@ -159,7 +159,7 @@ static sldns_lookup_table sldns_wireparse_errors_data[] = {
                "Mandatory SvcParamKey is missing"},
        { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_DUPLICATE_KEY,
                "Keys in SvcParam mandatory MUST be unique" },
-       { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY, 
+       { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY,
                "mandatory MUST not be included as mandatory parameter" },
        { LDNS_WIREPARSE_ERR_SVCB_PORT_VALUE_SYNTAX,
                "Could not parse port SvcParamValue" },
@@ -224,7 +224,7 @@ sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data;
 /* draft-ietf-dnsop-svcb-https-06: 6. Initial SvcParamKeys */
 const char *svcparamkey_strs[] = {
        "mandatory", "alpn", "no-default-alpn", "port",
-       "ipv4hint", "ech", "ipv6hint"
+       "ipv4hint", "ech", "ipv6hint", "dohpath"
 };
 
 char* sldns_wire2str_pkt(uint8_t* data, size_t len)
@@ -487,7 +487,7 @@ int sldns_wire2str_rr_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
        uint8_t* rr = *d;
        size_t rrlen = *dlen, dname_off, rdlen, ordlen;
        uint16_t rrtype = 0;
-       
+
        if(*dlen >= 3 && (*d)[0]==0 &&
                sldns_read_uint16((*d)+1)==LDNS_RR_TYPE_OPT) {
                /* perform EDNS OPT processing */
@@ -1119,7 +1119,7 @@ static int sldns_wire2str_svcparam_alpn2str(char** s,
                        w += sldns_str_print(s, slen, "%s", ",");
        }
        w += sldns_str_print(s, slen, "\"");
-       
+
        return w;
 }
 
@@ -1139,7 +1139,7 @@ static int sldns_wire2str_svcparam_ech2str(char** s,
        (*s) += size;
        (*slen) -= size;
 
-       w += sldns_str_print(s, slen, "\"");    
+       w += sldns_str_print(s, slen, "\"");
 
        return w + size;
 }
@@ -1162,7 +1162,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
 
        /* verify that we have data_len data */
        if (data_len > *dlen)
-               return -1; 
+               return -1;
 
        written_chars += sldns_print_svcparamkey(s, slen, svcparamkey);
        if (!data_len) {
@@ -1174,6 +1174,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
                case SVCB_KEY_IPV4HINT:
                case SVCB_KEY_IPV6HINT:
                case SVCB_KEY_MANDATORY:
+               case SVCB_KEY_DOHPATH:
                        return -1;
                default:
                        return written_chars;
@@ -1201,6 +1202,8 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
        case SVCB_KEY_ECH:
                r = sldns_wire2str_svcparam_ech2str(s, slen, data_len, *d);
                break;
+       case SVCB_KEY_DOHPATH:
+               /* fallthrough */
        default:
                r = sldns_str_print(s, slen, "=\"");
 
@@ -1222,7 +1225,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
        }
        if (r <= 0)
                return -1; /* wireformat error */
-       
+
        written_chars += r;
        *d    += data_len;
        *dlen -= data_len;
@@ -1551,7 +1554,7 @@ int sldns_wire2str_nsec_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
        unsigned i, bit, window, block_len;
        uint16_t t;
        int w = 0;
-       
+
        /* check for errors */
        while(pl) {
                if(pl < 2) return -1;

diff --git a/sbin/unwind/libunbound/util/Makefile.inc b/sbin/unwind/libunbound/util/Makefile.inc
index 33478fd..a245c53 100644 (file)
--- a/sbin/unwind/libunbound/util/Makefile.inc
+++ b/sbin/unwind/libunbound/util/Makefile.inc
@@ -1,11 +1,12 @@
-#      $OpenBSD: Makefile.inc,v 1.5 2022/10/22 16:37:57 florian Exp $
+#      $OpenBSD: Makefile.inc,v 1.6 2023/09/05 15:44:02 florian Exp $
 
 .PATH: ${.CURDIR}/libunbound/util
 
 SRCS+= alloc.c as112.c config_file.c configlexer.c configparser.y edns.c \
        fptr_wlist.c locks.c mini_event.c module.c net_help.c netevent.c \
-       proxy_protocol.c random.c rbtree.c regional.c rtt.c tcp_conn_limit.c \
-       timehist.c tube.c ub_event_pluggable.c util_log.c winsock_event.c
+       proxy_protocol.c random.c rbtree.c regional.c rfc_1982.c rtt.c siphash.c \
+       tcp_conn_limit.c timehist.c timeval_func.c tube.c ub_event_pluggable.c \
+       util_log.c winsock_event.c
 
 util_log.c:
        ln -s ${.CURDIR}/libunbound/util/log.c $@

diff --git a/sbin/unwind/libunbound/util/config_file.c b/sbin/unwind/libunbound/util/config_file.c
index cc54c4e..b7aed66 100644 (file)
--- a/sbin/unwind/libunbound/util/config_file.c
+++ b/sbin/unwind/libunbound/util/config_file.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -55,6 +55,7 @@
 #include "util/regional.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
+#include "util/random.h"
 #include "util/rtt.h"
 #include "services/cache/infra.h"
 #include "sldns/wire2str.h"
@@ -87,7 +88,10 @@ struct config_parser_state* cfg_parser = 0;
 /** init ports possible for use */
 static void init_outgoing_availports(int* array, int num);
 
-struct config_file* 
+/** init cookie with random data */
+static void init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len);
+
+struct config_file*
 config_create(void)
 {
        struct config_file* cfg;
@@ -99,6 +103,7 @@ config_create(void)
        cfg->stat_interval = 0;
        cfg->stat_cumulative = 0;
        cfg->stat_extended = 0;
+       cfg->stat_inhibit_zero = 1;
        cfg->num_threads = 1;
        cfg->port = UNBOUND_DNS_PORT;
        cfg->do_ip4 = 1;
@@ -115,6 +120,7 @@ config_create(void)
        cfg->tcp_auth_query_timeout = 3 * 1000; /* 3s in millisecs */
        cfg->do_tcp_keepalive = 0;
        cfg->tcp_keepalive_timeout = 120 * 1000; /* 120s in millisecs */
+       cfg->sock_queue_timeout = 0; /* do not check timeout */
        cfg->ssl_service_key = NULL;
        cfg->ssl_service_pem = NULL;
        cfg->ssl_port = UNBOUND_DNS_OVER_TLS_PORT;
@@ -152,7 +158,7 @@ config_create(void)
        cfg->outgoing_num_ports = 48; /* windows is limited in num fds */
        cfg->num_queries_per_thread = 24;
        cfg->outgoing_num_tcp = 2; /* leaves 64-52=12 for: 4if,1stop,thread4 */
-       cfg->incoming_num_tcp = 2; 
+       cfg->incoming_num_tcp = 2;
 #endif
        cfg->stream_wait_size = 4 * 1024 * 1024;
        cfg->edns_buffer_size = 1232; /* from DNS flagday recommendation */
@@ -232,6 +238,7 @@ config_create(void)
        cfg->harden_below_nxdomain = 1;
        cfg->harden_referral_path = 0;
        cfg->harden_algo_downgrade = 0;
+       cfg->harden_unknown_additional = 0;
        cfg->use_caps_bits_for_id = 0;
        cfg->caps_whitelist = NULL;
        cfg->private_address = NULL;
@@ -299,14 +306,14 @@ config_create(void)
        cfg->minimal_responses = 1;
        cfg->rrset_roundrobin = 1;
        cfg->unknown_server_time_limit = 376;
-       cfg->max_udp_size = 4096;
-       if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) 
+       cfg->max_udp_size = 1232; /* value taken from edns_buffer_size */
+       if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key")))
                goto error_exit;
-       if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) 
+       if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem")))
                goto error_exit;
-       if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key"))) 
+       if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key")))
                goto error_exit;
-       if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem"))) 
+       if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem")))
                goto error_exit;
 
 #ifdef CLIENT_SUBNET
@@ -314,7 +321,7 @@ config_create(void)
 #else
        if(!(cfg->module_conf = strdup("validator iterator"))) goto error_exit;
 #endif
-       if(!(cfg->val_nsec3_key_iterations = 
+       if(!(cfg->val_nsec3_key_iterations =
                strdup("1024 150 2048 150 4096 150"))) goto error_exit;
 #if defined(DNSTAP_SOCKET_PATH)
        if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
@@ -323,6 +330,7 @@ config_create(void)
        cfg->dnstap_bidirectional = 1;
        cfg->dnstap_tls = 1;
        cfg->disable_dnssec_lame_check = 0;
+       cfg->ip_ratelimit_cookie = 0;
        cfg->ip_ratelimit = 0;
        cfg->ratelimit = 0;
        cfg->ip_ratelimit_slabs = 4;
@@ -336,6 +344,8 @@ config_create(void)
        cfg->ip_ratelimit_backoff = 0;
        cfg->ratelimit_backoff = 0;
        cfg->outbound_msg_retry = 5;
+       cfg->max_sent_count = 32;
+       cfg->max_query_restarts = 11;
        cfg->qname_minimisation = 1;
        cfg->qname_minimisation_strict = 0;
        cfg->shm_enable = 0;
@@ -364,11 +374,17 @@ config_create(void)
        cfg->ipsecmod_whitelist = NULL;
        cfg->ipsecmod_strict = 0;
 #endif
+       cfg->do_answer_cookie = 0;
+       memset(cfg->cookie_secret, 0, sizeof(cfg->cookie_secret));
+       cfg->cookie_secret_len = 16;
+       init_cookie_secret(cfg->cookie_secret, cfg->cookie_secret_len);
 #ifdef USE_CACHEDB
        if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit;
        if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit;
 #ifdef USE_REDIS
        if(!(cfg->redis_server_host = strdup("127.0.0.1"))) goto error_exit;
+       cfg->redis_server_path = NULL;
+       cfg->redis_server_password = NULL;
        cfg->redis_timeout = 100;
        cfg->redis_server_port = 6379;
        cfg->redis_expire_records = 0;
@@ -484,10 +500,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
                /* not supported, library must have 1 thread in bgworker */
                return 0;
        } else if(strcmp(opt, "outgoing-port-permit:") == 0) {
-               return cfg_mark_ports(val, 1, 
+               return cfg_mark_ports(val, 1,
                        cfg->outgoing_avail_ports, 65536);
        } else if(strcmp(opt, "outgoing-port-avoid:") == 0) {
-               return cfg_mark_ports(val, 0, 
+               return cfg_mark_ports(val, 0,
                        cfg->outgoing_avail_ports, 65536);
        } else if(strcmp(opt, "local-zone:") == 0) {
                return cfg_parse_local_zone(cfg, val);
@@ -501,7 +517,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
                        if(atoi(val) == 0) return 0;
                        cfg->val_date_override = (uint32_t)atoi(val);
                }
-       } else if(strcmp(opt, "local-data-ptr:") == 0) { 
+       } else if(strcmp(opt, "local-data-ptr:") == 0) {
                char* ptr = cfg_ptr_reverse((char*)opt);
                return cfg_strlist_insert(&cfg->local_data, ptr);
        } else if(strcmp(opt, "logfile:") == 0) {
@@ -516,6 +532,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_YNO("use-syslog:", use_syslog)
        else S_STR("log-identity:", log_identity)
        else S_YNO("extended-statistics:", stat_extended)
+       else S_YNO("statistics-inhibit-zero:", stat_inhibit_zero)
        else S_YNO("statistics-cumulative:", stat_cumulative)
        else S_YNO("shm-enable:", shm_enable)
        else S_NUMBER_OR_ZERO("shm-key:", shm_key)
@@ -536,6 +553,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_NUMBER_NONZERO("tcp-reuse-timeout:", tcp_reuse_timeout)
        else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive)
        else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout)
+       else S_NUMBER_OR_ZERO("sock-queue-timeout:", sock_queue_timeout)
        else S_YNO("ssl-upstream:", ssl_upstream)
        else S_YNO("tls-upstream:", ssl_upstream)
        else S_STR("ssl-service-key:", ssl_service_key)
@@ -645,6 +663,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_YNO("harden-below-nxdomain:", harden_below_nxdomain)
        else S_YNO("harden-referral-path:", harden_referral_path)
        else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
+       else S_YNO("harden-unknown-additional:", harden_unknown_additional)
        else S_YNO("use-caps-for-id:", use_caps_bits_for_id)
        else S_STRLIST("caps-whitelist:", caps_whitelist)
        else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
@@ -680,7 +699,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else if(strcmp(opt, "serve-expired-reply-ttl:") == 0)
        { IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
        else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
-       else S_YNO("ede:", ede) 
+       else S_YNO("ede:", ede)
        else S_YNO("ede-serve-expired:", ede_serve_expired)
        else S_YNO("serve-original-ttl:", serve_original_ttl)
        else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
@@ -761,6 +780,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_POW2("dnscrypt-nonce-cache-slabs:",
                dnscrypt_nonce_cache_slabs)
 #endif
+       else if(strcmp(opt, "ip-ratelimit-cookie:") == 0) {
+           IS_NUMBER_OR_ZERO; cfg->ip_ratelimit_cookie = atoi(val);
+           infra_ip_ratelimit_cookie=cfg->ip_ratelimit_cookie;
+       }
        else if(strcmp(opt, "ip-ratelimit:") == 0) {
            IS_NUMBER_OR_ZERO; cfg->ip_ratelimit = atoi(val);
            infra_ip_ratelimit=cfg->ip_ratelimit;
@@ -778,6 +801,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_YNO("ip-ratelimit-backoff:", ip_ratelimit_backoff)
        else S_YNO("ratelimit-backoff:", ratelimit_backoff)
        else S_NUMBER_NONZERO("outbound-msg-retry:", outbound_msg_retry)
+       else S_NUMBER_NONZERO("max-sent-count:", max_sent_count)
+       else S_NUMBER_NONZERO("max-query-restarts:", max_query_restarts)
        else S_SIZET_NONZERO("fast-server-num:", fast_server_num)
        else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil)
        else S_YNO("qname-minimisation:", qname_minimisation)
@@ -806,7 +831,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        { IS_NUMBER_OR_ZERO; cfg->val_max_restart = (int32_t)atoi(val); }
        else if (strcmp(opt, "outgoing-interface:") == 0) {
                char* d = strdup(val);
-               char** oi = 
+               char** oi =
                (char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*));
                if(!d || !oi) { free(d); free(oi); return -1; }
                if(cfg->out_ifs && cfg->num_out_ifs) {
@@ -901,7 +926,7 @@ config_collate_cat(struct config_strlist* list)
        for(s=list; s; s=s->next)
                total += strlen(s->str) + 1; /* len + newline */
        left = total+1; /* one extra for nul at end */
-       r = malloc(left); 
+       r = malloc(left);
        if(!r)
                return NULL;
        w = r;
@@ -980,7 +1005,7 @@ config_collate_cat(struct config_strlist* list)
        }
 
 int
-config_get_option(struct config_file* cfg, const char* opt, 
+config_get_option(struct config_file* cfg, const char* opt,
        void (*func)(char*,void*), void* arg)
 {
        char buf[1024], nopt[64];
@@ -996,6 +1021,7 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_DEC(opt, "statistics-interval", stat_interval)
        else O_YNO(opt, "statistics-cumulative", stat_cumulative)
        else O_YNO(opt, "extended-statistics", stat_extended)
+       else O_YNO(opt, "statistics-inhibit-zero", stat_inhibit_zero)
        else O_YNO(opt, "shm-enable", shm_enable)
        else O_DEC(opt, "shm-key", shm_key)
        else O_YNO(opt, "use-syslog", use_syslog)
@@ -1055,6 +1081,7 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_DEC(opt, "tcp-reuse-timeout", tcp_reuse_timeout)
        else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive)
        else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout)
+       else O_DEC(opt, "sock-queue-timeout", sock_queue_timeout)
        else O_YNO(opt, "ssl-upstream", ssl_upstream)
        else O_YNO(opt, "tls-upstream", ssl_upstream)
        else O_STR(opt, "ssl-service-key", ssl_service_key)
@@ -1110,6 +1137,7 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain)
        else O_YNO(opt, "harden-referral-path", harden_referral_path)
        else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
+       else O_YNO(opt, "harden-unknown-additional", harden_unknown_additional)
        else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
        else O_LST(opt, "caps-whitelist", caps_whitelist)
        else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
@@ -1225,6 +1253,7 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_LST(opt, "python-script", python_script)
        else O_LST(opt, "dynlib-file", dynlib_file)
        else O_YNO(opt, "disable-dnssec-lame-check", disable_dnssec_lame_check)
+       else O_DEC(opt, "ip-ratelimit-cookie", ip_ratelimit_cookie)
        else O_DEC(opt, "ip-ratelimit", ip_ratelimit)
        else O_DEC(opt, "ratelimit", ratelimit)
        else O_MEM(opt, "ip-ratelimit-size", ip_ratelimit_size)
@@ -1238,6 +1267,8 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_YNO(opt, "ip-ratelimit-backoff", ip_ratelimit_backoff)
        else O_YNO(opt, "ratelimit-backoff", ratelimit_backoff)
        else O_UNS(opt, "outbound-msg-retry", outbound_msg_retry)
+       else O_UNS(opt, "max-sent-count", max_sent_count)
+       else O_UNS(opt, "max-query-restarts", max_query_restarts)
        else O_DEC(opt, "fast-server-num", fast_server_num)
        else O_DEC(opt, "fast-server-permil", fast_server_permil)
        else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min)
@@ -1278,6 +1309,8 @@ config_get_option(struct config_file* cfg, const char* opt,
 #ifdef USE_REDIS
        else O_STR(opt, "redis-server-host", redis_server_host)
        else O_DEC(opt, "redis-server-port", redis_server_port)
+       else O_STR(opt, "redis-server-path", redis_server_path)
+       else O_STR(opt, "redis-server-password", redis_server_password)
        else O_DEC(opt, "redis-timeout", redis_timeout)
        else O_YNO(opt, "redis-expire-records", redis_expire_records)
 #endif  /* USE_REDIS */
@@ -1313,7 +1346,7 @@ create_cfg_parser(struct config_file* cfg, char* filename, const char* chroot)
        init_cfg_parse();
 }
 
-int 
+int
 config_read(struct config_file* cfg, const char* filename, const char* chroot)
 {
        FILE *in;
@@ -1353,7 +1386,7 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
                        if(r == GLOB_NOMATCH) {
                                verbose(VERB_QUERY, "include: "
                                "no matches for %s", fname);
-                               return 1; 
+                               return 1;
                        } else if(r == GLOB_NOSPACE) {
                                log_err("include: %s: "
                                        "fnametern out of memory", fname);
@@ -1552,7 +1585,7 @@ config_del_strbytelist(struct config_strbytelist* p)
        }
 }
 
-void 
+void
 config_delete(struct config_file* cfg)
 {
        if(!cfg) return;
@@ -1629,6 +1662,7 @@ config_delete(struct config_file* cfg)
        free(cfg->server_cert_file);
        free(cfg->control_key_file);
        free(cfg->control_cert_file);
+       free(cfg->nat64_prefix);
        free(cfg->dns64_prefix);
        config_delstrlist(cfg->dns64_ignore_aaaa);
        free(cfg->dnstap_socket_path);
@@ -1654,6 +1688,8 @@ config_delete(struct config_file* cfg)
        free(cfg->cachedb_secret);
 #ifdef USE_REDIS
        free(cfg->redis_server_host);
+       free(cfg->redis_server_path);
+       free(cfg->redis_server_password);
 #endif  /* USE_REDIS */
 #endif  /* USE_CACHEDB */
 #ifdef USE_IPSET
@@ -1663,7 +1699,21 @@ config_delete(struct config_file* cfg)
        free(cfg);
 }
 
-static void 
+static void
+init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len)
+{
+       struct ub_randstate *rand = ub_initstate(NULL);
+
+       if (!rand)
+               fatal_exit("could not init random generator");
+       while (cookie_secret_len) {
+               *cookie_secret++ = (uint8_t)ub_random(rand);
+               cookie_secret_len--;
+       }
+       ub_randfree(rand);
+}
+
+static void
 init_outgoing_availports(int* a, int num)
 {
        /* generated with make iana_update */
@@ -1676,7 +1726,7 @@ init_outgoing_availports(int* a, int num)
        for(i=1024; i<num; i++) {
                a[i] = i;
        }
-       /* create empty spot at 49152 to keep ephemeral ports available 
+       /* create empty spot at 49152 to keep ephemeral ports available
         * to other programs */
        for(i=49152; i<49152+256; i++)
                a[i] = 0;
@@ -1687,7 +1737,7 @@ init_outgoing_availports(int* a, int num)
        }
 }
 
-int 
+int
 cfg_mark_ports(const char* str, int allow, int* avail, int num)
 {
        char* mid = strchr(str, '-');
@@ -1732,7 +1782,7 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
        return 1;
 }
 
-int 
+int
 cfg_scan_ports(int* avail, int num)
 {
        int i;
@@ -1849,7 +1899,7 @@ int cfg_strlist_append(struct config_strlist_head* list, char* item)
        return 1;
 }
 
-int 
+int
 cfg_region_strlist_insert(struct regional* region,
        struct config_strlist** head, char* item)
 {
@@ -1882,7 +1932,7 @@ cfg_strlist_find(struct config_strlist* head, const char *item)
        return NULL;
 }
 
-int 
+int
 cfg_strlist_insert(struct config_strlist** head, char* item)
 {
        struct config_strlist *s;
@@ -1912,7 +1962,7 @@ cfg_strlist_append_ex(struct config_strlist** head, char* item)
                return 0;
        s->str = item;
        s->next = NULL;
-       
+
        if (*head==NULL) {
                *head = s;
        } else {
@@ -1922,11 +1972,11 @@ cfg_strlist_append_ex(struct config_strlist** head, char* item)
                }
                last->next = s;
        }
-       
-       return 1;  
+
+       return 1;
 }
 
-int 
+int
 cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
 {
        struct config_str2list *s;
@@ -1948,7 +1998,7 @@ cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
        return 1;
 }
 
-int 
+int
 cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
        char* i3)
 {
@@ -1984,7 +2034,7 @@ cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
        return 1;
 }
 
-time_t 
+time_t
 cfg_convert_timeval(const char* str)
 {
        time_t t;
@@ -1992,7 +2042,7 @@ cfg_convert_timeval(const char* str)
        memset(&tm, 0, sizeof(tm));
        if(strlen(str) < 14)
                return 0;
-       if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, 
+       if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon,
                &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6)
                return 0;
        tm.tm_year -= 1900;
@@ -2009,7 +2059,7 @@ cfg_convert_timeval(const char* str)
        return t;
 }
 
-int 
+int
 cfg_count_numbers(const char* s)
 {
        /* format ::= (sp num)+ sp  */
@@ -2044,7 +2094,7 @@ static int isalldigit(const char* str, size_t l)
        return 1;
 }
 
-int 
+int
 cfg_parse_memsize(const char* str, size_t* res)
 {
        size_t len;
@@ -2060,11 +2110,11 @@ cfg_parse_memsize(const char* str, size_t* res)
        /* check appended num */
        while(len>0 && str[len-1]==' ')
                len--;
-       if(len > 1 && str[len-1] == 'b') 
+       if(len > 1 && str[len-1] == 'b')
                len--;
-       else if(len > 1 && str[len-1] == 'B') 
+       else if(len > 1 && str[len-1] == 'B')
                len--;
-       
+
        if(len > 1 && tolower((unsigned char)str[len-1]) == 'g')
                mult = 1024*1024*1024;
        else if(len > 1 && tolower((unsigned char)str[len-1]) == 'm')
@@ -2151,7 +2201,7 @@ uint8_t* config_parse_taglist(struct config_file* cfg, char* str,
                log_err("out of memory");
                return 0;
        }
-       
+
        /* parse */
        s = str;
        while((p=strsep(&s, " \t\n")) != NULL) {
@@ -2237,7 +2287,7 @@ int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2,
        return 0;
 }
 
-void 
+void
 config_apply(struct config_file* config)
 {
        MAX_TTL = (time_t)config->max_ttl;
@@ -2279,7 +2329,7 @@ void config_lookup_uid(struct config_file* cfg)
 #endif
 }
 
-/** 
+/**
  * Calculate string length of full pathname in original filesys
  * @param fname: the path name to convert.
  *     Must not be null or empty.
@@ -2293,7 +2343,7 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
 {
        size_t len = 0;
        int slashit = 0;
-       if(cfg->chrootdir && cfg->chrootdir[0] && 
+       if(cfg->chrootdir && cfg->chrootdir[0] &&
                strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
                /* already full pathname, return it */
                return strlen(fname);
@@ -2316,8 +2366,8 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
                /* prepend chdir */
                if(slashit && cfg->directory[0] != '/')
                        len++;
-               if(cfg->chrootdir && cfg->chrootdir[0] && 
-                       strncmp(cfg->chrootdir, cfg->directory, 
+               if(cfg->chrootdir && cfg->chrootdir[0] &&
+                       strncmp(cfg->chrootdir, cfg->directory,
                        strlen(cfg->chrootdir)) == 0)
                        len += strlen(cfg->directory)-strlen(cfg->chrootdir);
                else    len += strlen(cfg->directory);
@@ -2340,7 +2390,7 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
                return NULL;
        buf[0] = 0;
        /* is fname already in chroot ? */
-       if(cfg->chrootdir && cfg->chrootdir[0] && 
+       if(cfg->chrootdir && cfg->chrootdir[0] &&
                strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
                /* already full pathname, return it */
                (void)strlcpy(buf, fname, len);
@@ -2366,10 +2416,10 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
                if(slashit && cfg->directory[0] != '/')
                        (void)strlcat(buf, "/", len);
                /* is the directory already in the chroot? */
-               if(cfg->chrootdir && cfg->chrootdir[0] && 
-                       strncmp(cfg->chrootdir, cfg->directory, 
+               if(cfg->chrootdir && cfg->chrootdir[0] &&
+                       strncmp(cfg->chrootdir, cfg->directory,
                        strlen(cfg->chrootdir)) == 0)
-                       (void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir), 
+                       (void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir),
                                   len);
                else (void)strlcat(buf, cfg->directory, len);
                slashit = 1;
@@ -2406,7 +2456,7 @@ static char* last_space_pos(const char* str)
        return (sp>tab)?sp:tab;
 }
 
-int 
+int
 cfg_parse_local_zone(struct config_file* cfg, const char* val)
 {
        const char *type, *name_end, *name;
@@ -2441,11 +2491,11 @@ cfg_parse_local_zone(struct config_file* cfg, const char* val)
        }
 
        if(strcmp(type, "nodefault")==0) {
-               return cfg_strlist_insert(&cfg->local_zones_nodefault, 
+               return cfg_strlist_insert(&cfg->local_zones_nodefault,
                        strdup(name));
 #ifdef USE_IPSET
        } else if(strcmp(type, "ipset")==0) {
-               return cfg_strlist_insert(&cfg->local_zones_ipset, 
+               return cfg_strlist_insert(&cfg->local_zones_ipset,
                        strdup(name));
 #endif
        } else {
@@ -2500,7 +2550,7 @@ char* cfg_ptr_reverse(char* str)
                const char* hex = "0123456789abcdef";
                char *p = buf;
                int i;
-               memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, 
+               memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr,
                        sizeof(ad));
                for(i=15; i>=0; i--) {
                        uint8_t b = ad[i];
@@ -2512,7 +2562,7 @@ char* cfg_ptr_reverse(char* str)
                snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa. ");
        } else {
                uint8_t ad[4];
-               memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, 
+               memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr,
                        sizeof(ad));
                snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ",
                        (unsigned)ad[3], (unsigned)ad[2],

diff --git a/sbin/unwind/libunbound/util/config_file.h b/sbin/unwind/libunbound/util/config_file.h
index b140691..452f3c6 100644 (file)
--- a/sbin/unwind/libunbound/util/config_file.h
+++ b/sbin/unwind/libunbound/util/config_file.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -76,6 +76,8 @@ struct config_file {
        int stat_cumulative;
        /** if true, the statistics are kept in greater detail */
        int stat_extended;
+       /** if true, inhibits a lot of =0 lines from the extended stats output */
+       int stat_inhibit_zero;
 
        /** number of threads to create */
        int num_threads;
@@ -86,6 +88,8 @@ struct config_file {
        int do_ip4;
        /** do ip6 query support. */
        int do_ip6;
+       /** do nat64 on queries */
+       int do_nat64;
        /** prefer ip4 upstream queries. */
        int prefer_ip4;
        /** prefer ip6 upstream queries. */
@@ -114,6 +118,8 @@ struct config_file {
        int do_tcp_keepalive;
        /** tcp keepalive timeout, in msec */
        int tcp_keepalive_timeout;
+       /** timeout of packets sitting in the socket queue */
+       int sock_queue_timeout;
        /** proxy protocol ports */
        struct config_strlist* proxy_protocol_port;
 
@@ -230,7 +236,7 @@ struct config_file {
        /** interface description strings (IP addresses) */
        char **ifs;
 
-       /** number of outgoing interfaces to open. 
+       /** number of outgoing interfaces to open.
         * If 0 default all interfaces. */
        int num_out_ifs;
        /** outgoing interface description strings (IP addresses) */
@@ -249,7 +255,7 @@ struct config_file {
        /** list of donotquery addresses, linked list */
        struct config_strlist* donotqueryaddrs;
 #ifdef CLIENT_SUBNET
-       /** list of servers we send edns-client-subnet option to and 
+       /** list of servers we send edns-client-subnet option to and
         * accept option from, linked list */
        struct config_strlist* client_subnet;
        /** list of zones we send edns-client-subnet option for */
@@ -290,6 +296,9 @@ struct config_file {
        int harden_referral_path;
        /** harden against algorithm downgrade */
        int harden_algo_downgrade;
+       /** harden against unknown records in the authority section and in
+        * the additional section */
+       int harden_unknown_additional;
        /** use 0x20 bits in query as random ID bits */
        int use_caps_bits_for_id;
        /** 0x20 whitelist, domains that do not use capsforid */
@@ -362,7 +371,7 @@ struct config_file {
 
        /** the module configuration string */
        char* module_conf;
-       
+
        /** files with trusted DS and DNSKEYs in zonefile format, list */
        struct config_strlist* trust_anchor_file_list;
        /** list of trustanchor keys, linked list */
@@ -387,7 +396,7 @@ struct config_file {
        /** max number of query restarts, number of IPs to probe */
        int32_t val_max_restart;
        /** this value sets the number of seconds before revalidating bogus */
-       int bogus_ttl; 
+       int bogus_ttl;
        /** should validator clean additional section for secure msgs */
        int val_clean_additional;
        /** log bogus messages by the validator */
@@ -533,6 +542,9 @@ struct config_file {
        /** ignore AAAAs for these domain names and use A record anyway */
        struct config_strlist* dns64_ignore_aaaa;
 
+       /* NAT64 prefix; if unset defaults to dns64_prefix */
+       char* nat64_prefix;
+
        /** true to enable dnstap support */
        int dnstap;
        /** using bidirectional frame streams if true */
@@ -578,6 +590,9 @@ struct config_file {
 
        /** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */
        int ip_ratelimit;
+       /** ratelimit for ip addresses with a valid DNS Cookie. 0 is off,
+        *  otherwise qps (unless overridden) */
+       int ip_ratelimit_cookie;
        /** number of slabs for ip_ratelimit cache */
        size_t ip_ratelimit_slabs;
        /** memory size in bytes for ip_ratelimit cache */
@@ -608,6 +623,11 @@ struct config_file {
 
        /** number of retries on outgoing queries */
        int outbound_msg_retry;
+       /** max sent queries per qstate; resets on query restarts (e.g.,
+        *  CNAMES) and referrals */
+       int max_sent_count;
+       /** max number of query restarts; determines max length of CNAME chain */
+       int max_query_restarts;
        /** minimise outgoing QNAME and hide original QTYPE if possible */
        int qname_minimisation;
        /** minimise QNAME in strict mode, minimise according to RFC.
@@ -684,12 +704,23 @@ struct config_file {
        char* redis_server_host;
        /** redis server's TCP port */
        int redis_server_port;
+       /** redis server's unix path. Or "", NULL if unused */
+       char* redis_server_path;
+       /** redis server's AUTH password. Or "", NULL if unused */
+       char* redis_server_password;
        /** timeout (in ms) for communication with the redis server */
        int redis_timeout;
        /** set timeout on redis records based on DNS response ttl */
        int redis_expire_records;
 #endif
 #endif
+       /** Downstream DNS Cookies */
+       /** do answer with server cookie when request contained cookie option */
+       int do_answer_cookie;
+       /** cookie secret */
+       uint8_t cookie_secret[40];
+       /** cookie secret length */
+       size_t  cookie_secret_len;
 
        /* ipset module */
 #ifdef USE_IPSET
@@ -802,7 +833,7 @@ struct config_view {
        struct config_strlist* local_zones_ipset;
 #endif
        /** Fallback to global local_zones when there is no match in the view
-        * view specific tree. 1 for yes, 0 for no */   
+        * view specific tree. 1 for yes, 0 for no */
        int isfirst;
        /** predefined actions for particular IP address responses */
        struct config_str2list* respip_actions;
@@ -877,7 +908,7 @@ struct config_file* config_create_forlib(void);
  * @param config: where options are stored into, must be freshly created.
  * @param filename: name of configfile. If NULL nothing is done.
  * @param chroot: if not NULL, the chroot dir currently in use (for include).
- * @return: false on error. In that case errno is set, ENOENT means 
+ * @return: false on error. In that case errno is set, ENOENT means
  *     file not found.
  */
 int config_read(struct config_file* config, const char* filename,
@@ -912,16 +943,16 @@ void config_lookup_uid(struct config_file* config);
 int config_set_option(struct config_file* config, const char* option,
        const char* value);
 
-/** 
+/**
  * Call print routine for the given option.
  * @param cfg: config.
- * @param opt: option name without trailing :. 
+ * @param opt: option name without trailing :.
  *     This is different from config_set_option.
  * @param func: print func, called as (str, arg) for every data element.
  * @param arg: user argument for print func.
  * @return false if the option name is not supported (syntax error).
  */
-int config_get_option(struct config_file* cfg, const char* opt, 
+int config_get_option(struct config_file* cfg, const char* opt,
        void (*func)(char*,void*), void* arg);
 
 /**
@@ -941,7 +972,7 @@ int config_get_option_list(struct config_file* cfg, const char* opt,
  * @param str: string. malloced, caller must free it.
  * @return 0=OK, 1=syntax error, 2=malloc failed.
  */
-int config_get_option_collate(struct config_file* cfg, const char* opt, 
+int config_get_option_collate(struct config_file* cfg, const char* opt,
        char** str);
 
 /**
@@ -1136,7 +1167,7 @@ int cfg_count_numbers(const char* str);
  * k=1024, m=1024*1024, g=1024*1024*1024.
  * @param str: string
  * @param res: result is stored here, size in bytes.
- * @return: true if parsed correctly, or 0 on a parse error (and an error 
+ * @return: true if parsed correctly, or 0 on a parse error (and an error
  * is logged).
  */
 int cfg_parse_memsize(const char* str, size_t* res);
@@ -1170,7 +1201,7 @@ int find_tag_id(struct config_file* cfg, const char* tag);
 /**
  * parse taglist from string into bytestring with bitlist.
  * @param cfg: the config structure (with tagnames)
- * @param str: the string to parse.  Parse puts 0 bytes in string. 
+ * @param str: the string to parse.  Parse puts 0 bytes in string.
  * @param listlen: returns length of in bytes.
  * @return malloced bytes with a bitlist of the tags.  or NULL on parse error
  * or malloc failure.
@@ -1213,7 +1244,7 @@ int cfg_parse_local_zone(struct config_file* cfg, const char* val);
  * @param allow: give true if this range is permitted.
  * @param avail: the array from cfg.
  * @param num: size of the array (65536).
- * @return: true if parsed correctly, or 0 on a parse error (and an error 
+ * @return: true if parsed correctly, or 0 on a parse error (and an error
  * is logged).
  */
 int cfg_mark_ports(const char* str, int allow, int* avail, int num);
@@ -1241,7 +1272,7 @@ void cfg_apply_local_port_policy(struct config_file* cfg, int num);
  */
 int cfg_scan_ports(int* avail, int num);
 
-/** 
+/**
  * Convert a filename to full pathname in original filesys
  * @param fname: the path name to convert.
  *      Must not be null or empty.
@@ -1250,7 +1281,7 @@ int cfg_scan_ports(int* avail, int num);
  * @return pointer to malloced buffer which is: [chroot][chdir]fname
  *      or NULL on malloc failure.
  */
-char* fname_after_chroot(const char* fname, struct config_file* cfg, 
+char* fname_after_chroot(const char* fname, struct config_file* cfg,
        int use_chdir);
 
 /**
@@ -1335,4 +1366,3 @@ int if_is_dnscrypt(const char* ifname, const char* port, int dnscrypt_port);
 #endif
 
 #endif /* UTIL_CONFIG_FILE_H */
-

diff --git a/sbin/unwind/libunbound/util/configlexer.c b/sbin/unwind/libunbound/util/configlexer.c
index 2209c86..461789c 100644 (file)
--- a/sbin/unwind/libunbound/util/configlexer.c
+++ b/sbin/unwind/libunbound/util/configlexer.c
@@ -5,7 +5,7 @@
 
 #define  YY_INT_ALIGNED short int
 
-/*     $OpenBSD: configlexer.c,v 1.16 2022/10/22 16:37:57 florian Exp $        */
+/*     $OpenBSD: configlexer.c,v 1.17 2023/09/05 15:44:02 florian Exp $        */
 
 /* A lexical scanner generated by flex */
 
@@ -27,7 +27,7 @@
 
 /* end standard C headers. */
 
-/* $OpenBSD: configlexer.c,v 1.16 2022/10/22 16:37:57 florian Exp $ */
+/* $OpenBSD: configlexer.c,v 1.17 2023/09/05 15:44:02 florian Exp $ */
 
 /* flex integer type definitions */
 
@@ -368,8 +368,8 @@ static void yy_fatal_error (yyconst char msg[]  );
        *yy_cp = '\0'; \
        (yy_c_buf_p) = yy_cp;
 
-#define YY_NUM_RULES 369
-#define YY_END_OF_BUFFER 370
+#define YY_NUM_RULES 381
+#define YY_END_OF_BUFFER 382
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -377,409 +377,423 @@ struct yy_trans_info
        flex_int32_t yy_verify;
        flex_int32_t yy_nxt;
        };
-static yyconst flex_int16_t yy_accept[3646] =
+static yyconst flex_int16_t yy_accept[3778] =
     {   0,
-        1,    1,  343,  343,  347,  347,  351,  351,  355,  355,
-        1,    1,  359,  359,  363,  363,  370,  367,    1,  341,
-      341,  368,    2,  368,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  343,  344,  344,  345,
-      368,  347,  348,  348,  349,  368,  354,  351,  352,  352,
-      353,  368,  355,  356,  356,  357,  368,  366,  342,    2,
-      346,  368,  366,  362,  359,  360,  360,  361,  368,  363,
-      364,  364,  365,  368,  367,    0,    1,    2,    2,    2,
-        2,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  343,
-        0,  347,    0,  354,    0,  351,  355,    0,  366,    0,
-        2,    2,  366,  362,    0,  359,  363,    0,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  366,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  339,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  133,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  143,  367,  367,  367,  367,
-      367,  367,  367,  366,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  115,  367,  338,  367,  367,  367,
-      367,  367,  367,  367,  367,    8,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  134,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  148,  367,  367,  366,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  331,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  366,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   69,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  260,  367,   14,
-       15,  367,   19,   18,  367,  367,  240,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  141,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  238,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,    3,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      366,  367,  367,  367,  367,  367,  367,  367,  325,  367,
-      367,  324,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  350,  367,  367,  367,  367,  367,  367,  367,
-      367,   68,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,   72,  367,
-      294,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      332,  333,  367,  367,  367,  367,  367,  367,  367,  367,
-       73,  367,  367,  142,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  137,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      227,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,   21,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  169,  367,  367,  367,
-      367,  367,  366,  350,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  113,  367,  367,  367,  367,
-      367,  367,  367,  302,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  196,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  168,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  112,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   35,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,   36,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   70,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  140,  367,  367,  367,  366,  367,  367,
-      367,  367,  367,  132,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,   71,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  264,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  197,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,   58,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  282,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,   63,  367,   64,  367,  367,
-      367,  367,  367,  116,  367,  117,  367,  367,  367,  367,
-      367,  114,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,    7,  367,  367,  367,  367,
-      366,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  249,
-      367,  367,  367,  367,  172,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  265,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   49,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,   59,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  219,
-
-      367,  218,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   16,   17,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,   74,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  226,  367,  367,  367,  367,  367,  367,  119,
-      367,  118,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  210,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  149,  367,
-      367,  367,  366,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  107,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,   95,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  239,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      100,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,   67,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  213,  214,  367,  367,
-      367,  296,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,    6,  367,  367,  367,  367,
-      367,  367,  367,  315,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  300,  367,  367,  367,  367,  367,  367,
-      367,  326,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,   46,  367,  367,  367,
-      367,  367,   48,  367,  367,  367,   96,  367,  367,  367,
-      367,  367,   56,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  366,  367,  206,  367,  367,  367,
-      144,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  231,  367,  207,  367,  367,  367,  246,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,   57,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      146,  125,  367,  126,  367,  367,  367,  367,  124,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  165,  367,
-      367,   54,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  281,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  208,  367,  367,  367,  367,  367,  211,  367,
-      217,  367,  367,  367,  367,  367,  367,  245,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  111,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  138,  367,  367,  367,
-
-      367,  367,  367,  367,  367,   65,  367,  367,  367,   29,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   20,  367,  367,  367,  367,  367,  367,  367,
-       30,   39,  367,  177,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  204,  367,
-      367,  366,  367,  367,  367,  367,  367,  367,   82,   84,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  304,  367,  367,  367,  367,  261,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  127,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  164,  367,   50,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  255,  367,  367,
-      367,  367,  367,  367,  367,  319,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  171,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  313,
-      367,  367,  367,  367,  237,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  329,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  189,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  120,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  184,  367,  198,  367,  367,  367,  367,  367,
-      367,  367,  366,  367,  152,  367,  367,  367,  367,  367,
-      106,  367,  367,  367,  367,  229,  367,  367,  367,  367,
-      367,  367,  247,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  273,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  145,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  188,
-      367,  367,  367,  367,  367,  367,  367,   85,  367,   86,
-      367,  367,  367,  367,  367,  258,  367,  367,  367,  367,
-       66,  322,  367,  367,  367,  367,  367,   94,  199,  367,
-      220,  367,  250,  367,  367,  212,  297,  367,  367,  367,
-      367,  367,  367,   78,  367,  201,  367,  367,  367,  367,
-      367,  367,    9,  367,  367,  367,  367,  367,  110,  367,
-      367,  367,  367,  367,  367,  286,  367,  367,  367,  367,
-      228,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  366,  367,  367,  367,  367,
-      187,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  173,  367,  303,  367,  367,  367,  367,  367,  272,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  241,  367,  367,  367,  367,  367,  367,  295,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  170,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  323,  367,  200,
-      367,  367,  367,  367,  367,  367,  367,  367,   77,   79,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      109,  367,  367,  367,  367,  367,  367,  284,  367,  367,
-      367,  367,  299,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  233,   37,   31,   33,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,   38,  367,   32,   34,  367,   40,  367,  367,
-
-      367,  367,  367,  367,  367,  105,  367,  183,  367,  367,
-      367,  367,  367,  367,  367,  366,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  235,  232,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,   76,  367,
-      367,  367,  147,  367,  128,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  166,   51,  367,  367,  367,
-      358,   13,  367,  367,  367,  367,  367,  367,  367,  153,
-      367,  367,  367,  367,  367,  367,  367,  317,  367,  320,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,   12,  367,  367,   22,  367,  367,  367,  367,
-      367,  367,  367,  290,  367,  367,  367,  367,  301,  367,
-      367,  367,  367,   80,  367,  243,  367,  367,  367,  367,
-      367,  234,  367,  367,   75,  367,  367,  367,  367,  367,
-      367,   23,  367,  367,   47,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  182,  181,  367,
-      367,  358,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  236,  230,  367,  248,  367,  367,  305,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  194,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,   87,  367,  367,  367,  367,  367,
-      367,  367,  285,  367,  367,  367,  367,  216,  367,  367,
-      367,  367,  367,  242,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  292,  367,  367,  367,  327,  328,
-      179,  367,  367,  367,   81,  367,  367,  367,  367,  190,
-      367,  367,  367,  121,  123,  122,  367,  367,  367,   25,
-      367,  367,  174,  367,  176,  367,  221,  367,  367,  367,
-      367,  180,  367,  367,  367,  367,  251,  367,  367,  367,
-      367,  367,  367,  367,  155,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  263,  367,  367,
-      367,  367,  367,  367,  367,  336,  367,   27,  367,  298,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,   92,  222,  367,
-      367,  257,  367,  367,  283,  367,  321,  367,  215,  367,
-      367,  367,  367,  367,  293,   60,  367,  367,  367,  367,
-      367,  367,  367,    4,  367,  367,  367,  367,  136,  367,
-      154,  367,  367,  367,  195,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  254,   41,   42,  367,  367,  367,  367,
-
-      367,  367,  367,  306,  367,  367,  367,  367,  367,  367,
-      367,  271,  367,  367,  367,  367,  367,  367,  367,  367,
-      225,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,   91,   90,  367,  367,   61,
-      367,  367,  289,  367,  259,  367,  367,  367,  367,  367,
-       11,  367,  367,  367,  367,  340,  367,  367,  367,  367,
-      135,  367,  367,  367,  367,  367,  223,   97,  367,  367,
-       44,  367,  367,  367,  367,  367,  367,  367,  367,  186,
-      367,  367,  367,  367,  367,  367,  367,  157,  367,  367,
-      367,  367,  262,  367,  367,  367,  367,  367,  270,  367,
-
-      367,  367,  367,  150,  367,  367,  367,  129,  131,  130,
-      367,  367,  367,   99,  103,   98,  167,  367,  367,  367,
-      367,   88,  367,  256,  291,  367,  367,  367,  367,  367,
-      367,   10,  367,  367,  367,  367,  367,  287,  330,  367,
-      367,  367,  367,  367,  367,  335,   43,  367,  367,  367,
-      367,  367,  185,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  104,  102,
-      367,   55,  367,  367,   89,  367,  318,  367,  367,  367,
-      367,   24,  367,  367,  367,  367,  367,  209,  367,  367,
-
-      367,  367,  367,  367,  224,  367,  367,  367,  367,  367,
-      367,  367,  367,  205,  367,  367,  175,   83,  367,  367,
-      367,  367,  367,  307,  367,  367,  367,  367,  367,  367,
-      367,  267,  367,  367,  266,  151,  367,  367,  101,   52,
-      367,  367,  158,  159,  162,  163,  160,  161,   93,  316,
-      367,  367,  288,  139,  367,  367,  367,   26,  367,  178,
-      367,  367,  367,  367,  203,  367,  253,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  192,  191,
-       45,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  314,  367,  367,  367,  367,  108,
-      367,  252,  367,  280,  311,  367,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  337,  367,   53,   62,
-        5,  367,  367,  244,  367,  367,  312,  367,  367,  367,
-      367,  367,  367,  367,  367,  367,  268,   28,  367,  367,
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      269,  367,  367,  367,  156,  367,  367,  367,  367,  367,
-      367,  367,  367,  193,  367,  202,  367,  367,  367,  367,
-      367,  367,  367,  367,  367,  308,  367,  367,  367,  367,
-
-      367,  367,  367,  367,  367,  367,  367,  367,  367,  367,
-      367,  367,  367,  334,  367,  367,  276,  367,  367,  367,
-      367,  367,  309,  367,  367,  367,  367,  367,  367,  310,
-      367,  367,  367,  274,  367,  277,  278,  367,  367,  367,
-      367,  367,  275,  279,    0
+        1,    1,  355,  355,  359,  359,  363,  363,  367,  367,
+        1,    1,  371,  371,  375,  375,  382,  379,    1,  353,
+      353,  380,    2,  380,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  355,  356,  356,  357,
+      380,  359,  360,  360,  361,  380,  366,  363,  364,  364,
+      365,  380,  367,  368,  368,  369,  380,  378,  354,    2,
+      358,  380,  378,  374,  371,  372,  372,  373,  380,  375,
+      376,  376,  377,  380,  379,    0,    1,    2,    2,    2,
+        2,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      355,    0,  359,    0,  366,    0,  363,  367,    0,  378,
+        0,    2,    2,  378,  374,    0,  371,  375,    0,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  378,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  351,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  136,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  146,  379,  379,  379,  379,  379,
+
+      379,  379,  378,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  118,  379,
+      379,  350,  379,  379,  379,  379,  379,  379,  379,  379,
+
+        8,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  137,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  151,  379,  379,
+      378,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  341,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  378,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,   71,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  265,  379,   14,   15,  379,  379,   20,   19,
+
+      379,  379,  244,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  144,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  242,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,    3,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      378,  379,  379,  379,  379,  379,  379,  379,  379,  333,
+      379,  379,  332,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  362,  379,  379,  379,
+      379,  379,  379,  379,  379,   70,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,   74,  379,  302,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  342,  343,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,   75,  379,  379,
+
+      145,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  140,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  231,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,   22,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  172,  379,  379,  379,  379,  379,
+      378,  362,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  116,  379,  379,  379,  379,
+      379,  379,  379,  310,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,   16,  379,  379,  379,  379,  379,
+      379,  379,  379,  199,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  171,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  115,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   37,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,   38,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   72,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  143,
+      379,  379,  379,  378,  379,  379,  379,  379,  379,  379,
+      135,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,   73,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      269,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  200,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,   60,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  288,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,   65,  379,   66,
+      379,  379,  379,  379,  379,  379,  119,  379,  120,  379,
+
+      379,  379,  379,  379,  117,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,    7,  379,
+      379,  379,  379,  378,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  254,  379,  379,  379,  379,  175,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  270,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   51,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+       61,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  222,  379,  221,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,   17,   18,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,   76,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  230,  379,  379,  379,  379,  379,  379,  379,  122,
+      379,  121,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  213,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  152,  379,
+      379,  379,  378,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  110,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,   97,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  243,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  102,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+       69,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  216,
+      217,  379,  379,  379,  304,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,    6,  379,  379,  379,  379,  379,  379,  379,  323,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  308,
+      379,  379,  379,  379,  379,  379,  379,  334,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,   48,  379,  379,  379,  379,  379,   50,
+      379,  379,  379,   98,  379,  379,  379,  379,  379,   58,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  378,  379,  209,  379,  379,  379,  147,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  235,
+      379,  379,  210,  379,  379,  379,  250,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,   59,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  149,
+      128,  379,  129,  379,  379,  379,  379,  127,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  168,  379,
+      379,   56,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  286,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  211,  379,  379,  379,  379,  379,  214,  379,
+      220,  379,  379,  379,  379,  379,  379,  379,  379,  249,
+      379,  379,  379,  379,  379,  379,  253,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  114,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  141,
+      379,  379,  379,  379,  379,  379,  379,  379,   67,  379,
+      379,  379,  379,   31,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,   21,  379,  379,  379,
+
+      379,  379,  379,  379,   32,   41,  379,  180,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  207,  379,  379,  378,  379,  379,  379,  379,
+      346,  379,  379,   84,   86,  379,  379,  379,  379,  379,
+      379,  379,  347,  379,  379,  379,  379,  379,  379,  312,
+      379,  379,  379,  379,  266,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  130,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  167,  379,   52,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  260,  379,  379,  379,  379,  379,
+      379,  379,  379,  327,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  174,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  321,
+      379,  379,  379,  379,  241,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  339,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  192,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      123,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  187,  379,  201,  379,  379,  379,
+      379,  379,  379,  379,  378,  379,  155,  379,  379,  379,
+      379,  379,  109,  379,  379,  379,  379,  233,  379,  379,
+      379,  379,  379,  379,  251,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  278,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  148,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  191,  379,  379,  379,  379,  379,  379,  379,
+       87,  379,   88,  379,  379,  379,  379,  379,  263,  379,
+      379,  379,  379,  379,   68,  330,  379,  379,  379,  379,
+      379,   96,  202,  379,  223,  379,  255,  379,  379,  215,
+      305,  379,  379,  379,  379,  300,  379,  379,  379,   80,
+      379,  204,  379,  379,  379,  379,  379,  379,    9,  379,
+      379,  379,  379,  379,  113,  379,  379,  379,  379,  379,
+      379,  292,  379,  379,  379,  379,  379,  232,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  378,  379,  379,  379,  379,  190,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      176,  379,  311,  379,  379,  379,  379,  379,  277,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      245,  379,  379,  379,  379,  379,  379,  303,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  173,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  331,  379,
+      203,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+       79,   81,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  112,  379,  379,  379,  379,  379,  379,  290,
+      379,  379,  379,  379,  379,  379,  307,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      237,  379,   39,   33,   35,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   40,  379,
+       34,   36,  379,   42,  379,  379,  379,  379,  379,  379,
+
+      379,  108,  379,  186,  379,  379,  379,  379,  379,  379,
+      379,  378,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  239,  236,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,   78,  379,  379,  379,  150,  379,
+      131,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  169,   53,  379,  379,  379,  370,   13,  379,
+      379,  379,  379,  379,  379,  379,  156,  379,  379,  379,
+      379,  379,  379,  379,  379,  325,  379,  328,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,   12,  379,  379,   23,  379,  379,  379,  379,  379,
+      379,  379,  296,  379,  379,  379,  379,  379,  379,  309,
+      379,  379,  379,  379,   82,  379,  247,  379,  379,  379,
+      379,  379,  238,  379,  379,  379,  379,   77,  379,  379,
+      379,  379,  379,  379,   24,  379,  379,   49,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      185,  184,  379,  379,  370,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  240,  234,  379,  252,  379,  379,
+      313,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  197,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   89,  379,
+      379,  379,  379,  379,  379,  379,  379,  291,  379,  379,
+      379,  379,  219,  379,  379,  379,  379,  379,  379,  246,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      298,  379,  379,  379,  335,  379,  337,  336,  182,  379,
+      379,  379,   83,  379,  379,  379,  379,  193,  379,  379,
+      379,  379,  379,  124,  126,  125,  379,  379,  379,   26,
+      379,  379,  177,  379,  179,  379,  224,  379,  379,  379,
+      379,  183,  379,  379,  379,  379,  256,  379,  379,  379,
+
+      379,  379,  379,  379,  158,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  268,  379,  379,
+      379,  379,  379,  379,  379,  348,  379,   28,  379,  306,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,   94,  225,
+      379,  379,  262,  379,  379,  379,  289,  379,  329,  379,
+      218,  379,  379,  301,  379,  379,  379,  299,   62,  379,
+      379,  379,  379,  379,  379,  379,    4,  379,  379,  379,
+      379,  379,  139,  379,  157,  379,  379,  379,  198,   30,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  259,
+       43,   44,  379,  379,  379,  379,  379,  379,  379,  314,
+      379,  379,  379,  379,  379,  379,  379,  276,  379,  379,
+      379,  379,  379,  379,  379,  379,  228,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,   93,   92,  379,  379,   63,  379,  379,  287,
+      295,  379,  264,  379,  379,  379,  379,  379,   11,  379,
+      379,  379,  379,  352,  379,  379,  379,  379,  379,  138,
+      379,  379,  379,  379,  379,  379,  226,   99,  379,  379,
+       46,  379,  379,  379,  379,  379,  379,  379,  379,  189,
+
+      379,  379,  379,  379,  379,  379,  379,  160,  379,  379,
+      379,  379,  267,  379,  379,  379,  379,  379,  275,  379,
+      379,  379,  379,  153,  379,  379,  379,  132,  134,  133,
+      379,  379,  379,  101,  105,  100,  379,  170,  379,  379,
+      379,  379,   90,  379,  261,  297,  379,  379,  379,  379,
+      379,  379,   10,  379,  379,  379,  379,  379,  293,  340,
+      379,  379,  379,  379,  379,  379,  379,  379,  345,   45,
+      379,  379,  379,  379,  379,  188,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  106,  104,  379,  379,   57,  379,  379,   91,  379,
+      326,  379,  379,  379,  379,   25,  379,  379,  379,  379,
+      379,  212,  379,  379,  338,  379,  379,  379,  379,  227,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  208,
+      379,  379,  178,   85,  379,  379,  379,  379,  379,  315,
+      379,  379,  379,  379,  379,  379,  379,  272,  379,  379,
+      271,  154,  379,  379,  103,  379,   54,  379,  379,  161,
+      162,  165,  166,  163,  164,   95,  324,  379,  379,  294,
+      142,  379,  379,  379,  379,   27,  379,  181,  379,  379,
+      379,  379,  206,  379,  258,  379,  379,  379,  379,  379,
+
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  195,  194,  229,
+       47,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  322,  379,  379,  379,  379,
+      111,  379,  257,  379,  285,  319,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  349,  379,  107,
+       55,   64,    5,  379,  379,  248,  379,  379,  320,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  273,   29,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+
+      379,  379,  274,  379,  379,  379,  159,  379,  379,  379,
+      379,  379,  379,  379,  379,  196,  379,  205,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  316,  379,  379,
+      379,  379,  379,  379,  379,  379,  379,  379,  379,  379,
+      379,  379,  379,  379,  379,  344,  379,  379,  281,  379,
+      379,  379,  379,  379,  317,  379,  379,  379,  379,  379,
+      379,  318,  379,  379,  379,  279,  379,  282,  283,  379,
+      379,  379,  379,  379,  280,  284,    0
     } ;
 
 static yyconst flex_int32_t yy_ec[256] =
@@ -822,821 +836,851 @@ static yyconst flex_int32_t yy_meta[41] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1
     } ;
 
-static yyconst flex_int16_t yy_base[3664] =
+static yyconst flex_int16_t yy_base[3796] =
     {   0,
         0,    0,   38,   41,   44,   46,   59,   65,   71,   77,
-       90,  112,   96,  118,  124,  136, 4156, 2779,   81, 7110,
-     7110, 7110,  129,   52,  130,   63,  131,  152,   70,  140,
-      149,  156,   57,   88,   76,  173,  175,   95,  197,  145,
-      185,  199,  208,  213,  178,  123, 2391, 7110, 7110, 7110,
-      107, 2147, 7110, 7110, 7110,  154, 2117, 1982, 7110, 7110,
-     7110,  245, 1770, 7110, 7110, 7110,  163, 1609, 7110,  249,
-     7110,  253,  148, 1509, 1480, 7110, 7110, 7110,  257, 1324,
-     7110, 7110, 7110,  233, 1201,  263,  201,    0,  267,    0,
-        0,  165,  191,  221,  252,  205,  181,  265,   92,  261,
-
-      216,  263,  271,  272,  210,  279,  274,  282,  278,  291,
-      283,  286,  276,  285,  295,  293,  306,  314,  297,  313,
-      317,  311,  315,  319,  321,  331,  327,  332,  336,  322,
-      339,  337,  346,  345,  347,  348,  353,  351,  357,  284,
-      358,  359,  369,  360,  380,  365,  381,  379,  375,  366,
-      367,  389,  390,  394,  393,  395,  396,  403,  404, 1026,
-      419,  993,  422,  933,  429,  800,  757,  433,  713,  437,
-      441,    0,  433,  515,  447,  479,  364,  452,  411,  445,
-      426,  446,  447,  448,  449,  450,  451,  453,  452,  456,
-      470,  234,  463,  473,  481,  479,  476,  483,  486,  493,
-
-      488,  489,  495,  491,  501,  508,  505,  506,  504,  510,
-      512,  513,  460,  514,  517,  529,  518,  516,  526,  538,
-      539,  550,  543,  534,  551,  552,  400,  559,  555,  563,
-      558,  570,  565,  574,  566,  569,  571,  576,  573,  577,
-      580,  581,  578,  584,  585,  587,  589,  598,  599,  590,
-      602,  596,  611,  607,  616,  612,  614,  613,  617,  541,
-      627,  628,  620,  629,  630,  624,  633,  641,  637,  649,
-      644,  635,  645,  647,  648,  652,  651,  656,  653,  668,
-      670,  669,  672,  679,  665,  675,  666,  678,  682,  681,
-      691,  654,  686,  693,  698,  683,  696,  699,  687,  702,
-
-      704,  705,  710,  711,  708, 7110,  718,  714,  721,  722,
-      729,  726,  731,  733,  740,  741,  716,  725,  737,  739,
-      744,  746,  748,  750,  742,  751,  755,  753,  759,  763,
-      770,  765,  772,  785,  767,  773,  777,  778,  786,  774,
-      780,  798,  812,  790,  808,  809,  795,  813,  814,  815,
-      816,  818,  822,  819,  833,  821,  823,  830,  836,  837,
-      839,  840,  847,  842, 7110,  844,  852,  866,  853,  862,
-      865,  849,  869,  871,  850,  881,  877,  874,  891,  913,
-      878,  884,  882,  886,  889, 7110,  896,  893,  937,  895,
-      902,  923,  918,  906,  919,  920,  921,  925,  947,  928,
-
-      926,  943,  961,  958,  942,  948,  945,  959,  967,  972,
-      969,  971,  973,  974,  983,  883,  976,  975,  989,  978,
-      979,  984,  990,  994,  997, 1003, 1007, 1008, 1009,  999,
-     1001, 1013, 1014, 1017, 1025, 1048, 1021, 1019, 1030, 1020,
-     1037, 1042, 1022, 1038, 1050, 1049, 1051, 1039, 1040, 1055,
-     1058, 1067, 1060, 1063, 1076, 1071, 1074, 1077, 1078, 1079,
-     1081, 1080, 1085, 1086, 1087, 1088, 1095, 1093, 1094, 1101,
-     1103, 1096, 1109, 1107, 7110, 1111, 7110, 1113, 1114, 1115,
-     1116, 1118, 1119, 1120, 1121, 7110, 1123, 1126, 1127, 1137,
-     1128, 1138, 1145, 1152, 1130, 1148, 1149, 1150, 1151, 1155,
-
-     1158, 1169, 1156, 1161, 1172, 1159, 1174, 1171, 1168, 1177,
-     1175, 1182, 1178, 1184, 1185, 1186, 1205, 7110, 1187, 1188,
-     1195, 1192, 1198, 1203, 1202, 1212, 1223, 1214, 1215, 1222,
-     1226, 1239, 1227, 1230, 1191, 1234, 1236, 1247, 1237, 1249,
-     1243, 1251, 1245, 1252, 1254, 1255, 1259, 1261, 1265, 1266,
-     1268, 7110, 1267, 1271, 1278, 1285, 1280, 1272, 1269, 1283,
-     1286, 1289, 1290, 1291, 1293, 1296, 1298, 1300, 1308, 1303,
-     1311, 1309, 1310, 1312, 1314, 1317, 1316, 1318, 1323, 1331,
-     1328, 1333, 1336, 1344, 1343, 1346, 1353, 1355, 1340, 1348,
-     1350, 1356, 1352, 1351, 1360, 1361, 1366, 1363, 1365, 1372,
-
-     1373, 1374, 1375, 1377, 1378, 1382, 1380, 1385, 1387, 1388,
-     1390, 1389, 1391, 1398, 1397, 1399, 1404, 1401, 1417, 1403,
-     1406, 1420, 1423, 1410, 1414, 7110, 1432, 1427, 1430, 1431,
-     1434, 1437, 1438, 1442, 1441, 1444, 1447, 1445, 1446, 1449,
-     1452, 1453, 1454, 1455, 1456, 1462, 1469, 1464, 1473, 1480,
-     1479, 1481, 1467, 1483, 1484, 1487, 1488, 1495, 1491, 1499,
-     1500, 1490, 1501, 1494, 1514, 1504, 1505, 1511, 1525, 1502,
-     1520, 1522, 1512, 1523, 1526, 1528, 1534, 1542, 1538, 1539,
-     1546, 1547, 1541, 1549, 1543, 1553, 1556, 1557, 1558, 1559,
-     1560, 1567, 1564, 1563, 1569, 1570, 1565, 1571, 1579, 1573,
-
-     1587, 1577, 1586, 1589, 1592, 1593, 1594, 1595, 1598, 1596,
-     1602, 1603, 1604, 1605, 1610, 1617, 1606, 1625, 1618, 1608,
-     1619, 1626, 1628, 1634, 1635, 1636, 1637, 1638, 1639, 1641,
-     1642, 1648, 1645, 1651, 1652, 1655, 1657, 1656, 1670, 1662,
-     1671, 1672, 1659, 1675, 1677, 1679, 1660, 1683, 1685, 1688,
-     1690, 1680, 7110, 1678, 1702, 1691, 1699, 1698, 1700, 1701,
-     1712, 1705, 1707, 1704, 1708, 1709, 1734, 7110, 1715, 7110,
-     7110, 1718, 7110, 7110, 1717, 1721, 7110, 1716, 1731, 1723,
-     1724, 1741, 1747, 1749, 1744, 1742, 1751, 1752, 1763, 1773,
-     1758, 1759, 1761, 1766, 1767, 1762, 1779, 1776, 1768, 1788,
-
-     1789, 1769, 1795, 1802, 1790, 1805, 1800, 1803, 1809, 1807,
-     1811, 1813, 1817, 1819, 1820, 1822, 1823, 1824, 1826, 1720,
-     1828, 1825, 1833, 1830, 1834, 1836, 1835, 1843, 1846, 1839,
-     1855, 7110, 1853, 1856, 1842, 1865, 1862, 1866, 1868, 1863,
-     1864, 1874, 1876, 1870, 1877, 1879, 1881, 1880, 1882, 1883,
-     1886, 1889, 1892, 1890, 1894, 1897, 1896, 1902, 7110, 1903,
-     1904, 1906, 1910, 1907, 1908, 1917, 1909, 1918, 1919, 1920,
-     1932, 1924, 1934, 1925, 1927, 1936, 1929, 1937, 1939, 7110,
-     1947, 1952, 1941, 1954, 1944, 1948, 1956, 1957, 1958, 1960,
-     1961, 1963, 1964, 1966, 1977, 1972, 1974, 1973, 1975, 1983,
-
-     1987, 1980, 1990, 1991, 1999, 1992, 1995, 2000, 2001, 2002,
-     2003, 2005, 2006, 2008, 2012, 2013, 2020, 2016, 2024, 2017,
-     2019, 2035, 2040, 2022, 2033, 2036, 2037, 2038, 2043, 2047,
-     2051, 2046, 2050, 2053, 2060, 2055, 2058, 2061, 2062, 2069,
-     2071, 2063, 2073, 2080, 2064, 2074, 2083, 2076, 7110, 2082,
-     2084, 7110, 2089, 2090, 2091, 2113, 2092, 2096, 2099, 2104,
-     2101, 2105, 2108, 2097, 2115, 2107, 2131, 2119, 2127, 2132,
-     2135, 2137, 2133, 2138, 2139, 2140, 2144, 2146, 2149, 2151,
-     2159, 2162, 2166, 2168, 2170, 2169, 2171, 2172, 2174, 2194,
-     2173, 2175, 2176, 2177, 2178, 2181, 2188, 2182, 2183, 2184,
-
-     2187, 2199, 2207, 2204, 2205, 2210, 2211, 2212, 2216, 2219,
-     2221, 2222, 7110, 2229, 2232, 2224, 2226, 2233, 2244, 2236,
-     2237, 7110, 2239, 2240, 2245, 2253, 2250, 2251, 2252, 2254,
-     2255, 2258, 2260, 2262, 2264, 2275, 2263, 2282, 7110, 2267,
-     7110, 2265, 2266, 2284, 2268, 2277, 2285, 2290, 2288, 2292,
-     7110, 7110, 2294, 2295, 2300, 2302, 2312, 2298, 2308, 2309,
-     7110, 2310, 2317, 7110, 2314, 2313, 2321, 2319, 2320, 2325,
-     2327, 2329, 2331, 2336, 2332, 2343, 2334, 2339, 2347, 7110,
-     2350, 2335, 2348, 2353, 2354, 2355, 2356, 2357, 2363, 2360,
-     7110, 2364, 2366, 2367, 2380, 2376, 2377, 2378, 2381, 2387,
-
-     2379, 2383, 2385, 2389, 2390, 2399, 2400, 2401, 2404, 2406,
-     2413, 2410, 2414, 7110, 2412, 2398, 2418, 2425, 2421, 2423,
-     2420, 2424, 2427, 2428, 2430, 2431, 2436, 2437, 2435, 2441,
-     2442, 2443, 2450, 2451, 2452, 2453, 2456, 2447, 2457, 2460,
-     2461, 2468, 2463, 2465, 2469, 2470, 7110, 2473, 2476, 2477,
-     2478, 2482, 2480,  171, 2484, 2486, 2490, 2489, 2496, 2504,
-     2491, 2499, 2512, 2497, 2509, 2508, 2515, 2507, 2516, 2517,
-     2518, 2519, 2524, 2525, 2523, 7110, 2527, 2529, 2528, 2532,
-     2535, 2534, 2539, 7110, 2545, 2536, 2551, 2560, 2550, 2548,
-     2561, 2552, 2563, 2565, 2567, 2566, 2568, 2575, 2573, 2570,
-
-     2576, 2577, 7110, 2583, 2586, 2588, 2579, 2589, 2597, 2595,
-     2590, 2592, 2598, 2600, 2606, 2602, 2608, 2610, 2611, 2613,
-     2616, 2615, 2624, 2614, 2619, 2626, 2623, 2625, 2628, 2627,
-     2633, 2636, 2643, 2641, 7110, 2648, 2645, 2649, 2647, 2650,
-     2652, 2654, 2653, 2672, 2656, 2662, 2664, 2673, 2678, 2667,
-     2681, 2688, 2684, 2689, 2693, 2698, 2695, 2699, 2705, 2696,
-     2707, 2709, 2703, 2710, 2719, 2711, 2715, 2716, 2718, 2722,
-     2730, 2731, 2729, 2733, 2726, 2727, 2744, 2738, 2750, 2756,
-     2746, 7110, 2755, 2748, 2742, 2758, 2760, 2767, 2764, 2765,
-     2770, 2768, 2771, 2772, 2774, 2778, 2783, 2784, 2657, 2781,
-
-     2786, 2790, 2788, 2794, 2797, 2796, 2798, 2801, 2808, 2805,
-     2810, 2811, 7110, 2812, 2816, 2799, 2817, 2825, 2819, 2828,
-     2829, 2831, 2822, 2832, 2833, 2835, 2837, 2838, 2841, 2840,
-     2848, 2845, 2847, 2849, 2846, 7110, 2858, 2852, 2859, 2863,
-     2862, 2865, 2866, 2873, 2877, 2879, 2881, 2883, 2869, 2885,
-     2886, 2889, 7110, 2896, 2898, 2894, 2895, 2903, 2901, 2904,
-     2905, 2907, 2908, 7110, 2909, 2911, 2912, 2915, 2913, 2917,
-     2924, 2925, 2920, 7110, 2927, 2931, 2932, 2934, 2935, 2936,
-     2937, 2938, 2941, 2942, 2944, 2943, 2957, 2946, 2953, 7110,
-     2949, 2965, 2960, 2963, 2966, 2970, 2971, 2973, 2975, 2976,
-
-     2977, 2981, 7110, 2993, 2871, 2989, 2998, 2982, 2990, 2994,
-     2999, 3002, 3003, 2996, 3005, 3006, 3009, 7110, 3010, 3013,
-     3015, 3017, 3019, 3020, 3021, 3028, 3027, 3026, 3030, 3032,
-     3035, 3036, 3034, 3043, 3037, 3047, 3041, 3045, 3054, 3055,
-     3057, 3058, 3060, 3061, 3070, 3071, 3068, 3073, 3076, 3077,
-     3069, 3078, 3079, 3087, 3092, 3094, 3089, 3095, 7110, 3098,
-     3100, 3093, 3091, 3101, 3105, 3103, 3107, 3110, 3106, 3108,
-     3120, 3121, 3112, 3128, 3130, 3123, 3132, 3134, 3136, 3137,
-     3139, 3138, 3140, 3141, 3148, 3145, 3147, 3149, 3158, 3151,
-     3156, 3169, 3154, 3161, 3164, 3165, 3166, 3168, 3171, 3172,
-
-     3176, 3178, 3174, 3179, 3188, 3190, 3195, 3186, 3197, 3196,
-     3199, 3202, 3203, 3204, 7110, 3207, 3208, 3205, 3212, 3215,
-     3218, 3219, 3227, 3222, 3226, 3234, 3230, 3229, 3236, 3238,
-     3241, 3242, 3243, 3250, 3246, 7110, 3247, 7110, 3248, 3249,
-     3252, 3261, 3256, 7110, 3267, 7110, 3257, 3271, 3262, 3264,
-     3268, 7110, 3272, 3273, 3277, 3274, 3279, 3281, 3285, 3286,
-     3287, 3288, 3289, 3296, 3291, 3295, 3298, 3302, 3301, 3305,
-     3308, 3310, 3311, 3313, 3312, 3315, 3319, 3320, 3321, 3328,
-     3330, 3331, 3332, 3333, 3334, 7110, 3338, 3341, 3335, 3346,
-     3343, 3345, 3347, 3353, 3354, 3355, 3356, 3360, 3358, 3362,
-
-     3367, 3370, 3364, 3371, 3374, 3381, 3383, 3375, 3390, 7110,
-     3385, 3388, 3389, 3392, 7110, 3396, 3393, 3402, 3404, 3397,
-     3394, 3400, 3406, 3413, 3407, 3410, 3416, 3420, 3424, 3427,
-     3428, 7110, 3421, 3429, 3419, 3437, 3442, 3433, 3445, 3449,
-     3446, 3452, 3454, 3456, 3458, 3435, 3459, 3460, 3461, 3462,
-     3470, 3472, 3473, 3469, 3482, 3468, 3475, 3484, 3485, 3471,
-     3478, 3486, 3487, 3488, 3492, 3494, 3493, 3495, 3496, 3497,
-     3503, 3509, 7110, 3501, 3512, 3504, 3521, 3510, 3518, 3519,
-     3514, 3523, 3531, 3527, 7110, 3538, 3525, 3535, 3529, 3542,
-     3533, 3546, 3547, 3549, 3550, 3551, 3554, 3553, 3552, 7110,
-
-     3555, 7110, 3556, 3569, 3558, 3564, 3573, 3574, 3576, 3578,
-     3580, 3582, 3583, 3584, 3586, 3589, 3590, 3594, 3595, 3598,
-     3596, 3615, 3600, 3597, 3602, 3611, 3612, 3613, 3616, 3626,
-     3618, 3617, 7110, 7110, 3619, 3621, 3633, 3628, 3635, 3636,
-     3637, 3640, 3647, 3643, 3646, 3649, 3650, 3658, 7110, 3653,
-     3654, 3660, 3661, 3662, 3671, 3663, 3673, 3680, 3678, 3675,
-     3685, 3684, 7110, 3677, 3686, 3693, 3688, 3695, 3702, 7110,
-     3691, 7110, 3692, 3694, 3703, 3706, 3705, 3707, 3708, 3709,
-     3712, 3715, 3717, 3720, 3730, 3732, 3733, 3727, 3735, 3723,
-     3728, 3737, 3739, 3742, 3750, 3745, 3747, 3748, 7110, 3752,
-
-     3749, 3753, 3754, 3758, 3760, 3768, 3761, 3762, 7110, 3764,
-     3771, 3774, 3772, 3776, 3782, 3779, 3783, 3786, 3788, 3789,
-     3790, 3792, 3794, 7110, 3793, 3796, 3807, 3799, 3800, 3802,
-     3810, 3814, 3820, 7110, 3821, 3813, 3829, 3825, 3815, 3828,
-     3831, 3832, 3833, 3835, 3836, 3837, 3838, 3839, 3844, 3845,
-     3841, 3840, 3847, 3858, 3859, 3850, 3869, 3857, 3861, 7110,
-     3871, 3866, 3872, 3873, 3874, 3875, 3876, 3878, 3881, 3884,
-     3886, 3896, 3897, 3888, 3893, 3899, 3901, 3903, 3908, 3910,
-     7110, 3911, 3904, 3918, 3916, 3915, 3923, 3925, 3917, 3927,
-     3929, 3919, 3930, 3931, 3933, 3941, 3939, 3949, 3945, 3935,
-
-     3947, 3946, 3954, 3950, 3952, 3953, 3956, 7110, 3968, 3963,
-     3969, 3971, 3974, 3975, 3982, 3978, 3979, 3980, 3989, 3981,
-     3991, 3983, 3986, 3993, 3996, 3997, 7110, 7110, 4005, 3998,
-     4000, 7110, 4002, 4006, 4016, 4012, 4014, 4015, 4018, 4019,
-     4020, 4021, 4024, 4022, 4030, 7110, 4037, 4034, 4038, 4035,
-     4042, 4050, 4041, 7110, 4040, 4051, 4053, 4056, 4054, 4057,
-     4058, 4060, 4062, 4064, 4066, 4067, 4068, 4070, 4080, 4081,
-     4073, 4077, 4082, 7110, 4083, 4084, 4090, 4088, 4089, 4091,
-     4096, 7110, 4097, 4100, 4098, 4101, 4105, 4109, 4115, 4112,
-     4118, 4120, 4121, 4124, 4122, 4125, 4126, 4129, 4136, 4132,
-
-     4133, 4134, 4131, 4138, 4151, 4153, 7110, 4147, 4154, 4140,
-     4158, 4162, 7110, 4167, 4174, 4175, 7110, 4177, 4155, 4159,
-     4172, 4182, 7110, 4178, 4179, 4180, 4185, 4187, 4194, 4189,
-     4197, 4196, 4198, 4193, 4199, 4202, 7110, 4203, 4200, 4201,
-     7110, 4205, 4209, 4221, 4223, 4207, 4224, 4225, 4228, 4226,
-     4229, 7110, 4230, 7110, 4234, 4236, 4239, 7110, 4241, 4242,
-     4244, 4246, 4243, 4250, 4251, 4257, 4259, 4247, 4261, 4262,
-     4263, 4264, 4266, 4275, 4265, 4272, 4273, 4274, 7110, 4277,
-     4276, 4284, 4286, 4279, 4296, 4292, 4290, 4285, 4298, 4287,
-     7110, 7110, 4305, 7110, 4307, 4308, 4309, 4311, 7110, 4313,
-
-     4312, 4320, 4315, 4316, 4319, 4318, 4323, 4329, 7110, 4331,
-     4333, 7110, 4335, 4338, 4345, 4340, 4341, 4342, 4343, 4346,
-     4350, 4349, 4353, 4355, 4356, 4357, 4352, 4366, 4361, 4374,
-     4360, 4379, 7110, 4362, 4372, 4377, 4387, 4384, 4380, 4388,
-     4392, 4390, 7110, 4394, 4401, 4393, 4404, 4405, 7110, 4406,
-     7110, 4396, 4407, 4408, 4417, 4413, 4424, 7110, 4421, 4422,
-     4426, 4427, 4428, 4429, 4430, 4434, 4437, 4438, 4440, 4447,
-     4443, 4444, 4442, 4451, 4458, 7110, 4446, 4449, 4452, 4462,
-     4467, 4459, 4469, 4471, 4478, 4474, 4473, 4476, 4477, 4481,
-     4483, 4486, 4488, 4490, 4492, 4482, 7110, 4498, 4496, 4501,
-
-     4504, 4512, 4507, 4509, 4510, 7110, 4514, 4515, 4516, 7110,
-     4517, 4513, 4523, 4528, 4524, 4529, 4531, 4534, 4535, 4537,
-     4538, 4536, 7110, 4540, 4543, 4539, 4556, 4557, 4545, 4546,
-     7110, 7110, 4563, 7110, 4565, 4544, 4558, 4548, 4568, 4570,
-     4575, 4572, 4577, 4578, 4580, 4583, 4584, 4585, 7110, 4586,
-     4594, 4590, 4601, 4597, 4608, 4603, 4607, 4604, 7110, 7110,
-     4610, 4613, 4611, 4617, 4618, 4621, 4622, 4629, 4625, 4626,
-     4632, 4636, 4643, 7110, 4634, 4635, 4642, 4644, 7110, 4645,
-     4647, 4648, 4650, 4649, 4651, 4656, 4653, 4657, 4658, 4660,
-     4663, 4661, 4674, 4666, 4668, 4675, 4677, 4678, 4681, 4682,
-
-     4683, 4688, 7110, 4690, 4685, 4691, 4692, 4696, 4699, 4702,
-     4703, 4700, 4705, 4713, 7110, 4714, 7110, 4709, 4706, 4725,
-     4715, 4708, 4733, 4730, 4734, 4727, 4718, 4736, 4738, 4743,
-     4746, 4739, 4748, 4749, 4752, 4753, 4754, 7110, 4757, 4759,
-     4761, 4763, 4769, 4771, 4773, 7110, 4774, 4765, 4776, 4777,
-     4781, 4783, 4784, 4787, 4788, 4791, 4792, 4793, 4795, 4800,
-     4797, 4801, 4802, 4804, 4805, 7110, 4808, 4815, 4809, 4817,
-     4812, 4820, 4821, 4823, 4831, 4834, 4822, 4829, 4835, 7110,
-     4836, 4838, 4840, 4848, 7110, 4843, 4845, 4846, 4849, 4850,
-     4853, 4855, 4856, 4858, 4862, 7110, 4866, 4859, 4868, 4867,
-
-     4870, 4871, 4872, 4876, 4882, 4884, 4878, 4891, 7110, 4892,
-     4885, 4890, 4896, 4898, 4899, 4900, 4903, 4904, 7110, 4905,
-     4913, 4914, 4907, 4926, 4931, 4906, 4917, 4934, 4924, 4933,
-     4915, 4935, 4936, 4937, 4941, 4942, 4943, 4944, 4945, 4955,
-     4960, 4958, 7110, 4946, 7110, 4947, 4956, 4963, 4974, 4969,
-     4971, 4972, 4976, 4975, 7110, 4961, 4982, 4984, 4979, 4987,
-     7110, 4988, 4985, 4989, 4990, 7110, 5003, 4986, 4992, 4993,
-     5008, 5009, 7110, 5014, 5015, 5011, 5023, 5025, 5020, 5022,
-     5024, 5026, 5028, 5030, 5031, 5032, 5041, 5034, 5037, 7110,
-     5039, 5046, 5052, 5053, 5054, 5036, 5047, 5055, 5057, 5063,
-
-     5060, 7110, 5064, 5065, 5066, 5067, 5068, 5070, 5071, 5072,
-     5084, 5083, 5079, 5076, 5081, 5088, 5090, 5092, 5097, 7110,
-     5093, 5098, 5099, 5108, 5109, 5110, 5115, 7110, 5111, 7110,
-     5112, 5116, 5121, 5124, 5128, 7110, 5131, 5132, 5119, 5136,
-     7110, 7110, 5138, 5139, 5140, 5144, 5141, 7110, 7110, 5147,
-     7110, 5148, 7110, 5149, 5151, 7110, 7110, 5101, 5153, 5154,
-     5155, 5156, 5158, 7110, 5165, 7110, 5168, 5169, 5170, 5172,
-     5159, 5173, 7110, 5174, 5177, 5182, 5183, 5185, 7110, 5176,
-     5187, 5191, 5204, 5190, 5186, 7110, 5200, 5202, 5203, 5206,
-     7110, 5209, 5212, 5213, 5207, 5214, 5215, 5216, 5123, 5217,
-
-     5219, 5220, 5229, 5226, 5227, 5230, 5237, 5239, 5241, 5243,
-     5244, 5245, 5248, 5249, 5251, 5254, 5257, 5258, 5259, 5260,
-     5261, 5265, 5267, 5264, 5273, 5275, 5268, 5277, 5284, 5285,
-     5286, 5270, 5288, 5287, 5289, 5295, 5291, 5302, 5297, 5299,
-     5303, 5304, 5306, 5305, 5308, 5312, 5313, 5317, 5315, 5318,
-     7110, 5311, 5321, 5322, 5331, 5325, 5332, 5335, 5342, 5347,
-     5348, 7110, 5350, 7110, 5352, 5336, 5344, 5338, 5356, 7110,
-     5358, 5359, 5360, 5361, 5363, 5364, 5365, 5366, 5362, 5369,
-     5373, 7110, 5375, 5389, 5376, 5370, 5385, 5396, 7110, 5391,
-     5398, 5383, 5393, 5399, 5402, 5403, 5404, 5405, 5408, 5406,
-
-     5407, 5413, 5416, 5410, 5419, 5420, 7110, 5428, 5432, 5435,
-     5421, 5433, 5434, 5436, 5438, 5440, 5442, 5443, 5444, 5446,
-     5447, 5448, 5454, 5460, 5457, 5465, 5470, 7110, 5453, 7110,
-     5471, 5473, 5474, 5461, 5477, 5478, 5475, 5479, 7110, 7110,
-     5476, 5484, 5485, 5490, 5491, 5487, 5494, 5497, 5499, 5500,
-     7110, 5501, 5503, 5507, 5511, 5510, 5512, 7110, 5517, 5519,
-     5520, 5522, 7110, 5523, 5524, 5526, 5527, 5537, 5529, 5542,
-     5538, 5544, 5531, 5534, 5545, 5550, 7110, 7110, 7110, 7110,
-     5551, 5554, 5556, 5557, 5558, 5559, 5560, 5564, 5566, 5562,
-     5563, 5567, 7110, 5578, 7110, 7110, 5574, 7110, 5580, 5581,
-
-     5584, 5586, 5568, 5588, 5590, 7110, 5591, 7110, 5596, 5599,
-     5592, 5603, 5609, 5600, 5593, 5611, 5613, 5614, 5615, 5616,
-     5623, 5621, 5624, 5622, 5627, 5629, 5631, 7110, 7110, 5635,
-     5639, 5640, 5642, 5644, 5645, 5646, 5653, 5651, 5652, 5654,
-     5656, 5658, 5659, 5667, 5668, 5664, 5665, 5673, 7110, 5674,
-     5670, 5676, 7110, 5678, 7110, 5682, 5683, 5684, 5685, 5686,
-     5691, 5692, 5693, 5695, 5697, 7110, 7110, 5696, 5711, 5706,
-     7110, 7110, 5698, 5707, 5708, 5710, 5716, 5713, 5718, 7110,
-     5721, 5722, 5723, 5719, 5725, 5733, 5726, 7110, 5735, 7110,
-     5736, 5738, 5744, 5739, 5747, 5752, 5748, 5755, 5754, 5751,
-
-     5757, 5758, 7110, 5760, 5761, 7110, 5768, 5767, 5771, 5765,
-     5772, 5777, 5773, 7110, 5778, 5780, 5785, 5790, 7110, 5792,
-     5793, 5794, 5787, 7110, 5801, 7110, 5795, 5802, 5804, 5809,
-     5805, 7110, 5806, 5810, 7110, 5813, 5819, 5821, 5822, 5814,
-     5823, 7110, 5829, 5824, 7110, 5830, 5832, 5833, 5838, 5839,
-     5841, 5835, 5843, 5844, 5851, 5847, 5849, 7110, 7110, 5862,
-     5852,  135, 5865, 5855, 5860, 5863, 5866, 5873, 5868, 5870,
-     5876, 7110, 7110, 5877, 7110, 5871, 5881, 7110, 5869, 5885,
-     5886, 5889, 5890, 5891, 5892, 5896, 5898, 5899, 5900, 5901,
-     5902, 5908, 7110, 5920, 5923, 5905, 5926, 5927, 5929, 5931,
-
-     5933, 5935, 5937, 5938, 5939, 5918, 5940, 5941, 5942, 5945,
-     5947, 5948, 5949, 5951, 7110, 5958, 5963, 5952, 5960, 5965,
-     5966, 5967, 7110, 5974, 5970, 5979, 5976, 7110, 5983, 5980,
-     5984, 5986, 5987, 7110, 5988, 5991, 5998, 5999, 5992, 5994,
-     6000, 6002, 6004, 6015, 7110, 6005, 6007, 6008, 7110, 7110,
-     7110, 6020, 6022, 6019, 7110, 6027, 6023, 6010, 6028, 7110,
-     6030, 6031, 6032, 7110, 7110, 7110, 6034, 6036, 6038, 7110,
-     6042, 6045, 7110, 6043, 7110, 6048, 7110, 6049, 6051, 6052,
-     6057, 7110, 6058, 6060, 6050, 6067, 7110, 6075, 6077, 6079,
-     6061, 6065, 6072, 6081, 7110, 6088, 6084, 6087, 6094, 6080,
-
-     6083, 6090, 6096, 6097, 6105, 6100, 6103, 7110, 6104, 6107,
-     6109, 6116, 6110, 6106, 6113, 7110, 6118, 7110, 6120, 7110,
-     6122, 6123, 6124, 6126, 6131, 6127, 6132, 6133, 6134, 6142,
-     6144, 6146, 6147, 6148, 6150, 6153, 6154, 7110, 7110, 6164,
-     6156, 7110, 6160, 6168, 7110, 6157, 7110, 6172, 7110, 6159,
-     6161, 6176, 6169, 6179, 7110, 7110, 6183, 6180, 6186, 6193,
-     6188, 6190, 6191, 7110, 6196, 6192, 6194, 6199, 7110, 6207,
-     7110, 6202, 6209, 6212, 7110, 6204, 6215, 6219, 6205, 6208,
-     6224, 6216, 6221, 6225, 6235, 6231, 6232, 6233, 6237, 6234,
-     6238, 6239, 6246, 7110, 7110, 7110, 6240, 6248, 6257, 6255,
-
-     6256, 6264, 6260, 7110, 6261, 6263, 6265, 6267, 6275, 6271,
-     6273, 7110, 6279, 6274, 6276, 6277, 6281, 6283, 6282, 6284,
-     7110, 6295, 6297, 6300, 6303, 6304, 6305, 6307, 6312, 6314,
-     6316, 6309, 6317, 6325, 6321, 7110, 7110, 6324, 6320, 7110,
-     6328, 6330, 7110, 6331, 7110, 6332, 6333, 6334, 6335, 6337,
-     7110, 6340, 6341, 6342, 6344, 7110, 6345, 6347, 6349, 6352,
-     7110, 6346, 6366, 6359, 6362, 6363, 7110, 7110, 6369, 6371,
-     7110, 6373, 6375, 6374, 6382, 6377, 6378, 6384, 6387, 7110,
-     6391, 6393, 6385, 6394, 6396, 6397, 6400, 7110, 6399, 6402,
-     6403, 6404, 7110, 6408, 6411, 6412, 6410, 6413, 7110, 6415,
-
-     6416, 6425, 6417, 7110, 6428, 6432, 6433, 7110, 7110, 7110,
-     6438, 6440, 6441, 7110, 7110, 7110, 7110, 6443, 6444, 6434,
-     6451, 7110, 6447, 7110, 7110, 6455, 6459, 6463, 6465, 6469,
-     6468, 7110, 6470, 6471, 6474, 6458, 6477, 7110, 7110, 6478,
-     6481, 6482, 6483, 6485, 6486, 7110, 7110, 6487, 6489, 6490,
-     6495, 6492, 7110, 6493, 6498, 6500, 6505, 6508, 6516, 6518,
-     6510, 6519, 6520, 6527, 6528, 6513, 6530, 6523, 6531, 6534,
-     6533, 6541, 6543, 6542, 6547, 6550, 6551, 6553, 7110, 7110,
-     6555, 7110, 6557, 6559, 7110, 6560, 7110, 6562, 6564, 6570,
-     6572, 7110, 6574, 6576, 6580, 6582, 6565, 7110, 6577, 6584,
-
-     6588, 6585, 6589, 6590, 7110, 6593, 6595, 6597, 6598, 6599,
-     6603, 6604, 6607, 7110, 6602, 6609, 7110, 7110, 6600, 6616,
-     6611, 6620, 6622, 7110, 6623, 6630, 6625, 6627, 6628, 6631,
-     6629, 7110, 6635, 6633, 7110, 7110, 6634, 6636, 7110, 7110,
-     6643, 6644, 7110, 7110, 7110, 7110, 7110, 7110, 7110, 7110,
-     6648, 6652, 7110, 7110, 6646, 6657, 6661, 7110, 6663, 7110,
-     6650, 6658, 6666, 6654, 7110, 6665, 7110, 6668, 6671, 6672,
-     6285, 6675, 6680, 6676, 6678, 6683, 6684, 6685, 6687, 6686,
-     6692, 6688, 6694, 6698, 6699, 6706, 6696, 6707, 7110, 7110,
-     7110, 6708, 6709, 6714, 6711, 6724, 6725, 6728, 6731, 6717,
-
-     6719, 6732, 6733, 6737, 6721, 6734, 6747, 6740, 6743, 6745,
-     6752, 6744, 6757, 6759, 7110, 6761, 6748, 6753, 6766, 7110,
-     6762, 7110, 6767, 7110, 7110, 6769, 6770, 6773, 6774, 6782,
-     6784, 6775, 6779, 6780, 6783, 6787, 7110, 6791, 7110, 7110,
-     7110, 6794, 6796, 7110, 6795, 6797, 7110, 6798, 6800, 6802,
-     6804, 6806, 6803, 6807, 6808, 6811, 7110, 7110, 6814, 6820,
-     6823, 6825, 6826, 6833, 6828, 6830, 6832, 6836, 6839, 6846,
-     7110, 6844, 6845, 6848, 7110, 6849, 6851, 6852, 6854, 6855,
-     6862, 6857, 6864, 7110, 6860, 7110, 6866, 6863, 6878, 6867,
-     6868, 6869, 6879, 6884, 6881, 7110, 6871, 6890, 6885, 6892,
-
-     6895, 6898, 6899, 6888, 6901, 6905, 6909, 6913, 6908, 6914,
-     6916, 6917, 6918, 7110, 6920, 6923, 7110, 6924, 6925, 6926,
-     6927, 6931, 7110, 6934, 6928, 6936, 6938, 6941, 6943, 7110,
-     6949, 6952, 6953, 7110, 6954, 7110, 7110, 6956, 6944, 6957,
-     6965, 6967, 7110, 7110, 7110, 6990, 6997, 7004, 7011, 7018,
-     7025, 7032,   88, 7039, 7046, 7053, 7060, 7067, 7074, 7081,
-     7088, 7095, 7102
+       90,  112,   96,  118,  124,  136, 4433, 4347,   81, 7350,
+     7350, 7350,  129,   52,  137,   63,  130,  159,   70,  132,
+      134,  146,   57,   88,   76,  166,  177,   95,  199,  155,
+      187,  201,  210,  172,  156,  148, 4272, 7350, 7350, 7350,
+      107, 4232, 7350, 7350, 7350,  190, 3938, 3683, 7350, 7350,
+     7350,  239, 3467, 7350, 7350, 7350,  203, 3285, 7350,  243,
+     7350,  247,  212, 2761, 2193, 7350, 7350, 7350,  251, 1857,
+     7350, 7350, 7350,  228, 1817,  257,  261,    0,  264,    0,
+        0,  258,  262,  260,  195,  170,  251,  265,  269,   92,
+
+      270,  259,  275,  276,  277,  278,  288,  284,  286,  283,
+      293,  179,  290,  292,  302,  306,  307,  310,  315,  314,
+      318,  317,  325,  327,  328,  319,  335,  331,  336,  139,
+      337,  342,  347,  350,  351,  353,  339,  360,  352,  363,
+      356,  364,  366,  370,  374,  383,  379,  380,  389,  378,
+      392,  225,  393,  395,  400,  399,  402,  403,  405,  408,
+     1704,  425, 1563,  427, 1366,  435, 1178, 1061,  439, 1021,
+      443,  447,    0,  424,  923,  451,  831,  375,  455,  443,
+      455,  432,  451,  452,  453,  454,  215,  457,  456,  458,
+      459,  462,  460,  480,  467,  472,  482,  419,  486,  487,
+
+      493,  478,  503,  485,  495,  505,  499,  498,  515,  512,
+      514,  513,  517,  520,  521,  470,  522,  523,  539,  525,
+      524,  526,  547,  548,  552,  556,  534,  561,  566,  532,
+      568,  564,  565,  573,  570,  577,  576,  585,  580,  581,
+      572,  582,  584,  586,  590,  589,  591,  594,  599,  595,
+      600,  613,  604,  601,  617,  605,  622,  615,  618,  630,
+      608,  626,  623,  632,  635,  643,  644,  636,  645,  640,
+      537,  646,  649,  656,  659,  658,  641,  657,  654,  661,
+      663,  665,  667,  668,  670,  679,  682,  678,  681,  690,
+      687,  689,  688,  692,  693,  696,  669,  705,  695,  708,
+
+      711,  700,  709,  713,  715,  717,  719,  718,  722,  723,
+      728,  724, 7350,  731,  730,  735,  736,  745,  742,  740,
+      747,  754,  755,  750,  751,  756,  753,  757,  759,  760,
+      761,  764,  767,  771,  768,  773,  775,  788,  781,  779,
+      794,  780,  790,  792,  815,  795,  796,  804,  799,  823,
+      810,  821,  826,  827,  828,  830,  831,  829,  837,  840,
+      800,  841,  850,  835,  852,  853,  854,  855,  856,  857,
+      865,  861, 7350,  863,  870,  877,  879,  881,  882,  888,
+      895,  890,  869,  896,  900,  899,  903,  912,  934,  904,
+      907,  901,  905,  917, 7350,  919,  918,  958,  914,  927,
+
+      945,  941,  942,  940,  949,  943,  946,  962,  948,  967,
+      968,  969,  981,  979,  976,  978,  980,  982,  986,  989,
+     1000, 1005,  990,  997,  999, 1007,  926,  992, 1011, 1017,
+     1003, 1012, 1018, 1019, 1022, 1024, 1020, 1027, 1033, 1038,
+     1039, 1031, 1028, 1044, 1041, 1048, 1045, 1068, 1052, 1049,
+     1051, 1066, 1055, 1069, 1071, 1072, 1075, 1074, 1083, 1076,
+     1090, 1080, 1095, 1097, 1087, 1098, 1107, 1104, 1103, 1084,
+     1106, 1109, 1112, 1110, 1115, 1116, 1117, 1120, 1119, 1125,
+     1126, 1124, 1127, 1132, 1136, 1137, 1142, 1138, 7350, 1150,
+     1145, 7350, 1147, 1148, 1149, 1152, 1151, 1154, 1153, 1155,
+
+     7350, 1157, 1162, 1163, 1171, 1164, 1182, 1179, 1187, 1169,
+     1184, 1185, 1186, 1190, 1191, 1192, 1200, 1195, 1199, 1203,
+     1205, 1207, 1208, 1210, 1209, 1211, 1217, 1214, 1218, 1216,
+     1220, 1224, 1240, 7350, 1225, 1226, 1227, 1234, 1233, 1244,
+     1235, 1253, 1258, 1250, 1264, 1255, 1261, 1268, 1272, 1275,
+     1276,  868, 1277, 1280, 1278, 1282, 1284, 1286, 1285, 1292,
+     1288, 1290, 1296, 1295, 1294, 1302, 1305, 7350, 1306, 1310,
+     1316, 1324, 1309, 1308, 1319, 1322, 1331, 1326, 1327, 1328,
+     1329, 1333, 1330, 1339, 1344, 1340, 1337, 1352, 1356, 1348,
+     1355, 1351, 1353, 1357, 1361, 1363, 1359, 1377, 1367, 1370,
+
+     1374, 1383, 1384, 1386, 1388, 1395, 1397, 1390, 1392, 1393,
+     1398, 1394, 1400, 1402, 1403, 1404, 1407, 1412, 1411, 1420,
+     1416, 1417, 1422, 1418, 1424, 1425, 1427, 1428, 1429, 1432,
+     1437, 1435, 1439, 1441, 1443, 1456, 1444, 1447, 1445, 1450,
+     1460, 1469, 1458, 1461, 7350, 1477, 1470, 1475, 1480, 1481,
+     1482, 1483, 1473, 1487, 1236, 1490, 1491, 1492, 1494, 1495,
+     1497, 1502, 1498, 1499, 1501, 1500, 1508, 1521, 1518, 1511,
+     1525, 1510, 1527, 1528, 1529, 1531, 1532, 1534, 1535, 1542,
+     1538, 1550, 1537, 1541, 1548, 1549, 1557, 1555, 1558, 1559,
+     1567, 1562, 1560, 1570, 1552, 1573, 1576, 1577, 1582, 1586,
+
+     1587, 1588, 1595, 1590, 1592, 1452, 1596, 1602, 1597, 1598,
+     1601, 1605, 1606, 1607, 1614, 1609, 1611, 1621, 1622, 1610,
+     1612, 1626, 1624, 1640, 1630, 1632, 1633, 1635, 1641, 1642,
+     1643, 1648, 1644, 1649, 1651, 1652, 1653, 1658, 1659, 1655,
+     1664, 1665, 1657, 1674, 1675, 1677, 1678, 1680, 1683, 1681,
+     1686, 1690, 1684, 1687, 1693, 1695, 1700, 1701, 1702, 1703,
+     1705, 1715, 1706, 1718, 1719, 1714, 1720, 1722, 1724, 1725,
+     1726, 1731, 1732, 1735, 1738, 1736, 7350, 1740, 1748, 1744,
+     1746, 1749, 1750, 1751, 1752, 1760, 1756, 1758, 1755, 1757,
+     1761, 1783, 7350, 1769, 7350, 7350, 1771, 1772, 7350, 7350,
+
+     1777, 1774, 7350, 1775, 1787, 1790, 1778, 1796, 1806, 1808,
+     1801, 1798, 1804, 1791, 1819, 1820, 1810, 1823, 1814, 1815,
+     1825, 1826, 1836, 1837, 1834, 1843, 1831, 1844, 1849, 1860,
+     1851, 1861, 1855, 1863, 1864, 1866, 1872, 1873, 1877, 1845,
+     1767, 1867, 1879, 1874, 1880, 1881, 1884, 1882, 1887, 1890,
+     1888, 1892, 1893, 1902, 1895, 1908, 1911, 7350, 1898, 1918,
+     1909, 1913, 1914, 1922, 1919, 1923, 1925, 1920, 1921, 1931,
+     1936, 1933, 1937, 1938, 1939, 1942, 1940, 1941, 1948, 1943,
+     1950, 1952, 1955, 1954, 1966, 1957, 1958, 7350, 1965, 1967,
+     1968, 1973, 1970, 1969, 1980, 1981, 1971, 1982, 1984, 1989,
+
+     1986, 1993, 1987, 1990, 1998, 1999, 2001, 2003, 7350, 2008,
+     2005, 2011, 2012, 2013, 2015, 2016, 2018, 2021, 2022, 2024,
+     2025, 2026, 2027, 2028, 2035, 2031, 2037, 2039, 2041, 2044,
+     2046, 2051, 2050, 2056, 2054, 2057, 2062, 2063, 2065, 2066,
+     2067, 2068, 2069, 2071, 2073, 2081, 2083, 2070, 2086, 2078,
+     2079, 2095, 2100, 2097, 2096, 2098, 2102, 2103, 2104, 2112,
+     2114, 2113, 2109, 2117, 2125, 2111, 2121, 2122, 2123, 2126,
+     2138, 2133, 2135, 2145, 2134, 2141, 2136, 2147, 2143, 7350,
+     2149, 2150, 7350, 2153, 2154, 2155, 2177, 2158, 2159, 2165,
+     2157, 2168, 2170, 2171, 2179, 2178, 2184, 2183, 2191, 2187,
+
+     2199, 2200, 2202, 2203, 2207, 2201, 2209, 2211, 2205, 2214,
+     2212, 2215, 2224, 2222, 2231, 2235, 2233, 2239, 2242, 2237,
+     2238, 2240, 2260, 2241, 2243, 2249, 2244, 2245, 2247, 2254,
+     2250, 2251, 2255, 2265, 2270, 2271, 2278, 2276, 2273, 2275,
+     2282, 2277, 2283, 2291, 2288, 2294, 7350, 2302, 2297, 2299,
+     2303, 2304, 2311, 2307, 2306, 7350, 2310, 2313, 2315, 2326,
+     2321, 2309, 2324, 2316, 2323, 2327, 2332, 2333, 2334, 2335,
+     2338, 2345, 7350, 2340, 7350, 2346, 2348, 2349, 2352, 2359,
+     2350, 2351, 2354, 2358, 2361, 2362, 7350, 7350, 2370, 2371,
+     2377, 2363, 2384, 2385, 2380, 2381, 2382, 7350, 2383, 2393,
+
+     7350, 2390, 2388, 2397, 2398, 2401, 2402, 2404, 2406, 2405,
+     2413, 2408, 2415, 2410, 2411, 2417, 7350, 2423, 2426, 2414,
+     2427, 2433, 2430, 2434, 2436, 2437, 2439, 7350, 2444, 2440,
+     2447, 2445, 2454, 2458, 2452, 2449, 2459, 2463, 2455, 2460,
+     2465, 2468, 2469, 2476, 2478, 2480, 2481, 2483, 2490, 2487,
+     2495, 7350, 2491, 2475, 2477, 2500, 2498, 2502, 2499, 2504,
+     2505, 2506, 2507, 2509, 2511, 2516, 2515, 2517, 2518, 2519,
+     2528, 2529, 2521, 2532, 2534, 2525, 2531, 2539, 2540, 2546,
+     2541, 2543, 2547, 2548, 7350, 2549, 2554, 2555, 2556, 2557,
+     2550,  280, 2560, 2564, 2565, 2567, 2569, 2571, 2576, 2580,
+
+     2587, 2588, 2583, 2584, 2590, 2591, 2593, 2594, 2597, 2595,
+     2585, 2598, 2605, 2603, 2606, 7350, 2614, 2609, 2611, 2615,
+     2616, 2617, 2619, 7350, 2627, 2620, 2634, 2641, 2636, 2628,
+     2644, 2626, 2632, 2646, 7350, 2648, 2649, 2651, 2658, 2654,
+     2656, 2660, 2657, 7350, 2662, 2664, 2667, 2665, 2673, 2675,
+     2674, 2666, 2677, 2680, 2684, 2682, 2686, 2688, 2689, 2690,
+     2691, 2695, 2698, 2694, 2710, 2702, 2703, 2706, 2712, 2707,
+     2716, 2714, 2717, 2719, 2724, 2720, 7350, 2731, 2721, 2729,
+     2730, 2732, 2735, 2739, 2737, 2747, 2745, 2748, 2750, 2753,
+     2765, 2755, 2758, 2775, 2756, 2771, 2772, 2783, 2780, 2782,
+
+     2759, 2779, 2789, 2791, 2786, 2792, 2799, 2801, 2802, 2798,
+     2797, 2803, 2804, 2809, 2819, 2814, 2821, 2811, 2822, 2812,
+     2823, 2824, 2828, 2830, 2836, 2835, 7350, 2840, 2838, 2845,
+     2848, 2847, 2855, 2850, 2851, 2852, 2858, 2860, 2861, 2862,
+     2863, 2870, 2867, 2871, 2874, 2875, 2879, 2876, 2878, 2885,
+     2886, 2888, 2891, 2894, 2895, 2898, 2900, 2899, 7350, 2903,
+     2902, 2908, 2909, 2912, 2914, 2916, 2919, 2917, 2921, 2923,
+     2924, 2926, 2928, 2929, 2930, 2931, 2938, 2935, 2941, 2937,
+     2936, 7350, 2949, 2943, 2947, 2956, 2953, 2957, 2955, 2959,
+     2965, 2966, 2969, 2972, 2973, 2974, 2975, 2976, 7350, 2984,
+
+     2985, 2981, 2983, 2993, 2990, 2992, 2994, 2996, 2997, 7350,
+     2998, 3000, 3002, 3001, 3004, 3006, 3013, 3014, 3009, 3010,
+     7350, 3025, 3020, 3022, 3023, 3026, 3027, 3028, 3030, 3032,
+     3033, 3035, 3039, 3036, 3048, 3037, 3045, 7350, 3049, 3057,
+     3055, 3061, 3059, 3062, 3063, 3064, 3066, 3072, 3075, 3069,
+     7350, 3086, 3084, 3085, 3093, 3089, 3065, 3094, 3090, 3097,
+     3098, 3099, 3100, 3101, 3104, 7350, 3105, 3107, 3109, 3110,
+     3114, 3113, 3115, 3122, 3121, 3123, 3126, 3128, 3129, 3132,
+     3130, 3135, 3136, 3141, 3137, 3138, 3148, 3150, 3153, 3151,
+     3156, 3157, 3160, 3164, 3168, 3167, 3170, 3173, 3174, 3163,
+
+     3175, 3178, 3182, 3190, 3191, 3186, 3188, 7350, 3193, 3194,
+     3195, 3197, 3199, 3200, 3201, 3202, 3205, 3203, 3212, 3213,
+     3207, 3217, 3225, 3228, 3226, 3229, 3231, 3232, 3233, 3234,
+     3235, 3237, 3238, 3247, 3240, 3243, 3244, 3248, 3249, 3258,
+     3253, 3259, 3266, 3255, 3262, 3267, 3268, 3269, 3270, 3276,
+     3273, 3277, 3278, 3280, 3281, 3282, 3284, 3298, 3303, 3299,
+     3291, 3293, 3305, 3307, 3308, 3309, 7350, 3312, 3313, 3310,
+     3314, 3317, 3323, 3319, 3332, 3327, 3331, 3335, 3336, 3339,
+     3345, 3337, 3338, 3346, 3340, 3353, 3351, 7350, 3348, 7350,
+     3358, 3354, 3359, 3361, 3369, 3365, 7350, 3368, 7350, 3370,
+
+     3372, 3374, 3376, 3377, 7350, 3378, 3379, 3382, 3380, 3383,
+     3386, 3384, 3388, 3391, 3396, 3394, 3404, 3405, 3407, 3395,
+     3397, 3411, 3414, 3417, 3415, 3419, 3420, 3423, 3422, 3424,
+     3426, 3430, 3427, 3432, 3433, 3435, 3440, 3442, 7350, 3453,
+     3445, 3441, 3450, 3456, 3443, 3457, 3458, 3460, 3462, 3464,
+     3465, 3463, 3469, 3470, 3476, 3479, 3480, 3481, 3482, 3486,
+     3498, 3483, 3499, 3495, 7350, 3494, 3497, 3502, 3504, 7350,
+     3506, 3505, 3512, 3514, 3509, 3507, 3516, 3517, 3518, 3522,
+     3524, 3526, 3527, 3534, 3532, 3535, 7350, 3539, 3542, 3541,
+     3549, 3544, 3550, 3557, 3559, 3555, 3561, 3563, 3571, 3567,
+
+     3556, 3558, 3568, 3570, 3575, 3579, 3583, 3586, 3584, 3588,
+     3581, 3591, 3593, 3594, 3585, 3595, 3597, 3598, 3600, 3602,
+     3605, 3607, 3606, 3601, 3609, 3608, 3611, 3618, 7350, 3622,
+     3623, 3614, 3637, 3628, 3629, 3632, 3633, 3636, 3640, 3642,
+     7350, 3644, 3638, 3649, 3650, 3655, 3646, 3653, 3659, 3660,
+     3663, 3664, 3666, 3665, 3668, 7350, 3670, 7350, 3669, 3686,
+     3676, 3681, 3687, 3682, 3688, 3693, 3695, 3696, 3697, 3698,
+     3701, 3705, 3706, 3709, 3707, 3710, 3712, 3713, 3714, 3718,
+     3730, 3717, 3729, 3720, 3721, 3732, 3733, 3735, 3743, 3739,
+     3741, 7350, 7350, 3745, 3746, 3748, 3752, 3756, 3754, 3757,
+
+     3759, 3766, 3768, 3761, 3765, 3767, 3777, 7350, 3769, 3780,
+     3781, 3782, 3784, 3794, 3789, 3791, 3799, 3792, 3796, 3806,
+     3802, 7350, 3801, 3804, 3805, 3815, 3812, 3811, 3822, 7350,
+     3818, 7350, 3813, 3817, 3823, 3827, 3828, 3829, 3830, 3831,
+     3834, 3837, 3839, 3845, 3852, 3854, 3855, 3849, 3857, 3841,
+     3850, 3859, 3864, 3860, 3871, 3867, 3869, 3870, 7350, 3875,
+     3872, 3876, 3877, 3879, 3881, 3890, 3884, 3883, 7350, 3887,
+     3891, 3894, 3896, 3901, 3903, 3904, 3905, 3907, 3910, 3913,
+     3911, 3912, 3915, 3920, 7350, 3914, 3921, 3928, 3924, 3929,
+     3931, 3935, 3939, 3930, 3944, 7350, 3940, 3946, 3954, 3952,
+
+     3949, 3956, 3957, 3953, 3959, 3962, 3964, 3963, 3965, 3966,
+     3967, 3969, 3971, 3974, 3972, 3985, 3986, 3978, 3988, 3995,
+     3977, 7350, 3994, 3999, 4000, 4001, 4002, 4003, 4007, 4008,
+     4012, 4014, 4004, 4016, 4025, 4006, 4020, 4028, 4030, 4031,
+     4038, 4033, 7350, 4040, 4037, 4045, 4042, 4043, 4044, 4047,
+     4052, 4046, 4053, 4057, 4059, 4054, 4062, 4063, 4060, 4071,
+     4070, 4072, 4073, 4077, 4078, 4087, 4079, 4080, 4082, 4083,
+     7350, 4102, 4090, 4092, 4103, 4097, 4094, 4112, 4110, 4111,
+     4113, 4115, 4116, 4117, 4120, 4121, 4122, 4125, 4126, 7350,
+     7350, 4128, 4129, 4130, 7350, 4132, 4135, 4144, 4133, 4137,
+
+     4136, 4148, 4145, 4149, 4151, 4159, 4155, 4160, 4163, 4157,
+     4169, 7350, 4171, 4167, 4176, 4173, 4175, 4180, 4177, 7350,
+     4178, 4190, 4187, 4189, 4191, 4188, 4192, 4195, 4196, 4198,
+     4201, 4202, 4205, 4206, 4215, 4217, 4208, 4218, 4219, 7350,
+     4216, 4213, 4221, 4225, 4222, 4229, 4227, 7350, 4230, 4234,
+     4240, 4237, 4244, 4251, 4245, 4252, 4247, 4260, 4255, 4257,
+     4261, 4262, 4264, 4265, 4266, 4274, 4269, 4273, 4270, 4277,
+     4279, 4281, 4289, 7350, 4283, 4291, 4294, 4295, 4297, 7350,
+     4299, 4309, 4310, 7350, 4311, 4301, 4312, 4306, 4319, 7350,
+     4316, 4320, 4321, 4322, 4315, 4331, 4326, 4335, 4337, 4330,
+
+     4332, 4334, 4338, 7350, 4341, 4342, 4346, 7350, 4344, 4354,
+     4355, 4359, 4363, 4345, 4366, 4364, 4367, 4368, 4369, 7350,
+     4371, 4380, 7350, 4381, 4373, 4382, 7350, 4375, 4377, 4386,
+     4393, 4388, 4390, 4394, 4398, 4403, 4396, 4400, 4404, 4405,
+     4406, 4407, 4414, 4411, 4417, 4413, 4418, 7350, 4427, 4415,
+     4421, 4425, 4420, 4435, 4437, 4438, 4423, 4442, 4441, 7350,
+     7350, 4449, 7350, 4452, 4443, 4445, 4451, 7350, 4453, 4456,
+     4463, 4458, 4464, 4460, 4466, 4469, 4472, 4473, 7350, 4477,
+     4478, 7350, 4474, 4482, 4489, 4484, 4485, 4486, 4490, 4493,
+     4495, 4491, 4499, 4501, 4500, 4502, 4503, 4507, 4505, 4523,
+
+     4509, 4524, 7350, 4518, 4519, 4521, 4535, 4528, 4525, 4536,
+     4544, 4531, 7350, 4547, 4548, 4537, 4553, 4554, 7350, 4556,
+     7350, 4541, 4557, 4560, 4562, 4563, 4567, 4574, 4569, 7350,
+     4571, 4570, 4576, 4577, 4578, 4579, 7350, 4580, 4586, 4588,
+     4590, 4592, 4599, 4595, 4594, 4597, 4602, 4605, 7350, 4598,
+     4604, 4610, 4615, 4619, 4616, 4611, 4621, 4629, 4625, 4631,
+     4624, 4628, 4635, 4637, 4638, 4645, 4643, 4648, 4632, 7350,
+     4647, 4654, 4655, 4640, 4665, 4656, 4658, 4660, 7350, 4662,
+     4669, 4671, 4673, 7350, 4670, 4674, 4677, 4680, 4684, 4685,
+     4687, 4688, 4689, 4692, 4693, 4690, 7350, 4697, 4698, 4691,
+
+     4696, 4707, 4713, 4699, 7350, 7350, 4715, 7350, 4718, 4700,
+     4716, 4719, 4720, 4726, 4728, 4729, 4733, 4725, 4730, 4736,
+     4739, 4741, 7350, 4742, 4752, 4747, 4756, 4757, 4759, 4760,
+     7350, 4758, 4748, 7350, 7350, 4765, 4770, 4767, 4773, 4774,
+     4777, 4762, 7350, 4784, 4781, 4782, 4788, 4790, 4797, 7350,
+     4794, 4779, 4800, 4792, 7350, 4793, 4801, 4802, 4805, 4803,
+     4809, 4807, 4810, 4811, 4813, 4815, 4817, 4819, 4824, 4822,
+     4826, 4828, 4831, 4832, 4833, 4836, 4837, 4842, 7350, 4839,
+     4844, 4845, 4848, 4850, 4853, 4856, 4857, 4854, 4858, 4865,
+     4868, 7350, 4861, 7350, 4869, 4860, 4880, 4870, 4871, 4884,
+
+     4885, 4889, 4881, 4887, 4888, 4893, 4895, 4898, 4899, 4904,
+     4900, 4905, 4908, 4909, 7350, 4917, 4918, 4907, 4923, 4925,
+     4927, 4929, 4930, 7350, 4931, 4912, 4933, 4938, 4940, 4942,
+     4943, 4945, 4946, 4948, 4951, 4949, 4956, 4958, 4959, 4952,
+     4967, 4960, 4970, 4965, 4963, 7350, 4971, 4975, 4972, 4981,
+     4978, 4983, 4984, 4986, 4992, 4995, 4985, 4987, 4997, 7350,
+     4998, 5000, 5006, 5007, 7350, 5003, 5009, 5010, 5011, 5012,
+     5015, 5017, 5020, 5022, 5027, 7350, 5030, 5018, 5032, 5021,
+     5031, 5034, 5040, 5041, 5043, 5045, 5046, 5050, 7350, 5057,
+     5047, 5056, 5058, 5060, 5062, 5064, 5069, 5066, 5071, 5072,
+
+     7350, 5073, 5074, 5080, 5081, 5088, 5089, 5084, 5086, 5097,
+     5094, 5095, 5092, 5093, 5104, 5102, 5103, 5109, 5110, 5111,
+     5113, 5114, 5121, 5124, 7350, 5116, 7350, 5123, 5125, 5129,
+     5132, 5137, 5131, 5141, 5139, 5133, 7350, 5135, 5145, 5148,
+     5149, 5150, 7350, 5154, 5152, 5156, 5157, 7350, 5160, 5162,
+     5158, 5165, 5173, 5174, 7350, 5180, 5181, 5182, 5176, 5189,
+     5185, 5191, 5186, 5192, 5195, 5188, 5196, 5197, 5205, 5203,
+     5201, 7350, 5204, 5209, 5211, 5213, 5214, 5216, 5220, 5221,
+     5222, 5224, 5227, 7350, 5228, 5230, 5231, 5232, 5234, 5235,
+     5236, 5237, 5244, 5243, 5245, 5253, 5247, 5255, 5257, 5258,
+
+     5259, 5261, 7350, 5266, 5267, 5264, 5268, 5277, 5273, 5270,
+     7350, 5275, 7350, 5279, 5282, 5285, 5287, 5288, 7350, 5291,
+     5292, 5295, 5297, 5299, 7350, 7350, 5301, 5308, 5303, 5310,
+     5304, 7350, 7350, 5312, 7350, 5306, 7350, 5314, 5316, 7350,
+     7350, 5317, 5318, 5319, 5320, 7350, 5321, 5325, 5334, 7350,
+     5336, 7350, 5345, 5327, 5342, 5338, 5329, 5348, 7350, 5331,
+     5346, 5340, 5355, 5357, 7350, 5358, 5359, 5360, 5369, 5361,
+     5362, 7350, 5365, 5370, 5371, 5372, 5375, 7350, 5380, 5383,
+     5384, 5376, 5378, 5385, 5395, 5386, 5396, 5397, 5401, 5399,
+     5402, 5403, 5407, 5406, 5409, 5415, 5417, 5419, 5408, 5425,
+
+     5421, 5426, 5428, 5432, 5434, 5430, 5436, 5437, 5438, 5440,
+     5441, 5444, 5445, 5447, 5451, 5448, 5453, 5454, 5455, 5460,
+     5463, 5465, 5467, 5468, 5474, 5469, 5476, 5471, 5479, 5477,
+     5480, 5481, 5484, 5489, 5482, 5485, 5492, 5493, 5496, 7350,
+     5498, 5500, 5502, 5507, 5503, 5509, 5513, 5520, 5524, 5526,
+     7350, 5528, 7350, 5530, 5515, 5521, 5534, 5535, 7350, 5536,
+     5537, 5538, 5539, 5540, 5541, 5542, 5543, 5546, 5547, 5551,
+     7350, 5554, 5567, 5548, 5557, 5568, 5570, 7350, 5571, 5573,
+     5574, 5575, 5576, 5505, 5581, 5582, 5583, 5586, 5578, 5584,
+     5591, 5590, 5604, 5585, 5595, 5606, 7350, 5608, 5610, 5617,
+
+     5614, 5615, 5616, 5599, 5620, 5619, 5622, 5623, 5625, 5626,
+     5627, 5628, 5629, 5630, 5640, 5637, 5648, 5652, 7350, 5641,
+     7350, 5644, 5647, 5655, 5654, 5656, 5657, 5658, 5659, 5662,
+     7350, 7350, 5664, 5665, 5668, 5670, 5672, 5673, 5676, 5678,
+     5680, 5682, 7350, 5685, 5688, 5690, 5693, 5699, 5692, 7350,
+     5694, 5701, 5704, 5702, 5706, 5708, 7350, 5712, 5711, 5713,
+     5714, 5719, 5716, 5728, 5725, 5722, 5729, 5732, 5733, 5737,
+     7350, 5734, 7350, 7350, 7350, 5738, 5740, 5741, 5743, 5746,
+     5747, 5748, 5756, 5757, 5758, 5751, 5752, 5754, 7350, 5771,
+     7350, 7350, 5768, 7350, 5774, 5762, 5775, 5777, 5764, 5778,
+
+     5781, 7350, 5782, 7350, 5786, 5788, 5784, 5795, 5801, 5798,
+     5790, 5805, 5806, 5802, 5792, 5796, 5817, 5815, 5818, 5808,
+     5816, 5825, 5827, 7350, 7350, 5822, 5829, 5830, 5837, 5834,
+     5838, 5832, 5847, 5840, 5845, 5842, 5848, 5849, 5852, 5859,
+     5860, 5856, 5855, 5865, 7350, 5862, 5866, 5872, 7350, 5858,
+     7350, 5874, 5876, 5877, 5868, 5878, 5880, 5883, 5884, 5887,
+     5890, 5888, 7350, 7350, 5895, 5903, 5898, 7350, 7350, 5899,
+     5900, 5901, 5905, 5907, 5902, 5908, 7350, 5910, 5914, 5911,
+     5915, 5916, 5917, 5929, 5922, 7350, 5931, 7350, 5933, 5934,
+     5936, 5926, 5943, 5945, 5940, 5942, 5950, 5948, 5949, 5952,
+
+     5956, 7350, 5954, 5955, 7350, 5964, 5962, 5966, 5967, 5969,
+     5972, 5973, 7350, 5974, 5976, 5979, 5980, 5982, 5987, 7350,
+     5990, 5991, 5992, 5984, 7350, 5999, 7350, 5996, 6000, 6001,
+     6008, 6006, 7350, 6004, 6009, 6010, 6011, 7350, 6015, 6020,
+     6022, 6023, 6025, 6027, 7350, 6032, 6017, 7350, 6028, 6034,
+     6036, 6042, 6039, 6044, 6045, 6046, 6047, 6055, 6051, 6052,
+     7350, 7350, 6059, 6057,  123, 6066, 6063, 6067, 6068, 6069,
+     6076, 6071, 6073, 6079, 7350, 7350, 6080, 7350, 6074, 6081,
+     7350, 6072, 6089, 6090, 6083, 6093, 6094, 6095, 6099, 6103,
+     6104, 6105, 6106, 6107, 6109, 7350, 6125, 6128, 6110, 6131,
+
+     6132, 6134, 6136, 6138, 6140, 6142, 6143, 6144, 6121, 6114,
+     6145, 6146, 6149, 6150, 6152, 6153, 6154, 6156, 7350, 6163,
+     6166, 6157, 6167, 6170, 6171, 6175, 6172, 7350, 6179, 6181,
+     6184, 6186, 7350, 6193, 6185, 6187, 6198, 6195, 6199, 7350,
+     6189, 6201, 6203, 6205, 6206, 6210, 6211, 6212, 6213, 6220,
+     7350, 6217, 6216, 6224, 7350, 6221, 7350, 7350, 7350, 6218,
+     6232, 6226, 7350, 6235, 6237, 6238, 6239, 7350, 6242, 6244,
+     6245, 6252, 6247, 7350, 7350, 7350, 6248, 6250, 6249, 7350,
+     6256, 6266, 7350, 6253, 7350, 6261, 7350, 6262, 6264, 6270,
+     6268, 7350, 6274, 6272, 6275, 6280, 7350, 6287, 6291, 6293,
+
+     6288, 6278, 6283, 6294, 7350, 6301, 6300, 6303, 6307, 6296,
+     6304, 6309, 6310, 6311, 6318, 6313, 6320, 7350, 6317, 6322,
+     6323, 6324, 6326, 6331, 6332, 7350, 6333, 7350, 6335, 7350,
+     6336, 6337, 6339, 6340, 6342, 6341, 6343, 6348, 6354, 6355,
+     6358, 6360, 6363, 6364, 6365, 6367, 6369, 6370, 7350, 7350,
+     6377, 6373, 7350, 6374, 6384, 6386, 7350, 6379, 7350, 6393,
+     7350, 6381, 6388, 7350, 6390, 6394, 6396, 7350, 7350, 6399,
+     6402, 6403, 6411, 6406, 6408, 6409, 7350, 6413, 6416, 6415,
+     6417, 6419, 7350, 6426, 7350, 6421, 6431, 6427, 7350, 7350,
+     6423, 6424, 6437, 6439, 6433, 6440, 6443, 6444, 6447, 6446,
+
+     6457, 6449, 6452, 6453, 6459, 6454, 6467, 6471, 6475, 7350,
+     7350, 7350, 6465, 6461, 6478, 6480, 6482, 6489, 6484, 7350,
+     6486, 6488, 6490, 6492, 6499, 6496, 6498, 7350, 6494, 6500,
+     6501, 6503, 6505, 6508, 6507, 6510, 7350, 6521, 6525, 6529,
+     6512, 6522, 6530, 6532, 6534, 6538, 6539, 6541, 6542, 6543,
+     6515, 6544, 7350, 7350, 6546, 6547, 7350, 6551, 6553, 7350,
+     7350, 6554, 7350, 6556, 6557, 6558, 6559, 6560, 7350, 6565,
+     6562, 6566, 6568, 7350, 6567, 6571, 6575, 6584, 6572, 7350,
+     6586, 6595, 6570, 6591, 6592, 6593, 7350, 7350, 6594, 6600,
+     7350, 6602, 6603, 6605, 6612, 6609, 6614, 6617, 6613, 7350,
+
+     6607, 6620, 6623, 6624, 6626, 6627, 6628, 7350, 6629, 6630,
+     6632, 6633, 7350, 6636, 6635, 6638, 6640, 6641, 7350, 6642,
+     6645, 6663, 6659, 7350, 6648, 6666, 6658, 7350, 7350, 7350,
+     6673, 6675, 6676, 7350, 7350, 7350, 6662, 7350, 6679, 6681,
+     6670, 6683, 7350, 6684, 7350, 7350, 6688, 6693, 6697, 6701,
+     6705, 6692, 7350, 6704, 6698, 6711, 6667, 6706, 7350, 7350,
+     6713, 6714, 6708, 6716, 6717, 6719, 6721, 6723, 7350, 7350,
+     6724, 6725, 6726, 6729, 6727, 7350, 6733, 6735, 6745, 6737,
+     6747, 6753, 6755, 6741, 6757, 6758, 6765, 6766, 6750, 6761,
+     6763, 6768, 6769, 6771, 6778, 6785, 6780, 6782, 6788, 6783,
+
+     6789, 7350, 7350, 6792, 6793, 7350, 6796, 6797, 7350, 6799,
+     7350, 6801, 6803, 6805, 6809, 7350, 6811, 6813, 6815, 6819,
+     6816, 7350, 6820, 6822, 7350, 6824, 6825, 6826, 6827, 7350,
+     6828, 6831, 6832, 6836, 6833, 6837, 6840, 6844, 6854, 7350,
+     6841, 6858, 7350, 7350, 6846, 6731, 6839, 6859, 6849, 7350,
+     6863, 6861, 6862, 6868, 6869, 6871, 6870, 7350, 6872, 6874,
+     7350, 7350, 6875, 6877, 7350, 6880, 7350, 6882, 6884, 7350,
+     7350, 7350, 7350, 7350, 7350, 7350, 7350, 6885, 6891, 7350,
+     7350, 6887, 6896, 6898, 6902, 7350, 6906, 7350, 6893, 6903,
+     6907, 6899, 7350, 6909, 7350, 6910, 6913, 6915, 6925, 6914,
+
+     6917, 6921, 6922, 6926, 6930, 6928, 6932, 6931, 6936, 6937,
+     6935, 6938, 6949, 6939, 6952, 6943, 6955, 7350, 7350, 7350,
+     7350, 6945, 6957, 6962, 6964, 6966, 6967, 6970, 6972, 6974,
+     6975, 6976, 6978, 6980, 6981, 6982, 6990, 6986, 6987, 6989,
+     6992, 6988, 7002, 7004, 7010, 7350, 7012, 6998, 6996, 7017,
+     7350, 7005, 7350, 7007, 7350, 7350, 7019, 7021, 7023, 7014,
+     7030, 7032, 7027, 7029, 7028, 7034, 7036, 7350, 7038, 7350,
+     7350, 7350, 7350, 7040, 7043, 7350, 7044, 7045, 7350, 7046,
+     7048, 7050, 7051, 7052, 7054, 7055, 7057, 7068, 7350, 7350,
+     7056, 7059, 7070, 7072, 7074, 7081, 7082, 7080, 7086, 7087,
+
+     7078, 7090, 7350, 7094, 7095, 7099, 7350, 7101, 7088, 7096,
+     7102, 7104, 7112, 7108, 7109, 7350, 7110, 7350, 7114, 7116,
+     7115, 7117, 7118, 7119, 7129, 7126, 7133, 7350, 7124, 7134,
+     7138, 7139, 7141, 7143, 7144, 7145, 7153, 7149, 7156, 7160,
+     7155, 7161, 7147, 7165, 7163, 7350, 7172, 7167, 7350, 7169,
+     7173, 7175, 7176, 7179, 7350, 7184, 7177, 7181, 7187, 7190,
+     7185, 7350, 7198, 7202, 7199, 7350, 7203, 7350, 7350, 7204,
+     7191, 7193, 7214, 7216, 7350, 7350, 7350, 7230, 7237, 7244,
+     7251, 7258, 7265, 7272,   88, 7279, 7286, 7293, 7300, 7307,
+     7314, 7321, 7328, 7335, 7342
+
     } ;
 
-static yyconst flex_int16_t yy_def[3664] =
+static yyconst flex_int16_t yy_def[3796] =
     {   0,
-     3645,    1, 3646, 3646, 3647, 3647, 3648, 3648, 3649, 3649,
-     3650, 3650, 3651, 3651, 3652, 3652, 3645, 3653, 3645, 3645,
-     3645, 3645, 3654, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3655, 3645, 3645, 3645,
-     3655, 3656, 3645, 3645, 3645, 3656, 3657, 3645, 3645, 3645,
-     3645, 3657, 3658, 3645, 3645, 3645, 3658, 3659, 3645, 3660,
-     3645, 3659, 3659, 3661, 3645, 3645, 3645, 3645, 3661, 3662,
-     3645, 3645, 3645, 3662, 3653, 3653, 3645, 3663, 3654, 3663,
-     3654, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3655,
-     3655, 3656, 3656, 3657, 3657, 3645, 3658, 3658, 3659, 3659,
-     3660, 3660, 3659, 3661, 3661, 3645, 3662, 3662, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3659,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645,
-     3645, 3653, 3645, 3645, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3659, 3659, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3659, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3659, 3653, 3645, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3645, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3659, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3645, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653,
-     3645, 3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3645, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3645, 3645, 3653, 3645, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653,
-     3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653,
-     3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653,
-     3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3645, 3653, 3645, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645, 3645,
-     3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3645, 3645, 3645, 3653, 3653, 3653, 3645,
-     3653, 3653, 3645, 3653, 3645, 3653, 3645, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653,
-     3653, 3645, 3653, 3653, 3645, 3653, 3645, 3653, 3645, 3653,
-     3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653,
-     3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3645, 3645, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3645,
-     3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653,
-
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645, 3645, 3645,
-     3653, 3653, 3653, 3645, 3645, 3645, 3645, 3653, 3653, 3653,
-     3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645,
-     3653, 3645, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653, 3645, 3645,
-     3653, 3653, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3653, 3653, 3645, 3645, 3653, 3653, 3653, 3645, 3653, 3645,
-     3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645,
-     3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645,
-     3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3645,
-     3645, 3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653,
-
-     3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653,
-     3653, 3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653,
-     3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645,
-     3653, 3653, 3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653,
-     3653, 3653, 3645, 3645,    0, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645
+     3777,    1, 3778, 3778, 3779, 3779, 3780, 3780, 3781, 3781,
+     3782, 3782, 3783, 3783, 3784, 3784, 3777, 3785, 3777, 3777,
+     3777, 3777, 3786, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3787, 3777, 3777, 3777,
+     3787, 3788, 3777, 3777, 3777, 3788, 3789, 3777, 3777, 3777,
+     3777, 3789, 3790, 3777, 3777, 3777, 3790, 3791, 3777, 3792,
+     3777, 3791, 3791, 3793, 3777, 3777, 3777, 3777, 3793, 3794,
+     3777, 3777, 3777, 3794, 3785, 3785, 3777, 3795, 3786, 3795,
+     3786, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3787, 3787, 3788, 3788, 3789, 3789, 3777, 3790, 3790, 3791,
+     3791, 3792, 3792, 3791, 3793, 3793, 3777, 3794, 3794, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3791, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3777, 3777,
+
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3791, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785,
+
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3791, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3777, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3777, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3791, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3791, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785,
+     3785, 3777, 3777, 3785, 3777, 3785, 3777, 3785, 3785, 3777,
+     3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3777, 3777, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3777, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3777, 3785, 3785, 3785, 3777, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3777, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3777, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3777, 3777, 3785, 3777, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3777, 3785, 3785, 3785, 3777, 3785, 3777, 3777, 3777, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3777, 3777, 3777, 3785, 3785, 3785, 3777,
+     3785, 3785, 3777, 3785, 3777, 3785, 3777, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777,
+     3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3777, 3785,
+     3777, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3777, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777,
+     3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3777, 3777,
+     3785, 3785, 3785, 3777, 3777, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777, 3785,
+     3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3777, 3777, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3785, 3785, 3777,
+     3777, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3777,
+     3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785,
+     3777, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777,
+     3777, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+
+     3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785,
+     3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3777, 3785,
+     3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785,
+     3785, 3777, 3785, 3785, 3785, 3777, 3785, 3777, 3777, 3785,
+     3785, 3785, 3785, 3785, 3777, 3777,    0, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777
+
     } ;
 
-static yyconst flex_int16_t yy_nxt[7151] =
+static yyconst flex_int16_t yy_nxt[7391] =
     {   0,
        18,   19,   20,   21,   22,   23,   22,   18,   18,   18,
        18,   18,   22,   24,   25,   26,   27,   28,   29,   30,
@@ -1645,788 +1689,814 @@ static yyconst flex_int16_t yy_nxt[7151] =
        48,   49,   50,   48,   49,   50,   53,   54,   53,   54,
        55,   51,   55,   85,   51,   85,   85,   56,   85,   56,
        58,   59,   60,   61,   85,   22,   58,   59,   60,   61,
-       86,   22,   62,   64,   65,   66,   86,   97,   62,   64,
-       65,   66,   87,   86,   67,  119,   88,  108,   85,   86,
+       86,   22,   62,   64,   65,   66,   86,   98,   62,   64,
+       65,   66,   87,   86,   67,  120,   88,  109,   85,   86,
        67,   19,   20,   21,   69,   70,   71,   75,   76,   77,
 
-       78,   86,   22,   72,  121,   86,  120,  109,   86,   79,
-      160,  160,   73,   19,   20,   21,   69,   70,   71,   75,
-       76,   77,   78,  187,   22,   72,   81,   82,   83,  130,
-       90,   79,   90,   90,   73,   90,   86,   84,   81,   82,
-       83,   90,   91,   86,   86,   98,   92,   93,  170,   84,
-       94,  159,   99,   86,  110,   95,  100,  162,   86,  101,
-      162,  170,   86,  112,   96,   86,  167,  167,  111,   86,
-      102,  113,  137,  115,  103,  173,  116,  104,   86,  105,
-      106,  179,  114,  117,  170,  118,   86,  122,   86,  126,
-      107,   86,  156,  127,   86,  123,  157,  184,   86,  138,
-
-      158,  124,   87,  139,   86,  125,   88,  128,  180,  129,
-       86,  131,   86,  140,  141,  132,  142,  143,   86,  133,
-      144,   86,  148,   86,  149,  134,   86,  145,  135,   86,
-      152,  146,  147,  150,   86,  136,  177,  177,  183,  151,
-      153,  181,  196,  189,  154,  155,  164,   86,  164,  164,
-       90,  164,   90,   90,  169,   90,  169,  169,  174,  169,
-      174,  174,  172,  174,   85,   86,   85,   85,   90,   85,
-       90,   90,  291,   90,   86,   85,   86,  182,   86,   90,
-       91,  185,  190,  188,   86,   86,  197,   86,  191,   86,
-      192,   86,   86,  208,  186,   86,   86,   86,   86,   86,
-
-      200,  199,  193,  194,   86,  198,   86,  195,   86,  201,
-       86,  202,  247,  210,  206,  203,  204,  207,  209,   86,
-      211,  216,  212,  205,   86,  213,   86,   86,   86,  218,
-       86,  219,   86,  221,   86,   86,  227,  222,  214,  215,
-       86,  228,  226,  224,   86,   86,  217,  230,  225,   86,
-       86,  220,   86,  223,  231,  233,  234,  229,   86,   86,
-       86,   86,  232,  236,   86,  238,   86,  242,  235,  239,
-       86,   86,   86,   86,  244,  240,  237,  178,   86,   86,
-       86,  241,   86,  245,  243,  250,  253,  254,   86,  246,
-      255,  249,   86,   86,   86,  256,  251,  248,  262,  259,
-
-      252,  263,   86,   86,  261,  265,   86,   86,   86,   86,
-      260,  269,  257,   86,  266,  258,   86,   86,  264,  268,
-      270,  272,  160,  160,   86,  162,  267,  271,  162,  275,
-      164,  273,  164,  164,  341,  164,  167,  167,  169,   86,
-      169,  169,   90,  169,   90,   90,  170,   90,  174,  274,
-      174,  174,  276,  174,  172,  177,  177,  278,   86,   86,
-       86,   86,   86,   86,   86,   86,   86,  277,  280,   86,
-      283,  286,  282,   86,  279,  281,   86,  289,  288,  285,
-      176,  292,  284,   86,  290,  287,   86,  293,  294,   86,
-      295,  321,   86,  298,   86,  296,   86,  303,  299,   86,
-
-      305,   86,   86,  300,   86,  306,   86,  308,   86,  301,
-      302,  304,  297,  309,   86,  312,  310,   86,   86,   86,
-      307,   86,  314,   86,  315,   86,   86,   86,  175,   86,
-       86,   86,  322,  316,  311,  323,  329,  317,  319,   86,
-      318,  320,   86,  324,  313,  332,  325,   86,  326,  330,
-      336,   86,   86,  333,   86,  331,   86,  334,  338,  339,
-      327,  378,  328,   86,   86,   86,  342,  337,   86,  335,
-      344,   86,   86,  343,  340,  345,   86,  346,   86,   86,
-      347,  349,   86,   86,   86,  348,   86,   86,  351,   86,
-       86,   86,  350,   86,   86,  353,  359,   86,   86,  354,
-
-       86,  357,   86,   86,  352,  364,  360,  358,  355,   86,
-      365,   86,   86,  361,  356,   86,  362,  366,  370,  368,
-       86,  367,  363,  373,   86,   86,   86,   86,  376,   86,
-       86,  369,  375,   86,  379,  380,  382,   86,  371,  372,
-       86,   86,   86,   86,  387,  374,   86,  385,   86,  377,
-       86,  384,  381,  386,   86,  383,  389,   86,   86,  390,
-      170,   86,   86,  393,   86,   86,   86,   86,  388,   86,
-      412,  392,  394,  396,  398,  400,  391,  401,   86,   86,
-      395,   86,   86,   86,  397,   86,  404,  402,   86,  399,
-      403,   86,   86,  405,   86,   86,   86,  407,  411,   86,
-
-       86,  413,  406,  409,   86,  408,   86,  414,  415,   86,
-      417,   86,   86,  418,  416,   86,  419,   86,   86,  410,
-      421,   86,  422,   86,   86,  426,  170,   86,  428,   86,
-      420,   86,  423,  424,   86,   86,  430,  429,   86,   86,
-      425,  427,   86,  431,   86,  433,   86,  435,  436,  438,
-       86,  434,   86,   86,   86,   86,  439,   86,  442,   86,
-      432,   86,  443,   86,   86,  441,   86,  445,   86,  448,
-      168,  440,   86,  437,  446,  450,   86,  453,   86,  444,
-       86,  454,  447,   86,  449,   86,   86,   86,  452,  462,
-       86,   86,  451,   86,  465,  464,  466,  455,   86,   86,
-
-      470,  166,  469,   86,  463,  471,  476,  456,   86,  467,
-      457,   86,  468,  472,  473,  458,  459,  460,  461,  474,
-      477,   86,   86,  480,  475,   86,   86,   86,   86,   86,
-      486,   86,   86,  488,   86,   86,   86,  484,  485,  478,
-      487,  481,  479,   86,  482,  483,   86,  489,  492,   86,
-       86,  491,   86,   86,  497,   86,  498,   86,  499,  490,
-       86,  493,   86,   86,  516,   86,   86,  500,  496,  494,
-      503,  505,  495,  504,  501,   86,  510,  502,   86,   86,
-      506,  508,   86,  509,   86,  511,  507,   86,  517,  518,
-       86,   86,  519,  515,   86,   86,   86,   86,  512,   86,
-
-      533,  513,   86,  514,   86,  520,   86,  521,   86,   86,
-      535,  532,  538,  522,  536,   86,  537,  523,  534,  170,
-      540,  579,  524,  549,  550,  525,   86,  526,  539,  527,
-      551,   86,   86,   86,   86,  552,   86,  553,   86,   86,
-      555,   86,  528,  558,  554,  529,  165,  530,  557,  531,
-       86,  556,  541,  542,  560,   86,   86,  559,   86,  562,
-       86,   86,  543,  544,  545,  546,  547,  561,  564,  548,
-      563,   86,   86,  570,   86,  568,  566,  571,  565,  573,
-       86,  569,   86,  574,   86,   86,   86,   86,   86,   86,
-      578,   86,   86,  581,  567,  572,   86,   86,  576,  582,
-
-      583,  577,   86,   86,  575,  580,  163,   86,  585,  588,
-       86,  584,   86,  586,   86,  589,   86,  587,  590,  591,
-       86,   86,   86,  596,  593,  594,   86,   86,  612,  598,
-       86,  597,   86,   86,   86,   86,  592,  615,   86,  161,
-      595,  613,  599,   86,  601,  600,  602,  603,  614,  617,
-       86,   86,   86,   86,  624,   86,  618,  619,  604,  616,
-      605,   86,   86,   86,   86,  621,  606,  620,   86,  622,
-      626,   86,  623,   86,  607,  608,   86,  629,  609,  610,
-       86,  625,  611,  630,   86,  627,  628,   86,  631,   86,
-       86,   86,   86,   86,   86,  636,  634,  635,   86,   86,
-
-       86,   86,  632,  637,  642,  638,   86,   86,   86,   86,
-      644,  633,  641,  643,   86,  646,   86,  640,  639,  645,
-       86,  647,   86,  649,   86,  651,   86,   86,   86,   86,
-      648,   86,   86,   86,   86,  653,   86,  657,  655,   86,
-       86,   86,  650,   86,  664,  666,  659,  652,  669,  654,
-       86,   86,  656,  658,  660,  665,  661,  662,   86,  668,
-      663,   86,   86,   86,   86,   86,  673,  667,   86,   86,
-      671,   86,   86,  672,   86,  670,  677,  679,  674,  680,
-      676,   86,   86,  675,   86,   86,  682,   86,   86,  678,
-       86,   86,  683,  687,  686,   86,  689,   86,   86,   86,
-
-       86,   86,  685,  681,   86,   86,  684,  721,   86,  704,
-      688,   86,  692,  690,   86,   86,   86,  691,   86,  693,
-      701,  706,  702,  703,  694,   86,  695,   86,   86,  708,
-      705,  707,  696,  712,  697,   86,   86,  698,  699,   86,
-       86,  709,  711,   86,  700,  710,  717,   86,  716,   86,
-       86,  714,   86,  713,  715,  719,   86,  718,   86,  720,
-       86,  724,   86,  726,   86,   86,  730,   86,   86,  723,
-      722,  727,   86,  729,   86,  725,  728,  733,   86,   86,
-       86,   86,   86,  734,   86,   86,  731,  737,  739,  738,
-      732,  170,  741,   86,  736,  740,   86,  735,   86,   86,
-
-      743,  744,   86,   86,   86,  742,   86,  748,  750,   86,
-      745,   86,  753,   86,  746,  754,   86,  749,  756,  752,
-      747,   86,   86,   86,   86,   86,  758,   86,  755,   86,
-       86,   86,  762,  751,  757,  761,   86,  178,  767,  759,
-      763,   86,  760,  768,   86,  770,   86,  764,  771,   86,
-      765,  772,  766,   86,  769,  773,   86,   86,  774,   86,
-      775,   86,  776,   86,   86,   86,   86,  777,   86,   86,
-      782,  778,  781,   86,   86,  780,   86,  785,   86,   86,
-      790,  784,  779,  783,  786,   86,   86,   86,   86,  789,
-       86,   86,  792,   86,  796,   86,  794,  788,   86,  787,
-
-       86,   86,   86,   86,   86,  803,  799,  791,  793,  795,
-       86,   86,   86,  797,   86,  804,   86,   86,  801,   86,
-      806,  798,  800,   86,  802,  807,  805,   86,  808,  809,
-       86,  811,  810,   86,  812,  813,   86,  816,  814,  818,
-       86,  815,  817,   86,   86,   86,  820,   86,  821,  819,
-       86,   86,  823,  824,   86,   86,  825,   86,   86,   86,
-       86,  832,   86,  830,  828,   86,   86,   86,   86,   86,
-      822,  826,  827,  829,  833,   86,  839,   86,  837,  831,
-       86,  176,   86,  840,  836,  834,   86,  838,  835,  841,
-      842,  843,   86,   86,   86,  844,   86,   86,  846,  845,
-
-       86,   86,  851,   86,   86,  849,  853,   86,   86,  852,
-      847,  848,   86,   86,   86,   86,  854,   86,   86,  856,
-      850,  858,  175,  857,   86,   86,  859,   86,  855,  862,
-      860,  861,  865,   86,  866,   86,   86,  870,   86,   86,
-      868,   86,  867,  863,  864,  869,  871,   86,  872,  875,
-      873,   86,   86,  879,   86,   86,   86,  877,  880,   86,
-       86,  881,   86,  876,  883,  874,   86,  878,  885,   86,
-       86,   86,   86,   86,  891,  884,   86,   86,   86,  882,
-       86,  892,   86,   86,   86,  893,   86,  886,  887,  888,
-       86,  889,   86,  890,  901,  898,  896,  894,  895,   86,
-
-       86,  900,   86,  897,  899,   86,   86,   86,   86,   86,
-      902,   86,  908,  903,  904,   86,   86,   86,   86,   86,
-      918,   86,  170,   86,  905,  910,  907,  906,  916,  909,
-       86,   86,   86,  911,  912,  913,  914,  915,   86,   86,
-      921,   86,  919,  922,  917,  920,  924,   86,   86,   86,
-       86,   86,   86,  923,   86,   86,  929,  928,   86,  930,
-      932,   86,  927,  925,   86,   86,  933,  926,   86,   86,
-       86,  935,   86,   86,  936,  170,  934,  940,  931,  938,
-      941,  939,  937,   86,   86,   86,  944,  942,   86,  943,
-       86,   86,   86,   86,  948,  949,   86,  945,   86,  950,
-
-      952,   86,  954,   86,   86,  946,  947,  951,  953,  956,
-      955,   86,   86,   86,   86,   86,  958,   86,   86,  962,
-       86,   86,   86,  959,  957,   86,  963,  964,   86,   86,
-       86,   86,  961,   86,   86,  965,   86,   86,  960,  977,
-      978, 1029,  967,  975,   86,  981,  966,   86,  976,  968,
-      980,  979,  969,  982,   86,   86,  970,   86,  983,  971,
-       86,  984,   86,  985,   86,   86,  972,  973,  986,  974,
-      990,   86,   86,  987,   86,   86,   86,  999,  988,   86,
-       86,   86,   86,  168, 1002,  989,   86,  991,  992,   86,
-      993,  998,   86,  994, 1006, 1000, 1004, 1001,  995, 1003,
-
-     1007,   86,   86,   86,  996,  997, 1008, 1010,   86, 1012,
-     1014, 1011, 1005,   86, 1013,   86,   86, 1009,   86, 1015,
-       86, 1017,   86, 1018,   86, 1019,   86, 1020, 1016, 1022,
-       86, 1021,   86,   86, 1023,   86,   86,   86,   86,   86,
-     1026,   86, 1030,   86, 1033, 1024,   86,   86,   86,   86,
-     1037, 1039,   86, 1031, 1025,   86,   86, 1027, 1028,   86,
-     1032, 1035, 1040, 1043, 1038, 1034,   86, 1041,   86,   86,
-     1036, 1042, 1045, 1047, 1044,   86,   86,   86,   86,   86,
-     1046,   86, 1049,   86, 1048, 1050, 1051,   86, 1052,   86,
-       86, 1053,   86,   86,   86,   86,   86, 1055, 1056,   86,
-
-     1057, 1061,   86,   86, 1065,   86, 1064,   86, 1054,   86,
-       86, 1063, 1059, 1058, 1062,   86,   86,   86, 1060,   86,
-       86,   86,   86,   86, 1073, 1068, 1069, 1066, 1071, 1072,
-       86,   86,   86,   86, 1067, 1074, 1075,   86,   86, 1079,
-       86, 1077,   86, 1070, 1080,   86, 1078,   86, 1082,   86,
-       86, 1081,   86, 1083,   86, 1088, 1076,   86, 1085, 1084,
-       86,   86, 1090, 1089, 1091,   86, 1086,   86, 1087,   86,
-       86,   86, 1093,   86,   86, 1092,   86,   86, 1094,   86,
-     1101, 1095, 1099,  166, 1104,   86,   86,   86,   86, 1096,
-       86, 1098, 1097,   86, 1105, 1102,   86, 1100, 1103, 1106,
-
-       86, 1111, 1107,   86,   86,   86, 1110, 1108,   86, 1113,
-     1109, 1114,   86,   86,   86,   86,   86, 1112,   86,   86,
-     1125,   86, 1117, 1119, 1115,   86,   86, 1126, 1116,   86,
-       86, 1128,   86,   86, 1118,   86, 1120,   86, 1122, 1133,
-     1121, 1123, 1131, 1127, 1129, 1124,   86, 1132,   86,   86,
-       86,   86, 1130,   86, 1140, 1137,   86, 1139, 1141,   86,
-       86, 1135, 1142,   86,   86, 1134,   86, 1145,   86, 1136,
-     1147,   86, 1138,   86,   86,   86,   86,   86, 1153, 1144,
-     1149, 1143,   86, 1154,  170, 1150,   86,   86, 1146,   86,
-     1156, 1155, 1148,   86, 1157,   86,   86,   86, 1151, 1158,
-
-     1152, 1160,   86,   86,   86,   86, 1173, 1159, 1161,   86,
-       86, 1163,   86, 1174,   86, 1164, 1176,   86,   86, 1162,
-       86,   86, 1178, 1165, 1180, 1166,   86, 1175,   86, 1167,
-      165, 1168,   86, 1181, 1182, 1169, 1179, 1170, 1183, 1177,
-       86, 1185, 1171, 1184,   86,   86,   86, 1172,   86, 1187,
-       86,   86,   86,   86, 1186, 1190, 1193,   86, 1192,   86,
-      163, 1188,   86, 1189,   86, 1191, 1194, 1198, 1197, 1201,
-     1199, 1196,   86, 1202, 1195,   86, 1205, 1200, 1204,   86,
-     1203,   86,   86,   86,   86,   86,   86,   86,   86,   86,
-       86,   86, 1220, 1217,   86,   86,   86,   86, 1216, 1221,
-
-       86,   86, 1219, 1218, 1207, 1208, 1206,   86, 1209, 1222,
-     1224, 1223,   86, 1210, 1228, 1211, 1225,   86,   86, 1226,
-       86, 1212, 1229,   86,   86,   86, 1213, 1214, 1227,   86,
-     1230, 1235,   86, 1215,   86,   86, 1238,   86, 1236,   86,
-     1232, 1231,   86, 1233, 1241,   86,   86, 1234, 1239,   86,
-       86, 1243,   86,   86, 1244, 1237, 1240,   86,   86, 1242,
-     1249, 1246, 1247,   86,   86,   86,   86,   86,   86, 1245,
-     1252,   86, 1250,   86, 1248,   86,   86,   86,   86,   86,
-       86,   86, 1254, 1251, 1257, 1256, 1258, 1253,   86, 1261,
-       86, 1255, 1263, 1260, 1259,   86, 1262,   86,   86, 1264,
-
-     1266,   86, 1265,   86, 1267,   86, 1270,   86,   86, 1275,
-     1271,   86, 1272,   86, 1274,   86, 1268, 1273, 1269, 1276,
-     1277,   86,   86,   86, 1281,   86,   86,   86, 1283, 1282,
-       86, 1284,   86,   86,   86, 1279, 1278, 1286,   86, 1280,
-       86, 1285,   86, 1293,   86,   86, 1287,   86,   86,   86,
-     1295, 1300,   86, 1288, 1289, 1291,   86, 1297, 1290, 1292,
-       86,   86, 1296,   86, 1299, 1294,   86,   86,   86,   86,
-       86, 1302, 1303,   86, 1298, 1306,   86,   86, 1305,   86,
-       86, 1307, 1301, 1309, 1304, 1308, 1311, 1312, 1313,   86,
-       86,   86,   86,   86,   86, 1310,   86, 1316,   86, 1314,
-
-       86, 1317,   86,   86,  161, 1321, 1323, 1324, 1325, 1315,
-     1318,   86,   86,   86,   86, 1319, 1322,   86, 1320,   86,
-     1328, 1330, 1326,   86, 1327,   86,   86,   86, 1329, 1332,
-     1331,   86, 1334,   86,   86, 1336,   86,   86,   86, 1335,
-       86,   86, 1337,   86,   86, 1339, 1338, 1342,   86,   86,
-       86, 1333, 1343, 1345,   86,   86,   86, 1349, 1350, 1340,
-       86, 1344, 1341,   86,   86,   86,   86, 1347, 1353,   86,
-       86, 1352, 1346,   86,   86, 1348,   86, 1358,   86, 1354,
-     1351,   86,   86,   86, 1355, 1356,   86, 1360, 1364,   86,
-       86,   86, 1357,  170, 1359,   86, 1366,   86, 1365,   86,
-
-     1367, 1361,   86,   86,   86, 1363, 1376, 1372, 1362,   86,
-       86, 1369,   86, 1368, 1370, 1371, 1374,   86, 1373, 1377,
-       86,   86,   86, 1380, 1375,   86, 1378, 1379,   86,   86,
-       86,   86,   86, 1381, 1382, 1384,   86,   86,   86, 1390,
-       86,   86,   86, 1383, 1387,   86, 1385,   86,   86,   86,
-     1401, 1386,   86, 1388, 1394, 1389, 1391, 1396,   86, 1392,
-     1393,   86, 1400,   86,   86,   86, 1397, 1395, 1398, 1402,
-     1404, 1399, 1403,   86,   86, 1405,   86, 1406,   86,   86,
-       86,   86, 1413,   86, 1407, 1410,   86, 1409,   86,   86,
-       86, 1414,   86, 1412, 1408, 1418,   86, 1415, 1411,   86,
-
-     1416,   86,   86,   86, 1419,   86, 1420, 1422,   86, 1417,
-       86,   86, 1421,   86, 1423,   86, 1428, 1424, 1425,   86,
-     1426,   86, 1431,   86,   86, 1429,   86,   86,   86,   86,
-     1427, 1438,   86, 1432, 1430, 1436,   86,   86,   86,   86,
-       86,   86, 1433, 1437, 1435, 1434,   86, 1439, 1441,   86,
-     1448, 1442, 1440, 1444,   86, 1450,   86, 1443,   86, 1445,
-       86,   86,   86,   86, 1447,   86,   86,   86, 1453,   86,
-       86, 1446, 1456, 1451, 1449,   86, 1452,   86, 1457, 1458,
-       86, 1455, 1526, 1454, 1459,   86,   86, 1463, 1460, 1461,
-     1462,   86, 1464, 1471,   86, 1473, 1465,   86, 1474, 1466,
-
-     1467,   86,   86, 1472, 1468, 1477,   86, 1475,   86,   86,
-     1469,   86,   86, 1478, 1470, 1476,   86, 1479,   86, 1480,
-       86, 1482,   86,   86,   86, 1483, 1487, 1484,   86,   86,
-     1481,   86,   86, 1488, 1490,   86, 1485, 1493, 1494,   86,
-       86, 1486,   86,   86,   86, 1491,   86, 1495, 1489, 1498,
-     1496,   86, 1497, 1492, 1499,   86, 1500,   86, 1501,   86,
-     1502,   86, 1503,   86, 1505, 1504, 1506, 1507,   86,   86,
-     1508,   86, 1509,   86, 1514, 1511, 1510,   86,   86, 1515,
-       86,   86, 1513,   86,   86,   86, 1516,   86, 1518, 1512,
-     1524,   86,   86, 1520,   86, 1519,   86,   86, 1525,   86,
-
-     1517,   86, 1527,   86, 1521, 1523, 1522,   86, 1529,   86,
-       86,   86,   86, 1528,   86, 1530, 1531, 1532,   86, 1535,
-     1536,   86, 1538,   86,   86,   86, 1539, 1533, 1540,   86,
-       86, 1542,   86, 1537, 1541,   86, 1534, 1544,   86, 1543,
-     1546,   86,   86, 1547,   86,   86,   86, 1552,   86, 1548,
-       86,   86, 1545,   86,   86, 1557, 1549, 1555,   86,   86,
-       86,   86,   86, 1558, 1560,   86, 1550, 1551, 1554, 1559,
-     1553,   86,   86, 1556, 1562,   86,   86, 1561,   86,   86,
-     1563, 1565,   86, 1567,   86, 1564,   86, 1568, 1629, 1566,
-       86, 1569,   86, 1570,   86, 1572,   86, 1571,   86,   86,
-
-     1574, 1573,   86, 1578, 1575, 1579, 1576,   86,   86,   86,
-     1582,   86, 1580, 1581,   86, 1577,   86,   86,   86, 1586,
-       86,   86,   86, 1583,   86,   86,   86, 1588,  170, 1585,
-       86, 1594, 1595,   86, 1597, 1590, 1584,   86,   86, 1596,
-       86, 1587, 1589, 1591,   86,   86, 1592,   86,   86,   86,
-       86,   86, 1605, 1593,   86,   86,   86,   86, 1598,   86,
-     1602, 1609,   86, 1603, 1599, 1600,   86, 1601, 1604, 1610,
-       86, 1612, 1614,   86, 1606, 1608,   86, 1615,   86,   86,
-     1607, 1613, 1611,   86,   86, 1617,   86, 1618,   86,   86,
-       86, 1616, 1626, 1623,   86,   86, 1624, 1619, 1625, 1620,
-
-     1628, 1621,   86,   86, 1622, 1631,   86,   86, 1627,   86,
-     1632,   86,   86, 1630, 1633,   86,   86, 1636,   86,   86,
-     1637, 1638,   86,   86, 1641, 1635,   86, 1639,   86, 1634,
-       86, 1646,   86,   86,   86, 1650, 1647, 1643, 1640,   86,
-       86,   86, 1642,   86, 1644,   86, 1645,   86,   86,   86,
-       86, 1648, 1651, 1649,   86, 1652,   86, 1659,   86, 1654,
-       86, 1658, 1653, 1655, 1656, 1660, 1657,   86,   86, 1664,
-       86,   86, 1661,   86,   86, 1668, 1663, 1669, 1670, 1662,
-     1666,   86,   86,   86,   86, 1665,   86, 1672, 1673,   86,
-       86,   86,   86, 1667, 1678, 1671, 1674, 1677, 1675, 1679,
-
-       86, 1680,   86, 1681,   86,   86,   86,   86,   86, 1682,
-     1685,   86, 1676,   86,   86, 1687,   86, 1686,   86,   86,
-       86,   86, 1688,   86, 1693,   86, 1689, 1692, 1683, 1695,
-     1684, 1691, 1690,   86,   86, 1699,   86, 1701, 1696, 1694,
-     1700,   86, 1702,   86, 1698,   86, 1704,   86, 1697,   86,
-       86,   86,   86,   86,   86, 1712, 1703, 1708,   86, 1707,
-       86,   86,   86, 1713,   86, 1716, 1705,   86, 1706,   86,
-     1709,   86, 1711, 1710,   86, 1718, 1719,   86,   86,   86,
-     1714,   86,   86, 1717,   86,   86, 1720,   86, 1715,   86,
-     1728,   86,   86, 1721, 1729, 1725, 1722, 1723, 1724,   86,
-
-     1727,   86, 1733,   86, 1735, 1726, 1730, 1734,   86,   86,
-       86, 1731,   86, 1732, 1736,   86,   86,   86,   86, 1741,
-       86,   86, 1737, 1742, 1739,   86, 1745, 1738,   86, 1740,
-     1749,   86,   86, 1746, 1751,   86, 1743, 1750, 1744,   86,
-       86, 1754,   86,   86, 1748, 1747, 1756,   86, 1755,   86,
-     1752,   86, 1753, 1757,   86,   86,   86, 1762, 1763,   86,
-       86,   86,   86,   86, 1760,   86, 1767, 1766, 1768,   86,
-       86, 1758, 1759, 1771,   86,   86, 1761,   86, 1764, 1770,
-       86,   86, 1765, 1772,   86,   86,   86,   86, 1776, 1769,
-       86, 1773,   86, 1774,   86, 1781, 1779, 1775,   86,   86,
-
-       86,   86,   86, 1787,   86, 1788, 1785, 1777,   86,   86,
-     1778,   86, 1780, 1782,   86,   86, 1786, 1789,   86, 1784,
-     1783,   86, 1794,   86,   86,   86,   86, 1799,   86, 1790,
-     1791, 1797,   86,   86,   86, 1802, 1800, 1795, 1793, 1792,
-     1798,   86, 1796,   86,   86,   86,   86,   86,   86, 1806,
-     1809,   86, 1808, 1801,   86, 1805,  170, 1810,   86,   86,
-       86, 1811, 1804, 1803, 1812, 1807,   86,   86,   86,   86,
-     1820,   86, 1813,   86, 1815,   86, 1814,   86, 1821, 1824,
-       86, 1818, 1826,   86,   86, 1816, 1817,   86,   86, 1828,
-     1830, 1822, 1825, 1819,   86, 1823,   86, 1832,   86, 1829,
-
-     1834,   86,   86,   86, 1827,   86,   86,   86, 1831,   86,
-       86, 1836, 1833,   86, 1837,   86, 1839,   86, 1840,   86,
-       86, 1835, 1844,   86, 1841, 1842,   86, 1845, 1843,   86,
-     1838, 1852,   86,   86,   86, 1847, 1849,   86, 1846, 1850,
-       86,   86,   86, 1856, 1854, 1853,   86, 1857,   86, 1848,
-       86, 1851, 1862, 1859, 1860,   86, 1863, 1858,   86,   86,
-     1855, 1869,   86, 1867, 1864,   86, 1865,   86, 1866,   86,
-     1861,   86,   86,   86,   86,   86, 1868, 1874, 1873, 1875,
-     1876,   86,   86,   86,   86,   86,   86, 1877,   86, 1878,
-     1870,   86, 1871, 1880, 1872,   86, 1881,   86,   86,   86,
-
-       86,   86, 1883, 1882, 1879,   86,   86,   86,   86,   86,
-       86, 1884, 1893, 1892,   86, 1887,   86,   86, 1885, 1888,
-     1886, 1889,   86,   86, 1890,   86, 1896,   86, 1899, 1895,
-     1898,   86,   86, 1891,   86, 1894,   86, 1897,   86, 1904,
-       86, 1903,   86, 1900,   86, 1906,   86, 1901,   86, 1907,
-     1908,   86, 1902, 1910, 1911,   86, 1912, 1905, 1909,   86,
-       86, 1913,   86,   86,   86,   86,   86,   86,   86,   86,
-     1927,   86, 1917, 1914, 1919, 1920, 1928,   86, 1921, 1918,
-     1916, 1922,   86, 1923, 1915, 1926,   86,   86, 1924,   86,
-     1932,   86, 1931,   86, 1925,   86,   86,   86, 1929,   86,
-
-     1936, 1935,   86,   86, 1937, 1930, 1933,   86,   86,   86,
-       86,   86, 1946,   86, 1934,   86, 1940, 1947, 1944, 1939,
-     1942, 1938, 1945, 1943,   86,   86,   86, 1941,   86,   86,
-       86,   86,   86, 1953,   86, 1948, 1955, 1949, 1954,   86,
-     1951,   86, 1956, 1950, 1960, 1952,   86, 1959,   86,   86,
-       86, 1963, 1958,   86, 1965, 1964,   86, 1957, 1962,   86,
-       86, 1969,   86,   86, 1961, 1973,   86,   86, 1966, 1967,
-     1974,   86, 1968,   86,   86,   86,   86, 1970, 1980, 1978,
-     1975, 1972, 1976, 1971,   86, 1982,   86, 1983,   86, 1979,
-       86,   86, 1986,   86, 1981, 1977, 1984,   86,   86,   86,
-
-     1990,   86, 1985, 1987,   86,   86,   86,   86,   86, 1994,
-     1988, 1992, 1995, 1989, 1991,   86,   86, 1993,   86,   86,
-       86,   86,   86, 2000, 1996,   86, 1997, 1999,   86, 2001,
-       86, 2003, 2007,   86, 2002, 1998,   86, 2009, 2004, 2010,
-       86,   86, 2005,   86, 2006,   86,   86, 2013,   86, 2011,
-       86, 2017,   86, 2012, 2008,   86, 2014, 2019,   86, 2015,
-       86,   86,   86,   86, 2023,   86,   86,   86, 2018, 2016,
-     2025,   86, 2026,   86,   86,   86, 2021,   86, 2028, 2022,
-     2020,   86, 2024, 2030,   86,  170, 2029,   86, 2032,   86,
-     2034, 2027,   86, 2033, 2037,   86,   86, 2035, 2031,   86,
-
-     2041,   86,   86,   86, 2036,   86,   86,   86, 2039,   86,
-     2043, 2038,   86,   86, 2048,   86, 2042, 2044, 2040, 2045,
-       86, 2051, 2052,   86, 2049, 2046,   86,   86,   86, 2047,
-     2053, 2050, 2054,   86,   86, 2056, 2057, 2058,   86, 2055,
-     2059,   86,   86, 2060,   86,   86,   86, 2061,   86,   86,
-       86,   86,   86,   86,   86, 2066, 2067,   86,   86, 2071,
-       86, 2068, 2072,   86, 2080, 2062, 2064, 2065, 2063, 2069,
-       86,   86,   86, 2070,   86, 2073, 2075, 2077, 2078,   86,
-     2074, 2079,   86, 2076,   86,   86,   86,   86,   86,   86,
-     2087,   86, 2090, 2091,   86, 2081, 2092,   86, 2083,   86,
-
-     2082,   86, 2085, 2088, 2084, 2089,   86, 2086, 2094,   86,
-       86, 2095,   86, 2099,   86, 2101,   86,   86, 2103, 2093,
-     2100,   86, 2096,   86,   86, 2105, 2102, 2097,   86,   86,
-       86,   86,   86, 2098, 2106, 2104,   86, 2109,   86, 2108,
-       86, 2112,   86,   86,   86, 2111,   86, 2113,   86, 2115,
-     2110, 2116,   86, 2107,   86, 2117, 2119, 2118,   86,   86,
-       86, 2127,   86,   86, 2114,   86,   86,   86, 2124,   86,
-     2120, 2121, 2122, 2130, 2131, 2132,   86, 2123, 2125, 2126,
-     2133,   86,   86, 2128,   86, 2129, 2136,   86,   86, 2139,
-     2134,   86,   86,   86,   86,   86,   86, 2135, 2137,   86,
-
-     2140, 2143,   86, 2138,   86, 2145,   86, 2148, 2149,   86,
-       86,   86, 2141,   86, 2142,   86, 2146, 2151,   86,   86,
-     2144, 2147, 2153, 2156, 2154,   86, 2158,   86,   86,   86,
-     2150,   86,   86,   86,   86,   86, 2152,   86, 2164, 2161,
-     2155, 2157, 2162,   86, 2167, 2169, 2160,   86,   86, 2159,
-       86,   86, 2168,   86,   86,   86, 2173, 2172, 2175, 2166,
-     2163, 2165, 2171,   86,   86, 2176,   86,   86, 2170,   86,
-       86,   86, 2174,   86, 2177,   86, 2178,   86, 2182,   86,
-       86,   86, 2184,   86, 2187, 2179,   86, 2188, 2189, 2183,
-       86, 2180, 2181,   86,   86,   86,   86,   86, 2185, 2192,
-
-     2197,   86,   86,   86,   86, 2191, 2190, 2186, 2196,   86,
-       86,   86, 2203,   86,   86, 2193, 2194, 2202,   86, 2195,
-     2204, 2206,   86, 2199, 2200,   86, 2198, 2205,   86, 2201,
-     2210,   86, 2207,   86,   86,   86, 2208,   86,   86,   86,
-     2214, 2209,   86, 2218,   86,   86,   86,   86, 2212,   86,
-     2223,   86, 2221,   86, 2211, 3645, 2213, 2222, 2215, 2216,
-       86, 2220, 2217, 2219,   86, 2224,   86,   86,   86, 2226,
-     2225,   86,   86, 2229, 2231,   86, 2230, 2238, 2227, 2232,
-       86, 2233, 2235, 2228, 2236,   86, 2234,   86,   86, 2240,
-       86,   86,   86,   86, 2237,   86, 2242, 2239,   86, 2244,
-
-       86, 2246,   86, 2241, 2248, 2243,   86,   86, 2249,   86,
-       86,   86,  170,   86,   86,   86,   86, 2252,   86, 2256,
-       86, 2257,   86, 2258, 2247, 2245, 2251, 2253, 2254, 3645,
-     2250, 2262, 2255, 2259,   86, 2260,   86,   86,   86,   86,
-     2261,   86,   86,   86, 2263, 2265, 2264,   86, 2267,   86,
-     2268, 2266,   86, 2270,   86,   86,   86,   86, 2274,   86,
-       86, 2269, 2273,   86,   86, 2275, 2271, 2272, 2276, 2277,
-       86, 2279,   86, 2278,   86,   86,   86,   86,   86,   86,
-     2280, 2284, 2286, 2281, 2285,   86,   86,   86,   86,   86,
-       86, 2291,   86, 2282, 2288, 2283, 2287,   86,   86,   86,
-
-       86, 2290, 2292,   86, 2289,   86, 2294, 2293, 2295,   86,
-     2297,   86, 2296, 2302, 2298, 2299, 2301, 2303,   86, 2300,
-       86,   86,   86, 2304,   86,   86,   86, 2310,   86,   86,
-     2312,   86,   86,   86, 2313, 2315,   86, 2305, 2306, 2309,
-     2307, 2308,   86, 2317,   86, 2311,   86, 2318,   86, 2314,
-     2316,   86, 2321,   86,   86,   86,   86, 2320,   86,   86,
-     2326, 2323,   86,   86, 2327,   86,   86, 2322,   86,   86,
-       86, 2319, 2328,   86,   86,   86, 2325, 2324, 2330,   86,
-     2331, 2337, 2333, 2329, 2332,   86, 2338,   86, 2335, 2336,
-       86, 2334,   86,   86, 2340, 2343, 2339,   86, 2341, 2346,
-
-       86,   86, 2345,   86, 2349,   86,   86,   86, 2344,   86,
-     2350, 2342, 2352, 2348,   86, 2347, 2353,   86,   86,   86,
-       86,   86, 2355, 2351, 2354, 2356,   86, 2358, 2357, 2359,
-       86, 2363, 2361, 2360,   86,   86, 2364,   86, 2366,   86,
-       86,   86,   86,   86, 2369, 2362, 2368,   86, 2370, 2365,
-       86,   86, 2371,   86, 2375,   86,   86,   86, 2379,   86,
-       86, 2376,   86, 2380,   86,   86, 2367, 2378, 2372, 2373,
-     2377,   86,   86, 2374, 2385,   86, 2383, 2384, 2382, 2381,
-       86, 2386,   86, 2387,   86, 2390,   86,   86, 2392,   86,
-       86,   86, 2391, 2396,   86,   86,   86, 2388, 2394,   86,
-
-     2398,   86, 2399,   86, 2389,   86, 2395, 2393, 2397,   86,
-     2401,   86, 2400, 2402,   86, 2403, 2406,   86, 2404, 2408,
-       86, 2405,   86,   86, 2409,   86,   86,   86,   86,   86,
-       86, 2411, 2410, 2414, 2415, 2412,   86,   86, 2407, 2413,
-     2419,   86,   86, 2416,   86, 2418, 2417,   86,   86,   86,
-       86,   86,   86,   86, 2427, 2420,   86,   86,   86,   86,
-     2421,   86, 2422, 2423, 2425, 2428, 2426, 2433, 2429,   86,
-       86,   86, 2430, 2424, 2431, 2432,   86, 2434,   86, 2440,
-     2438,   86, 2435,   86, 2437,   86, 2439, 2443,   86, 2445,
-       86,   86, 2442,   86, 2444, 2436,   86,   86,   86,   86,
-
-     2448, 2452, 2449,  170, 2456, 3645, 2441,   86, 2454, 2446,
-       86, 2450, 2447, 2455,   86, 2457,   86,   86, 2451, 2458,
-       86,   86, 2461,   86,   86, 2453,   86, 2462, 2459, 2466,
-       86,   86, 2467, 2465,   86,   86, 2470, 2460,   86,   86,
-     2472, 2463,   86, 2471, 2473,   86, 2468,   86,   86,   86,
-     2475, 2476, 2464, 2469, 2474,   86,   86,   86,   86, 2478,
-       86,   86,   86,   86,   86, 2481,   86, 2484, 2477,   86,
-       86,   86, 2490,   86,   86, 2488,   86, 2479, 2483,   86,
-     2491,   86, 2485, 2480, 2482, 2486, 2487,   86,   86, 2492,
-       86,   86, 2493, 2489,   86,   86,   86, 2494,   86, 2499,
-
-     2502,   86, 2497,   86,   86,   86, 2496, 2495, 2500,   86,
-     2498, 2503,   86,   86, 2501,   86,   86, 2504,   86,   86,
-     2513,   86,   86, 2505, 2506, 2511,   86,   86,   86, 3645,
-     2518,   86, 2507, 2516, 2509, 2515, 2508, 2510,   86, 2512,
-       86, 2519, 2514,   86, 2517, 2520,   86,   86, 2521,   86,
-     2522,   86,   86, 2523, 2529, 2524,   86, 2527, 2528,   86,
-     2530,   86,   86, 2525, 2526,   86,   86,   86, 2534, 2536,
-       86, 2535,   86, 2537,   86, 2538,   86, 2531,   86, 2533,
-     2532, 2541,   86, 2542,   86, 2539,   86,   86, 2540,   86,
-       86, 2543, 2544, 2548,   86, 2549,   86,   86, 2545, 2551,
-
-       86,   86, 2547, 2553,   86,   86,   86, 2556,   86, 2546,
-       86, 2555, 2557,   86,   86,   86, 2550,   86,   86, 2552,
-     2554,   86,   86, 2559, 2558,   86, 2563, 2564,   86, 2566,
-       86, 2561, 2560,   86,   86,   86,   86, 2562, 2568, 2570,
-     2569, 2565,   86, 2567,   86, 2571, 2573,   86,   86,   86,
-     2576,   86, 2579,   86, 2574, 2580,   86, 2575,   86,   86,
-     2572,   86,   86,   86, 2577, 2586,   86, 2585,   86,   86,
-     2578,   86,   86, 2582, 2588,   86, 2581, 2584, 2591,   86,
-       86,   86, 2583,   86,   86,   86, 2589, 2587, 2593,   86,
-     2590,   86, 2592, 2601, 2594,   86, 2599,   86,   86, 2605,
-
-     2597, 2595, 2596,   86,   86,   86, 2600, 2602, 2607,   86,
-     2606,   86,   86,   86, 2608, 2598,   86,   86,   86,   86,
-       86, 2612, 2603, 2614, 2604, 2610,   86,   86,   86, 3645,
-       86, 2615, 2616, 2618, 2611, 2617, 2609,   86, 2619,   86,
-     2620, 2622, 2623, 2613,   86, 2621,   86,   86,   86,   86,
-       86, 2624, 2627, 2625,   86,   86,   86,   86,   86,   86,
-       86, 2626, 2634, 2629, 2630, 2631, 2632, 2635,   86,   86,
-     2628,   86, 2633,   86,   86, 2636,   86, 2640, 2639, 2637,
-     2638, 2641,   86, 2642,   86,   86, 2645,   86,   86,  170,
-     2649, 2643,   86, 2644, 2646,   86, 2651,   86,   86,   86,
-
-       86,   86,   86,   86, 2659,   86,   86, 2652, 2647, 2653,
-     2648, 2650, 3645, 2654, 2655, 2657,   86, 2656, 2661, 2658,
-     2662,   86,   86, 2663,   86, 2660, 2664,   86,   86, 2666,
-     2667, 2665, 2668,   86, 2670,   86,   86,   86,   86,   86,
-     2672,   86, 2669,   86,   86,   86, 2676,   86, 2677,   86,
-       86, 2671,   86, 2673,   86, 2679, 2680, 2674, 2685,   86,
-       86, 2678, 2681, 2675, 2682,   86,   86,   86,   86, 2686,
-       86, 2683, 2684,   86, 2688, 2689,   86,   86,   86,   86,
-       86,   86, 2691,   86,   86,   86, 2690, 2696, 2687,   86,
-     2698, 2699,   86, 2701,   86, 2695,   86,   86, 2692, 2693,
-
-     2694,   86, 2700,   86, 2697,   86,   86, 2702, 2705, 2707,
-       86,   86,   86, 2703,   86, 2711, 2712, 2710, 2708, 2734,
-     2704,   86,   86,   86,   86,   86, 2706, 2709,   86,   86,
-     2714, 2713,   86, 2715,   86, 2718,   86,   86, 2769, 2716,
-     2719,   86, 2720, 2717,   86,   86, 2726, 2721, 2722,   86,
-     2724,   86,   86,   86,   86, 2725, 2728,   86, 2723, 2730,
-       86,   86,   86, 2729,   86, 2727,   86,   86,   86,   86,
-     2739,   86,   86, 2737, 2738, 2741, 2732, 2740,   86, 2731,
-     2733,   86,   86,   86, 2743,   86,   86,   86, 2736,   86,
-       86, 2746, 2735, 2748, 2745,   86,   86, 2751,   86,   86,
-
-       86, 2744, 2742,   86,   86, 2752, 2747, 2749, 2750, 2753,
-     2754, 2755, 2758,   86, 2757,   86,   86,   86, 2759,   86,
-       86, 2756,   86, 2762, 2763,   86,   86,   86,   86,   86,
-       86, 2764,   86,   86, 2768, 2760, 2766, 2761, 2765,   86,
-       86, 2767,   86,   86, 2770, 2772, 2771, 2773, 2776, 2777,
-       86, 2778,   86, 2779,   86, 2780,   86,   86,   86, 2774,
-     2775,   86,   86, 2784,   86, 2785, 2783,   86, 2786, 2781,
-       86,   86,   86,   86,   86, 3645, 2782,   86,   86, 2793,
-       86,   86, 2787,   86, 2789, 2795,   86, 2796,   86, 2798,
-       86, 2788, 2797, 2790, 2792, 2791, 2794,   86,   86,   86,
-
-       86,   86,   86, 2802,   86, 2800, 2803, 2806,   86, 2799,
-       86, 2801,   86, 2807, 2808,   86,   86,   86,   86,   86,
-     2804,   86, 2805, 2815,   86,  170,   86, 2817,   86, 2811,
-       86,   86, 2810, 2813,   86,   86, 2809, 2816,   86, 2818,
-     2814, 2812, 2821, 2819,   86,   86, 2820, 2824,   86,   86,
-     2826,   86, 2825, 2827, 2828,   86, 2822,   86, 2823, 2829,
-       86,   86, 2830,   86, 2831,   86, 2832, 2833, 2834,   86,
-     2835,   86,   86,   86,   86,   86,   86,   86,   86,   86,
-     2843, 3645,   86,   86, 2836, 2841,   86, 2847,   86,   86,
-     2838, 2837, 2848, 2845, 2840, 2839,   86, 2842,   86, 2844,
-
-     2846, 2849,   86, 2850,   86, 2851,   86, 2852, 2853,   86,
-     2855,   86,   86, 2854, 2856,   86,   86,   86,   86,   86,
-       86,   86, 2859,   86, 2857, 2866,   86, 2865, 2867,   86,
-     2858, 2860,   86,   86,   86, 2861, 2862, 2863, 2864, 2870,
-     2871,   86, 2873, 2868, 2872,   86,   86,   86,   86,   86,
-     2869,   86, 2874,   86, 2880,   86,   86,   86, 2879,   86,
-       86,   86, 2876, 3645, 2875, 2878,   86,   86, 2877, 2888,
-       86, 2884, 2886,   86,   86, 2887, 2881, 2882,   86, 2883,
-     2889, 2885, 2890,   86,   86, 2891,   86,   86,   86,   86,
-       86,   86,   86, 2892, 2895, 2896, 2897,   86,   86, 2894,
-
-       86, 2902, 2903,   86,   86, 2893, 2906,   86, 2898, 2900,
-       86, 2899,   86,   86,   86, 2901,   86, 2909, 2905, 2904,
-       86, 2907, 2914,   86,   86,   86, 2912, 2908, 2913, 2910,
-       86, 2911,   86,   86, 2919,   86,   86,   86, 2915,   86,
-       86, 2923,   86, 2922,   86, 2916, 2921,   86, 2920, 2924,
-       86,   86, 2917, 2918, 2926,   86, 2927,   86,   86, 2930,
-     2929, 2925, 2932,   86,   86, 2933, 2928,   86, 2935,   86,
-       86,   86,   86,   86, 2942,   86,   86,   86, 2931,   86,
-       86,   86, 2939, 2936, 2937, 2938, 2940,   86, 2941, 2934,
-     2945,   86, 2946,   86,   86, 2944, 2943,   86, 2947,   86,
-
-     2951,   86, 2949,   86,   86,   86,   86, 2950, 2948,   86,
-     2952, 2953,   86,   86, 2955, 2958,   86, 2956, 2960, 2954,
-     2957, 2959,   86, 2962,  170, 2961,   86,   86,   86,   86,
-     2967, 3645, 2964, 2963,   86,   86,   86,   86, 2969, 2968,
-       86, 2972,   86, 2973,   86, 2971, 2965, 2966,   86, 2977,
-     2970, 2975,   86,   86, 2978,   86, 2976,   86,   86,   86,
-     2982, 2974, 2979, 2980,   86,   86,   86,   86, 2983,   86,
-     2984,   86,   86, 2981, 2989, 2990, 2985,   86,   86, 2987,
-       86,   86, 2991,   86, 2986, 2993,   86,   86, 2995,   86,
-     2992,   86, 2996, 2988, 2994,   86,   86,   86,   86,   86,
-
-     2998, 2999, 3000, 2997,   86,   86,   86, 3005,   86,   86,
-       86,   86, 3002, 3003, 3004, 3007, 3001, 3006, 3009,   86,
-       86,   86, 3645,   86,   86, 3010,   86, 3008, 3015,   86,
-     3011,   86,   86, 3016,   86,   86,   86, 3020,   86,   86,
-     3012, 3013, 3014, 3018, 3019, 3023,   86, 3021,   86,   86,
-     3017,   86,   86, 3022, 3030, 3027, 3028,   86, 3024, 3031,
-       86,   86, 3033, 3025,   86,   86, 3034,   86,   86, 3026,
-       86,   86, 3035,   86,   86, 3040, 3037, 3029,   86, 3032,
-       86,   86, 3038, 3041,   86,   86,   86, 3039, 3042, 3045,
-       86,   86, 3047,   86, 3645, 3036, 3043, 3049,   86, 3044,
-
-       86, 3046, 3050,   86, 3051,   86,   86,   86,   86, 3054,
-     3052, 3048, 3053, 3055,   86,   86, 3059,   86,   86,   86,
-     3057, 3060,   86,   86, 3063, 3064,   86,   86, 3056, 3058,
-     3061, 3065,   86, 3066,   86,   86,   86,   86, 3067, 3062,
-     3068, 3070,   86,   86, 3073,   86,   86, 3074,   86, 3069,
-     3075,   86,   86, 3077,   86, 3071,   86,   86, 3081, 3082,
-       86, 3078,   86, 3072,   86,   86, 3083, 3076,   86, 3084,
-     3085, 3080, 3086,   86, 3079,   86,   86, 3087,   86,   86,
-     3092,   86,   86,   86,   86, 3091,   86, 3094, 3095,   86,
-       86, 3088, 3097, 3089,   86, 3096, 3090, 3098,   86,   86,
-
-     3101, 3100,   86,   86,   86,   86, 3093, 3099, 3104,   86,
-     3108,   86,   86,   86,   86,   86, 3110, 3645,   86, 3102,
-     3103,   86, 3105, 3107, 3111, 3106, 3109, 3115, 3112, 3114,
-     3117,   86, 3116,   86, 3113, 3118,   86, 3119, 3120,   86,
-       86, 3121,   86, 3122,   86, 3123,   86, 3124,   86, 3125,
-       86,   86,   86,   86,   86,   86, 3127, 3129,   86, 3131,
-       86,   86,   86, 3133,   86,   86, 3126, 3130, 3140, 3134,
-     3138,   86, 3128,   86, 3132, 3139,   86, 3142,   86,   86,
-       86, 3135, 3136,   86, 3137, 3143, 3145,   86, 3141,   86,
-     3146, 3147,   86,   86, 3148, 3149,   86,   86, 3144,   86,
-
-       86,   86, 3150, 3155,   86,   86, 3151,   86, 3152, 3153,
-     3156,   86,   86,   86, 3158,   86, 3157,   86,   86, 3154,
-       86,   86, 3163,   86, 3160, 3167, 3159, 3164,   86, 3166,
-     3161, 3165,   86,   86, 3169,   86,   86, 3162, 3168, 3171,
-       86,   86, 3175,   86,   86,   86, 3170,   86, 3173,   86,
-     3172,   86, 3182, 3176, 3179,   86,   86, 3177,   86, 3174,
-     3180,   86,   86,   86,   86,   86, 3187, 3185, 3183, 3186,
-       86,   86, 3178,   86,   86, 3181, 3189, 3191,   86, 3188,
-       86, 3192, 3184, 3197, 3193,   86, 3190, 3194,   86, 3195,
-       86, 3196,   86,   86,   86, 3201,   86,   86, 3198, 3200,
-
-       86,   86, 3202,   86, 3199, 3203, 3204,   86, 3206,   86,
-       86, 3205, 3210,   86, 3208, 3212,   86,   86,   86,   86,
-       86, 3213,   86,   86, 3207, 3214,   86, 3215, 3209,   86,
-     3216,   86, 3221,   86, 3218,   86,   86,   86, 3211,   86,
-       86, 3219, 3217, 3225,   86,   86,   86,   86, 3222, 3223,
-     3224, 3220, 3230, 3226, 3229,   86, 3227,   86, 3232,   86,
-       86,   86, 3236,   86, 3228, 3237,   86,   86, 3233,   86,
-       86, 3239,   86,   86,   86, 3231, 3240,   86, 3234, 3242,
-     3243,   86,   86, 3241, 3245,   86, 3238, 3235, 3246,   86,
-     3247, 3244,   86,   86, 3248, 3251,   86, 3250, 3249,   86,
-
-     3254,   86, 3256,   86,   86,   86,   86,   86, 3253,   86,
-     3258, 3261,   86, 3252, 3262,   86, 3264,   86,   86, 3259,
-       86,   86,   86, 3257, 3255,   86, 3260, 3267,   86,   86,
-     3265, 3268,   86, 3269,   86, 3263, 3271,   86,   86, 3266,
-     3273, 3270, 3276, 3274,   86,   86,   86,   86,   86, 3280,
-       86,   86,   86,   86, 3282, 3283, 3272, 3278, 3275,   86,
-     3284,   86, 3281, 3277, 3287, 3285, 3279, 3288,   86,   86,
-       86, 3290, 3289,   86,   86, 3293,   86,   86,   86, 3292,
-       86, 3286, 3296, 3294,   86, 3299,   86,   86,   86,   86,
-       86, 3291,   86, 3304,   86,   86,   86,   86,   86, 3295,
-
-     3500, 3297, 3298, 3303, 3300, 3301, 3307, 3308,   86, 3309,
-       86, 3306, 3310,   86, 3302, 3305,   86,   86,   86, 3314,
-       86, 3311,   86, 3313, 3315,   86, 3316,   86, 3317,   86,
-       86, 3312, 3320,   86,   86, 3318, 3322,   86,   86, 3321,
-     3324,   86, 3325,   86,   86,   86,   86,   86,   86, 3323,
-       86, 3331, 3332,   86,   86,   86, 3319,   86,   86,   86,
-       86, 3338,   86, 3326, 3339,   86, 3329, 3327, 3328, 3337,
-     3330, 3335,   86, 3341, 3334,   86,   86, 3340, 3336,   86,
-     3333, 3344,   86, 3346,   86, 3347,   86,   86,   86, 3350,
-       86,   86, 3342, 3348, 3343,   86, 3353,   86,   86, 3352,
-
-       86, 3349, 3351, 3345,   86, 3354,   86,   86, 3355,   86,
-       86, 3356,   86,   86, 3359,   86,   86,   86, 3357, 3361,
-     3362,   86, 3360,   86,   86,   86,   86, 3358,   86,   86,
-       86, 3371, 3374, 3372, 3363, 3375, 3364, 3365,   86, 3366,
-     3367,   86, 3368, 3369, 3370,   86,   86,   86, 3377, 3373,
-     3379,   86, 3380,   86,   86, 3382,   86,   86, 3381, 3378,
-       86, 3376, 3383, 3385,   86, 3645, 3384, 3387,   86, 3388,
-     3389,   86,   86, 3390, 3391, 3386,   86, 3392,   86, 3393,
-     3394,   86,   86,   86,   86, 3395, 3398,   86, 3396, 3399,
-       86,   86, 3401, 3397,   86,   86,   86, 3405,   86,   86,
-
-       86, 3404,   86,   86, 3400,   86,   86, 3409,   86, 3408,
-     3645,   86, 3414,   86, 3402, 3403, 3413, 3410,   86, 3406,
-     3411,   86, 3416,   86, 3412, 3407,   86, 3415, 3417,   86,
-     3418,   86,   86,   86, 3423, 3425,   86, 3420, 3419, 3424,
-       86,   86, 3421,   86,   86, 3422,   86,   86, 3645, 3429,
-     3433, 3426, 3430, 3432,   86,   86,   86, 3428, 3427, 3435,
-       86, 3434, 3436,   86,   86, 3431,   86, 3439,   86, 3440,
-       86, 3438,   86,   86, 3443,   86, 3444,   86,   86, 3437,
-     3645, 3441, 3445,   86, 3446,   86, 3447,   86, 3448,   86,
-       86, 3442, 3449,   86, 3450,   86, 3453,   86,   86, 3452,
-
-     3454,   86,   86,   86, 3451, 3458,   86, 3455,   86, 3460,
-       86,   86,   86,   86, 3456,   86,   86,   86, 3464, 3465,
-       86, 3467,   86, 3457,   86, 3462, 3461, 3459, 3463,   86,
-     3466, 3468, 3469,   86, 3471,   86,   86, 3474,   86, 3473,
-       86,   86,   86,   86,   86, 3476,   86,   86,   86,   86,
-     3470, 3482, 3475, 3472, 3480, 3481,   86,   86, 3479,   86,
-     3477,   86, 3478,   86, 3483,   86, 3486,   86, 3487, 3489,
-       86,   86, 3488, 3490,   86, 3491,   86, 3485,   86,   86,
-     3493,   86, 3484, 3494,   86,   86, 3492, 3495,   86,   86,
-     3499,   86, 3496,   86, 3502, 3498,   86,   86,   86,   86,
-
-       86,   86, 3503, 3501, 3497,   86, 3511,   86, 3509,   86,
-     3504,   86,   86, 3506, 3505, 3508, 3513, 3510, 3515,   86,
-       86,   86,   86, 3507,   86, 3517, 3520,   86, 3512, 3516,
-       86, 3514,   86, 3521,   86, 3518, 3522,   86,   86, 3523,
-     3524,   86, 3519, 3525,   86,   86,   86,   86, 3528, 3526,
-       86, 3529, 3527,   86, 3533, 3530,   86,   86,   86, 3531,
-       86,   86, 3532, 3536, 3537,   86,   86, 3534, 3535, 3539,
-       86, 3540,   86, 3541,   86,   86, 3542, 3538, 3544,   86,
-       86, 3547,   86,   86, 3548, 3543,   86,   86,   86, 3551,
-     3545, 3552,   86,   86, 3549,   86,   86,   86, 3546, 3557,
-
-       86, 3556, 3553, 3558,   86, 3554, 3550,   86,   86,   86,
-       86,   86, 3555,   86, 3562,   86,   86,   86, 3564,   86,
-       86,   86, 3561, 3571,   86, 3569, 3570,   86, 3559, 3560,
-     3566, 3563, 3567,   86, 3565, 3568,   86, 3575,   86,   86,
-     3577,   86, 3578,   86, 3576,   86,   86, 3572, 3579,   86,
-     3580, 3573,   86, 3583, 3581, 3574, 3584,   86,   86,   86,
-     3586,   86,   86, 3585,   86,   86, 3587,   86,   86, 3592,
-       86, 3582, 3589,   86, 3595,   86,   86,   86, 3596,   86,
-       86,   86,   86, 3588,   86, 3597, 3590, 3591, 3598, 3593,
-     3594,   86,   86, 3603,   86, 3602, 3599,   86,   86, 3600,
-
-     3601,   86, 3604,   86, 3607,   86, 3609, 3605,   86, 3610,
-     3606,   86,   86, 3614,   86, 3645, 3611, 3608,   86, 3612,
-     3613,   86,   86, 3615, 3616, 3617,   86,   86, 3618,   86,
-       86,   86, 3623,   86, 3619, 3621,   86,   86,   86,   86,
-       86,   86, 3625, 3626,   86, 3629, 3630,   86, 3620,   86,
-     3622,   86, 3633, 3634,   86, 3624,   86,   86, 3627, 3628,
-     3631, 3636,   86, 3635, 3637,   86,   86,   86, 3632,   86,
-       86, 3645, 3639, 3638, 3640, 3645, 3641, 3643,   86, 3644,
-       86, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3642,
+       78,   86,   22,   72,  122,   86,  121,  110,   86,   79,
+      161,  161,   73,   19,   20,   21,   69,   70,   71,   75,
+       76,   77,   78,  189,   22,   72,   81,   82,   83,  131,
+       90,   79,   90,   90,   73,   90,  171,   84,   81,   82,
+       83,   90,   91,   86,   99,   86,  111,   86,  113,   84,
+       86,  100,   86,   92,   93,  101,  114,   94,  102,   86,
+      112,   86,   95,  116,   96,  236,  117,  115,   86,   86,
+      157,   97,   86,  118,  158,  119,  160,  103,  159,   86,
+      123,  104,  138,   86,  105,   86,  106,  107,  124,  153,
+       86,  127,   86,  163,  125,  128,  163,  108,  126,  154,
+
+       86,  139,  184,  155,  156,  140,  168,  168,   86,  129,
+      209,  130,   86,  132,   86,  141,  142,  133,  143,  144,
+      183,  134,  145,   86,  149,  171,  150,  135,   86,  146,
+      136,  178,  178,  147,  148,  151,  289,  137,   86,  174,
+      165,  152,  165,  165,   90,  165,   90,   90,  170,   90,
+      170,  170,  175,  170,  175,  175,  173,  175,   85,  268,
+       85,   85,   87,   85,   86,   90,   88,   90,   90,   85,
+       90,   86,   86,   86,  180,   86,   90,   91,   86,  181,
+      182,  186,   86,   86,  185,  187,  191,  192,   86,   86,
+       86,   86,  190,  171,  193,  200,   86,   86,  188,   86,
+
+      194,   86,  195,   86,  203,   86,   86,  196,  197,  211,
+      199,  202,  198,  204,  201,   86,  205,  206,  207,   86,
+       86,  210,  219,   86,  213,  208,  215,   86,   86,  216,
+       86,   86,   86,  224,  214,  212,  222,  225,   86,  231,
+       86,   86,  217,  218,   86,  230,  221,  220,   86,   86,
+       86,  234,   86,  226,  229,   86,  223,  227,  235,  238,
+       86,  232,  228,   86,   86,   86,   86,  240,  233,   86,
+      237,  242,  245,   86,  246,  243,   86,   86,  239,   86,
+      248,  244,  241,   86,  251,  247,  254,   86,  179,  249,
+      258,   86,   86,   86,  261,  250,   86,  255,  253,  259,
+
+      257,  256,   86,  252,  260,   86,   86,  266,   86,  264,
+      270,  262,   86,   86,  263,   86,   86,  274,   86,  271,
+      265,   86,  269,  277,  267,  273,  301,  275,  161,  161,
+      163,  272,   86,  163,  276,  278,  165,  171,  165,  165,
+      279,  165,  168,  168,  170,   86,  170,  170,   90,  170,
+       90,   90,  175,   90,  175,  175,   86,  175,  178,  178,
+      173,  280,  281,  283,   86,   86,   86,   86,   86,   86,
+       86,   86,   86,   86,  286,   86,  292,  282,  288,  284,
+       86,  287,  295,   86,  291,   86,  294,  296,  285,  290,
+      299,   86,  293,   86,  297,   86,  300,  302,   86,   86,
+
+       86,  328,  303,  311,  305,  298,   86,  310,   86,  306,
+      312,   86,   86,  315,  307,  313,   86,  314,   86,  304,
+      308,  309,  319,  316,  317,   86,   86,   86,   86,  321,
+       86,  318,  322,   86,   86,   86,   86,   86,   86,   86,
+      329,  330,  323,  336,  324,   86,  326,   86,  325,  327,
+       86,  320,   86,  331,  339,  338,  332,  337,  333,  341,
+       86,   86,  340,  343,  393,   86,  348,  344,  345,   86,
+      334,  342,  335,  346,   86,  349,  351,   86,   86,   86,
+      352,   86,  350,   86,  354,   86,   86,  353,  347,   86,
+       86,  355,  357,   86,   86,   86,  356,   86,   86,   86,
+
+      359,  361,   86,   86,   86,  360,  358,   86,   86,  367,
+      362,  365,   86,   86,   86,  366,  368,   86,   86,  363,
+      372,   86,  374,  364,  370,  373,   86,  369,   86,  378,
+       86,   86,  375,  371,  376,   86,   86,  382,  385,   86,
+      377,  383,  381,   86,  384,   86,  379,  380,   86,   86,
+      388,  389,  391,   86,   86,  387,   86,   86,   86,   86,
+      394,  395,   86,  396,  386,  392,  398,  171,  390,   86,
+       86,   86,   86,  399,   86,  402,   86,  401,   86,  403,
+       86,   86,   86,   86,  405,  407,  410,  397,  409,  411,
+      400,   86,   86,  404,   86,   86,  412,  414,  406,  413,
+
+       86,   86,   86,   86,  408,   86,   86,  421,   86,   86,
+      426,  423,  422,   86,  418,  415,  416,  420,   86,  417,
+      419,   86,   86,  424,   86,  425,   86,  428,   86,  429,
+       86,   86,   86,  431,  433,   86,   86,   86,  438,  434,
+      427,   86,  440,   86,   86,  435,  430,  432,   86,   86,
+      436,  441,  442,   86,  445,   86,  437,  439,   86,  443,
+       86,  447,  448,   86,   86,  446,   86,   86,   86,   86,
+       86,  454,   86,   86,   86,  455,  444,   86,  457,  453,
+       86,   86,  451,  450,   86,  460,   86,  449,   86,  462,
+      452,  456,   86,   86,   86,  465,  458,  466,  459,  461,
+
+      464,   86,  474,   86,  467,   86,  463,   86,   86,   86,
+      476,  483,   86,   86,  486,  487,  468,   86,  502,  469,
+      490,  475,  484,   86,  470,  471,  472,  473,   86,  485,
+      488,  477,  177,  478,   86,  489,   86,  491,  492,   86,
+       86,   86,   86,   86,   86,  479,  480,  481,   86,  482,
+       86,  499,  501,   86,   86,  503,  495,  493,  496,  500,
+      494,  497,  498,   86,  504,   86,   86,   86,   86,   86,
+       86,  507,  512,  505,   86,  513,   86,  514,   86,  508,
+      506,   86,   86,   86,  519,  511,  515,  509,  518,  510,
+       86,  531,   86,  516,   86,   86,  517,  520,  523,  521,
+
+      524,   86,  526,   86,  745,  522,  527,  533,   86,   86,
+      532,  534,   86,   86,   86,  525,   86,   86,   86,  528,
+       86,  535,  529,  549,  530,   86,  536,   86,  537,  551,
+       86,   86,   86,  552,  538,  554,  176,  548,  539,   86,
+       86,  550,  565,  540,  553,  556,  541,   86,  542,  566,
+      543,  555,  567,   86,   86,  171,   86,  568,   86,   86,
+      569,   86,   86,  544,  597,  574,  545,  570,  546,  576,
+      547,   86,  572,  557,  558,   86,  571,  573,  575,  577,
+       86,   86,   86,  559,  560,  561,  562,  563,  581,   86,
+      564,   86,   86,   86,   86,   86,  580,  583,  582,   86,
+
+      588,  579,   86,   86,  589,   86,  578,  591,  587,  585,
+       86,  586,   86,   86,  596,  584,   86,  590,   86,  592,
+       86,  598,  594,  593,   86,   86,  595,  600,  601,  599,
+       86,   86,   86,   86,  171,   86,  602,   86,  608,  607,
+       86,   86,  609,  610,   86,  603,   86,  604,  605,  606,
+      612,   86,   86,  615,   86,  613,  617,   86,   86,  631,
+      611,   86,   86,  616,   86,   86,  621,  622,   86,  633,
+      614,  632,  619,  618,  169,  620,  636,  635,  623,   86,
+      624,   86,   86,  634,   86,   86,  625,   86,   86,   86,
+      640,  638,  639,   86,  626,  627,   86,   86,  628,  629,
+
+       86,  641,  630,   86,  643,  637,  644,  645,   86,  642,
+       86,   86,  648,  647,  649,  646,   86,   86,  652,   86,
+       86,  650,   86,   86,  653,   86,  655,  654,   86,   86,
+       86,  651,   86,   86,  656,  657,  661,   86,   86,   86,
+       86,  665,  660,  663,  664,   86,  667,  659,  658,   86,
+       86,   86,  666,  662,  668,   86,  670,  672,   86,  673,
+       86,   86,   86,   86,   86,   86,   86,   86,   86,  675,
+       86,  669,  679,  671,  677,   86,   86,   86,  686,  167,
+      681,  674,   86,  676,   86,  678,  680,  691,  682,  688,
+      683,  687,   86,  684,  690,   86,  685,   86,   86,   86,
+
+       86,  689,  695,   86,   86,   86,  693,  699,   86,  694,
+      702,  692,   86,   86,  698,  701,   86,  696,   86,  697,
+       86,   86,   86,   86,   86,  705,  708,   86,  700,   86,
+       86,   86,  704,   86,  703,  710,  712,   86,   86,   86,
+       86,  709,  711,  706,  707,  713,   86,   86,   86,   86,
+      715,  727,  714,   86,  716,  726,  854,   86,  724,  717,
+      725,  718,  729,   86,  730,  728,   86,  719,   86,  720,
+      731,   86,  721,  722,   86,  740,  732,   86,  734,  723,
+      733,   86,  735,  739,  737,   86,  741,  738,   86,   86,
+       86,   86,  744,   86,  747,   86,  749,   86,   86,   86,
+
+      742,   86,  736,   86,  743,   86,  753,   86,   86,   86,
+      746,  751,  750,  752,  756,   86,  748,  757,   86,   86,
+      754,   86,   86,   86,  760,  755,  758,  762,  761,  171,
+      759,  764,   86,  763,  765,   86,  766,   86,  769,   86,
+       86,   86,   86,   86,   86,  772,   86,  778,  774,  768,
+       86,  767,   86,   86,  770,  773,  777,   86,  771,  780,
+      776,   86,  779,  781,   86,   86,   86,  775,   86,   86,
+       86,  783,   86,  782,   86,  786,   86,  787,  784,  166,
+       86,  785,  795,   86,  792,  788,  796,   86,  791,  793,
+       86,  798,  789,  794,  797,  790,   86,   86,  799,   86,
+
+      800,   86,  801,   86,  802,   86,   86,   86,   86,  803,
+       86,   86,  808,   86,  807,   86,   86,   86,  806,  811,
+       86,  804,  812,  810,   86,   86,  805,  816,  815,   86,
+       86,   86,  809,   86,  818,   86,  820,   86,   86,  822,
+       86,   86,   86,  813,  814,   86,  829,  825,   86,  817,
+       86,  821,   86,  819,   86,  823,   86,   86,   86,  830,
+       86,  837,  824,   86,  826,   86,  827,  912,  828,   86,
+      831,   86,  832,   86,   86,  836,  838,  833,  840,  839,
+      834,  835,   86,   86,  844,  842,   86,  841,   86,  843,
+       86,  846,  845,   86,   86,   86,   86,  847,  850,  849,
+
+       86,  851,  852,   86,   86,   86,  858,   86,   86,  856,
+       86,   86,   86,   86,   86,   86,  855,  859,  853,  848,
+      861,   86,  865,   86,   86,  857,  863,  869,  867,  860,
+      864,   86,  862,  866,   86,  870,  871,  868,   86,  872,
+       86,   86,   86,  873,   86,   86,  874,   86,   86,  880,
+       86,   86,  878,  883,   86,   86,  881,  882,  876,  877,
+      875,   86,   86,   86,  887,   86,  885,  879,   86,  888,
+       86,   86,   86,   86,  894,   86,  164,  891,  886,  884,
+       86,  889,  896,   86,  890,  898,   86,  899,  897,   86,
+       86,  892,  893,  904,  895,   86,  900,  901,  902,   86,
+
+       86,   86,  908,   86,  910,   86,  906,  909,   86,   86,
+       86,   86,  905,  903,   86,   86,  907,  914,   86,   86,
+       86,  921,   86,   86,   86,   86,  922,   86,  913,  916,
+      911,  915,  917,  923,   86,   86,  918,   86,  919,   86,
+      920,  926,  928,   86,  927,   86,   86,  931,   86,  924,
+      925,  929,  930,   86,   86,   86,   86,   86,  934,  933,
+      938,   86,   86,  932,   86,   86,   86,  935,   86,  948,
+       86,   86,   86,  940,  937,  936,  946,   86,   86,  939,
+      941,  949,  942,  943,  944,  945,  947,   86,   86,  951,
+       86,   86,  950,   86,   86,  954,   86,   86,  952,   86,
+
+       86,  958,  953,   86,  959,  962,   86,  955,   86,  957,
+      960,  963,  956,   86,   86,   86,   86,  162,   86,  171,
+      965,  961,  970,  966,  971,  968,  964,   86,   86,  967,
+      969,   86,   86,   86,  972,   86,  973,   86,   86,   86,
+      977,  974,  975,  980,   86,   86,  981,  983,   86,   86,
+      976,   86,  978,   86,  982,  987,  984,   86,  985,   86,
+      979,   86,   86,   86,   86,   86,  990,  994,   86,   86,
+       86,   86,  986,   86,   86,  991,  988,  995,  996,  989,
+       86, 1008,   86,  993,   86,   86,  997,   86,   86,  992,
+       86,   86, 1058, 1011,  999,  998,   86, 1007, 1000, 1010,
+
+       86, 1001, 1009,   86,   86, 1002, 1013, 1015, 1003,   86,
+     1012,   86, 1014, 1016,   86, 1004, 1005,   86, 1006,   86,
+     1017,   86, 1018,   86, 1022, 1019, 1023,   86,   86, 1020,
+       86, 1021,   86,   86, 1024, 1025,   86, 1026,   86,   86,
+     1027, 1033, 1036, 1032,   86, 1028, 1035,   86, 1034,   86,
+       86, 1029, 1030, 1038, 1031, 1040,   86,   86,   86, 1043,
+     1057, 1042,   86, 1037,   86, 1045, 1041, 1046,   86, 1039,
+      179, 1048, 1047,   86,   86, 1049,   86,   86, 1052,   86,
+       86, 1051, 1044, 1050, 1053,   86,   86,   86, 1054, 1056,
+       86, 1055,   86,   86,   86,   86, 1060,   86, 1064, 1059,
+
+       86,   86, 1063,   86, 1067,   86,   86, 1061,   86, 1071,
+     1065,   86, 1062, 1072, 1066,   86, 1076, 1069, 1074, 1068,
+     1073,   86,   86, 1075,   86, 1077,   86,   86, 1070, 1081,
+     1083,   86,   86,   86,   86,   86,   86, 1082,   86, 1085,
+     1078, 1084, 1086, 1087,   86, 1079,   86, 1080, 1088,   86,
+       86,   86,   86,   86,   86,   86,   86, 1092, 1090, 1093,
+     1094,   86, 1098,   86, 1089,   86, 1101,   86,   86, 1091,
+       86,   86, 1095, 1102, 1099, 1097, 1100, 1096,   86,   86,
+       86,   86,   86,   86,   86, 1110,   86, 1105, 1103, 1106,
+     1104, 1108, 1109,   86,   86,   86, 1116,   86, 1111,   86,
+
+       86, 1117,   86,   86, 1114, 1107,   86, 1119, 1112, 1113,
+     1115,   86,   86, 1118,   86, 1120,   86, 1128,   86, 1125,
+     1122,   86, 1121, 1127,   86,   86,   86, 1126,   86,   86,
+     1130,   86, 1124, 1132,   86,   86, 1123,   86,   86,   86,
+       86,   86, 1142, 1139,   86, 1129, 1137, 1131,   86, 1133,
+       86, 1134,   86, 1143,   86, 1136, 1135,   86, 1140,   86,
+     1141, 1138, 1144,   86,   86, 1148, 1152,   86, 1145,   86,
+       86, 1147, 1149, 1146, 1151,   86,   86, 1150,   86,   86,
+       86,   86,   86,   86,   86, 1155,   86, 1157, 1163, 1153,
+     1164,   86,   86, 1166,   86, 1154,   86, 1165, 1156,   86,
+
+     1158, 1160, 1169, 1159, 1161, 1167, 1162, 1170,   86,   86,
+       86,   86, 1168,   86, 1171,   86,   86,   86, 1177, 1178,
+     1175, 1179,   86, 1173,   86,   86,   86,   86, 1172, 1180,
+       86, 1174, 1183, 1185,   86,   86,   86, 1176,   86,   86,
+     1181, 1187, 1188, 1182, 1184, 1191,   86,   86,   86,   86,
+     1192,  171, 1194, 1186,   86, 1189,   86, 1190,   86, 1195,
+       86, 1193,   86,   86, 1198, 1199,   86,   86,   86, 1196,
+       86,   86,   86, 1213, 1197, 1200, 1212, 1202,   86, 1203,
+     1216,   86, 1214,   86,   86, 1215, 1201, 1204, 1218, 1205,
+       86,   86,   86, 1206,  177, 1207,   86,   86, 1223, 1208,
+
+       86, 1209, 1221, 1224,   86, 1220, 1210, 1219, 1217, 1225,
+     1222, 1211,   86,   86,   86,   86,   86, 1227,   86, 1233,
+       86, 1230,   86, 1235,   86,   86, 1226,   86,   86, 1228,
+     1229, 1231, 1232, 1239, 1238,   86, 1234,   86, 1242, 1236,
+     1241, 1237, 1243, 1240,   86, 1244,   86, 1245,   86, 1246,
+       86,   86,   86,   86,   86,   86,   86,   86,   86, 1261,
+       86, 1258,   86,   86,   86, 1262, 1257,   86,   86, 1260,
+     1248, 1249, 1247,   86, 1250, 1263, 1259, 1264,   86, 1251,
+     1265, 1252, 1266,   86,   86, 1270,   86, 1253,   86,   86,
+       86,   86, 1254, 1255, 1271,   86,   86, 1267, 1272, 1256,
+
+     1269,   86, 1268, 1277,   86, 1278, 1273,   86, 1275, 1280,
+       86, 1274,   86, 1281, 1276,   86,   86,   86, 1285,   86,
+       86, 1283,   86,   86,   86, 1286,   86, 1279,   86,   86,
+     1284, 1282, 1288, 1291,   86, 1289,   86,   86, 1287,   86,
+       86, 1293, 1294, 1292, 1290,   86,   86,   86,   86, 1295,
+     1296,   86, 1303,   86, 1301, 1299, 1300, 1298,   86,   86,
+     1297,   86,   86,   86,   86,   86, 1309,   86, 1302, 1304,
+     1308,   86,   86, 1305,   86,   86,   86, 1319, 1311, 1314,
+     1315, 1306, 1310,   86,   86, 1312, 1313, 1307, 1316, 1317,
+       86, 1320, 1321,   86,   86,   86,   86,   86,   86, 1318,
+
+     1326,   86, 1322,   86, 1328, 1327,   86, 1329, 1324, 1323,
+       86,   86, 1325, 1331,   86,   86, 1330,   86,   86,   86,
+     1338,   86, 1340,   86,   86, 1332,   86,   86,   86, 1342,
+       86, 1334, 1336, 1337, 1333, 1335,   86, 1344, 1341,   86,
+       86, 1339, 1345,   86, 1343, 1347,   86,   86, 1346,   86,
+       86, 1348,   86,   86, 1351, 1352, 1350,   86,   86, 1349,
+       86, 1358,   86, 1354, 1353,   86, 1356,   86,   86, 1355,
+     1359,   86,   86,   86, 1360, 1362,   86, 1363,   86, 1357,
+     1361,   86,   86, 1369, 1367, 1370, 1364, 1371,   86,   86,
+       86,   86, 1365,   86,   86, 1368,   86, 1374, 1366, 1372,
+
+       86, 1373, 1376,   86,   86, 1375, 1378, 1380,   86, 1377,
+     1379,   86,   86,   86, 1382,   86, 1381,   86,   86,   86,
+       86, 1383,   86, 1385,   86, 1388, 1384, 1389,   86,   86,
+       86,   86,   86, 1391,   86, 1395, 1396, 1386,   86, 1387,
+     1390,   86,   86, 1393,   86,   86, 1399,   86, 1392, 1397,
+     1398, 1394,   86,   86,   86, 1404,   86, 1400, 1401,   86,
+       86,   86,   86,  171, 1402, 1406, 1410,   86,   86,   86,
+       86, 1403, 1405,   86, 1412, 1413, 1411,   86,   86, 1407,
+       86, 1409,   86, 1414,   86, 1418, 1408, 1415, 1421,   86,
+     1417, 1419, 1416,   86, 1423, 1424,   86,   86,   86, 1420,
+
+       86,   86, 1426,   86,   86, 1427,   86,   86,   86, 1428,
+       86,   86, 1425, 1422, 1434, 1431,   86, 1433,   86,   86,
+     1429, 1430,   86, 1432,   86, 1435, 1438,   86,   86,   86,
+       86, 1436,   86,   86, 1449, 1442, 1439, 1444, 1437,   86,
+       86,   86, 1440, 1441, 1448,   86, 1445,   86, 1446,   86,
+     1443, 1447, 1450, 1451,   86, 1453, 1452,   86, 1455,   86,
+     1454,   86,   86, 1456,   86, 1461, 1458,   86, 1457,   86,
+       86,   86, 1462,   86, 1466,   86, 1460,   86,   86,   86,
+       86, 1459, 1467, 1463, 1464, 1468,   86,   86,   86, 1465,
+       86, 1470, 1471,   86, 1473,   86, 1472,   86, 1469,   86,
+
+     1476,   86,   86,   86,   86, 1474, 1479,   86,   86, 1477,
+     1478,   86, 1475, 1480, 1484,   86,   86, 1487, 1486,   86,
+       86, 1481, 1483,   86, 1482,   86, 1485,   86, 1490,   86,
+       86, 1497,   86,   86,   86, 1488, 1489,   86, 1499, 1492,
+     1491, 1493,   86,   86,   86,   86, 1494, 1496,   86, 1500,
+       86, 1502,   86, 1498, 1507, 1495, 1501, 1505,   86, 1508,
+       86,   86, 1506,   86, 1504, 1503,   86, 1512,   86,   86,
+     1523,   86,   86, 1529,  176, 1510, 1511, 1509,   86, 1513,
+     1521, 1520, 1522, 1514,   86,   86, 1515, 1516,   86, 1524,
+     1526, 1517,   86,   86, 1525,   86,   86, 1518, 1527,   86,
+
+     1528, 1519,   86, 1531,   86,   86, 1536, 1532, 1537, 1533,
+       86,   86,   86, 1530,   86,   86,   86,   86, 1538, 1534,
+     1539, 1541,   86, 1535,   86,   86, 1544,   86, 1546, 1547,
+     1540, 1542,   86, 1545,   86,   86,   86,   86, 1549, 1548,
+     1543,   86, 1555,   86, 1557, 1550, 1558, 1559,   86,   86,
+     1551,   86, 1552,   86, 1553, 1556, 1554, 1561,   86, 1560,
+       86,   86, 1566,   86,   86,   86, 1562, 1567,   86, 1565,
+     1570,   86, 1568,   86,   86,   86,   86, 1576, 1563, 1564,
+       86, 1577, 1572,   86,   86, 1571, 1569,   86,   86,   86,
+     1575,   86,   86, 1573, 1574, 1579, 1578, 1581,   86,   86,
+
+     1583,   86, 1580, 1582,   86, 1584, 1588,   86,   86, 1587,
+     1590,   86,   86,   86, 1592,   86,   86, 1585, 1591, 1593,
+     1594,   86,   86, 1589, 1597,   86, 1586,   86, 1599,   86,
+       86, 1596,   86, 1600,   86, 1601,   86,   86, 1605,   86,
+     1595,   86,   86,   86,   86, 1610, 1608, 1598,   86,   86,
+       86,   86, 1613, 1611,   86, 1602,   86, 1603, 1604, 1607,
+       86, 1606,   86, 1612, 1609, 1615,   86, 1614,   86,   86,
+       86, 1616,   86, 1617, 1618, 1620, 1621, 1622,   86,   86,
+     1619, 1623,   86, 1625, 1624,   86,   86,   86,   86,   86,
+     1626, 1631, 1632, 1628,   86, 1629,   86,   86,   86, 1633,
+
+     1635, 1634, 1630,   86, 1627,   86,   86,   86, 1639,   86,
+       86,   86, 1636,   86,  171,   86, 1641,   86, 1638,   86,
+     1647, 1648,   86,   86, 1637, 1643,   86,   86, 1649, 1644,
+     1640, 1642, 1651,   86, 1650,   86,   86, 1645,   86,   86,
+       86,   86, 1646,   86, 1659,   86,   86, 1652,   86,   86,
+       86, 1656,   86, 1653, 1657, 1654, 1655, 1663,   86, 1658,
+     1665,   86,   86, 1667, 1669, 1660, 1662, 1664,   86, 1670,
+       86, 1661,   86, 1666,   86,   86,   86,   86,   86,   86,
+     1673, 1668,   86, 1672, 1678,   86, 1671, 1679,   86, 1674,
+     1681, 1675, 1676, 1683, 1680, 1677, 1682,   86,   86,   86,
+
+     1686, 1684,   86,   86, 1689, 1687,   86,   86, 1691, 1685,
+       86,   86,   86,   86,   86, 1692, 1693,   86,   86, 1696,
+       86, 1688,   86,   86, 1701, 1690,   86,   86,   86, 1705,
+     1694, 1702, 1698, 1695,   86,   86,   86, 1697, 1699,   86,
+     1700,   86,   86,   86, 1703,   86, 1706, 1704,   86,   86,
+       86,   86, 1707, 1713,   86, 1709, 1714, 1710, 1708, 1715,
+     1711,   86, 1712,   86,   86, 1717,   86, 1720, 1716,   86,
+       86, 1725, 1719,   86, 1724, 1726,   86,   86, 1722, 1721,
+       86,   86, 1718,   86, 1728, 1729,   86,   86,   86, 1734,
+     1723,   86, 1731, 1730, 1727,   86, 1733, 1735, 1736,   86,
+
+     1737,   86, 1738,   86,   86, 1741,   86,   86,   86, 1732,
+       86, 1742,   86,   86,   86,   86,   86, 1743,   86, 1749,
+       86, 1739, 1748, 1740, 1745,   86,   86, 1746, 1744, 1747,
+       86, 1752, 1755, 1751, 1753, 1757, 1750, 1756,   86,   86,
+     1758,   86,   86, 1760,   86,   86,   86,   86,   86, 1754,
+       86,   86, 1764,   86, 1768, 1763,   86,   86, 1769, 1759,
+       86,   86,   86, 1761, 1762, 1774,   86, 1765,   86, 1767,
+     1766,   86,   86, 1777, 1770,   86, 1772, 1771, 1776,   86,
+       86,   86,   86,   86, 1779, 1775,   86, 1778, 1773,   86,
+       86,   86, 1787,   86,   86,   86, 1788,   86,  171, 1780,
+
+     1781, 1782, 1783, 1784,   86, 1786,   86, 1785, 1795, 1791,
+     1792,   86,   86, 1789, 1790, 1793,   86, 1794,   86, 1796,
+       86,   86,   86,   86, 1800,   86,   86,   86, 1801, 1798,
+       86, 1804,   86, 1797, 1799, 1808,   86, 1809, 1805, 1810,
+       86, 1802, 1813, 1803,   86,   86, 1807, 1806,   86,   86,
+       86,   86,   86,   86, 1814, 1811, 1815, 1812,   86,   86,
+     1821,   86, 1816, 1822,   86, 1824,   86,   86, 1819, 1818,
+     1817,   86,   86, 1820,   86, 1827, 1828, 1826,   86, 1823,
+     1830,   86,   86,   86, 1832,   86, 1831,   86, 1825,   86,
+       86,   86,   86,   86, 1836,   86,   86,   86, 1829,   86,
+
+     1841,   86, 1839, 1833,   86, 1834, 1835,   86,   86,   86,
+       86, 1847, 1842, 1837, 1845, 1838, 1840,   86,   86, 1848,
+       86, 1846, 1843, 1844,   86, 1851, 1850,   86,   86, 1849,
+       86, 1854,   86,   86, 1859,   86,   86,   86, 1857,   86,
+       86, 1860, 1855,   86, 1862,   86,   86, 1853,   86, 1852,
+     1856, 1858, 1866,   86,   86,   86,   86, 1865,   86, 1861,
+     1868, 1870, 1863,   86, 1864, 1869,   86, 1871, 1872,  171,
+       86,   86, 1867,   86, 1874,   86,   86,   86,   86, 1881,
+      169, 1882,   86,   86, 1875, 1873, 1880, 1878, 1885,   86,
+     1876, 1877,   86,   86,   86,   86,   86, 1889, 1887,   86,
+
+     1879, 1886, 1883, 1884, 1890, 1891, 1893,   86,   86, 1896,
+       86,   86,   86, 1894, 1888,   86, 1892,   86,   86,   86,
+       86, 1895,   86, 1898, 1899,   86, 1901,   86, 1902,   86,
+       86,   86, 1907, 1906, 1897,   86, 1903,   86, 1904,   86,
+       86, 1914, 1900, 1911, 1905,   86, 1912,   86,   86, 1909,
+     1915, 1916,   86, 1908,   86,   86, 1922,   86, 1913, 1910,
+     1919, 1918,   86,   86, 1924, 1921, 1925, 1917,   86,   86,
+       86,   86,   86, 1926,   86, 1927,   86, 1928, 1929, 1920,
+       86,   86, 1931,   86,   86, 1930, 1936, 1923,   86, 1932,
+     1937, 1935,   86, 1938,   86, 1940,   86,   86,   86,   86,
+
+     1933,   86, 1939, 1934,   86, 1943,   86,   86,   86, 1942,
+       86,   86, 1944,   86,   86,   86, 1945, 1941,   86,   86,
+       86,   86,   86, 1956,   86, 1947, 1955,   86, 1946, 1950,
+     1948,   86, 1951, 1949, 1952,   86,   86, 1953, 1958, 1954,
+     1961,   86,   86, 1957, 1962,   86,   86, 1959, 1960,   86,
+       86,   86, 1967,   86, 1969,   86, 1971,   86, 1964,   86,
+     1966, 1963,   86,   86, 1970, 1965,   86, 1973,   86, 1975,
+     1968, 1972,   86,   86, 1976, 1974,   86,   86,   86,   86,
+     1977,   86,   86,   86,  167, 1980, 1982, 1983, 1990,   86,
+     1984, 1979, 1981, 1991,   86,   86, 1978, 1985, 1986,   86,
+
+       86,   86, 1989, 1987, 1994, 1995,   86, 1988,   86,   86,
+       86,   86, 1992, 1993,   86, 1998, 1999, 2000,   86,   86,
+       86, 1996,   86,   86, 2002,   86,   86,   86, 1997, 2012,
+       86,   86, 2005,   86,   86, 2007, 2004, 2011, 2008, 2001,
+     2010, 2003,   86,   86, 2006,   86,   86, 2015,   86, 2013,
+     2019, 2009,   86, 2014,   86, 2020,   86, 2021,   86,   86,
+     2017,   86, 2025, 2016, 2018,   86, 2022,   86, 2026,   86,
+       86, 2029,   86, 2031,   86, 2030, 2028, 2024,   86,   86,
+       86,   86,   86, 2023, 2039, 2027, 2035, 2032, 2033, 2040,
+       86, 2034, 2036,   86,   86,   86, 2041,   86, 2038, 2037,
+
+     2044, 2046,   86, 2048,   86,   86, 2049,   86, 2042,   86,
+     2050, 2045,   86, 2052,   86,   86, 2043,   86,   86,   86,
+     2047, 2053, 2057, 2051,   86,   86,   86, 2059,   86, 2061,
+       86,   86, 2056, 2060, 2054,   86,   86, 2055, 2058, 2062,
+       86,   86,   86,   86,   86, 2063, 2067,   86, 2066, 2064,
+       86, 2068,   86, 2070,   86, 2065, 2069, 2074,   86, 2076,
+     2071, 2077,   86,   86, 2072,   86, 2073,   86,   86, 2080,
+       86, 2078,   86,   86, 2081, 2079, 2084,   86, 2086, 2075,
+       86, 2082,   86,   86,   86,   86, 2085, 2090,   86,   86,
+       86, 2083,   86, 2092,   86, 2093,   86,   86, 2088, 2095,
+
+       86, 2089, 2087,   86,   86, 2091, 2097,   86, 2096,  171,
+     2101, 2099, 2094, 2100,   86, 2104,   86,   86,   86, 2098,
+       86, 2102, 2108,   86,   86,   86,   86,   86,   86, 2103,
+     2106, 2109, 2111,   86,   86, 2116, 2105,   86, 2110, 2107,
+     2112,   86,   86,   86,   86, 2113, 2114, 2120,   86, 2117,
+     2119,  166,   86,   86, 2115, 2121, 2123,   86, 2124,   86,
+     2118, 2126,   86, 2122, 2127,   86,   86,   86, 2125,   86,
+       86, 2129,   86, 2130, 2128,   86,   86,   86,   86,   86,
+       86, 2135,   86, 2136,   86,   86, 2131,   86, 2137, 2140,
+       86,   86, 2138, 2133, 2132, 2134, 2141, 2139,   86,   86,
+
+     2148,   86, 2149, 2144, 2146, 2143, 2147,   86,   86, 2142,
+     2145, 2150,   86,   86,   86,   86,   86,   86, 2156,   86,
+       86,   86, 2159, 2151, 2160,   86, 2161,   86, 2163,   86,
+     2154, 2152, 2153,   86, 2157, 2155, 2158, 2162,   86, 2164,
+     2165,   86, 2168,   86,   86, 2170,   86, 2172, 2169, 2171,
+       86,   86, 2174,   86, 2166,   86,   86,   86,   86,   86,
+       86, 2176, 2167, 2178, 2179,   86,   86,   86, 2173, 2182,
+       86, 2181,   86,   86, 2187,   86,   86, 2189, 2175, 2180,
+     2185, 2186, 2177,   86,   86,   86,   86, 2183, 2184, 2188,
+       86,   86,   86,   86, 2197,   86,   86, 2190, 2191, 2192,
+
+       86, 2201, 2200,   86, 2193,   86, 2194,   86, 2195, 2202,
+       86, 2196, 2198, 2199, 2203,   86,   86, 2204, 2206, 2209,
+     2205, 2207, 2208,   86,   86,   86,   86, 2213,   86,   86,
+       86, 2215, 2210,   86,   86,   86, 2218, 2219,   86,   86,
+     2221,   86,   86,   86, 2211,   86,   86, 2212,   86,   86,
+       86, 2226, 2223, 2216, 2224, 2214, 2217,   86,   86, 2220,
+     2230,   86,   86, 2229,   86, 2227, 2228, 2222,   86, 2225,
+       86, 2233,   86,   86, 2236, 2237,   86, 2232, 2240, 2231,
+       86, 2234,   86, 2242,   86, 2241,   86, 2245,   86,   86,
+       86,   86, 2246,   86, 2235, 2244, 2238, 2248, 2239, 2249,
+
+       86,   86,   86,   86,   86,   86, 2243, 2250,   86,   86,
+     2247,   86, 2255, 2251,   86,   86, 2252, 2257,   86,   86,
+     2260,   86, 2261, 2256, 2262, 2253,   86, 2254,   86,   86,
+       86,   86,   86, 2258,   86,   86, 2265, 2270,   86, 2269,
+       86, 2263,   86,   86, 2259,  164, 2264,   86, 2268, 2267,
+       86, 2275, 2266,   86, 2276, 2273, 2277,   86,   86, 2271,
+       86, 2272, 2274, 2279,   86,   86, 2278, 2280,   86, 2281,
+       86, 2282, 2284,   86,   86,   86, 2283,   86,   86,   86,
+     2288, 2292,   86,   86, 2286,  162,   86,   86, 2295, 2285,
+       86, 2297,   86, 2287,   86, 2298,   86, 2289, 2290, 2291,
+
+     2293, 2294,   86, 2296,   86, 2300, 2299,   86,   86, 2305,
+       86, 2306,   86, 2304,   86, 2301, 2307, 2309, 2310,   86,
+     2302, 2308,   86,   86,   86,   86, 2314, 2303,   86,   86,
+     2312, 2313,   86,   86,   86,   86, 2318, 2316, 2320,   86,
+     2311, 2315, 2322,   86,   86,   86, 2317,  171,   86, 2323,
+       86,   86, 2326, 2319,   86,   86, 2331,   86,   86,   86,
+       86, 2321, 2324, 2327, 2330, 2325, 2328,   86,   86, 2333,
+     2332, 2334,   86, 2337, 2329, 2335,   86,   86, 2336,   86,
+       86,   86,   86, 2338,   86, 2339,   86, 2340,   86, 2342,
+       86, 2341, 2343,   86,   86,   86, 2346, 2344, 2345,   86,
+
+     2347,   86, 2348,   86, 2349, 2350,   86,   86, 2352,   86,
+     2351,   86, 2353,   86, 2354, 2355,   86,   86,   86,   86,
+       86, 2362, 2357, 2360,   86, 2361,   86,   86,   86, 2356,
+       86,   86, 3777,   86,   86, 2358,   86, 2359,   86, 2364,
+       86, 2367, 2363, 2370, 2365, 2366, 2369, 2371,   86, 2373,
+       86,   86, 2368, 2372,   86,   86,   86, 2376,   86, 2374,
+     2377, 2379,   86, 2375,   86,   86,   86, 2378, 2380,   86,
+     2386,   86, 2381,   86, 2382, 2389,   86,   86, 2388,   86,
+     2383, 2384,   86, 2385, 2392,   86,   86,   86, 2387, 2394,
+       86,   86, 2395, 2390, 2393,   86, 2398,   86,   86,   86,
+
+     2391, 2397,   86,   86,   86, 2400,   86, 2403,   86, 2404,
+     2396, 2399,   86,   86,   86,   86,   86, 2405,   86, 3777,
+       86, 2401,   86, 2402, 2407, 2406, 2408, 2410, 2409, 2412,
+     2414,   86,   86, 2413,   86, 2415,   86,   86,   86, 2417,
+     2418,   86, 2411, 2419,   86, 2416, 2423, 2424,   86,   86,
+       86, 2421, 2427, 3777,   86, 2422, 2420,   86, 2426, 2425,
+       86,   86, 2428, 2431, 2429, 2430,   86,   86, 2432,   86,
+       86, 2433, 2436,   86, 2434,   86,   86, 2439, 2435, 2437,
+       86, 2442,   86,   86,   86, 2438, 2444,   86, 2446,   86,
+       86,   86,   86,   86, 2449, 2440, 2448, 2445, 2450,   86,
+
+     2441,   86, 2443,   86, 2451,   86, 2455,   86,   86, 2459,
+       86,   86,   86, 2456, 2460,   86, 2447,   86,   86, 2452,
+     2457, 2453, 2458,   86,   86, 2454, 2461, 2465,   86,   86,
+     2462, 2463,   86, 2466,   86, 2464, 2470,   86,   86, 2468,
+     2467,   86,   86, 2471,   86,   86, 2472, 2476,   86, 2474,
+       86,   86, 2478,   86, 2469, 2473,   86, 2475,   86, 2479,
+       86,   86, 2477, 2482, 2483, 2480, 2481,   86,   86,   86,
+     2486,   86, 2488,   86, 2487,   86, 2484, 2489,   86, 2485,
+     2491, 2490,   86,   86,   86, 2492,   86,   86, 2493, 2495,
+       86, 2496, 2501,   86, 2494, 2498, 2497,   86,   86, 2500,
+
+       86,   86,   86,   86,   86,   86,   86, 2499, 2509,   86,
+       86,   86,   86,   86, 2513, 2502, 2503, 2505, 2504, 2507,
+       86, 2508, 2510, 2511, 2512, 2514,   86, 2506,   86,   86,
+     2516,   86,   86,   86, 2517, 2515, 2520, 2519,   86,   86,
+     2525,   86,   86,   86, 2521, 2527,   86, 2518, 2524,   86,
+     2522, 2526,   86, 2530,   86,   86, 2528, 2531, 2523, 2534,
+      171,   86, 2529, 2536, 2538,   86, 2539, 2532, 2537,   86,
+       86,   86,   86,   86, 2533,   86, 2540, 2543,   86, 2541,
+       86, 2542, 2535,   86, 2544, 2548,   86,   86, 2549, 2547,
+       86, 2552,   86, 2551,   86,   86, 2554,   86, 2545, 2553,
+
+     2555,   86, 2550,   86, 2557,   86,   86,   86, 2556, 2546,
+       86, 2558, 2559,   86,   86,   86,   86, 2560,   86, 2563,
+       86, 2566,   86,   86,   86, 2561,   86, 2572,   86, 2570,
+       86, 2562,   86, 2565, 2573,   86, 2568,   86, 2564,   86,
+     2567,   86, 2575, 2569,   86,   86,   86, 2574, 2571,   86,
+       86, 2581,   86, 2576, 2584,   86, 2579,   86,   86, 2578,
+     2585,   86, 2582,   86, 2580, 2577,   86,   86, 2583,   86,
+       86,   86, 2595,   86,   86, 2596, 2586, 2587,   86, 2593,
+     2588,   86,   86,   86,   86, 2601, 2589, 2599, 2591, 2597,
+     2590, 2592, 2594,   86,   86, 2598, 2603,   86,   86, 2600,
+
+       86,   86,   86, 2604, 2602, 2605,   86, 2606,   86, 2610,
+     2611,   86,   86,   86, 2612, 2608, 2613,   86,   86, 2609,
+       86,   86,   86, 2617, 2607,   86, 2618, 3777, 2614, 2619,
+       86,   86, 2620, 2615, 2616, 2621,   86, 2622,   86, 2625,
+       86, 2626,   86,   86,   86, 2629,   86, 2623, 2627, 2628,
+     2624,   86, 2632,   86, 2633,   86,   86, 2635,   86,   86,
+     2637,   86,   86, 2631,   86,   86, 2630, 2639, 2640,   86,
+     2641,   86,   86,   86, 2643, 2634,   86, 2636,   86, 2638,
+       86, 2644, 2646,   86,   86,   86, 2642, 2650,   86, 2649,
+     2645,   86, 2647, 2652,   86, 2648,   86,   86,   86,   86,
+
+       86, 2654, 2656, 2655, 2651,   86, 2657, 2659,   86, 2653,
+       86,   86, 2662,   86, 2666, 2661,   86, 2660, 2665,   86,
+       86, 2658,   86,   86,   86,   86, 2663, 2672,   86, 2671,
+       86,   86, 2664,   86,   86,   86, 2667, 2668, 2674, 2670,
+       86, 2676, 2678,   86,   86,   86, 2669,   86, 2681, 2673,
+     2675, 2679, 2680,   86,   86, 2677,   86, 2686,   86,   86,
+       86, 2688, 2682,   86, 2692, 2683, 2689, 2687, 2684,   86,
+       86,   86, 2693,   86, 2694,   86, 2695,   86, 2696,   86,
+     2685, 2690,   86, 2691,   86,   86,   86,   86, 2700, 2701,
+     2698, 2703, 2704,   86,   86, 2707, 2708,   86, 2705,   86,
+
+     2697,   86,   86, 2699, 2711,   86,   86,   86,   86, 2706,
+       86, 2702, 2712, 2713, 2710,   86,   86,   86, 2709, 2715,
+     2716, 2723,   86,   86,   86, 2718,   86,   86, 2724,   86,
+     2714, 2719, 2720, 2721,   86, 2717,   86,   86,   86, 2730,
+     2722, 2725,   86, 2729,   86,   86,   86, 2728,   86, 2726,
+       86, 2731,  171, 2733,   86, 2734, 2727, 2735,   86, 2732,
+     2740,   86,   86,   86, 2738,   86, 2736,   86, 2737,   86,
+       86,   86, 2742,   86, 2739,   86, 2747, 2741,   86, 2743,
+     2748, 2744, 2746, 2756, 2745, 2751,   86,   86, 2752,   86,
+     2750, 2749, 2753,   86,   86,   86, 2757, 2754,   86,   86,
+
+     2755,   86,   86, 2759,   86,   86, 2761, 2758,   86,   86,
+       86, 2765, 2766, 2760,   86, 2763,   86,   86,   86, 2768,
+     2762, 2769,   86, 2771,   86, 2770,   86,   86, 2764,   86,
+     2767, 2772, 2773,   86,   86,   86, 2778,   86, 2774, 2777,
+       86,   86, 2775,   86,   86,   86, 2780,   86,   86,   86,
+       86, 2788, 2785, 2779, 2776, 2787,   86,   86,   86, 2790,
+       86, 2784, 2789, 2781, 2782, 2783,   86, 2791,   86, 2786,
+       86,   86,   86, 2797,   86, 2801, 2795,   86, 2792,   86,
+       86,   86, 2800,   86, 2802, 2804,   86, 2793,   86, 2794,
+       86, 2798,   86, 2796, 2803,   86, 2799, 2805,   86, 2808,
+
+       86,   86, 2810, 2809,   86,   86, 2806, 2811,   86, 2807,
+       86, 2813,   86, 2815,   86, 2817,   86,   86, 2816,   86,
+     2812,   86, 2819,   86, 2821,   86, 2820,   86, 2818,   86,
+       86,   86,   86,   86,   86, 2825, 2814, 2822,   86, 2829,
+       86, 2823,   86, 2830,   86, 2824, 2831,   86, 2832,   86,
+     2827,   86, 2833,   86, 2828,   86, 2835, 2826,   86,   86,
+     2834,   86, 2840, 2839, 2837, 2841, 2838, 2836,   86, 2843,
+       86,   86,   86,   86,   86,   86, 2847, 2850,   86, 2846,
+     2842, 2845,   86,   86,   86,   86, 2851, 2844,   86,   86,
+     2849,   86, 2848,   86, 2856, 2857,   86,   86,   86,   86,
+
+     2860, 2863, 2858, 2852, 2853, 2854, 2855, 2859,   86,   86,
+       86, 2861,   86, 2862,   86,   86,   86, 2867, 2871,   86,
+       86,   86,   86, 2864, 2865, 2870, 2866, 2873,   86, 2874,
+       86, 2875,   86, 2876,   86, 2868, 2869, 2872,   86,   86,
+     2877,   86, 2880,   86, 2879,   86, 2881,   86, 2882,   86,
+       86,   86, 2878,   86,   86, 2883, 2889,   86,   86, 2891,
+       86,   86, 2885, 2892,   86, 2894,   86,   86,   86, 2884,
+     2888, 2886, 2893,   86, 2887, 2896,   86, 2890,   86, 2895,
+       86,   86,   86, 2899,   86, 2897, 2902,   86, 2904,   86,
+       86, 2903,   86,   86,   86,  171, 2898,   86,   86, 2913,
+
+     2900, 2901,   86, 2907, 2911,   86,   86, 2912, 2909,   86,
+     2905,   86, 2906,   86, 2914,   86,   86, 2908,   86, 2910,
+       86, 2915,   86, 2920, 2916, 2955,   86, 2922,   86, 2917,
+     2921, 2923, 2924,   86,   86, 2918, 2925,   86, 2919,   86,
+     2926,   86, 2927,   86, 2928, 2930, 2929,   86,   86,   86,
+       86,   86,   86,   86,   86,   86,   86, 2939, 3777,   86,
+       86,   86, 2937, 2932,   86, 2943, 2931,   86, 2934, 2933,
+       86, 2944, 2936, 2935, 2938, 2946, 2940, 2941, 2942, 2945,
+       86,   86, 2949,   86,   86, 2951,   86,   86,   86,   86,
+     2948,   86, 2947, 2950,   86,   86,   86,   86,   86,   86,
+
+     3777, 2961, 2963,   86,   86, 2952, 2953, 2954,   86, 2956,
+     2960, 2962,   86, 2957, 2958, 2959, 2964,   86, 2965,   86,
+     2968,   86, 2969,   86, 2970, 2967, 2966,   86,   86,   86,
+       86, 2974,   86,   86, 2977,   86,   86, 2976,   86,   86,
+       86,   86,   86,   86, 2973, 2971, 2972, 2975, 2984, 2986,
+       86, 2981, 2982,   86,   86, 2985, 2978,   86, 2979, 2980,
+       86,   86, 2983, 2987, 2988,   86, 2990,   86,   86,   86,
+       86,   86,   86, 2989, 2994,   86, 2996,   86,   86, 2991,
+     2992,   86, 3002,   86, 3001,   86,   86, 2993, 3005,   86,
+     2995,   86, 2997,   86, 2998,   86, 3000, 2999,   86, 3008,
+
+     3003,   86, 3006,   86, 3004,   86,   86,   86, 3007, 3011,
+     3012, 3013,   86, 3009,   86,   86, 3010,   86, 3014,   86,
+     3020,   86, 3015, 3018,   86,   86,   86,   86, 3024,   86,
+     3023, 3025,   86, 3022, 3016,   86, 3017, 3021,   86, 3019,
+     3027,   86,   86, 3028, 3029,   86,   86,   86, 3026, 3033,
+       86,   86, 3035,   86,   86, 3038,   86, 3031, 3030,   86,
+       86,   86, 3036, 3045,   86,   86, 3032,   86, 3034,   86,
+       86,   86, 3039, 3040, 3041,   86, 3037,   86, 3042, 3043,
+     3044,   86, 3047, 3048,   86, 3046, 3049,   86,   86, 3051,
+       86,   86, 3050, 3052,   86,   86, 3054,   86, 3053,   86,
+
+     3055,   86, 3056,   86, 3058,   86, 3059, 3061,   86,   86,
+     3057,   86, 3060, 3062,   86,   86, 3063, 3065,  171,   86,
+     3067,   86, 3064, 3068, 3070, 3777, 3066, 3069,   86,   86,
+       86,   86, 3072, 3071, 3074,   86, 3073, 3075,   86, 3076,
+       86, 3078,   86,   86, 3080,   86, 3079,   86, 3077, 3081,
+       86,   86, 3082,   86, 3085,   86, 3083, 3086,   86, 3084,
+       86,   86,   86, 3087, 3088,   86, 3092, 3093,   86,   86,
+     3090,   86,   86,   86, 3094,   86, 3089, 3096,   86,   86,
+     3095,   86, 3097, 3100, 3098,   86, 3091,   86, 3099,   86,
+       86,   86, 3101,   86, 3102, 3103,   86,   86, 3108, 3104,
+
+       86,   86, 3106,   86, 3105, 3107, 3111, 3110,   86, 3109,
+     3113,   86,   86,   86,   86,   86,   86, 3114,   86, 3119,
+       86,   86, 3120,   86,   86, 3124, 3112,   86,   86,   86,
+       86, 3115, 3122, 3116, 3117,   86, 3123, 3118, 3126,   86,
+     3121, 3128,   86, 3125,   86, 3127,   86,   86, 3133,   86,
+     3135, 3132, 3136,   86, 3129,   86,   86, 3139,   86, 3130,
+     3140,   86,   86,   86, 3134,   86, 3131,   86,   86,   86,
+     3141, 3146, 3137, 3138, 3143,   86, 3144,   86, 3147,   86,
+       86, 3145,   86, 3148, 3151,   86,   86,   86, 3153,   86,
+     3142, 3155,   86,   86, 3157,   86, 3150,   86, 3149, 3158,
+
+       86, 3152, 3159,   86,   86,   86, 3162, 3154, 3160,   86,
+     3161, 3163,   86,   86,   86, 3167, 3156,   86, 3165,   86,
+     3168,   86,   86,   86,   86, 3173, 3166, 3174,   86, 3164,
+       86, 3169, 3175,   86, 3176,   86,   86, 3170,   86, 3177,
+       86,   86, 3171, 3172, 3180,   86, 3183,   86, 3181,   86,
+     3184, 3178,   86, 3179, 3185,   86, 3187,   86,   86,   86,
+       86, 3182, 3191, 3192,   86,   86, 3194, 3186,   86, 3193,
+       86, 3188,   86, 3196, 3190, 3195,   86, 3189, 3197,   86,
+       86,   86,   86, 3202,   86,   86,   86,   86, 3201,   86,
+     3204, 3205,   86,   86,   86, 3207,   86, 3208, 3206, 3198,
+
+     3199, 3200,   86,   86, 3211, 3210,   86,   86,   86, 3203,
+     3209, 3214,   86, 3212, 3213, 3218,   86,   86,   86,   86,
+       86, 3220,   86,   86, 3777, 3215, 3217,   86, 3216, 3221,
+     3224, 3219, 3225, 3222,   86, 3227, 3240, 3226,   86, 3223,
+     3228,   86, 3229, 3230,   86,   86, 3231,   86, 3232,   86,
+     3233,   86, 3234,   86, 3235,   86,   86,   86,   86,   86,
+     3239, 3237,   86,   86, 3242,   86,   86,   86, 3244,   86,
+       86, 3236, 3241, 3251, 3245, 3249,   86, 3238, 3250,   86,
+       86, 3243, 3253,   86,   86,   86, 3246, 3247,   86, 3248,
+     3254, 3257,   86, 3255,   86, 3252, 3259,   86,   86,   86,
+
+       86, 3258,   86, 3256, 3260, 3261,   86, 3262,   86, 3263,
+     3264,   86,   86, 3268,   86, 3269,   86, 3265,   86,   86,
+     3267, 3266, 3270,   86,   86,   86,   86, 3276, 3271,   86,
+       86,   86, 3277,   86,   86, 3273, 3282,   86, 3279,   86,
+     3274, 3280, 3272, 3278, 3283,   86, 3275, 3285,   86, 3281,
+       86,   86,   86, 3284, 3289,   86, 3290,   86,   86, 3292,
+       86,   86,   86,   86, 3286,   86,   86, 3291, 3295,   86,
+     3288, 3296, 3293, 3298,   86,   86, 3287,   86, 3299,   86,
+     3301,   86, 3302,   86, 3303,   86, 3294,   86,   86, 3297,
+     3304,   86, 3305,   86, 3308, 3300,   86, 3309, 3306, 3310,
+
+       86,   86, 3307, 3311,   86, 3312,   86,   86, 3317,   86,
+     3313, 3314, 3316,   86,   86, 3315,   86,   86, 3318, 3320,
+       86, 3319,   86,   86,   86, 3326,   86, 3321, 3324, 3322,
+       86,   86, 3328,   86, 3329,   86,   86,   86, 3332,   86,
+     3330, 3331, 3325, 3323,   86,   86,   86, 3337,   86,   86,
+       86, 3327,   86,   86,   86,   86,   86, 3341, 3333, 3334,
+     3335,   86, 3338, 3339, 3342, 3340, 3336,   86,   86, 3345,
+     3343,   86, 3346,   86, 3349, 3344,   86,   86,   86, 3353,
+       86, 3354,   86,   86, 3356, 3350,   86,   86, 3347, 3357,
+       86, 3348,   86, 3359,   86, 3351, 3360,   86, 3361,   86,
+
+     3358,   86, 3355,   86, 3352, 3363,   86,   86, 3366,   86,
+     3364, 3369,   86, 3362, 3368,   86,   86, 3365, 3372,   86,
+     3374,   86,   86, 3367,   86, 3371,   86, 3376,   86,   86,
+       86, 3380,   86, 3381,   86, 3370,   86,   86, 3383,   86,
+       86, 3375, 3373, 3377,   86, 3384,   86, 3378, 3379, 3387,
+       86, 3388,   86,   86, 3382, 3391,   86,   86, 3385,   86,
+       86, 3389,   86, 3386, 3396,   86,   86,   86, 3393, 3394,
+       86, 3400,   86, 3390,   86, 3392, 3777, 3398,   86, 3395,
+       86, 3397, 3401, 3402,   86, 3407, 3399, 3403,   86, 3404,
+     3405,   86, 3408,   86, 3406,   86, 3410,   86, 3409,   86,
+
+     3413,   86,   86,   86, 3412,   86, 3416,   86, 3414,   86,
+     3419,   86,   86,   86,   86, 3411,   86, 3424,   86, 3420,
+       86,   86, 3441,   86, 3415,   86, 3417, 3418,   86, 3423,
+     3431, 3421, 3427, 3428,   86,   86, 3426, 3429,   86, 3422,
+     3425, 3430,   86,   86, 3434,   86, 3435,   86, 3433, 3432,
+     3436,   86,   86, 3438,   86,   86,   86,   86, 3443,   86,
+       86, 3437, 3442, 3445,   86, 3446,   86,   86, 3439,   86,
+       86,   86,   86,   86, 3452,   86, 3444, 3453,   86,   86,
+       86,   86, 3440,   86,   86,   86, 3447, 3459,   86, 3461,
+     3450, 3448, 3449, 3458, 3451, 3456, 3460,   86, 3455,   86,
+
+     3457, 3454, 3463, 3464,   86,   86,   86,   86,   86, 3777,
+     3466, 3467, 3469,   86, 3470,   86,   86, 3462,   86, 3473,
+       86, 3471,   86, 3465, 3478,   86,   86,   86, 3468, 3476,
+       86, 3477, 3472,   86, 3474, 3475,   86,   86, 3479,   86,
+       86,   86,   86,   86, 3482,   86,   86, 3484,   86,   86,
+     3485,   86, 3483,   86,   86,   86, 3480, 3481,   86, 3494,
+     3495,   86, 3486, 3777, 3490, 3487, 3488, 3489, 3491, 3492,
+     3497,   86,   86, 3777, 3493,   86,   86, 3498, 3496,   86,
+       86, 3499, 3500,   86, 3501, 3502,   86, 3503,   86,   86,
+     3505, 3506,   86, 3504,   86, 3509,   86,   86, 3523, 3507,
+
+     3511,   86, 3508, 3512, 3513,   86,   86, 3514, 3515, 3519,
+       86,   86, 3510, 3516,   86, 3517, 3518,   86,   86,   86,
+     3521,   86, 3520, 3522,   86, 3525,   86,   86, 3526,   86,
+       86, 3530,   86, 3524,   86, 3529,   86,   86,   86,   86,
+       86, 3527,   86, 3535,   86, 3534,   86, 3597,   86, 3528,
+       86, 3536, 3531, 3539,   86, 3537, 3532, 3540,   86, 3541,
+       86, 3542, 3533,   86, 3538, 3543,   86, 3544,   86, 3545,
+       86,   86, 3549, 3551,   86, 3546,   86, 3550,   86,   86,
+     3547,   86,   86, 3548,   86, 3777, 3555, 3556, 3552, 3553,
+     3558,   86, 3559,   86, 3561,   86,   86, 3554,   86, 3560,
+
+     3562,   86,   86, 3557, 3565,   86,   86, 3564, 3567,   86,
+       86, 3563,   86, 3570,   86, 3571,   86, 3572,   86, 3568,
+     3566, 3573,   86, 3574,   86, 3575,   86, 3576,   86,   86,
+     3569, 3577,   86,   86, 3580,   86, 3581,   86,   86,   86,
+       86,   86, 3579, 3586,   86,   86,   86, 3582, 3588,   86,
+       86, 3583,   86,   86,   86, 3578, 3585,   86, 3592,   86,
+     3584, 3589,   86, 3590, 3587, 3591, 3593,   86, 3602, 3594,
+     3595,   86,   86, 3599,   86,   86,   86, 3596, 3598, 3601,
+     3600,   86,   86,   86,   86,   86, 3604,   86,   86, 3603,
+       86, 3608, 3610,   86, 3612,   86, 3609,   86,   86, 3607,
+
+       86, 3605, 3606, 3615,   86, 3611,   86, 3616, 3618,   86,
+     3619,   86,   86, 3617, 3620,   86,   86, 3614, 3621,   86,
+       86, 3613,   86,   86, 3624, 3623,   86,   86,   86, 3622,
+       86, 3632, 3625, 3629,   86,   86, 3626, 3628,   86,   86,
+     3630,   86, 3631,   86,   86,   86, 3627, 3633,   86,   86,
+       86,   86,   86, 3639, 3634, 3641,   86, 3635,   86, 3636,
+     3638, 3640,   86, 3643, 3646,   86, 3637, 3644,   86, 3642,
+       86, 3645, 3649, 3648, 3651,   86, 3647,   86, 3653,   86,
+       86, 3654, 3655,   86, 3656,   86, 3652,   86,   86,   86,
+     3650,   86, 3659,   86,   86,   86, 3660, 3664, 3661,   86,
+
+       86,   86,   86,   86, 3668,   86, 3657, 3667, 3658,   86,
+     3663,   86, 3666, 3665, 3670,   86, 3671,   86,   86, 3662,
+       86, 3669, 3672,   86, 3673,   86, 3674,   86, 3675, 3676,
+       86, 3679,   86, 3677,   86, 3680,   86, 3683, 3678, 3684,
+       86,   86,   86,   86, 3681,   86, 3682,   86, 3689,   86,
+     3690,   86, 3688,   86, 3685, 3686,   86,   86,   86,   86,
+     3687,   86, 3694,   86,   86,   86, 3696,   86,   86,   86,
+       86, 3693,   86, 3701, 3691, 3702, 3692, 3698, 3699, 3695,
+     3703,   86, 3697,   86, 3707,   86, 3700,   86, 3709, 3704,
+     3705,   86, 3708,   86,   86,   86, 3710, 3715, 3711,   86,
+
+       86,   86, 3706,   86, 3712, 3713, 3716,   86,   86,   86,
+     3714, 3718,   86, 3717,   86,   86, 3721,   86, 3719, 3724,
+     3720,   86,   86,   86, 3727,   86, 3728,   86,   86,   86,
+       86,   86,   86, 3731, 3722, 3726, 3723,   86, 3729,   86,
+     3725, 3730,   86, 3735, 3736, 3734,   86,   86, 3739, 3732,
+     3733,   86,   86, 3741,   86, 3742,   86,   86,   86, 3737,
+       86, 3743,   86, 3738, 3744, 3746,   86, 3747,   86,   86,
+     3740, 3748, 3749,   86,   86, 3750,   86, 3745,   86, 3752,
+       86, 3751,   86, 3753, 3755,   86,   86, 3757,   86,   86,
+       86, 3758,   86, 3761,   86, 3754, 3762,   86,   86, 3756,
+
+       86, 3765, 3766,   86,   86, 3767,   86, 3759, 3760, 3763,
+     3768,   86,   86, 3764, 3769,   86,   86,   86, 3777, 3770,
+     3777, 3771, 3772, 3773, 3777, 3774, 3775,   86, 3776,   86,
        47,   47,   47,   47,   47,   47,   47,   52,   52,   52,
-
        52,   52,   52,   52,   57,   57,   57,   57,   57,   57,
        57,   63,   63,   63,   63,   63,   63,   63,   68,   68,
        68,   68,   68,   68,   68,   74,   74,   74,   74,   74,
        74,   74,   80,   80,   80,   80,   80,   80,   80,   89,
-       89, 3645,   89,   89,   89,   89,  160,  160, 3645, 3645,
-     3645,  160,  160,  162,  162, 3645, 3645,  162, 3645,  162,
-      164, 3645, 3645, 3645, 3645, 3645,  164,  167,  167, 3645,
-     3645, 3645,  167,  167,  169, 3645, 3645, 3645, 3645, 3645,
-      169,  171,  171, 3645,  171,  171,  171,  171,  174, 3645,
-     3645, 3645, 3645, 3645,  174,  177,  177, 3645, 3645, 3645,
-
-      177,  177,   90,   90, 3645,   90,   90,   90,   90,   17,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645
+       89, 3777,   89,   89,   89,   89,  161,  161, 3777, 3777,
+     3777,  161,  161,  163,  163, 3777, 3777,  163, 3777,  163,
+
+      165, 3777, 3777, 3777, 3777, 3777,  165,  168,  168, 3777,
+     3777, 3777,  168,  168,  170, 3777, 3777, 3777, 3777, 3777,
+      170,  172,  172, 3777,  172,  172,  172,  172,  175, 3777,
+     3777, 3777, 3777, 3777,  175,  178,  178, 3777, 3777, 3777,
+      178,  178,   90,   90, 3777,   90,   90,   90,   90,   17,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777
     } ;
 
-static yyconst flex_int16_t yy_chk[7151] =
+static yyconst flex_int16_t yy_chk[7391] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -2436,784 +2506,810 @@ static yyconst flex_int16_t yy_chk[7151] =
         5,    3,    6,   24,    4,   24,   24,    5,   24,    6,
         7,    7,    7,    7,   24,    7,    8,    8,    8,    8,
        33,    8,    7,    9,    9,    9,   26,   26,    8,   10,
-       10,   10,   19,   29,    9,   33,   19,   29, 3653,   35,
+       10,   10,   19,   29,    9,   33,   19,   29, 3785,   35,
        10,   11,   11,   11,   11,   11,   11,   13,   13,   13,
 
-       13,   34,   13,   11,   35,   99,   34,   29,   38,   13,
+       13,   34,   13,   11,   35,  100,   34,   29,   38,   13,
        51,   51,   11,   12,   12,   12,   12,   12,   12,   14,
-       14,   14,   14,   99,   14,   12,   15,   15,   15,   38,
-       23,   14,   23,   23,   12,   23,   46,   15,   16,   16,
-       16,   23,   23,   25,   27,   27,   25,   25, 2962,   16,
-       25,   46,   27,   30,   30,   25,   27,   56,   40,   27,
-       56,   73,   31,   31,   25,   28,   67,   67,   30,   32,
-       28,   31,   40,   32,   28,   73,   32,   28,   92,   28,
-       28,   92,   31,   32, 1154,   32,   36,   36,   37,   37,
-       28,   45,   45,   37,   97,   36,   45,   97,   41,   41,
-
-       45,   36,   87,   41,   93,   36,   87,   37,   93,   37,
-       39,   39,   42,   41,   41,   39,   41,   42,   96,   39,
-       42,   43,   43,  105,   43,   39,   44,   42,   39,  101,
-       44,   42,   42,   43,   94,   39,   84,   84,   96,   43,
-       44,   94,  105,  101,   44,   44,   62,  192,   62,   62,
-       70,   62,   70,   70,   72,   70,   72,   72,   79,   72,
-       79,   79,   70,   79,   86,   95,   86,   86,   89,   86,
-       89,   89,  192,   89,  100,   86,  102,   95,   98,   89,
-       89,   98,  102,  100,  103,  104,  106,  107,  102,  113,
-      102,  109,  106,  113,   98,  108,  111,  140,  114,  112,
-
-      108,  107,  103,  103,  110,  106,  116,  104,  115,  108,
-      119,  109,  140,  115,  111,  110,  110,  112,  114,  117,
-      116,  118,  117,  110,  122,  117,  120,  118,  123,  119,
-      121,  120,  124,  121,  125,  130,  124,  121,  117,  117,
-      127,  125,  123,  122,  126,  128,  118,  127,  122,  129,
-      132,  120,  131,  121,  128,  130,  131,  126,  134,  133,
-      135,  136,  129,  133,  138,  135,  137,  137,  132,  135,
-      139,  141,  142,  144,  139,  135,  134,  177,  146,  150,
-      151,  136,  143,  139,  138,  143,  144,  145,  149,  139,
-      146,  142,  148,  145,  147,  147,  143,  141,  150,  148,
-
-      143,  151,  152,  153,  149,  153,  155,  154,  156,  157,
-      148,  155,  147,  227,  153,  147,  158,  159,  152,  154,
-      156,  158,  161,  161,  179,  163,  153,  157,  163,  179,
-      165,  159,  165,  165,  227,  165,  168,  168,  170,  181,
-      170,  170,  171,  170,  171,  171,  173,  171,  175,  173,
-      175,  175,  180,  175,  171,  178,  178,  181,  180,  182,
-      183,  184,  185,  186,  187,  189,  188,  180,  183,  190,
-      185,  188,  184,  213,  182,  183,  193,  191,  190,  187,
-      176,  193,  186,  191,  191,  189,  194,  194,  195,  197,
-      196,  213,  196,  197,  195,  196,  198,  198,  197,  199,
-
-      200,  201,  202,  197,  204,  200,  200,  202,  203,  197,
-      197,  199,  196,  203,  205,  206,  204,  209,  207,  208,
-      201,  206,  207,  210,  208,  211,  212,  214,  174,  218,
-      215,  217,  214,  209,  205,  215,  217,  210,  212,  219,
-      211,  212,  216,  216,  206,  220,  216,  224,  216,  218,
-      223,  220,  221,  221,  260,  219,  223,  222,  225,  226,
-      216,  260,  216,  222,  225,  226,  228,  224,  229,  222,
-      230,  231,  228,  229,  226,  231,  230,  232,  233,  235,
-      233,  234,  236,  232,  237,  233,  239,  234,  236,  238,
-      240,  243,  235,  241,  242,  238,  243,  244,  245,  239,
-
-      246,  241,  247,  250,  237,  248,  244,  242,  239,  252,
-      248,  248,  249,  245,  240,  251,  246,  249,  253,  251,
-      254,  250,  247,  255,  253,  256,  258,  257,  258,  255,
-      259,  252,  257,  263,  261,  262,  264,  266,  254,  254,
-      261,  262,  264,  265,  269,  256,  267,  267,  272,  259,
-      269,  266,  263,  268,  268,  265,  270,  271,  273,  271,
-      274,  275,  270,  273,  277,  276,  279,  292,  269,  278,
-      292,  272,  274,  276,  278,  280,  271,  281,  285,  287,
-      275,  280,  282,  281,  277,  283,  284,  282,  286,  279,
-      283,  288,  284,  285,  290,  289,  296,  287,  291,  293,
-
-      299,  293,  286,  289,  291,  288,  294,  294,  295,  297,
-      297,  295,  298,  298,  296,  300,  299,  301,  302,  290,
-      301,  305,  302,  303,  304,  307,  169,  308,  309,  317,
-      300,  307,  303,  304,  309,  310,  311,  310,  318,  312,
-      305,  308,  311,  312,  313,  313,  314,  315,  316,  317,
-      319,  314,  320,  315,  316,  325,  318,  321,  321,  322,
-      312,  323,  322,  324,  326,  320,  328,  324,  327,  327,
-      167,  319,  329,  316,  325,  329,  330,  331,  332,  323,
-      335,  332,  326,  331,  328,  333,  336,  340,  330,  335,
-      337,  338,  329,  341,  338,  337,  338,  333,  334,  339,
-
-      340,  166,  339,  344,  336,  341,  344,  334,  347,  338,
-      334,  342,  338,  342,  342,  334,  334,  334,  334,  343,
-      345,  345,  346,  347,  343,  343,  348,  349,  350,  351,
-      352,  352,  354,  354,  356,  353,  357,  350,  351,  346,
-      353,  348,  346,  358,  349,  349,  355,  355,  358,  359,
-      360,  357,  361,  362,  363,  364,  364,  366,  364,  356,
-      363,  359,  372,  375,  375,  367,  369,  364,  362,  360,
-      367,  369,  361,  368,  364,  370,  372,  366,  371,  368,
-      370,  371,  373,  371,  374,  373,  370,  378,  376,  377,
-      377,  381,  378,  374,  376,  383,  416,  382,  373,  384,
-
-      382,  373,  385,  373,  379,  379,  388,  379,  390,  387,
-      383,  381,  387,  379,  384,  391,  385,  379,  382,  394,
-      388,  416,  379,  390,  391,  379,  380,  380,  387,  380,
-      392,  393,  395,  396,  397,  392,  392,  393,  398,  401,
-      394,  400,  380,  397,  393,  380,  164,  380,  396,  380,
-      389,  395,  389,  389,  399,  405,  402,  398,  407,  401,
-      399,  406,  389,  389,  389,  389,  389,  400,  403,  389,
-      402,  404,  408,  407,  403,  405,  404,  408,  403,  410,
-      409,  406,  411,  411,  412,  410,  413,  414,  418,  417,
-      415,  420,  421,  418,  404,  409,  415,  422,  413,  419,
-
-      419,  414,  419,  423,  412,  417,  162,  424,  421,  424,
-      425,  420,  430,  422,  431,  425,  426,  423,  426,  426,
-      427,  428,  429,  429,  427,  428,  432,  433,  437,  431,
-      434,  430,  438,  440,  437,  443,  426,  440,  435,  160,
-      428,  438,  432,  439,  434,  433,  435,  435,  439,  442,
-      441,  444,  448,  449,  449,  442,  443,  444,  435,  441,
-      435,  436,  446,  445,  447,  446,  436,  445,  450,  447,
-      451,  451,  448,  453,  436,  436,  454,  454,  436,  436,
-      452,  450,  436,  455,  456,  452,  453,  457,  456,  455,
-      458,  459,  460,  462,  461,  461,  459,  460,  463,  464,
-
-      465,  466,  457,  461,  466,  462,  468,  469,  467,  472,
-      468,  458,  465,  467,  470,  470,  471,  464,  463,  469,
-      474,  471,  473,  473,  476,  476,  478,  479,  480,  481,
-      472,  482,  483,  484,  485,  479,  487,  483,  481,  488,
-      489,  491,  474,  495,  490,  492,  485,  478,  495,  480,
-      490,  492,  482,  484,  487,  491,  487,  488,  493,  494,
-      489,  496,  497,  498,  499,  494,  498,  493,  500,  503,
-      497,  501,  506,  497,  504,  496,  502,  504,  499,  505,
-      501,  509,  502,  500,  508,  505,  506,  507,  511,  503,
-      510,  513,  507,  511,  510,  512,  513,  514,  515,  516,
-
-      519,  520,  509,  505,  535,  522,  508,  535,  521,  522,
-      512,  523,  516,  514,   85,  525,  524,  515,  517,  517,
-      519,  524,  520,  521,  517,  526,  517,  528,  529,  526,
-      523,  525,  517,  529,  517,  530,  527,  517,  517,  531,
-      533,  527,  528,  534,  517,  527,  532,  536,  531,  537,
-      539,  530,  532,  529,  530,  533,  541,  532,  543,  534,
-      538,  538,  540,  540,  542,  544,  544,  545,  546,  537,
-      536,  541,  547,  543,  548,  539,  542,  547,  549,  550,
-      553,  551,  559,  548,  554,  558,  545,  551,  554,  553,
-      546,  555,  556,  557,  550,  555,  560,  549,  556,  561,
-
-      558,  559,  562,  563,  564,  557,  565,  563,  565,  566,
-      560,  567,  568,  568,  561,  569,  570,  564,  571,  567,
-      562,  569,  572,  573,  571,  574,  573,  575,  570,  577,
-      576,  578,  577,  566,  572,  576,  579,   80,  580,  574,
-      578,  581,  575,  580,  580,  582,  582,  578,  583,  583,
-      578,  584,  579,  589,  581,  585,  585,  584,  586,  586,
-      587,  590,  588,  591,  594,  593,  587,  588,  588,  592,
-      593,  589,  592,  595,  596,  591,  598,  596,  599,  597,
-      601,  595,  590,  594,  597,  600,  601,  602,  603,  600,
-      604,  605,  603,  607,  607,  606,  605,  599,  608,  598,
-
-      609,  610,  612,  611,  613,  614,  610,  602,  604,  606,
-      615,  614,  616,  608,  618,  615,  620,  617,  612,  621,
-      617,  609,  611,  624,  613,  617,  616,  625,  617,  617,
-      619,  619,  618,  622,  620,  621,  623,  624,  622,  627,
-      628,  623,  625,  629,  630,  627,  629,  631,  630,  628,
-      632,  633,  631,  632,  635,  634,  633,  636,  638,  639,
-      637,  640,  640,  638,  636,  641,  642,  643,  644,  645,
-      630,  634,  635,  637,  641,  646,  647,  648,  645,  639,
-      653,   75,  647,  648,  644,  642,  649,  646,  643,  649,
-      650,  650,  651,  650,  652,  651,  654,  655,  653,  652,
-
-      656,  657,  658,  662,  659,  656,  660,  664,  658,  659,
-      654,  655,  660,  661,  663,  670,  661,  666,  667,  663,
-      657,  665,   74,  664,  668,  673,  665,  665,  662,  668,
-      666,  667,  669,  671,  670,  672,  674,  674,  669,  675,
-      672,  676,  671,  668,  668,  673,  675,  677,  676,  678,
-      677,  679,  680,  681,  683,  678,  685,  680,  681,  681,
-      682,  682,  684,  679,  684,  677,  686,  680,  686,  687,
-      688,  689,  690,  691,  692,  685,  694,  693,  697,  683,
-      692,  693,  695,  696,  698,  694,  700,  687,  688,  689,
-      702,  690,  699,  691,  701,  699,  697,  695,  696,  703,
-
-      701,  700,  704,  698,  699,  705,  706,  707,  708,  710,
-      702,  709,  708,  703,  704,  711,  712,  713,  714,  717,
-      717,  720,   68,  715,  705,  710,  707,  706,  715,  709,
-      716,  719,  721,  711,  712,  712,  713,  714,  718,  722,
-      720,  723,  718,  721,  716,  719,  723,  724,  725,  726,
-      727,  728,  729,  722,  730,  731,  728,  727,  733,  729,
-      731,  732,  726,  724,  734,  735,  732,  725,  736,  738,
-      737,  734,  743,  747,  735,  740,  733,  739,  730,  737,
-      740,  738,  736,  739,  741,  742,  743,  741,  744,  742,
-      745,  754,  746,  752,  747,  748,  748,  744,  749,  749,
-
-      750,  750,  752,  751,  756,  745,  746,  749,  751,  755,
-      754,  758,  757,  759,  760,  755,  757,  764,  762,  761,
-      763,  765,  766,  758,  756,  761,  762,  763,  769,  778,
-      775,  772,  760,  820,  776,  764,  780,  781,  759,  775,
-      776,  820,  766,  769,  779,  780,  765,  767,  772,  767,
-      779,  778,  767,  781,  782,  786,  767,  785,  782,  767,
-      783,  783,  784,  784,  787,  788,  767,  767,  785,  767,
-      789,  791,  792,  786,  793,  796,  789,  792,  787,  794,
-      795,  799,  802,   63,  795,  788,  790,  790,  790,  798,
-      790,  791,  797,  790,  798,  793,  797,  794,  790,  796,
-
-      799,  800,  801,  805,  790,  790,  800,  802,  803,  804,
-      805,  803,  797,  807,  804,  804,  808,  801,  806,  806,
-      810,  808,  809,  809,  811,  810,  812,  811,  807,  813,
-      813,  812,  814,  815,  814,  816,  817,  818,  822,  819,
-      817,  821,  821,  824,  824,  815,  823,  825,  827,  826,
-      828,  830,  830,  822,  816,  835,  828,  818,  819,  829,
-      823,  826,  831,  834,  829,  825,  833,  831,  831,  834,
-      827,  833,  836,  838,  835,  837,  840,  841,  836,  838,
-      837,  839,  840,  844,  839,  841,  842,  842,  843,  843,
-      845,  844,  846,  848,  847,  849,  850,  846,  847,  851,
-
-      848,  852,  852,  854,  856,  853,  855,  855,  845,  857,
-      856,  854,  850,  849,  853,  858,  860,  861,  851,  862,
-      864,  865,  867,  863,  865,  860,  861,  857,  863,  864,
-      866,  868,  869,  870,  858,  866,  867,  872,  874,  871,
-      875,  869,  877,  862,  871,  871,  870,  873,  873,  876,
-      878,  872,  879,  874,  883,  879,  868,  885,  876,  875,
-      881,  886,  881,  879,  882,  882,  877,  884,  878,  887,
-      888,  889,  884,  890,  891,  883,  892,  893,  885,  894,
-      892,  886,  890,   58,  895,  896,  898,  897,  899,  887,
-      895,  889,  888,  902,  896,  893,  900,  891,  894,  897,
-
-      901,  902,  898,  903,  904,  906,  901,  899,  907,  904,
-      900,  905,  905,  908,  909,  910,  911,  903,  912,  913,
-      916,  914,  908,  910,  906,  915,  916,  917,  907,  918,
-      920,  919,  921,  917,  909,  924,  911,  919,  913,  924,
-      912,  914,  922,  918,  920,  915,  925,  923,  922,  926,
-      927,  928,  921,  923,  930,  927,  929,  929,  931,  932,
-      930,  926,  932,  933,  931,  925,  934,  935,  936,  926,
-      937,  937,  928,  935,  938,  939,  942,  945,  941,  934,
-      939,  933,  940,  941,  941,  940,  943,  946,  936,  948,
-      943,  942,  938,  944,  944,  950,  947,  951,  940,  945,
-
-      940,  947,  953,  954,  955,  957,  957,  946,  948,  958,
-      964,  951,  959,  958,  961,  953,  960,  960,  962,  950,
-      966,  963,  962,  954,  964,  955,  956,  959,  965,  956,
-       57,  956,  968,  965,  966,  956,  963,  956,  967,  961,
-      969,  968,  956,  967,  967,  970,  973,  956,  971,  970,
-      972,  974,  975,  976,  969,  972,  974,  977,  973,  978,
-       52,  970,  979,  971,  980,  972,  975,  979,  978,  982,
-      980,  977,  981,  983,  976,  982,  986,  981,  985,  983,
-      984,  984,  986,  985,  987,  988,  991,  989,  992,  993,
-      994,  995,  995,  992,  996,  998,  999, 1000,  991,  996,
-
-     1001,  997,  994,  993,  988,  989,  987,  990,  990,  997,
-      999,  998, 1002,  990, 1003,  990, 1000, 1004, 1005, 1001,
-     1003,  990, 1004, 1006, 1007, 1008,  990,  990, 1002, 1009,
-     1005, 1010, 1010,  990, 1011, 1012, 1014, 1016, 1011, 1017,
-     1007, 1006, 1014, 1008, 1017, 1015, 1018, 1009, 1015, 1020,
-     1021, 1019, 1023, 1024, 1020, 1012, 1016, 1019, 1025, 1018,
-     1026, 1023, 1024, 1027, 1028, 1029, 1026, 1030, 1031, 1021,
-     1029, 1032, 1027, 1033, 1025, 1034, 1037, 1035, 1042, 1043,
-     1040, 1045, 1031, 1028, 1034, 1033, 1035, 1030, 1036, 1038,
-     1046, 1032, 1042, 1037, 1036, 1038, 1040, 1044, 1047, 1043,
-
-     1045, 1049, 1044, 1048, 1046, 1050, 1049, 1053, 1054, 1056,
-     1050, 1058, 1053, 1055, 1055, 1056, 1047, 1054, 1048, 1057,
-     1058, 1059, 1060, 1062, 1063, 1057, 1066, 1065, 1065, 1063,
-     1063, 1065, 1068, 1069, 1067, 1060, 1059, 1067, 1070, 1062,
-     1071, 1066, 1072, 1074, 1073, 1075, 1068, 1077, 1082, 1074,
-     1076, 1082, 1078, 1069, 1070, 1072, 1076, 1078, 1071, 1073,
-     1079, 1083, 1077, 1081, 1081, 1075, 1084, 1085, 1086, 1087,
-     1088, 1084, 1085, 1090, 1079, 1088, 1089, 1092, 1087, 1093,
-     1094, 1089, 1083, 1092, 1086, 1090, 1094, 1095, 1096, 1096,
-     1097, 1098, 1101, 1095, 1099, 1093, 1102, 1099, 1103, 1097,
-
-     1100, 1100, 1104, 1105,   47, 1104, 1106, 1107, 1108, 1098,
-     1101, 1116, 1106, 1107, 1108, 1102, 1105, 1109, 1103, 1110,
-     1111, 1113, 1109, 1112, 1110, 1115, 1111, 1113, 1112, 1116,
-     1115, 1117, 1118, 1121, 1119, 1120, 1120, 1122, 1118, 1119,
-     1123, 1124, 1121, 1125, 1126, 1123, 1122, 1126, 1129, 1127,
-     1128, 1117, 1127, 1129, 1130, 1131, 1132, 1133, 1134, 1124,
-     1138, 1128, 1125, 1133, 1134, 1135, 1136, 1131, 1137, 1137,
-     1139, 1136, 1130, 1140, 1141, 1132, 1143, 1142, 1144, 1138,
-     1135, 1142, 1145, 1146, 1139, 1140, 1148, 1144, 1149, 1149,
-     1150, 1151, 1141, 1153, 1143, 1152, 1151, 1155, 1150, 1156,
-
-     1152, 1145, 1158, 1157, 1161, 1148, 1162, 1158, 1146, 1159,
-     1164, 1155, 1162, 1153, 1156, 1157, 1160, 1160, 1159, 1163,
-     1168, 1166, 1165, 1166, 1161, 1163, 1164, 1165, 1167, 1169,
-     1170, 1171, 1172, 1167, 1168, 1170, 1175, 1173, 1174, 1177,
-     1177, 1179, 1178, 1169, 1173, 1180, 1171, 1182, 1181, 1186,
-     1186, 1172, 1183, 1174, 1181, 1175, 1178, 1183, 1185, 1179,
-     1180, 1190, 1185, 1189, 1187, 1192, 1183, 1182, 1183, 1187,
-     1189, 1183, 1188, 1188, 1191, 1190, 1193, 1191, 1194, 1196,
-     1195, 1197, 1198, 1200, 1192, 1195, 1199, 1194, 1198, 1201,
-     1202, 1199, 1207, 1197, 1193, 1204, 1204, 1200, 1196, 1205,
-
-     1201, 1206, 1208, 1211, 1205, 1212, 1206, 1208, 1210, 1202,
-     1209, 1213, 1207, 1214, 1209, 1216, 1214, 1210, 1211, 1215,
-     1212, 1217, 1216, 1218, 1219, 1214, 1220, 1224, 1222, 1221,
-     1213, 1223, 1225, 1217, 1215, 1221, 1227, 1223, 1228, 1226,
-     1230, 1229, 1218, 1222, 1220, 1219, 1231, 1224, 1226, 1232,
-     1233, 1227, 1225, 1229, 1234, 1236, 1233, 1228, 1237, 1230,
-     1239, 1236, 1238, 1240, 1232, 1241, 1243, 1242, 1239, 1245,
-     1299, 1231, 1242, 1237, 1234, 1246, 1238, 1247, 1243, 1244,
-     1250, 1241, 1299, 1240, 1244, 1244, 1248, 1248, 1245, 1246,
-     1247, 1249, 1249, 1250, 1251, 1252, 1249, 1253, 1253, 1249,
-
-     1249, 1252, 1254, 1251, 1249, 1256, 1255, 1254, 1257, 1260,
-     1249, 1256, 1258, 1257, 1249, 1255, 1263, 1258, 1259, 1259,
-     1261, 1261, 1262, 1264, 1266, 1262, 1265, 1262, 1267, 1268,
-     1260, 1269, 1265, 1266, 1268, 1270, 1263, 1271, 1272, 1275,
-     1276, 1264, 1273, 1271, 1272, 1269, 1274, 1273, 1267, 1276,
-     1274, 1278, 1275, 1270, 1276, 1285, 1276, 1277, 1276, 1281,
-     1276, 1284, 1277, 1279, 1279, 1278, 1280, 1280, 1283, 1280,
-     1281, 1286, 1283, 1287, 1288, 1285, 1284, 1289, 1290, 1288,
-     1288, 1292, 1287, 1291, 1293, 1294, 1289, 1295, 1291, 1286,
-     1297, 1296,   18, 1293, 1300, 1292, 1297, 1298, 1298, 1301,
-
-     1290, 1303, 1300, 1302, 1294, 1296, 1295, 1304, 1302, 1306,
-     1305, 1307, 1316, 1301, 1308, 1303, 1304, 1305, 1310, 1308,
-     1309, 1309, 1311, 1311, 1312, 1314, 1312, 1306, 1314, 1315,
-     1317, 1316, 1319, 1310, 1315, 1323, 1307, 1318, 1318, 1317,
-     1320, 1320, 1321, 1321, 1322, 1324, 1325, 1326, 1326, 1322,
-     1327, 1328, 1319, 1330, 1329, 1331, 1323, 1329, 1332, 1335,
-     1333, 1331, 1334, 1332, 1334, 1338, 1324, 1325, 1328, 1333,
-     1327, 1337, 1339, 1330, 1337, 1341, 1340, 1335, 1342, 1343,
-     1338, 1340, 1349, 1342, 1405, 1339, 1344, 1343, 1405, 1341,
-     1345, 1344, 1346, 1345, 1347, 1347, 1348, 1346, 1350, 1351,
-
-     1349, 1348, 1352, 1354, 1350, 1355, 1351, 1356, 1357, 1354,
-     1358, 1355, 1356, 1357, 1359, 1352, 1358, 1360, 1361, 1362,
-     1362, 1363, 1365, 1359, 1366, 1367, 1369, 1365, 1368, 1361,
-     1370, 1371, 1372, 1373, 1375, 1367, 1360, 1371, 1372, 1373,
-     1375, 1363, 1366, 1368, 1376, 1377, 1369, 1378, 1379, 1380,
-     1381, 1382, 1382, 1370, 1383, 1384, 1386, 1385, 1376, 1388,
-     1379, 1386, 1391, 1380, 1376, 1377, 1389, 1378, 1381, 1387,
-     1387, 1389, 1392, 1393, 1383, 1385, 1394, 1392, 1392, 1395,
-     1384, 1391, 1388, 1396, 1397, 1394, 1398, 1395, 1399, 1400,
-     1401, 1393, 1401, 1399, 1402, 1408, 1399, 1396, 1400, 1397,
-
-     1404, 1398, 1406, 1409, 1398, 1407, 1404, 1410, 1402, 1414,
-     1407, 1407, 1411, 1406, 1408, 1412, 1413, 1411, 1415, 1416,
-     1412, 1413, 1417, 1419, 1416, 1410, 1420, 1414, 1421, 1409,
-     1422, 1422, 1423, 1424, 1425, 1426, 1423, 1419, 1415, 1428,
-     1427, 1426, 1417, 1429, 1420, 1430, 1421, 1433, 1431, 1432,
-     1435, 1424, 1427, 1425, 1437, 1428, 1434, 1435, 1438, 1430,
-     1436, 1434, 1429, 1431, 1432, 1436, 1433, 1439, 1440, 1440,
-     1441, 1442, 1437, 1443, 1444, 1444, 1439, 1445, 1446, 1438,
-     1442, 1447, 1451, 1445, 1446, 1441, 1448, 1448, 1449, 1449,
-     1450, 1452, 1453, 1443, 1454, 1447, 1450, 1453, 1451, 1455,
-
-     1454, 1456, 1457, 1457, 1463, 1455, 1462, 1456, 1458, 1458,
-     1460, 1460, 1452, 1461, 1464, 1462, 1466, 1461, 1465, 1469,
-     1467, 1470, 1463, 1468, 1468, 1473, 1464, 1467, 1458, 1470,
-     1458, 1466, 1465, 1471, 1472, 1474, 1476, 1475, 1471, 1469,
-     1474, 1474, 1475, 1475, 1473, 1477, 1477, 1478, 1472, 1479,
-     1480, 1482, 1481, 1483, 1484, 1485, 1476, 1481, 1486, 1480,
-     1487, 1485, 1488, 1486, 1490, 1489, 1478, 1493, 1479, 1491,
-     1482, 1489, 1484, 1483, 1494, 1491, 1492, 1495, 1496, 1497,
-     1487, 1498, 1492, 1490, 1499, 1500, 1493, 1503, 1488, 1501,
-     1501, 1502, 1504, 1494, 1502, 1498, 1495, 1496, 1497, 1508,
-
-     1500, 1505, 1506, 1506, 1508, 1499, 1503, 1507, 1507, 1510,
-     1509, 1504, 1511, 1505, 1509, 1512, 1513, 1514, 1518, 1514,
-     1516, 1517, 1510, 1514, 1512, 1519, 1517, 1511, 1520, 1513,
-     1521, 1521, 1522, 1518, 1523, 1524, 1514, 1522, 1516, 1525,
-     1523, 1526, 1528, 1527, 1520, 1519, 1528, 1526, 1527, 1529,
-     1524, 1530, 1525, 1529, 1531, 1532, 1533, 1534, 1535, 1535,
-     1537, 1539, 1540, 1534, 1532, 1541, 1541, 1540, 1542, 1543,
-     1547, 1530, 1531, 1547, 1542, 1549, 1533, 1550, 1537, 1545,
-     1545, 1551, 1539, 1548, 1548, 1553, 1554, 1556, 1553, 1543,
-     1555, 1549, 1557, 1550, 1558, 1558, 1556, 1551, 1559, 1560,
-
-     1561, 1562, 1563, 1564, 1565, 1565, 1562, 1554, 1566, 1564,
-     1555, 1567, 1557, 1559, 1569, 1568, 1563, 1566, 1570, 1561,
-     1560, 1571, 1571, 1572, 1573, 1575, 1574, 1576, 1576, 1567,
-     1568, 1574, 1577, 1578, 1579, 1579, 1577, 1572, 1570, 1569,
-     1575, 1580, 1573, 1581, 1582, 1583, 1584, 1585, 1589, 1583,
-     1587, 1587, 1585, 1578, 1588, 1582, 1591, 1588, 1592, 1590,
-     1593, 1589, 1581, 1580, 1590, 1584, 1594, 1595, 1596, 1597,
-     1597, 1599, 1591, 1598, 1593, 1600, 1592, 1603, 1598, 1601,
-     1601, 1595, 1603, 1602, 1604, 1594, 1594, 1605, 1608, 1605,
-     1607, 1599, 1602, 1596, 1606, 1600, 1607, 1609, 1611, 1606,
-
-     1612, 1612, 1613, 1609, 1604, 1614, 1617, 1621, 1608, 1616,
-     1620, 1614, 1611, 1622, 1616, 1618, 1618, 1619, 1619, 1623,
-     1625, 1613, 1623, 1626, 1620, 1621, 1624, 1624, 1622, 1627,
-     1617, 1629, 1635, 1628, 1633, 1626, 1628, 1629, 1625, 1628,
-     1630, 1631, 1634, 1633, 1631, 1630, 1638, 1634, 1646, 1627,
-     1636, 1628, 1639, 1636, 1637, 1637, 1640, 1635, 1639, 1641,
-     1631, 1646, 1640, 1644, 1641, 1642, 1642, 1643, 1643, 1644,
-     1638, 1645, 1647, 1648, 1649, 1650, 1645, 1651, 1650, 1652,
-     1653, 1656, 1654, 1651, 1660, 1652, 1653, 1654, 1657, 1655,
-     1647, 1661, 1648, 1657, 1649, 1655, 1658, 1658, 1659, 1662,
-
-     1663, 1664, 1660, 1659, 1656, 1665, 1667, 1666, 1668, 1669,
-     1670, 1661, 1670, 1669, 1674, 1664, 1671, 1676, 1662, 1665,
-     1663, 1666, 1672, 1678, 1667, 1675, 1674, 1681, 1677, 1672,
-     1676, 1679, 1680, 1668, 1677, 1671, 1682, 1675, 1687, 1682,
-     1684, 1681, 1689, 1678, 1683, 1683, 1691, 1679, 1688, 1684,
-     1686, 1686, 1680, 1688, 1689, 1690, 1690, 1682, 1687, 1692,
-     1693, 1691, 1694, 1695, 1696, 1699, 1698, 1697, 1701, 1703,
-     1705, 1705, 1695, 1692, 1697, 1698, 1706, 1706, 1698, 1696,
-     1694, 1699, 1704, 1701, 1693, 1704, 1707, 1708, 1701, 1709,
-     1710, 1710, 1709, 1711, 1703, 1712, 1713, 1714, 1707, 1715,
-
-     1714, 1713, 1716, 1717, 1715, 1708, 1711, 1718, 1719, 1721,
-     1724, 1720, 1723, 1723, 1712, 1725, 1718, 1724, 1721, 1717,
-     1720, 1716, 1722, 1720, 1726, 1727, 1728, 1719, 1722, 1729,
-     1732, 1731, 1735, 1730, 1736, 1725, 1731, 1726, 1730, 1730,
-     1728, 1738, 1732, 1727, 1738, 1729, 1737, 1737, 1739, 1740,
-     1741, 1741, 1736, 1742, 1742, 1741, 1744, 1735, 1740, 1745,
-     1743, 1744, 1746, 1747, 1739, 1748, 1750, 1751, 1742, 1743,
-     1748, 1748, 1743, 1752, 1753, 1754, 1756, 1745, 1755, 1753,
-     1750, 1747, 1751, 1746, 1755, 1757, 1757, 1758, 1760, 1754,
-     1764, 1759, 1761, 1758, 1756, 1752, 1759, 1762, 1761, 1765,
-
-     1766, 1767, 1760, 1762, 1771, 1773, 1766, 1774, 1768, 1769,
-     1764, 1768, 1771, 1765, 1767, 1769, 1775, 1768, 1777, 1776,
-     1778, 1779, 1780, 1777, 1773, 1781, 1774, 1776, 1782, 1778,
-     1783, 1780, 1784, 1784, 1779, 1775, 1790, 1785, 1781, 1786,
-     1788, 1791, 1782, 1785, 1783, 1786, 1787, 1789, 1789, 1787,
-     1792, 1793, 1793, 1788, 1784, 1794, 1790, 1795, 1796, 1791,
-     1797, 1798, 1801, 1795, 1800, 1800, 1802, 1803, 1794, 1792,
-     1802, 1804, 1803, 1805, 1807, 1808, 1797, 1810, 1805, 1798,
-     1796, 1806, 1801, 1807, 1811, 1813, 1806, 1812, 1810, 1814,
-     1812, 1804, 1816, 1811, 1815, 1815, 1817, 1813, 1808, 1818,
-
-     1819, 1819, 1820, 1821, 1814, 1822, 1825, 1823, 1817, 1826,
-     1821, 1816, 1828, 1829, 1827, 1830, 1820, 1822, 1818, 1823,
-     1827, 1830, 1831, 1831, 1828, 1825, 1836, 1832, 1839, 1826,
-     1832, 1829, 1833, 1833, 1835, 1836, 1837, 1838, 1838, 1835,
-     1839, 1840, 1837, 1840, 1841, 1842, 1843, 1841, 1844, 1845,
-     1846, 1847, 1848, 1852, 1851, 1846, 1847, 1849, 1850, 1851,
-     1853, 1848, 1852, 1856, 1858, 1842, 1844, 1845, 1843, 1849,
-     1858, 1854, 1855, 1850, 1859, 1852, 1854, 1855, 1856, 1862,
-     1853, 1857, 1857, 1854, 1861, 1863, 1864, 1865, 1866, 1867,
-     1866, 1868, 1868, 1869, 1869, 1859, 1870, 1870, 1862, 1871,
-
-     1861, 1874, 1864, 1867, 1863, 1867, 1875, 1865, 1872, 1872,
-     1873, 1873, 1876, 1877, 1877, 1879, 1878, 1883, 1882, 1871,
-     1878, 1879, 1874, 1880, 1882, 1884, 1880, 1875, 1886, 1885,
-     1889, 1884, 1892, 1876, 1885, 1883, 1887, 1888, 1888, 1887,
-     1890, 1891, 1891, 1893, 1894, 1890, 1895, 1892, 1900, 1894,
-     1889, 1895, 1897, 1886, 1896, 1896, 1898, 1897, 1899, 1902,
-     1901, 1903, 1898, 1904, 1893, 1905, 1906, 1903, 1900, 1907,
-     1899, 1899, 1899, 1906, 1907, 1909, 1910, 1899, 1901, 1902,
-     1909, 1909, 1911, 1904, 1912, 1905, 1912, 1913, 1914, 1915,
-     1910, 1916, 1917, 1918, 1920, 1915, 1922, 1911, 1913, 1923,
-
-     1916, 1919, 1919, 1914, 1921, 1921, 1924, 1924, 1925, 1925,
-     1926, 1930, 1917, 1931, 1918, 1933, 1922, 1929, 1929, 1934,
-     1920, 1923, 1931, 1935, 1933, 1936, 1937, 1937, 1938, 1935,
-     1926, 1939, 1940, 1941, 1942, 1944, 1930, 1943, 1943, 1940,
-     1934, 1936, 1941, 1945, 1947, 1949, 1939, 1948, 1950, 1938,
-     1947, 1949, 1948, 1955, 1953, 1951, 1953, 1952, 1956, 1945,
-     1942, 1944, 1951, 1952, 1956, 1957, 1957, 1959, 1950, 1958,
-     1960, 1961, 1955, 1962, 1958, 1963, 1959, 1964, 1963, 1965,
-     1966, 1967, 1965, 1968, 1968, 1960, 1971, 1969, 1970, 1964,
-     1972, 1961, 1962, 1969, 1970, 1973, 1975, 1976, 1966, 1973,
-
-     1978, 1978, 1979, 1977, 1980, 1972, 1971, 1967, 1977, 1981,
-     1983, 1985, 1985, 1984, 1986, 1973, 1975, 1984, 1987, 1976,
-     1986, 1988, 1988, 1980, 1981, 1990, 1979, 1987, 1989, 1983,
-     1991, 1991, 1989, 1992, 1993, 1995, 1990, 1994, 1996, 1997,
-     1995, 1990, 1998, 1999, 2003, 2000, 2001, 2002, 1993, 1999,
-     2004, 2004, 2002, 2010, 1992,   17, 1994, 2003, 1996, 1997,
-     2008, 2001, 1998, 2000, 2005, 2005, 2006, 2009, 2019, 2008,
-     2006, 2011, 2020, 2010, 2012, 2012, 2011, 2020, 2009, 2014,
-     2014, 2015, 2016, 2009, 2018, 2021, 2015, 2015, 2016, 2022,
-     2018, 2024, 2025, 2026, 2019, 2022, 2025, 2021, 2027, 2027,
-
-     2028, 2029, 2030, 2024, 2031, 2026, 2034, 2029, 2032, 2032,
-     2031, 2033, 2035, 2039, 2040, 2036, 2038, 2035, 2042, 2040,
-     2046, 2042, 2043, 2043, 2030, 2028, 2034, 2036, 2038,    0,
-     2033, 2047, 2039, 2044, 2044, 2045, 2045, 2047, 2048, 2050,
-     2046, 2049, 2051, 2053, 2048, 2050, 2049, 2055, 2053, 2056,
-     2055, 2051, 2057, 2057, 2059, 2060, 2063, 2061, 2062, 2062,
-     2068, 2056, 2061, 2064, 2065, 2063, 2059, 2060, 2064, 2065,
-     2066, 2067, 2067, 2066, 2069, 2070, 2071, 2072, 2075, 2073,
-     2068, 2072, 2074, 2069, 2073, 2076, 2077, 2078, 2074, 2081,
-     2080, 2080, 2084, 2070, 2076, 2071, 2075, 2082, 2088, 2083,
-
-     2090, 2078, 2080, 2087, 2077, 2086, 2082, 2081, 2083, 2085,
-     2085, 2089, 2084, 2090, 2086, 2087, 2089, 2093, 2093, 2088,
-     2095, 2096, 2097, 2095, 2098, 2101, 2100, 2102, 2103, 2104,
-     2104, 2106, 2105, 2102, 2105, 2107, 2107, 2096, 2097, 2101,
-     2098, 2100, 2108, 2110, 2110, 2103, 2111, 2111, 2113, 2106,
-     2108, 2114, 2115, 2116, 2117, 2118, 2119, 2114, 2115, 2120,
-     2120, 2117, 2122, 2121, 2121, 2127, 2123, 2116, 2124, 2125,
-     2126, 2113, 2121, 2131, 2129, 2134, 2119, 2118, 2123, 2128,
-     2124, 2130, 2126, 2122, 2125, 2135, 2130, 2130, 2128, 2129,
-     2136, 2127, 2132, 2139, 2132, 2134, 2131, 2138, 2132, 2137,
-
-     2137, 2140, 2136, 2142, 2140, 2141, 2146, 2144, 2135, 2152,
-     2141, 2132, 2144, 2139, 2145, 2138, 2145, 2147, 2148, 2150,
-     2153, 2154, 2147, 2142, 2146, 2148, 2156, 2152, 2150, 2153,
-     2155, 2157, 2155, 2154, 2159, 2160, 2159, 2157, 2161, 2161,
-     2162, 2163, 2164, 2165, 2164, 2156, 2163, 2166, 2165, 2160,
-     2167, 2168, 2166, 2169, 2170, 2173, 2171, 2172, 2174, 2177,
-     2170, 2171, 2178, 2174, 2174, 2179, 2162, 2173, 2167, 2168,
-     2172, 2175, 2182, 2169, 2180, 2180, 2178, 2179, 2177, 2175,
-     2181, 2181, 2183, 2182, 2184, 2185, 2187, 2186, 2187, 2188,
-     2189, 2185, 2186, 2190, 2190, 2196, 2191, 2183, 2189, 2192,
-
-     2192, 2193, 2193, 2194, 2184, 2195, 2189, 2188, 2191, 2199,
-     2195, 2198, 2194, 2196, 2200, 2198, 2200, 2201, 2199, 2202,
-     2203, 2199, 2204, 2205, 2202, 2202, 2212, 2207, 2208, 2209,
-     2211, 2204, 2203, 2208, 2209, 2205, 2213, 2215, 2201, 2207,
-     2214, 2214, 2216, 2211, 2217, 2213, 2212, 2218, 2219, 2222,
-     2220, 2221, 2226, 2224, 2222, 2215, 2225, 2236, 2229, 2230,
-     2216, 2238, 2217, 2218, 2220, 2224, 2221, 2229, 2225, 2227,
-     2228, 2237, 2226, 2219, 2227, 2228, 2233, 2230, 2235, 2238,
-     2236, 2239, 2233, 2240, 2235, 2242, 2237, 2241, 2241, 2243,
-     2243, 2244, 2240, 2245, 2242, 2233, 2246, 2247, 2248, 2250,
-
-     2246, 2251, 2247, 2252, 2254,    0, 2239, 2251, 2253, 2244,
-     2254, 2248, 2245, 2253, 2253, 2255, 2256, 2258, 2250, 2256,
-     2257, 2255, 2261, 2261, 2263, 2252, 2262, 2262, 2257, 2264,
-     2264, 2265, 2265, 2263, 2266, 2267, 2268, 2258, 2269, 2270,
-     2270, 2262, 2268, 2269, 2271, 2271, 2266, 2275, 2276, 2272,
-     2273, 2275, 2262, 2267, 2272, 2277, 2273, 2278, 2280, 2277,
-     2281, 2282, 2284, 2283, 2285, 2281, 2287, 2284, 2276, 2286,
-     2288, 2289, 2290, 2290, 2292, 2288, 2291, 2278, 2283, 2294,
-     2291, 2295, 2285, 2280, 2282, 2286, 2287, 2293, 2296, 2292,
-     2297, 2298, 2293, 2289, 2299, 2300, 2301, 2294, 2305, 2299,
-
-     2302, 2302, 2297, 2304, 2306, 2307, 2296, 2295, 2300, 2308,
-     2298, 2304, 2309, 2312, 2301, 2310, 2311, 2305, 2313, 2319,
-     2314, 2322, 2318, 2306, 2307, 2312, 2314, 2316, 2321,    0,
-     2321, 2327, 2308, 2319, 2310, 2318, 2309, 2311, 2320, 2313,
-     2326, 2322, 2316, 2324, 2320, 2323, 2323, 2325, 2324, 2328,
-     2325, 2329, 2332, 2326, 2332, 2327, 2330, 2330, 2331, 2331,
-     2333, 2333, 2334, 2328, 2329, 2335, 2336, 2337, 2337, 2339,
-     2339, 2337, 2340, 2340, 2341, 2341, 2342, 2334, 2348, 2336,
-     2335, 2343, 2343, 2344, 2344, 2342, 2345, 2347, 2342, 2349,
-     2350, 2345, 2347, 2351, 2351, 2352, 2352, 2353, 2348, 2354,
-
-     2354, 2355, 2350, 2356, 2356, 2357, 2358, 2359, 2359, 2349,
-     2361, 2358, 2360, 2360, 2362, 2363, 2353, 2364, 2365, 2355,
-     2357, 2367, 2369, 2362, 2361, 2371, 2367, 2368, 2368, 2370,
-     2370, 2364, 2363, 2372, 2373, 2377, 2374, 2365, 2372, 2374,
-     2373, 2369, 2378, 2371, 2375, 2375, 2376, 2376, 2379, 2381,
-     2379, 2382, 2383, 2383, 2377, 2384, 2386, 2378, 2387, 2388,
-     2375, 2384, 2389, 2390, 2381, 2391, 2391, 2390, 2392, 2393,
-     2382, 2394, 2398, 2387, 2393, 2395, 2386, 2389, 2397, 2397,
-     2400, 2399, 2388, 2401, 2402, 2403, 2394, 2392, 2399, 2404,
-     2395, 2407, 2398, 2407, 2400, 2405, 2405, 2406, 2411, 2410,
-
-     2403, 2401, 2402, 2412, 2408, 2410, 2406, 2408, 2412, 2413,
-     2411, 2414, 2415, 2416, 2413, 2404, 2417, 2418, 2420, 2426,
-     2423, 2417, 2408, 2420, 2408, 2415, 2421, 2422, 2431,    0,
-     2427, 2421, 2422, 2424, 2416, 2423, 2414, 2429, 2425, 2424,
-     2426, 2428, 2429, 2418, 2425, 2427, 2430, 2428, 2432, 2433,
-     2434, 2430, 2433, 2431, 2435, 2436, 2437, 2438, 2439, 2444,
-     2446, 2432, 2440, 2435, 2436, 2437, 2438, 2441, 2440, 2447,
-     2434, 2442, 2439, 2441, 2456, 2442, 2448, 2448, 2447, 2444,
-     2446, 2449, 2450, 2450, 2451, 2452, 2452, 2449, 2454, 2453,
-     2456, 2450, 2459, 2451, 2453, 2457, 2458, 2458, 2463, 2468,
-
-     2460, 2462, 2464, 2465, 2468, 2469, 2470, 2459, 2454, 2460,
-     2454, 2457,    0, 2462, 2463, 2465, 2467, 2464, 2470, 2467,
-     2471, 2471, 2472, 2472, 2476, 2469, 2474, 2474, 2475, 2476,
-     2477, 2475, 2478, 2479, 2480, 2480, 2477, 2481, 2478, 2482,
-     2482, 2483, 2479, 2484, 2485, 2486, 2486, 2488, 2487, 2496,
-     2489, 2481, 2491, 2483, 2487, 2489, 2491, 2484, 2496, 2492,
-     2497, 2488, 2492, 2485, 2493, 2493, 2494, 2495, 2498, 2497,
-     2499, 2494, 2495, 2501, 2499, 2500, 2500, 2503, 2504, 2505,
-     2506, 2507, 2503, 2508, 2509, 2510, 2501, 2508, 2498, 2514,
-     2510, 2511, 2513, 2513, 2515, 2507, 2512, 2511, 2504, 2505,
-
-     2506, 2516, 2512, 2517, 2509, 2518, 2521, 2514, 2517, 2519,
-     2519, 2522, 2523, 2515, 2558, 2524, 2525, 2523, 2521, 2558,
-     2516, 2524, 2525, 2526, 2529, 2531, 2518, 2522, 2527, 2532,
-     2527, 2526, 2539, 2529, 2533, 2533, 2599, 2534, 2599, 2531,
-     2534, 2535, 2535, 2532, 2537, 2538, 2544, 2537, 2538, 2540,
-     2540, 2543, 2544, 2545, 2547, 2543, 2546, 2546, 2539, 2550,
-     2550, 2552, 2554, 2547, 2555, 2545, 2559, 2560, 2561, 2562,
-     2563, 2563, 2571, 2561, 2562, 2567, 2554, 2565, 2565, 2552,
-     2555, 2567, 2568, 2569, 2569, 2570, 2572, 2574, 2560, 2580,
-     2575, 2572, 2559, 2575, 2571, 2576, 2577, 2578, 2578, 2585,
-
-     2581, 2570, 2568, 2584, 2582, 2580, 2574, 2576, 2577, 2581,
-     2582, 2583, 2587, 2587, 2585, 2588, 2589, 2583, 2588, 2590,
-     2595, 2584, 2592, 2592, 2593, 2593, 2594, 2596, 2597, 2598,
-     2600, 2594, 2601, 2602, 2598, 2589, 2596, 2590, 2595, 2604,
-     2605, 2597, 2603, 2606, 2600, 2602, 2601, 2603, 2606, 2607,
-     2607, 2608, 2608, 2609, 2609, 2610, 2610, 2611, 2612, 2604,
-     2605, 2613, 2614, 2614, 2615, 2615, 2613, 2616, 2616, 2611,
-     2617, 2618, 2619, 2620, 2621,    0, 2612, 2624, 2622, 2623,
-     2623, 2627, 2617, 2632, 2619, 2625, 2625, 2626, 2626, 2628,
-     2628, 2618, 2627, 2620, 2622, 2621, 2624, 2629, 2630, 2631,
-
-     2634, 2633, 2635, 2632, 2637, 2630, 2633, 2636, 2636, 2629,
-     2639, 2631, 2640, 2637, 2638, 2638, 2641, 2642, 2644, 2643,
-     2634, 2645, 2635, 2645, 2652, 2646, 2647, 2647, 2649, 2641,
-     2648, 2650, 2640, 2643, 2653, 2654, 2639, 2646, 2656, 2648,
-     2644, 2642, 2652, 2649, 2655, 2657, 2650, 2655, 2658, 2666,
-     2657, 2668, 2656, 2658, 2659, 2659, 2653, 2667, 2654, 2660,
-     2660, 2661, 2661, 2663, 2663, 2665, 2665, 2666, 2667, 2669,
-     2668, 2671, 2672, 2673, 2674, 2679, 2675, 2676, 2677, 2678,
-     2677,    0, 2680, 2686, 2669, 2675, 2681, 2681, 2683, 2685,
-     2672, 2671, 2683, 2679, 2674, 2673, 2692, 2676, 2687, 2678,
-
-     2680, 2684, 2684, 2685, 2690, 2686, 2693, 2687, 2688, 2688,
-     2691, 2691, 2694, 2690, 2692, 2695, 2696, 2697, 2698, 2700,
-     2701, 2699, 2695, 2704, 2693, 2702, 2702, 2701, 2703, 2703,
-     2694, 2696, 2705, 2706, 2711, 2697, 2698, 2699, 2700, 2706,
-     2708, 2708, 2710, 2704, 2709, 2709, 2712, 2713, 2710, 2714,
-     2705, 2715, 2711, 2716, 2717, 2717, 2718, 2719, 2716, 2720,
-     2721, 2722, 2713,    0, 2712, 2715, 2729, 2723, 2714, 2725,
-     2725, 2721, 2723, 2724, 2734, 2724, 2718, 2719, 2726, 2720,
-     2726, 2722, 2727, 2727, 2731, 2729, 2732, 2733, 2737, 2741,
-     2735, 2736, 2738, 2731, 2734, 2735, 2736, 2742, 2743, 2733,
-
-     2746, 2743, 2744, 2744, 2745, 2732, 2747, 2747, 2737, 2741,
-     2748, 2738, 2749, 2750, 2752, 2742, 2753, 2750, 2746, 2745,
-     2754, 2748, 2756, 2756, 2755, 2757, 2754, 2749, 2755, 2752,
-     2759, 2753, 2760, 2761, 2762, 2762, 2764, 2765, 2757, 2766,
-     2767, 2767, 2769, 2766, 2773, 2759, 2765, 2774, 2764, 2768,
-     2768, 2771, 2760, 2761, 2770, 2770, 2771, 2772, 2775, 2774,
-     2773, 2769, 2776, 2776, 2781, 2781, 2772, 2782, 2783, 2783,
-     2784, 2785, 2786, 2787, 2790, 2790, 2791, 2788, 2775, 2789,
-     2792, 2803, 2787, 2784, 2785, 2786, 2788, 2797, 2789, 2782,
-     2794, 2794, 2797, 2799, 2800, 2792, 2791, 2801, 2799, 2802,
-
-     2803, 2804, 2801, 2805, 2807, 2811, 2815, 2802, 2800, 2809,
-     2804, 2805, 2810, 2814, 2809, 2812, 2812, 2810, 2814, 2807,
-     2811, 2813, 2813, 2816, 2816, 2815, 2817, 2818, 2819, 2820,
-     2821,    0, 2818, 2817, 2822, 2824, 2821, 2823, 2823, 2822,
-     2825, 2826, 2826, 2827, 2827, 2825, 2819, 2820, 2830, 2833,
-     2824, 2831, 2831, 2832, 2833, 2833, 2832, 2834, 2835, 2836,
-     2837, 2830, 2834, 2835, 2838, 2839, 2837, 2840, 2838, 2841,
-     2839, 2842, 2843, 2836, 2844, 2845, 2840, 2846, 2847, 2842,
-     2844, 2845, 2846, 2851, 2841, 2848, 2848, 2850, 2851, 2852,
-     2847, 2854, 2852, 2843, 2850, 2856, 2857, 2858, 2859, 2860,
-
-     2856, 2857, 2858, 2854, 2861, 2862, 2863, 2863, 2864, 2868,
-     2865, 2873, 2860, 2861, 2862, 2865, 2859, 2864, 2869, 2870,
-     2874, 2875,    0, 2876, 2869, 2870, 2878, 2868, 2877, 2877,
-     2873, 2879, 2884, 2878, 2881, 2882, 2883, 2883, 2885, 2887,
-     2874, 2875, 2876, 2881, 2882, 2886, 2886, 2884, 2889, 2891,
-     2879, 2892, 2894, 2885, 2895, 2892, 2893, 2893, 2887, 2896,
-     2895, 2897, 2898, 2889, 2900, 2896, 2899, 2899, 2898, 2891,
-     2901, 2902, 2900, 2904, 2905, 2907, 2902, 2894, 2910, 2897,
-     2908, 2907, 2904, 2908, 2909, 2911, 2913, 2905, 2909, 2912,
-     2912, 2915, 2915, 2916,    0, 2901, 2910, 2917, 2917, 2911,
-
-     2923, 2913, 2918, 2918, 2920, 2920, 2921, 2922, 2927, 2923,
-     2921, 2916, 2922, 2925, 2925, 2928, 2930, 2929, 2931, 2933,
-     2928, 2930, 2930, 2934, 2934, 2936, 2936, 2940, 2927, 2929,
-     2931, 2937, 2937, 2938, 2938, 2939, 2941, 2944, 2939, 2933,
-     2940, 2943, 2943, 2946, 2947, 2947, 2948, 2948, 2952, 2941,
-     2949, 2949, 2950, 2951, 2951, 2944, 2953, 2954, 2955, 2956,
-     2956, 2952, 2957, 2946, 2955, 2961, 2957, 2950, 2964, 2960,
-     2961, 2954, 2963, 2965, 2953, 2960, 2966, 2963, 2963, 2967,
-     2968, 2969, 2979, 2970, 2976, 2967, 2968, 2970, 2971, 2971,
-     2974, 2964, 2976, 2965, 2977, 2974, 2966, 2977, 2980, 2981,
-
-     2981, 2980, 2982, 2983, 2984, 2985, 2969, 2979, 2983, 2986,
-     2987, 2987, 2988, 2989, 2990, 2991, 2989,    0, 2996, 2982,
-     2982, 2992, 2984, 2986, 2989, 2985, 2988, 2994, 2990, 2992,
-     2995, 3006, 2994, 2994, 2991, 2995, 2995, 2996, 2997, 2997,
-     2998, 2998, 2999, 2999, 3000, 3000, 3001, 3001, 3002, 3002,
-     3003, 3004, 3005, 3007, 3008, 3009, 3004, 3006, 3010, 3008,
-     3011, 3012, 3013, 3010, 3014, 3018, 3003, 3007, 3018, 3011,
-     3016, 3016, 3005, 3019, 3009, 3017, 3017, 3020, 3020, 3021,
-     3022, 3012, 3013, 3025, 3014, 3021, 3024, 3024, 3019, 3027,
-     3025, 3026, 3026, 3030, 3027, 3029, 3029, 3031, 3022, 3032,
-
-     3033, 3035, 3030, 3036, 3036, 3039, 3031, 3040, 3032, 3033,
-     3037, 3037, 3038, 3041, 3039, 3042, 3038, 3043, 3046, 3035,
-     3047, 3048, 3044, 3058, 3041, 3048, 3040, 3044, 3044, 3047,
-     3042, 3046, 3054, 3052, 3053, 3053, 3057, 3043, 3052, 3056,
-     3056, 3059, 3061, 3061, 3062, 3063, 3054, 3067, 3058, 3068,
-     3057, 3069, 3072, 3062, 3068, 3071, 3074, 3063, 3072, 3059,
-     3069, 3076, 3078, 3085, 3079, 3080, 3080, 3078, 3074, 3079,
-     3081, 3083, 3067, 3084, 3091, 3071, 3083, 3085, 3092, 3081,
-     3086, 3086, 3076, 3091, 3086, 3093, 3084, 3088, 3088, 3089,
-     3089, 3090, 3090, 3100, 3094, 3096, 3101, 3097, 3092, 3094,
-
-     3098, 3096, 3097, 3102, 3093, 3098, 3099, 3099, 3101, 3103,
-     3104, 3100, 3105, 3106, 3103, 3107, 3107, 3109, 3105, 3114,
-     3110, 3109, 3111, 3113, 3102, 3110, 3115, 3111, 3104, 3112,
-     3112, 3117, 3119, 3119, 3114, 3121, 3122, 3123, 3106, 3124,
-     3126, 3115, 3113, 3124, 3125, 3127, 3128, 3129, 3121, 3122,
-     3123, 3117, 3129, 3125, 3128, 3130, 3126, 3131, 3131, 3132,
-     3133, 3134, 3135, 3135, 3127, 3136, 3136, 3137, 3132, 3141,
-     3146, 3140, 3150, 3143, 3151, 3130, 3140, 3140, 3133, 3143,
-     3144, 3144, 3153, 3141, 3148, 3148, 3137, 3134, 3150, 3152,
-     3151, 3146, 3154, 3158, 3152, 3157, 3157, 3154, 3153, 3159,
-
-     3160, 3161, 3162, 3162, 3163, 3166, 3160, 3167, 3159, 3165,
-     3165, 3168, 3168, 3158, 3170, 3172, 3173, 3176, 3179, 3166,
-     3170, 3180, 3173, 3163, 3161, 3174, 3167, 3177, 3177, 3182,
-     3174, 3178, 3178, 3179, 3183, 3172, 3181, 3181, 3184, 3176,
-     3182, 3180, 3185, 3183, 3186, 3187, 3188, 3190, 3185, 3189,
-     3189, 3191, 3192, 3197, 3191, 3192, 3181, 3187, 3184, 3193,
-     3193, 3198, 3190, 3186, 3199, 3197, 3188, 3200, 3200, 3201,
-     3199, 3202, 3201, 3203, 3205, 3206, 3206, 3202, 3207, 3205,
-     3208, 3198, 3209, 3207, 3210, 3211, 3211, 3214, 3209, 3215,
-     3216, 3203, 3213, 3217, 3217, 3219, 3218, 3220, 3471, 3208,
-
-     3471, 3210, 3210, 3216, 3213, 3214, 3220, 3222, 3222, 3223,
-     3223, 3219, 3224, 3224, 3215, 3218, 3225, 3226, 3227, 3228,
-     3228, 3225, 3232, 3227, 3229, 3229, 3230, 3230, 3231, 3231,
-     3233, 3226, 3234, 3239, 3235, 3232, 3238, 3238, 3234, 3235,
-     3241, 3241, 3242, 3242, 3244, 3246, 3247, 3248, 3249, 3239,
-     3250, 3250, 3252, 3252, 3253, 3254, 3233, 3255, 3257, 3262,
-     3258, 3259, 3259, 3244, 3260, 3260, 3248, 3246, 3247, 3258,
-     3249, 3255, 3264, 3263, 3254, 3265, 3266, 3262, 3257, 3263,
-     3253, 3266, 3269, 3270, 3270, 3272, 3272, 3274, 3273, 3275,
-     3276, 3277, 3264, 3273, 3265, 3275, 3278, 3278, 3283, 3277,
-
-     3279, 3274, 3276, 3269, 3281, 3279, 3282, 3284, 3281, 3285,
-     3286, 3282, 3289, 3287, 3285, 3290, 3291, 3292, 3283, 3287,
-     3289, 3294, 3286, 3297, 3295, 3296, 3298, 3284, 3300, 3301,
-     3303, 3298, 3302, 3300, 3290, 3303, 3291, 3292, 3302, 3294,
-     3295, 3305, 3296, 3296, 3297, 3306, 3307, 3320, 3306, 3301,
-     3311, 3311, 3312, 3312, 3313, 3318, 3318, 3319, 3313, 3307,
-     3323, 3305, 3319, 3321, 3321,    0, 3320, 3326, 3326, 3327,
-     3327, 3336, 3327, 3328, 3328, 3323, 3328, 3329, 3329, 3330,
-     3330, 3331, 3330, 3333, 3334, 3331, 3335, 3335, 3333, 3336,
-     3337, 3340, 3340, 3334, 3341, 3342, 3343, 3344, 3344, 3345,
-
-     3348, 3343, 3349, 3350, 3337, 3352, 3354, 3350, 3351, 3349,
-        0, 3355, 3356, 3356, 3341, 3342, 3355, 3351, 3357, 3345,
-     3352, 3358, 3358, 3361, 3354, 3348, 3366, 3357, 3359, 3359,
-     3360, 3360, 3362, 3363, 3364, 3365, 3368, 3362, 3361, 3364,
-     3364, 3365, 3363, 3367, 3369, 3363, 3371, 3370,    0, 3369,
-     3373, 3366, 3370, 3372, 3372, 3374, 3373, 3368, 3367, 3375,
-     3375, 3374, 3376, 3376, 3377, 3371, 3378, 3381, 3381, 3383,
-     3383, 3378, 3384, 3386, 3388, 3388, 3389, 3389, 3397, 3377,
-        0, 3384, 3390, 3390, 3391, 3391, 3393, 3393, 3394, 3394,
-     3399, 3386, 3395, 3395, 3396, 3396, 3400, 3400, 3402, 3399,
-
-     3401, 3401, 3403, 3404, 3397, 3406, 3406, 3402, 3407, 3408,
-     3408, 3409, 3410, 3419, 3403, 3415, 3411, 3412, 3412, 3413,
-     3413, 3416, 3416, 3404, 3421, 3410, 3409, 3407, 3411, 3420,
-     3415, 3419, 3420, 3422, 3422, 3423, 3425, 3426, 3427, 3425,
-     3428, 3429, 3431, 3426, 3430, 3428, 3434, 3437, 3433, 3438,
-     3421, 3437, 3427, 3423, 3433, 3434, 3441, 3442, 3431, 3455,
-     3429, 3451, 3430, 3461, 3438, 3452, 3451, 3464, 3452, 3456,
-     3456, 3462, 3455, 3457, 3457, 3459, 3459, 3442, 3466, 3463,
-     3462, 3468, 3441, 3463, 3469, 3470, 3461, 3464, 3472, 3474,
-     3470, 3475, 3466, 3473, 3473, 3469, 3476, 3477, 3478, 3480,
-
-     3479, 3482, 3474, 3472, 3468, 3481, 3482, 3483, 3480, 3487,
-     3475, 3484, 3485, 3477, 3476, 3479, 3484, 3481, 3486, 3486,
-     3488, 3492, 3493, 3478, 3495, 3488, 3494, 3494, 3483, 3487,
-     3500, 3485, 3501, 3495, 3505, 3492, 3496, 3496, 3497, 3497,
-     3498, 3498, 3493, 3499, 3499, 3502, 3503, 3506, 3502, 3500,
-     3504, 3503, 3501, 3508, 3507, 3504, 3509, 3512, 3510, 3505,
-     3507, 3517, 3506, 3510, 3511, 3511, 3518, 3508, 3509, 3513,
-     3513, 3514, 3514, 3516, 3516, 3521, 3517, 3512, 3519, 3519,
-     3523, 3526, 3526, 3527, 3527, 3518, 3528, 3529, 3532, 3530,
-     3521, 3531, 3533, 3534, 3528, 3530, 3535, 3531, 3523, 3536,
-
-     3536, 3535, 3532, 3538, 3538, 3533, 3529, 3542, 3545, 3543,
-     3546, 3548, 3534, 3549, 3546, 3550, 3553, 3551, 3549, 3552,
-     3554, 3555, 3545, 3556, 3556, 3554, 3555, 3559, 3542, 3543,
-     3551, 3548, 3552, 3560, 3550, 3553, 3561, 3562, 3562, 3563,
-     3564, 3565, 3565, 3566, 3563, 3567, 3564, 3559, 3566, 3568,
-     3567, 3560, 3569, 3570, 3568, 3561, 3572, 3572, 3573, 3570,
-     3574, 3574, 3576, 3573, 3577, 3578, 3576, 3579, 3580, 3581,
-     3582, 3569, 3578, 3585, 3585, 3581, 3588, 3583, 3587, 3587,
-     3590, 3591, 3592, 3577, 3597, 3588, 3579, 3580, 3588, 3582,
-     3583, 3589, 3593, 3593, 3595, 3592, 3589, 3594, 3599, 3590,
-
-     3591, 3604, 3594, 3598, 3598, 3600, 3600, 3595, 3601, 3601,
-     3597, 3602, 3603, 3605, 3605,    0, 3602, 3599, 3606, 3603,
-     3604, 3609, 3607, 3606, 3607, 3608, 3608, 3610, 3609, 3611,
-     3612, 3613, 3615, 3615, 3610, 3612, 3616, 3618, 3619, 3620,
-     3621, 3625, 3618, 3619, 3622, 3622, 3624, 3624, 3611, 3626,
-     3613, 3627, 3627, 3628, 3628, 3616, 3629, 3639, 3620, 3621,
-     3625, 3631, 3631, 3629, 3632, 3632, 3633, 3635, 3626, 3638,
-     3640,    0, 3635, 3633, 3638,    0, 3639, 3641, 3641, 3642,
-     3642,    0,    0,    0,    0,    0,    0,    0,    0, 3640,
-     3646, 3646, 3646, 3646, 3646, 3646, 3646, 3647, 3647, 3647,
-
-     3647, 3647, 3647, 3647, 3648, 3648, 3648, 3648, 3648, 3648,
-     3648, 3649, 3649, 3649, 3649, 3649, 3649, 3649, 3650, 3650,
-     3650, 3650, 3650, 3650, 3650, 3651, 3651, 3651, 3651, 3651,
-     3651, 3651, 3652, 3652, 3652, 3652, 3652, 3652, 3652, 3654,
-     3654,    0, 3654, 3654, 3654, 3654, 3655, 3655,    0,    0,
-        0, 3655, 3655, 3656, 3656,    0,    0, 3656,    0, 3656,
-     3657,    0,    0,    0,    0,    0, 3657, 3658, 3658,    0,
-        0,    0, 3658, 3658, 3659,    0,    0,    0,    0,    0,
-     3659, 3660, 3660,    0, 3660, 3660, 3660, 3660, 3661,    0,
-        0,    0,    0,    0, 3661, 3662, 3662,    0,    0,    0,
-
-     3662, 3662, 3663, 3663,    0, 3663, 3663, 3663, 3663, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645,
-     3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645
+       14,   14,   14,  100,   14,   12,   15,   15,   15,   38,
+       23,   14,   23,   23,   12,   23, 3065,   15,   16,   16,
+       16,   23,   23,   27,   27,   30,   30,   31,   31,   16,
+       25,   27,  130,   25,   25,   27,   31,   25,   27,   32,
+       30,   46,   25,   32,   25,  130,   32,   31,   40,   45,
+       45,   25,   28,   32,   45,   32,   46,   28,   45,   36,
+       36,   28,   40,   96,   28,   44,   28,   28,   36,   44,
+       37,   37,  112,   56,   36,   37,   56,   28,   36,   44,
+
+       41,   41,   96,   44,   44,   41,   67,   67,   95,   37,
+      112,   37,   39,   39,   42,   41,   41,   39,   41,   42,
+       95,   39,   42,   43,   43,   73,   43,   39,  187,   42,
+       39,   84,   84,   42,   42,   43,  187,   39,  152,   73,
+       62,   43,   62,   62,   70,   62,   70,   70,   72,   70,
+       72,   72,   79,   72,   79,   79,   70,   79,   86,  152,
+       86,   86,   87,   86,   97,   89,   87,   89,   89,   86,
+       89,   92,  102,   94,   92,   93,   89,   89,   98,   93,
+       94,   98,   99,  101,   97,   99,  102,  102,  103,  104,
+      105,  106,  101, 1192,  103,  107,  110,  108,   99,  109,
+
+      103,  107,  103,  113,  109,  114,  111,  104,  104,  114,
+      106,  108,  105,  109,  107,  115,  110,  111,  111,  116,
+      117,  113,  119,  118,  116,  111,  118,  120,  119,  118,
+      122,  121,  126,  122,  117,  115,  121,  122,  123,  126,
+      124,  125,  118,  118,  128,  125,  120,  119,  127,  129,
+      131,  128,  137,  122,  124,  132,  121,  123,  129,  132,
+      133,  127,  123,  134,  135,  139,  136,  134,  127,  141,
+      131,  136,  137,  138,  138,  136,  140,  142,  133,  143,
+      140,  136,  135,  144,  141,  139,  144,  145,  178,  140,
+      146,  150,  147,  148,  148,  140,  146,  144,  143,  146,
+
+      145,  144,  149,  142,  147,  151,  153,  150,  154,  149,
+      154,  148,  156,  155,  148,  157,  158,  156,  159,  154,
+      149,  160,  153,  159,  151,  155,  198,  157,  162,  162,
+      164,  154,  198,  164,  158,  160,  166,  174,  166,  166,
+      174,  166,  169,  169,  171,  182,  171,  171,  172,  171,
+      172,  172,  176,  172,  176,  176,  180,  176,  179,  179,
+      172,  180,  181,  182,  183,  184,  185,  186,  181,  189,
+      188,  190,  191,  193,  185,  192,  190,  181,  186,  183,
+      195,  185,  193,  216,  189,  196,  192,  194,  184,  188,
+      196,  202,  191,  194,  194,  197,  197,  199,  204,  199,
+
+      200,  216,  199,  202,  200,  195,  201,  201,  205,  200,
+      203,  208,  207,  205,  200,  203,  203,  204,  206,  199,
+      200,  200,  209,  206,  207,  210,  212,  211,  209,  210,
+      213,  208,  211,  214,  215,  217,  218,  221,  220,  222,
+      217,  218,  212,  220,  213,  230,  215,  227,  214,  215,
+      271,  209,  219,  219,  223,  222,  219,  221,  219,  225,
+      223,  224,  224,  226,  271,  225,  230,  227,  228,  226,
+      219,  225,  219,  229,  228,  231,  233,  232,  233,  229,
+      234,  231,  232,  235,  236,  241,  234,  235,  229,  237,
+      236,  237,  238,  239,  240,  242,  237,  243,  238,  244,
+
+      240,  242,  246,  245,  247,  241,  239,  248,  250,  247,
+      243,  245,  249,  251,  254,  246,  248,  253,  256,  243,
+      252,  261,  253,  244,  250,  252,  252,  249,  258,  257,
+      255,  259,  254,  251,  255,  257,  263,  260,  263,  262,
+      256,  261,  259,  260,  262,  264,  258,  258,  265,  268,
+      266,  267,  269,  270,  277,  265,  266,  267,  269,  272,
+      272,  273,  273,  274,  264,  270,  275,  279,  268,  274,
+      278,  276,  275,  276,  280,  278,  281,  277,  282,  279,
+      283,  284,  297,  285,  281,  283,  286,  274,  285,  287,
+      276,  288,  286,  280,  289,  287,  288,  290,  282,  289,
+
+      291,  293,  292,  290,  284,  294,  295,  297,  299,  296,
+      302,  299,  298,  302,  294,  291,  292,  296,  298,  293,
+      295,  300,  303,  300,  301,  301,  304,  304,  305,  305,
+      306,  308,  307,  307,  308,  309,  310,  312,  314,  309,
+      303,  311,  316,  315,  314,  310,  306,  307,  316,  317,
+      311,  317,  318,  320,  320,  319,  312,  315,  318,  319,
+      321,  322,  323,  324,  325,  321,  327,  322,  323,  326,
+      328,  328,  329,  330,  331,  329,  319,  332,  331,  327,
+      333,  335,  325,  324,  334,  334,  336,  323,  337,  336,
+      326,  330,  340,  342,  339,  338,  332,  339,  333,  335,
+
+      337,  338,  342,  343,  340,  344,  336,  341,  346,  347,
+      344,  346,  349,  361,  349,  349,  341,  348,  361,  341,
+      351,  343,  347,  351,  341,  341,  341,  341,  345,  348,
+      350,  345,  177,  345,  352,  350,  350,  352,  353,  353,
+      354,  355,  358,  356,  357,  345,  345,  345,  364,  345,
+      359,  358,  360,  360,  362,  362,  355,  354,  356,  359,
+      354,  357,  357,  363,  363,  365,  366,  367,  368,  369,
+      370,  366,  371,  364,  372,  372,  374,  372,  371,  367,
+      365,  552,  383,  375,  376,  370,  372,  368,  375,  369,
+      376,  383,  377,  372,  378,  379,  374,  377,  379,  378,
+
+      379,  380,  381,  382,  552,  378,  382,  385,  381,  384,
+      384,  386,  386,  385,  392,  380,  387,  390,  393,  382,
+      391,  387,  382,  391,  382,  388,  388,  399,  388,  392,
+      394,  397,  396,  393,  388,  396,  175,  390,  388,  427,
+      400,  391,  399,  388,  394,  397,  388,  389,  389,  400,
+      389,  396,  401,  404,  402,  403,  406,  401,  401,  407,
+      402,  409,  405,  389,  427,  406,  389,  402,  389,  408,
+      389,  398,  404,  398,  398,  408,  403,  405,  407,  409,
+      410,  411,  412,  398,  398,  398,  398,  398,  413,  415,
+      398,  416,  414,  417,  413,  418,  412,  414,  413,  419,
+
+      418,  411,  420,  423,  419,  428,  410,  421,  417,  415,
+      424,  416,  425,  421,  426,  414,  431,  420,  422,  422,
+      426,  428,  424,  423,  429,  432,  425,  430,  430,  429,
+      430,  433,  434,  437,  170,  435,  431,  436,  437,  436,
+      438,  443,  438,  438,  442,  432,  439,  433,  434,  435,
+      439,  440,  441,  441,  445,  440,  443,  444,  447,  449,
+      438,  446,  450,  442,  451,  449,  447,  447,  453,  451,
+      440,  450,  445,  444,  168,  446,  454,  453,  447,  452,
+      447,  448,  454,  452,  455,  456,  448,  458,  457,  460,
+      458,  456,  457,  462,  448,  448,  459,  470,  448,  448,
+
+      465,  459,  448,  461,  461,  455,  462,  463,  463,  460,
+      464,  466,  466,  465,  467,  464,  469,  468,  470,  471,
+      467,  468,  472,  474,  471,  473,  473,  472,  475,  476,
+      477,  469,  479,  478,  473,  474,  478,  482,  480,  481,
+      483,  482,  477,  480,  481,  484,  484,  476,  475,  485,
+      486,  488,  483,  479,  485,  487,  487,  490,  491,  491,
+      493,  494,  495,  490,  497,  496,  499,  498,  500,  494,
+      502,  486,  498,  488,  496,  503,  504,  506,  505,  167,
+      500,  493,  510,  495,  505,  497,  499,  510,  502,  507,
+      502,  506,  508,  503,  509,  507,  504,  511,  512,  513,
+
+      509,  508,  513,  514,  515,  516,  512,  517,  518,  512,
+      520,  511,  519,  517,  516,  519,  520,  514,  521,  515,
+      522,  523,  525,  524,  526,  522,  525,  528,  518,  530,
+      527,  529,  521,  531,  520,  527,  529,  532,  535,  536,
+      537,  526,  528,  523,  524,  530,  539,  538,  541,  655,
+      532,  538,  531,  533,  533,  537,  655,  540,  535,  533,
+      536,  533,  540,  544,  541,  539,  542,  533,  546,  533,
+      542,  543,  533,  533,  547,  548,  543,  545,  544,  533,
+      543,  548,  545,  547,  546,  549,  548,  546,  550,  551,
+      553,  555,  551,  554,  554,  556,  556,  557,  559,  558,
+
+      549,  561,  545,  562,  550,  560,  560,  565,  564,  563,
+      553,  558,  557,  559,  563,  566,  555,  564,  567,  569,
+      561,  574,  573,  570,  567,  562,  565,  570,  569,  571,
+      566,  572,  575,  571,  573,  576,  574,  572,  577,  578,
+      579,  580,  581,  583,  577,  580,  582,  586,  582,  576,
+      587,  575,  584,  586,  578,  581,  585,  585,  579,  588,
+      584,  590,  587,  589,  592,  588,  593,  583,  591,  589,
+      594,  591,  597,  590,  595,  594,  596,  595,  592,  165,
+      599,  593,  600,  600,  598,  596,  601,  601,  597,  598,
+      598,  603,  596,  599,  602,  596,  602,  603,  604,  604,
+
+      605,  605,  606,  608,  607,  609,  610,  612,  606,  607,
+      607,  611,  612,  613,  611,  614,  615,  616,  610,  615,
+      617,  608,  616,  614,  619,  618,  609,  620,  619,  621,
+      622,  624,  613,  620,  622,  623,  624,  625,  626,  626,
+      627,  628,  629,  617,  618,  630,  633,  629,  632,  621,
+      631,  625,  633,  623,  634,  627,  635,  637,  639,  634,
+      638,  638,  628,  640,  630,  706,  631,  706,  632,  636,
+      635,  643,  636,  641,  644,  637,  639,  636,  641,  640,
+      636,  636,  642,  647,  646,  643,  653,  642,  648,  644,
+      646,  648,  647,  649,  650,  651,  652,  649,  651,  650,
+
+      654,  652,  653,  656,  657,  658,  659,  659,  660,  657,
+      661,  663,  664,  666,  665,  662,  656,  660,  654,  649,
+      662,  667,  666,  672,  670,  658,  664,  670,  668,  661,
+      665,  669,  663,  667,  668,  671,  671,  669,  671,  672,
+      673,  674,  675,  673,  676,  677,  674,  678,  679,  680,
+      683,  681,  678,  683,  684,  680,  681,  682,  676,  677,
+      675,  685,  686,  682,  687,  695,  685,  679,  688,  687,
+      687,  689,  690,  693,  691,  692,  163,  690,  686,  684,
+      691,  688,  693,  694,  689,  695,  696,  696,  694,  697,
+      698,  690,  690,  700,  692,  699,  697,  698,  699,  700,
+
+      701,  702,  703,  704,  704,  705,  702,  703,  703,  707,
+      709,  710,  701,  699,  711,  708,  702,  708,  712,  713,
+      714,  715,  716,  720,  717,  721,  716,  715,  707,  710,
+      705,  709,  711,  717,  718,  719,  712,  723,  713,  722,
+      714,  720,  722,  725,  721,  726,  727,  724,  728,  718,
+      719,  722,  723,  724,  729,  730,  731,  733,  727,  726,
+      731,  732,  734,  725,  735,  736,  737,  728,  740,  740,
+      743,  738,  739,  733,  730,  729,  738,  741,  742,  732,
+      734,  741,  735,  735,  736,  737,  739,  744,  745,  743,
+      746,  747,  742,  748,  750,  746,  749,  753,  744,  751,
+
+      754,  750,  745,  752,  751,  754,  755,  747,  756,  749,
+      752,  755,  748,  757,  758,  759,  760,  161,  761,  763,
+      757,  753,  762,  758,  763,  760,  756,  766,  762,  759,
+      761,  764,  765,  767,  764,  768,  765,  769,  770,  771,
+      769,  766,  767,  772,  772,  773,  773,  774,  774,  776,
+      768,  775,  770,  778,  773,  779,  775,  780,  776,  781,
+      771,  779,  782,  783,  784,  785,  782,  786,  789,  787,
+      790,  788,  778,  786,  791,  783,  780,  787,  788,  781,
+      841,  797,  794,  785,  797,  798,  789,  802,  804,  784,
+      801,  807,  841,  802,  791,  790,  792,  794,  792,  801,
+
+      805,  792,  798,  806,  814,  792,  805,  807,  792,  808,
+      804,  812,  806,  808,  811,  792,  792,  813,  792,  809,
+      809,  810,  810,  817,  814,  811,  815,  819,  820,  812,
+       85,  813,  815,  816,  816,  816,  818,  816,  821,  822,
+      816,  818,  821,  817,  827,  816,  820,  825,  819,  823,
+      824,  816,  816,  823,  816,  824,  826,  828,  840,  827,
+      840,  826,  829,  822,  831,  829,  825,  830,  833,  823,
+       80,  831,  830,  830,  832,  832,  834,  835,  835,  836,
+      842,  834,  828,  833,  836,  837,  838,  844,  837,  839,
+      839,  838,  843,  845,  846,  848,  843,  847,  847,  842,
+
+      849,  851,  846,  850,  850,  852,  853,  844,  855,  854,
+      848,  859,  845,  855,  849,  854,  859,  852,  857,  851,
+      856,  856,  861,  857,  857,  860,  862,  863,  853,  864,
+      866,  860,  865,  868,  869,  864,  866,  865,  867,  868,
+      861,  867,  869,  870,  870,  862,  872,  863,  871,  871,
+      873,  874,  875,  877,  878,  876,  880,  875,  873,  876,
+      877,  879,  881,  881,  872,  882,  884,  884,  883,  874,
+      886,  887,  878,  885,  882,  880,  883,  879,  889,  885,
+      890,  891,  894,  893,  897,  894,  892,  889,  886,  890,
+      887,  892,  893,  895,  896,  898,  900,  899,  895,  901,
+
+      903,  900,  900,  904,  898,  891,  902,  902,  896,  897,
+      899,  905,  906,  901,  907,  903,  908,  911,  911,  908,
+      905,  910,  904,  910,  912,  913,  914,  908,  915,  916,
+      913,  917,  907,  915,  918,  919,  906,  920,  921,  922,
+      923,  924,  925,  922,  926,  912,  920,  914,  925,  916,
+      927,  917,  928,  926,  929,  919,  918,  930,  923,  931,
+      924,  921,  927,  933,  932,  931,  935,  935,  928,  934,
+      936,  930,  932,  929,  934,  937,  938,  933,  939,  940,
+      941,  942,  943,  948,  944,  938,  945,  940,  946,  936,
+      947,  950,  951,  949,  946,  937,  947,  948,  939,  949,
+
+      941,  943,  952,  942,  944,  950,  945,  953,  952,  955,
+      954,  956,  951,  953,  954,  957,  958,  959,  959,  960,
+      957,  961,  963,  956,  966,  960,  962,  961,  955,  962,
+      964,  956,  965,  967,  967,  968,  969,  958,  965,  970,
+      963,  969,  970,  964,  966,  971,  972,  975,  973,  977,
+      971,  971,  973,  968,  976,  970,  979,  970,  974,  974,
+      978,  972,  981,  982,  977,  978,  984,  985,  986,  975,
+      991,  988,  989,  989,  976,  979,  988,  982,  990,  984,
+      992,  992,  990,  993,  994,  991,  981,  985,  994,  986,
+      987,  996,  995,  987,   75,  987,  998,  997,  999,  987,
+
+     1000,  987,  997,  999,  999,  996,  987,  995,  993, 1000,
+      998,  987, 1001, 1002, 1006, 1003, 1004, 1002, 1009, 1006,
+     1005, 1004, 1007, 1008, 1008, 1011, 1001, 1010, 1012, 1002,
+     1003, 1004, 1005, 1012, 1011, 1014, 1007, 1013, 1015, 1009,
+     1014, 1010, 1016, 1013, 1015, 1017, 1017, 1018, 1016, 1019,
+     1020, 1021, 1018, 1022, 1024, 1019, 1025, 1027, 1028, 1028,
+     1029, 1025, 1026, 1031, 1032, 1029, 1024, 1030, 1033, 1027,
+     1021, 1022, 1020, 1023, 1023, 1030, 1026, 1031, 1034, 1023,
+     1032, 1023, 1033, 1035, 1036, 1037, 1039, 1023, 1040, 1038,
+     1042, 1037, 1023, 1023, 1038, 1041, 1043, 1034, 1039, 1023,
+
+     1036, 1045, 1035, 1044, 1044, 1045, 1040, 1046, 1042, 1048,
+     1049, 1041, 1050, 1049, 1043, 1048, 1051, 1052, 1053, 1055,
+     1054, 1051, 1062, 1057, 1053, 1054, 1058, 1046, 1059, 1064,
+     1052, 1050, 1057, 1060, 1061, 1058, 1065, 1063, 1055, 1060,
+     1066, 1062, 1063, 1061, 1059, 1067, 1068, 1069, 1070, 1064,
+     1065, 1071, 1072, 1074, 1070, 1068, 1069, 1067, 1072, 1076,
+     1066, 1077, 1078, 1081, 1082, 1079, 1080, 1083, 1071, 1074,
+     1079, 1084, 1080, 1076, 1085, 1086, 1092, 1092, 1082, 1085,
+     1086, 1077, 1081, 1089, 1090, 1083, 1084, 1078, 1089, 1090,
+     1091, 1093, 1094, 1095, 1096, 1097, 1099, 1093, 1094, 1091,
+
+     1100, 1103, 1095, 1102, 1102, 1100, 1100, 1102, 1097, 1096,
+     1104, 1105, 1099, 1104, 1106, 1107, 1103, 1108, 1110, 1109,
+     1111, 1112, 1113, 1114, 1115, 1105, 1111, 1120, 1113, 1115,
+     1116, 1107, 1109, 1110, 1106, 1108, 1118, 1118, 1114, 1119,
+     1121, 1112, 1119, 1123, 1116, 1121, 1122, 1124, 1120, 1125,
+     1126, 1122, 1127, 1130, 1125, 1126, 1124, 1129, 1132, 1123,
+     1131, 1133, 1136, 1129, 1127, 1135, 1131, 1133, 1139, 1130,
+     1134, 1134, 1137, 1140, 1135, 1137, 1138, 1138, 1141, 1132,
+     1136, 1142, 1143, 1144, 1142, 1145, 1139, 1146, 1154, 1144,
+     1155, 1145, 1140, 1146, 1147, 1143, 1148, 1149, 1141, 1147,
+
+     1150, 1148, 1151, 1149, 1153, 1150, 1154, 1156, 1151, 1153,
+     1155, 1157, 1159, 1156, 1158, 1158, 1157, 1160, 1161, 1162,
+     1163, 1159, 1164, 1161, 1165, 1164, 1160, 1165, 1167, 1166,
+     1168, 1169, 1170, 1167, 1173, 1171, 1172, 1162, 1176, 1163,
+     1166, 1171, 1172, 1169, 1177, 1174, 1175, 1175, 1168, 1173,
+     1174, 1170, 1178, 1179, 1181, 1180, 1182, 1176, 1177, 1180,
+     1183, 1184, 1186, 1191, 1178, 1182, 1187, 1187, 1188, 1189,
+     1190, 1179, 1181, 1193, 1189, 1190, 1188, 1194, 1195, 1183,
+     1196, 1186, 1197, 1191, 1198, 1196, 1184, 1193, 1199, 1199,
+     1195, 1197, 1194, 1200, 1201, 1202, 1203, 1204, 1211, 1198,
+
+     1201, 1202, 1204, 1205, 1206, 1205, 1207, 1208, 1210, 1206,
+     1209, 1212, 1203, 1200, 1212, 1209, 1214, 1211, 1213, 1215,
+     1207, 1208, 1218, 1210, 1219, 1213, 1217, 1217, 1220, 1221,
+     1222, 1214, 1223, 1226, 1226, 1221, 1218, 1223, 1215, 1232,
+     1225, 1230, 1219, 1220, 1225, 1233, 1223, 1227, 1223, 1229,
+     1222, 1223, 1227, 1228, 1228, 1230, 1229, 1231, 1232, 1234,
+     1231, 1236, 1237, 1233, 1238, 1239, 1236, 1240, 1234, 1241,
+     1243, 1239, 1240, 1242, 1245, 1245, 1238, 1246, 1248, 1252,
+     1247, 1237, 1246, 1241, 1242, 1247, 1249, 1251, 1250, 1243,
+     1253, 1249, 1250, 1254, 1252, 1256, 1251, 1255, 1248, 1257,
+
+     1255, 1258, 1259, 1260, 1261, 1253, 1257, 1264, 1262, 1255,
+     1256, 1263, 1254, 1258, 1262, 1266, 1267, 1265, 1264, 1268,
+     1270, 1259, 1261, 1265, 1260, 1269, 1263, 1272, 1268, 1271,
+     1273, 1275, 1274, 1276, 1279, 1266, 1267, 1275, 1278, 1270,
+     1269, 1271, 1280, 1281, 1278, 1282, 1272, 1274, 1283, 1279,
+     1285, 1281, 1284, 1276, 1286, 1273, 1280, 1284, 1287, 1286,
+     1286, 1288, 1285, 1289, 1283, 1282, 1290, 1290, 1292, 1295,
+     1295, 1293, 1301, 1301,   74, 1288, 1289, 1287, 1291, 1291,
+     1293, 1292, 1294, 1291, 1296, 1297, 1291, 1291, 1294, 1296,
+     1298, 1291, 1302, 1299, 1297, 1300, 1298, 1291, 1299, 1305,
+
+     1300, 1291, 1303, 1303, 1304, 1306, 1307, 1304, 1308, 1304,
+     1311, 1310, 1307, 1302, 1308, 1309, 1312, 1313, 1309, 1305,
+     1310, 1312, 1314, 1306, 1318, 1320, 1315, 1316, 1317, 1318,
+     1311, 1313, 1315, 1316, 1317, 1319, 1321, 1322, 1320, 1319,
+     1314, 1323, 1322, 1324, 1324, 1321, 1325, 1325, 1326, 1325,
+     1321, 1329, 1321, 1328, 1321, 1323, 1321, 1328, 1330, 1326,
+     1332, 1331, 1333, 1334, 1335, 1336, 1329, 1333, 1333, 1332,
+     1336, 1337, 1334, 1338, 1339, 1340, 1341, 1342, 1330, 1331,
+     1343, 1343, 1338, 1342, 1344, 1337, 1335, 1345, 1346, 1348,
+     1341, 1349, 1347, 1339, 1340, 1345, 1344, 1347, 1350, 1351,
+
+     1349, 1352, 1346, 1348, 1353, 1350, 1354, 1354, 1355, 1353,
+     1356, 1356, 1358, 1357, 1358, 1361, 1360, 1351, 1357, 1360,
+     1361, 1362, 1363, 1355, 1364, 1364, 1352, 1365, 1366, 1366,
+     1368, 1363, 1367, 1367, 1369, 1368, 1370, 1371, 1372, 1372,
+     1362, 1373, 1374, 1375, 1376, 1377, 1375, 1365, 1378, 1381,
+     1380, 1377, 1380, 1378, 1379, 1369, 1384, 1370, 1371, 1374,
+     1385, 1373, 1383, 1379, 1376, 1383, 1387, 1381, 1389, 1386,
+     1388, 1384, 1390, 1385, 1386, 1388, 1389, 1390, 1391, 1392,
+     1387, 1391, 1393, 1393, 1392, 1394, 1395, 1396, 1397, 1398,
+     1394, 1400, 1401, 1396, 1402, 1397, 1403, 1400, 1401, 1402,
+
+     1404, 1403, 1398, 1405, 1395, 1406, 1404, 1407, 1408, 1408,
+     1409, 1411, 1405, 1412, 1414, 1413, 1411, 1415, 1407, 1416,
+     1417, 1418, 1419, 1420, 1406, 1413, 1417, 1418, 1419, 1414,
+     1409, 1412, 1422, 1423, 1420, 1424, 1425, 1415, 1422, 1426,
+     1427, 1428, 1416, 1429, 1429, 1430, 1431, 1423, 1432, 1434,
+     1436, 1426, 1433, 1423, 1427, 1424, 1425, 1433, 1437, 1428,
+     1435, 1435, 1439, 1437, 1440, 1430, 1432, 1434, 1441, 1440,
+     1440, 1431, 1443, 1436, 1442, 1444, 1445, 1446, 1457, 1447,
+     1443, 1439, 1450, 1442, 1447, 1448, 1441, 1447, 1449, 1444,
+     1449, 1445, 1446, 1452, 1448, 1446, 1450, 1453, 1454, 1452,
+
+     1455, 1453, 1456, 1459, 1457, 1455, 1455, 1458, 1459, 1454,
+     1460, 1461, 1462, 1463, 1464, 1460, 1461, 1465, 1467, 1464,
+     1468, 1456, 1469, 1470, 1470, 1458, 1472, 1471, 1473, 1474,
+     1462, 1471, 1467, 1463, 1475, 1474, 1476, 1465, 1468, 1477,
+     1469, 1478, 1479, 1481, 1472, 1480, 1475, 1473, 1482, 1483,
+     1485, 1486, 1476, 1482, 1484, 1478, 1483, 1479, 1477, 1484,
+     1480, 1487, 1481, 1488, 1490, 1486, 1489, 1489, 1485, 1491,
+     1492, 1494, 1488, 1493, 1493, 1495, 1500, 1494, 1491, 1490,
+     1496, 1495, 1487, 1497, 1497, 1498, 1498, 1499, 1501, 1503,
+     1492, 1502, 1500, 1499, 1496, 1503, 1502, 1504, 1505, 1506,
+
+     1506, 1507, 1507, 1504, 1505, 1509, 1509, 1510, 1511, 1501,
+     1512, 1510, 1513, 1514, 1515, 1516, 1518, 1511, 1517, 1517,
+     1521, 1507, 1516, 1507, 1513, 1519, 1520, 1514, 1512, 1515,
+     1522, 1520, 1523, 1519, 1521, 1524, 1518, 1523, 1523, 1525,
+     1524, 1524, 1526, 1526, 1527, 1528, 1529, 1530, 1531, 1522,
+     1532, 1533, 1530, 1535, 1534, 1529, 1536, 1537, 1535, 1525,
+     1534, 1538, 1539, 1527, 1528, 1540, 1541, 1531, 1544, 1533,
+     1532, 1540, 1542, 1543, 1536, 1545, 1538, 1537, 1542, 1543,
+     1546, 1547, 1548, 1549, 1545, 1541, 1551, 1544, 1539, 1550,
+     1552, 1553, 1553, 1554, 1555, 1556, 1554, 1557,   68, 1546,
+
+     1547, 1548, 1549, 1550, 1561, 1552, 1562, 1551, 1561, 1557,
+     1558, 1558, 1560, 1555, 1556, 1559, 1559, 1560, 1563, 1562,
+     1564, 1565, 1566, 1570, 1566, 1568, 1569, 1571, 1566, 1564,
+     1572, 1569, 1574, 1563, 1565, 1573, 1573, 1574, 1570, 1575,
+     1576, 1566, 1578, 1568, 1577, 1575, 1572, 1571, 1578, 1579,
+     1582, 1583, 1580, 1585, 1579, 1576, 1580, 1577, 1581, 1584,
+     1586, 1589, 1581, 1587, 1587, 1591, 1586, 1592, 1584, 1583,
+     1582, 1591, 1593, 1585, 1594, 1594, 1595, 1593, 1596, 1589,
+     1598, 1598, 1595, 1600, 1601, 1601, 1600, 1602, 1592, 1603,
+     1604, 1606, 1607, 1609, 1606, 1608, 1610, 1612, 1596, 1611,
+
+     1611, 1613, 1609, 1602, 1614, 1603, 1604, 1616, 1620, 1615,
+     1621, 1617, 1612, 1607, 1615, 1608, 1610, 1617, 1618, 1618,
+     1619, 1616, 1613, 1614, 1622, 1621, 1620, 1623, 1625, 1619,
+     1624, 1624, 1626, 1627, 1629, 1629, 1628, 1630, 1627, 1631,
+     1633, 1630, 1625, 1632, 1632, 1634, 1635, 1623, 1636, 1622,
+     1626, 1628, 1636, 1637, 1642, 1638, 1645, 1635, 1641, 1631,
+     1638, 1641, 1633, 1643, 1634, 1640, 1640, 1642, 1643, 1644,
+     1646, 1647, 1637, 1648, 1645, 1649, 1652, 1650, 1651, 1651,
+       63, 1652, 1653, 1654, 1646, 1644, 1650, 1648, 1655, 1655,
+     1647, 1647, 1656, 1657, 1658, 1659, 1662, 1659, 1657, 1660,
+
+     1649, 1656, 1653, 1654, 1660, 1661, 1663, 1666, 1664, 1667,
+     1667, 1661, 1663, 1664, 1658, 1668, 1662, 1669, 1672, 1671,
+     1676, 1666, 1675, 1669, 1671, 1673, 1673, 1674, 1674, 1677,
+     1678, 1679, 1679, 1678, 1668, 1680, 1675, 1681, 1676, 1682,
+     1683, 1684, 1672, 1683, 1677, 1685, 1683, 1684, 1686, 1681,
+     1685, 1686, 1688, 1680, 1690, 1689, 1692, 1692, 1683, 1682,
+     1689, 1688, 1691, 1693, 1694, 1691, 1695, 1686, 1696, 1701,
+     1694, 1702, 1695, 1696, 1697, 1697, 1698, 1698, 1699, 1690,
+     1700, 1703, 1701, 1704, 1699, 1700, 1706, 1693, 1705, 1702,
+     1707, 1705, 1706, 1708, 1711, 1710, 1707, 1709, 1715, 1708,
+
+     1703, 1710, 1709, 1704, 1712, 1713, 1713, 1714, 1716, 1712,
+     1717, 1718, 1714, 1719, 1724, 1720, 1715, 1711, 1721, 1723,
+     1722, 1726, 1725, 1726, 1727, 1717, 1725, 1732, 1716, 1720,
+     1718, 1728, 1721, 1719, 1722, 1730, 1731, 1723, 1728, 1724,
+     1732, 1734, 1735, 1727, 1733, 1736, 1737, 1730, 1731, 1738,
+     1733, 1743, 1738, 1739, 1739, 1740, 1742, 1742, 1735, 1747,
+     1737, 1734, 1744, 1745, 1740, 1736, 1748, 1744, 1746, 1746,
+     1738, 1743, 1749, 1750, 1747, 1745, 1751, 1752, 1754, 1753,
+     1748, 1755, 1759, 1757,   58, 1751, 1753, 1754, 1761, 1761,
+     1754, 1750, 1752, 1762, 1762, 1764, 1749, 1755, 1757, 1760,
+
+     1763, 1765, 1760, 1757, 1765, 1766, 1766, 1759, 1767, 1768,
+     1769, 1770, 1763, 1764, 1771, 1769, 1770, 1771, 1772, 1773,
+     1775, 1767, 1774, 1776, 1773, 1777, 1778, 1779, 1768, 1782,
+     1782, 1780, 1776, 1784, 1785, 1778, 1775, 1781, 1778, 1772,
+     1780, 1774, 1783, 1781, 1777, 1786, 1787, 1785, 1788, 1783,
+     1789, 1779, 1790, 1784, 1791, 1789, 1789, 1790, 1794, 1795,
+     1787, 1796, 1796, 1786, 1788, 1797, 1791, 1799, 1797, 1798,
+     1800, 1800, 1801, 1801, 1804, 1800, 1799, 1795, 1805, 1802,
+     1806, 1803, 1809, 1794, 1807, 1798, 1803, 1801, 1802, 1807,
+     1807, 1802, 1804, 1810, 1811, 1812, 1809, 1813, 1806, 1805,
+
+     1812, 1814, 1815, 1816, 1816, 1818, 1817, 1814, 1810, 1819,
+     1818, 1813, 1817, 1820, 1823, 1821, 1811, 1824, 1825, 1820,
+     1815, 1821, 1826, 1819, 1828, 1827, 1833, 1828, 1826, 1829,
+     1834, 1831, 1825, 1828, 1823, 1829, 1835, 1824, 1827, 1831,
+     1836, 1837, 1838, 1839, 1840, 1833, 1837, 1841, 1836, 1834,
+     1842, 1838, 1843, 1840, 1850, 1835, 1839, 1844, 1844, 1845,
+     1841, 1846, 1848, 1851, 1842, 1845, 1843, 1846, 1847, 1849,
+     1849, 1847, 1852, 1854, 1850, 1848, 1853, 1853, 1855, 1844,
+     1856, 1851, 1857, 1858, 1855, 1861, 1854, 1860, 1860, 1862,
+     1863, 1852, 1864, 1862, 1865, 1863, 1868, 1867, 1857, 1865,
+
+     1870, 1858, 1856, 1866, 1871, 1861, 1867, 1872, 1866, 1873,
+     1872, 1870, 1864, 1871, 1874, 1875, 1875, 1876, 1877, 1868,
+     1878, 1873, 1879, 1879, 1881, 1882, 1880, 1886, 1883, 1874,
+     1877, 1880, 1882, 1884, 1887, 1888, 1876, 1889, 1881, 1878,
+     1883, 1888, 1890, 1894, 1891, 1884, 1886, 1892, 1892, 1889,
+     1891,   57, 1893, 1897, 1887, 1893, 1895, 1895, 1897, 1898,
+     1890, 1899, 1901, 1894, 1900, 1900, 1904, 1899, 1898, 1902,
+     1903, 1902, 1905, 1903, 1901, 1906, 1908, 1907, 1909, 1910,
+     1911, 1908, 1912, 1909, 1913, 1915, 1904, 1914, 1910, 1913,
+     1921, 1918, 1911, 1906, 1905, 1907, 1914, 1912, 1916, 1917,
+
+     1919, 1919, 1920, 1916, 1917, 1915, 1918, 1923, 1920, 1914,
+     1916, 1921, 1924, 1925, 1926, 1927, 1928, 1933, 1928, 1936,
+     1929, 1930, 1930, 1923, 1931, 1931, 1932, 1932, 1934, 1934,
+     1926, 1924, 1925, 1937, 1929, 1927, 1929, 1933, 1935, 1935,
+     1936, 1938, 1939, 1939, 1940, 1941, 1942, 1944, 1940, 1942,
+     1945, 1941, 1946, 1944, 1937, 1947, 1948, 1949, 1946, 1952,
+     1950, 1948, 1938, 1950, 1951, 1951, 1953, 1956, 1945, 1954,
+     1954, 1953, 1955, 1959, 1959, 1957, 1958, 1961, 1947, 1952,
+     1957, 1958, 1949, 1961, 1960, 1962, 1963, 1955, 1956, 1960,
+     1964, 1965, 1967, 1968, 1966, 1969, 1970, 1962, 1962, 1962,
+
+     1966, 1970, 1969, 1973, 1962, 1974, 1963, 1977, 1964, 1972,
+     1976, 1965, 1967, 1968, 1972, 1972, 1975, 1973, 1975, 1978,
+     1974, 1976, 1977, 1979, 1980, 1978, 1981, 1982, 1982, 1983,
+     1984, 1984, 1979, 1985, 1986, 1987, 1987, 1988, 1988, 1989,
+     1992, 1992, 1993, 1994, 1980, 1996, 1999, 1981, 1997, 2001,
+     2000, 1998, 1994, 1985, 1996, 1983, 1986, 1998, 2003, 1989,
+     2002, 2002, 2004, 2001, 2005, 1999, 2000, 1993, 2007, 1997,
+     2010, 2005, 2006, 2008, 2008, 2009, 2009, 2004, 2013, 2003,
+     2014, 2006, 2011, 2015, 2013, 2014, 2016, 2018, 2017, 2015,
+     2019, 2021, 2019, 2018, 2007, 2017, 2010, 2022, 2011, 2023,
+
+     2023, 2026, 2024, 2022, 2025, 2027, 2016, 2024, 2028, 2029,
+     2021, 2030, 2029, 2025, 2031, 2032, 2026, 2031, 2033, 2034,
+     2034, 2037, 2035, 2030, 2036, 2027, 2042, 2028, 2035, 2041,
+     2036, 2038, 2039, 2032, 2043, 2045, 2039, 2044, 2044, 2043,
+     2047, 2037, 2046, 2049, 2033,   52, 2038, 2050, 2042, 2041,
+     2052, 2050, 2039, 2051, 2051, 2047, 2052, 2053, 2055, 2045,
+     2057, 2046, 2049, 2054, 2054, 2056, 2053, 2055, 2059, 2056,
+     2060, 2057, 2058, 2058, 2061, 2062, 2057, 2063, 2064, 2065,
+     2062, 2066, 2067, 2069, 2060,   47, 2068, 2066, 2069, 2059,
+     2070, 2071, 2071, 2061, 2072, 2072, 2075, 2063, 2064, 2065,
+
+     2067, 2068, 2073, 2070, 2076, 2075, 2073, 2077, 2078, 2079,
+     2079, 2081, 2081, 2078, 2086, 2076, 2082, 2083, 2085, 2088,
+     2076, 2082, 2082, 2083, 2085, 2087, 2089, 2077, 2095, 2091,
+     2087, 2088, 2089, 2092, 2093, 2094, 2094, 2092, 2096, 2097,
+     2086, 2091, 2098, 2100, 2096, 2101, 2093, 2102, 2098, 2099,
+     2099, 2103, 2102, 2095, 2105, 2106, 2109, 2109, 2114, 2107,
+       18, 2097, 2100, 2103, 2107, 2101, 2105, 2110, 2111, 2111,
+     2110, 2112, 2112, 2115, 2106, 2113, 2113, 2116, 2114, 2115,
+     2117, 2118, 2119, 2116, 2121, 2117, 2125, 2118, 2128, 2121,
+     2129, 2119, 2122, 2122, 2124, 2126, 2126, 2124, 2125, 2130,
+
+     2128, 2132, 2129, 2133, 2130, 2131, 2131, 2134, 2133, 2137,
+     2132, 2135, 2134, 2138, 2135, 2136, 2136, 2139, 2140, 2141,
+     2142, 2143, 2138, 2141, 2144, 2142, 2146, 2143, 2150, 2137,
+     2145, 2147,   17, 2153, 2151, 2139, 2157, 2140, 2152, 2145,
+     2149, 2149, 2144, 2151, 2146, 2147, 2150, 2152, 2154, 2154,
+     2155, 2156, 2149, 2153, 2159, 2158, 2165, 2157, 2166, 2155,
+     2158, 2162, 2162, 2156, 2167, 2164, 2169, 2159, 2164, 2170,
+     2171, 2172, 2165, 2174, 2166, 2174, 2171, 2173, 2173, 2175,
+     2167, 2169, 2176, 2170, 2177, 2177, 2178, 2183, 2172, 2180,
+     2180, 2181, 2181, 2175, 2178, 2184, 2185, 2186, 2187, 2188,
+
+     2176, 2184, 2185, 2189, 2192, 2187, 2190, 2190, 2191, 2191,
+     2183, 2186, 2193, 2195, 2194, 2196, 2197, 2191, 2199,    0,
+     2198, 2188, 2201, 2189, 2193, 2192, 2194, 2196, 2195, 2198,
+     2200, 2204, 2205, 2199, 2206, 2200, 2200, 2202, 2209, 2202,
+     2202, 2208, 2197, 2202, 2212, 2201, 2206, 2207, 2207, 2210,
+     2216, 2204, 2210,    0, 2222, 2205, 2202, 2211, 2209, 2208,
+     2214, 2215, 2211, 2215, 2212, 2214, 2217, 2218, 2216, 2220,
+     2223, 2217, 2222, 2224, 2218, 2225, 2226, 2225, 2220, 2223,
+     2227, 2228, 2229, 2232, 2231, 2224, 2231, 2228, 2233, 2233,
+     2234, 2235, 2236, 2238, 2236, 2226, 2235, 2232, 2238, 2239,
+
+     2227, 2240, 2229, 2241, 2239, 2242, 2243, 2245, 2244, 2247,
+     2246, 2250, 2243, 2244, 2247, 2247, 2234, 2251, 2248, 2240,
+     2245, 2241, 2246, 2252, 2256, 2242, 2248, 2253, 2253, 2255,
+     2250, 2251, 2254, 2254, 2257, 2252, 2258, 2261, 2259, 2256,
+     2255, 2262, 2258, 2259, 2260, 2269, 2260, 2263, 2263, 2262,
+     2264, 2265, 2265, 2274, 2257, 2261, 2267, 2262, 2266, 2266,
+     2271, 2268, 2264, 2269, 2271, 2267, 2268, 2272, 2273, 2276,
+     2273, 2277, 2275, 2278, 2274, 2280, 2272, 2275, 2275, 2272,
+     2277, 2276, 2281, 2285, 2282, 2278, 2283, 2286, 2280, 2282,
+     2287, 2283, 2288, 2288, 2281, 2286, 2285, 2289, 2290, 2287,
+
+     2291, 2292, 2293, 2296, 2300, 2294, 2295, 2286, 2296, 2301,
+     2298, 2299, 2304, 2310, 2301, 2289, 2290, 2292, 2291, 2294,
+     2302, 2295, 2298, 2299, 2300, 2302, 2303, 2293, 2307, 2311,
+     2304, 2309, 2312, 2313, 2307, 2303, 2310, 2309, 2318, 2314,
+     2315, 2315, 2316, 2319, 2311, 2317, 2317, 2307, 2314, 2320,
+     2312, 2316, 2321, 2320, 2322, 2324, 2318, 2321, 2313, 2325,
+     2326, 2333, 2319, 2327, 2328, 2325, 2329, 2322, 2327, 2327,
+     2328, 2332, 2329, 2330, 2324, 2342, 2330, 2336, 2336, 2332,
+     2338, 2333, 2326, 2337, 2337, 2339, 2339, 2340, 2340, 2338,
+     2341, 2344, 2352, 2342, 2345, 2346, 2346, 2344, 2337, 2345,
+
+     2347, 2347, 2341, 2348, 2349, 2354, 2356, 2351, 2348, 2337,
+     2349, 2351, 2352, 2353, 2357, 2358, 2360, 2353, 2359, 2357,
+     2362, 2360, 2361, 2363, 2364, 2354, 2365, 2366, 2366, 2364,
+     2367, 2356, 2368, 2359, 2367, 2370, 2362, 2369, 2358, 2371,
+     2361, 2372, 2369, 2363, 2373, 2374, 2375, 2368, 2365, 2376,
+     2377, 2375, 2380, 2370, 2378, 2378, 2373, 2381, 2382, 2372,
+     2380, 2383, 2376, 2384, 2374, 2371, 2385, 2388, 2377, 2386,
+     2387, 2389, 2390, 2396, 2393, 2391, 2381, 2382, 2390, 2388,
+     2383, 2391, 2395, 2398, 2399, 2398, 2384, 2396, 2386, 2393,
+     2385, 2387, 2389, 2397, 2403, 2395, 2400, 2400, 2401, 2397,
+
+     2404, 2405, 2402, 2401, 2399, 2402, 2406, 2403, 2407, 2407,
+     2408, 2408, 2409, 2411, 2409, 2405, 2410, 2410, 2412, 2406,
+     2418, 2413, 2414, 2414, 2404, 2426, 2414,    0, 2411, 2416,
+     2416, 2417, 2417, 2412, 2413, 2418, 2419, 2419, 2420, 2421,
+     2421, 2422, 2422, 2423, 2425, 2426, 2427, 2420, 2423, 2425,
+     2420, 2428, 2429, 2429, 2430, 2430, 2431, 2432, 2432, 2433,
+     2434, 2434, 2436, 2428, 2435, 2440, 2427, 2436, 2437, 2437,
+     2438, 2438, 2439, 2442, 2440, 2431, 2445, 2433, 2444, 2435,
+     2441, 2441, 2443, 2443, 2447, 2449, 2439, 2448, 2448, 2447,
+     2442, 2451, 2444, 2450, 2450, 2445, 2452, 2453, 2457, 2454,
+
+     2458, 2452, 2454, 2453, 2449, 2455, 2455, 2456, 2456, 2451,
+     2459, 2461, 2459, 2462, 2464, 2458, 2466, 2457, 2463, 2463,
+     2464, 2455, 2467, 2468, 2469, 2470, 2461, 2471, 2471, 2470,
+     2472, 2478, 2462, 2473, 2480, 2474, 2466, 2467, 2473, 2469,
+     2475, 2475, 2477, 2477, 2481, 2479, 2468, 2482, 2480, 2472,
+     2474, 2478, 2479, 2483, 2484, 2475, 2485, 2485, 2486, 2487,
+     2491, 2487, 2481, 2488, 2490, 2482, 2488, 2486, 2483, 2492,
+     2490, 2493, 2491, 2494, 2492, 2495, 2493, 2496, 2494, 2498,
+     2484, 2488, 2497, 2488, 2499, 2500, 2502, 2503, 2498, 2499,
+     2496, 2502, 2503, 2504, 2505, 2506, 2507, 2508, 2504, 2509,
+
+     2495, 2506, 2507, 2497, 2510, 2513, 2514, 2511, 2512, 2505,
+     2510, 2500, 2511, 2512, 2509, 2516, 2517, 2515, 2508, 2514,
+     2515, 2522, 2518, 2519, 2520, 2517, 2521, 2522, 2523, 2526,
+     2513, 2518, 2519, 2520, 2523, 2516, 2528, 2524, 2529, 2531,
+     2521, 2524, 2530, 2530, 2533, 2531, 2536, 2529, 2538, 2526,
+     2532, 2532, 2535, 2533, 2534, 2534, 2528, 2535, 2539, 2532,
+     2540, 2540, 2541, 2542, 2538, 2545, 2536, 2544, 2536, 2546,
+     2547, 2551, 2542, 2549, 2539, 2550, 2549, 2541, 2552, 2544,
+     2550, 2545, 2547, 2559, 2546, 2553, 2553, 2554, 2554, 2559,
+     2552, 2551, 2556, 2556, 2557, 2558, 2560, 2557, 2561, 2563,
+
+     2558, 2566, 2560, 2562, 2562, 2564, 2564, 2561, 2565, 2567,
+     2568, 2568, 2569, 2563, 2571, 2566, 2570, 2573, 2569, 2571,
+     2565, 2573, 2574, 2575, 2575, 2574, 2576, 2577, 2567, 2578,
+     2570, 2576, 2577, 2579, 2580, 2581, 2582, 2582, 2578, 2581,
+     2583, 2585, 2579, 2586, 2587, 2588, 2585, 2589, 2590, 2591,
+     2592, 2593, 2590, 2583, 2580, 2592, 2594, 2593, 2595, 2595,
+     2597, 2589, 2594, 2586, 2587, 2588, 2596, 2596, 2598, 2591,
+     2599, 2600, 2601, 2602, 2602, 2607, 2600, 2606, 2597, 2604,
+     2605, 2607, 2606, 2610, 2608, 2610, 2609, 2598, 2612, 2599,
+     2608, 2604, 2614, 2601, 2609, 2615, 2605, 2612, 2616, 2616,
+
+     2617, 2618, 2618, 2617, 2620, 2621, 2614, 2620, 2622, 2615,
+     2623, 2622, 2624, 2624, 2627, 2628, 2629, 2631, 2627, 2636,
+     2621, 2628, 2630, 2630, 2634, 2634, 2631, 2638, 2629, 2639,
+     2642, 2643, 2644, 2645, 2647, 2642, 2623, 2636, 2648, 2647,
+     2654, 2638, 2657, 2648, 2660, 2639, 2649, 2649, 2651, 2651,
+     2644, 2656, 2653, 2662, 2645, 2655, 2655, 2643, 2653, 2661,
+     2654, 2658, 2661, 2660, 2657, 2662, 2658, 2656, 2663, 2664,
+     2664, 2666, 2667, 2668, 2670, 2671, 2669, 2673, 2673, 2668,
+     2663, 2667, 2669, 2674, 2675, 2676, 2674, 2666, 2677, 2682,
+     2671, 2683, 2670, 2679, 2679, 2680, 2680, 2681, 2684, 2686,
+
+     2683, 2686, 2681, 2675, 2676, 2676, 2677, 2682, 2685, 2687,
+     2688, 2684, 2690, 2685, 2689, 2691, 2692, 2690, 2694, 2694,
+     2693, 2699, 2695, 2687, 2688, 2693, 2689, 2696, 2696, 2697,
+     2697, 2698, 2698, 2699, 2701, 2691, 2692, 2695, 2700, 2702,
+     2700, 2703, 2703, 2706, 2702, 2704, 2704, 2705, 2705, 2707,
+     2708, 2709, 2701, 2710, 2711, 2706, 2712, 2712, 2713, 2714,
+     2714, 2716, 2708, 2715, 2715, 2717, 2717, 2718, 2719, 2707,
+     2711, 2709, 2716, 2720, 2710, 2719, 2721, 2713, 2722, 2718,
+     2723, 2724, 2726, 2722, 2728, 2720, 2725, 2725, 2727, 2727,
+     2730, 2726, 2729, 2731, 2732, 2735, 2721, 2733, 2736, 2736,
+
+     2723, 2724, 2734, 2730, 2734, 2737, 2738, 2735, 2732, 2739,
+     2728, 2741, 2729, 2742, 2737, 2743, 2745, 2731, 2784, 2733,
+     2744, 2738, 2746, 2744, 2739, 2784, 2747, 2746, 2755, 2741,
+     2745, 2747, 2748, 2748, 2756, 2742, 2749, 2749, 2743, 2750,
+     2750, 2752, 2752, 2754, 2754, 2756, 2755, 2757, 2758, 2760,
+     2761, 2762, 2763, 2764, 2765, 2766, 2767, 2766,    0, 2768,
+     2769, 2774, 2764, 2758, 2770, 2770, 2757, 2772, 2761, 2760,
+     2775, 2772, 2763, 2762, 2765, 2774, 2767, 2768, 2769, 2773,
+     2773, 2776, 2777, 2777, 2779, 2780, 2780, 2781, 2782, 2783,
+     2776, 2789, 2775, 2779, 2785, 2786, 2787, 2790, 2794, 2788,
+
+        0, 2790, 2792, 2792, 2791, 2781, 2782, 2783, 2795, 2785,
+     2789, 2791, 2804, 2786, 2787, 2788, 2793, 2793, 2794, 2796,
+     2798, 2798, 2799, 2799, 2800, 2796, 2795, 2801, 2802, 2803,
+     2800, 2804, 2806, 2805, 2807, 2807, 2808, 2806, 2809, 2810,
+     2811, 2812, 2813, 2814, 2803, 2801, 2802, 2805, 2814, 2816,
+     2816, 2811, 2812, 2815, 2820, 2815, 2808, 2822, 2809, 2810,
+     2823, 2817, 2813, 2817, 2818, 2818, 2822, 2825, 2824, 2826,
+     2827, 2828, 2829, 2820, 2826, 2830, 2828, 2833, 2834, 2823,
+     2824, 2835, 2836, 2836, 2835, 2837, 2838, 2825, 2839, 2839,
+     2827, 2840, 2829, 2841, 2830, 2842, 2834, 2833, 2844, 2842,
+
+     2837, 2845, 2840, 2846, 2838, 2849, 2847, 2851, 2841, 2846,
+     2847, 2848, 2848, 2844, 2852, 2854, 2845, 2853, 2849, 2855,
+     2856, 2856, 2851, 2854, 2859, 2858, 2860, 2861, 2861, 2863,
+     2860, 2862, 2862, 2859, 2852, 2866, 2853, 2858, 2865, 2855,
+     2864, 2864, 2867, 2865, 2866, 2868, 2869, 2872, 2863, 2870,
+     2870, 2876, 2876, 2877, 2878, 2879, 2879, 2868, 2867, 2880,
+     2881, 2882, 2877, 2886, 2886, 2887, 2869, 2888, 2872, 2883,
+     2884, 2885, 2880, 2881, 2882, 2896, 2878, 2899, 2883, 2884,
+     2885, 2893, 2888, 2890, 2890, 2887, 2893, 2895, 2897, 2896,
+     2898, 2900, 2895, 2897, 2901, 2903, 2899, 2907, 2898, 2905,
+
+     2900, 2906, 2901, 2911, 2905, 2915, 2906, 2908, 2908, 2916,
+     2903, 2910, 2907, 2909, 2909, 2914, 2910, 2912, 2912, 2913,
+     2914, 2920, 2911, 2915, 2917,    0, 2913, 2916, 2918, 2921,
+     2917, 2919, 2919, 2918, 2921, 2926, 2920, 2922, 2922, 2923,
+     2923, 2927, 2927, 2928, 2929, 2932, 2928, 2930, 2926, 2929,
+     2929, 2931, 2930, 2934, 2933, 2936, 2931, 2934, 2935, 2932,
+     2933, 2937, 2938, 2935, 2936, 2939, 2940, 2941, 2943, 2942,
+     2938, 2950, 2940, 2941, 2942, 2946, 2937, 2944, 2944, 2947,
+     2943, 2955, 2946, 2950, 2947, 2948, 2939, 2952, 2948, 2953,
+     2954, 2956, 2952, 2957, 2953, 2954, 2958, 2959, 2959, 2955,
+
+     2960, 2962, 2957, 2961, 2956, 2958, 2962, 2961, 2965, 2960,
+     2966, 2967, 2970, 2971, 2972, 2975, 2966, 2967, 2973, 2974,
+     2974, 2976, 2975, 2978, 2980, 2980, 2965, 2979, 2981, 2982,
+     2983, 2970, 2978, 2971, 2972, 2985, 2979, 2973, 2982, 2992,
+     2976, 2984, 2984, 2981, 2987, 2983, 2989, 2990, 2991, 2991,
+     2993, 2990, 2994, 2995, 2985, 2996, 2993, 2997, 2994, 2987,
+     2998, 2998, 2999, 2997, 2992, 3000, 2989, 3003, 3004, 3001,
+     2999, 3006, 2995, 2996, 3001, 3007, 3003, 3006, 3007, 3008,
+     3009, 3004, 3010, 3008, 3011, 3011, 3012, 3014, 3014, 3015,
+     3000, 3016, 3016, 3017, 3018, 3018, 3010, 3024, 3009, 3019,
+
+     3019, 3012, 3021, 3021, 3022, 3023, 3024, 3015, 3022, 3028,
+     3023, 3026, 3026, 3029, 3030, 3031, 3017, 3034, 3029, 3032,
+     3031, 3031, 3035, 3036, 3037, 3037, 3030, 3039, 3039, 3028,
+     3047, 3032, 3040, 3040, 3041, 3041, 3042, 3034, 3043, 3042,
+     3044, 3049, 3035, 3036, 3046, 3046, 3050, 3050, 3047, 3051,
+     3051, 3043, 3053, 3044, 3052, 3052, 3054, 3054, 3055, 3056,
+     3057, 3049, 3058, 3059, 3059, 3060, 3063, 3053, 3058, 3060,
+     3064, 3055, 3063, 3066, 3057, 3064, 3067, 3056, 3066, 3066,
+     3068, 3069, 3070, 3071, 3072, 3082, 3073, 3079, 3070, 3071,
+     3073, 3074, 3074, 3077, 3080, 3079, 3085, 3080, 3077, 3067,
+
+     3068, 3069, 3083, 3084, 3084, 3083, 3086, 3087, 3088, 3072,
+     3082, 3086, 3089, 3085, 3085, 3090, 3090, 3091, 3092, 3093,
+     3094, 3092, 3095, 3099,    0, 3087, 3089, 3110, 3088, 3092,
+     3095, 3091, 3097, 3093, 3109, 3098, 3110, 3097, 3097, 3094,
+     3098, 3098, 3099, 3100, 3100, 3101, 3101, 3102, 3102, 3103,
+     3103, 3104, 3104, 3105, 3105, 3106, 3107, 3108, 3111, 3112,
+     3109, 3107, 3113, 3114, 3112, 3115, 3116, 3117, 3114, 3118,
+     3122, 3106, 3111, 3122, 3115, 3120, 3120, 3108, 3121, 3121,
+     3123, 3113, 3124, 3124, 3125, 3127, 3116, 3117, 3126, 3118,
+     3125, 3129, 3129, 3126, 3130, 3123, 3131, 3131, 3135, 3132,
+
+     3136, 3130, 3141, 3127, 3132, 3134, 3134, 3135, 3138, 3136,
+     3137, 3137, 3139, 3142, 3142, 3143, 3143, 3138, 3144, 3145,
+     3141, 3139, 3144, 3146, 3147, 3148, 3149, 3150, 3145, 3153,
+     3152, 3160, 3150, 3150, 3156, 3147, 3160, 3154, 3153, 3162,
+     3148, 3154, 3146, 3152, 3161, 3161, 3149, 3164, 3164, 3156,
+     3165, 3166, 3167, 3162, 3169, 3169, 3170, 3170, 3171, 3172,
+     3173, 3177, 3179, 3178, 3165, 3172, 3184, 3171, 3178, 3181,
+     3167, 3179, 3173, 3182, 3186, 3188, 3166, 3189, 3184, 3182,
+     3188, 3191, 3189, 3190, 3190, 3194, 3177, 3193, 3195, 3181,
+     3191, 3202, 3193, 3196, 3196, 3186, 3203, 3196, 3194, 3198,
+
+     3198, 3201, 3195, 3199, 3199, 3200, 3200, 3204, 3206, 3210,
+     3201, 3202, 3204, 3207, 3206, 3203, 3208, 3211, 3207, 3209,
+     3209, 3208, 3212, 3213, 3214, 3215, 3216, 3210, 3213, 3211,
+     3219, 3215, 3217, 3217, 3219, 3220, 3221, 3222, 3222, 3223,
+     3220, 3221, 3214, 3212, 3224, 3225, 3227, 3229, 3229, 3231,
+     3232, 3216, 3233, 3234, 3236, 3235, 3237, 3234, 3223, 3224,
+     3225, 3238, 3231, 3232, 3235, 3233, 3227, 3239, 3240, 3238,
+     3236, 3241, 3239, 3242, 3242, 3237, 3243, 3244, 3245, 3246,
+     3246, 3247, 3247, 3248, 3251, 3243, 3252, 3254, 3240, 3251,
+     3251, 3241, 3258, 3254, 3262, 3244, 3255, 3255, 3256, 3256,
+
+     3252, 3263, 3248, 3265, 3245, 3260, 3260, 3266, 3265, 3267,
+     3262, 3270, 3270, 3258, 3267, 3271, 3272, 3263, 3273, 3274,
+     3275, 3275, 3276, 3266, 3273, 3272, 3278, 3278, 3280, 3279,
+     3281, 3282, 3282, 3284, 3286, 3271, 3291, 3292, 3287, 3284,
+     3288, 3276, 3274, 3279, 3287, 3288, 3295, 3280, 3281, 3293,
+     3293, 3294, 3294, 3296, 3286, 3297, 3297, 3298, 3291, 3300,
+     3299, 3295, 3302, 3292, 3301, 3303, 3304, 3306, 3298, 3299,
+     3301, 3305, 3305, 3296, 3314, 3297,    0, 3303, 3313, 3300,
+     3307, 3302, 3306, 3307, 3308, 3315, 3304, 3308, 3309, 3309,
+     3313, 3315, 3316, 3316, 3314, 3317, 3318, 3319, 3317, 3321,
+
+     3322, 3322, 3318, 3323, 3321, 3324, 3325, 3329, 3323, 3326,
+     3327, 3327, 3325, 3330, 3331, 3319, 3332, 3333, 3333, 3329,
+     3335, 3334, 3351, 3336, 3324, 3341, 3326, 3326, 3351, 3332,
+     3341, 3330, 3336, 3338, 3338, 3342, 3335, 3339, 3339, 3331,
+     3334, 3340, 3340, 3343, 3344, 3344, 3345, 3345, 3343, 3342,
+     3346, 3346, 3347, 3348, 3348, 3349, 3350, 3352, 3355, 3355,
+     3356, 3347, 3352, 3358, 3358, 3359, 3359, 3362, 3349, 3364,
+     3365, 3366, 3367, 3368, 3368, 3371, 3356, 3370, 3370, 3372,
+     3375, 3373, 3350, 3383, 3376, 3379, 3362, 3377, 3377, 3379,
+     3366, 3364, 3365, 3376, 3367, 3373, 3378, 3378, 3372, 3381,
+
+     3375, 3371, 3382, 3383, 3384, 3385, 3386, 3389, 3382,    0,
+     3385, 3386, 3390, 3390, 3392, 3392, 3393, 3381, 3394, 3395,
+     3401, 3393, 3396, 3384, 3401, 3395, 3399, 3397, 3389, 3398,
+     3398, 3399, 3394, 3402, 3396, 3397, 3403, 3404, 3402, 3405,
+     3406, 3407, 3409, 3410, 3405, 3411, 3412, 3407, 3415, 3414,
+     3409, 3416, 3406, 3417, 3418, 3420, 3403, 3404, 3421, 3418,
+     3420, 3425, 3410,    0, 3415, 3411, 3412, 3414, 3416, 3416,
+     3422, 3427, 3423,    0, 3417, 3437, 3422, 3423, 3421, 3426,
+     3457, 3425, 3426, 3441, 3427, 3431, 3431, 3432, 3432, 3433,
+     3437, 3439, 3439, 3433, 3440, 3442, 3442, 3444, 3457, 3440,
+
+     3447, 3447, 3441, 3448, 3448, 3452, 3448, 3449, 3449, 3452,
+     3449, 3455, 3444, 3450, 3450, 3451, 3451, 3454, 3451, 3458,
+     3455, 3463, 3454, 3456, 3456, 3461, 3461, 3462, 3462, 3464,
+     3465, 3466, 3466, 3458, 3467, 3465, 3468, 3471, 3472, 3473,
+     3475, 3463, 3474, 3473, 3546, 3472, 3477, 3546, 3478, 3464,
+     3480, 3474, 3467, 3478, 3484, 3475, 3468, 3479, 3479, 3480,
+     3481, 3481, 3471, 3489, 3477, 3482, 3482, 3483, 3483, 3484,
+     3485, 3486, 3487, 3488, 3490, 3485, 3491, 3487, 3487, 3488,
+     3486, 3492, 3493, 3486, 3494,    0, 3492, 3493, 3489, 3490,
+     3495, 3495, 3496, 3497, 3498, 3498, 3500, 3491, 3496, 3497,
+
+     3499, 3499, 3501, 3494, 3504, 3504, 3505, 3501, 3507, 3507,
+     3508, 3500, 3510, 3512, 3512, 3513, 3513, 3514, 3514, 3508,
+     3505, 3515, 3515, 3517, 3517, 3518, 3518, 3519, 3519, 3521,
+     3510, 3520, 3520, 3523, 3524, 3524, 3526, 3526, 3527, 3528,
+     3529, 3531, 3523, 3532, 3532, 3533, 3535, 3527, 3534, 3534,
+     3536, 3528, 3547, 3537, 3541, 3521, 3531, 3538, 3538, 3545,
+     3529, 3535, 3549, 3536, 3533, 3537, 3539, 3539, 3552, 3541,
+     3542, 3542, 3548, 3548, 3552, 3553, 3551, 3545, 3547, 3551,
+     3549, 3554, 3555, 3557, 3556, 3559, 3554, 3560, 3563, 3553,
+     3564, 3559, 3563, 3566, 3566, 3568, 3560, 3569, 3578, 3557,
+
+     3582, 3555, 3556, 3578, 3579, 3564, 3589, 3579, 3583, 3583,
+     3584, 3584, 3592, 3582, 3585, 3585, 3590, 3569, 3587, 3587,
+     3591, 3568, 3594, 3596, 3591, 3590, 3597, 3600, 3598, 3589,
+     3601, 3601, 3592, 3598, 3602, 3603, 3594, 3597, 3599, 3604,
+     3599, 3606, 3600, 3605, 3608, 3607, 3596, 3602, 3611, 3609,
+     3610, 3612, 3614, 3608, 3603, 3610, 3616, 3604, 3622, 3605,
+     3607, 3609, 3613, 3612, 3615, 3615, 3606, 3613, 3617, 3611,
+     3623, 3614, 3622, 3617, 3624, 3624, 3616, 3625, 3626, 3626,
+     3627, 3627, 3628, 3628, 3629, 3629, 3625, 3630, 3631, 3632,
+     3623, 3633, 3632, 3634, 3635, 3636, 3633, 3637, 3634, 3638,
+
+     3639, 3642, 3640, 3637, 3641, 3641, 3630, 3640, 3631, 3649,
+     3636, 3648, 3639, 3638, 3643, 3643, 3644, 3644, 3652, 3635,
+     3654, 3642, 3645, 3645, 3647, 3647, 3648, 3660, 3649, 3650,
+     3650, 3657, 3657, 3652, 3658, 3658, 3659, 3661, 3654, 3662,
+     3663, 3665, 3664, 3661, 3659, 3662, 3660, 3666, 3667, 3667,
+     3669, 3669, 3666, 3674, 3663, 3664, 3675, 3677, 3678, 3680,
+     3665, 3681, 3678, 3682, 3683, 3684, 3681, 3685, 3686, 3691,
+     3687, 3677, 3692, 3686, 3674, 3687, 3675, 3683, 3684, 3680,
+     3688, 3688, 3682, 3693, 3694, 3694, 3685, 3695, 3696, 3691,
+     3692, 3701, 3695, 3698, 3696, 3697, 3697, 3702, 3698, 3699,
+
+     3700, 3709, 3693, 3702, 3699, 3700, 3704, 3704, 3705, 3710,
+     3701, 3706, 3706, 3705, 3708, 3711, 3710, 3712, 3708, 3713,
+     3709, 3714, 3715, 3717, 3717, 3713, 3719, 3719, 3721, 3720,
+     3722, 3723, 3724, 3721, 3711, 3715, 3712, 3729, 3720, 3726,
+     3714, 3720, 3725, 3725, 3726, 3724, 3727, 3730, 3730, 3722,
+     3723, 3731, 3732, 3732, 3733, 3733, 3734, 3735, 3736, 3727,
+     3743, 3734, 3738, 3729, 3735, 3737, 3737, 3738, 3741, 3739,
+     3731, 3739, 3740, 3740, 3742, 3741, 3745, 3736, 3744, 3743,
+     3748, 3742, 3750, 3744, 3747, 3747, 3751, 3750, 3752, 3753,
+     3757, 3751, 3754, 3754, 3758, 3745, 3756, 3756, 3761, 3748,
+
+     3759, 3759, 3760, 3760, 3771, 3761, 3772, 3752, 3753, 3757,
+     3763, 3763, 3765, 3758, 3764, 3764, 3767, 3770,    0, 3765,
+        0, 3767, 3770, 3771,    0, 3772, 3773, 3773, 3774, 3774,
+     3778, 3778, 3778, 3778, 3778, 3778, 3778, 3779, 3779, 3779,
+     3779, 3779, 3779, 3779, 3780, 3780, 3780, 3780, 3780, 3780,
+     3780, 3781, 3781, 3781, 3781, 3781, 3781, 3781, 3782, 3782,
+     3782, 3782, 3782, 3782, 3782, 3783, 3783, 3783, 3783, 3783,
+     3783, 3783, 3784, 3784, 3784, 3784, 3784, 3784, 3784, 3786,
+     3786,    0, 3786, 3786, 3786, 3786, 3787, 3787,    0,    0,
+        0, 3787, 3787, 3788, 3788,    0,    0, 3788,    0, 3788,
+
+     3789,    0,    0,    0,    0,    0, 3789, 3790, 3790,    0,
+        0,    0, 3790, 3790, 3791,    0,    0,    0,    0,    0,
+     3791, 3792, 3792,    0, 3792, 3792, 3792, 3792, 3793,    0,
+        0,    0,    0,    0, 3793, 3794, 3794,    0,    0,    0,
+     3794, 3794, 3795, 3795,    0, 3795, 3795, 3795, 3795, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777,
+     3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -3428,7 +3524,7 @@ static void config_end_include(void)
 #define YY_NO_INPUT 1
 #endif
 
-#line 3430 "<stdout>"
+#line 3526 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -3646,7 +3742,7 @@ YY_DECL
        {
 #line 211 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 
-#line 3648 "<stdout>"
+#line 3744 "<stdout>"
 
        while ( 1 )             /* loops until end-of-file is reached */
                {
@@ -3679,13 +3775,13 @@ yy_match:
                        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                                {
                                yy_current_state = (int) yy_def[yy_current_state];
-                               if ( yy_current_state >= 3646 )
+                               if ( yy_current_state >= 3778 )
                                        yy_c = yy_meta[(unsigned int) yy_c];
                                }
                        yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
                        ++yy_cp;
                        }
-               while ( yy_base[yy_current_state] != 7110 );
+               while ( yy_base[yy_current_state] != 7350 );
 
 yy_find_action:
                yy_act = yy_accept[yy_current_state];
@@ -3712,13 +3808,13 @@ do_action:      /* This label is used only to access EOF actions. */
 case 1:
 YY_RULE_SETUP
 #line 212 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ 
+{
        LEXOUT(("SP ")); /* ignore */ }
        YY_BREAK
 case 2:
 YY_RULE_SETUP
 #line 214 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ 
+{
        /* note that flex makes the longest match and '.' is any but not nl */
        LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
        YY_BREAK
@@ -3790,137 +3886,137 @@ YY_RULE_SETUP
 case 16:
 YY_RULE_SETUP
 #line 230 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PREFER_IP4) }
+{ YDVAR(1, VAR_DO_NAT64) }
        YY_BREAK
 case 17:
 YY_RULE_SETUP
 #line 231 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PREFER_IP6) }
+{ YDVAR(1, VAR_PREFER_IP4) }
        YY_BREAK
 case 18:
 YY_RULE_SETUP
 #line 232 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_UDP) }
+{ YDVAR(1, VAR_PREFER_IP6) }
        YY_BREAK
 case 19:
 YY_RULE_SETUP
 #line 233 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_TCP) }
+{ YDVAR(1, VAR_DO_UDP) }
        YY_BREAK
 case 20:
 YY_RULE_SETUP
 #line 234 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_UPSTREAM) }
+{ YDVAR(1, VAR_DO_TCP) }
        YY_BREAK
 case 21:
 YY_RULE_SETUP
 #line 235 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_MSS) }
+{ YDVAR(1, VAR_TCP_UPSTREAM) }
        YY_BREAK
 case 22:
 YY_RULE_SETUP
 #line 236 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_OUTGOING_TCP_MSS) }
+{ YDVAR(1, VAR_TCP_MSS) }
        YY_BREAK
 case 23:
 YY_RULE_SETUP
 #line 237 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_IDLE_TIMEOUT) }
+{ YDVAR(1, VAR_OUTGOING_TCP_MSS) }
        YY_BREAK
 case 24:
 YY_RULE_SETUP
 #line 238 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_REUSE_TCP_QUERIES) }
+{ YDVAR(1, VAR_TCP_IDLE_TIMEOUT) }
        YY_BREAK
 case 25:
 YY_RULE_SETUP
 #line 239 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_REUSE_TIMEOUT) }
+{ YDVAR(1, VAR_MAX_REUSE_TCP_QUERIES) }
        YY_BREAK
 case 26:
 YY_RULE_SETUP
 #line 240 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) }
+{ YDVAR(1, VAR_TCP_REUSE_TIMEOUT) }
        YY_BREAK
 case 27:
 YY_RULE_SETUP
 #line 241 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) }
+{ YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) }
        YY_BREAK
 case 28:
 YY_RULE_SETUP
 #line 242 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) }
+{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) }
        YY_BREAK
 case 29:
 YY_RULE_SETUP
 #line 243 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) }
        YY_BREAK
 case 30:
 YY_RULE_SETUP
 #line 244 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_SOCK_QUEUE_TIMEOUT) }
        YY_BREAK
 case 31:
 YY_RULE_SETUP
 #line 245 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
+{ YDVAR(1, VAR_SSL_UPSTREAM) }
        YY_BREAK
 case 32:
 YY_RULE_SETUP
 #line 246 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
+{ YDVAR(1, VAR_SSL_UPSTREAM) }
        YY_BREAK
 case 33:
 YY_RULE_SETUP
 #line 247 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
+{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
        YY_BREAK
 case 34:
 YY_RULE_SETUP
 #line 248 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
+{ YDVAR(1, VAR_SSL_SERVICE_KEY) }
        YY_BREAK
 case 35:
 YY_RULE_SETUP
 #line 249 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_PORT) }
+{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
        YY_BREAK
 case 36:
 YY_RULE_SETUP
 #line 250 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SSL_PORT) }
+{ YDVAR(1, VAR_SSL_SERVICE_PEM) }
        YY_BREAK
 case 37:
 YY_RULE_SETUP
 #line 251 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_CERT_BUNDLE) }
+{ YDVAR(1, VAR_SSL_PORT) }
        YY_BREAK
 case 38:
 YY_RULE_SETUP
 #line 252 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_CERT_BUNDLE) }
+{ YDVAR(1, VAR_SSL_PORT) }
        YY_BREAK
 case 39:
 YY_RULE_SETUP
 #line 253 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_WIN_CERT) }
+{ YDVAR(1, VAR_TLS_CERT_BUNDLE) }
        YY_BREAK
 case 40:
 YY_RULE_SETUP
 #line 254 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_WIN_CERT) }
+{ YDVAR(1, VAR_TLS_CERT_BUNDLE) }
        YY_BREAK
 case 41:
 YY_RULE_SETUP
 #line 255 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
+{ YDVAR(1, VAR_TLS_WIN_CERT) }
        YY_BREAK
 case 42:
 YY_RULE_SETUP
 #line 256 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
+{ YDVAR(1, VAR_TLS_WIN_CERT) }
        YY_BREAK
 case 43:
 YY_RULE_SETUP
@@ -3935,1529 +4031,1589 @@ YY_RULE_SETUP
 case 45:
 YY_RULE_SETUP
 #line 259 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
+{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
        YY_BREAK
 case 46:
 YY_RULE_SETUP
 #line 260 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_CIPHERS) }
+{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
        YY_BREAK
 case 47:
 YY_RULE_SETUP
 #line 261 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_CIPHERSUITES) }
+{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
        YY_BREAK
 case 48:
 YY_RULE_SETUP
 #line 262 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TLS_USE_SNI) }
+{ YDVAR(1, VAR_TLS_CIPHERS) }
        YY_BREAK
 case 49:
 YY_RULE_SETUP
 #line 263 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTPS_PORT) }
+{ YDVAR(1, VAR_TLS_CIPHERSUITES) }
        YY_BREAK
 case 50:
 YY_RULE_SETUP
 #line 264 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_ENDPOINT) }
+{ YDVAR(1, VAR_TLS_USE_SNI) }
        YY_BREAK
 case 51:
 YY_RULE_SETUP
 #line 265 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_MAX_STREAMS) }
+{ YDVAR(1, VAR_HTTPS_PORT) }
        YY_BREAK
 case 52:
 YY_RULE_SETUP
 #line 266 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_QUERY_BUFFER_SIZE) }
+{ YDVAR(1, VAR_HTTP_ENDPOINT) }
        YY_BREAK
 case 53:
 YY_RULE_SETUP
 #line 267 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_RESPONSE_BUFFER_SIZE) }
+{ YDVAR(1, VAR_HTTP_MAX_STREAMS) }
        YY_BREAK
 case 54:
 YY_RULE_SETUP
 #line 268 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_NODELAY) }
+{ YDVAR(1, VAR_HTTP_QUERY_BUFFER_SIZE) }
        YY_BREAK
 case 55:
 YY_RULE_SETUP
 #line 269 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_NOTLS_DOWNSTREAM) }
+{ YDVAR(1, VAR_HTTP_RESPONSE_BUFFER_SIZE) }
        YY_BREAK
 case 56:
 YY_RULE_SETUP
 #line 270 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSTEMD) }
+{ YDVAR(1, VAR_HTTP_NODELAY) }
        YY_BREAK
 case 57:
 YY_RULE_SETUP
 #line 271 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_DAEMONIZE) }
+{ YDVAR(1, VAR_HTTP_NOTLS_DOWNSTREAM) }
        YY_BREAK
 case 58:
 YY_RULE_SETUP
 #line 272 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE) }
+{ YDVAR(1, VAR_USE_SYSTEMD) }
        YY_BREAK
 case 59:
 YY_RULE_SETUP
 #line 273 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE) }
+{ YDVAR(1, VAR_DO_DAEMONIZE) }
        YY_BREAK
 case 60:
 YY_RULE_SETUP
 #line 274 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_OUTGOING_INTERFACE) }
+{ YDVAR(1, VAR_INTERFACE) }
        YY_BREAK
 case 61:
 YY_RULE_SETUP
 #line 275 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
+{ YDVAR(1, VAR_INTERFACE) }
        YY_BREAK
 case 62:
 YY_RULE_SETUP
 #line 276 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INTERFACE_AUTOMATIC_PORTS) }
+{ YDVAR(1, VAR_OUTGOING_INTERFACE) }
        YY_BREAK
 case 63:
 YY_RULE_SETUP
 #line 277 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SO_RCVBUF) }
+{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
        YY_BREAK
 case 64:
 YY_RULE_SETUP
 #line 278 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SO_SNDBUF) }
+{ YDVAR(1, VAR_INTERFACE_AUTOMATIC_PORTS) }
        YY_BREAK
 case 65:
 YY_RULE_SETUP
 #line 279 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SO_REUSEPORT) }
+{ YDVAR(1, VAR_SO_RCVBUF) }
        YY_BREAK
 case 66:
 YY_RULE_SETUP
 #line 280 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_TRANSPARENT) }
+{ YDVAR(1, VAR_SO_SNDBUF) }
        YY_BREAK
 case 67:
 YY_RULE_SETUP
 #line 281 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_FREEBIND) }
+{ YDVAR(1, VAR_SO_REUSEPORT) }
        YY_BREAK
 case 68:
 YY_RULE_SETUP
 #line 282 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_DSCP) }
+{ YDVAR(1, VAR_IP_TRANSPARENT) }
        YY_BREAK
 case 69:
 YY_RULE_SETUP
 #line 283 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CHROOT) }
+{ YDVAR(1, VAR_IP_FREEBIND) }
        YY_BREAK
 case 70:
 YY_RULE_SETUP
 #line 284 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_USERNAME) }
+{ YDVAR(1, VAR_IP_DSCP) }
        YY_BREAK
 case 71:
 YY_RULE_SETUP
 #line 285 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DIRECTORY) }
+{ YDVAR(1, VAR_CHROOT) }
        YY_BREAK
 case 72:
 YY_RULE_SETUP
 #line 286 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOGFILE) }
+{ YDVAR(1, VAR_USERNAME) }
        YY_BREAK
 case 73:
 YY_RULE_SETUP
 #line 287 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PIDFILE) }
+{ YDVAR(1, VAR_DIRECTORY) }
        YY_BREAK
 case 74:
 YY_RULE_SETUP
 #line 288 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_HINTS) }
+{ YDVAR(1, VAR_LOGFILE) }
        YY_BREAK
 case 75:
 YY_RULE_SETUP
 #line 289 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STREAM_WAIT_SIZE) }
+{ YDVAR(1, VAR_PIDFILE) }
        YY_BREAK
 case 76:
 YY_RULE_SETUP
 #line 290 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
+{ YDVAR(1, VAR_ROOT_HINTS) }
        YY_BREAK
 case 77:
 YY_RULE_SETUP
 #line 291 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
+{ YDVAR(1, VAR_STREAM_WAIT_SIZE) }
        YY_BREAK
 case 78:
 YY_RULE_SETUP
 #line 292 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
+{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
        YY_BREAK
 case 79:
 YY_RULE_SETUP
 #line 293 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
+{ YDVAR(1, VAR_MSG_BUFFER_SIZE) }
        YY_BREAK
 case 80:
 YY_RULE_SETUP
 #line 294 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
+{ YDVAR(1, VAR_MSG_CACHE_SIZE) }
        YY_BREAK
 case 81:
 YY_RULE_SETUP
 #line 295 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
+{ YDVAR(1, VAR_MSG_CACHE_SLABS) }
        YY_BREAK
 case 82:
 YY_RULE_SETUP
 #line 296 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_TTL) }
+{ YDVAR(1, VAR_RRSET_CACHE_SIZE) }
        YY_BREAK
 case 83:
 YY_RULE_SETUP
 #line 297 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
+{ YDVAR(1, VAR_RRSET_CACHE_SLABS) }
        YY_BREAK
 case 84:
 YY_RULE_SETUP
 #line 298 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHE_MIN_TTL) }
+{ YDVAR(1, VAR_CACHE_MAX_TTL) }
        YY_BREAK
 case 85:
 YY_RULE_SETUP
 #line 299 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_HOST_TTL) }
+{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
        YY_BREAK
 case 86:
 YY_RULE_SETUP
 #line 300 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_LAME_TTL) }
+{ YDVAR(1, VAR_CACHE_MIN_TTL) }
        YY_BREAK
 case 87:
 YY_RULE_SETUP
 #line 301 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
+{ YDVAR(1, VAR_INFRA_HOST_TTL) }
        YY_BREAK
 case 88:
 YY_RULE_SETUP
 #line 302 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
+{ YDVAR(1, VAR_INFRA_LAME_TTL) }
        YY_BREAK
 case 89:
 YY_RULE_SETUP
 #line 303 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
        YY_BREAK
 case 90:
 YY_RULE_SETUP
 #line 304 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
+{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
        YY_BREAK
 case 91:
 YY_RULE_SETUP
 #line 305 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_CACHE_MAX_RTT) }
+{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
        YY_BREAK
 case 92:
 YY_RULE_SETUP
 #line 306 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INFRA_KEEP_PROBING) }
+{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
        YY_BREAK
 case 93:
 YY_RULE_SETUP
 #line 307 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
+{ YDVAR(1, VAR_INFRA_CACHE_MAX_RTT) }
        YY_BREAK
 case 94:
 YY_RULE_SETUP
 #line 308 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
+{ YDVAR(1, VAR_INFRA_KEEP_PROBING) }
        YY_BREAK
 case 95:
 YY_RULE_SETUP
 #line 309 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DELAY_CLOSE) }
+{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
        YY_BREAK
 case 96:
 YY_RULE_SETUP
 #line 310 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UDP_CONNECT) }
+{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
        YY_BREAK
 case 97:
 YY_RULE_SETUP
 #line 311 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
+{ YDVAR(1, VAR_DELAY_CLOSE) }
        YY_BREAK
 case 98:
 YY_RULE_SETUP
 #line 312 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
+{ YDVAR(1, VAR_UDP_CONNECT) }
        YY_BREAK
 case 99:
 YY_RULE_SETUP
 #line 313 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
+{ YDVAR(1, VAR_TARGET_FETCH_POLICY) }
        YY_BREAK
 case 100:
 YY_RULE_SETUP
 #line 314 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_GLUE) }
+{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
        YY_BREAK
 case 101:
 YY_RULE_SETUP
 #line 315 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
+{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
        YY_BREAK
 case 102:
 YY_RULE_SETUP
 #line 316 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
+{ YDVAR(1, VAR_HARDEN_GLUE) }
        YY_BREAK
 case 103:
 YY_RULE_SETUP
 #line 317 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
        YY_BREAK
 case 104:
 YY_RULE_SETUP
 #line 318 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
+{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
        YY_BREAK
 case 105:
 YY_RULE_SETUP
 #line 319 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
        YY_BREAK
 case 106:
 YY_RULE_SETUP
 #line 320 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CAPS_WHITELIST) }
+{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
        YY_BREAK
 case 107:
 YY_RULE_SETUP
 #line 321 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CAPS_WHITELIST) }
+{ YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) }
        YY_BREAK
 case 108:
 YY_RULE_SETUP
 #line 322 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
        YY_BREAK
 case 109:
 YY_RULE_SETUP
 #line 323 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
+{ YDVAR(1, VAR_CAPS_WHITELIST) }
        YY_BREAK
 case 110:
 YY_RULE_SETUP
 #line 324 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+{ YDVAR(1, VAR_CAPS_WHITELIST) }
        YY_BREAK
 case 111:
 YY_RULE_SETUP
 #line 325 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH_KEY) }
+{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
        YY_BREAK
 case 112:
 YY_RULE_SETUP
 #line 326 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PREFETCH) }
+{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
        YY_BREAK
 case 113:
 YY_RULE_SETUP
 #line 327 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DENY_ANY) }
+{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
        YY_BREAK
 case 114:
 YY_RULE_SETUP
 #line 328 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_STUB_ZONE) }
+{ YDVAR(1, VAR_PREFETCH_KEY) }
        YY_BREAK
 case 115:
 YY_RULE_SETUP
 #line 329 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NAME) }
+{ YDVAR(1, VAR_PREFETCH) }
        YY_BREAK
 case 116:
 YY_RULE_SETUP
 #line 330 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_ADDR) }
+{ YDVAR(1, VAR_DENY_ANY) }
        YY_BREAK
 case 117:
 YY_RULE_SETUP
 #line 331 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_HOST) }
+{ YDVAR(0, VAR_STUB_ZONE) }
        YY_BREAK
 case 118:
 YY_RULE_SETUP
 #line 332 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_PRIME) }
+{ YDVAR(1, VAR_NAME) }
        YY_BREAK
 case 119:
 YY_RULE_SETUP
 #line 333 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_FIRST) }
+{ YDVAR(1, VAR_STUB_ADDR) }
        YY_BREAK
 case 120:
 YY_RULE_SETUP
 #line 334 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_NO_CACHE) }
+{ YDVAR(1, VAR_STUB_HOST) }
        YY_BREAK
 case 121:
 YY_RULE_SETUP
 #line 335 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_STUB_PRIME) }
        YY_BREAK
 case 122:
 YY_RULE_SETUP
 #line 336 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_STUB_FIRST) }
        YY_BREAK
 case 123:
 YY_RULE_SETUP
 #line 337 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) }
+{ YDVAR(1, VAR_STUB_NO_CACHE) }
        YY_BREAK
 case 124:
 YY_RULE_SETUP
 #line 338 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_FORWARD_ZONE) }
+{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
        YY_BREAK
 case 125:
 YY_RULE_SETUP
 #line 339 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_ADDR) }
+{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
        YY_BREAK
 case 126:
 YY_RULE_SETUP
 #line 340 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_HOST) }
+{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) }
        YY_BREAK
 case 127:
 YY_RULE_SETUP
 #line 341 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_FIRST) }
+{ YDVAR(0, VAR_FORWARD_ZONE) }
        YY_BREAK
 case 128:
 YY_RULE_SETUP
 #line 342 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_NO_CACHE) }
+{ YDVAR(1, VAR_FORWARD_ADDR) }
        YY_BREAK
 case 129:
 YY_RULE_SETUP
 #line 343 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_FORWARD_HOST) }
        YY_BREAK
 case 130:
 YY_RULE_SETUP
 #line 344 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
+{ YDVAR(1, VAR_FORWARD_FIRST) }
        YY_BREAK
 case 131:
 YY_RULE_SETUP
 #line 345 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) }
+{ YDVAR(1, VAR_FORWARD_NO_CACHE) }
        YY_BREAK
 case 132:
 YY_RULE_SETUP
 #line 346 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_AUTH_ZONE) }
+{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
        YY_BREAK
 case 133:
 YY_RULE_SETUP
 #line 347 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_RPZ) }
+{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
        YY_BREAK
 case 134:
 YY_RULE_SETUP
 #line 348 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TAGS) }
+{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) }
        YY_BREAK
 case 135:
 YY_RULE_SETUP
 #line 349 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
+{ YDVAR(0, VAR_AUTH_ZONE) }
        YY_BREAK
 case 136:
 YY_RULE_SETUP
 #line 350 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
+{ YDVAR(0, VAR_RPZ) }
        YY_BREAK
 case 137:
 YY_RULE_SETUP
 #line 351 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_LOG) }
+{ YDVAR(1, VAR_TAGS) }
        YY_BREAK
 case 138:
 YY_RULE_SETUP
 #line 352 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_LOG_NAME) }
+{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
        YY_BREAK
 case 139:
 YY_RULE_SETUP
 #line 353 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) }
+{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
        YY_BREAK
 case 140:
 YY_RULE_SETUP
 #line 354 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEFILE) }
+{ YDVAR(1, VAR_RPZ_LOG) }
        YY_BREAK
 case 141:
 YY_RULE_SETUP
 #line 355 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MASTER) }
+{ YDVAR(1, VAR_RPZ_LOG_NAME) }
        YY_BREAK
 case 142:
 YY_RULE_SETUP
 #line 356 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MASTER) }
+{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) }
        YY_BREAK
 case 143:
 YY_RULE_SETUP
 #line 357 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_URL) }
+{ YDVAR(1, VAR_ZONEFILE) }
        YY_BREAK
 case 144:
 YY_RULE_SETUP
 #line 358 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ALLOW_NOTIFY) }
+{ YDVAR(1, VAR_MASTER) }
        YY_BREAK
 case 145:
 YY_RULE_SETUP
 #line 359 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
+{ YDVAR(1, VAR_MASTER) }
        YY_BREAK
 case 146:
 YY_RULE_SETUP
 #line 360 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FOR_UPSTREAM) }
+{ YDVAR(1, VAR_URL) }
        YY_BREAK
 case 147:
 YY_RULE_SETUP
 #line 361 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FALLBACK_ENABLED) }
+{ YDVAR(1, VAR_ALLOW_NOTIFY) }
        YY_BREAK
 case 148:
 YY_RULE_SETUP
 #line 362 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_VIEW) }
+{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
        YY_BREAK
 case 149:
 YY_RULE_SETUP
 #line 363 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VIEW_FIRST) }
+{ YDVAR(1, VAR_FOR_UPSTREAM) }
        YY_BREAK
 case 150:
 YY_RULE_SETUP
 #line 364 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
+{ YDVAR(1, VAR_FALLBACK_ENABLED) }
        YY_BREAK
 case 151:
 YY_RULE_SETUP
 #line 365 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
+{ YDVAR(0, VAR_VIEW) }
        YY_BREAK
 case 152:
 YY_RULE_SETUP
 #line 366 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL) }
+{ YDVAR(1, VAR_VIEW_FIRST) }
        YY_BREAK
 case 153:
 YY_RULE_SETUP
 #line 367 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_INTERFACE_ACTION) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
        YY_BREAK
 case 154:
 YY_RULE_SETUP
 #line 368 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
+{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
        YY_BREAK
 case 155:
 YY_RULE_SETUP
 #line 369 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
+{ YDVAR(2, VAR_ACCESS_CONTROL) }
        YY_BREAK
 case 156:
 YY_RULE_SETUP
 #line 370 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
+{ YDVAR(2, VAR_INTERFACE_ACTION) }
        YY_BREAK
 case 157:
 YY_RULE_SETUP
 #line 371 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
+{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
        YY_BREAK
 case 158:
 YY_RULE_SETUP
 #line 372 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
        YY_BREAK
 case 159:
 YY_RULE_SETUP
 #line 373 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
        YY_BREAK
 case 160:
 YY_RULE_SETUP
 #line 374 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
+{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
        YY_BREAK
 case 161:
 YY_RULE_SETUP
 #line 375 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
        YY_BREAK
 case 162:
 YY_RULE_SETUP
 #line 376 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
+{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
        YY_BREAK
 case 163:
 YY_RULE_SETUP
 #line 377 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
        YY_BREAK
 case 164:
 YY_RULE_SETUP
 #line 378 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_IDENTITY) }
+{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
        YY_BREAK
 case 165:
 YY_RULE_SETUP
 #line 379 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_VERSION) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
        YY_BREAK
 case 166:
 YY_RULE_SETUP
 #line 380 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
+{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
        YY_BREAK
 case 167:
 YY_RULE_SETUP
 #line 381 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) }
+{ YDVAR(1, VAR_HIDE_IDENTITY) }
        YY_BREAK
 case 168:
 YY_RULE_SETUP
 #line 382 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IDENTITY) }
+{ YDVAR(1, VAR_HIDE_VERSION) }
        YY_BREAK
 case 169:
 YY_RULE_SETUP
 #line 383 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VERSION) }
+{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
        YY_BREAK
 case 170:
 YY_RULE_SETUP
 #line 384 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_HTTP_USER_AGENT) }
+{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) }
        YY_BREAK
 case 171:
 YY_RULE_SETUP
 #line 385 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MODULE_CONF) }
+{ YDVAR(1, VAR_IDENTITY) }
        YY_BREAK
 case 172:
 YY_RULE_SETUP
 #line 386 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR) }
+{ YDVAR(1, VAR_VERSION) }
        YY_BREAK
 case 173:
 YY_RULE_SETUP
 #line 387 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
+{ YDVAR(1, VAR_HTTP_USER_AGENT) }
        YY_BREAK
 case 174:
 YY_RULE_SETUP
 #line 388 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_MODULE_CONF) }
        YY_BREAK
 case 175:
 YY_RULE_SETUP
 #line 389 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR) }
        YY_BREAK
 case 176:
 YY_RULE_SETUP
 #line 390 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
+{ YDVAR(1, VAR_DLV_ANCHOR_FILE) }
        YY_BREAK
 case 177:
 YY_RULE_SETUP
 #line 391 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
        YY_BREAK
 case 178:
 YY_RULE_SETUP
 #line 392 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
+{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
        YY_BREAK
 case 179:
 YY_RULE_SETUP
 #line 393 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
+{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
        YY_BREAK
 case 180:
 YY_RULE_SETUP
 #line 394 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
+{ YDVAR(1, VAR_TRUST_ANCHOR) }
        YY_BREAK
 case 181:
 YY_RULE_SETUP
 #line 395 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
+{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
        YY_BREAK
 case 182:
 YY_RULE_SETUP
 #line 396 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
+{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
        YY_BREAK
 case 183:
 YY_RULE_SETUP
 #line 397 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_MAX_RESTART) }
+{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
        YY_BREAK
 case 184:
 YY_RULE_SETUP
 #line 398 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_BOGUS_TTL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
        YY_BREAK
 case 185:
 YY_RULE_SETUP
 #line 399 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
+{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
        YY_BREAK
 case 186:
 YY_RULE_SETUP
 #line 400 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+{ YDVAR(1, VAR_VAL_MAX_RESTART) }
        YY_BREAK
 case 187:
 YY_RULE_SETUP
 #line 401 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
+{ YDVAR(1, VAR_BOGUS_TTL) }
        YY_BREAK
 case 188:
 YY_RULE_SETUP
 #line 402 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
+{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
        YY_BREAK
 case 189:
 YY_RULE_SETUP
 #line 403 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED) }
+{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
        YY_BREAK
 case 190:
 YY_RULE_SETUP
 #line 404 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
+{ YDVAR(1, VAR_AGGRESSIVE_NSEC) }
        YY_BREAK
 case 191:
 YY_RULE_SETUP
 #line 405 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
+{ YDVAR(1, VAR_IGNORE_CD_FLAG) }
        YY_BREAK
 case 192:
 YY_RULE_SETUP
 #line 406 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
+{ YDVAR(1, VAR_SERVE_EXPIRED) }
        YY_BREAK
 case 193:
 YY_RULE_SETUP
 #line 407 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
        YY_BREAK
 case 194:
 YY_RULE_SETUP
 #line 408 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDE_SERVE_EXPIRED) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
        YY_BREAK
 case 195:
 YY_RULE_SETUP
 #line 409 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
        YY_BREAK
 case 196:
 YY_RULE_SETUP
 #line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_DSA) }
+{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
        YY_BREAK
 case 197:
 YY_RULE_SETUP
 #line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAKE_SHA1) }
+{ YDVAR(1, VAR_EDE_SERVE_EXPIRED) }
        YY_BREAK
 case 198:
 YY_RULE_SETUP
 #line 412 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
+{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) }
        YY_BREAK
 case 199:
 YY_RULE_SETUP
 #line 413 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
+{ YDVAR(1, VAR_FAKE_DSA) }
        YY_BREAK
 case 200:
 YY_RULE_SETUP
 #line 414 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
+{ YDVAR(1, VAR_FAKE_SHA1) }
        YY_BREAK
 case 201:
 YY_RULE_SETUP
 #line 415 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
+{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
        YY_BREAK
 case 202:
 YY_RULE_SETUP
 #line 416 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ 
-                                 YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
        YY_BREAK
 case 203:
 YY_RULE_SETUP
-#line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
+#line 417 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
        YY_BREAK
 case 204:
 YY_RULE_SETUP
-#line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_CHECK) }
+#line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
        YY_BREAK
 case 205:
 YY_RULE_SETUP
-#line 420 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) }
+#line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+                                 YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
        YY_BREAK
 case 206:
 YY_RULE_SETUP
 #line 421 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_ADD_HOLDDOWN) }
+{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
        YY_BREAK
 case 207:
 YY_RULE_SETUP
 #line 422 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DEL_HOLDDOWN) }
+{ YDVAR(1, VAR_ZONEMD_CHECK) }
        YY_BREAK
 case 208:
 YY_RULE_SETUP
 #line 423 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_KEEP_MISSING) }
+{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) }
        YY_BREAK
 case 209:
 YY_RULE_SETUP
 #line 424 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
+{ YDVAR(1, VAR_ADD_HOLDDOWN) }
        YY_BREAK
 case 210:
 YY_RULE_SETUP
 #line 425 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_USE_SYSLOG) }
+{ YDVAR(1, VAR_DEL_HOLDDOWN) }
        YY_BREAK
 case 211:
 YY_RULE_SETUP
 #line 426 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_IDENTITY) }
+{ YDVAR(1, VAR_KEEP_MISSING) }
        YY_BREAK
 case 212:
 YY_RULE_SETUP
 #line 427 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TIME_ASCII) }
+{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
        YY_BREAK
 case 213:
 YY_RULE_SETUP
 #line 428 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_QUERIES) }
+{ YDVAR(1, VAR_USE_SYSLOG) }
        YY_BREAK
 case 214:
 YY_RULE_SETUP
 #line 429 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_REPLIES) }
+{ YDVAR(1, VAR_LOG_IDENTITY) }
        YY_BREAK
 case 215:
 YY_RULE_SETUP
 #line 430 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
+{ YDVAR(1, VAR_LOG_TIME_ASCII) }
        YY_BREAK
 case 216:
 YY_RULE_SETUP
 #line 431 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
+{ YDVAR(1, VAR_LOG_QUERIES) }
        YY_BREAK
 case 217:
 YY_RULE_SETUP
 #line 432 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOG_SERVFAIL) }
+{ YDVAR(1, VAR_LOG_REPLIES) }
        YY_BREAK
 case 218:
 YY_RULE_SETUP
 #line 433 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE) }
+{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
        YY_BREAK
 case 219:
 YY_RULE_SETUP
 #line 434 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA) }
+{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
        YY_BREAK
 case 220:
 YY_RULE_SETUP
 #line 435 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
+{ YDVAR(1, VAR_LOG_SERVFAIL) }
        YY_BREAK
 case 221:
 YY_RULE_SETUP
 #line 436 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
+{ YDVAR(2, VAR_LOCAL_ZONE) }
        YY_BREAK
 case 222:
 YY_RULE_SETUP
 #line 437 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
+{ YDVAR(1, VAR_LOCAL_DATA) }
        YY_BREAK
 case 223:
 YY_RULE_SETUP
 #line 438 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
+{ YDVAR(1, VAR_LOCAL_DATA_PTR) }
        YY_BREAK
 case 224:
 YY_RULE_SETUP
 #line 439 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
+{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
        YY_BREAK
 case 225:
 YY_RULE_SETUP
 #line 440 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
+{ YDVAR(1, VAR_INSECURE_LAN_ZONES) }
        YY_BREAK
 case 226:
 YY_RULE_SETUP
 #line 441 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_ENABLE) }
+{ YDVAR(1, VAR_STATISTICS_INTERVAL) }
        YY_BREAK
 case 227:
 YY_RULE_SETUP
 #line 442 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SHM_KEY) }
+{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
        YY_BREAK
 case 228:
 YY_RULE_SETUP
 #line 443 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_REMOTE_CONTROL) }
+{ YDVAR(1, VAR_EXTENDED_STATISTICS) }
        YY_BREAK
 case 229:
 YY_RULE_SETUP
 #line 444 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_ENABLE) }
+{ YDVAR(1, VAR_STATISTICS_INHIBIT_ZERO) }
        YY_BREAK
 case 230:
 YY_RULE_SETUP
 #line 445 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_INTERFACE) }
+{ YDVAR(1, VAR_SHM_ENABLE) }
        YY_BREAK
 case 231:
 YY_RULE_SETUP
 #line 446 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_PORT) }
+{ YDVAR(1, VAR_SHM_KEY) }
        YY_BREAK
 case 232:
 YY_RULE_SETUP
 #line 447 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_USE_CERT) }
+{ YDVAR(0, VAR_REMOTE_CONTROL) }
        YY_BREAK
 case 233:
 YY_RULE_SETUP
 #line 448 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_ENABLE) }
        YY_BREAK
 case 234:
 YY_RULE_SETUP
 #line 449 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_SERVER_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_INTERFACE) }
        YY_BREAK
 case 235:
 YY_RULE_SETUP
 #line 450 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
+{ YDVAR(1, VAR_CONTROL_PORT) }
        YY_BREAK
 case 236:
 YY_RULE_SETUP
 #line 451 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
+{ YDVAR(1, VAR_CONTROL_USE_CERT) }
        YY_BREAK
 case 237:
 YY_RULE_SETUP
 #line 452 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PYTHON_SCRIPT) }
+{ YDVAR(1, VAR_SERVER_KEY_FILE) }
        YY_BREAK
 case 238:
 YY_RULE_SETUP
 #line 453 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_PYTHON) }
+{ YDVAR(1, VAR_SERVER_CERT_FILE) }
        YY_BREAK
 case 239:
 YY_RULE_SETUP
 #line 454 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DYNLIB_FILE) }
+{ YDVAR(1, VAR_CONTROL_KEY_FILE) }
        YY_BREAK
 case 240:
 YY_RULE_SETUP
 #line 455 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DYNLIB) }
+{ YDVAR(1, VAR_CONTROL_CERT_FILE) }
        YY_BREAK
 case 241:
 YY_RULE_SETUP
 #line 456 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DOMAIN_INSECURE) }
+{ YDVAR(1, VAR_PYTHON_SCRIPT) }
        YY_BREAK
 case 242:
 YY_RULE_SETUP
 #line 457 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
+{ YDVAR(0, VAR_PYTHON) }
        YY_BREAK
 case 243:
 YY_RULE_SETUP
 #line 458 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
+{ YDVAR(1, VAR_DYNLIB_FILE) }
        YY_BREAK
 case 244:
 YY_RULE_SETUP
 #line 459 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
+{ YDVAR(0, VAR_DYNLIB) }
        YY_BREAK
 case 245:
 YY_RULE_SETUP
 #line 460 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_MAX_UDP_SIZE) }
+{ YDVAR(1, VAR_DOMAIN_INSECURE) }
        YY_BREAK
 case 246:
 YY_RULE_SETUP
 #line 461 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_PREFIX) }
+{ YDVAR(1, VAR_MINIMAL_RESPONSES) }
        YY_BREAK
 case 247:
 YY_RULE_SETUP
 #line 462 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_SYNTHALL) }
+{ YDVAR(1, VAR_RRSET_ROUNDROBIN) }
        YY_BREAK
 case 248:
 YY_RULE_SETUP
 #line 463 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
+{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
        YY_BREAK
 case 249:
 YY_RULE_SETUP
 #line 464 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DEFINE_TAG) }
+{ YDVAR(1, VAR_MAX_UDP_SIZE) }
        YY_BREAK
 case 250:
 YY_RULE_SETUP
 #line 465 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
+{ YDVAR(1, VAR_DNS64_PREFIX) }
        YY_BREAK
 case 251:
 YY_RULE_SETUP
 #line 466 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
+{ YDVAR(1, VAR_DNS64_SYNTHALL) }
        YY_BREAK
 case 252:
 YY_RULE_SETUP
 #line 467 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
+{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
        YY_BREAK
 case 253:
 YY_RULE_SETUP
 #line 468 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
+{ YDVAR(1, VAR_NAT64_PREFIX) }
        YY_BREAK
 case 254:
 YY_RULE_SETUP
 #line 469 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
+{ YDVAR(1, VAR_DEFINE_TAG) }
        YY_BREAK
 case 255:
 YY_RULE_SETUP
 #line 470 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_INTERFACE_TAG) }
+{ YDVAR(2, VAR_LOCAL_ZONE_TAG) }
        YY_BREAK
 case 256:
 YY_RULE_SETUP
 #line 471 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_INTERFACE_TAG_ACTION) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
        YY_BREAK
 case 257:
 YY_RULE_SETUP
 #line 472 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_INTERFACE_TAG_DATA) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
        YY_BREAK
 case 258:
 YY_RULE_SETUP
 #line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_INTERFACE_VIEW) }
+{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
        YY_BREAK
 case 259:
 YY_RULE_SETUP
 #line 474 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
+{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
        YY_BREAK
 case 260:
 YY_RULE_SETUP
 #line 475 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DNSTAP) }
+{ YDVAR(2, VAR_INTERFACE_TAG) }
        YY_BREAK
 case 261:
 YY_RULE_SETUP
 #line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+{ YDVAR(3, VAR_INTERFACE_TAG_ACTION) }
        YY_BREAK
 case 262:
 YY_RULE_SETUP
 #line 477 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
+{ YDVAR(3, VAR_INTERFACE_TAG_DATA) }
        YY_BREAK
 case 263:
 YY_RULE_SETUP
 #line 478 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+{ YDVAR(2, VAR_INTERFACE_VIEW) }
        YY_BREAK
 case 264:
 YY_RULE_SETUP
 #line 479 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IP) }
+{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
        YY_BREAK
 case 265:
 YY_RULE_SETUP
 #line 480 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS) }
+{ YDVAR(0, VAR_DNSTAP) }
        YY_BREAK
 case 266:
 YY_RULE_SETUP
 #line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
+{ YDVAR(1, VAR_DNSTAP_ENABLE) }
        YY_BREAK
 case 267:
 YY_RULE_SETUP
 #line 482 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
+{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
        YY_BREAK
 case 268:
 YY_RULE_SETUP
 #line 483 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
        YY_BREAK
 case 269:
 YY_RULE_SETUP
-#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
+#line 484 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IP) }
        YY_BREAK
 case 270:
 YY_RULE_SETUP
-#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS) }
        YY_BREAK
 case 271:
 YY_RULE_SETUP
-#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+#line 486 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
        YY_BREAK
 case 272:
 YY_RULE_SETUP
-#line 489 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
        YY_BREAK
 case 273:
 YY_RULE_SETUP
-#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
        YY_BREAK
 case 274:
 YY_RULE_SETUP
-#line 491 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
-               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+               YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
        YY_BREAK
 case 275:
 YY_RULE_SETUP
-#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
        YY_BREAK
 case 276:
 YY_RULE_SETUP
-#line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
        YY_BREAK
 case 277:
 YY_RULE_SETUP
-#line 497 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+#line 494 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
        YY_BREAK
 case 278:
 YY_RULE_SETUP
-#line 499 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+#line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
        YY_BREAK
 case 279:
 YY_RULE_SETUP
-#line 501 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 496 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
-               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
        YY_BREAK
 case 280:
 YY_RULE_SETUP
-#line 503 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
+#line 498 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
        YY_BREAK
 case 281:
 YY_RULE_SETUP
-#line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT) }
+#line 500 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
        YY_BREAK
 case 282:
 YY_RULE_SETUP
-#line 505 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT) }
+#line 502 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
        YY_BREAK
 case 283:
 YY_RULE_SETUP
-#line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
+#line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
        YY_BREAK
 case 284:
 YY_RULE_SETUP
-#line 507 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+#line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
        YY_BREAK
 case 285:
 YY_RULE_SETUP
 #line 508 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
+{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
        YY_BREAK
 case 286:
 YY_RULE_SETUP
 #line 509 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+{ YDVAR(1, VAR_IP_RATELIMIT) }
        YY_BREAK
 case 287:
 YY_RULE_SETUP
 #line 510 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+{ YDVAR(1, VAR_IP_RATELIMIT_COOKIE) }
        YY_BREAK
 case 288:
 YY_RULE_SETUP
 #line 511 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+{ YDVAR(1, VAR_RATELIMIT) }
        YY_BREAK
 case 289:
 YY_RULE_SETUP
 #line 512 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
        YY_BREAK
 case 290:
 YY_RULE_SETUP
 #line 513 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
+{ YDVAR(1, VAR_RATELIMIT_SLABS) }
        YY_BREAK
 case 291:
 YY_RULE_SETUP
 #line 514 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) }
+{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
        YY_BREAK
 case 292:
 YY_RULE_SETUP
 #line 515 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_BACKOFF) }
+{ YDVAR(1, VAR_RATELIMIT_SIZE) }
        YY_BREAK
 case 293:
 YY_RULE_SETUP
 #line 516 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) }
+{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
        YY_BREAK
 case 294:
 YY_RULE_SETUP
 #line 517 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_LOW_RTT) }
+{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
        YY_BREAK
 case 295:
 YY_RULE_SETUP
 #line 518 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_NUM) }
+{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
        YY_BREAK
 case 296:
 YY_RULE_SETUP
 #line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
        YY_BREAK
 case 297:
 YY_RULE_SETUP
 #line 520 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) }
        YY_BREAK
 case 298:
 YY_RULE_SETUP
 #line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+{ YDVAR(1, VAR_RATELIMIT_BACKOFF) }
        YY_BREAK
 case 299:
 YY_RULE_SETUP
 #line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
+{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) }
        YY_BREAK
 case 300:
 YY_RULE_SETUP
 #line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP) }
+{ YDVAR(1, VAR_MAX_SENT_COUNT) }
        YY_BREAK
 case 301:
 YY_RULE_SETUP
 #line 524 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
+{ YDVAR(1, VAR_MAX_QUERY_RESTARTS) }
        YY_BREAK
 case 302:
 YY_RULE_SETUP
 #line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_DNSCRYPT) }
+{ YDVAR(1, VAR_LOW_RTT) }
        YY_BREAK
 case 303:
 YY_RULE_SETUP
 #line 526 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
+{ YDVAR(1, VAR_FAST_SERVER_NUM) }
        YY_BREAK
 case 304:
 YY_RULE_SETUP
 #line 527 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PORT) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 305:
 YY_RULE_SETUP
 #line 528 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 306:
 YY_RULE_SETUP
 #line 529 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
        YY_BREAK
 case 307:
 YY_RULE_SETUP
 #line 530 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
+{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
        YY_BREAK
 case 308:
 YY_RULE_SETUP
 #line 531 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
+{ YDVAR(2, VAR_RESPONSE_IP) }
        YY_BREAK
 case 309:
 YY_RULE_SETUP
 #line 532 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
+{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
        YY_BREAK
 case 310:
 YY_RULE_SETUP
-#line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{
-               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
+#line 533 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(0, VAR_DNSCRYPT) }
        YY_BREAK
 case 311:
 YY_RULE_SETUP
-#line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
+#line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
        YY_BREAK
 case 312:
 YY_RULE_SETUP
-#line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
+#line 535 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PORT) }
        YY_BREAK
 case 313:
 YY_RULE_SETUP
-#line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_RESPONSES) }
+#line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
        YY_BREAK
 case 314:
 YY_RULE_SETUP
-#line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) }
+#line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
        YY_BREAK
 case 315:
 YY_RULE_SETUP
-#line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_QUERIES) }
+#line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
        YY_BREAK
 case 316:
 YY_RULE_SETUP
-#line 541 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) }
+#line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
        YY_BREAK
 case 317:
 YY_RULE_SETUP
-#line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
+#line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
        YY_BREAK
 case 318:
 YY_RULE_SETUP
-#line 543 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
+#line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
+               YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
        YY_BREAK
 case 319:
 YY_RULE_SETUP
 #line 544 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_HOOK) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
        YY_BREAK
 case 320:
 YY_RULE_SETUP
 #line 545 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
        YY_BREAK
 case 321:
 YY_RULE_SETUP
 #line 546 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+{ YDVAR(1, VAR_PAD_RESPONSES) }
        YY_BREAK
 case 322:
 YY_RULE_SETUP
 #line 547 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) }
        YY_BREAK
 case 323:
 YY_RULE_SETUP
 #line 548 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+{ YDVAR(1, VAR_PAD_QUERIES) }
        YY_BREAK
 case 324:
 YY_RULE_SETUP
 #line 549 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_CACHEDB) }
+{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) }
        YY_BREAK
 case 325:
 YY_RULE_SETUP
 #line 550 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
        YY_BREAK
 case 326:
 YY_RULE_SETUP
 #line 551 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
+{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
        YY_BREAK
 case 327:
 YY_RULE_SETUP
 #line 552 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
+{ YDVAR(1, VAR_IPSECMOD_HOOK) }
        YY_BREAK
 case 328:
 YY_RULE_SETUP
 #line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
+{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
        YY_BREAK
 case 329:
 YY_RULE_SETUP
 #line 554 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
        YY_BREAK
 case 330:
 YY_RULE_SETUP
 #line 555 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
        YY_BREAK
 case 331:
 YY_RULE_SETUP
 #line 556 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(0, VAR_IPSET) }
+{ YDVAR(1, VAR_IPSECMOD_STRICT) }
        YY_BREAK
 case 332:
 YY_RULE_SETUP
 #line 557 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V4) }
+{ YDVAR(0, VAR_CACHEDB) }
        YY_BREAK
 case 333:
 YY_RULE_SETUP
 #line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V6) }
+{ YDVAR(1, VAR_CACHEDB_BACKEND) }
        YY_BREAK
 case 334:
 YY_RULE_SETUP
 #line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
        YY_BREAK
 case 335:
 YY_RULE_SETUP
 #line 560 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
        YY_BREAK
 case 336:
 YY_RULE_SETUP
 #line 561 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
+{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
        YY_BREAK
 case 337:
 YY_RULE_SETUP
 #line 562 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
+{ YDVAR(1, VAR_CACHEDB_REDISPATH) }
        YY_BREAK
 case 338:
 YY_RULE_SETUP
 #line 563 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_NSID ) }
+{ YDVAR(1, VAR_CACHEDB_REDISPASSWORD) }
        YY_BREAK
 case 339:
 YY_RULE_SETUP
 #line 564 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_EDE ) }
+{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
        YY_BREAK
 case 340:
 YY_RULE_SETUP
 #line 565 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
+{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
        YY_BREAK
 case 341:
-/* rule 341 can match eol */
 YY_RULE_SETUP
 #line 566 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++; }
+{ YDVAR(0, VAR_IPSET) }
        YY_BREAK
-/* Quoted strings. Strip leading and ending quotes */
 case 342:
 YY_RULE_SETUP
+#line 567 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V4) }
+       YY_BREAK
+case 343:
+YY_RULE_SETUP
+#line 568 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V6) }
+       YY_BREAK
+case 344:
+YY_RULE_SETUP
 #line 569 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+       YY_BREAK
+case 345:
+YY_RULE_SETUP
+#line 570 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+       YY_BREAK
+case 346:
+YY_RULE_SETUP
+#line 571 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_ANSWER_COOKIE ) }
+       YY_BREAK
+case 347:
+YY_RULE_SETUP
+#line 572 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_COOKIE_SECRET) }
+       YY_BREAK
+case 348:
+YY_RULE_SETUP
+#line 573 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
+       YY_BREAK
+case 349:
+YY_RULE_SETUP
+#line 574 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
+       YY_BREAK
+case 350:
+YY_RULE_SETUP
+#line 575 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_NSID ) }
+       YY_BREAK
+case 351:
+YY_RULE_SETUP
+#line 576 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_EDE ) }
+       YY_BREAK
+case 352:
+YY_RULE_SETUP
+#line 577 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
+       YY_BREAK
+case 353:
+/* rule 353 can match eol */
+YY_RULE_SETUP
+#line 578 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++; }
+       YY_BREAK
+/* Quoted strings. Strip leading and ending quotes */
+case 354:
+YY_RULE_SETUP
+#line 581 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
        YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 570 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 582 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
        if(--num_args == 0) { BEGIN(INITIAL); }
        else                { BEGIN(val); }
 }
        YY_BREAK
-case 343:
+case 355:
 YY_RULE_SETUP
-#line 575 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 587 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 344:
-/* rule 344 can match eol */
+case 356:
+/* rule 356 can match eol */
 YY_RULE_SETUP
-#line 576 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ yyerror("newline inside quoted string, no end \""); 
+#line 588 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ yyerror("newline inside quoted string, no end \"");
                          cfg_parser->line++; BEGIN(INITIAL); }
        YY_BREAK
-case 345:
+case 357:
 YY_RULE_SETUP
-#line 578 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 590 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         LEXOUT(("QE "));
        if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5470,34 +5626,34 @@ YY_RULE_SETUP
 }
        YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 346:
+case 358:
 YY_RULE_SETUP
-#line 590 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
        YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 591 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 603 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
        if(--num_args == 0) { BEGIN(INITIAL); }
        else                { BEGIN(val); }
 }
        YY_BREAK
-case 347:
+case 359:
 YY_RULE_SETUP
-#line 596 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 348:
-/* rule 348 can match eol */
+case 360:
+/* rule 360 can match eol */
 YY_RULE_SETUP
-#line 597 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ yyerror("newline inside quoted string, no end '"); 
+#line 609 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ yyerror("newline inside quoted string, no end '");
                             cfg_parser->line++; BEGIN(INITIAL); }
        YY_BREAK
-case 349:
+case 361:
 YY_RULE_SETUP
-#line 599 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 611 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         LEXOUT(("SQE "));
        if(--num_args == 0) { BEGIN(INITIAL); }
@@ -5510,38 +5666,38 @@ YY_RULE_SETUP
 }
        YY_BREAK
 /* include: directive */
-case 350:
+case 362:
 YY_RULE_SETUP
-#line 611 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ 
+#line 623 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{
        LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
        YY_BREAK
 case YY_STATE_EOF(include):
-#line 613 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 625 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
        YY_BREAK
-case 351:
+case 363:
 YY_RULE_SETUP
-#line 617 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 629 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ISP ")); /* ignore */ }
        YY_BREAK
-case 352:
-/* rule 352 can match eol */
+case 364:
+/* rule 364 can match eol */
 YY_RULE_SETUP
-#line 618 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 630 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++;}
        YY_BREAK
-case 353:
+case 365:
 YY_RULE_SETUP
-#line 619 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 631 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("IQS ")); BEGIN(include_quoted); }
        YY_BREAK
-case 354:
+case 366:
 YY_RULE_SETUP
-#line 620 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 632 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("Iunquotedstr(%s) ", yytext));
        config_start_include_glob(yytext, 0);
@@ -5549,27 +5705,27 @@ YY_RULE_SETUP
 }
        YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 625 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 637 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
        YY_BREAK
-case 355:
+case 367:
 YY_RULE_SETUP
-#line 629 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 641 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 356:
-/* rule 356 can match eol */
+case 368:
+/* rule 368 can match eol */
 YY_RULE_SETUP
-#line 630 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ yyerror("newline before \" in include name"); 
+#line 642 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ yyerror("newline before \" in include name");
                                  cfg_parser->line++; BEGIN(inc_prev); }
        YY_BREAK
-case 357:
+case 369:
 YY_RULE_SETUP
-#line 632 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("IQE "));
        yytext[yyleng - 1] = '\0';
@@ -5579,7 +5735,7 @@ YY_RULE_SETUP
        YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 638 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 650 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("LEXEOF "));
        yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
@@ -5594,39 +5750,39 @@ case YY_STATE_EOF(val):
 }
        YY_BREAK
 /* include-toplevel: directive */
-case 358:
+case 370:
 YY_RULE_SETUP
-#line 652 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 664 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel);
 }
        YY_BREAK
 case YY_STATE_EOF(include_toplevel):
-#line 655 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 667 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("EOF inside include_toplevel directive");
        BEGIN(inc_prev);
 }
        YY_BREAK
-case 359:
+case 371:
 YY_RULE_SETUP
-#line 659 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 671 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITSP ")); /* ignore */ }
        YY_BREAK
-case 360:
-/* rule 360 can match eol */
+case 372:
+/* rule 372 can match eol */
 YY_RULE_SETUP
-#line 660 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
        YY_BREAK
-case 361:
+case 373:
 YY_RULE_SETUP
-#line 661 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 673 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); }
        YY_BREAK
-case 362:
+case 374:
 YY_RULE_SETUP
-#line 662 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 674 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("ITunquotedstr(%s) ", yytext));
        config_start_include_glob(yytext, 1);
@@ -5635,29 +5791,29 @@ YY_RULE_SETUP
 }
        YY_BREAK
 case YY_STATE_EOF(include_toplevel_quoted):
-#line 668 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("EOF inside quoted string");
        BEGIN(inc_prev);
 }
        YY_BREAK
-case 363:
+case 375:
 YY_RULE_SETUP
-#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 684 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 { LEXOUT(("ITSTR(%s) ", yytext)); yymore(); }
        YY_BREAK
-case 364:
-/* rule 364 can match eol */
+case 376:
+/* rule 376 can match eol */
 YY_RULE_SETUP
-#line 673 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 685 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        yyerror("newline before \" in include name");
        cfg_parser->line++; BEGIN(inc_prev);
 }
        YY_BREAK
-case 365:
+case 377:
 YY_RULE_SETUP
-#line 677 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 689 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        LEXOUT(("ITQE "));
        yytext[yyleng - 1] = '\0';
@@ -5666,33 +5822,33 @@ YY_RULE_SETUP
        return (VAR_FORCE_TOPLEVEL);
 }
        YY_BREAK
-case 366:
+case 378:
 YY_RULE_SETUP
-#line 685 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
-{ LEXOUT(("unquotedstr(%s) ", yytext)); 
+#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+{ LEXOUT(("unquotedstr(%s) ", yytext));
                        if(--num_args == 0) { BEGIN(INITIAL); }
                        yylval.str = strdup(yytext); return STRING_ARG; }
        YY_BREAK
-case 367:
+case 379:
 YY_RULE_SETUP
-#line 689 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 701 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        ub_c_error_msg("unknown keyword '%s'", yytext);
        }
        YY_BREAK
-case 368:
+case 380:
 YY_RULE_SETUP
-#line 693 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 705 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 {
        ub_c_error_msg("stray '%s'", yytext);
        }
        YY_BREAK
-case 369:
+case 381:
 YY_RULE_SETUP
-#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 709 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 ECHO;
        YY_BREAK
-#line 5694 "<stdout>"
+#line 5850 "<stdout>"
 
        case YY_END_OF_BUFFER:
                {
@@ -5985,7 +6141,7 @@ static int yy_get_next_buffer (void)
                while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                        {
                        yy_current_state = (int) yy_def[yy_current_state];
-                       if ( yy_current_state >= 3646 )
+                       if ( yy_current_state >= 3778 )
                                yy_c = yy_meta[(unsigned int) yy_c];
                        }
                yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -6013,11 +6169,11 @@ static int yy_get_next_buffer (void)
        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                {
                yy_current_state = (int) yy_def[yy_current_state];
-               if ( yy_current_state >= 3646 )
+               if ( yy_current_state >= 3778 )
                        yy_c = yy_meta[(unsigned int) yy_c];
                }
        yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-       yy_is_jam = (yy_current_state == 3645);
+       yy_is_jam = (yy_current_state == 3777);
 
        return yy_is_jam ? 0 : yy_current_state;
 }
@@ -6650,7 +6806,7 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
+#line 709 "/usr/src/usr.sbin/unbound/util/configlexer.lex"
 
 
 

diff --git a/sbin/unwind/libunbound/util/configlexer.lex b/sbin/unwind/libunbound/util/configlexer.lex
index 09e314b..3fcdfa6 100644 (file)
--- a/sbin/unwind/libunbound/util/configlexer.lex
+++ b/sbin/unwind/libunbound/util/configlexer.lex
@@ -209,9 +209,9 @@ SQANY     [^\'\n\r\\]|\\.
 %x     quotedstring singlequotedstr include include_quoted val include_toplevel include_toplevel_quoted
 
 %%
-<INITIAL,val>{SPACE}*  { 
+<INITIAL,val>{SPACE}*  {
        LEXOUT(("SP ")); /* ignore */ }
-<INITIAL,val>{SPACE}*{COMMENT}.*       { 
+<INITIAL,val>{SPACE}*{COMMENT}.*       {
        /* note that flex makes the longest match and '.' is any but not nl */
        LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
 server{COLON}                  { YDVAR(0, VAR_SERVER) }
@@ -227,6 +227,7 @@ outgoing-num-tcp{COLON}             { YDVAR(1, VAR_OUTGOING_NUM_TCP) }
 incoming-num-tcp{COLON}                { YDVAR(1, VAR_INCOMING_NUM_TCP) }
 do-ip4{COLON}                  { YDVAR(1, VAR_DO_IP4) }
 do-ip6{COLON}                  { YDVAR(1, VAR_DO_IP6) }
+do-nat64{COLON}                        { YDVAR(1, VAR_DO_NAT64) }
 prefer-ip4{COLON}              { YDVAR(1, VAR_PREFER_IP4) }
 prefer-ip6{COLON}              { YDVAR(1, VAR_PREFER_IP6) }
 do-udp{COLON}                  { YDVAR(1, VAR_DO_UDP) }
@@ -240,6 +241,7 @@ tcp-reuse-timeout{COLON}    { YDVAR(1, VAR_TCP_REUSE_TIMEOUT) }
 tcp-auth-query-timeout{COLON}  { YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) }
 edns-tcp-keepalive{COLON}      { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) }
 edns-tcp-keepalive-timeout{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) }
+sock-queue-timeout{COLON} { YDVAR(1, VAR_SOCK_QUEUE_TIMEOUT) }
 ssl-upstream{COLON}            { YDVAR(1, VAR_SSL_UPSTREAM) }
 tls-upstream{COLON}            { YDVAR(1, VAR_SSL_UPSTREAM) }
 ssl-service-key{COLON}         { YDVAR(1, VAR_SSL_SERVICE_KEY) }
@@ -316,6 +318,7 @@ harden-dnssec-stripped{COLON}       { YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 harden-below-nxdomain{COLON}   { YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}    { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 harden-algo-downgrade{COLON}   { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
+harden-unknown-additional{COLON}       { YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) }
 use-caps-for-id{COLON}         { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}          { YDVAR(1, VAR_CAPS_WHITELIST) }
 caps-exempt{COLON}             { YDVAR(1, VAR_CAPS_WHITELIST) }
@@ -413,7 +416,7 @@ val-log-level{COLON}                { YDVAR(1, VAR_VAL_LOG_LEVEL) }
 key-cache-size{COLON}          { YDVAR(1, VAR_KEY_CACHE_SIZE) }
 key-cache-slabs{COLON}         { YDVAR(1, VAR_KEY_CACHE_SLABS) }
 neg-cache-size{COLON}          { YDVAR(1, VAR_NEG_CACHE_SIZE) }
-val-nsec3-keysize-iterations{COLON}    { 
+val-nsec3-keysize-iterations{COLON}    {
                                  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 zonemd-permissive-mode{COLON}  { YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
 zonemd-check{COLON}            { YDVAR(1, VAR_ZONEMD_CHECK) }
@@ -438,6 +441,7 @@ insecure-lan-zones{COLON}   { YDVAR(1, VAR_INSECURE_LAN_ZONES) }
 statistics-interval{COLON}     { YDVAR(1, VAR_STATISTICS_INTERVAL) }
 statistics-cumulative{COLON}   { YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 extended-statistics{COLON}     { YDVAR(1, VAR_EXTENDED_STATISTICS) }
+statistics-inhibit-zero{COLON} { YDVAR(1, VAR_STATISTICS_INHIBIT_ZERO) }
 shm-enable{COLON}              { YDVAR(1, VAR_SHM_ENABLE) }
 shm-key{COLON}                 { YDVAR(1, VAR_SHM_KEY) }
 remote-control{COLON}          { YDVAR(0, VAR_REMOTE_CONTROL) }
@@ -461,6 +465,7 @@ max-udp-size{COLON}         { YDVAR(1, VAR_MAX_UDP_SIZE) }
 dns64-prefix{COLON}            { YDVAR(1, VAR_DNS64_PREFIX) }
 dns64-synthall{COLON}          { YDVAR(1, VAR_DNS64_SYNTHALL) }
 dns64-ignore-aaaa{COLON}       { YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
+nat64-prefix{COLON}            { YDVAR(1, VAR_NAT64_PREFIX) }
 define-tag{COLON}              { YDVAR(1, VAR_DEFINE_TAG) }
 local-zone-tag{COLON}          { YDVAR(2, VAR_LOCAL_ZONE_TAG) }
 access-control-tag{COLON}      { YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
@@ -502,6 +507,7 @@ dnstap-log-forwarder-response-messages{COLON}       {
                YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 ip-ratelimit{COLON}            { YDVAR(1, VAR_IP_RATELIMIT) }
+ip-ratelimit-cookie{COLON}     { YDVAR(1, VAR_IP_RATELIMIT_COOKIE) }
 ratelimit{COLON}               { YDVAR(1, VAR_RATELIMIT) }
 ip-ratelimit-slabs{COLON}              { YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
 ratelimit-slabs{COLON}         { YDVAR(1, VAR_RATELIMIT_SLABS) }
@@ -514,6 +520,8 @@ ratelimit-factor{COLON}             { YDVAR(1, VAR_RATELIMIT_FACTOR) }
 ip-ratelimit-backoff{COLON}            { YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) }
 ratelimit-backoff{COLON}               { YDVAR(1, VAR_RATELIMIT_BACKOFF) }
 outbound-msg-retry{COLON}              { YDVAR(1, VAR_OUTBOUND_MSG_RETRY) }
+max-sent-count{COLON}          { YDVAR(1, VAR_MAX_SENT_COUNT) }
+max-query-restarts{COLON}      { YDVAR(1, VAR_MAX_QUERY_RESTARTS) }
 low-rtt{COLON}                 { YDVAR(1, VAR_LOW_RTT) }
 fast-server-num{COLON}         { YDVAR(1, VAR_FAST_SERVER_NUM) }
 low-rtt-pct{COLON}             { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
@@ -551,6 +559,8 @@ backend{COLON}                      { YDVAR(1, VAR_CACHEDB_BACKEND) }
 secret-seed{COLON}             { YDVAR(1, VAR_CACHEDB_SECRETSEED) }
 redis-server-host{COLON}       { YDVAR(1, VAR_CACHEDB_REDISHOST) }
 redis-server-port{COLON}       { YDVAR(1, VAR_CACHEDB_REDISPORT) }
+redis-server-path{COLON}       { YDVAR(1, VAR_CACHEDB_REDISPATH) }
+redis-server-password{COLON}   { YDVAR(1, VAR_CACHEDB_REDISPASSWORD) }
 redis-timeout{COLON}           { YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
 redis-expire-records{COLON}    { YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
 ipset{COLON}                   { YDVAR(0, VAR_IPSET) }
@@ -558,6 +568,8 @@ name-v4{COLON}                      { YDVAR(1, VAR_IPSET_NAME_V4) }
 name-v6{COLON}                 { YDVAR(1, VAR_IPSET_NAME_V6) }
 udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 tcp-connection-limit{COLON}    { YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+answer-cookie{COLON}           { YDVAR(1, VAR_ANSWER_COOKIE ) }
+cookie-secret{COLON}           { YDVAR(1, VAR_COOKIE_SECRET) }
 edns-client-string{COLON}      { YDVAR(2, VAR_EDNS_CLIENT_STRING) }
 edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
 nsid{COLON}                    { YDVAR(1, VAR_NSID ) }
@@ -573,7 +585,7 @@ proxy-protocol-port{COLON}  { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
        else                { BEGIN(val); }
 }
 <quotedstring>{DQANY}*  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
-<quotedstring>{NEWLINE} { yyerror("newline inside quoted string, no end \""); 
+<quotedstring>{NEWLINE} { yyerror("newline inside quoted string, no end \"");
                          cfg_parser->line++; BEGIN(INITIAL); }
 <quotedstring>\" {
         LEXOUT(("QE "));
@@ -594,7 +606,7 @@ proxy-protocol-port{COLON}  { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
        else                { BEGIN(val); }
 }
 <singlequotedstr>{SQANY}*  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
-<singlequotedstr>{NEWLINE} { yyerror("newline inside quoted string, no end '"); 
+<singlequotedstr>{NEWLINE} { yyerror("newline inside quoted string, no end '");
                             cfg_parser->line++; BEGIN(INITIAL); }
 <singlequotedstr>\' {
         LEXOUT(("SQE "));
@@ -608,7 +620,7 @@ proxy-protocol-port{COLON}  { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 }
 
        /* include: directive */
-<INITIAL,val>include{COLON}    { 
+<INITIAL,val>include{COLON}    {
        LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 <include><<EOF>>       {
         yyerror("EOF inside include directive");
@@ -627,7 +639,7 @@ proxy-protocol-port{COLON}  { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
         BEGIN(inc_prev);
 }
 <include_quoted>{DQANY}*       { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
-<include_quoted>{NEWLINE}      { yyerror("newline before \" in include name"); 
+<include_quoted>{NEWLINE}      { yyerror("newline before \" in include name");
                                  cfg_parser->line++; BEGIN(inc_prev); }
 <include_quoted>\"     {
        LEXOUT(("IQE "));
@@ -682,7 +694,7 @@ proxy-protocol-port{COLON}  { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
        return (VAR_FORCE_TOPLEVEL);
 }
 
-<val>{UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", yytext)); 
+<val>{UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", yytext));
                        if(--num_args == 0) { BEGIN(INITIAL); }
                        yylval.str = strdup(yytext); return STRING_ARG; }
 

diff --git a/sbin/unwind/libunbound/util/configparser.h b/sbin/unwind/libunbound/util/configparser.h
index d2e7370..ad2902b 100644 (file)
--- a/sbin/unwind/libunbound/util/configparser.h
+++ b/sbin/unwind/libunbound/util/configparser.h
@@ -16,319 +16,331 @@
 #define VAR_PREFER_IP4 272
 #define VAR_DO_IP4 273
 #define VAR_DO_IP6 274
-#define VAR_PREFER_IP6 275
-#define VAR_DO_UDP 276
-#define VAR_DO_TCP 277
-#define VAR_TCP_MSS 278
-#define VAR_OUTGOING_TCP_MSS 279
-#define VAR_TCP_IDLE_TIMEOUT 280
-#define VAR_EDNS_TCP_KEEPALIVE 281
-#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 282
-#define VAR_CHROOT 283
-#define VAR_USERNAME 284
-#define VAR_DIRECTORY 285
-#define VAR_LOGFILE 286
-#define VAR_PIDFILE 287
-#define VAR_MSG_CACHE_SIZE 288
-#define VAR_MSG_CACHE_SLABS 289
-#define VAR_NUM_QUERIES_PER_THREAD 290
-#define VAR_RRSET_CACHE_SIZE 291
-#define VAR_RRSET_CACHE_SLABS 292
-#define VAR_OUTGOING_NUM_TCP 293
-#define VAR_INFRA_HOST_TTL 294
-#define VAR_INFRA_LAME_TTL 295
-#define VAR_INFRA_CACHE_SLABS 296
-#define VAR_INFRA_CACHE_NUMHOSTS 297
-#define VAR_INFRA_CACHE_LAME_SIZE 298
-#define VAR_NAME 299
-#define VAR_STUB_ZONE 300
-#define VAR_STUB_HOST 301
-#define VAR_STUB_ADDR 302
-#define VAR_TARGET_FETCH_POLICY 303
-#define VAR_HARDEN_SHORT_BUFSIZE 304
-#define VAR_HARDEN_LARGE_QUERIES 305
-#define VAR_FORWARD_ZONE 306
-#define VAR_FORWARD_HOST 307
-#define VAR_FORWARD_ADDR 308
-#define VAR_DO_NOT_QUERY_ADDRESS 309
-#define VAR_HIDE_IDENTITY 310
-#define VAR_HIDE_VERSION 311
-#define VAR_IDENTITY 312
-#define VAR_VERSION 313
-#define VAR_HARDEN_GLUE 314
-#define VAR_MODULE_CONF 315
-#define VAR_TRUST_ANCHOR_FILE 316
-#define VAR_TRUST_ANCHOR 317
-#define VAR_VAL_OVERRIDE_DATE 318
-#define VAR_BOGUS_TTL 319
-#define VAR_VAL_CLEAN_ADDITIONAL 320
-#define VAR_VAL_PERMISSIVE_MODE 321
-#define VAR_INCOMING_NUM_TCP 322
-#define VAR_MSG_BUFFER_SIZE 323
-#define VAR_KEY_CACHE_SIZE 324
-#define VAR_KEY_CACHE_SLABS 325
-#define VAR_TRUSTED_KEYS_FILE 326
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 327
-#define VAR_USE_SYSLOG 328
-#define VAR_OUTGOING_INTERFACE 329
-#define VAR_ROOT_HINTS 330
-#define VAR_DO_NOT_QUERY_LOCALHOST 331
-#define VAR_CACHE_MAX_TTL 332
-#define VAR_HARDEN_DNSSEC_STRIPPED 333
-#define VAR_ACCESS_CONTROL 334
-#define VAR_LOCAL_ZONE 335
-#define VAR_LOCAL_DATA 336
-#define VAR_INTERFACE_AUTOMATIC 337
-#define VAR_STATISTICS_INTERVAL 338
-#define VAR_DO_DAEMONIZE 339
-#define VAR_USE_CAPS_FOR_ID 340
-#define VAR_STATISTICS_CUMULATIVE 341
-#define VAR_OUTGOING_PORT_PERMIT 342
-#define VAR_OUTGOING_PORT_AVOID 343
-#define VAR_DLV_ANCHOR_FILE 344
-#define VAR_DLV_ANCHOR 345
-#define VAR_NEG_CACHE_SIZE 346
-#define VAR_HARDEN_REFERRAL_PATH 347
-#define VAR_PRIVATE_ADDRESS 348
-#define VAR_PRIVATE_DOMAIN 349
-#define VAR_REMOTE_CONTROL 350
-#define VAR_CONTROL_ENABLE 351
-#define VAR_CONTROL_INTERFACE 352
-#define VAR_CONTROL_PORT 353
-#define VAR_SERVER_KEY_FILE 354
-#define VAR_SERVER_CERT_FILE 355
-#define VAR_CONTROL_KEY_FILE 356
-#define VAR_CONTROL_CERT_FILE 357
-#define VAR_CONTROL_USE_CERT 358
-#define VAR_TCP_REUSE_TIMEOUT 359
-#define VAR_MAX_REUSE_TCP_QUERIES 360
-#define VAR_EXTENDED_STATISTICS 361
-#define VAR_LOCAL_DATA_PTR 362
-#define VAR_JOSTLE_TIMEOUT 363
-#define VAR_STUB_PRIME 364
-#define VAR_UNWANTED_REPLY_THRESHOLD 365
-#define VAR_LOG_TIME_ASCII 366
-#define VAR_DOMAIN_INSECURE 367
-#define VAR_PYTHON 368
-#define VAR_PYTHON_SCRIPT 369
-#define VAR_VAL_SIG_SKEW_MIN 370
-#define VAR_VAL_SIG_SKEW_MAX 371
-#define VAR_VAL_MAX_RESTART 372
-#define VAR_CACHE_MIN_TTL 373
-#define VAR_VAL_LOG_LEVEL 374
-#define VAR_AUTO_TRUST_ANCHOR_FILE 375
-#define VAR_KEEP_MISSING 376
-#define VAR_ADD_HOLDDOWN 377
-#define VAR_DEL_HOLDDOWN 378
-#define VAR_SO_RCVBUF 379
-#define VAR_EDNS_BUFFER_SIZE 380
-#define VAR_PREFETCH 381
-#define VAR_PREFETCH_KEY 382
-#define VAR_SO_SNDBUF 383
-#define VAR_SO_REUSEPORT 384
-#define VAR_HARDEN_BELOW_NXDOMAIN 385
-#define VAR_IGNORE_CD_FLAG 386
-#define VAR_LOG_QUERIES 387
-#define VAR_LOG_REPLIES 388
-#define VAR_LOG_LOCAL_ACTIONS 389
-#define VAR_TCP_UPSTREAM 390
-#define VAR_SSL_UPSTREAM 391
-#define VAR_TCP_AUTH_QUERY_TIMEOUT 392
-#define VAR_SSL_SERVICE_KEY 393
-#define VAR_SSL_SERVICE_PEM 394
-#define VAR_SSL_PORT 395
-#define VAR_FORWARD_FIRST 396
-#define VAR_STUB_SSL_UPSTREAM 397
-#define VAR_FORWARD_SSL_UPSTREAM 398
-#define VAR_TLS_CERT_BUNDLE 399
-#define VAR_STUB_TCP_UPSTREAM 400
-#define VAR_FORWARD_TCP_UPSTREAM 401
-#define VAR_HTTPS_PORT 402
-#define VAR_HTTP_ENDPOINT 403
-#define VAR_HTTP_MAX_STREAMS 404
-#define VAR_HTTP_QUERY_BUFFER_SIZE 405
-#define VAR_HTTP_RESPONSE_BUFFER_SIZE 406
-#define VAR_HTTP_NODELAY 407
-#define VAR_HTTP_NOTLS_DOWNSTREAM 408
-#define VAR_STUB_FIRST 409
-#define VAR_MINIMAL_RESPONSES 410
-#define VAR_RRSET_ROUNDROBIN 411
-#define VAR_MAX_UDP_SIZE 412
-#define VAR_DELAY_CLOSE 413
-#define VAR_UDP_CONNECT 414
-#define VAR_UNBLOCK_LAN_ZONES 415
-#define VAR_INSECURE_LAN_ZONES 416
-#define VAR_INFRA_CACHE_MIN_RTT 417
-#define VAR_INFRA_CACHE_MAX_RTT 418
-#define VAR_INFRA_KEEP_PROBING 419
-#define VAR_DNS64_PREFIX 420
-#define VAR_DNS64_SYNTHALL 421
-#define VAR_DNS64_IGNORE_AAAA 422
-#define VAR_DNSTAP 423
-#define VAR_DNSTAP_ENABLE 424
-#define VAR_DNSTAP_SOCKET_PATH 425
-#define VAR_DNSTAP_IP 426
-#define VAR_DNSTAP_TLS 427
-#define VAR_DNSTAP_TLS_SERVER_NAME 428
-#define VAR_DNSTAP_TLS_CERT_BUNDLE 429
-#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 430
-#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 431
-#define VAR_DNSTAP_SEND_IDENTITY 432
-#define VAR_DNSTAP_SEND_VERSION 433
-#define VAR_DNSTAP_BIDIRECTIONAL 434
-#define VAR_DNSTAP_IDENTITY 435
-#define VAR_DNSTAP_VERSION 436
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 437
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 438
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 439
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 440
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 441
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 442
-#define VAR_RESPONSE_IP_TAG 443
-#define VAR_RESPONSE_IP 444
-#define VAR_RESPONSE_IP_DATA 445
-#define VAR_HARDEN_ALGO_DOWNGRADE 446
-#define VAR_IP_TRANSPARENT 447
-#define VAR_IP_DSCP 448
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 449
-#define VAR_IP_RATELIMIT 450
-#define VAR_IP_RATELIMIT_SLABS 451
-#define VAR_IP_RATELIMIT_SIZE 452
-#define VAR_RATELIMIT 453
-#define VAR_RATELIMIT_SLABS 454
-#define VAR_RATELIMIT_SIZE 455
-#define VAR_OUTBOUND_MSG_RETRY 456
-#define VAR_RATELIMIT_FOR_DOMAIN 457
-#define VAR_RATELIMIT_BELOW_DOMAIN 458
-#define VAR_IP_RATELIMIT_FACTOR 459
-#define VAR_RATELIMIT_FACTOR 460
-#define VAR_IP_RATELIMIT_BACKOFF 461
-#define VAR_RATELIMIT_BACKOFF 462
-#define VAR_SEND_CLIENT_SUBNET 463
-#define VAR_CLIENT_SUBNET_ZONE 464
-#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 465
-#define VAR_CLIENT_SUBNET_OPCODE 466
-#define VAR_MAX_CLIENT_SUBNET_IPV4 467
-#define VAR_MAX_CLIENT_SUBNET_IPV6 468
-#define VAR_MIN_CLIENT_SUBNET_IPV4 469
-#define VAR_MIN_CLIENT_SUBNET_IPV6 470
-#define VAR_MAX_ECS_TREE_SIZE_IPV4 471
-#define VAR_MAX_ECS_TREE_SIZE_IPV6 472
-#define VAR_CAPS_WHITELIST 473
-#define VAR_CACHE_MAX_NEGATIVE_TTL 474
-#define VAR_PERMIT_SMALL_HOLDDOWN 475
-#define VAR_QNAME_MINIMISATION 476
-#define VAR_QNAME_MINIMISATION_STRICT 477
-#define VAR_IP_FREEBIND 478
-#define VAR_DEFINE_TAG 479
-#define VAR_LOCAL_ZONE_TAG 480
-#define VAR_ACCESS_CONTROL_TAG 481
-#define VAR_LOCAL_ZONE_OVERRIDE 482
-#define VAR_ACCESS_CONTROL_TAG_ACTION 483
-#define VAR_ACCESS_CONTROL_TAG_DATA 484
-#define VAR_VIEW 485
-#define VAR_ACCESS_CONTROL_VIEW 486
-#define VAR_VIEW_FIRST 487
-#define VAR_SERVE_EXPIRED 488
-#define VAR_SERVE_EXPIRED_TTL 489
-#define VAR_SERVE_EXPIRED_TTL_RESET 490
-#define VAR_SERVE_EXPIRED_REPLY_TTL 491
-#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 492
-#define VAR_EDE_SERVE_EXPIRED 493
-#define VAR_SERVE_ORIGINAL_TTL 494
-#define VAR_FAKE_DSA 495
-#define VAR_FAKE_SHA1 496
-#define VAR_LOG_IDENTITY 497
-#define VAR_HIDE_TRUSTANCHOR 498
-#define VAR_HIDE_HTTP_USER_AGENT 499
-#define VAR_HTTP_USER_AGENT 500
-#define VAR_TRUST_ANCHOR_SIGNALING 501
-#define VAR_AGGRESSIVE_NSEC 502
-#define VAR_USE_SYSTEMD 503
-#define VAR_SHM_ENABLE 504
-#define VAR_SHM_KEY 505
-#define VAR_ROOT_KEY_SENTINEL 506
-#define VAR_DNSCRYPT 507
-#define VAR_DNSCRYPT_ENABLE 508
-#define VAR_DNSCRYPT_PORT 509
-#define VAR_DNSCRYPT_PROVIDER 510
-#define VAR_DNSCRYPT_SECRET_KEY 511
-#define VAR_DNSCRYPT_PROVIDER_CERT 512
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 513
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 514
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 515
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 516
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 517
-#define VAR_PAD_RESPONSES 518
-#define VAR_PAD_RESPONSES_BLOCK_SIZE 519
-#define VAR_PAD_QUERIES 520
-#define VAR_PAD_QUERIES_BLOCK_SIZE 521
-#define VAR_IPSECMOD_ENABLED 522
-#define VAR_IPSECMOD_HOOK 523
-#define VAR_IPSECMOD_IGNORE_BOGUS 524
-#define VAR_IPSECMOD_MAX_TTL 525
-#define VAR_IPSECMOD_WHITELIST 526
-#define VAR_IPSECMOD_STRICT 527
-#define VAR_CACHEDB 528
-#define VAR_CACHEDB_BACKEND 529
-#define VAR_CACHEDB_SECRETSEED 530
-#define VAR_CACHEDB_REDISHOST 531
-#define VAR_CACHEDB_REDISPORT 532
-#define VAR_CACHEDB_REDISTIMEOUT 533
-#define VAR_CACHEDB_REDISEXPIRERECORDS 534
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 535
-#define VAR_FOR_UPSTREAM 536
-#define VAR_AUTH_ZONE 537
-#define VAR_ZONEFILE 538
-#define VAR_MASTER 539
-#define VAR_URL 540
-#define VAR_FOR_DOWNSTREAM 541
-#define VAR_FALLBACK_ENABLED 542
-#define VAR_TLS_ADDITIONAL_PORT 543
-#define VAR_LOW_RTT 544
-#define VAR_LOW_RTT_PERMIL 545
-#define VAR_FAST_SERVER_PERMIL 546
-#define VAR_FAST_SERVER_NUM 547
-#define VAR_ALLOW_NOTIFY 548
-#define VAR_TLS_WIN_CERT 549
-#define VAR_TCP_CONNECTION_LIMIT 550
-#define VAR_FORWARD_NO_CACHE 551
-#define VAR_STUB_NO_CACHE 552
-#define VAR_LOG_SERVFAIL 553
-#define VAR_DENY_ANY 554
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 555
-#define VAR_LOG_TAG_QUERYREPLY 556
-#define VAR_STREAM_WAIT_SIZE 557
-#define VAR_TLS_CIPHERS 558
-#define VAR_TLS_CIPHERSUITES 559
-#define VAR_TLS_USE_SNI 560
-#define VAR_IPSET 561
-#define VAR_IPSET_NAME_V4 562
-#define VAR_IPSET_NAME_V6 563
-#define VAR_TLS_SESSION_TICKET_KEYS 564
-#define VAR_RPZ 565
-#define VAR_TAGS 566
-#define VAR_RPZ_ACTION_OVERRIDE 567
-#define VAR_RPZ_CNAME_OVERRIDE 568
-#define VAR_RPZ_LOG 569
-#define VAR_RPZ_LOG_NAME 570
-#define VAR_DYNLIB 571
-#define VAR_DYNLIB_FILE 572
-#define VAR_EDNS_CLIENT_STRING 573
-#define VAR_EDNS_CLIENT_STRING_OPCODE 574
-#define VAR_NSID 575
-#define VAR_ZONEMD_PERMISSIVE_MODE 576
-#define VAR_ZONEMD_CHECK 577
-#define VAR_ZONEMD_REJECT_ABSENCE 578
-#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 579
-#define VAR_INTERFACE_AUTOMATIC_PORTS 580
-#define VAR_EDE 581
-#define VAR_INTERFACE_ACTION 582
-#define VAR_INTERFACE_VIEW 583
-#define VAR_INTERFACE_TAG 584
-#define VAR_INTERFACE_TAG_ACTION 585
-#define VAR_INTERFACE_TAG_DATA 586
-#define VAR_PROXY_PROTOCOL_PORT 587
+#define VAR_DO_NAT64 275
+#define VAR_PREFER_IP6 276
+#define VAR_DO_UDP 277
+#define VAR_DO_TCP 278
+#define VAR_TCP_MSS 279
+#define VAR_OUTGOING_TCP_MSS 280
+#define VAR_TCP_IDLE_TIMEOUT 281
+#define VAR_EDNS_TCP_KEEPALIVE 282
+#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 283
+#define VAR_SOCK_QUEUE_TIMEOUT 284
+#define VAR_CHROOT 285
+#define VAR_USERNAME 286
+#define VAR_DIRECTORY 287
+#define VAR_LOGFILE 288
+#define VAR_PIDFILE 289
+#define VAR_MSG_CACHE_SIZE 290
+#define VAR_MSG_CACHE_SLABS 291
+#define VAR_NUM_QUERIES_PER_THREAD 292
+#define VAR_RRSET_CACHE_SIZE 293
+#define VAR_RRSET_CACHE_SLABS 294
+#define VAR_OUTGOING_NUM_TCP 295
+#define VAR_INFRA_HOST_TTL 296
+#define VAR_INFRA_LAME_TTL 297
+#define VAR_INFRA_CACHE_SLABS 298
+#define VAR_INFRA_CACHE_NUMHOSTS 299
+#define VAR_INFRA_CACHE_LAME_SIZE 300
+#define VAR_NAME 301
+#define VAR_STUB_ZONE 302
+#define VAR_STUB_HOST 303
+#define VAR_STUB_ADDR 304
+#define VAR_TARGET_FETCH_POLICY 305
+#define VAR_HARDEN_SHORT_BUFSIZE 306
+#define VAR_HARDEN_LARGE_QUERIES 307
+#define VAR_FORWARD_ZONE 308
+#define VAR_FORWARD_HOST 309
+#define VAR_FORWARD_ADDR 310
+#define VAR_DO_NOT_QUERY_ADDRESS 311
+#define VAR_HIDE_IDENTITY 312
+#define VAR_HIDE_VERSION 313
+#define VAR_IDENTITY 314
+#define VAR_VERSION 315
+#define VAR_HARDEN_GLUE 316
+#define VAR_MODULE_CONF 317
+#define VAR_TRUST_ANCHOR_FILE 318
+#define VAR_TRUST_ANCHOR 319
+#define VAR_VAL_OVERRIDE_DATE 320
+#define VAR_BOGUS_TTL 321
+#define VAR_VAL_CLEAN_ADDITIONAL 322
+#define VAR_VAL_PERMISSIVE_MODE 323
+#define VAR_INCOMING_NUM_TCP 324
+#define VAR_MSG_BUFFER_SIZE 325
+#define VAR_KEY_CACHE_SIZE 326
+#define VAR_KEY_CACHE_SLABS 327
+#define VAR_TRUSTED_KEYS_FILE 328
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 329
+#define VAR_USE_SYSLOG 330
+#define VAR_OUTGOING_INTERFACE 331
+#define VAR_ROOT_HINTS 332
+#define VAR_DO_NOT_QUERY_LOCALHOST 333
+#define VAR_CACHE_MAX_TTL 334
+#define VAR_HARDEN_DNSSEC_STRIPPED 335
+#define VAR_ACCESS_CONTROL 336
+#define VAR_LOCAL_ZONE 337
+#define VAR_LOCAL_DATA 338
+#define VAR_INTERFACE_AUTOMATIC 339
+#define VAR_STATISTICS_INTERVAL 340
+#define VAR_DO_DAEMONIZE 341
+#define VAR_USE_CAPS_FOR_ID 342
+#define VAR_STATISTICS_CUMULATIVE 343
+#define VAR_OUTGOING_PORT_PERMIT 344
+#define VAR_OUTGOING_PORT_AVOID 345
+#define VAR_DLV_ANCHOR_FILE 346
+#define VAR_DLV_ANCHOR 347
+#define VAR_NEG_CACHE_SIZE 348
+#define VAR_HARDEN_REFERRAL_PATH 349
+#define VAR_PRIVATE_ADDRESS 350
+#define VAR_PRIVATE_DOMAIN 351
+#define VAR_REMOTE_CONTROL 352
+#define VAR_CONTROL_ENABLE 353
+#define VAR_CONTROL_INTERFACE 354
+#define VAR_CONTROL_PORT 355
+#define VAR_SERVER_KEY_FILE 356
+#define VAR_SERVER_CERT_FILE 357
+#define VAR_CONTROL_KEY_FILE 358
+#define VAR_CONTROL_CERT_FILE 359
+#define VAR_CONTROL_USE_CERT 360
+#define VAR_TCP_REUSE_TIMEOUT 361
+#define VAR_MAX_REUSE_TCP_QUERIES 362
+#define VAR_EXTENDED_STATISTICS 363
+#define VAR_LOCAL_DATA_PTR 364
+#define VAR_JOSTLE_TIMEOUT 365
+#define VAR_STUB_PRIME 366
+#define VAR_UNWANTED_REPLY_THRESHOLD 367
+#define VAR_LOG_TIME_ASCII 368
+#define VAR_DOMAIN_INSECURE 369
+#define VAR_PYTHON 370
+#define VAR_PYTHON_SCRIPT 371
+#define VAR_VAL_SIG_SKEW_MIN 372
+#define VAR_VAL_SIG_SKEW_MAX 373
+#define VAR_VAL_MAX_RESTART 374
+#define VAR_CACHE_MIN_TTL 375
+#define VAR_VAL_LOG_LEVEL 376
+#define VAR_AUTO_TRUST_ANCHOR_FILE 377
+#define VAR_KEEP_MISSING 378
+#define VAR_ADD_HOLDDOWN 379
+#define VAR_DEL_HOLDDOWN 380
+#define VAR_SO_RCVBUF 381
+#define VAR_EDNS_BUFFER_SIZE 382
+#define VAR_PREFETCH 383
+#define VAR_PREFETCH_KEY 384
+#define VAR_SO_SNDBUF 385
+#define VAR_SO_REUSEPORT 386
+#define VAR_HARDEN_BELOW_NXDOMAIN 387
+#define VAR_IGNORE_CD_FLAG 388
+#define VAR_LOG_QUERIES 389
+#define VAR_LOG_REPLIES 390
+#define VAR_LOG_LOCAL_ACTIONS 391
+#define VAR_TCP_UPSTREAM 392
+#define VAR_SSL_UPSTREAM 393
+#define VAR_TCP_AUTH_QUERY_TIMEOUT 394
+#define VAR_SSL_SERVICE_KEY 395
+#define VAR_SSL_SERVICE_PEM 396
+#define VAR_SSL_PORT 397
+#define VAR_FORWARD_FIRST 398
+#define VAR_STUB_SSL_UPSTREAM 399
+#define VAR_FORWARD_SSL_UPSTREAM 400
+#define VAR_TLS_CERT_BUNDLE 401
+#define VAR_STUB_TCP_UPSTREAM 402
+#define VAR_FORWARD_TCP_UPSTREAM 403
+#define VAR_HTTPS_PORT 404
+#define VAR_HTTP_ENDPOINT 405
+#define VAR_HTTP_MAX_STREAMS 406
+#define VAR_HTTP_QUERY_BUFFER_SIZE 407
+#define VAR_HTTP_RESPONSE_BUFFER_SIZE 408
+#define VAR_HTTP_NODELAY 409
+#define VAR_HTTP_NOTLS_DOWNSTREAM 410
+#define VAR_STUB_FIRST 411
+#define VAR_MINIMAL_RESPONSES 412
+#define VAR_RRSET_ROUNDROBIN 413
+#define VAR_MAX_UDP_SIZE 414
+#define VAR_DELAY_CLOSE 415
+#define VAR_UDP_CONNECT 416
+#define VAR_UNBLOCK_LAN_ZONES 417
+#define VAR_INSECURE_LAN_ZONES 418
+#define VAR_INFRA_CACHE_MIN_RTT 419
+#define VAR_INFRA_CACHE_MAX_RTT 420
+#define VAR_INFRA_KEEP_PROBING 421
+#define VAR_DNS64_PREFIX 422
+#define VAR_DNS64_SYNTHALL 423
+#define VAR_DNS64_IGNORE_AAAA 424
+#define VAR_NAT64_PREFIX 425
+#define VAR_DNSTAP 426
+#define VAR_DNSTAP_ENABLE 427
+#define VAR_DNSTAP_SOCKET_PATH 428
+#define VAR_DNSTAP_IP 429
+#define VAR_DNSTAP_TLS 430
+#define VAR_DNSTAP_TLS_SERVER_NAME 431
+#define VAR_DNSTAP_TLS_CERT_BUNDLE 432
+#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 433
+#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 434
+#define VAR_DNSTAP_SEND_IDENTITY 435
+#define VAR_DNSTAP_SEND_VERSION 436
+#define VAR_DNSTAP_BIDIRECTIONAL 437
+#define VAR_DNSTAP_IDENTITY 438
+#define VAR_DNSTAP_VERSION 439
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 440
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 441
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 442
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 443
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 444
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 445
+#define VAR_RESPONSE_IP_TAG 446
+#define VAR_RESPONSE_IP 447
+#define VAR_RESPONSE_IP_DATA 448
+#define VAR_HARDEN_ALGO_DOWNGRADE 449
+#define VAR_IP_TRANSPARENT 450
+#define VAR_IP_DSCP 451
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 452
+#define VAR_IP_RATELIMIT 453
+#define VAR_IP_RATELIMIT_SLABS 454
+#define VAR_IP_RATELIMIT_SIZE 455
+#define VAR_RATELIMIT 456
+#define VAR_RATELIMIT_SLABS 457
+#define VAR_RATELIMIT_SIZE 458
+#define VAR_OUTBOUND_MSG_RETRY 459
+#define VAR_MAX_SENT_COUNT 460
+#define VAR_MAX_QUERY_RESTARTS 461
+#define VAR_RATELIMIT_FOR_DOMAIN 462
+#define VAR_RATELIMIT_BELOW_DOMAIN 463
+#define VAR_IP_RATELIMIT_FACTOR 464
+#define VAR_RATELIMIT_FACTOR 465
+#define VAR_IP_RATELIMIT_BACKOFF 466
+#define VAR_RATELIMIT_BACKOFF 467
+#define VAR_SEND_CLIENT_SUBNET 468
+#define VAR_CLIENT_SUBNET_ZONE 469
+#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 470
+#define VAR_CLIENT_SUBNET_OPCODE 471
+#define VAR_MAX_CLIENT_SUBNET_IPV4 472
+#define VAR_MAX_CLIENT_SUBNET_IPV6 473
+#define VAR_MIN_CLIENT_SUBNET_IPV4 474
+#define VAR_MIN_CLIENT_SUBNET_IPV6 475
+#define VAR_MAX_ECS_TREE_SIZE_IPV4 476
+#define VAR_MAX_ECS_TREE_SIZE_IPV6 477
+#define VAR_CAPS_WHITELIST 478
+#define VAR_CACHE_MAX_NEGATIVE_TTL 479
+#define VAR_PERMIT_SMALL_HOLDDOWN 480
+#define VAR_QNAME_MINIMISATION 481
+#define VAR_QNAME_MINIMISATION_STRICT 482
+#define VAR_IP_FREEBIND 483
+#define VAR_DEFINE_TAG 484
+#define VAR_LOCAL_ZONE_TAG 485
+#define VAR_ACCESS_CONTROL_TAG 486
+#define VAR_LOCAL_ZONE_OVERRIDE 487
+#define VAR_ACCESS_CONTROL_TAG_ACTION 488
+#define VAR_ACCESS_CONTROL_TAG_DATA 489
+#define VAR_VIEW 490
+#define VAR_ACCESS_CONTROL_VIEW 491
+#define VAR_VIEW_FIRST 492
+#define VAR_SERVE_EXPIRED 493
+#define VAR_SERVE_EXPIRED_TTL 494
+#define VAR_SERVE_EXPIRED_TTL_RESET 495
+#define VAR_SERVE_EXPIRED_REPLY_TTL 496
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 497
+#define VAR_EDE_SERVE_EXPIRED 498
+#define VAR_SERVE_ORIGINAL_TTL 499
+#define VAR_FAKE_DSA 500
+#define VAR_FAKE_SHA1 501
+#define VAR_LOG_IDENTITY 502
+#define VAR_HIDE_TRUSTANCHOR 503
+#define VAR_HIDE_HTTP_USER_AGENT 504
+#define VAR_HTTP_USER_AGENT 505
+#define VAR_TRUST_ANCHOR_SIGNALING 506
+#define VAR_AGGRESSIVE_NSEC 507
+#define VAR_USE_SYSTEMD 508
+#define VAR_SHM_ENABLE 509
+#define VAR_SHM_KEY 510
+#define VAR_ROOT_KEY_SENTINEL 511
+#define VAR_DNSCRYPT 512
+#define VAR_DNSCRYPT_ENABLE 513
+#define VAR_DNSCRYPT_PORT 514
+#define VAR_DNSCRYPT_PROVIDER 515
+#define VAR_DNSCRYPT_SECRET_KEY 516
+#define VAR_DNSCRYPT_PROVIDER_CERT 517
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 518
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 519
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 520
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 521
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 522
+#define VAR_PAD_RESPONSES 523
+#define VAR_PAD_RESPONSES_BLOCK_SIZE 524
+#define VAR_PAD_QUERIES 525
+#define VAR_PAD_QUERIES_BLOCK_SIZE 526
+#define VAR_IPSECMOD_ENABLED 527
+#define VAR_IPSECMOD_HOOK 528
+#define VAR_IPSECMOD_IGNORE_BOGUS 529
+#define VAR_IPSECMOD_MAX_TTL 530
+#define VAR_IPSECMOD_WHITELIST 531
+#define VAR_IPSECMOD_STRICT 532
+#define VAR_CACHEDB 533
+#define VAR_CACHEDB_BACKEND 534
+#define VAR_CACHEDB_SECRETSEED 535
+#define VAR_CACHEDB_REDISHOST 536
+#define VAR_CACHEDB_REDISPORT 537
+#define VAR_CACHEDB_REDISTIMEOUT 538
+#define VAR_CACHEDB_REDISEXPIRERECORDS 539
+#define VAR_CACHEDB_REDISPATH 540
+#define VAR_CACHEDB_REDISPASSWORD 541
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 542
+#define VAR_FOR_UPSTREAM 543
+#define VAR_AUTH_ZONE 544
+#define VAR_ZONEFILE 545
+#define VAR_MASTER 546
+#define VAR_URL 547
+#define VAR_FOR_DOWNSTREAM 548
+#define VAR_FALLBACK_ENABLED 549
+#define VAR_TLS_ADDITIONAL_PORT 550
+#define VAR_LOW_RTT 551
+#define VAR_LOW_RTT_PERMIL 552
+#define VAR_FAST_SERVER_PERMIL 553
+#define VAR_FAST_SERVER_NUM 554
+#define VAR_ALLOW_NOTIFY 555
+#define VAR_TLS_WIN_CERT 556
+#define VAR_TCP_CONNECTION_LIMIT 557
+#define VAR_ANSWER_COOKIE 558
+#define VAR_COOKIE_SECRET 559
+#define VAR_IP_RATELIMIT_COOKIE 560
+#define VAR_FORWARD_NO_CACHE 561
+#define VAR_STUB_NO_CACHE 562
+#define VAR_LOG_SERVFAIL 563
+#define VAR_DENY_ANY 564
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 565
+#define VAR_LOG_TAG_QUERYREPLY 566
+#define VAR_STREAM_WAIT_SIZE 567
+#define VAR_TLS_CIPHERS 568
+#define VAR_TLS_CIPHERSUITES 569
+#define VAR_TLS_USE_SNI 570
+#define VAR_IPSET 571
+#define VAR_IPSET_NAME_V4 572
+#define VAR_IPSET_NAME_V6 573
+#define VAR_TLS_SESSION_TICKET_KEYS 574
+#define VAR_RPZ 575
+#define VAR_TAGS 576
+#define VAR_RPZ_ACTION_OVERRIDE 577
+#define VAR_RPZ_CNAME_OVERRIDE 578
+#define VAR_RPZ_LOG 579
+#define VAR_RPZ_LOG_NAME 580
+#define VAR_DYNLIB 581
+#define VAR_DYNLIB_FILE 582
+#define VAR_EDNS_CLIENT_STRING 583
+#define VAR_EDNS_CLIENT_STRING_OPCODE 584
+#define VAR_NSID 585
+#define VAR_ZONEMD_PERMISSIVE_MODE 586
+#define VAR_ZONEMD_CHECK 587
+#define VAR_ZONEMD_REJECT_ABSENCE 588
+#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 589
+#define VAR_INTERFACE_AUTOMATIC_PORTS 590
+#define VAR_EDE 591
+#define VAR_INTERFACE_ACTION 592
+#define VAR_INTERFACE_VIEW 593
+#define VAR_INTERFACE_TAG 594
+#define VAR_INTERFACE_TAG_ACTION 595
+#define VAR_INTERFACE_TAG_DATA 596
+#define VAR_PROXY_PROTOCOL_PORT 597
+#define VAR_STATISTICS_INHIBIT_ZERO 598
+#define VAR_HARDEN_UNKNOWN_ADDITIONAL 599
 #ifndef YYSTYPE_DEFINED
 #define YYSTYPE_DEFINED
 typedef union {

diff --git a/sbin/unwind/libunbound/util/configparser.y b/sbin/unwind/libunbound/util/configparser.y
index 3ecdad2..d8f25a6 100644 (file)
--- a/sbin/unwind/libunbound/util/configparser.y
+++ b/sbin/unwind/libunbound/util/configparser.y
@@ -47,6 +47,7 @@
 #include "util/configyyrename.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
+#include "sldns/str2wire.h"
 
 int ub_c_lex(void);
 void ub_c_error(const char *message);
@@ -73,9 +74,10 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_FORCE_TOPLEVEL
 %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
 %token VAR_OUTGOING_RANGE VAR_INTERFACE VAR_PREFER_IP4
-%token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP
+%token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_NAT64 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP
 %token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS VAR_TCP_IDLE_TIMEOUT
 %token VAR_EDNS_TCP_KEEPALIVE VAR_EDNS_TCP_KEEPALIVE_TIMEOUT
+%token VAR_SOCK_QUEUE_TIMEOUT
 %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE
 %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD
 %token VAR_RRSET_CACHE_SIZE VAR_RRSET_CACHE_SLABS VAR_OUTGOING_NUM_TCP
@@ -123,6 +125,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_UNBLOCK_LAN_ZONES VAR_INSECURE_LAN_ZONES
 %token VAR_INFRA_CACHE_MIN_RTT VAR_INFRA_CACHE_MAX_RTT VAR_INFRA_KEEP_PROBING
 %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL VAR_DNS64_IGNORE_AAAA
+%token VAR_NAT64_PREFIX
 %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH VAR_DNSTAP_IP
 %token VAR_DNSTAP_TLS VAR_DNSTAP_TLS_SERVER_NAME VAR_DNSTAP_TLS_CERT_BUNDLE
 %token VAR_DNSTAP_TLS_CLIENT_KEY_FILE VAR_DNSTAP_TLS_CLIENT_CERT_FILE
@@ -140,7 +143,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DISABLE_DNSSEC_LAME_CHECK
 %token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE
 %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE
-%token VAR_OUTBOUND_MSG_RETRY
+%token VAR_OUTBOUND_MSG_RETRY VAR_MAX_SENT_COUNT VAR_MAX_QUERY_RESTARTS
 %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN
 %token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR
 %token VAR_IP_RATELIMIT_BACKOFF VAR_RATELIMIT_BACKOFF
@@ -175,12 +178,13 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT
 %token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED
 %token VAR_CACHEDB_REDISHOST VAR_CACHEDB_REDISPORT VAR_CACHEDB_REDISTIMEOUT
-%token VAR_CACHEDB_REDISEXPIRERECORDS
+%token VAR_CACHEDB_REDISEXPIRERECORDS VAR_CACHEDB_REDISPATH VAR_CACHEDB_REDISPASSWORD
 %token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM
 %token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM
 %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL
 %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
 %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
+%token VAR_ANSWER_COOKIE VAR_COOKIE_SECRET VAR_IP_RATELIMIT_COOKIE
 %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
 %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY
 %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI
@@ -193,7 +197,8 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_RPZ_SIGNAL_NXDOMAIN_RA VAR_INTERFACE_AUTOMATIC_PORTS VAR_EDE
 %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
 %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
-%token VAR_PROXY_PROTOCOL_PORT
+%token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO
+%token VAR_HARDEN_UNKNOWN_ADDITIONAL
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -222,10 +227,11 @@ contents_server: contents_server content_server
        | ;
 content_server: server_num_threads | server_verbosity | server_port |
        server_outgoing_range | server_do_ip4 |
-       server_do_ip6 | server_prefer_ip4 | server_prefer_ip6 |
-       server_do_udp | server_do_tcp |
+       server_do_ip6 | server_do_nat64 | server_prefer_ip4 |
+       server_prefer_ip6 | server_do_udp | server_do_tcp |
        server_tcp_mss | server_outgoing_tcp_mss | server_tcp_idle_timeout |
        server_tcp_keepalive | server_tcp_keepalive_timeout |
+       server_sock_queue_timeout |
        server_interface | server_chroot | server_username |
        server_directory | server_logfile | server_pidfile |
        server_msg_cache_size | server_msg_cache_slabs |
@@ -273,6 +279,7 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_so_reuseport | server_delay_close | server_udp_connect |
        server_unblock_lan_zones | server_insecure_lan_zones |
        server_dns64_prefix | server_dns64_synthall | server_dns64_ignore_aaaa |
+       server_nat64_prefix |
        server_infra_cache_min_rtt | server_infra_cache_max_rtt | server_harden_algo_downgrade |
        server_ip_transparent | server_ip_ratelimit | server_ratelimit |
        server_ip_dscp | server_infra_keep_probing |
@@ -282,6 +289,7 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_ratelimit_below_domain | server_ratelimit_factor |
        server_ip_ratelimit_factor | server_ratelimit_backoff |
        server_ip_ratelimit_backoff | server_outbound_msg_retry |
+       server_max_sent_count | server_max_query_restarts |
        server_send_client_subnet | server_client_subnet_zone |
        server_client_subnet_always_forward | server_client_subnet_opcode |
        server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 |
@@ -301,7 +309,7 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_serve_expired |
        server_serve_expired_ttl | server_serve_expired_ttl_reset |
        server_serve_expired_reply_ttl | server_serve_expired_client_timeout |
-       server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa | 
+       server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa |
        server_log_identity | server_use_systemd |
        server_response_ip_tag | server_response_ip | server_response_ip_data |
        server_shm_enable | server_shm_key | server_fake_sha1 |
@@ -317,12 +325,14 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_unknown_server_time_limit | server_log_tag_queryreply |
        server_stream_wait_size | server_tls_ciphers |
        server_tls_ciphersuites | server_tls_session_ticket_keys |
+       server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie |
        server_tls_use_sni | server_edns_client_string |
        server_edns_client_string_opcode | server_nsid |
        server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
        server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
        server_interface_automatic_ports | server_ede |
-       server_proxy_protocol_port
+       server_proxy_protocol_port | server_statistics_inhibit_zero |
+       server_harden_unknown_additional
        ;
 stubstart: VAR_STUB_ZONE
        {
@@ -485,7 +495,7 @@ rpz_signal_nxdomain_ra: VAR_RPZ_SIGNAL_NXDOMAIN_RA STRING_ARG
 rpzstart: VAR_RPZ
        {
                struct config_auth* s;
-               OUTYY(("\nP(rpz:)\n")); 
+               OUTYY(("\nP(rpz:)\n"));
                cfg_parser->started_toplevel = 1;
                s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
                if(s) {
@@ -501,7 +511,7 @@ rpzstart: VAR_RPZ
                }
        }
        ;
-contents_rpz: contents_rpz content_rpz 
+contents_rpz: contents_rpz content_rpz
        | ;
 content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url |
           auth_allow_notify | rpz_action_override | rpz_cname_override |
@@ -554,6 +564,15 @@ server_extended_statistics: VAR_EXTENDED_STATISTICS STRING_ARG
                free($2);
        }
        ;
+server_statistics_inhibit_zero: VAR_STATISTICS_INHIBIT_ZERO STRING_ARG
+       {
+               OUTYY(("P(server_statistics_inhibit_zero:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->stat_inhibit_zero = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_shm_enable: VAR_SHM_ENABLE STRING_ARG
        {
                OUTYY(("P(server_shm_enable:%s)\n", $2));
@@ -840,6 +859,15 @@ server_do_ip6: VAR_DO_IP6 STRING_ARG
                free($2);
        }
        ;
+server_do_nat64: VAR_DO_NAT64 STRING_ARG
+       {
+               OUTYY(("P(server_do_nat64:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->do_nat64 = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_do_udp: VAR_DO_UDP STRING_ARG
        {
                OUTYY(("P(server_do_udp:%s)\n", $2));
@@ -962,6 +990,19 @@ server_tcp_keepalive_timeout: VAR_EDNS_TCP_KEEPALIVE_TIMEOUT STRING_ARG
                free($2);
        }
        ;
+server_sock_queue_timeout: VAR_SOCK_QUEUE_TIMEOUT STRING_ARG
+       {
+               OUTYY(("P(server_sock_queue_timeout:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else if (atoi($2) > 6553500)
+                       cfg_parser->cfg->sock_queue_timeout = 6553500;
+               else if (atoi($2) < 1)
+                       cfg_parser->cfg->sock_queue_timeout = 0;
+               else cfg_parser->cfg->sock_queue_timeout = atoi($2);
+               free($2);
+       }
+       ;
 server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG
        {
                OUTYY(("P(server_tcp_upstream:%s)\n", $2));
@@ -1122,7 +1163,7 @@ server_http_nodelay: VAR_HTTP_NODELAY STRING_ARG
                        yyerror("expected yes or no.");
                else cfg_parser->cfg->http_nodelay = (strcmp($2, "yes")==0);
                free($2);
-       }
+       };
 server_http_notls_downstream: VAR_HTTP_NOTLS_DOWNSTREAM STRING_ARG
        {
                OUTYY(("P(server_http_notls_downstream:%s)\n", $2));
@@ -1768,6 +1809,16 @@ server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
                free($2);
        }
        ;
+server_harden_unknown_additional: VAR_HARDEN_UNKNOWN_ADDITIONAL STRING_ARG
+       {
+               OUTYY(("P(server_harden_unknown_additional:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->harden_unknown_additional =
+                       (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
        {
                OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
@@ -2159,6 +2210,7 @@ server_permit_small_holddown: VAR_PERMIT_SMALL_HOLDDOWN STRING_ARG
                        (strcmp($2, "yes")==0);
                free($2);
        }
+       ;
 server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG
        {
                OUTYY(("P(server_key_cache_size:%s)\n", $2));
@@ -2196,6 +2248,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
                   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
                   && strcmp($3, "typetransparent")!=0
                   && strcmp($3, "always_transparent")!=0
+                  && strcmp($3, "block_a")!=0
                   && strcmp($3, "always_refuse")!=0
                   && strcmp($3, "always_nxdomain")!=0
                   && strcmp($3, "always_nodata")!=0
@@ -2208,7 +2261,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
                        yyerror("local-zone type: expected static, deny, "
                                "refuse, redirect, transparent, "
                                "typetransparent, inform, inform_deny, "
-                               "inform_redirect, always_transparent, "
+                               "inform_redirect, always_transparent, block_a,"
                                "always_refuse, always_nxdomain, "
                                "always_nodata, always_deny, always_null, "
                                "noview, nodefault or ipset");
@@ -2323,6 +2376,13 @@ server_dns64_ignore_aaaa: VAR_DNS64_IGNORE_AAAA STRING_ARG
                        fatal_exit("out of memory adding dns64-ignore-aaaa");
        }
        ;
+server_nat64_prefix: VAR_NAT64_PREFIX STRING_ARG
+       {
+               OUTYY(("P(nat64_prefix:%s)\n", $2));
+               free(cfg_parser->cfg->nat64_prefix);
+               cfg_parser->cfg->nat64_prefix = $2;
+       }
+       ;
 server_define_tag: VAR_DEFINE_TAG STRING_ARG
        {
                char* p, *s = $2;
@@ -2508,6 +2568,15 @@ server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG
                free($2);
        }
        ;
+server_ip_ratelimit_cookie: VAR_IP_RATELIMIT_COOKIE STRING_ARG
+       {
+               OUTYY(("P(server_ip_ratelimit_cookie:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->ip_ratelimit_cookie = atoi($2);
+               free($2);
+       }
+       ;
 server_ratelimit: VAR_RATELIMIT STRING_ARG
        {
                OUTYY(("P(server_ratelimit:%s)\n", $2));
@@ -2636,6 +2705,24 @@ server_outbound_msg_retry: VAR_OUTBOUND_MSG_RETRY STRING_ARG
                free($2);
        }
        ;
+server_max_sent_count: VAR_MAX_SENT_COUNT STRING_ARG
+       {
+               OUTYY(("P(server_max_sent_count:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->max_sent_count = atoi($2);
+               free($2);
+       }
+       ;
+server_max_query_restarts: VAR_MAX_QUERY_RESTARTS STRING_ARG
+       {
+               OUTYY(("P(server_max_query_restarts:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->max_query_restarts = atoi($2);
+               free($2);
+       }
+       ;
 server_low_rtt: VAR_LOW_RTT STRING_ARG
        {
                OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
@@ -2685,7 +2772,7 @@ server_pad_responses: VAR_PAD_RESPONSES STRING_ARG
                OUTYY(("P(server_pad_responses:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->pad_responses = 
+               else cfg_parser->cfg->pad_responses =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -2704,7 +2791,7 @@ server_pad_queries: VAR_PAD_QUERIES STRING_ARG
                OUTYY(("P(server_pad_queries:%s)\n", $2));
                if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
                        yyerror("expected yes or no.");
-               else cfg_parser->cfg->pad_queries = 
+               else cfg_parser->cfg->pad_queries =
                        (strcmp($2, "yes")==0);
                free($2);
        }
@@ -3443,9 +3530,10 @@ py_script: VAR_PYTHON_SCRIPT STRING_ARG
                if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, $2))
                        yyerror("out of memory");
        }
+       ;
 dynlibstart: VAR_DYNLIB
-       { 
-               OUTYY(("\nP(dynlib:)\n")); 
+       {
+               OUTYY(("\nP(dynlib:)\n"));
                cfg_parser->started_toplevel = 1;
        }
        ;
@@ -3459,6 +3547,7 @@ dl_file: VAR_DYNLIB_FILE STRING_ARG
                if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, $2))
                        yyerror("out of memory");
        }
+       ;
 server_disable_dnssec_lame_check: VAR_DISABLE_DNSSEC_LAME_CHECK STRING_ARG
        {
                OUTYY(("P(disable_dnssec_lame_check:%s)\n", $2));
@@ -3519,7 +3608,6 @@ dnsc_dnscrypt_enable: VAR_DNSCRYPT_ENABLE STRING_ARG
                free($2);
        }
        ;
-
 dnsc_dnscrypt_port: VAR_DNSCRYPT_PORT STRING_ARG
        {
                OUTYY(("P(dnsc_dnscrypt_port:%s)\n", $2));
@@ -3613,7 +3701,7 @@ contents_cachedb: contents_cachedb content_cachedb
        | ;
 content_cachedb: cachedb_backend_name | cachedb_secret_seed |
        redis_server_host | redis_server_port | redis_timeout |
-       redis_expire_records
+       redis_expire_records | redis_server_path | redis_server_password
        ;
 cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG
        {
@@ -3666,6 +3754,30 @@ redis_server_port: VAR_CACHEDB_REDISPORT STRING_ARG
                free($2);
        }
        ;
+redis_server_path: VAR_CACHEDB_REDISPATH STRING_ARG
+       {
+       #if defined(USE_CACHEDB) && defined(USE_REDIS)
+               OUTYY(("P(redis_server_path:%s)\n", $2));
+               free(cfg_parser->cfg->redis_server_path);
+               cfg_parser->cfg->redis_server_path = $2;
+       #else
+               OUTYY(("P(Compiled without cachedb or redis, ignoring)\n"));
+               free($2);
+       #endif
+       }
+       ;
+redis_server_password: VAR_CACHEDB_REDISPASSWORD STRING_ARG
+       {
+       #if defined(USE_CACHEDB) && defined(USE_REDIS)
+               OUTYY(("P(redis_server_password:%s)\n", $2));
+               free(cfg_parser->cfg->redis_server_password);
+               cfg_parser->cfg->redis_server_password = $2;
+       #else
+               OUTYY(("P(Compiled without cachedb or redis, ignoring)\n"));
+               free($2);
+       #endif
+       }
+       ;
 redis_timeout: VAR_CACHEDB_REDISTIMEOUT STRING_ARG
        {
        #if defined(USE_CACHEDB) && defined(USE_REDIS)
@@ -3703,6 +3815,31 @@ server_tcp_connection_limit: VAR_TCP_CONNECTION_LIMIT STRING_ARG STRING_ARG
                }
        }
        ;
+server_answer_cookie: VAR_ANSWER_COOKIE STRING_ARG
+       {
+               OUTYY(("P(server_answer_cookie:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->do_answer_cookie = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
+server_cookie_secret: VAR_COOKIE_SECRET STRING_ARG
+       {
+               uint8_t secret[32];
+               size_t secret_len = sizeof(secret);
+
+               OUTYY(("P(server_cookie_secret:%s)\n", $2));
+               if(sldns_str2wire_hex_buf($2, secret, &secret_len)
+               || (secret_len != 16))
+                       yyerror("expected 128 bit hex string");
+               else {
+                       cfg_parser->cfg->cookie_secret_len = secret_len;
+                       memcpy(cfg_parser->cfg->cookie_secret, secret, sizeof(secret));
+               }
+               free($2);
+       }
+       ;
        ipsetstart: VAR_IPSET
                {
                        OUTYY(("\nP(ipset:)\n"));
@@ -3772,10 +3909,11 @@ validate_acl_action(const char* action)
                strcmp(action, "refuse_non_local")!=0 &&
                strcmp(action, "allow_setrd")!=0 &&
                strcmp(action, "allow")!=0 &&
-               strcmp(action, "allow_snoop")!=0)
+               strcmp(action, "allow_snoop")!=0 &&
+               strcmp(action, "allow_cookie")!=0)
        {
                yyerror("expected deny, refuse, deny_non_local, "
-                       "refuse_non_local, allow, allow_setrd or "
-                       "allow_snoop as access control action");
+                       "refuse_non_local, allow, allow_setrd, "
+                       "allow_snoop or allow_cookie as access control action");
        }
 }

diff --git a/sbin/unwind/libunbound/util/data/msgencode.c b/sbin/unwind/libunbound/util/data/msgencode.c
index fe21cfb..a170eb7 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgencode.c
+++ b/sbin/unwind/libunbound/util/data/msgencode.c
@@ -806,6 +806,95 @@ calc_edns_field_size(struct edns_data* edns)
        return 1 + 2 + 2 + 4 + 2 + rdatalen;
 }
 
+uint16_t
+calc_edns_option_size(struct edns_data* edns, uint16_t code)
+{
+       size_t rdatalen = 0;
+       struct edns_option* opt;
+       if(!edns || !edns->edns_present)
+               return 0;
+       for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) {
+               if(opt->opt_code == code)
+                       rdatalen += 4 + opt->opt_len;
+       }
+       for(opt = edns->opt_list_out; opt; opt = opt->next) {
+               if(opt->opt_code == code)
+                       rdatalen += 4 + opt->opt_len;
+       }
+       return rdatalen;
+}
+
+uint16_t
+calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size)
+{
+       size_t rdatalen = 0;
+       struct edns_option* opt;
+       *txt_size = 0;
+       if(!edns || !edns->edns_present)
+               return 0;
+       for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) {
+               if(opt->opt_code == LDNS_EDNS_EDE) {
+                       rdatalen += 4 + opt->opt_len;
+                       if(opt->opt_len > 2) *txt_size += opt->opt_len - 2;
+                       if(opt->opt_len >= 2 && sldns_read_uint16(
+                               opt->opt_data) == LDNS_EDE_OTHER) {
+                               *txt_size += 4 + 2;
+                       }
+               }
+       }
+       for(opt = edns->opt_list_out; opt; opt = opt->next) {
+               if(opt->opt_code == LDNS_EDNS_EDE) {
+                       rdatalen += 4 + opt->opt_len;
+                       if(opt->opt_len > 2) *txt_size += opt->opt_len - 2;
+                       if(opt->opt_len >= 2 && sldns_read_uint16(
+                               opt->opt_data) == LDNS_EDE_OTHER) {
+                               *txt_size += 4 + 2;
+                       }
+               }
+       }
+       return rdatalen;
+}
+
+/* Trims the EDE OPTION-DATA to not include any EXTRA-TEXT data.
+ * Also removes any LDNS_EDE_OTHER options from the list since they are useless
+ * without the extra text. */
+static void
+ede_trim_text(struct edns_option** list)
+{
+       struct edns_option* curr, *prev = NULL;
+       if(!list || !(*list)) return;
+       /* Unlink and repoint if LDNS_EDE_OTHER are first in list */
+       while(list && *list && (*list)->opt_code == LDNS_EDNS_EDE
+               && (*list)->opt_len >= 2
+               && sldns_read_uint16((*list)->opt_data) == LDNS_EDE_OTHER ) {
+               *list = (*list)->next;
+       }
+       if(!list || !(*list)) return;
+       curr = *list;
+       while(curr) {
+               if(curr->opt_code == LDNS_EDNS_EDE) {
+                       if(curr->opt_len >= 2 && sldns_read_uint16(
+                               curr->opt_data) == LDNS_EDE_OTHER) {
+                               /* LDNS_EDE_OTHER cannot be the first option in
+                                * this while, so prev is always initialized at
+                                * this point from the other branches;
+                                * cut this option off */
+                               prev->next = curr->next;
+                               curr = curr->next;
+                       } else if(curr->opt_len > 2) {
+                               /* trim this option's EXTRA-TEXT */
+                               curr->opt_len = 2;
+                               prev = curr;
+                               curr = curr->next;
+                       }
+               } else {
+                       /* continue */
+                       prev = curr;
+                       curr = curr->next;
+               }
+       }
+}
+
 static void
 attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
        uint16_t max_msg_sz)
@@ -894,6 +983,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 {
        uint16_t flags;
        unsigned int attach_edns = 0;
+       uint16_t edns_field_size, ede_size, ede_txt_size;
 
        if(!cached || rep->authoritative) {
                /* original flags, copy RD and CD bits from query. */
@@ -916,25 +1006,39 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
        log_assert(flags & BIT_QR); /* QR bit must be on in our replies */
        if(udpsize < LDNS_HEADER_SIZE)
                return 0;
+       /* currently edns does not change during calculations;
+        * calculate sizes once here */
+       edns_field_size = calc_edns_field_size(edns);
+       ede_size = calc_ede_option_size(edns, &ede_txt_size);
        if(sldns_buffer_capacity(pkt) < udpsize)
                udpsize = sldns_buffer_capacity(pkt);
-       if(udpsize < LDNS_HEADER_SIZE + calc_edns_field_size(edns)) {
+       /* EDEs are optional, try to fit anything else before them */
+       if(udpsize < LDNS_HEADER_SIZE + edns_field_size - ede_size) {
                /* packet too small to contain edns, omit it. */
                attach_edns = 0;
        } else {
                /* reserve space for edns record */
-               attach_edns = (unsigned int)calc_edns_field_size(edns);
-               udpsize -= attach_edns;
+               attach_edns = (unsigned int)edns_field_size - ede_size;
        }
 
        if(!reply_info_encode(qinf, rep, id, flags, pkt, timenow, region,
-               udpsize, dnssec, MINIMAL_RESPONSES)) {
+               udpsize - attach_edns, dnssec, MINIMAL_RESPONSES)) {
                log_err("reply encode: out of memory");
                return 0;
        }
-       if(attach_edns && sldns_buffer_capacity(pkt) >=
-               sldns_buffer_limit(pkt)+attach_edns)
-               attach_edns_record_max_msg_sz(pkt, edns, udpsize+attach_edns);
+       if(attach_edns) {
+               if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size)
+                       attach_edns_record_max_msg_sz(pkt, edns, udpsize);
+               else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_txt_size) {
+                       ede_trim_text(&edns->opt_list_inplace_cb_out);
+                       ede_trim_text(&edns->opt_list_out);
+                       attach_edns_record_max_msg_sz(pkt, edns, udpsize);
+               } else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_size) {
+                       edns_opt_list_remove(&edns->opt_list_inplace_cb_out, LDNS_EDNS_EDE);
+                       edns_opt_list_remove(&edns->opt_list_out, LDNS_EDNS_EDE);
+                       attach_edns_record_max_msg_sz(pkt, edns, udpsize);
+               }
+       }
        return 1;
 }
 
@@ -958,15 +1062,17 @@ qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo)
        sldns_buffer_flip(pkt);
 }
 
-void 
-error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
-       uint16_t qid, uint16_t qflags, struct edns_data* edns)
+void
+extended_error_encode(sldns_buffer* buf, uint16_t rcode,
+       struct query_info* qinfo, uint16_t qid, uint16_t qflags,
+       uint16_t xflags, struct edns_data* edns)
 {
        uint16_t flags;
 
        sldns_buffer_clear(buf);
        sldns_buffer_write(buf, &qid, sizeof(uint16_t));
-       flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/
+       flags = (uint16_t)(BIT_QR | BIT_RA | (rcode & 0xF)); /* QR and retcode*/
+       flags |= xflags;
        flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */
        sldns_buffer_write_u16(buf, flags);
        if(qinfo) flags = 1;
@@ -993,11 +1099,25 @@ error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
                struct edns_data es = *edns;
                es.edns_version = EDNS_ADVERTISED_VERSION;
                es.udp_size = EDNS_ADVERTISED_SIZE;
-               es.ext_rcode = 0;
+               es.ext_rcode = (uint8_t)(rcode >> 4);
                es.bits &= EDNS_DO;
                if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
-                       edns->udp_size)
-                       return;
+                       edns->udp_size) {
+                       edns_opt_list_remove(&es.opt_list_inplace_cb_out, LDNS_EDNS_EDE);
+                       edns_opt_list_remove(&es.opt_list_out, LDNS_EDNS_EDE);
+                       if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
+                               edns->udp_size) {
+                               return;
+                       }
+               }
                attach_edns_record(buf, &es);
        }
 }
+
+void
+error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
+       uint16_t qid, uint16_t qflags, struct edns_data* edns)
+{
+       extended_error_encode(buf, (r & 0x000F), qinfo, qid, qflags,
+               (r & 0xFFF0), edns);
+}

diff --git a/sbin/unwind/libunbound/util/data/msgencode.h b/sbin/unwind/libunbound/util/data/msgencode.h
index 30dc515..6aff060 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgencode.h
+++ b/sbin/unwind/libunbound/util/data/msgencode.h
@@ -108,6 +108,27 @@ void qinfo_query_encode(struct sldns_buffer* pkt, struct query_info* qinfo);
  */
 uint16_t calc_edns_field_size(struct edns_data* edns);
 
+/**
+ * Calculate the size of a specific EDNS option in packet.
+ * @param edns: edns data or NULL.
+ * @param code: the opt code to get the size of.
+ * @return octets the option will take up.
+ */
+uint16_t calc_edns_option_size(struct edns_data* edns, uint16_t code);
+
+/**
+ * Calculate the size of the EDE option(s) in packet. Also calculate seperately
+ * the size of the EXTRA-TEXT field(s) in case we can trim them to fit.
+ * In this case include any LDNS_EDE_OTHER options in their entirety since they
+ * are useless without extra text.
+ * @param edns: edns data or NULL.
+ * @param txt_size: the size of the EXTRA-TEXT field(s); this includes
+ *     LDNS_EDE_OTHER in their entirety since they are useless without
+ *     extra text.
+ * @return octets the option will take up.
+ */
+uint16_t calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size);
+
 /**
  * Attach EDNS record to buffer. Buffer has complete packet. There must
  * be enough room left for the EDNS record.
@@ -116,11 +137,11 @@ uint16_t calc_edns_field_size(struct edns_data* edns);
  */
 void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns);
 
-/** 
+/**
  * Encode an error. With QR and RA set.
  *
  * @param pkt: where to store the packet.
- * @param r: RCODE value to encode.
+ * @param r: RCODE value to encode (may contain extra flags).
  * @param qinfo: if not NULL, the query is included.
  * @param qid: query ID to set in packet. network order.
  * @param qflags: original query flags (to copy RD and CD bits). host order.
@@ -130,4 +151,21 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns);
 void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
        uint16_t qid, uint16_t qflags, struct edns_data* edns);
 
+/**
+ * Encode an extended error. With QR and RA set.
+ *
+ * @param pkt: where to store the packet.
+ * @param rcode: Extended RCODE value to encode.
+ * @param qinfo: if not NULL, the query is included.
+ * @param qid: query ID to set in packet. network order.
+ * @param qflags: original query flags (to copy RD and CD bits). host order.
+ * @param xflags: extra flags to set (such as for example BIT_AA and/or BIT_TC)
+ * @param edns: if not NULL, this is the query edns info,
+ *     and an edns reply is attached. Only attached if EDNS record fits reply.
+ *     Without edns extended errors (i.e. > 15) will not be conveyed.
+ */
+void extended_error_encode(struct sldns_buffer* pkt, uint16_t rcode,
+       struct query_info* qinfo, uint16_t qid, uint16_t qflags,
+       uint16_t xflags, struct edns_data* edns);
+
 #endif /* UTIL_DATA_MSGENCODE_H */

diff --git a/sbin/unwind/libunbound/util/data/msgparse.c b/sbin/unwind/libunbound/util/data/msgparse.c
index 5bb69d6..b5414c6 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgparse.c
+++ b/sbin/unwind/libunbound/util/data/msgparse.c
@@ -45,6 +45,8 @@
 #include "util/netevent.h"
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
+#include "util/rfc_1982.h"
+#include "util/edns.h"
 #include "sldns/rrdef.h"
 #include "sldns/sbuffer.h"
 #include "sldns/parseutil.h"
@@ -940,22 +942,11 @@ parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region)
        return 0;
 }
 
-static int
-edns_opt_list_append_keepalive(struct edns_option** list, int msec,
-               struct regional* region)
-{
-       uint8_t data[2]; /* For keepalive value */
-       data[0] = (uint8_t)((msec >> 8) & 0xff);
-       data[1] = (uint8_t)(msec & 0xff);
-       return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data),
-                       data, region);
-}
-
 /** parse EDNS options from EDNS wireformat rdata */
 static int
 parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
        struct edns_data* edns, struct config_file* cfg, struct comm_point* c,
-       struct regional* region)
+       struct comm_reply* repinfo, uint32_t now, struct regional* region)
 {
        /* To respond with a Keepalive option, the client connection must have
         * received one message with a TCP Keepalive EDNS option, and that
@@ -979,6 +970,10 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
        while(rdata_len >= 4) {
                uint16_t opt_code = sldns_read_uint16(rdata_ptr);
                uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+               uint8_t server_cookie[40];
+               enum edns_cookie_val_status cookie_val_status;
+               int cookie_is_v4 = 1;
+
                rdata_ptr += 4;
                rdata_len -= 4;
                if(opt_len > rdata_len)
@@ -1041,6 +1036,76 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
                        edns->padding_block_size = cfg->pad_responses_block_size;
                        break;
 
+               case LDNS_EDNS_COOKIE:
+                       if(!cfg || !cfg->do_answer_cookie || !repinfo)
+                               break;
+                       if(opt_len != 8 && (opt_len < 16 || opt_len > 40)) {
+                               verbose(VERB_ALGO, "worker request: "
+                                       "badly formatted cookie");
+                               return LDNS_RCODE_FORMERR;
+                       }
+                       edns->cookie_present = 1;
+
+                       /* Copy client cookie, version and timestamp for
+                        * validation and creation purposes.
+                        */
+                       if(opt_len >= 16) {
+                               memmove(server_cookie, rdata_ptr, 16);
+                       } else {
+                               memset(server_cookie, 0, 16);
+                               memmove(server_cookie, rdata_ptr, opt_len);
+                       }
+
+                       /* Copy client ip for validation and creation
+                        * purposes. It will be overwritten if (re)creation
+                        * is needed.
+                        */
+                       if(repinfo->remote_addr.ss_family == AF_INET) {
+                               memcpy(server_cookie + 16,
+                                       &((struct sockaddr_in*)&repinfo->remote_addr)->sin_addr, 4);
+                       } else {
+                               cookie_is_v4 = 0;
+                               memcpy(server_cookie + 16,
+                                       &((struct sockaddr_in6*)&repinfo->remote_addr)->sin6_addr, 16);
+                       }
+
+                       cookie_val_status = edns_cookie_server_validate(
+                               rdata_ptr, opt_len, cfg->cookie_secret,
+                               cfg->cookie_secret_len, cookie_is_v4,
+                               server_cookie, now);
+                       switch(cookie_val_status) {
+                       case COOKIE_STATUS_VALID:
+                       case COOKIE_STATUS_VALID_RENEW:
+                               edns->cookie_valid = 1;
+                               /* Reuse cookie */
+                               if(!edns_opt_list_append(
+                                       &edns->opt_list_out, LDNS_EDNS_COOKIE,
+                                       opt_len, rdata_ptr, region)) {
+                                       log_err("out of memory");
+                                       return LDNS_RCODE_SERVFAIL;
+                               }
+                               /* Cookie to be reused added to outgoing
+                                * options. Done!
+                                */
+                               break;
+                       case COOKIE_STATUS_CLIENT_ONLY:
+                               edns->cookie_client = 1;
+                               /* fallthrough */
+                       case COOKIE_STATUS_FUTURE:
+                       case COOKIE_STATUS_EXPIRED:
+                       case COOKIE_STATUS_INVALID:
+                       default:
+                               edns_cookie_server_write(server_cookie,
+                                       cfg->cookie_secret, cookie_is_v4, now);
+                               if(!edns_opt_list_append(&edns->opt_list_out,
+                                       LDNS_EDNS_COOKIE, 24, server_cookie,
+                                       region)) {
+                                       log_err("out of memory");
+                                       return LDNS_RCODE_SERVFAIL;
+                               }
+                               break;
+                       }
+                       break;
                default:
                        break;
                }
@@ -1115,6 +1180,8 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
        edns->opt_list_out = NULL;
        edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
+       edns->cookie_present = 0;
+       edns->cookie_valid = 0;
 
        /* take the options */
        rdata_len = found->rr_first->size-2;
@@ -1170,7 +1237,8 @@ skip_pkt_rrs(sldns_buffer* pkt, int num)
 
 int 
 parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
-       struct config_file* cfg, struct comm_point* c, struct regional* region)
+       struct config_file* cfg, struct comm_point* c,
+       struct comm_reply* repinfo, time_t now, struct regional* region)
 {
        size_t rdata_len;
        uint8_t* rdata_ptr;
@@ -1206,6 +1274,8 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
        edns->opt_list_out = NULL;
        edns->opt_list_inplace_cb_out = NULL;
        edns->padding_block_size = 0;
+       edns->cookie_present = 0;
+       edns->cookie_valid = 0;
 
        /* take the options */
        rdata_len = sldns_buffer_read_u16(pkt);
@@ -1214,7 +1284,7 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
        rdata_ptr = sldns_buffer_current(pkt);
        /* ignore rrsigs */
        return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg,
-                       c, region);
+               c, repinfo, now, region);
 }
 
 void

diff --git a/sbin/unwind/libunbound/util/data/msgparse.h b/sbin/unwind/libunbound/util/data/msgparse.h
index 0c458e6..b7dc235 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgparse.h
+++ b/sbin/unwind/libunbound/util/data/msgparse.h
@@ -72,6 +72,7 @@ struct regional;
 struct edns_option;
 struct config_file;
 struct comm_point;
+struct comm_reply;
 
 /** number of buckets in parse rrset hash table. Must be power of 2. */
 #define PARSE_TABLE_SIZE 32
@@ -217,8 +218,6 @@ struct rr_parse {
  * region.
  */
 struct edns_data {
-       /** if EDNS OPT record was present */
-       int edns_present;
        /** Extended RCODE */
        uint8_t ext_rcode;
        /** The EDNS version number */
@@ -238,7 +237,15 @@ struct edns_data {
        struct edns_option* opt_list_inplace_cb_out;
        /** block size to pad */
        uint16_t padding_block_size;
-};
+       /** if EDNS OPT record was present */
+       unsigned int edns_present   : 1;
+       /** if a cookie was present */
+       unsigned int cookie_present : 1;
+       /** if the cookie validated */
+       unsigned int cookie_valid   : 1;
+       /** if the cookie holds only the client part */
+       unsigned int cookie_client  : 1;
+};     
 
 /**
  * EDNS option
@@ -310,12 +317,15 @@ int skip_pkt_rrs(struct sldns_buffer* pkt, int num);
  *     initialised.
  * @param cfg: the configuration (with nsid value etc.)
  * @param c: commpoint to determine transport (if needed)
+ * @param repinfo: commreply to determine the client address
+ * @param now: current time
  * @param region: region to alloc results in (edns option contents)
  * @return: 0 on success, or an RCODE on error.
  *     RCODE formerr if OPT is badly formatted and so on.
  */
 int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns,
-       struct config_file* cfg, struct comm_point* c, struct regional* region);
+       struct config_file* cfg, struct comm_point* c,
+       struct comm_reply* repinfo, time_t now, struct regional* region);
 
 /**
  * Calculate hash value for rrset in packet.

diff --git a/sbin/unwind/libunbound/util/data/msgreply.c b/sbin/unwind/libunbound/util/data/msgreply.c
index 1e6ee97..920a0a9 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgreply.c
+++ b/sbin/unwind/libunbound/util/data/msgreply.c
@@ -94,7 +94,7 @@ parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg,
 struct reply_info*
 construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
        time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
-       size_t ar, size_t total, enum sec_status sec)
+       size_t ar, size_t total, enum sec_status sec, sldns_ede_code reason_bogus)
 {
        struct reply_info* rep;
        /* rrset_count-1 because the first ref is part of the struct. */
@@ -117,7 +117,9 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
        rep->ar_numrrsets = ar;
        rep->rrset_count = total;
        rep->security = sec;
-       rep->reason_bogus = LDNS_EDE_NONE;
+       rep->reason_bogus = reason_bogus;
+       /* this is only allocated and used for caching on copy */
+       rep->reason_bogus_str = NULL;
        rep->authoritative = 0;
        /* array starts after the refs */
        if(region)
@@ -137,7 +139,7 @@ parse_create_repinfo(struct msg_parse* msg, struct reply_info** rep,
 {
        *rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0, 
                0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets, 
-               msg->rrset_count, sec_status_unchecked);
+               msg->rrset_count, sec_status_unchecked, LDNS_EDE_NONE);
        if(!*rep)
                return 0;
        return 1;
@@ -182,7 +184,7 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region,
        new_rep = construct_reply_info_base(region, rep->flags,
                rep->qdcount, rep->ttl, rep->prefetch_ttl,
                rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
-               sec_status_insecure);
+               sec_status_insecure, LDNS_EDE_NONE);
        if(!new_rep)
                return NULL;
        if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
@@ -580,6 +582,10 @@ reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc)
        for(i=0; i<rep->rrset_count; i++) {
                ub_packed_rrset_parsedelete(rep->rrsets[i], alloc);
        }
+       if(rep->reason_bogus_str) {
+               free(rep->reason_bogus_str);
+               rep->reason_bogus_str = NULL;
+       }
        free(rep);
 }
 
@@ -661,6 +667,10 @@ void
 reply_info_delete(void* d, void* ATTR_UNUSED(arg))
 {
        struct reply_info* r = (struct reply_info*)d;
+       if(r->reason_bogus_str) {
+               free(r->reason_bogus_str);
+               r->reason_bogus_str = NULL;
+       }
        free(r);
 }
 
@@ -737,17 +747,36 @@ repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
        return 1;
 }
 
-struct reply_info* 
-reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc, 
+struct reply_info*
+reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc,
        struct regional* region)
 {
        struct reply_info* cp;
-       cp = construct_reply_info_base(region, rep->flags, rep->qdcount, 
-               rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, 
+       cp = construct_reply_info_base(region, rep->flags, rep->qdcount,
+               rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
                rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
-               rep->rrset_count, rep->security);
+               rep->rrset_count, rep->security, rep->reason_bogus);
        if(!cp)
                return NULL;
+
+       if(rep->reason_bogus_str && *rep->reason_bogus_str != 0) {
+               if(region) {
+                       cp->reason_bogus_str = (char*)regional_alloc(region,
+                               sizeof(char)
+                               * (strlen(rep->reason_bogus_str)+1));
+               } else {
+                       cp->reason_bogus_str = malloc(sizeof(char)
+                               * (strlen(rep->reason_bogus_str)+1));
+               }
+               if(!cp->reason_bogus_str) {
+                       if(!region)
+                               reply_info_parsedelete(cp, alloc);
+                       return NULL;
+               }
+               memcpy(cp->reason_bogus_str, rep->reason_bogus_str,
+                       strlen(rep->reason_bogus_str)+1);
+       }
+
        /* allocate ub_key structures special or not */
        if(!reply_info_alloc_rrset_keys(cp, alloc, region)) {
                if(!region)
@@ -1020,6 +1049,16 @@ int edns_opt_list_append_ede(struct edns_option** list, struct regional* region,
        return 1;
 }
 
+int edns_opt_list_append_keepalive(struct edns_option** list, int msec,
+       struct regional* region)
+{
+       uint8_t data[2]; /* For keepalive value */
+       data[0] = (uint8_t)((msec >> 8) & 0xff);
+       data[1] = (uint8_t)(msec & 0xff);
+       return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data),
+               data, region);
+}
+
 int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        uint8_t* data, struct regional* region)
 {
@@ -1195,7 +1234,7 @@ int inplace_cb_query_response_call(struct module_env* env,
 }
 
 struct edns_option* edns_opt_copy_region(struct edns_option* list,
-        struct regional* region)
+       struct regional* region)
 {
        struct edns_option* result = NULL, *cur = NULL, *s;
        while(list) {
@@ -1224,6 +1263,42 @@ struct edns_option* edns_opt_copy_region(struct edns_option* list,
        return result;
 }
 
+struct edns_option* edns_opt_copy_filter_region(struct edns_option* list,
+       uint16_t* filter_list, size_t filter_list_len, struct regional* region)
+{
+       struct edns_option* result = NULL, *cur = NULL, *s;
+       size_t i;
+       while(list) {
+               for(i=0; i<filter_list_len; i++)
+                       if(filter_list[i] == list->opt_code) goto found;
+               if(i == filter_list_len) goto next;
+found:
+               /* copy edns option structure */
+               s = regional_alloc_init(region, list, sizeof(*list));
+               if(!s) return NULL;
+               s->next = NULL;
+
+               /* copy option data */
+               if(s->opt_data) {
+                       s->opt_data = regional_alloc_init(region, s->opt_data,
+                               s->opt_len);
+                       if(!s->opt_data)
+                               return NULL;
+               }
+
+               /* link into list */
+               if(cur)
+                       cur->next = s;
+               else    result = s;
+               cur = s;
+
+next:
+               /* examine next element */
+               list = list->next;
+       }
+       return result;
+}
+
 int edns_opt_compare(struct edns_option* p, struct edns_option* q)
 {
        if(!p && !q) return 0;

diff --git a/sbin/unwind/libunbound/util/data/msgreply.h b/sbin/unwind/libunbound/util/data/msgreply.h
index 9538adc..a9af3d7 100644 (file)
--- a/sbin/unwind/libunbound/util/data/msgreply.h
+++ b/sbin/unwind/libunbound/util/data/msgreply.h
@@ -170,9 +170,17 @@ struct reply_info {
 
        /**
         * EDE (rfc8914) code with reason for DNSSEC bogus status.
+        * Used for caching the EDE.
         */
        sldns_ede_code reason_bogus;
 
+        /**
+         * EDE (rfc8914) NULL-terminated string with human-readable reason
+        * for DNSSEC bogus status.
+        * Used for caching the EDE.
+         */
+        char* reason_bogus_str;
+
        /**
         * Number of RRsets in each section.
         * The answer section. Add up the RRs in every RRset to calculate
@@ -240,13 +248,15 @@ struct msgreply_entry {
  * @param ar: ar count
  * @param total: total rrset count (presumably an+ns+ar).
  * @param sec: security status of the reply info.
+ * @param reason_bogus: the Extended DNS Error for DNSSEC bogus status
  * @return the reply_info base struct with the array for putting the rrsets
  * in.  The array has been zeroed.  Returns NULL on malloc failure.
  */
 struct reply_info*
 construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
-               time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
-               size_t ar, size_t total, enum sec_status sec);
+       time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
+       size_t ar, size_t total, enum sec_status sec,
+       sldns_ede_code reason_bogus);
 
 /** 
  * Parse wire query into a queryinfo structure, return 0 on parse error. 
@@ -567,6 +577,16 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
 int edns_opt_list_append_ede(struct edns_option** list, struct regional* region,
        sldns_ede_code code, const char *txt);
 
+/**
+ * Append edns keep alive option to edns options list
+ * @param list: the edns option list to append the edns option to.
+ * @param msec: the duration in msecs for the keep alive.
+ * @param region: region to allocate the new edns option.
+ * @return false on failure.
+ */
+int edns_opt_list_append_keepalive(struct edns_option** list, int msec,
+       struct regional* region);
+
 /**
  * Remove any option found on the edns option list that matches the code.
  * @param list: the list of edns options.
@@ -718,6 +738,12 @@ int inplace_cb_query_response_call(struct module_env* env,
 struct edns_option* edns_opt_copy_region(struct edns_option* list,
        struct regional* region);
 
+/**
+ * Copy a filtered edns option list allocated to the new region
+ */
+struct edns_option* edns_opt_copy_filter_region(struct edns_option* list,
+       uint16_t* filter_list, size_t filter_list_len, struct regional* region);
+
 /**
  * Copy edns option list allocated with malloc
  */

diff --git a/sbin/unwind/libunbound/util/edns.c b/sbin/unwind/libunbound/util/edns.c
index f55dcb9..2b4047f 100644 (file)
--- a/sbin/unwind/libunbound/util/edns.c
+++ b/sbin/unwind/libunbound/util/edns.c
@@ -45,8 +45,11 @@
 #include "util/netevent.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/rfc_1982.h"
+#include "util/siphash.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
+#include "sldns/sbuffer.h"
 
 struct edns_strings* edns_strings_create(void)
 {
@@ -128,3 +131,59 @@ edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
        return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen);
 }
 
+uint8_t*
+edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, int v4,
+       uint8_t* hash)
+{
+       v4?siphash(in, 20, secret, hash, 8):siphash(in, 32, secret, hash, 8);
+       return hash;
+}
+
+void
+edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4,
+       uint32_t timestamp)
+{
+       uint8_t hash[8];
+       buf[ 8] = 1;   /* Version */
+       buf[ 9] = 0;   /* Reserved */
+       buf[10] = 0;   /* Reserved */
+       buf[11] = 0;   /* Reserved */
+       sldns_write_uint32(buf + 12, timestamp);
+       (void)edns_cookie_server_hash(buf, secret, v4, hash);
+       memcpy(buf + 16, hash, 8);
+}
+
+enum edns_cookie_val_status
+edns_cookie_server_validate(const uint8_t* cookie, size_t cookie_len,
+       const uint8_t* secret, size_t secret_len, int v4,
+       const uint8_t* hash_input, uint32_t now)
+{
+       uint8_t hash[8];
+       uint32_t timestamp;
+       uint32_t subt_1982 = 0; /* Initialize for the compiler; unused value */
+       int comp_1982;
+       if(cookie_len != 24)
+               /* RFC9018 cookies are 24 bytes long */
+               return COOKIE_STATUS_CLIENT_ONLY;
+       if(secret_len != 16 ||  /* RFC9018 cookies have 16 byte secrets */
+               cookie[8] != 1) /* RFC9018 cookies are cookie version 1 */
+               return COOKIE_STATUS_INVALID;
+       timestamp = sldns_read_uint32(cookie + 12);
+       if((comp_1982 = compare_1982(now, timestamp)) > 0
+               && (subt_1982 = subtract_1982(timestamp, now)) > 3600)
+               /* Cookie is older than 1 hour (see RFC9018 Section 4.3.) */
+               return COOKIE_STATUS_EXPIRED;
+       if(comp_1982 <= 0 && subtract_1982(now, timestamp) > 300)
+               /* Cookie time is more than 5 minutes in the future.
+                * (see RFC9018 Section 4.3.) */
+               return COOKIE_STATUS_FUTURE;
+       if(memcmp(edns_cookie_server_hash(hash_input, secret, v4, hash),
+               cookie + 16, 8) != 0)
+               /* Hashes do not match */
+               return COOKIE_STATUS_INVALID;
+       if(comp_1982 > 0 && subt_1982 > 1800)
+               /* Valid cookie but older than 30 minutes, so create a new one
+                * anyway */
+               return COOKIE_STATUS_VALID_RENEW;
+       return COOKIE_STATUS_VALID;
+}

diff --git a/sbin/unwind/libunbound/util/edns.h b/sbin/unwind/libunbound/util/edns.h
index d9ded0b..5da0ecb 100644 (file)
--- a/sbin/unwind/libunbound/util/edns.h
+++ b/sbin/unwind/libunbound/util/edns.h
@@ -75,6 +75,15 @@ struct edns_string_addr {
        size_t string_len;
 };
 
+enum edns_cookie_val_status {
+       COOKIE_STATUS_CLIENT_ONLY = -3,
+       COOKIE_STATUS_FUTURE = -2,
+       COOKIE_STATUS_EXPIRED = -1,
+       COOKIE_STATUS_INVALID = 0,
+       COOKIE_STATUS_VALID = 1,
+       COOKIE_STATUS_VALID_RENEW = 2,
+};
+
 /**
  * Create structure to hold EDNS strings
  * @return: newly created edns_strings, NULL on alloc failure.
@@ -106,4 +115,54 @@ struct edns_string_addr*
 edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
        socklen_t addrlen);
 
+/**
+ * Compute the interoperable DNS cookie (RFC9018) hash.
+ * @param in: buffer input for the hash generation. It needs to be:
+ *     Client Cookie | Version | Reserved | Timestamp | Client-IP
+ * @param secret: the server secret; implicit length of 16 octets.
+ * @param v4: if the client IP is v4 or v6.
+ * @param hash: buffer to write the hash to.
+ * return a pointer to the hash.
+ */
+uint8_t* edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret,
+       int v4, uint8_t* hash);
+
+/**
+ * Write an interoperable DNS server cookie (RFC9018).
+ * @param buf: buffer to write to. It should have a size of at least 32 octets
+ *     as it doubles as the output buffer and the hash input buffer.
+ *     The first 8 octets are expected to be the Client Cookie and will be
+ *             left untouched.
+ *     The next 8 octets will be written with Version | Reserved | Timestamp.
+ *     The next 4 or 16 octets are expected to be the IPv4 or the IPv6 address
+ *             based on the v4 flag.
+ *     Thus the first 20 or 32 octets, based on the v4 flag, will be used as
+ *             the hash input.
+ *     The server hash (8 octets) will be written after the first 16 octets;
+ *             overwriting the address information.
+ *     The caller expects a complete, 24 octet long cookie in the buffer.
+ * @param secret: the server secret; implicit length of 16 octets.
+ * @param v4: if the client IP is v4 or v6.
+ * @param timestamp: the timestamp to use.
+ */
+void edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4,
+       uint32_t timestamp);
+
+/**
+ * Validate an interoperable DNS cookie (RFC9018).
+ * @param cookie: pointer to the cookie data.
+ * @param cookie_len: the length of the cookie data.
+ * @param secret: pointer to the server secret.
+ * @param secret_len: the length of the secret.
+ * @param v4: if the client IP is v4 or v6.
+ * @param hash_input: pointer to the hash input for validation. It needs to be:
+ *     Client Cookie | Version | Reserved | Timestamp | Client-IP
+ * @param now: the current time.
+ * return edns_cookie_val_status with the cookie validation status i.e.,
+ *     <=0 for invalid, else valid.
+ */
+enum edns_cookie_val_status edns_cookie_server_validate(const uint8_t* cookie,
+       size_t cookie_len, const uint8_t* secret, size_t secret_len, int v4,
+       const uint8_t* hash_input, uint32_t now);
+
 #endif

diff --git a/sbin/unwind/libunbound/util/fptr_wlist.c b/sbin/unwind/libunbound/util/fptr_wlist.c
index dc8ab66..3b88da2 100644 (file)
--- a/sbin/unwind/libunbound/util/fptr_wlist.c
+++ b/sbin/unwind/libunbound/util/fptr_wlist.c
@@ -659,6 +659,10 @@ int fptr_whitelist_inplace_cb_edns_back_parsed(
 #else
        (void)fptr;
 #endif
+#ifdef WITH_PYTHONMODULE
+    if(fptr == &python_inplace_cb_edns_back_parsed_call)
+        return 1;
+#endif
 #ifdef WITH_DYNLIBMODULE
     if(fptr == &dynlib_inplace_cb_edns_back_parsed)
             return 1;
@@ -675,6 +679,10 @@ int fptr_whitelist_inplace_cb_query_response(
 #else
        (void)fptr;
 #endif
+#ifdef WITH_PYTHONMODULE
+    if(fptr == &python_inplace_cb_query_response)
+        return 1;
+#endif
 #ifdef WITH_DYNLIBMODULE
     if(fptr == &dynlib_inplace_cb_query_response)
             return 1;

diff --git a/sbin/unwind/libunbound/util/iana_ports.inc b/sbin/unwind/libunbound/util/iana_ports.inc
index 80a8144..5cb127e 100644 (file)
--- a/sbin/unwind/libunbound/util/iana_ports.inc
+++ b/sbin/unwind/libunbound/util/iana_ports.inc
@@ -674,6 +674,8 @@
 911,
 912,
 913,
+914,
+915,
 989,
 990,
 991,
@@ -1901,6 +1903,7 @@
 2256,
 2257,
 2258,
+2259,
 2260,
 2261,
 2262,
@@ -2010,6 +2013,7 @@
 2366,
 2367,
 2368,
+2369,
 2370,
 2372,
 2378,
@@ -4840,6 +4844,7 @@
 8403,
 8416,
 8417,
+8433,
 8442,
 8443,
 8444,

diff --git a/sbin/unwind/libunbound/util/module.c b/sbin/unwind/libunbound/util/module.c
index 6698f94..773dab8 100644 (file)
--- a/sbin/unwind/libunbound/util/module.c
+++ b/sbin/unwind/libunbound/util/module.c
@@ -84,8 +84,10 @@ void errinf_ede(struct module_qstate* qstate,
        const char* str, sldns_ede_code reason_bogus)
 {
        struct errinf_strlist* p;
-       if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) || !str)
+       if(!str || (qstate->env->cfg->val_log_level < 2 &&
+               !qstate->env->cfg->log_servfail)) {
                return;
+       }
        p = (struct errinf_strlist*)regional_alloc(qstate->region, sizeof(*p));
        if(!p) {
                log_err("malloc failure in validator-error-info string");
@@ -152,15 +154,19 @@ char* errinf_to_str_bogus(struct module_qstate* qstate)
        return p;
 }
 
+/* Try to find the latest (most specific) dnssec failure */
 sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate)
 {
        struct errinf_strlist* s;
+       sldns_ede_code ede = LDNS_EDE_NONE;
        for(s=qstate->errinf; s; s=s->next) {
-               if (s->reason_bogus != LDNS_EDE_NONE) {
-                       return s->reason_bogus;
-               }
+               if(s->reason_bogus == LDNS_EDE_NONE) continue;
+               if(ede != LDNS_EDE_NONE
+                       && ede != LDNS_EDE_DNSSEC_BOGUS
+                       && s->reason_bogus == LDNS_EDE_DNSSEC_BOGUS) continue;
+               ede = s->reason_bogus;
        }
-       return LDNS_EDE_NONE;
+       return ede;
 }
 
 char* errinf_to_str_servfail(struct module_qstate* qstate)

diff --git a/sbin/unwind/libunbound/util/module.h b/sbin/unwind/libunbound/util/module.h
index 013c65b..5b6fcc9 100644 (file)
--- a/sbin/unwind/libunbound/util/module.h
+++ b/sbin/unwind/libunbound/util/module.h
@@ -619,6 +619,12 @@ struct module_qstate {
        /** if this is a validation recursion query that does not get
         * validation itself */
        int is_valrec;
+#ifdef CLIENT_SUBNET
+       /** the client network address is needed for the client-subnet option
+        *  when prefetching, but we can't use reply_list in mesh_info, because
+        *  we don't want to send a reply for the internal query. */
+        struct sockaddr_storage client_addr;
+#endif
 
        /** comm_reply contains server replies */
        struct comm_reply* reply;
@@ -671,6 +677,8 @@ struct module_qstate {
         * those servers. By comparing expiry time with qstarttime for type NS.
         */
        time_t qstarttime;
+       /** whether a message from cachedb will be used for the reply */
+       int is_cachedb_answer;
 
        /**
         * Attributes of clients that share the qstate that may affect IP-based
@@ -818,11 +826,11 @@ void errinf_dname(struct module_qstate* qstate, const char* str,
  *    This string is malloced and has to be freed by caller.
  */
 char* errinf_to_str_bogus(struct module_qstate* qstate);
+
 /**
- * Check the sldns_ede_code of the qstate.
+ * Check the sldns_ede_code of the qstate->errinf.
  * @param qstate: query state.
- * @return LDNS_EDE_DNSSEC_BOGUS by default, or the first explicitly set
- *   sldns_ede_code.
+ * @return the latest explicitly set sldns_ede_code or LDNS_EDE_NONE.
  */
 sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate);
 

diff --git a/sbin/unwind/libunbound/util/net_help.c b/sbin/unwind/libunbound/util/net_help.c
index 54fad69..e559c9b 100644 (file)
--- a/sbin/unwind/libunbound/util/net_help.c
+++ b/sbin/unwind/libunbound/util/net_help.c
@@ -779,8 +779,8 @@ addr_in_common(struct sockaddr_storage* addr1, int net1,
        return match;
 }
 
-void 
-addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, 
+void
+addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
        char* buf, size_t len)
 {
        int af = (int)((struct sockaddr_in*)addr)->sin_family;
@@ -792,7 +792,50 @@ addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
        }
 }
 
-int 
+int
+prefixnet_is_nat64(int prefixnet)
+{
+       return (prefixnet == 32 || prefixnet == 40 ||
+               prefixnet == 48 || prefixnet == 56 ||
+               prefixnet == 64 || prefixnet == 96);
+}
+
+void
+addr_to_nat64(const struct sockaddr_storage* addr,
+       const struct sockaddr_storage* nat64_prefix,
+       socklen_t nat64_prefixlen, int nat64_prefixnet,
+       struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen)
+{
+       struct sockaddr_in *sin = (struct sockaddr_in *)addr;
+       struct sockaddr_in6 *sin6;
+       uint8_t *v4_byte;
+
+       /* This needs to be checked by the caller */
+       log_assert(addr->ss_family == AF_INET);
+       /* Current usage is only from config values; prefix lengths enforced
+        * during config validation */
+       log_assert(prefixnet_is_nat64(nat64_prefixnet));
+
+       *nat64_addr = *nat64_prefix;
+       *nat64_addrlen = nat64_prefixlen;
+
+       sin6 = (struct sockaddr_in6 *)nat64_addr;
+       sin6->sin6_flowinfo = 0;
+       sin6->sin6_port = sin->sin_port;
+
+       nat64_prefixnet = nat64_prefixnet / 8;
+
+       v4_byte = (uint8_t *)&sin->sin_addr.s_addr;
+       for(int i = 0; i < 4; i++) {
+               if(nat64_prefixnet == 8) {
+                       /* bits 64...71 are MBZ */
+                       sin6->sin6_addr.s6_addr[nat64_prefixnet++] = 0;
+               }
+               sin6->sin6_addr.s6_addr[nat64_prefixnet++] = *v4_byte++;
+       }
+}
+
+int
 addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen)
 {
        /* prefix for ipv4 into ipv6 mapping is ::ffff:x.x.x.x */
@@ -1005,6 +1048,16 @@ listen_sslctx_setup(void* ctxt)
                        log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
        }
 #endif
+#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
+       /* ignore errors when peers do not send the mandatory close_notify
+        * alert on shutdown.
+        * Relevant for openssl >= 3 */
+       if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
+               SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
+               log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
+               return 0;
+       }
+#endif
 
        if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
                SSL_OP_CIPHER_SERVER_PREFERENCE) !=
@@ -1233,6 +1286,17 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
                SSL_CTX_free(ctx);
                return 0;
        }
+#endif
+#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
+       /* ignore errors when peers do not send the mandatory close_notify
+        * alert on shutdown.
+        * Relevant for openssl >= 3 */
+       if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
+               SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
+               log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
+               SSL_CTX_free(ctx);
+               return 0;
+       }
 #endif
        if(key && key[0]) {
                if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {

diff --git a/sbin/unwind/libunbound/util/net_help.h b/sbin/unwind/libunbound/util/net_help.h
index f1881b3..a9de910 100644 (file)
--- a/sbin/unwind/libunbound/util/net_help.h
+++ b/sbin/unwind/libunbound/util/net_help.h
@@ -331,6 +331,29 @@ int addr_in_common(struct sockaddr_storage* addr1, int net1,
 void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
        char* buf, size_t len);
 
+/**
+ * Check if the prefix network length is one of the allowed 32, 40, 48, 56, 64,
+ * or 96.
+ * @param prefixnet: prefix network length to check.
+ * @return 1 on success, 0 on failure.
+ */
+int prefixnet_is_nat64(int prefixnet);
+
+/**
+ * Create a NAT64 address from a given address (needs to be IPv4) and a given
+ * NAT64 prefix. The NAT64 prefix net needs to be one of 32, 40, 48, 56, 64, 96.
+ * @param addr: IPv4 address.
+ * @param nat64_prefix: NAT64 prefix.
+ * @param nat64_prefixlen: NAT64 prefix len.
+ * @param nat64_prefixnet: NAT64 prefix mask.
+ * @param nat64_addr: the resulting NAT64 address.
+ * @param nat64_addrlen: the resulting NAT64 address length.
+ */
+void addr_to_nat64(const struct sockaddr_storage* addr,
+       const struct sockaddr_storage* nat64_prefix,
+       socklen_t nat64_prefixlen, int nat64_prefixnet,
+       struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen);
+
 /**
  * See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0"
  * @param addr: address

diff --git a/sbin/unwind/libunbound/util/netevent.c b/sbin/unwind/libunbound/util/netevent.c
index c67a49f..204e488 100644 (file)
--- a/sbin/unwind/libunbound/util/netevent.c
+++ b/sbin/unwind/libunbound/util/netevent.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -46,6 +46,7 @@
 #include "util/tcp_conn_limit.h"
 #include "util/fptr_wlist.h"
 #include "util/proxy_protocol.h"
+#include "util/timeval_func.h"
 #include "sldns/pkthdr.h"
 #include "sldns/sbuffer.h"
 #include "sldns/str2wire.h"
@@ -71,7 +72,9 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
-
+#ifdef HAVE_LINUX_NET_TSTAMP_H
+#include <linux/net_tstamp.h>
+#endif
 /* -------- Start of local definitions -------- */
 /** if CMSG_ALIGN is not defined on this platform, a workaround */
 #ifndef CMSG_ALIGN
@@ -114,6 +117,16 @@
 /** timeout in millisec to wait for write to unblock, packets dropped after.*/
 #define SEND_BLOCKED_WAIT_TIMEOUT 200
 
+/** Let's make timestamping code cleaner and redefine SO_TIMESTAMP* */
+#ifndef SO_TIMESTAMP
+#define SO_TIMESTAMP 29
+#endif
+#ifndef SO_TIMESTAMPNS
+#define SO_TIMESTAMPNS 35
+#endif
+#ifndef SO_TIMESTAMPING
+#define SO_TIMESTAMPING 37
+#endif
 /**
  * The internal event structure for keeping ub_event info for the event.
  * Possibly other structures (list, tree) this is part of.
@@ -177,7 +190,7 @@ static struct comm_point* comm_point_create_tcp_handler(
 
 /* -------- End of local definitions -------- */
 
-struct comm_base* 
+struct comm_base*
 comm_base_create(int sigs)
 {
        struct comm_base* b = (struct comm_base*)calloc(1,
@@ -220,7 +233,7 @@ comm_base_create_event(struct ub_event_base* base)
        return b;
 }
 
-void 
+void
 comm_base_delete(struct comm_base* b)
 {
        if(!b)
@@ -237,7 +250,7 @@ comm_base_delete(struct comm_base* b)
        free(b);
 }
 
-void 
+void
 comm_base_delete_no_base(struct comm_base* b)
 {
        if(!b)
@@ -253,14 +266,14 @@ comm_base_delete_no_base(struct comm_base* b)
        free(b);
 }
 
-void 
+void
 comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv)
 {
        *tt = &b->eb->secs;
        *tv = &b->eb->now;
 }
 
-void 
+void
 comm_base_dispatch(struct comm_base* b)
 {
        int retval;
@@ -470,7 +483,7 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
                                (struct sockaddr_storage*)addr, addrlen);
                return 0;
        } else if((size_t)sent != sldns_buffer_remaining(packet)) {
-               log_err("sent %d in place of %d bytes", 
+               log_err("sent %d in place of %d bytes",
                        (int)sent, (int)sldns_buffer_remaining(packet));
                return 0;
        }
@@ -489,7 +502,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
        if(r->srctype == 6) {
 #ifdef IPV6_PKTINFO
                char buf[1024];
-               if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, 
+               if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr,
                        buf, (socklen_t)sizeof(buf)) == 0) {
                        (void)strlcpy(buf, "(inet_ntop error)", sizeof(buf));
                }
@@ -499,13 +512,13 @@ static void p_ancil(const char* str, struct comm_reply* r)
        } else if(r->srctype == 4) {
 #ifdef IP_PKTINFO
                char buf1[1024], buf2[1024];
-               if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 
+               if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr,
                        buf1, (socklen_t)sizeof(buf1)) == 0) {
                        (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
                }
                buf1[sizeof(buf1)-1]=0;
 #ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
-               if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, 
+               if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst,
                        buf2, (socklen_t)sizeof(buf2)) == 0) {
                        (void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2));
                }
@@ -517,7 +530,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
                        buf1, buf2);
 #elif defined(IP_RECVDSTADDR)
                char buf1[1024];
-               if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
+               if(inet_ntop(AF_INET, &r->pktinfo.v4addr,
                        buf1, (socklen_t)sizeof(buf1)) == 0) {
                        (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
                }
@@ -531,7 +544,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
 /** send a UDP reply over specified interface*/
 static int
 comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
-       struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) 
+       struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r)
 {
 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG)
        ssize_t sent;
@@ -579,6 +592,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
                cmsg_data = CMSG_DATA(cmsg);
                ((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0;
                cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
+               /* zero the padding bytes inserted by the CMSG_LEN */
+               if(sizeof(struct in_pktinfo) < cmsg->cmsg_len)
+                       memset(((uint8_t*)(CMSG_DATA(cmsg))) +
+                               sizeof(struct in_pktinfo), 0, cmsg->cmsg_len
+                               - sizeof(struct in_pktinfo));
 #elif defined(IP_SENDSRCADDR)
                msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
                log_assert(msg.msg_controllen <= sizeof(control.buf));
@@ -587,6 +605,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
                memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
                        sizeof(struct in_addr));
                cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
+               /* zero the padding bytes inserted by the CMSG_LEN */
+               if(sizeof(struct in_addr) < cmsg->cmsg_len)
+                       memset(((uint8_t*)(CMSG_DATA(cmsg))) +
+                               sizeof(struct in_addr), 0, cmsg->cmsg_len
+                               - sizeof(struct in_addr));
 #else
                verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR");
                msg.msg_control = NULL;
@@ -603,6 +626,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
                cmsg_data = CMSG_DATA(cmsg);
                ((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0;
                cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
+               /* zero the padding bytes inserted by the CMSG_LEN */
+               if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len)
+                       memset(((uint8_t*)(CMSG_DATA(cmsg))) +
+                               sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len
+                               - sizeof(struct in6_pktinfo));
        } else {
                /* try to pass all 0 to use default route */
                msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
@@ -611,9 +639,14 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
                cmsg->cmsg_type = IPV6_PKTINFO;
                memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo));
                cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
+               /* zero the padding bytes inserted by the CMSG_LEN */
+               if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len)
+                       memset(((uint8_t*)(CMSG_DATA(cmsg))) +
+                               sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len
+                               - sizeof(struct in6_pktinfo));
        }
 #endif /* S_SPLINT_S */
-       if(verbosity >= VERB_ALGO)
+       if(verbosity >= VERB_ALGO && r->srctype != 0)
                p_ancil("send_udp over interface", r);
        sent = sendmsg(c->fd, &msg, 0);
        if(sent == -1) {
@@ -695,7 +728,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
                if(!udp_send_errno_needs_log(addr, addrlen))
                        return 0;
                verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno));
-               log_addr(VERB_OPS, "remote address is", 
+               log_addr(VERB_OPS, "remote address is",
                        (struct sockaddr_storage*)addr, addrlen);
 #ifdef __NetBSD__
                /* netbsd 7 has IP_PKTINFO for recv but not send */
@@ -705,7 +738,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 #endif
                return 0;
        } else if((size_t)sent != sldns_buffer_remaining(packet)) {
-               log_err("sent %d in place of %d bytes", 
+               log_err("sent %d in place of %d bytes",
                        (int)sent, (int)sldns_buffer_remaining(packet));
                return 0;
        }
@@ -817,7 +850,7 @@ done:
        return 1;
 }
 
-void 
+void
 comm_point_udp_ancil_callback(int fd, short event, void* arg)
 {
 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG)
@@ -833,6 +866,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 #ifndef S_SPLINT_S
        struct cmsghdr* cmsg;
 #endif /* S_SPLINT_S */
+#ifdef HAVE_LINUX_NET_TSTAMP_H
+       struct timespec *ts;
+#endif /* HAVE_LINUX_NET_TSTAMP_H */
 
        rep.c = (struct comm_point*)arg;
        log_assert(rep.c->type == comm_udp);
@@ -843,6 +879,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
        ub_comm_base_now(rep.c->ev->base);
        for(i=0; i<NUM_UDP_PER_SELECT; i++) {
                sldns_buffer_clear(rep.c->buffer);
+               timeval_clear(&rep.c->recv_tv);
                rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr);
                log_assert(fd != -1);
                log_assert(sldns_buffer_remaining(rep.c->buffer) > 0);
@@ -894,9 +931,23 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
                                        sizeof(struct in_addr));
                                break;
 #endif /* IP_PKTINFO or IP_RECVDSTADDR */
+#ifdef HAVE_LINUX_NET_TSTAMP_H
+                       } else if( cmsg->cmsg_level == SOL_SOCKET &&
+                               cmsg->cmsg_type == SO_TIMESTAMPNS) {
+                               ts = (struct timespec *)CMSG_DATA(cmsg);
+                               TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts);
+                       } else if( cmsg->cmsg_level == SOL_SOCKET &&
+                               cmsg->cmsg_type == SO_TIMESTAMPING) {
+                               ts = (struct timespec *)CMSG_DATA(cmsg);
+                               TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts);
+                       } else if( cmsg->cmsg_level == SOL_SOCKET &&
+                               cmsg->cmsg_type == SO_TIMESTAMP) {
+                               memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval));
+#endif /* HAVE_LINUX_NET_TSTAMP_H */
                        }
                }
-               if(verbosity >= VERB_ALGO)
+
+               if(verbosity >= VERB_ALGO && rep.srctype != 0)
                        p_ancil("receive_udp on interface", &rep);
 #endif /* S_SPLINT_S */
 
@@ -930,7 +981,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */
 }
 
-void 
+void
 comm_point_udp_callback(int fd, short event, void* arg)
 {
        struct comm_reply rep;
@@ -950,14 +1001,14 @@ comm_point_udp_callback(int fd, short event, void* arg)
                rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr);
                log_assert(fd != -1);
                log_assert(sldns_buffer_remaining(rep.c->buffer) > 0);
-               rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), 
+               rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer),
                        sldns_buffer_remaining(rep.c->buffer), MSG_DONTWAIT,
                        (struct sockaddr*)&rep.remote_addr, &rep.remote_addrlen);
                if(rcv == -1) {
 #ifndef USE_WINSOCK
                        if(errno != EAGAIN && errno != EINTR
                                && udp_recv_needs_log(errno))
-                               log_err("recvfrom %d failed: %s", 
+                               log_err("recvfrom %d failed: %s",
                                        fd, strerror(errno));
 #else
                        if(WSAGetLastError() != WSAEINPROGRESS &&
@@ -1012,7 +1063,7 @@ int adjusted_tcp_timeout(struct comm_point* c)
 
 /** Use a new tcp handler for new query fd, set to read query */
 static void
-setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) 
+setup_tcp_handler(struct comm_point* c, int fd, int cur, int max)
 {
        int handler_usage;
        log_assert(c->type == comm_tcp || c->type == comm_http);
@@ -1076,10 +1127,10 @@ int comm_point_perform_accept(struct comm_point* c,
                /* EINTR is signal interrupt. others are closed connection. */
                if(     errno == EINTR || errno == EAGAIN
 #ifdef EWOULDBLOCK
-                       || errno == EWOULDBLOCK 
+                       || errno == EWOULDBLOCK
 #endif
 #ifdef ECONNABORTED
-                       || errno == ECONNABORTED 
+                       || errno == ECONNABORTED
 #endif
 #ifdef EPROTO
                        || errno == EPROTO
@@ -1253,7 +1304,7 @@ static int http2_submit_settings(struct http2_session* h2_session)
 #endif /* HAVE_NGHTTP2 */
 
 
-void 
+void
 comm_point_tcp_accept_callback(int fd, short event, void* arg)
 {
        struct comm_point* c = (struct comm_point*)arg, *c_hdl;
@@ -2161,7 +2212,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
                log_err("in comm_point_tcp_handle_read buffer_remaining is "
                        "not > 0 as expected, continuing with (harmless) 0 "
                        "length recv");
-       r = recv(fd, (void*)sldns_buffer_current(c->buffer), 
+       r = recv(fd, (void*)sldns_buffer_current(c->buffer),
                sldns_buffer_remaining(c->buffer), MSG_DONTWAIT);
        if(r == 0) {
                if(c->tcp_req_info)
@@ -2252,8 +2303,8 @@ recv_error:
        return 0;
 }
 
-/** 
- * Handle tcp writing callback. 
+/**
+ * Handle tcp writing callback.
  * @param fd: file descriptor of socket.
  * @param c: comm point to write buffer out of.
  * @return: 0 on error
@@ -2277,7 +2328,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
                /* from Stevens, unix network programming, vol1, 3rd ed, p450*/
                int error = 0;
                socklen_t len = (socklen_t)sizeof(error);
-               if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 
+               if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
                        &len) < 0){
 #ifndef USE_WINSOCK
                        error = errno; /* on solaris errno is error */
@@ -2318,7 +2369,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
                return ssl_handle_it(c, 1);
 
 #ifdef USE_MSG_FASTOPEN
-       /* Only try this on first use of a connection that uses tfo, 
+       /* Only try this on first use of a connection that uses tfo,
           otherwise fall through to normal write */
        /* Also, TFO support on WINDOWS not implemented at the moment */
        if(c->tcp_do_fastopen == 1) {
@@ -2473,7 +2524,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
                        if(WSAGetLastError() == WSAEWOULDBLOCK) {
                                ub_winsock_tcp_wouldblock(c->ev->ev,
                                        UB_EV_WRITE);
-                               return 1; 
+                               return 1;
                        }
                        if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
                                return 0; /* silence reset by peer */
@@ -2522,7 +2573,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
                        return 1;
                if(WSAGetLastError() == WSAEWOULDBLOCK) {
                        ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
-                       return 1; 
+                       return 1;
                }
                if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
                        return 0; /* silence reset by peer */
@@ -2541,12 +2592,13 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
        if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) {
                tcp_callback_writer(c);
        }
-       
+
        return 1;
 }
 
-/** read again to drain buffers when there could be more to read */
-static void
+/** read again to drain buffers when there could be more to read, returns 0
+ * on failure which means the comm point is closed. */
+static int
 tcp_req_info_read_again(int fd, struct comm_point* c)
 {
        while(c->tcp_req_info->read_again) {
@@ -2560,12 +2612,13 @@ tcp_req_info_read_again(int fd, struct comm_point* c)
                        if(!c->tcp_do_close) {
                                fptr_ok(fptr_whitelist_comm_point(
                                        c->callback));
-                               (void)(*c->callback)(c, c->cb_arg, 
+                               (void)(*c->callback)(c, c->cb_arg,
                                        NETEVENT_CLOSED, NULL);
                        }
-                       return;
+                       return 0;
                }
        }
+       return 1;
 }
 
 /** read again to drain buffers when there could be more to read */
@@ -2616,13 +2669,16 @@ tcp_more_write_again(int fd, struct comm_point* c)
        }
 }
 
-void 
+void
 comm_point_tcp_handle_callback(int fd, short event, void* arg)
 {
        struct comm_point* c = (struct comm_point*)arg;
        log_assert(c->type == comm_tcp);
        ub_comm_base_now(c->ev->base);
 
+       if(c->fd == -1 || c->fd != fd)
+               return; /* duplicate event, but commpoint closed. */
+
 #ifdef USE_DNSCRYPT
        /* Initialize if this is a dnscrypt socket */
        if(c->tcp_parent) {
@@ -2671,8 +2727,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
                        }
                        return;
                }
-               if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again)
-                       tcp_req_info_read_again(fd, c);
+               if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) {
+                       if(!tcp_req_info_read_again(fd, c))
+                               return;
+               }
                if(moreread && *moreread)
                        tcp_more_read_again(fd, c);
                return;
@@ -2690,8 +2748,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
                        }
                        return;
                }
-               if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again)
-                       tcp_req_info_read_again(fd, c);
+               if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) {
+                       if(!tcp_req_info_read_again(fd, c))
+                               return;
+               }
                if(morewrite && *morewrite)
                        tcp_more_write_again(fd, c);
                return;
@@ -2774,7 +2834,7 @@ http_read_more(int fd, struct comm_point* c)
 {
        ssize_t r;
        log_assert(sldns_buffer_remaining(c->buffer) > 0);
-       r = recv(fd, (void*)sldns_buffer_current(c->buffer), 
+       r = recv(fd, (void*)sldns_buffer_current(c->buffer),
                sldns_buffer_remaining(c->buffer), MSG_DONTWAIT);
        if(r == 0) {
                return 0;
@@ -3043,7 +3103,7 @@ http_chunked_segment(struct comm_point* c)
                /* return and wait to read more */
                return 1;
        }
-       
+
        /* callback of http reader for a new part of the data */
        c->http_stored = 0;
        sldns_buffer_set_position(c->buffer, 0);
@@ -3393,7 +3453,7 @@ http_check_connect(int fd, struct comm_point* c)
        /* from Stevens, unix network programming, vol1, 3rd ed, p450*/
        int error = 0;
        socklen_t len = (socklen_t)sizeof(error);
-       if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 
+       if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
                &len) < 0){
 #ifndef USE_WINSOCK
                error = errno; /* on solaris errno is error */
@@ -3478,7 +3538,7 @@ http_write_more(int fd, struct comm_point* c)
 {
        ssize_t r;
        log_assert(sldns_buffer_remaining(c->buffer) > 0);
-       r = send(fd, (void*)sldns_buffer_current(c->buffer), 
+       r = send(fd, (void*)sldns_buffer_current(c->buffer),
                sldns_buffer_remaining(c->buffer), 0);
        if(r == -1) {
 #ifndef USE_WINSOCK
@@ -3489,7 +3549,7 @@ http_write_more(int fd, struct comm_point* c)
                        return 1;
                if(WSAGetLastError() == WSAEWOULDBLOCK) {
                        ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
-                       return 1; 
+                       return 1;
                }
 #endif
                log_err_addr("http send r", sock_strerror(errno),
@@ -3610,8 +3670,8 @@ comm_point_http2_handle_write(int ATTR_UNUSED(fd), struct comm_point* c)
 #endif
 }
 
-/** 
- * Handle http writing callback. 
+/**
+ * Handle http writing callback.
  * @param fd: file descriptor of socket.
  * @param c: comm point to write buffer out of.
  * @return: 0 on error
@@ -3677,7 +3737,7 @@ comm_point_http_handle_write(int fd, struct comm_point* c)
        return 1;
 }
 
-void 
+void
 comm_point_http_handle_callback(int fd, short event, void* arg)
 {
        struct comm_point* c = (struct comm_point*)arg;
@@ -3730,7 +3790,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg)
        if(event&UB_EV_READ) {
                if(!comm_point_tcp_handle_read(fd, c, 1)) {
                        fptr_ok(fptr_whitelist_comm_point(c->callback));
-                       (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, 
+                       (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED,
                                NULL);
                }
                return;
@@ -3738,21 +3798,21 @@ void comm_point_local_handle_callback(int fd, short event, void* arg)
        log_err("Ignored event %d for localhdl.", event);
 }
 
-void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_raw_handle_callback(int ATTR_UNUSED(fd),
        short event, void* arg)
 {
        struct comm_point* c = (struct comm_point*)arg;
        int err = NETEVENT_NOERROR;
        log_assert(c->type == comm_raw);
        ub_comm_base_now(c->ev->base);
-       
+
        if(event&UB_EV_TIMEOUT)
                err = NETEVENT_TIMEOUT;
        fptr_ok(fptr_whitelist_comm_point_raw(c->callback));
        (void)(*c->callback)(c, c->cb_arg, err, NULL);
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
        int pp2_enabled, comm_point_callback_type* callback,
        void* callback_arg, struct unbound_socket* socket)
@@ -3800,7 +3860,11 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
        evbits = UB_EV_READ | UB_EV_PERSIST;
        /* ub_event stuff */
        c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
+#ifdef USE_WINSOCK
                comm_point_udp_callback, c);
+#else
+               comm_point_udp_ancil_callback, c);
+#endif
        if(c->ev->ev == NULL) {
                log_err("could not baseset udp event");
                comm_point_delete(c);
@@ -3815,7 +3879,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
        return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_udp_ancil(struct comm_base *base, int fd,
        sldns_buffer* buffer, int pp2_enabled,
        comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket)
@@ -3878,8 +3942,8 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
        return c;
 }
 
-static struct comm_point* 
-comm_point_create_tcp_handler(struct comm_base *base, 
+static struct comm_point*
+comm_point_create_tcp_handler(struct comm_base *base,
        struct comm_point* parent, size_t bufsize,
        struct sldns_buffer* spoolbuf, comm_point_callback_type* callback,
        void* callback_arg, struct unbound_socket* socket)
@@ -3976,8 +4040,8 @@ comm_point_create_tcp_handler(struct comm_base *base,
        return c;
 }
 
-static struct comm_point* 
-comm_point_create_http_handler(struct comm_base *base, 
+static struct comm_point*
+comm_point_create_http_handler(struct comm_base *base,
        struct comm_point* parent, size_t bufsize, int harden_large_queries,
        uint32_t http_max_streams, char* http_endpoint,
        comm_point_callback_type* callback, void* callback_arg,
@@ -4074,7 +4138,7 @@ comm_point_create_http_handler(struct comm_base *base,
                return NULL;
        }
 #endif
-       
+
        /* add to parent free list */
        c->tcp_free = parent->tcp_free;
        parent->tcp_free = c;
@@ -4096,7 +4160,7 @@ comm_point_create_http_handler(struct comm_base *base,
        return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_tcp(struct comm_base *base, int fd, int num,
        int idle_timeout, int harden_large_queries,
        uint32_t http_max_streams, char* http_endpoint,
@@ -4194,11 +4258,11 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num,
                        return NULL;
                }
        }
-       
+
        return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg)
 {
@@ -4265,7 +4329,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
        return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_http_out(struct comm_base *base, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg,
        sldns_buffer* temp)
@@ -4336,7 +4400,7 @@ comm_point_create_http_out(struct comm_base *base, size_t bufsize,
        return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg)
 {
@@ -4404,8 +4468,8 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
        return c;
 }
 
-struct comm_point* 
-comm_point_create_raw(struct comm_base* base, int fd, int writing, 
+struct comm_point*
+comm_point_create_raw(struct comm_base* base, int fd, int writing,
        comm_point_callback_type* callback, void* callback_arg)
 {
        struct comm_point* c = (struct comm_point*)calloc(1,
@@ -4469,7 +4533,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
        return c;
 }
 
-void 
+void
 comm_point_close(struct comm_point* c)
 {
        if(!c)
@@ -4488,6 +4552,11 @@ comm_point_close(struct comm_point* c)
                tcp_req_info_clear(c->tcp_req_info);
        if(c->h2_session)
                http2_session_server_delete(c->h2_session);
+       /* stop the comm point from reading or writing after it is closed. */
+       if(c->tcp_more_read_again && *c->tcp_more_read_again)
+               *c->tcp_more_read_again = 0;
+       if(c->tcp_more_write_again && *c->tcp_more_write_again)
+               *c->tcp_more_write_again = 0;
 
        /* close fd after removing from event lists, or epoll.. is messed up */
        if(c->fd != -1 && !c->do_not_close) {
@@ -4504,10 +4573,10 @@ comm_point_close(struct comm_point* c)
        c->fd = -1;
 }
 
-void 
+void
 comm_point_delete(struct comm_point* c)
 {
-       if(!c) 
+       if(!c)
                return;
        if((c->type == comm_tcp || c->type == comm_http) && c->ssl) {
 #ifdef HAVE_SSL
@@ -4546,7 +4615,7 @@ comm_point_delete(struct comm_point* c)
        free(c);
 }
 
-void 
+void
 comm_point_send_reply(struct comm_reply *repinfo)
 {
        struct sldns_buffer* buffer;
@@ -4610,7 +4679,7 @@ comm_point_send_reply(struct comm_reply *repinfo)
        }
 }
 
-void 
+void
 comm_point_drop_reply(struct comm_reply* repinfo)
 {
        if(!repinfo)
@@ -4634,7 +4703,7 @@ comm_point_drop_reply(struct comm_reply* repinfo)
        reclaim_tcp_handler(repinfo->c);
 }
 
-void 
+void
 comm_point_stop_listening(struct comm_point* c)
 {
        verbose(VERB_ALGO, "comm point stop listening %d", c->fd);
@@ -4646,10 +4715,10 @@ comm_point_stop_listening(struct comm_point* c)
        }
 }
 
-void 
+void
 comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 {
-       verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 
+       verbose(VERB_ALGO, "comm point start listening %d (%d msec)",
                c->fd==-1?newfd:c->fd, msec);
        if(c->type == comm_tcp_accept && !c->tcp_free) {
                /* no use to start listening no free slots. */
@@ -4733,10 +4802,10 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
 size_t comm_point_get_mem(struct comm_point* c)
 {
        size_t s;
-       if(!c) 
+       if(!c)
                return 0;
        s = sizeof(*c) + sizeof(*c->ev);
-       if(c->timeout) 
+       if(c->timeout)
                s += sizeof(*c->timeout);
        if(c->type == comm_tcp || c->type == comm_local) {
                s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer);
@@ -4755,7 +4824,7 @@ size_t comm_point_get_mem(struct comm_point* c)
        return s;
 }
 
-struct comm_timer* 
+struct comm_timer*
 comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
 {
        struct internal_timer *tm = (struct internal_timer*)calloc(1,
@@ -4768,7 +4837,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
        tm->base = base;
        tm->super.callback = cb;
        tm->super.cb_arg = cb_arg;
-       tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, 
+       tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT,
                comm_timer_callback, &tm->super);
        if(tm->ev == NULL) {
                log_err("timer_create: event_base_set failed.");
@@ -4778,7 +4847,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
        return &tm->super;
 }
 
-void 
+void
 comm_timer_disable(struct comm_timer* timer)
 {
        if(!timer)
@@ -4787,7 +4856,7 @@ comm_timer_disable(struct comm_timer* timer)
        timer->ev_timer->enabled = 0;
 }
 
-void 
+void
 comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 {
        log_assert(tv);
@@ -4799,7 +4868,7 @@ comm_timer_set(struct comm_timer* timer, struct timeval* tv)
        timer->ev_timer->enabled = 1;
 }
 
-void 
+void
 comm_timer_delete(struct comm_timer* timer)
 {
        if(!timer)
@@ -4812,7 +4881,7 @@ comm_timer_delete(struct comm_timer* timer)
        free(timer->ev_timer);
 }
 
-void 
+void
 comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
 {
        struct comm_timer* tm = (struct comm_timer*)arg;
@@ -4824,19 +4893,19 @@ comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
        (*tm->callback)(tm->cb_arg);
 }
 
-int 
+int
 comm_timer_is_set(struct comm_timer* timer)
 {
        return (int)timer->ev_timer->enabled;
 }
 
-size_t 
+size_t
 comm_timer_get_mem(struct comm_timer* ATTR_UNUSED(timer))
 {
        return sizeof(struct internal_timer);
 }
 
-struct comm_signal* 
+struct comm_signal*
 comm_signal_create(struct comm_base* base,
         void (*callback)(int, void*), void* cb_arg)
 {
@@ -4853,7 +4922,7 @@ comm_signal_create(struct comm_base* base,
        return com;
 }
 
-void 
+void
 comm_signal_callback(int sig, short event, void* arg)
 {
        struct comm_signal* comsig = (struct comm_signal*)arg;
@@ -4864,10 +4933,10 @@ comm_signal_callback(int sig, short event, void* arg)
        (*comsig->callback)(sig, comsig->cb_arg);
 }
 
-int 
+int
 comm_signal_bind(struct comm_signal* comsig, int sig)
 {
-       struct internal_signal* entry = (struct internal_signal*)calloc(1, 
+       struct internal_signal* entry = (struct internal_signal*)calloc(1,
                sizeof(struct internal_signal));
        if(!entry) {
                log_err("malloc failed");
@@ -4894,7 +4963,7 @@ comm_signal_bind(struct comm_signal* comsig, int sig)
        return 1;
 }
 
-void 
+void
 comm_signal_delete(struct comm_signal* comsig)
 {
        struct internal_signal* p, *np;

diff --git a/sbin/unwind/libunbound/util/netevent.h b/sbin/unwind/libunbound/util/netevent.h
index 3e7849c..dc9619c 100644 (file)
--- a/sbin/unwind/libunbound/util/netevent.h
+++ b/sbin/unwind/libunbound/util/netevent.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -60,6 +60,7 @@
 #ifndef NET_EVENT_H
 #define NET_EVENT_H
 
+#include <sys/time.h>
 #include "dnscrypt/dnscrypt.h"
 #ifdef HAVE_NGHTTP2_NGHTTP2_H
 #include <nghttp2/nghttp2.h>
@@ -83,7 +84,7 @@ struct internal_timer; /* A sub struct of the comm_timer super struct */
 enum listen_type;
 
 /** callback from communication point function type */
-typedef int comm_point_callback_type(struct comm_point*, void*, int, 
+typedef int comm_point_callback_type(struct comm_point*, void*, int,
        struct comm_reply*);
 
 /** to pass no_error to callback function */
@@ -91,7 +92,7 @@ typedef int comm_point_callback_type(struct comm_point*, void*, int,
 /** to pass closed connection to callback function */
 #define NETEVENT_CLOSED -1
 /** to pass timeout happened to callback function */
-#define NETEVENT_TIMEOUT -2 
+#define NETEVENT_TIMEOUT -2
 /** to pass fallback from capsforID to callback function; 0x20 failed */
 #define NETEVENT_CAPSFAIL -3
 /** to pass done transfer to callback function; http file is complete */
@@ -165,8 +166,8 @@ struct comm_reply {
        socklen_t client_addrlen;
 };
 
-/** 
- * Communication point to the network 
+/**
+ * Communication point to the network
  * These behaviours can be accomplished by setting the flags
  * and passing return values from the callback.
  *    udp frontside: called after readdone. sendafter.
@@ -206,7 +207,7 @@ struct comm_point {
        int max_tcp_count;
        /** current number of tcp handler in-use for this accept socket */
        int cur_tcp_count;
-       /** malloced array of tcp handlers for a tcp-accept, 
+       /** malloced array of tcp handlers for a tcp-accept,
            of size max_tcp_count. */
        struct comm_point** tcp_handlers;
        /** linked list of free tcp_handlers to use for new queries.
@@ -271,9 +272,9 @@ struct comm_point {
        /** is this a UDP, TCP-accept or TCP socket. */
        enum comm_point_type {
                /** UDP socket - handle datagrams. */
-               comm_udp, 
+               comm_udp,
                /** TCP accept socket - only creates handlers if readable. */
-               comm_tcp_accept, 
+               comm_tcp_accept,
                /** TCP handler socket - handle byteperbyte readwrite. */
                comm_tcp,
                /** HTTP handler socket */
@@ -282,7 +283,7 @@ struct comm_point {
                comm_local,
                /** raw - not DNS format - for pipe readers and writers */
                comm_raw
-       } 
+       }
                /** variable with type of socket, UDP,TCP-accept,TCP,pipe */
                type;
 
@@ -303,7 +304,7 @@ struct comm_point {
        /** if set the connection is NOT closed on delete. */
        int do_not_close;
 
-       /** if set, the connection is closed on error, on timeout, 
+       /** if set, the connection is closed on error, on timeout,
            and after read/write completes. No callback is done. */
        int tcp_do_close;
 
@@ -383,15 +384,16 @@ struct comm_point {
        /** number of queries outstanding on this socket, used by
         * outside network for udp ports */
        int inuse;
-
+       /** the timestamp when the packet was received by the kernel */
+       struct timeval recv_tv;
        /** callback when done.
            tcp_accept does not get called back, is NULL then.
            If a timeout happens, callback with timeout=1 is called.
-           If an error happens, callback is called with error set 
+           If an error happens, callback is called with error set
            nonzero. If not NETEVENT_NOERROR, it is an errno value.
            If the connection is closed (by remote end) then the
            callback is called with error set to NETEVENT_CLOSED=-1.
-           If a timeout happens on the connection, the error is set to 
+           If a timeout happens on the connection, the error is set to
            NETEVENT_TIMEOUT=-2.
            The reply_info can be copied if the reply needs to happen at a
            later time. It consists of a struct with commpoint and address.
@@ -399,7 +401,7 @@ struct comm_point {
            Note the reply information is temporary and must be copied.
            NULL is passed for_reply info, in cases where error happened.
 
-           declare as: 
+           declare as:
            int my_callback(struct comm_point* c, void* my_arg, int error,
                struct comm_reply *reply_info);
 
@@ -446,14 +448,14 @@ struct comm_signal {
 
 /**
  * Create a new comm base.
- * @param sigs: if true it attempts to create a default loop for 
+ * @param sigs: if true it attempts to create a default loop for
  *   signal handling.
  * @return: the new comm base. NULL on error.
  */
 struct comm_base* comm_base_create(int sigs);
 
 /**
- * Create comm base that uses the given ub_event_base (underlying pluggable 
+ * Create comm base that uses the given ub_event_base (underlying pluggable
  * event mechanism pointer).
  * @param base: underlying pluggable event base.
  * @return: the new comm base. NULL on error.
@@ -619,7 +621,7 @@ struct comm_point* comm_point_create_http_out(struct comm_base* base,
  * @return: the commpoint or NULL on error.
  */
 struct comm_point* comm_point_create_local(struct comm_base* base,
-       int fd, size_t bufsize, 
+       int fd, size_t bufsize,
        comm_point_callback_type* callback, void* callback_arg);
 
 /**
@@ -632,7 +634,7 @@ struct comm_point* comm_point_create_local(struct comm_base* base,
  * @return: the commpoint or NULL on error.
  */
 struct comm_point* comm_point_create_raw(struct comm_base* base,
-       int fd, int writing, 
+       int fd, int writing,
        comm_point_callback_type* callback, void* callback_arg);
 
 /**
@@ -722,7 +724,7 @@ size_t comm_point_get_mem(struct comm_point* c);
  * @param cb_arg: user callback argument.
  * @return: the new timer or NULL on error.
  */
-struct comm_timer* comm_timer_create(struct comm_base* base, 
+struct comm_timer* comm_timer_create(struct comm_base* base,
        void (*cb)(void*), void* cb_arg);
 
 /**
@@ -792,7 +794,7 @@ void comm_signal_delete(struct comm_signal* comsig);
  *     if -1, error message has been printed if necessary, simply drop
  *     out of the reading handler.
  */
-int comm_point_perform_accept(struct comm_point* c, 
+int comm_point_perform_accept(struct comm_point* c,
        struct sockaddr_storage* addr, socklen_t* addrlen);
 
 /**** internal routines ****/
@@ -801,7 +803,7 @@ int comm_point_perform_accept(struct comm_point* c,
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for udp comm point.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -811,7 +813,7 @@ void comm_point_udp_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for udp ancillary data comm point.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -821,7 +823,7 @@ void comm_point_udp_ancil_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp accept comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -831,7 +833,7 @@ void comm_point_tcp_accept_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp data comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -841,7 +843,7 @@ void comm_point_tcp_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp data comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -955,7 +957,7 @@ void http2_stream_add_meshstate(struct http2_stream* h2_stream,
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for timer comm.
  * @param fd: file descriptor (always -1).
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_timer structure.
  */
@@ -965,7 +967,7 @@ void comm_timer_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for signal comm.
  * @param fd: file descriptor (used for the signal number).
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the internal commsignal structure.
  */
@@ -975,7 +977,7 @@ void comm_signal_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for AF_UNIX fds
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -985,7 +987,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for raw fd access.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -995,7 +997,7 @@ void comm_point_raw_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for timeout on slow accept.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *     EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */

diff --git a/sbin/unwind/libunbound/util/regional.c b/sbin/unwind/libunbound/util/regional.c
index 93e911c..44aee68 100644 (file)
--- a/sbin/unwind/libunbound/util/regional.c
+++ b/sbin/unwind/libunbound/util/regional.c
@@ -186,7 +186,7 @@ regional_alloc_init(struct regional* r, const void *init, size_t size)
 {
        void *s = regional_alloc(r, size);
        if(!s) return NULL;
-       memcpy(s, init, size);
+       memmove(s, init, size);
        return s;
 }
 

diff --git a/sbin/unwind/libunbound/util/rfc_1982.c b/sbin/unwind/libunbound/util/rfc_1982.c
new file mode 100644 (file)
index 0000000..c28dede
--- /dev/null
+++ b/sbin/unwind/libunbound/util/rfc_1982.c
@@ -0,0 +1,74 @@
+/*
+ * util/rfc_1982.c - RFC 1982 Serial Number Arithmetic
+ *
+ * Copyright (c) 2023, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions for RFC 1982 serial number arithmetic.
+ */
+#include "config.h"
+
+int
+compare_1982(uint32_t a, uint32_t b)
+{
+       /* for 32 bit values */
+       const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
+
+       if (a == b) {
+               return 0;
+       } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) {
+               return -1;
+       } else {
+               return 1;
+       }
+}
+
+uint32_t
+subtract_1982(uint32_t a, uint32_t b)
+{
+       /* for 32 bit values */
+       const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
+
+       if(a == b)
+               return 0;
+       if(a < b && b - a < cutoff) {
+               return b-a;
+       }
+       if(a > b && a - b > cutoff) {
+               return ((uint32_t)0xffffffff) - (a-b-1);
+       }
+       /* wrong case, b smaller than a */
+       return 0;
+}

diff --git a/sbin/unwind/libunbound/util/rfc_1982.h b/sbin/unwind/libunbound/util/rfc_1982.h
new file mode 100644 (file)
index 0000000..bae383d
--- /dev/null
+++ b/sbin/unwind/libunbound/util/rfc_1982.h
@@ -0,0 +1,63 @@
+/*
+ * util/rfc_1982.h - RFC 1982 Serial Number Arithmetic
+ *
+ * Copyright (c) 2023, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions for RFC 1982 serial number arithmetic.
+ */
+#ifndef RFC_1982_H
+#define RFC_1982_H
+
+/**
+ * RFC 1982 comparison, uses unsigned integers, and tries to avoid
+ * compiler optimization (eg. by avoiding a-b<0 comparisons).
+ * @param a: value to compare.
+ * @param b: value to compare.
+ * @return 0 if equal, 1 if a > b, else -1.
+ */
+int compare_1982(uint32_t a, uint32_t b);
+
+/**
+ * RFC 1982 subtraction, uses unsigned integers, and tries to avoid
+ * compiler optimization (eg. by avoiding a-b<0 comparisons).
+ * @param a: value to subtract from.
+ * @param b: value to subtract.
+ * @return the difference between them if we know that b is larger than a,
+ *     that is the distance between them in serial number arithmetic.
+ */
+uint32_t subtract_1982(uint32_t a, uint32_t b);
+
+#endif /* RFC_1982_H */

diff --git a/sbin/unwind/libunbound/util/siphash.c b/sbin/unwind/libunbound/util/siphash.c
new file mode 100644 (file)
index 0000000..0e1b597
--- /dev/null
+++ b/sbin/unwind/libunbound/util/siphash.c
@@ -0,0 +1,187 @@
+/*
+   SipHash reference C implementation
+
+   Copyright (c) 2012-2016 Jean-Philippe Aumasson
+   <jeanphilippe.aumasson@gmail.com>
+   Copyright (c) 2012-2014 Daniel J. Bernstein <djb@cr.yp.to>
+
+   To the extent possible under law, the author(s) have dedicated all copyright
+   and related and neighboring rights to this software to the public domain
+   worldwide. This software is distributed without any warranty.
+
+   You should have received a copy of the CC0 Public Domain Dedication along
+   with
+   this software. If not, see
+   <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+/**
+ * Edited slightly for integration in Unbound. Edits are noted with 'EDIT'.
+ */
+/** EDIT
+ * \#include <assert.h>
+ * \#include <stdint.h>
+ * \#include <stdio.h>
+ * \#include <string.h>
+ * Replaced the above includes with Unbound's config.h
+ */
+#include "config.h"
+
+/* default: SipHash-2-4 */
+#define cROUNDS 2
+#define dROUNDS 4
+
+#define ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b))))
+
+#define U32TO8_LE(p, v)                                                        \
+    (p)[0] = (uint8_t)((v));                                                   \
+    (p)[1] = (uint8_t)((v) >> 8);                                              \
+    (p)[2] = (uint8_t)((v) >> 16);                                             \
+    (p)[3] = (uint8_t)((v) >> 24);
+
+#define U64TO8_LE(p, v)                                                        \
+    U32TO8_LE((p), (uint32_t)((v)));                                           \
+    U32TO8_LE((p) + 4, (uint32_t)((v) >> 32));
+
+#define U8TO64_LE(p)                                                           \
+    (((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) |                        \
+     ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) |                 \
+     ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) |                 \
+     ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
+
+#define SIPROUND                                                               \
+    do {                                                                       \
+        v0 += v1;                                                              \
+        v1 = ROTL(v1, 13);                                                     \
+        v1 ^= v0;                                                              \
+        v0 = ROTL(v0, 32);                                                     \
+        v2 += v3;                                                              \
+        v3 = ROTL(v3, 16);                                                     \
+        v3 ^= v2;                                                              \
+        v0 += v3;                                                              \
+        v3 = ROTL(v3, 21);                                                     \
+        v3 ^= v0;                                                              \
+        v2 += v1;                                                              \
+        v1 = ROTL(v1, 17);                                                     \
+        v1 ^= v2;                                                              \
+        v2 = ROTL(v2, 32);                                                     \
+    } while (0)
+
+#ifdef DEBUG
+#define TRACE                                                                  \
+    do {                                                                       \
+        printf("(%3d) v0 %08x %08x\n", (int)inlen, (uint32_t)(v0 >> 32),       \
+               (uint32_t)v0);                                                  \
+        printf("(%3d) v1 %08x %08x\n", (int)inlen, (uint32_t)(v1 >> 32),       \
+               (uint32_t)v1);                                                  \
+        printf("(%3d) v2 %08x %08x\n", (int)inlen, (uint32_t)(v2 >> 32),       \
+               (uint32_t)v2);                                                  \
+        printf("(%3d) v3 %08x %08x\n", (int)inlen, (uint32_t)(v3 >> 32),       \
+               (uint32_t)v3);                                                  \
+    } while (0)
+#else
+#define TRACE
+#endif
+
+int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
+            uint8_t *out, const size_t outlen) {
+
+    uint64_t v0 = 0x736f6d6570736575ULL;
+    uint64_t v1 = 0x646f72616e646f6dULL;
+    uint64_t v2 = 0x6c7967656e657261ULL;
+    uint64_t v3 = 0x7465646279746573ULL;
+    uint64_t k0 = U8TO64_LE(k);
+    uint64_t k1 = U8TO64_LE(k + 8);
+    uint64_t m;
+    int i;
+    const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t));
+    const int left = inlen & 7;
+    uint64_t b = ((uint64_t)inlen) << 56;
+    /** EDIT
+     * The following assert moved here from the top for C90 compliance.
+     */
+    assert((outlen == 8) || (outlen == 16));
+    v3 ^= k1;
+    v2 ^= k0;
+    v1 ^= k1;
+    v0 ^= k0;
+
+    if (outlen == 16)
+        v1 ^= 0xee;
+
+    for (; in != end; in += 8) {
+        m = U8TO64_LE(in);
+        v3 ^= m;
+
+        TRACE;
+        for (i = 0; i < cROUNDS; ++i)
+            SIPROUND;
+
+        v0 ^= m;
+    }
+
+    switch (left) {
+    case 7:
+        b |= ((uint64_t)in[6]) << 48;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 6:
+        b |= ((uint64_t)in[5]) << 40;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 5:
+        b |= ((uint64_t)in[4]) << 32;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 4:
+        b |= ((uint64_t)in[3]) << 24;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 3:
+        b |= ((uint64_t)in[2]) << 16;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 2:
+        b |= ((uint64_t)in[1]) << 8;
+        /** EDIT annotate case statement fallthrough for gcc */
+        /* fallthrough */
+    case 1:
+        b |= ((uint64_t)in[0]);
+        break;
+    case 0:
+        break;
+    }
+
+    v3 ^= b;
+
+    TRACE;
+    for (i = 0; i < cROUNDS; ++i)
+        SIPROUND;
+
+    v0 ^= b;
+
+    if (outlen == 16)
+        v2 ^= 0xee;
+    else
+        v2 ^= 0xff;
+
+    TRACE;
+    for (i = 0; i < dROUNDS; ++i)
+        SIPROUND;
+
+    b = v0 ^ v1 ^ v2 ^ v3;
+    U64TO8_LE(out, b);
+
+    if (outlen == 8)
+        return 0;
+
+    v1 ^= 0xdd;
+
+    TRACE;
+    for (i = 0; i < dROUNDS; ++i)
+        SIPROUND;
+
+    b = v0 ^ v1 ^ v2 ^ v3;
+    U64TO8_LE(out + 8, b);
+
+    return 0;
+}

diff --git a/sbin/unwind/libunbound/util/siphash.h b/sbin/unwind/libunbound/util/siphash.h
new file mode 100644 (file)
index 0000000..63da217
--- /dev/null
+++ b/sbin/unwind/libunbound/util/siphash.h
@@ -0,0 +1,43 @@
+/*
+ * util/siphash.h - header for SipHash reference C implementation.
+ *
+ * Copyright (c) 2023, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * \file
+ * Contains the SipHash reference C implementation.
+ */
+#ifndef UTIL_SIPHASH_H
+#define UTIL_SIPHASH_H
+int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
+            uint8_t *out, const size_t outlen);
+#endif /* UTIL_SIPHASH_H */

diff --git a/sbin/unwind/libunbound/util/storage/lruhash.c b/sbin/unwind/libunbound/util/storage/lruhash.c
index 3500a4e..e17b180 100644 (file)
--- a/sbin/unwind/libunbound/util/storage/lruhash.c
+++ b/sbin/unwind/libunbound/util/storage/lruhash.c
@@ -81,6 +81,7 @@ lruhash_create(size_t start_size, size_t maxmem,
        table->num = 0;
        table->space_used = 0;
        table->space_max = maxmem;
+       table->max_collisions = 0;
        table->array = calloc(table->size, sizeof(struct lruhash_bin));
        if(!table->array) {
                lock_quick_destroy(&table->lock);
@@ -216,15 +217,19 @@ reclaim_space(struct lruhash* table, struct lruhash_entry** list)
 
 struct lruhash_entry* 
 bin_find_entry(struct lruhash* table, 
-       struct lruhash_bin* bin, hashvalue_type hash, void* key)
+       struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions)
 {
+       size_t c = 0;
        struct lruhash_entry* p = bin->overflow_list;
        while(p) {
                if(p->hash == hash && table->compfunc(p->key, key) == 0)
-                       return p;
+                       break;
+               c++;
                p = p->overflow_next;
        }
-       return NULL;
+       if (collisions != NULL)
+               *collisions = c;
+       return p;
 }
 
 void 
@@ -303,6 +308,7 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash,
        struct lruhash_bin* bin;
        struct lruhash_entry* found, *reclaimlist=NULL;
        size_t need_size;
+       size_t collisions;
        fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc));
        fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
        fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
@@ -317,12 +323,14 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash,
        lock_quick_lock(&bin->lock);
 
        /* see if entry exists already */
-       if(!(found=bin_find_entry(table, bin, hash, entry->key))) {
+       if(!(found=bin_find_entry(table, bin, hash, entry->key, &collisions))) {
                /* if not: add to bin */
                entry->overflow_next = bin->overflow_list;
                bin->overflow_list = entry;
                lru_front(table, entry);
                table->num++;
+               if (table->max_collisions < collisions)
+                       table->max_collisions = collisions;
                table->space_used += need_size;
        } else {
                /* if so: update data - needs a writelock */
@@ -362,7 +370,7 @@ lruhash_lookup(struct lruhash* table, hashvalue_type hash, void* key, int wr)
        lock_quick_lock(&table->lock);
        bin = &table->array[hash & table->size_mask];
        lock_quick_lock(&bin->lock);
-       if((entry=bin_find_entry(table, bin, hash, key)))
+       if((entry=bin_find_entry(table, bin, hash, key, NULL)))
                lru_touch(table, entry);
        lock_quick_unlock(&table->lock);
 
@@ -389,7 +397,7 @@ lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key)
        lock_quick_lock(&table->lock);
        bin = &table->array[hash & table->size_mask];
        lock_quick_lock(&bin->lock);
-       if((entry=bin_find_entry(table, bin, hash, key))) {
+       if((entry=bin_find_entry(table, bin, hash, key, NULL))) {
                bin_overflow_remove(bin, entry);
                lru_remove(table, entry);
        } else {
@@ -579,6 +587,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash,
        struct lruhash_bin* bin;
        struct lruhash_entry* found, *reclaimlist = NULL;
        size_t need_size;
+       size_t collisions;
        fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc));
        fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
        fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
@@ -593,7 +602,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash,
        lock_quick_lock(&bin->lock);
 
        /* see if entry exists already */
-       if ((found = bin_find_entry(table, bin, hash, entry->key)) != NULL) {
+       if ((found = bin_find_entry(table, bin, hash, entry->key, &collisions)) != NULL) {
                /* if so: keep the existing data - acquire a writelock */
                lock_rw_wrlock(&found->lock);
        }
@@ -604,6 +613,8 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash,
                bin->overflow_list = entry;
                lru_front(table, entry);
                table->num++;
+               if (table->max_collisions < collisions)
+                       table->max_collisions = collisions;
                table->space_used += need_size;
                /* return the entry that was presented, and lock it */
                found = entry;

diff --git a/sbin/unwind/libunbound/util/storage/lruhash.h b/sbin/unwind/libunbound/util/storage/lruhash.h
index 4759b50..2086e4d 100644 (file)
--- a/sbin/unwind/libunbound/util/storage/lruhash.h
+++ b/sbin/unwind/libunbound/util/storage/lruhash.h
@@ -178,6 +178,8 @@ struct lruhash {
        size_t space_used;
        /** the amount of space the hash table is maximally allowed to use. */
        size_t space_max;
+       /** the maximum collisions were detected during the lruhash_insert operations. */
+       size_t max_collisions;
 };
 
 /**
@@ -357,10 +359,11 @@ void bin_delete(struct lruhash* table, struct lruhash_bin* bin);
  * @param bin: hash bin to look into.
  * @param hash: hash value to look for.
  * @param key: key to look for.
+ * @param collisions: how many collisions were found during the search.
  * @return: the entry or NULL if not found.
  */
 struct lruhash_entry* bin_find_entry(struct lruhash* table, 
-       struct lruhash_bin* bin, hashvalue_type hash, void* key);
+       struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions);
 
 /**
  * Remove entry from bin overflow chain.

diff --git a/sbin/unwind/libunbound/util/storage/slabhash.c b/sbin/unwind/libunbound/util/storage/slabhash.c
index a6c3d0f..7d376c4 100644 (file)
--- a/sbin/unwind/libunbound/util/storage/slabhash.c
+++ b/sbin/unwind/libunbound/util/storage/slabhash.c
@@ -242,3 +242,21 @@ size_t count_slabhash_entries(struct slabhash* sh)
        }
        return cnt;
 }
+
+void get_slabhash_stats(struct slabhash* sh, long long* num, long long* collisions)
+{
+       size_t slab, cnt = 0, max_collisions = 0;
+
+       for(slab=0; slab<sh->size; slab++) {
+               lock_quick_lock(&sh->array[slab]->lock);
+               cnt += sh->array[slab]->num;
+               if (max_collisions < sh->array[slab]->max_collisions) {
+                       max_collisions = sh->array[slab]->max_collisions;
+               }
+               lock_quick_unlock(&sh->array[slab]->lock);
+       }
+       if (num != NULL)
+               *num = cnt;
+       if (collisions != NULL)
+               *collisions = max_collisions;
+}

diff --git a/sbin/unwind/libunbound/util/storage/slabhash.h b/sbin/unwind/libunbound/util/storage/slabhash.h
index 4ecb604..dc5fc36 100644 (file)
--- a/sbin/unwind/libunbound/util/storage/slabhash.h
+++ b/sbin/unwind/libunbound/util/storage/slabhash.h
@@ -200,6 +200,15 @@ void slabhash_traverse(struct slabhash* table, int wr,
  */
 size_t count_slabhash_entries(struct slabhash* table);
 
+/**
+ * Retrieves number of items in slabhash and the current max collision level
+ * @param table: slabbed hash table.
+ * @param entries_count: where to save the current number of elements.
+ * @param max_collisions: where to save the current max collisions level.
+ */
+void get_slabhash_stats(struct slabhash* table,
+       long long* entries_count, long long* max_collisions);
+
 /* --- test representation --- */
 /** test structure contains test key */
 struct slabhash_testkey {

diff --git a/sbin/unwind/libunbound/util/timehist.c b/sbin/unwind/libunbound/util/timehist.c
index 61cc995..2063fe8 100644 (file)
--- a/sbin/unwind/libunbound/util/timehist.c
+++ b/sbin/unwind/libunbound/util/timehist.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -46,6 +46,7 @@
 #include <sys/types.h>
 #include "util/timehist.h"
 #include "util/log.h"
+#include "util/timeval_func.h"
 
 /** special timestwo operation for time values in histogram setup */
 static void
@@ -83,12 +84,12 @@ dosetup(struct timehist* hist)
 
 struct timehist* timehist_setup(void)
 {
-       struct timehist* hist = (struct timehist*)calloc(1, 
+       struct timehist* hist = (struct timehist*)calloc(1,
                sizeof(struct timehist));
        if(!hist)
                return NULL;
        hist->num = NUM_BUCKETS_HIST;
-       hist->buckets = (struct th_buck*)calloc(hist->num, 
+       hist->buckets = (struct th_buck*)calloc(hist->num,
                sizeof(struct th_buck));
        if(!hist->buckets) {
                free(hist);
@@ -114,23 +115,6 @@ void timehist_clear(struct timehist* hist)
                hist->buckets[i].count = 0;
 }
 
-/** histogram compare of time values */
-static int
-timeval_smaller(const struct timeval* x, const struct timeval* y)
-{
-#ifndef S_SPLINT_S
-       if(x->tv_sec < y->tv_sec)
-               return 1;
-       else if(x->tv_sec == y->tv_sec) {
-               if(x->tv_usec <= y->tv_usec)
-                       return 1;
-               else    return 0;
-       }
-       else    return 0;
-#endif
-}
-
-
 void timehist_insert(struct timehist* hist, struct timeval* tv)
 {
        size_t i;
@@ -194,7 +178,7 @@ timehist_count(struct timehist* hist)
        return res;
 }
 
-double 
+double
 timehist_quartile(struct timehist* hist, double q)
 {
        double lookfor, passed, res;
@@ -209,22 +193,22 @@ timehist_quartile(struct timehist* hist, double q)
        lookfor *= q;
        passed = 0;
        i = 0;
-       while(i+1 < hist->num && 
+       while(i+1 < hist->num &&
                passed+(double)hist->buckets[i].count < lookfor) {
                passed += (double)hist->buckets[i++].count;
        }
        /* got the right bucket */
 #ifndef S_SPLINT_S
-       low = (double)hist->buckets[i].lower.tv_sec + 
+       low = (double)hist->buckets[i].lower.tv_sec +
                (double)hist->buckets[i].lower.tv_usec/1000000.;
-       up = (double)hist->buckets[i].upper.tv_sec + 
+       up = (double)hist->buckets[i].upper.tv_sec +
                (double)hist->buckets[i].upper.tv_usec/1000000.;
 #endif
        res = (lookfor - passed)*(up-low)/((double)hist->buckets[i].count);
        return low+res;
 }
 
-void 
+void
 timehist_export(struct timehist* hist, long long* array, size_t sz)
 {
        size_t i;
@@ -235,7 +219,7 @@ timehist_export(struct timehist* hist, long long* array, size_t sz)
                array[i] = (long long)hist->buckets[i].count;
 }
 
-void 
+void
 timehist_import(struct timehist* hist, long long* array, size_t sz)
 {
        size_t i;

diff --git a/sbin/unwind/libunbound/util/timeval_func.c b/sbin/unwind/libunbound/util/timeval_func.c
new file mode 100644 (file)
index 0000000..90250e1
--- /dev/null
+++ b/sbin/unwind/libunbound/util/timeval_func.c
@@ -0,0 +1,113 @@
+/*
+ * util/timeval_func.c - helpers to work with struct timeval values.
+ *
+ * Copyright (c) 2023, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains helpers to manipulate struct timeval values.
+ */
+
+#include "config.h"
+#include "timeval_func.h"
+
+/** subtract timers and the values do not overflow or become negative */
+void
+timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
+{
+#ifndef S_SPLINT_S
+       time_t end_usec = end->tv_usec;
+       d->tv_sec = end->tv_sec - start->tv_sec;
+       if(end_usec < start->tv_usec) {
+               end_usec += 1000000;
+               d->tv_sec--;
+       }
+       d->tv_usec = end_usec - start->tv_usec;
+#endif
+}
+
+/** add timers and the values do not overflow or become negative */
+void
+timeval_add(struct timeval* d, const struct timeval* add)
+{
+#ifndef S_SPLINT_S
+       d->tv_sec += add->tv_sec;
+       d->tv_usec += add->tv_usec;
+       if(d->tv_usec >= 1000000 ) {
+               d->tv_usec -= 1000000;
+               d->tv_sec++;
+       }
+#endif
+}
+
+/** divide sum of timers to get average */
+void
+timeval_divide(struct timeval* avg, const struct timeval* sum, long long d)
+{
+#ifndef S_SPLINT_S
+       long long leftover;
+       if(d <= 0) {
+               avg->tv_sec = 0;
+               avg->tv_usec = 0;
+               return;
+       }
+       avg->tv_sec = sum->tv_sec / d;
+       avg->tv_usec = sum->tv_usec / d;
+       /* handle fraction from seconds divide */
+       leftover = sum->tv_sec - avg->tv_sec*d;
+       if(leftover <= 0)
+               leftover = 0;
+       avg->tv_usec += (((long long)leftover)*((long long)1000000))/d;
+       if(avg->tv_sec < 0)
+               avg->tv_sec = 0;
+       if(avg->tv_usec < 0)
+               avg->tv_usec = 0;
+#endif
+}
+
+/** histogram compare of time values */
+int
+timeval_smaller(const struct timeval* x, const struct timeval* y)
+{
+#ifndef S_SPLINT_S
+       if(x->tv_sec < y->tv_sec)
+               return 1;
+       else if(x->tv_sec == y->tv_sec) {
+               if(x->tv_usec <= y->tv_usec)
+                       return 1;
+               else    return 0;
+       }
+       else    return 0;
+#endif
+}

diff --git a/sbin/unwind/libunbound/util/timeval_func.h b/sbin/unwind/libunbound/util/timeval_func.h
new file mode 100644 (file)
index 0000000..819d1dd
--- /dev/null
+++ b/sbin/unwind/libunbound/util/timeval_func.h
@@ -0,0 +1,53 @@
+/*
+ * util/timeval_func.h - definitions of helpers for struct timeval values.
+ *
+ * Copyright (c) 2023, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains definitions of helpers to manipulate struct timeval
+ * values, implemented in the corresponding C file.
+ */
+#include <sys/time.h>
+
+#ifndef timeval_isset
+#define timeval_isset(tv) ((tv)->tv_sec || (tv)->tv_usec)
+#endif
+#ifndef timeval_clear
+#define timeval_clear(tv) ((tv)->tv_sec = (tv)->tv_usec = 0)
+#endif
+void timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start);
+void timeval_add(struct timeval* d, const struct timeval* add);
+void timeval_divide(struct timeval* avg, const struct timeval* sum, long long d);
+int timeval_smaller(const struct timeval* x, const struct timeval* y);

diff --git a/sbin/unwind/libunbound/util/tube.c b/sbin/unwind/libunbound/util/tube.c
index 43455fe..4881d80 100644 (file)
--- a/sbin/unwind/libunbound/util/tube.c
+++ b/sbin/unwind/libunbound/util/tube.c
@@ -45,6 +45,9 @@
 #include "util/netevent.h"
 #include "util/fptr_wlist.h"
 #include "util/ub_event.h"
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#endif
 
 #ifndef USE_WINSOCK
 /* on unix */
@@ -396,20 +399,28 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
        return 1;
 }
 
-/** perform a select() on the fd */
+/** perform poll() on the fd */
 static int
 pollit(int fd, struct timeval* t)
 {
-       fd_set r;
+       struct pollfd fds;
+       int pret;
+       int msec = -1;
+       memset(&fds, 0, sizeof(fds));
+       fds.fd = fd;
+       fds.events = POLLIN | POLLERR | POLLHUP;
 #ifndef S_SPLINT_S
-       FD_ZERO(&r);
-       FD_SET(FD_SET_T fd, &r);
+       if(t)
+               msec = t->tv_sec*1000 + t->tv_usec/1000;
 #endif
-       if(select(fd+1, &r, NULL, NULL, t) == -1) {
+
+       pret = poll(&fds, 1, msec);
+
+       if(pret == -1)
+               return 0;
+       if(pret != 0)
+               return 1;
                return 0;
-       }
-       errno = 0;
-       return (int)(FD_ISSET(fd, &r));
 }
 
 int tube_poll(struct tube* tube)
@@ -426,24 +437,27 @@ int tube_wait(struct tube* tube)
 
 int tube_wait_timeout(struct tube* tube, int msec)
 {
-       struct timeval t;
-       int fd = tube->sr;
-       fd_set r;
-       t.tv_sec = msec/1000;
-       t.tv_usec = (msec%1000)*1000;
-#ifndef S_SPLINT_S
-       FD_ZERO(&r);
-       FD_SET(FD_SET_T fd, &r);
-#endif
+       int ret = 0;
+
        while(1) {
-               if(select(fd+1, &r, NULL, NULL, &t) == -1) {
+               struct pollfd fds;
+               memset(&fds, 0, sizeof(fds));
+
+               fds.fd = tube->sr;
+               fds.events = POLLIN | POLLERR | POLLHUP;
+               ret = poll(&fds, 1, msec);
+
+               if(ret == -1) {
                        if(errno == EAGAIN || errno == EINTR)
                                continue;
                        return -1;
                }
                break;
        }
-       return (int)(FD_ISSET(fd, &r));
+
+       if(ret != 0)
+               return 1;
+       return 0;
 }
 
 int tube_read_fd(struct tube* tube)
@@ -529,6 +543,7 @@ struct tube* tube_create(void)
        if(tube->event == WSA_INVALID_EVENT) {
                free(tube);
                log_err("WSACreateEvent: %s", wsa_strerror(WSAGetLastError()));
+               return NULL;
        }
        if(!WSAResetEvent(tube->event)) {
                log_err("WSAResetEvent: %s", wsa_strerror(WSAGetLastError()));

diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c
index 3cdf9ce..3011a0a 100644 (file)
--- a/sbin/unwind/libunbound/validator/autotrust.c
+++ b/sbin/unwind/libunbound/validator/autotrust.c
@@ -2376,6 +2376,8 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
        edns.opt_list_out = NULL;
        edns.opt_list_inplace_cb_out = NULL;
        edns.padding_block_size = 0;
+       edns.cookie_present = 0;
+       edns.cookie_valid = 0;
        if(sldns_buffer_capacity(buf) < 65535)
                edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
        else    edns.udp_size = 65535;

diff --git a/sbin/unwind/libunbound/validator/val_kcache.c b/sbin/unwind/libunbound/validator/val_kcache.c
index c190085..f5d49d2 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_kcache.c
+++ b/sbin/unwind/libunbound/validator/val_kcache.c
@@ -81,17 +81,11 @@ key_cache_delete(struct key_cache* kcache)
 
 void 
 key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey,
-       struct module_qstate* qstate)
+       int copy_reason)
 {
-       struct key_entry_key* k = key_entry_copy(kkey);
+       struct key_entry_key* k = key_entry_copy(kkey, copy_reason);
        if(!k)
                return;
-       if(key_entry_isbad(k) && qstate->errinf &&
-               qstate->env->cfg->val_log_level >= 2) {
-               /* on malloc failure there is simply no reason string */
-               key_entry_set_reason(k, errinf_to_str_bogus(qstate));
-               key_entry_set_reason_bogus(k, errinf_to_reason_bogus(qstate));
-       }
        key_entry_hash(k);
        slabhash_insert(kcache->slab, k->entry.hash, &k->entry, 
                k->entry.data, NULL);

diff --git a/sbin/unwind/libunbound/validator/val_kcache.h b/sbin/unwind/libunbound/validator/val_kcache.h
index 76c9dd0..df8de09 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_kcache.h
+++ b/sbin/unwind/libunbound/validator/val_kcache.h
@@ -76,10 +76,10 @@ void key_cache_delete(struct key_cache* kcache);
  * @param kcache: the key cache.
  * @param kkey: key entry key, assumed malloced in a region, is copied
  *     to perform update or insertion. Its data pointer is also copied.
- * @param qstate: store errinf reason in case its bad.
+ * @param copy_reason: if the reason string needs to be copied (allocated).
  */
 void key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey,
-       struct module_qstate* qstate);
+       int copy_reason);
 
 /**
  * Remove an entry from the key cache.

diff --git a/sbin/unwind/libunbound/validator/val_kentry.c b/sbin/unwind/libunbound/validator/val_kentry.c
index a47feba..85f0264 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_kentry.c
+++ b/sbin/unwind/libunbound/validator/val_kentry.c
@@ -152,7 +152,7 @@ key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region)
 }
 
 struct key_entry_key* 
-key_entry_copy(struct key_entry_key* kkey)
+key_entry_copy(struct key_entry_key* kkey, int copy_reason)
 {
        struct key_entry_key* newk;
        if(!kkey)
@@ -190,7 +190,7 @@ key_entry_copy(struct key_entry_key* kkey)
                        }
                        packed_rrset_ptr_fixup(newd->rrset_data);
                }
-               if(d->reason) {
+               if(copy_reason && d->reason && *d->reason != 0) {
                        newd->reason = strdup(d->reason);
                        if(!newd->reason) {
                                free(newd->rrset_data);
@@ -199,6 +199,8 @@ key_entry_copy(struct key_entry_key* kkey)
                                free(newk);
                                return NULL;
                        }
+               } else {
+                       newd->reason = NULL;
                }
                if(d->algo) {
                        newd->algo = (uint8_t*)strdup((char*)d->algo);
@@ -237,22 +239,6 @@ key_entry_isbad(struct key_entry_key* kkey)
        return (int)(d->isbad);
 }
 
-void
-key_entry_set_reason(struct key_entry_key* kkey, char* reason)
-{
-       struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
-       d->reason = reason;
-}
-
-void
-key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede)
-{
-       struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
-       if (ede != LDNS_EDE_NONE) { /* reason_bogus init is LDNS_EDE_NONE already */
-               d->reason_bogus = ede;
-       }
-}
-
 char*
 key_entry_get_reason(struct key_entry_key* kkey)
 {
@@ -294,6 +280,7 @@ key_entry_setup(struct regional* region,
 struct key_entry_key* 
 key_entry_create_null(struct regional* region,
        uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
+       sldns_ede_code reason_bogus, const char* reason,
        time_t now)
 {
        struct key_entry_key* k;
@@ -302,8 +289,10 @@ key_entry_create_null(struct regional* region,
                return NULL;
        d->ttl = now + ttl;
        d->isbad = 0;
-       d->reason = NULL;
-       d->reason_bogus = LDNS_EDE_NONE;
+       d->reason = (!reason || *reason == 0)
+               ?NULL :(char*)regional_strdup(region, reason);
+               /* On allocation error we don't store the reason string */
+       d->reason_bogus = reason_bogus;
        d->rrset_type = LDNS_RR_TYPE_DNSKEY;
        d->rrset_data = NULL;
        d->algo = NULL;
@@ -313,7 +302,9 @@ key_entry_create_null(struct regional* region,
 struct key_entry_key* 
 key_entry_create_rrset(struct regional* region,
        uint8_t* name, size_t namelen, uint16_t dclass,
-       struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now)
+       struct ub_packed_rrset_key* rrset, uint8_t* sigalg,
+       sldns_ede_code reason_bogus, const char* reason,
+       time_t now)
 {
        struct key_entry_key* k;
        struct key_entry_data* d;
@@ -323,8 +314,10 @@ key_entry_create_rrset(struct regional* region,
                return NULL;
        d->ttl = rd->ttl + now;
        d->isbad = 0;
-       d->reason = NULL;
-       d->reason_bogus = LDNS_EDE_NONE;
+       d->reason = (!reason || *reason == 0)
+               ?NULL :(char*)regional_strdup(region, reason);
+               /* On allocation error we don't store the reason string */
+       d->reason_bogus = reason_bogus;
        d->rrset_type = ntohs(rrset->rk.type);
        d->rrset_data = (struct packed_rrset_data*)regional_alloc_init(region,
                rd, packed_rrset_sizeof(rd));
@@ -341,7 +334,8 @@ key_entry_create_rrset(struct regional* region,
 
 struct key_entry_key* 
 key_entry_create_bad(struct regional* region,
-       uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, 
+       uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
+       sldns_ede_code reason_bogus, const char* reason,
        time_t now)
 {
        struct key_entry_key* k;
@@ -350,8 +344,10 @@ key_entry_create_bad(struct regional* region,
                return NULL;
        d->ttl = now + ttl;
        d->isbad = 1;
-       d->reason = NULL;
-       d->reason_bogus = LDNS_EDE_NONE;
+       d->reason = (!reason || *reason == 0)
+               ?NULL :(char*)regional_strdup(region, reason);
+               /* On allocation error we don't store the reason string */
+       d->reason_bogus = reason_bogus;
        d->rrset_type = LDNS_RR_TYPE_DNSKEY;
        d->rrset_data = NULL;
        d->algo = NULL;

diff --git a/sbin/unwind/libunbound/validator/val_kentry.h b/sbin/unwind/libunbound/validator/val_kentry.h
index ded45be..ca9f0da 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_kentry.h
+++ b/sbin/unwind/libunbound/validator/val_kentry.h
@@ -120,9 +120,11 @@ struct key_entry_key* key_entry_copy_toregion(struct key_entry_key* kkey,
 /**
  * Copy a key entry, malloced.
  * @param kkey: the key entry key (and data pointer) to copy.
+ * @param copy_reason: if the reason string needs to be copied (allocated).
  * @return newly allocated entry or NULL on a failure to allocate memory.
  */
-struct key_entry_key* key_entry_copy(struct key_entry_key* kkey);
+struct key_entry_key* key_entry_copy(struct key_entry_key* kkey,
+       int copy_reason);
 
 /**
  * See if this is a null entry. Does not do locking.
@@ -145,23 +147,6 @@ int key_entry_isgood(struct key_entry_key* kkey);
  */
 int key_entry_isbad(struct key_entry_key* kkey);
 
-/**
- * Set reason why a key is bad.
- * @param kkey: bad key.
- * @param reason: string to attach, you must allocate it.
- *    Not safe to call twice unless you deallocate it yourself.
- */
-void key_entry_set_reason(struct key_entry_key* kkey, char* reason);
-
-/**
- * Set the EDE (RFC8914) code why the key is bad, if it
- * exists (so not LDNS_EDE_NONE).
- * @param kkey: bad key.
- * @param ede: EDE code to attach to this key.
- */
-void key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede);
-
-
 /**
  * Get reason why a key is bad.
  * @param kkey: bad key
@@ -184,11 +169,14 @@ sldns_ede_code key_entry_get_reason_bogus(struct key_entry_key* kkey);
  * @param namelen: length of name
  * @param dclass: class of key entry. (host order);
  * @param ttl: what ttl should the key have. relative.
+ * @param reason_bogus: accompanying EDE code.
+ * @param reason: accompanying NULL-terminated EDE string (or NULL).
  * @param now: current time (added to ttl).
  * @return new key entry or NULL on alloc failure
  */
 struct key_entry_key* key_entry_create_null(struct regional* region,
-       uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, 
+       uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
+       sldns_ede_code reason_bogus, const char* reason,
        time_t now);
 
 /**
@@ -199,12 +187,16 @@ struct key_entry_key* key_entry_create_null(struct regional* region,
  * @param dclass: class of key entry. (host order);
  * @param rrset: data for key entry. This is copied to the region.
  * @param sigalg: signalled algorithm list (or NULL).
+ * @param reason_bogus: accompanying EDE code (usually LDNS_EDE_NONE).
+ * @param reason: accompanying NULL-terminated EDE string (or NULL).
  * @param now: current time (added to ttl of rrset)
  * @return new key entry or NULL on alloc failure
  */
 struct key_entry_key* key_entry_create_rrset(struct regional* region,
-        uint8_t* name, size_t namelen, uint16_t dclass, 
-       struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now);
+       uint8_t* name, size_t namelen, uint16_t dclass,
+       struct ub_packed_rrset_key* rrset, uint8_t* sigalg,
+       sldns_ede_code reason_bogus, const char* reason,
+       time_t now);
 
 /**
  * Create a bad entry, in the given region.
@@ -213,11 +205,14 @@ struct key_entry_key* key_entry_create_rrset(struct regional* region,
  * @param namelen: length of name
  * @param dclass: class of key entry. (host order);
  * @param ttl: what ttl should the key have. relative.
+ * @param reason_bogus: accompanying EDE code.
+ * @param reason: accompanying NULL-terminated EDE string (or NULL).
  * @param now: current time (added to ttl).
  * @return new key entry or NULL on alloc failure
  */
 struct key_entry_key* key_entry_create_bad(struct regional* region,
        uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
+       sldns_ede_code reason_bogus, const char* reason,
        time_t now);
 
 /**

diff --git a/sbin/unwind/libunbound/validator/val_neg.c b/sbin/unwind/libunbound/validator/val_neg.c
index 67699b1..52bc683 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_neg.c
+++ b/sbin/unwind/libunbound/validator/val_neg.c
@@ -43,7 +43,7 @@
  */
 #include "config.h"
 #ifdef HAVE_OPENSSL_SSL_H
-#include "openssl/ssl.h"
+#include <openssl/ssl.h>
 #define NSEC3_SHA_LEN SHA_DIGEST_LENGTH
 #else
 #define NSEC3_SHA_LEN 20
@@ -1407,6 +1407,11 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
        /* Matching NSEC, use to generate No Data answer. Not creating answers
         * yet for No Data proven using wildcard. */
        if(nsec && nsec_proves_nodata(nsec, qinfo, &nodata_wc) && !nodata_wc) {
+               /* do not create nodata answers for qtype ANY, it is a query
+                * type, not an rrtype to disprove. Nameerrors are useful for
+                * qtype ANY, in the else branch. */
+               if(qinfo->qtype == LDNS_RR_TYPE_ANY)
+                       return NULL;
                if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len, 
                        qinfo->qtype, qinfo->qclass, region, 2))) 
                        return NULL;

diff --git a/sbin/unwind/libunbound/validator/val_nsec.c b/sbin/unwind/libunbound/validator/val_nsec.c
index 876bfab..17c90d8 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_nsec.c
+++ b/sbin/unwind/libunbound/validator/val_nsec.c
@@ -174,9 +174,10 @@ val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec,
 
 /** check security status from cache or verify rrset, returns true if secure */
 static int
-nsec_verify_rrset(struct module_env* env, struct val_env* ve, 
-       struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey, 
-       char** reason, struct module_qstate* qstate)
+nsec_verify_rrset(struct module_env* env, struct val_env* ve,
+       struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey,
+       char** reason, sldns_ede_code* reason_bogus,
+       struct module_qstate* qstate)
 {
        struct packed_rrset_data* d = (struct packed_rrset_data*)
                nsec->entry.data;
@@ -187,7 +188,7 @@ nsec_verify_rrset(struct module_env* env, struct val_env* ve,
        if(d->security == sec_status_secure)
                return 1;
        d->security = val_verify_rrset_entry(env, ve, nsec, kkey, reason,
-               NULL, LDNS_SECTION_AUTHORITY, qstate);
+               reason_bogus, LDNS_SECTION_AUTHORITY, qstate);
        if(d->security == sec_status_secure) {
                rrset_update_sec_status(env->rrset_cache, nsec, *env->now);
                return 1;
@@ -199,7 +200,7 @@ enum sec_status
 val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, 
        struct query_info* qinfo, struct reply_info* rep, 
        struct key_entry_key* kkey, time_t* proof_ttl, char** reason,
-       struct module_qstate* qstate)
+       sldns_ede_code* reason_bogus, struct module_qstate* qstate)
 {
        struct ub_packed_rrset_key* nsec = reply_find_rrset_section_ns(
                rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC, 
@@ -216,7 +217,8 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
         * 1) this is a delegation point and there is no DS
         * 2) this is not a delegation point */
        if(nsec) {
-               if(!nsec_verify_rrset(env, ve, nsec, kkey, reason, qstate)) {
+               if(!nsec_verify_rrset(env, ve, nsec, kkey, reason,
+                       reason_bogus, qstate)) {
                        verbose(VERB_ALGO, "NSEC RRset for the "
                                "referral did not verify.");
                        return sec_status_bogus;
@@ -225,6 +227,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
                if(sec == sec_status_bogus) {
                        /* something was wrong. */
                        *reason = "NSEC does not prove absence of DS";
+                       *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
                        return sec;
                } else if(sec == sec_status_insecure) {
                        /* this wasn't a delegation point. */
@@ -246,9 +249,11 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
                if(rep->rrsets[i]->rk.type != htons(LDNS_RR_TYPE_NSEC))
                        continue;
                if(!nsec_verify_rrset(env, ve, rep->rrsets[i], kkey, reason,
-                       qstate)) {
+                       reason_bogus, qstate)) {
                        verbose(VERB_ALGO, "NSEC for empty non-terminal "
                                "did not verify.");
+                       *reason = "NSEC for empty non-terminal "
+                               "did not verify.";
                        return sec_status_bogus;
                }
                if(nsec_proves_nodata(rep->rrsets[i], qinfo, &wc)) {

diff --git a/sbin/unwind/libunbound/validator/val_nsec.h b/sbin/unwind/libunbound/validator/val_nsec.h
index 7117809..81844c9 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_nsec.h
+++ b/sbin/unwind/libunbound/validator/val_nsec.h
@@ -44,6 +44,7 @@
 #ifndef VALIDATOR_VAL_NSEC_H
 #define VALIDATOR_VAL_NSEC_H
 #include "util/data/packed_rrset.h"
+#include "sldns/rrdef.h"
 struct val_env;
 struct module_env;
 struct module_qstate;
@@ -65,6 +66,7 @@ struct key_entry_key;
  * @param kkey: key entry to use for verification of signatures.
  * @param proof_ttl: if secure, the TTL of how long this proof lasts.
  * @param reason: string explaining why bogus.
+ * @param reason_bogus: relevant EDE code for validation failure.
  * @param qstate: qstate with region.
  * @return security status.
  *     SECURE: proved absence of DS.
@@ -75,7 +77,8 @@ struct key_entry_key;
 enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env,
        struct val_env* ve, struct query_info* qinfo, 
        struct reply_info* rep, struct key_entry_key* kkey,
-       time_t* proof_ttl, char** reason, struct module_qstate* qstate);
+       time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus,
+       struct module_qstate* qstate);
 
 /** 
  * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type.

diff --git a/sbin/unwind/libunbound/validator/val_sigcrypt.c b/sbin/unwind/libunbound/validator/val_sigcrypt.c
index 5ab21e2..37730f1 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_sigcrypt.c
+++ b/sbin/unwind/libunbound/validator/val_sigcrypt.c
@@ -48,6 +48,7 @@
 #include "util/data/msgparse.h"
 #include "util/data/dname.h"
 #include "util/rbtree.h"
+#include "util/rfc_1982.h"
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
@@ -718,9 +719,9 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
        }
        verbose(VERB_ALGO, "rrset failed to verify: all signatures are bogus");
        if(!numchecked) {
-               *reason = "signature missing";
+               *reason = "signature for expected key and algorithm missing";
                if(reason_bogus)
-                       *reason_bogus = LDNS_EDE_RRSIGS_MISSING;
+                       *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
        } else if(numchecked == numindeterminate) {
                verbose(VERB_ALGO, "rrset failed to verify due to algorithm "
                        "refusal by cryptolib");
@@ -1378,44 +1379,6 @@ sigdate_error(const char* str, int32_t expi, int32_t incep, int32_t now)
                        (unsigned)incep, (unsigned)now);
 }
 
-/** RFC 1982 comparison, uses unsigned integers, and tries to avoid
- * compiler optimization (eg. by avoiding a-b<0 comparisons),
- * this routine matches compare_serial(), for SOA serial number checks */
-static int
-compare_1982(uint32_t a, uint32_t b)
-{
-       /* for 32 bit values */
-        const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
-
-        if (a == b) {
-                return 0;
-        } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) {
-                return -1;
-        } else {
-                return 1;
-        }
-}
-
-/** if we know that b is larger than a, return the difference between them,
- * that is the distance between them. in RFC1982 arith */
-static uint32_t
-subtract_1982(uint32_t a, uint32_t b)
-{
-       /* for 32 bit values */
-        const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
-
-       if(a == b)
-               return 0;
-       if(a < b && b - a < cutoff) {
-               return b-a;
-       }
-       if(a > b && a - b > cutoff) {
-               return ((uint32_t)0xffffffff) - (a-b-1);
-       }
-       /* wrong case, b smaller than a */
-       return 0;
-}
-
 /** check rrsig dates */
 static int
 check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p,

diff --git a/sbin/unwind/libunbound/validator/val_utils.c b/sbin/unwind/libunbound/validator/val_utils.c
index e2319ee..8b38888 100644 (file)
--- a/sbin/unwind/libunbound/validator/val_utils.c
+++ b/sbin/unwind/libunbound/validator/val_utils.c
@@ -587,16 +587,18 @@ val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
                return key_entry_create_rrset(region, 
                        ds_rrset->rk.dname, ds_rrset->rk.dname_len,
                        ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
-                       downprot?sigalg:NULL, *env->now);
+                       downprot?sigalg:NULL, LDNS_EDE_NONE, NULL,
+                       *env->now);
        } else if(sec == sec_status_insecure) {
                return key_entry_create_null(region, ds_rrset->rk.dname,
-                       ds_rrset->rk.dname_len, 
+                       ds_rrset->rk.dname_len,
                        ntohs(ds_rrset->rk.rrset_class),
-                       rrset_get_ttl(ds_rrset), *env->now);
+                       rrset_get_ttl(ds_rrset), *reason_bogus, *reason,
+                       *env->now);
        }
        return key_entry_create_bad(region, ds_rrset->rk.dname,
                ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class),
-               BOGUS_KEY_TTL, *env->now);
+               BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now);
 }
 
 enum sec_status
@@ -694,7 +696,7 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
                has_useful_ta = 1;
 
                sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
-                       ta_dnskey, i, reason, NULL, LDNS_SECTION_ANSWER, qstate);
+                       ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate);
                if(sec == sec_status_secure) {
                        if(!sigalg || algo_needs_set_secure(&needs,
                                (uint8_t)dnskey_get_algo(ta_dnskey, i))) {
@@ -743,16 +745,17 @@ val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
                return key_entry_create_rrset(region,
                        dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len,
                        ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset,
-                       downprot?sigalg:NULL, *env->now);
+                       downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now);
        } else if(sec == sec_status_insecure) {
                return key_entry_create_null(region, dnskey_rrset->rk.dname,
                        dnskey_rrset->rk.dname_len,
                        ntohs(dnskey_rrset->rk.rrset_class),
-                       rrset_get_ttl(dnskey_rrset), *env->now);
+                       rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason,
+                       *env->now);
        }
        return key_entry_create_bad(region, dnskey_rrset->rk.dname,
                dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class),
-               BOGUS_KEY_TTL, *env->now);
+               BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now);
 }
 
 int

diff --git a/sbin/unwind/libunbound/validator/validator.c b/sbin/unwind/libunbound/validator/validator.c
index 1723afe..9de9d54 100644 (file)
--- a/sbin/unwind/libunbound/validator/validator.c
+++ b/sbin/unwind/libunbound/validator/validator.c
@@ -70,16 +70,16 @@ static void process_ds_response(struct module_qstate* qstate,
        struct query_info* qinfo, struct sock_list* origin);
 
 
-/* Updates the suplied EDE (RFC8914) code selectively so we don't loose
- * a more specific code
- */
+/* Updates the suplied EDE (RFC8914) code selectively so we don't lose
+ * a more specific code */
 static void
 update_reason_bogus(struct reply_info* rep, sldns_ede_code reason_bogus)
 {
-       if (rep->reason_bogus == LDNS_EDE_DNSSEC_BOGUS ||
-               rep->reason_bogus == LDNS_EDE_NONE) {
-               rep->reason_bogus = reason_bogus;
-       }
+       if(reason_bogus == LDNS_EDE_NONE) return;
+       if(reason_bogus == LDNS_EDE_DNSSEC_BOGUS
+               && rep->reason_bogus != LDNS_EDE_NONE
+               && rep->reason_bogus != LDNS_EDE_DNSSEC_BOGUS) return;
+       rep->reason_bogus = reason_bogus;
 }
 
 
@@ -1672,20 +1672,13 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
                vq->state = VAL_FINISHED_STATE;
                return 1;
        } else if(key_entry_isbad(vq->key_entry)) {
-               sldns_ede_code ede = LDNS_EDE_DNSSEC_BOGUS;
-
-               /* the key could have a more spefic EDE than just bogus */
-               if(key_entry_get_reason_bogus(vq->key_entry) != LDNS_EDE_NONE) {
-                       ede = key_entry_get_reason_bogus(vq->key_entry);
-               }
-
+               /* Bad keys should have the relevant EDE code and text */
+               sldns_ede_code ede = key_entry_get_reason_bogus(vq->key_entry);
                /* key is bad, chain is bad, reply is bogus */
                errinf_dname(qstate, "key for validation", vq->key_entry->name);
                errinf_ede(qstate, "is marked as invalid", ede);
-               if(key_entry_get_reason(vq->key_entry)) {
-                       errinf(qstate, "because of a previous");
-                       errinf(qstate, key_entry_get_reason(vq->key_entry));
-               }
+               errinf(qstate, "because of a previous");
+               errinf(qstate, key_entry_get_reason(vq->key_entry));
 
                /* no retries, stop bothering the authority until timeout */
                vq->restart_count = ve->max_restart;
@@ -1888,7 +1881,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
                vq->chase_reply->security = sec_status_insecure;
                val_mark_insecure(vq->chase_reply, vq->key_entry->name, 
                        qstate->env->rrset_cache, qstate->env);
-               key_cache_insert(ve->kcache, vq->key_entry, qstate);
+               key_cache_insert(ve->kcache, vq->key_entry,
+                       qstate->env->cfg->val_log_level >= 2);
                return 1;
        }
 
@@ -1897,12 +1891,13 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
                        "of trust to keys for", vq->key_entry->name,
                        LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
                vq->chase_reply->security = sec_status_bogus;
-
-               update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSKEY_MISSING);
+               update_reason_bogus(vq->chase_reply,
+                       key_entry_get_reason_bogus(vq->key_entry));
                errinf_ede(qstate, "while building chain of trust",
-                       LDNS_EDE_DNSKEY_MISSING);
+                       key_entry_get_reason_bogus(vq->key_entry));
                if(vq->restart_count >= ve->max_restart)
-                       key_cache_insert(ve->kcache, vq->key_entry, qstate);
+                       key_cache_insert(ve->kcache, vq->key_entry,
+                               qstate->env->cfg->val_log_level >= 2);
                return 1;
        }
 
@@ -2151,9 +2146,19 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
                                log_query_info(NO_VERBOSE, "validation failure",
                                        &qstate->qinfo);
                        else {
-                               char* err = errinf_to_str_bogus(qstate);
-                               if(err) log_info("%s", err);
-                               free(err);
+                               char* err_str = errinf_to_str_bogus(qstate);
+                               if(err_str) {
+                                       size_t err_str_len = strlen(err_str);
+                                       log_info("%s", err_str);
+                                       /* allocate space and store the error
+                                        * string */
+                                       vq->orig_msg->rep->reason_bogus_str = regional_alloc(
+                                               qstate->region,
+                                               sizeof(char) * (err_str_len+1));
+                                       memcpy(vq->orig_msg->rep->reason_bogus_str,
+                                               err_str, err_str_len+1);
+                               }
+                               free(err_str);
                        }
                }
                /*
@@ -2195,6 +2200,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
                        }
                }
        }
+
+       /* Update rep->reason_bogus as it is the one being cached */
+       update_reason_bogus(vq->orig_msg->rep, errinf_to_reason_bogus(qstate));
        /* store results in cache */
        if(qstate->query_flags&BIT_RD) {
                /* if secure, this will override cache anyway, no need
@@ -2370,13 +2378,17 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
                log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
                        "could not fetch DNSKEY rrset", 
                        ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
+               reason_bogus = LDNS_EDE_DNSKEY_MISSING;
+               reason = "no DNSKEY rrset";
                if(qstate->env->cfg->harden_dnssec_stripped) {
-                       errinf_ede(qstate, "no DNSKEY rrset", LDNS_EDE_DNSKEY_MISSING);
+                       errinf_ede(qstate, reason, reason_bogus);
                        kkey = key_entry_create_bad(qstate->region, ta->name,
                                ta->namelen, ta->dclass, BOGUS_KEY_TTL,
+                               reason_bogus, reason,
                                *qstate->env->now);
                } else  kkey = key_entry_create_null(qstate->region, ta->name,
                                ta->namelen, ta->dclass, NULL_KEY_TTL,
+                               reason_bogus, reason,
                                *qstate->env->now);
                if(!kkey) {
                        log_err("out of memory: allocate fail prime key");
@@ -2409,9 +2421,11 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
                        errinf_ede(qstate, reason, reason_bogus);
                        kkey = key_entry_create_bad(qstate->region, ta->name,
                                ta->namelen, ta->dclass, BOGUS_KEY_TTL,
+                               reason_bogus, reason,
                                *qstate->env->now);
                } else  kkey = key_entry_create_null(qstate->region, ta->name,
                                ta->namelen, ta->dclass, NULL_KEY_TTL,
+                               reason_bogus, reason,
                                *qstate->env->now);
                if(!kkey) {
                        log_err("out of memory: allocate null prime key");
@@ -2458,8 +2472,9 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                /* errors here pretty much break validation */
                verbose(VERB_DETAIL, "DS response was error, thus bogus");
                errinf(qstate, rc);
-               errinf_ede(qstate, "no DS", LDNS_EDE_NETWORK_ERROR);
-
+               reason = "no DS";
+               reason_bogus = LDNS_EDE_NETWORK_ERROR;
+               errinf_ede(qstate, reason, reason_bogus);
                goto return_bogus;
        }
 
@@ -2473,7 +2488,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                if(!ds) {
                        log_warn("internal error: POSITIVE DS response was "
                                "missing DS.");
-                       errinf_ede(qstate, "no DS record", LDNS_EDE_DNSSEC_BOGUS);
+                       reason = "no DS record";
+                       errinf_ede(qstate, reason, reason_bogus);
                        goto return_bogus;
                }
                /* Verify only returns BOGUS or SECURE. If the rrset is 
@@ -2492,13 +2508,11 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                if(!val_dsset_isusable(ds)) {
                        /* If they aren't usable, then we treat it like 
                         * there was no DS. */
-
-                       /* TODO add EDE Unsupported DS Digest Type; this needs
-                        * EDE to be added on non SERVFAIL answers. */
-
-                       *ke = key_entry_create_null(qstate->region, 
-                               qinfo->qname, qinfo->qname_len, qinfo->qclass, 
-                               ub_packed_rrset_ttl(ds), *qstate->env->now);
+                       *ke = key_entry_create_null(qstate->region,
+                               qinfo->qname, qinfo->qname_len, qinfo->qclass,
+                               ub_packed_rrset_ttl(ds),
+                               LDNS_EDE_UNSUPPORTED_DS_DIGEST, NULL,
+                               *qstate->env->now);
                        return (*ke) != NULL;
                }
 
@@ -2506,7 +2520,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                log_query_info(VERB_DETAIL, "validated DS", qinfo);
                *ke = key_entry_create_rrset(qstate->region,
                        qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
-                       NULL, *qstate->env->now);
+                       NULL, LDNS_EDE_NONE, NULL, *qstate->env->now);
                return (*ke) != NULL;
        } else if(subtype == VAL_CLASS_NODATA || 
                subtype == VAL_CLASS_NAMEERROR) {
@@ -2518,7 +2532,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                /* make sure there are NSECs or NSEC3s with signatures */
                if(!val_has_signed_nsecs(msg->rep, &reason)) {
                        verbose(VERB_ALGO, "no NSECs: %s", reason);
-                       errinf_ede(qstate, reason, LDNS_EDE_NSEC_MISSING);
+                       reason_bogus = LDNS_EDE_NSEC_MISSING;
+                       errinf_ede(qstate, reason, reason_bogus);
                        goto return_bogus;
                }
 
@@ -2530,7 +2545,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                /* Try to prove absence of the DS with NSEC */
                sec = val_nsec_prove_nodata_dsreply(
                        qstate->env, ve, qinfo, msg->rep, vq->key_entry, 
-                       &proof_ttl, &reason, qstate);
+                       &proof_ttl, &reason, &reason_bogus, qstate);
                switch(sec) {
                        case sec_status_secure:
                                verbose(VERB_DETAIL, "NSEC RRset for the "
@@ -2538,6 +2553,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                                *ke = key_entry_create_null(qstate->region, 
                                        qinfo->qname, qinfo->qname_len, 
                                        qinfo->qclass, proof_ttl,
+                                       LDNS_EDE_NONE, NULL,
                                        *qstate->env->now);
                                return (*ke) != NULL;
                        case sec_status_insecure:
@@ -2571,6 +2587,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                                *ke = key_entry_create_null(qstate->region, 
                                        qinfo->qname, qinfo->qname_len, 
                                        qinfo->qclass, proof_ttl,
+                                       LDNS_EDE_NONE, NULL,
                                        *qstate->env->now);
                                return (*ke) != NULL;
                        case sec_status_indeterminate:
@@ -2593,7 +2610,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                 * this is BOGUS. */
                verbose(VERB_DETAIL, "DS %s ran out of options, so return "
                        "bogus", val_classification_to_string(subtype));
-               errinf(qstate, "no DS but also no proof of that");
+               reason = "no DS but also no proof of that";
+               errinf_ede(qstate, reason, reason_bogus);
                goto return_bogus;
        } else if(subtype == VAL_CLASS_CNAME || 
                subtype == VAL_CLASS_CNAMENOANSWER) {
@@ -2605,22 +2623,25 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
                        qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
                if(!cname) {
-                       errinf(qstate, "validator classified CNAME but no "
-                               "CNAME of the queried name for DS");
+                       reason = "validator classified CNAME but no "
+                               "CNAME of the queried name for DS";
+                       errinf_ede(qstate, reason, reason_bogus);
                        goto return_bogus;
                }
                if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
                        == 0) {
                        if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
                                rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
-                               errinf(qstate, "DS got DNAME answer");
+                               reason = "DS got DNAME answer";
                        } else {
-                               errinf(qstate, "DS got unsigned CNAME answer");
+                               reason = "DS got unsigned CNAME answer";
                        }
+                       errinf_ede(qstate, reason, reason_bogus);
                        goto return_bogus;
                }
-               sec = val_verify_rrset_entry(qstate->env, ve, cname, 
-                       vq->key_entry, &reason, NULL, LDNS_SECTION_ANSWER, qstate);
+               sec = val_verify_rrset_entry(qstate->env, ve, cname,
+                       vq->key_entry, &reason, &reason_bogus,
+                       LDNS_SECTION_ANSWER, qstate);
                if(sec == sec_status_secure) {
                        verbose(VERB_ALGO, "CNAME validated, "
                                "proof that DS does not exist");
@@ -2629,12 +2650,13 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
                        return 1;
                }
                errinf(qstate, "CNAME in DS response was not secure.");
-               errinf(qstate, reason);
+               errinf_ede(qstate, reason, reason_bogus);
                goto return_bogus;
        } else {
                verbose(VERB_QUERY, "Encountered an unhandled type of "
                        "DS response, thus bogus.");
                errinf(qstate, "no DS and");
+               reason = "no DS";
                if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
                        char rc[16];
                        rc[0]=0;
@@ -2647,8 +2669,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
        }
 return_bogus:
        *ke = key_entry_create_bad(qstate->region, qinfo->qname,
-               qinfo->qname_len, qinfo->qclass, 
-               BOGUS_KEY_TTL, *qstate->env->now);
+               qinfo->qname_len, qinfo->qclass, BOGUS_KEY_TTL,
+               reason_bogus, reason, *qstate->env->now);
        return (*ke) != NULL;
 }
 
@@ -2768,14 +2790,17 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
                        vq->restart_count++;
                        return;
                }
-               vq->key_entry = key_entry_create_bad(qstate->region, 
+               reason = "No DNSKEY record";
+               reason_bogus = LDNS_EDE_DNSKEY_MISSING;
+               vq->key_entry = key_entry_create_bad(qstate->region,
                        qinfo->qname, qinfo->qname_len, qinfo->qclass,
-                       BOGUS_KEY_TTL, *qstate->env->now);
+                       BOGUS_KEY_TTL, reason_bogus, reason,
+                       *qstate->env->now);
                if(!vq->key_entry) {
                        log_err("alloc failure in missing dnskey response");
                        /* key_entry is NULL for failure in Validate */
                }
-               errinf_ede(qstate, "No DNSKEY record", LDNS_EDE_DNSKEY_MISSING);
+               errinf_ede(qstate, reason, reason_bogus);
                errinf_origin(qstate, origin);
                errinf_dname(qstate, "for key", qinfo->qname);
                vq->state = VAL_VALIDATE_STATE;
@@ -2822,7 +2847,8 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
        qstate->errinf = NULL;
 
        /* The DNSKEY validated, so cache it as a trusted key rrset. */
-       key_cache_insert(ve->kcache, vq->key_entry, qstate);
+       key_cache_insert(ve->kcache, vq->key_entry,
+               qstate->env->cfg->val_log_level >= 2);
 
        /* If good, we stay in the FINDKEY state. */
        log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
@@ -2890,7 +2916,8 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
                errinf_origin(qstate, origin);
                errinf_dname(qstate, "for trust anchor", ta->name);
                /* store the freshly primed entry in the cache */
-               key_cache_insert(ve->kcache, vq->key_entry, qstate);
+               key_cache_insert(ve->kcache, vq->key_entry,
+                       qstate->env->cfg->val_log_level >= 2);
        }
 
        /* If the result of the prime is a null key, skip the FINDKEY state.*/