From a1a7ba809693033026a36a0f26a153f5112d4504 Mon Sep 17 00:00:00 2001 From: florian Date: Tue, 1 Mar 2022 18:34:21 +0000 Subject: [PATCH] Update to libunbound 1.15.0; heavy lifting by sthen in unbound(8). Upstream renamed parse_edns_from_pkt to parse_edns_from_query_pkt and added two arguments (config_file and comm_point) that we don't use, adjust callers in frontend accordingly. --- sbin/unwind/frontend.c | 8 +- sbin/unwind/libunbound/config.h | 21 +- sbin/unwind/libunbound/dns64/dns64.c | 13 +- sbin/unwind/libunbound/dnscrypt/dnscrypt.h | 4 +- .../unwind/libunbound/iterator/iter_delegpt.c | 72 +- .../unwind/libunbound/iterator/iter_delegpt.h | 30 +- sbin/unwind/libunbound/iterator/iter_fwd.c | 18 +- sbin/unwind/libunbound/iterator/iter_hints.c | 24 +- sbin/unwind/libunbound/iterator/iter_utils.c | 152 +- sbin/unwind/libunbound/iterator/iter_utils.h | 7 +- sbin/unwind/libunbound/iterator/iterator.c | 180 +- sbin/unwind/libunbound/iterator/iterator.h | 9 +- sbin/unwind/libunbound/libunbound/context.c | 2 + sbin/unwind/libunbound/libunbound/context.h | 29 - .../unwind/libunbound/libunbound/libunbound.c | 4 + sbin/unwind/libunbound/libunbound/libworker.c | 19 +- .../libunbound/libunbound/unbound-event.h | 2 +- sbin/unwind/libunbound/libunbound/unbound.h | 32 +- sbin/unwind/libunbound/libunbound/worker.h | 22 +- sbin/unwind/libunbound/respip/respip.c | 75 +- sbin/unwind/libunbound/respip/respip.h | 3 + sbin/unwind/libunbound/services/authzone.c | 215 +- sbin/unwind/libunbound/services/authzone.h | 5 + sbin/unwind/libunbound/services/cache/infra.c | 66 +- sbin/unwind/libunbound/services/cache/infra.h | 14 +- sbin/unwind/libunbound/services/cache/rrset.h | 4 +- .../libunbound/services/listen_dnsport.c | 125 +- .../libunbound/services/listen_dnsport.h | 5 + sbin/unwind/libunbound/services/localzone.c | 137 +- sbin/unwind/libunbound/services/localzone.h | 6 +- sbin/unwind/libunbound/services/mesh.c | 95 +- .../libunbound/services/outbound_list.h | 2 +- .../libunbound/services/outside_network.c | 318 +- .../libunbound/services/outside_network.h | 27 +- sbin/unwind/libunbound/services/rpz.c | 1927 +++++- sbin/unwind/libunbound/services/rpz.h | 56 +- sbin/unwind/libunbound/sldns/keyraw.c | 6 +- sbin/unwind/libunbound/sldns/parseutil.h | 2 +- sbin/unwind/libunbound/sldns/str2wire.c | 16 +- sbin/unwind/libunbound/sldns/str2wire.h | 2 +- sbin/unwind/libunbound/sldns/wire2str.c | 11 + sbin/unwind/libunbound/sldns/wire2str.h | 2 +- sbin/unwind/libunbound/util/config_file.c | 25 +- sbin/unwind/libunbound/util/config_file.h | 17 +- sbin/unwind/libunbound/util/configlexer.c | 5780 +++++++++-------- sbin/unwind/libunbound/util/configlexer.lex | 6 + sbin/unwind/libunbound/util/configparser.h | 350 +- sbin/unwind/libunbound/util/configparser.y | 515 +- sbin/unwind/libunbound/util/data/msgencode.c | 20 +- sbin/unwind/libunbound/util/data/msgparse.c | 150 +- sbin/unwind/libunbound/util/data/msgparse.h | 23 +- sbin/unwind/libunbound/util/data/msgreply.c | 67 +- sbin/unwind/libunbound/util/data/msgreply.h | 27 +- .../libunbound/util/data/packed_rrset.h | 8 + sbin/unwind/libunbound/util/edns.c | 50 - sbin/unwind/libunbound/util/edns.h | 12 - sbin/unwind/libunbound/util/fptr_wlist.c | 8 +- sbin/unwind/libunbound/util/fptr_wlist.h | 7 +- sbin/unwind/libunbound/util/iana_ports.inc | 3 +- sbin/unwind/libunbound/util/mini_event.c | 9 + sbin/unwind/libunbound/util/module.h | 11 +- sbin/unwind/libunbound/util/net_help.c | 54 +- sbin/unwind/libunbound/util/net_help.h | 19 +- sbin/unwind/libunbound/util/netevent.c | 65 +- sbin/unwind/libunbound/util/netevent.h | 2 +- sbin/unwind/libunbound/util/regional.c | 2 + .../libunbound/util/shm_side/shm_main.c | 2 +- sbin/unwind/libunbound/util/tube.c | 6 +- sbin/unwind/libunbound/validator/autotrust.c | 4 +- sbin/unwind/libunbound/validator/val_utils.c | 8 +- sbin/unwind/libunbound/validator/validator.c | 4 +- sbin/unwind/libunbound/validator/validator.h | 2 +- 72 files changed, 6678 insertions(+), 4345 deletions(-) diff --git a/sbin/unwind/frontend.c b/sbin/unwind/frontend.c index e267b923800..6316231f4bf 100644 --- a/sbin/unwind/frontend.c +++ b/sbin/unwind/frontend.c @@ -1,4 +1,4 @@ -/* $OpenBSD: frontend.c,v 1.70 2022/03/01 18:30:23 florian Exp $ */ +/* $OpenBSD: frontend.c,v 1.71 2022/03/01 18:34:21 florian Exp $ */ /* * Copyright (c) 2018 Florian Obser @@ -779,7 +779,8 @@ handle_query(struct pending_query *pq) error_answer(pq, LDNS_RCODE_SERVFAIL); goto send_answer; } - rcode = parse_edns_from_pkt(pq->qbuf, &pq->edns, pq->region); + rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL, + pq->region); if (rcode != LDNS_RCODE_NOERROR) { error_answer(pq, rcode); goto send_answer; @@ -1071,7 +1072,8 @@ resend_dns64_query(struct pending_query *opq) { error_answer(pq, LDNS_RCODE_SERVFAIL); goto send_answer; } - rcode = parse_edns_from_pkt(pq->qbuf, &pq->edns, pq->region); + rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL, + pq->region); if (rcode != LDNS_RCODE_NOERROR) { error_answer(pq, rcode); goto send_answer; diff --git a/sbin/unwind/libunbound/config.h b/sbin/unwind/libunbound/config.h index 695945c89b4..b09a31b22b4 100644 --- a/sbin/unwind/libunbound/config.h +++ b/sbin/unwind/libunbound/config.h @@ -73,6 +73,9 @@ /* If we have be64toh */ #define HAVE_BE64TOH 1 +/* Define to 1 if you have the `BIO_set_callback_ex' function. */ +#define HAVE_BIO_SET_CALLBACK_EX 1 + /* Define to 1 if you have the header file. */ /* #undef HAVE_BSD_STDLIB_H */ @@ -224,7 +227,7 @@ #define HAVE_EVP_DIGESTVERIFY 1 /* Define to 1 if you have the `EVP_dss1' function. */ -#define HAVE_EVP_DSS1 1 +/* #undef HAVE_EVP_DSS1 */ /* Define to 1 if you have the `EVP_EncryptInit_ex' function. */ #define HAVE_EVP_ENCRYPTINIT_EX 1 @@ -260,7 +263,7 @@ #define HAVE_FCNTL 1 /* Define to 1 if you have the `FIPS_mode' function. */ -/* #undef HAVE_FIPS_MODE */ +#define HAVE_FIPS_MODE 1 /* Define to 1 if you have the `fork' function. */ #define HAVE_FORK 1 @@ -319,6 +322,9 @@ /* Define to 1 if you have the `if_nametoindex' function. */ #define HAVE_IF_NAMETOINDEX 1 +/* Define to 1 if you have the `if_nametoindex' function. */ +#define HAVE_IF_NAMETOINDEX 1 + /* Define to 1 if you have the `inet_aton' function. */ #define HAVE_INET_ATON 1 @@ -379,6 +385,9 @@ /* Define to 1 if you have the header file. */ #define HAVE_NETINET_TCP_H 1 +/* Define to 1 if you have the header file. */ +/* #undef HAVE_NETIOAPI_H */ + /* Use libnettle for crypto */ /* #undef HAVE_NETTLE */ @@ -536,7 +545,7 @@ #define HAVE_SSL_CTX_SET_ALPN_SELECT_CB 1 /* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */ -/* #undef HAVE_SSL_CTX_SET_CIPHERSUITES */ +#define HAVE_SSL_CTX_SET_CIPHERSUITES 1 /* Define to 1 if you have the `SSL_CTX_set_security_level' function. */ /* #undef HAVE_SSL_CTX_SET_SECURITY_LEVEL */ @@ -751,7 +760,7 @@ #define PACKAGE_NAME "unbound" /* Define to the full name and version of this package. */ -#define PACKAGE_STRING "unbound 1.13.2" +#define PACKAGE_STRING "unbound 1.15.0" /* Define to the one symbol short name of this package. */ #define PACKAGE_TARNAME "unbound" @@ -760,7 +769,7 @@ #define PACKAGE_URL "" /* Define to the version of this package. */ -#define PACKAGE_VERSION "1.13.2" +#define PACKAGE_VERSION "1.15.0" /* default pidfile location */ #define PIDFILE "" @@ -783,7 +792,7 @@ #define ROOT_CERT_FILE "/var/unbound/etc/icannbundle.pem" /* version number for resource files */ -#define RSRC_PACKAGE_VERSION 1,13,2,0 +#define RSRC_PACKAGE_VERSION 1,15,0,0 /* Directory to chdir to */ #define RUN_DIR "/var/unbound/etc" diff --git a/sbin/unwind/libunbound/dns64/dns64.c b/sbin/unwind/libunbound/dns64/dns64.c index c79bc9c6579..d01b436e1d6 100644 --- a/sbin/unwind/libunbound/dns64/dns64.c +++ b/sbin/unwind/libunbound/dns64/dns64.c @@ -685,8 +685,12 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id, switch(event) { case module_event_new: /* Tag this query as being new and fall through. */ - iq = (struct dns64_qstate*)regional_alloc( - qstate->region, sizeof(*iq)); + if (!(iq = (struct dns64_qstate*)regional_alloc( + qstate->region, sizeof(*iq)))) { + log_err("out of memory"); + qstate->ext_state[id] = module_error; + return; + } qstate->minfo[id] = iq; iq->state = DNS64_NEW_QUERY; iq->started_no_cache_store = qstate->no_cache_store; @@ -913,8 +917,9 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super) sizeof(struct dns_msg)))) return; super->return_msg->qinfo = super->qinfo; - super->return_msg->rep = reply_info_copy(qstate->return_msg->rep, NULL, - super->region); + if (!(super->return_msg->rep = reply_info_copy(qstate->return_msg->rep, + NULL, super->region))) + return; /* * Adjust the domain name of the answer RR set so that it matches the diff --git a/sbin/unwind/libunbound/dnscrypt/dnscrypt.h b/sbin/unwind/libunbound/dnscrypt/dnscrypt.h index 666f54e62aa..b0da9b73268 100644 --- a/sbin/unwind/libunbound/dnscrypt/dnscrypt.h +++ b/sbin/unwind/libunbound/dnscrypt/dnscrypt.h @@ -114,7 +114,7 @@ void dnsc_delete(struct dnsc_env *env); /** * handle a crypted dnscrypt request. - * Determine wether or not a query is coming over the dnscrypt listener and + * Determine whether or not a query is coming over the dnscrypt listener and * attempt to uncurve it or detect if it is a certificate query. * return 0 in case of failure. */ @@ -122,7 +122,7 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv, struct comm_reply* repinfo); /** * handle an unencrypted dnscrypt request. - * Determine wether or not a query is going over the dnscrypt channel and + * Determine whether or not a query is going over the dnscrypt channel and * attempt to curve it unless it was not crypted like when it is a * certificate query. * \return 0 in case of failure. diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.c b/sbin/unwind/libunbound/iterator/iter_delegpt.c index 9a672b0af39..80148e81089 100644 --- a/sbin/unwind/libunbound/iterator/iter_delegpt.c +++ b/sbin/unwind/libunbound/iterator/iter_delegpt.c @@ -73,8 +73,10 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region) copy->bogus = dp->bogus; copy->has_parent_side_NS = dp->has_parent_side_NS; copy->ssl_upstream = dp->ssl_upstream; + copy->tcp_upstream = dp->tcp_upstream; for(ns = dp->nslist; ns; ns = ns->next) { - if(!delegpt_add_ns(copy, region, ns->name, ns->lame)) + if(!delegpt_add_ns(copy, region, ns->name, ns->lame, + ns->tls_auth_name, ns->port)) return NULL; copy->nslist->resolved = ns->resolved; copy->nslist->got4 = ns->got4; @@ -83,8 +85,8 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region) copy->nslist->done_pside6 = ns->done_pside6; } for(a = dp->target_list; a; a = a->next_target) { - if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, - a->bogus, a->lame, a->tls_auth_name, NULL)) + if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, + a->bogus, a->lame, a->tls_auth_name, -1, NULL)) return NULL; } return copy; @@ -101,7 +103,7 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name) int delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name, - uint8_t lame) + uint8_t lame, char* tls_auth_name, int port) { struct delegpt_ns* ns; size_t len; @@ -125,6 +127,14 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name, ns->lame = lame; ns->done_pside4 = 0; ns->done_pside6 = 0; + ns->port = port; + if(tls_auth_name) { + ns->tls_auth_name = regional_strdup(region, tls_auth_name); + if(!ns->tls_auth_name) + return 0; + } else { + ns->tls_auth_name = NULL; + } return ns->name != 0; } @@ -158,9 +168,9 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr, return NULL; } -int -delegpt_add_target(struct delegpt* dp, struct regional* region, - uint8_t* name, size_t namelen, struct sockaddr_storage* addr, +int +delegpt_add_target(struct delegpt* dp, struct regional* region, + uint8_t* name, size_t namelen, struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions) { struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen); @@ -176,17 +186,22 @@ delegpt_add_target(struct delegpt* dp, struct regional* region, if(ns->got4 && ns->got6) ns->resolved = 1; } - return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, NULL, - additions); + log_assert(ns->port>0); + return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, + ns->tls_auth_name, ns->port, additions); } -int -delegpt_add_addr(struct delegpt* dp, struct regional* region, - struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, - uint8_t lame, char* tls_auth_name, int* additions) +int +delegpt_add_addr(struct delegpt* dp, struct regional* region, + struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, + uint8_t lame, char* tls_auth_name, int port, int* additions) { struct delegpt_addr* a; log_assert(!dp->dp_type_mlc); + if(port != -1) { + log_assert(port>0); + sockaddr_store_port(addr, addrlen, port); + } /* check for duplicates */ if((a = delegpt_find_addr(dp, addr, addrlen))) { if(bogus) @@ -411,7 +426,8 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region, (size_t)sldns_read_uint16(nsdata->rr_data[i])) continue; /* bad format */ /* add rdata of NS (= wirefmt dname), skip rdatalen bytes */ - if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame)) + if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame, + NULL, UNBOUND_DNS_PORT)) return 0; } return 1; @@ -428,7 +444,6 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region, log_assert(!dp->dp_type_mlc); memset(&sa, 0, len); sa.sin_family = AF_INET; - sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT); for(i=0; icount; i++) { if(d->rr_len[i] != 2 + INET_SIZE) continue; @@ -452,7 +467,6 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region, log_assert(!dp->dp_type_mlc); memset(&sa, 0, len); sa.sin6_family = AF_INET6; - sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT); for(i=0; icount; i++) { if(d->rr_len[i] != 2 + INET6_SIZE) /* rdatalen + len of IP6 */ continue; @@ -554,6 +568,7 @@ void delegpt_free_mlc(struct delegpt* dp) while(n) { nn = n->next; free(n->name); + free(n->tls_auth_name); free(n); n = nn; } @@ -576,7 +591,8 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name) return (dp->name != NULL); } -int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame) +int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame, + char* tls_auth_name, int port) { struct delegpt_ns* ns; size_t len; @@ -603,14 +619,30 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame) ns->lame = (uint8_t)lame; ns->done_pside4 = 0; ns->done_pside6 = 0; + ns->port = port; + if(tls_auth_name) { + ns->tls_auth_name = strdup(tls_auth_name); + if(!ns->tls_auth_name) { + free(ns->name); + free(ns); + return 0; + } + } else { + ns->tls_auth_name = NULL; + } return 1; } int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr, - socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name) + socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name, + int port) { struct delegpt_addr* a; log_assert(dp->dp_type_mlc); + if(port != -1) { + log_assert(port>0); + sockaddr_store_port(addr, addrlen, port); + } /* check for duplicates */ if((a = delegpt_find_addr(dp, addr, addrlen))) { if(bogus) @@ -663,7 +695,9 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen, if(ns->got4 && ns->got6) ns->resolved = 1; } - return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame, NULL); + log_assert(ns->port>0); + return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame, + ns->tls_auth_name, ns->port); } size_t delegpt_get_mem(struct delegpt* dp) diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.h b/sbin/unwind/libunbound/iterator/iter_delegpt.h index 138eb6e1b60..17db15a23e2 100644 --- a/sbin/unwind/libunbound/iterator/iter_delegpt.h +++ b/sbin/unwind/libunbound/iterator/iter_delegpt.h @@ -83,6 +83,8 @@ struct delegpt { uint8_t dp_type_mlc; /** use SSL for upstream query */ uint8_t ssl_upstream; + /** use TCP for upstream query */ + uint8_t tcp_upstream; /** delegpt from authoritative zone that is locally hosted */ uint8_t auth_dp; /*** no cache */ @@ -124,6 +126,11 @@ struct delegpt_ns { * Also enabled if a parent-side cache entry exists, or a parent-side * negative-cache entry exists. */ uint8_t done_pside6; + /** the TLS authentication name, (if not NULL) to use. */ + char* tls_auth_name; + /** the port to use; it should mosty be the default 53 but configured + * upstreams can provide nondefault ports. */ + int port; }; /** @@ -189,10 +196,12 @@ int delegpt_set_name(struct delegpt* dp, struct regional* regional, * @param regional: where to allocate the info. * @param name: domain name in wire format. * @param lame: name is lame, disprefer it. + * @param tls_auth_name: TLS authentication name (or NULL). + * @param port: port to use for resolved addresses. * @return false on error. */ -int delegpt_add_ns(struct delegpt* dp, struct regional* regional, - uint8_t* name, uint8_t lame); +int delegpt_add_ns(struct delegpt* dp, struct regional* regional, + uint8_t* name, uint8_t lame, char* tls_auth_name, int port); /** * Add NS rrset; calls add_ns repeatedly. @@ -269,12 +278,14 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional, * @param bogus: if address is bogus. * @param lame: if address is lame. * @param tls_auth_name: TLS authentication name (or NULL). + * @param port: the port to use; if -1 the port is taken from addr. * @param additions: will be set to 1 if a new address is added * @return false on error. */ -int delegpt_add_addr(struct delegpt* dp, struct regional* regional, +int delegpt_add_addr(struct delegpt* dp, struct regional* regional, struct sockaddr_storage* addr, socklen_t addrlen, - uint8_t bogus, uint8_t lame, char* tls_auth_name, int* additions); + uint8_t bogus, uint8_t lame, char* tls_auth_name, int port, + int* additions); /** * Find NS record in name list of delegation point. @@ -402,22 +413,27 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name); * @param dp: must have been created with delegpt_create_mlc. * @param name: the name to add. * @param lame: the name is lame, disprefer. + * @param tls_auth_name: TLS authentication name (or NULL). + * @param port: port to use for resolved addresses. * @return false on error. */ -int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame); +int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame, + char* tls_auth_name, int port); /** * add an address to a malloced delegation point. - * @param dp: must have been created with delegpt_create_mlc. + * @param dp: must have been created with delegpt_create_mlc. * @param addr: the address. * @param addrlen: the length of addr. * @param bogus: if address is bogus. * @param lame: if address is lame. * @param tls_auth_name: TLS authentication name (or NULL). + * @param port: the port to use; if -1 the port is taken from addr. * @return false on error. */ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr, - socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name); + socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name, + int port); /** * Add target address to the delegation point. diff --git a/sbin/unwind/libunbound/iterator/iter_fwd.c b/sbin/unwind/libunbound/iterator/iter_fwd.c index ea3d70e0732..15137291247 100644 --- a/sbin/unwind/libunbound/iterator/iter_fwd.c +++ b/sbin/unwind/libunbound/iterator/iter_fwd.c @@ -200,21 +200,27 @@ read_fwds_name(struct config_stub* s) } /** set fwd host names */ -static int +static int read_fwds_host(struct config_stub* s, struct delegpt* dp) { struct config_strlist* p; uint8_t* dname; - size_t dname_len; + char* tls_auth_name; + int port; for(p = s->hosts; p; p = p->next) { log_assert(p->str); - dname = sldns_str2wire_dname(p->str, &dname_len); + dname = authextstrtodname(p->str, &port, &tls_auth_name); if(!dname) { log_err("cannot parse forward %s server name: '%s'", s->name, p->str); return 0; } - if(!delegpt_add_ns_mlc(dp, dname, 0)) { +#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST) + if(tls_auth_name) + log_err("no name verification functionality in " + "ssl library, ignored name for %s", p->str); +#endif + if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) { free(dname); log_err("out of memory"); return 0; @@ -245,7 +251,7 @@ read_fwds_addr(struct config_stub* s, struct delegpt* dp) "ssl library, ignored name for %s", p->str); #endif if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0, - tls_auth_name)) { + tls_auth_name, -1)) { log_err("out of memory"); return 0; } @@ -276,6 +282,8 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg) dp->no_cache = s->no_cache; /* use SSL for queries to this forwarder */ dp->ssl_upstream = (uint8_t)s->ssl_upstream; + /* use TCP for queries to this forwarder */ + dp->tcp_upstream = (uint8_t)s->tcp_upstream; verbose(VERB_QUERY, "Forward zone server list:"); delegpt_log(VERB_QUERY, dp); if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp)) diff --git a/sbin/unwind/libunbound/iterator/iter_hints.c b/sbin/unwind/libunbound/iterator/iter_hints.c index 60e518122ed..9b1a200bbb1 100644 --- a/sbin/unwind/libunbound/iterator/iter_hints.c +++ b/sbin/unwind/libunbound/iterator/iter_hints.c @@ -99,7 +99,7 @@ ah(struct delegpt* dp, const char* sv, const char* ip) log_err("could not parse %s", sv); return 0; } - if(!delegpt_add_ns_mlc(dp, dname, 0) || + if(!delegpt_add_ns_mlc(dp, dname, 0, NULL, UNBOUND_DNS_PORT) || !extstrtoaddr(ip, &addr, &addrlen) || !delegpt_add_target_mlc(dp, dname, dname_len, &addr, addrlen, 0, 0)) { @@ -213,21 +213,27 @@ read_stubs_name(struct config_stub* s) } /** set stub host names */ -static int +static int read_stubs_host(struct config_stub* s, struct delegpt* dp) { struct config_strlist* p; - size_t dname_len; uint8_t* dname; + char* tls_auth_name; + int port; for(p = s->hosts; p; p = p->next) { log_assert(p->str); - dname = sldns_str2wire_dname(p->str, &dname_len); + dname = authextstrtodname(p->str, &port, &tls_auth_name); if(!dname) { log_err("cannot parse stub %s nameserver name: '%s'", s->name, p->str); return 0; } - if(!delegpt_add_ns_mlc(dp, dname, 0)) { +#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST) + if(tls_auth_name) + log_err("no name verification functionality in " + "ssl library, ignored name for %s", p->str); +#endif + if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) { free(dname); log_err("out of memory"); return 0; @@ -258,7 +264,7 @@ read_stubs_addr(struct config_stub* s, struct delegpt* dp) "ssl library, ignored name for %s", p->str); #endif if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0, - auth_name)) { + auth_name, -1)) { log_err("out of memory"); return 0; } @@ -287,6 +293,8 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg) dp->no_cache = s->no_cache; /* ssl_upstream */ dp->ssl_upstream = (uint8_t)s->ssl_upstream; + /* tcp_upstream */ + dp->tcp_upstream = (uint8_t)s->tcp_upstream; delegpt_log(VERB_QUERY, dp); if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime)) return 0; @@ -336,7 +344,7 @@ read_root_hints(struct iter_hints* hints, char* fname) if(sldns_wirerr_get_type(rr, rr_len, dname_len) == LDNS_RR_TYPE_NS) { if(!delegpt_add_ns_mlc(dp, sldns_wirerr_get_rdata(rr, - rr_len, dname_len), 0)) { + rr_len, dname_len), 0, NULL, UNBOUND_DNS_PORT)) { log_err("out of memory reading root hints"); goto stop_read; } @@ -395,10 +403,10 @@ read_root_hints(struct iter_hints* hints, char* fname) delegpt_free_mlc(dp); return 1; } + delegpt_log(VERB_QUERY, dp); if(!hints_insert(hints, c, dp, 0)) { return 0; } - delegpt_log(VERB_QUERY, dp); return 1; stop_read: diff --git a/sbin/unwind/libunbound/iterator/iter_utils.c b/sbin/unwind/libunbound/iterator/iter_utils.c index 668f898eb0f..2482a1f40f0 100644 --- a/sbin/unwind/libunbound/iterator/iter_utils.c +++ b/sbin/unwind/libunbound/iterator/iter_utils.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -37,7 +37,7 @@ * \file * * This file contains functions to assist the iterator module. - * Configuration options. Forward zones. + * Configuration options. Forward zones. */ #include "config.h" #include "iterator/iter_utils.h" @@ -141,7 +141,7 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg) return 1; } -int +int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) { int i; @@ -151,7 +151,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) for(i=0; imax_dependency_depth+1; i++) verbose(VERB_QUERY, "target fetch policy for level %d is %d", i, iter_env->target_fetch_policy[i]); - + if(!iter_env->donotq) iter_env->donotq = donotq_create(); if(!iter_env->donotq || !donotq_apply_cfg(iter_env->donotq, cfg)) { @@ -176,6 +176,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) } iter_env->supports_ipv6 = cfg->do_ip6; iter_env->supports_ipv4 = cfg->do_ip4; + iter_env->outbound_msg_retry = cfg->outbound_msg_retry; return 1; } @@ -212,7 +213,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) * dnsseclame servers get penalty * USEFUL_SERVER_TOP_TIMEOUT*3 .. * recursion lame servers get penalty - * UNKNOWN_SERVER_NICENESS + * UNKNOWN_SERVER_NICENESS * If no information is known about the server, this is * returned. 376 msec or so. * +BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*4) for dnssec failed IPs. @@ -221,11 +222,11 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) * is turned off (so we do not discard the reply). * When a final value is chosen that is recursionlame; RD bit is set on query. * Because of the numbers this means recursionlame also have dnssec lameness - * checking turned off. + * checking turned off. */ static int iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env, - uint8_t* name, size_t namelen, uint16_t qtype, time_t now, + uint8_t* name, size_t namelen, uint16_t qtype, time_t now, struct delegpt_addr* a) { int rtt, lame, reclame, dnsseclame; @@ -243,8 +244,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env, return -1; /* there is no ip4 available */ } /* check lameness - need zone , class info */ - if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, - name, namelen, qtype, &lame, &dnsseclame, &reclame, + if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, + name, namelen, qtype, &lame, &dnsseclame, &reclame, &rtt, now)) { log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen); verbose(VERB_ALGO, " rtt=%d%s%s%s%s", rtt, @@ -282,7 +283,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env, /** lookup RTT information, and also store fastest rtt (if any) */ static int iter_fill_rtt(struct iter_env* iter_env, struct module_env* env, - uint8_t* name, size_t namelen, uint16_t qtype, time_t now, + uint8_t* name, size_t namelen, uint16_t qtype, time_t now, struct delegpt* dp, int* best_rtt, struct sock_list* blacklist, size_t* num_suitable_results) { @@ -293,7 +294,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env, if(dp->bogus) return 0; /* NS bogus, all bogus, nothing found */ for(a=dp->result_list; a; a = a->next_result) { - a->sel_rtt = iter_filter_unsuitable(iter_env, env, + a->sel_rtt = iter_filter_unsuitable(iter_env, env, name, namelen, qtype, now, a); if(a->sel_rtt != -1) { if(sock_list_find(blacklist, &a->addr, a->addrlen)) @@ -329,7 +330,7 @@ nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n) int rtt_band; size_t i; int* rtt_list, *rtt_index; - + if(num_results < 1 || n >= num_results) { return -1; } @@ -361,8 +362,8 @@ nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n) * returns number of best targets (or 0, no suitable targets) */ static int iter_filter_order(struct iter_env* iter_env, struct module_env* env, - uint8_t* name, size_t namelen, uint16_t qtype, time_t now, - struct delegpt* dp, int* selected_rtt, int open_target, + uint8_t* name, size_t namelen, uint16_t qtype, time_t now, + struct delegpt* dp, int* selected_rtt, int open_target, struct sock_list* blacklist, time_t prefetch) { int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND, nth; @@ -370,9 +371,9 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env, struct delegpt_addr* a, *n, *prev=NULL; /* fillup sel_rtt and find best rtt in the bunch */ - got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, + got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, &low_rtt, blacklist, &num_results); - if(got_num == 0) + if(got_num == 0) return 0; if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT && (delegpt_count_missing_targets(dp) > 0 || open_target > 0)) { @@ -548,9 +549,9 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env, return got_num; } -struct delegpt_addr* -iter_server_selection(struct iter_env* iter_env, - struct module_env* env, struct delegpt* dp, +struct delegpt_addr* +iter_server_selection(struct iter_env* iter_env, + struct module_env* env, struct delegpt* dp, uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_lame, int* chase_to_rd, int open_target, struct sock_list* blacklist, time_t prefetch) @@ -592,7 +593,7 @@ iter_server_selection(struct iter_env* iter_env, if(num == 1) { a = dp->result_list; - if(++a->attempts < OUTBOUND_MSG_RETRY) + if(++a->attempts < iter_env->outbound_msg_retry) return a; dp->result_list = a->next_result; return a; @@ -602,7 +603,7 @@ iter_server_selection(struct iter_env* iter_env, log_assert(num > 1); /* grab secure random number, to pick unexpected server. * also we need it to be threadsafe. */ - sel = ub_random_max(env->rnd, num); + sel = ub_random_max(env->rnd, num); a = dp->result_list; prev = NULL; while(sel > 0 && a) { @@ -612,7 +613,7 @@ iter_server_selection(struct iter_env* iter_env, } if(!a) /* robustness */ return NULL; - if(++a->attempts < OUTBOUND_MSG_RETRY) + if(++a->attempts < iter_env->outbound_msg_retry) return a; /* remove it from the delegation point result list */ if(prev) @@ -621,8 +622,8 @@ iter_server_selection(struct iter_env* iter_env, return a; } -struct dns_msg* -dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg, +struct dns_msg* +dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) { struct dns_msg* m = (struct dns_msg*)regional_alloc(region, @@ -637,7 +638,7 @@ dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg, return m; } -struct dns_msg* +struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* region) { struct dns_msg* m = (struct dns_msg*)regional_alloc(region, @@ -653,7 +654,7 @@ dns_copy_msg(struct dns_msg* from, struct regional* region) return m; } -void +void iter_dns_store(struct module_env* env, struct query_info* msgqinf, struct reply_info* msgrep, int is_referral, time_t leeway, int pside, struct regional* region, uint16_t flags) @@ -663,7 +664,7 @@ iter_dns_store(struct module_env* env, struct query_info* msgqinf, log_err("out of memory: cannot store data in cache"); } -int +int iter_ns_probability(struct ub_randstate* rnd, int n, int m) { int sel; @@ -671,7 +672,7 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m) return 1; /* we do not need secure random numbers here, but * we do need it to be threadsafe, so we use this */ - sel = ub_random_max(rnd, m); + sel = ub_random_max(rnd, m); return (sel < n); } @@ -688,12 +689,12 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen, qinf.local_alias = NULL; fptr_ok(fptr_whitelist_modenv_detect_cycle( qstate->env->detect_cycle)); - return (*qstate->env->detect_cycle)(qstate, &qinf, + return (*qstate->env->detect_cycle)(qstate, &qinf, (uint16_t)(BIT_RD|BIT_CD), qstate->is_priming, qstate->is_valrec); } -void +void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) { struct delegpt_ns* ns; @@ -701,21 +702,21 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) if(ns->resolved) continue; /* see if this ns as target causes dependency cycle */ - if(causes_cycle(qstate, ns->name, ns->namelen, + if(causes_cycle(qstate, ns->name, ns->namelen, LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass) || - causes_cycle(qstate, ns->name, ns->namelen, + causes_cycle(qstate, ns->name, ns->namelen, LDNS_RR_TYPE_A, qstate->qinfo.qclass)) { log_nametypeclass(VERB_QUERY, "skipping target due " "to dependency cycle (harden-glue: no may " - "fix some of the cycles)", - ns->name, LDNS_RR_TYPE_A, + "fix some of the cycles)", + ns->name, LDNS_RR_TYPE_A, qstate->qinfo.qclass); ns->resolved = 1; } } } -void +void iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) { struct delegpt_ns* ns; @@ -723,14 +724,14 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) if(ns->done_pside4 && ns->done_pside6) continue; /* see if this ns as target causes dependency cycle */ - if(causes_cycle(qstate, ns->name, ns->namelen, + if(causes_cycle(qstate, ns->name, ns->namelen, LDNS_RR_TYPE_A, qstate->qinfo.qclass)) { log_nametypeclass(VERB_QUERY, "skipping target due " "to dependency cycle", ns->name, LDNS_RR_TYPE_A, qstate->qinfo.qclass); ns->done_pside4 = 1; } - if(causes_cycle(qstate, ns->name, ns->namelen, + if(causes_cycle(qstate, ns->name, ns->namelen, LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass)) { log_nametypeclass(VERB_QUERY, "skipping target due " "to dependency cycle", ns->name, @@ -740,8 +741,8 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) } } -int -iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, +int +iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, struct delegpt* dp) { struct delegpt_ns* ns; @@ -760,14 +761,14 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, /* either available or unused targets */ if(dp->usable_list || dp->result_list) return 0; - + /* see if query is for one of the nameservers, which is glue */ if( (qinfo->qtype == LDNS_RR_TYPE_A || qinfo->qtype == LDNS_RR_TYPE_AAAA) && dname_subdomain_c(qinfo->qname, dp->name) && delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len)) return 1; - + for(ns = dp->nslist; ns; ns = ns->next) { if(ns->resolved) /* skip failed targets */ continue; @@ -785,7 +786,7 @@ iter_qname_indicates_dnssec(struct module_env* env, struct query_info *qinfo) return 0; /* a trust anchor exists above the name? */ if((a=anchors_lookup(env->anchors, qinfo->qname, qinfo->qname_len, - qinfo->qclass))) { + qinfo->qclass))) { if(a->numDS == 0 && a->numDNSKEY == 0) { /* insecure trust point */ lock_basic_unlock(&a->lock); @@ -798,7 +799,7 @@ iter_qname_indicates_dnssec(struct module_env* env, struct query_info *qinfo) return 0; } -int +int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp, struct dns_msg* msg, uint16_t dclass) { @@ -842,7 +843,7 @@ iter_indicates_dnssec(struct module_env* env, struct delegpt* dp, return 0; } -int +int iter_msg_has_dnssec(struct dns_msg* msg) { size_t i; @@ -875,7 +876,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, * and referral to example.com. NS ... , then origin zone * is .com. For a referral to sub.example.com. NS ... then * we do not know, since example.com. may be in between. */ - for(i=0; irep->an_numrrsets+msg->rep->ns_numrrsets; + for(i=0; irep->an_numrrsets+msg->rep->ns_numrrsets; i++) { struct ub_packed_rrset_key* s = msg->rep->rrsets[i]; if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS && @@ -890,7 +891,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, return 0; } log_assert(type==RESPONSE_TYPE_ANSWER || type==RESPONSE_TYPE_CNAME); - /* not a referral, and not lame delegation (upwards), so, + /* not a referral, and not lame delegation (upwards), so, * any NS rrset must be from the zone itself */ if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen, LDNS_RR_TYPE_NS, dclass) || @@ -906,7 +907,7 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, } /** - * check equality of two rrsets + * check equality of two rrsets * @param k1: rrset * @param k2: rrset * @return true if equal @@ -935,7 +936,7 @@ rrset_equal(struct ub_packed_rrset_key* k1, struct ub_packed_rrset_key* k2) for(i=0; irr_len[i] != d2->rr_len[i] || /* no ttl check: d1->rr_ttl[i] != d2->rr_ttl[i] ||*/ - memcmp(d1->rr_data[i], d2->rr_data[i], + memcmp(d1->rr_data[i], d2->rr_data[i], d1->rr_len[i]) != 0) return 0; } @@ -966,7 +967,7 @@ rrset_canonical_sort_cmp(const void* x, const void* y) return 0; } -int +int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region) { size_t i; @@ -1024,7 +1025,7 @@ reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region) return 1; } -void +void caps_strip_reply(struct reply_info* rep) { size_t i; @@ -1066,8 +1067,8 @@ int caps_failed_rcode(struct reply_info* rep) FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN); } -void -iter_store_parentside_rrset(struct module_env* env, +void +iter_store_parentside_rrset(struct module_env* env, struct ub_packed_rrset_key* rrset) { struct rrset_ref ref; @@ -1107,12 +1108,12 @@ iter_store_parentside_NS(struct module_env* env, struct reply_info* rep) } } -void iter_store_parentside_neg(struct module_env* env, +void iter_store_parentside_neg(struct module_env* env, struct query_info* qinfo, struct reply_info* rep) { /* TTL: NS from referral in iq->deleg_msg, * or first RR from iq->response, - * or servfail5secs if !iq->response */ + * or servfail5secs if !iq->response */ time_t ttl = NORR_TTL; struct ub_packed_rrset_key* neg; struct packed_rrset_data* newd; @@ -1133,7 +1134,7 @@ void iter_store_parentside_neg(struct module_env* env, neg->rk.type = htons(qinfo->qtype); neg->rk.rrset_class = htons(qinfo->qclass); neg->rk.flags = 0; - neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname, + neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname, qinfo->qname_len); if(!neg->rk.dname) { log_err("out of memory in store_parentside_neg"); @@ -1141,7 +1142,7 @@ void iter_store_parentside_neg(struct module_env* env, } neg->rk.dname_len = qinfo->qname_len; neg->entry.hash = rrset_key_hash(&neg->rk); - newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch, + newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch, sizeof(struct packed_rrset_data) + sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)); if(!newd) { @@ -1166,13 +1167,13 @@ void iter_store_parentside_neg(struct module_env* env, iter_store_parentside_rrset(env, neg); } -int +int iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp, struct regional* region, struct query_info* qinfo) { struct ub_packed_rrset_key* akey; - akey = rrset_cache_lookup(env->rrset_cache, dp->name, - dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass, + akey = rrset_cache_lookup(env->rrset_cache, dp->name, + dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass, PACKED_RRSET_PARENT_SIDE, *env->now, 0); if(akey) { log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey); @@ -1195,8 +1196,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env, size_t num = delegpt_count_targets(dp); for(ns = dp->nslist; ns; ns = ns->next) { /* get cached parentside A */ - akey = rrset_cache_lookup(env->rrset_cache, ns->name, - ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass, + akey = rrset_cache_lookup(env->rrset_cache, ns->name, + ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass, PACKED_RRSET_PARENT_SIDE, *env->now, 0); if(akey) { log_rrset_key(VERB_ALGO, "found parent-side", akey); @@ -1207,8 +1208,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env, lock_rw_unlock(&akey->entry.lock); } /* get cached parentside AAAA */ - akey = rrset_cache_lookup(env->rrset_cache, ns->name, - ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass, + akey = rrset_cache_lookup(env->rrset_cache, ns->name, + ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass, PACKED_RRSET_PARENT_SIDE, *env->now, 0); if(akey) { log_rrset_key(VERB_ALGO, "found parent-side", akey); @@ -1223,8 +1224,8 @@ int iter_lookup_parent_glue_from_cache(struct module_env* env, return delegpt_count_targets(dp) != num; } -int -iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, +int +iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, uint16_t* c) { uint16_t c1 = *c, c2 = *c; @@ -1246,7 +1247,7 @@ void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z) { /* Only the DS record for the delegation itself is expected. - * We allow DS for everything between the bailiwick and the + * We allow DS for everything between the bailiwick and the * zonecut, thus DS records must be at or above the zonecut. * And the DS records must be below the server authority zone. * The answer section is already scrubbed. */ @@ -1260,7 +1261,7 @@ iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z) s->rk.dname, ntohs(s->rk.type), ntohs(s->rk.rrset_class)); memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1, - sizeof(struct ub_packed_rrset_key*) * + sizeof(struct ub_packed_rrset_key*) * (msg->rep->rrset_count-i-1)); msg->rep->ns_numrrsets--; msg->rep->rrset_count--; @@ -1284,11 +1285,11 @@ iter_scrub_nxdomain(struct dns_msg* msg) msg->rep->an_numrrsets = 0; } -void iter_dec_attempts(struct delegpt* dp, int d) +void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry) { struct delegpt_addr* a; for(a=dp->target_list; a; a = a->next_target) { - if(a->attempts >= OUTBOUND_MSG_RETRY) { + if(a->attempts >= outbound_msg_retry) { /* add back to result list */ a->next_result = dp->result_list; dp->result_list = a; @@ -1299,7 +1300,8 @@ void iter_dec_attempts(struct delegpt* dp, int d) } } -void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old) +void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old, + int outbound_msg_retry) { struct delegpt_addr* a, *o, *prev; for(a=dp->target_list; a; a = a->next_target) { @@ -1313,7 +1315,7 @@ void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old) prev = NULL; a = dp->usable_list; while(a) { - if(a->attempts >= OUTBOUND_MSG_RETRY) { + if(a->attempts >= outbound_msg_retry) { log_addr(VERB_ALGO, "remove from usable list dp", &a->addr, a->addrlen); /* remove from result list */ diff --git a/sbin/unwind/libunbound/iterator/iter_utils.h b/sbin/unwind/libunbound/iterator/iter_utils.h index 509d2921e30..0a40916c0e0 100644 --- a/sbin/unwind/libunbound/iterator/iter_utils.h +++ b/sbin/unwind/libunbound/iterator/iter_utils.h @@ -347,16 +347,19 @@ void iter_scrub_nxdomain(struct dns_msg* msg); * Remove query attempts from all available ips. For 0x20. * @param dp: delegpt. * @param d: decrease. + * @param outbound_msg_retry: number of retries of outgoing queries */ -void iter_dec_attempts(struct delegpt* dp, int d); +void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry); /** * Add retry counts from older delegpt to newer delegpt. * Does not waste time on timeout'd (or other failing) addresses. * @param dp: new delegationpoint. * @param old: old delegationpoint. + * @param outbound_msg_retry: number of retries of outgoing queries */ -void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old); +void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old, + int outbound_msg_retry); /** * See if a DS response (type ANSWER) is too low: a nodata answer with diff --git a/sbin/unwind/libunbound/iterator/iterator.c b/sbin/unwind/libunbound/iterator/iterator.c index f0105ad4b08..54006940d90 100644 --- a/sbin/unwind/libunbound/iterator/iterator.c +++ b/sbin/unwind/libunbound/iterator/iterator.c @@ -1533,36 +1533,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, if(!iq->ratelimit_ok && qstate->prefetch_leeway) iq->ratelimit_ok = 1; /* allow prefetches, this keeps otherwise valid data in the cache */ - if(!iq->ratelimit_ok && infra_ratelimit_exceeded( - qstate->env->infra_cache, iq->dp->name, - iq->dp->namelen, *qstate->env->now)) { - /* and increment the rate, so that the rate for time - * now will also exceed the rate, keeping cache fresh */ - (void)infra_ratelimit_inc(qstate->env->infra_cache, - iq->dp->name, iq->dp->namelen, - *qstate->env->now, &qstate->qinfo, - qstate->reply); - /* see if we are passed through with slip factor */ - if(qstate->env->cfg->ratelimit_factor != 0 && - ub_random_max(qstate->env->rnd, - qstate->env->cfg->ratelimit_factor) == 1) { - iq->ratelimit_ok = 1; - log_nametypeclass(VERB_ALGO, "ratelimit allowed through for " - "delegation point", iq->dp->name, - LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN); - } else { - lock_basic_lock(&ie->queries_ratelimit_lock); - ie->num_queries_ratelimited++; - lock_basic_unlock(&ie->queries_ratelimit_lock); - log_nametypeclass(VERB_ALGO, "ratelimit exceeded with " - "delegation point", iq->dp->name, - LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN); - qstate->was_ratelimited = 1; - errinf(qstate, "query was ratelimited"); - errinf_dname(qstate, "for zone", iq->dp->name); - return error_response(qstate, id, LDNS_RCODE_SERVFAIL); - } - } /* see if this dp not useless. * It is useless if: @@ -1988,12 +1958,13 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, iq->chase_flags &= ~BIT_RD; /* go to authorities */ for(ns = p->nslist; ns; ns=ns->next) { (void)delegpt_add_ns(iq->dp, qstate->region, - ns->name, ns->lame); + ns->name, ns->lame, ns->tls_auth_name, + ns->port); } for(a = p->target_list; a; a=a->next_target) { (void)delegpt_add_addr(iq->dp, qstate->region, &a->addr, a->addrlen, a->bogus, - a->lame, a->tls_auth_name, NULL); + a->lame, a->tls_auth_name, -1, NULL); } } iq->dp->has_parent_side_NS = 1; @@ -2211,9 +2182,11 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, int auth_fallback = 0; uint8_t* qout_orig = NULL; size_t qout_orig_len = 0; + int sq_check_ratelimit = 1; + int sq_was_ratelimited = 0; - /* NOTE: a request will encounter this state for each target it - * needs to send a query to. That is, at least one per referral, + /* NOTE: a request will encounter this state for each target it + * needs to send a query to. That is, at least one per referral, * more if some targets timeout or return throwaway answers. */ log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo); @@ -2298,7 +2271,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, iq->minimise_count++; iq->timeout_count = 0; - iter_dec_attempts(iq->dp, 1); + iter_dec_attempts(iq->dp, 1, ie->outbound_msg_retry); /* Limit number of iterations for QNAMEs with more * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB @@ -2500,7 +2473,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, (int)iq->caps_server+1, (int)naddr*3); iq->response = iq->caps_response; iq->caps_fallback = 0; - iter_dec_attempts(iq->dp, 3); /* space for fallback */ + iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */ iq->num_current_queries++; /* RespState decrements it*/ iq->referral_count++; /* make sure we don't loop */ iq->sent_count = 0; @@ -2529,6 +2502,23 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, /* Add the current set of unused targets to our queue. */ delegpt_add_unused_targets(iq->dp); + if(qstate->env->auth_zones) { + /* apply rpz triggers at query time */ + struct dns_msg* forged_response = rpz_callback_from_iterator_module(qstate, iq); + if(forged_response != NULL) { + qstate->ext_state[id] = module_finished; + qstate->return_rcode = LDNS_RCODE_NOERROR; + qstate->return_msg = forged_response; + iq->response = forged_response; + next_state(iq, FINISHED_STATE); + if(!iter_prepend(iq, qstate->return_msg, qstate->region)) { + log_err("rpz, prepend rrsets: out of memory"); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } + return 0; + } + } + /* Select the next usable target, filtering out unsuitable targets. */ target = iter_server_selection(ie, qstate->env, iq->dp, iq->dp->name, iq->dp->namelen, iq->qchase.qtype, @@ -2588,7 +2578,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, (int)iq->caps_server+1); iq->response = iq->caps_response; iq->caps_fallback = 0; - iter_dec_attempts(iq->dp, 3); /* space for fallback */ + iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */ iq->num_current_queries++; /* RespState decrements it*/ iq->referral_count++; /* make sure we don't loop */ iq->sent_count = 0; @@ -2629,22 +2619,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, return 0; } - /* if not forwarding, check ratelimits per delegationpoint name */ - if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) { - if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name, - iq->dp->namelen, *qstate->env->now, &qstate->qinfo, - qstate->reply)) { - lock_basic_lock(&ie->queries_ratelimit_lock); - ie->num_queries_ratelimited++; - lock_basic_unlock(&ie->queries_ratelimit_lock); - verbose(VERB_ALGO, "query exceeded ratelimits"); - qstate->was_ratelimited = 1; - errinf_dname(qstate, "exceeded ratelimit for zone", - iq->dp->name); - return error_response(qstate, id, LDNS_RCODE_SERVFAIL); - } - } - + /* Do not check ratelimit for forwarding queries or if we already got a + * pass. */ + sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok); /* We have a valid target. */ if(verbosity >= VERB_QUERY) { log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out); @@ -2656,24 +2633,32 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, } fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query)); outq = (*qstate->env->send_query)(&iq->qinfo_out, - iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), + iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), /* unset CD if to forwarder(RD set) and not dnssec retry * (blacklist nonempty) and no trust-anchors are configured * above the qname or on the first attempt when dnssec is on */ EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&& !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env, - &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), + &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted( - ie, iq), &target->addr, target->addrlen, + ie, iq), sq_check_ratelimit, &target->addr, target->addrlen, iq->dp->name, iq->dp->namelen, + (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream), (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), - target->tls_auth_name, qstate); + target->tls_auth_name, qstate, &sq_was_ratelimited); if(!outq) { + if(sq_was_ratelimited) { + lock_basic_lock(&ie->queries_ratelimit_lock); + ie->num_queries_ratelimited++; + lock_basic_unlock(&ie->queries_ratelimit_lock); + verbose(VERB_ALGO, "query exceeded ratelimits"); + qstate->was_ratelimited = 1; + errinf_dname(qstate, "exceeded ratelimit for zone", + iq->dp->name); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } log_addr(VERB_QUERY, "error sending query to auth server", &target->addr, target->addrlen); - if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) - infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name, - iq->dp->namelen, *qstate->env->now); if(qstate->env->cfg->qname_minimisation) iq->minimisation_state = SKIP_MINIMISE_STATE; return next_state(iq, QUERYTARGETS_STATE); @@ -2707,6 +2692,7 @@ find_NS(struct reply_info* rep, size_t from, size_t to) * * @param qstate: query state. * @param iq: iterator query state. + * @param ie: iterator shared global environment. * @param id: module id. * @return true if the event requires more immediate processing, false if * not. This is generally only true when forwarding the request to @@ -2714,10 +2700,11 @@ find_NS(struct reply_info* rep, size_t from, size_t to) */ static int processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, - int id) + struct iter_env* ie, int id) { int dnsseclame = 0; enum response_type type; + iq->num_current_queries--; if(!inplace_cb_query_response_call(qstate->env, qstate, iq->response)) @@ -2915,14 +2902,6 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, * delegation point, and back to the QUERYTARGETS_STATE. */ verbose(VERB_DETAIL, "query response was REFERRAL"); - if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) { - /* we have a referral, no ratelimit, we can send - * our queries to the given name */ - infra_ratelimit_dec(qstate->env->infra_cache, - iq->dp->name, iq->dp->namelen, - *qstate->env->now); - } - /* if hardened, only store referral if we asked for it */ if(!qstate->no_cache_store && (!qstate->env->cfg->harden_referral_path || @@ -2983,7 +2962,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, } if(iq->store_parent_NS && query_dname_compare(iq->dp->name, iq->store_parent_NS->name) == 0) - iter_merge_retry_counts(iq->dp, iq->store_parent_NS); + iter_merge_retry_counts(iq->dp, iq->store_parent_NS, + ie->outbound_msg_retry); delegpt_log(VERB_ALGO, iq->dp); /* Count this as a referral. */ iq->referral_count++; @@ -3061,6 +3041,39 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, /* set the current request's qname to the new value. */ iq->qchase.qname = sname; iq->qchase.qname_len = snamelen; + if(qstate->env->auth_zones) { + /* apply rpz qname triggers after cname */ + struct dns_msg* forged_response = + rpz_callback_from_iterator_cname(qstate, iq); + while(forged_response && reply_find_rrset_section_an( + forged_response->rep, iq->qchase.qname, + iq->qchase.qname_len, LDNS_RR_TYPE_CNAME, + iq->qchase.qclass)) { + /* another cname to follow */ + if(!handle_cname_response(qstate, iq, forged_response, + &sname, &snamelen)) { + errinf(qstate, "malloc failure, CNAME info"); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } + iq->qchase.qname = sname; + iq->qchase.qname_len = snamelen; + forged_response = + rpz_callback_from_iterator_cname(qstate, iq); + } + if(forged_response != NULL) { + qstate->ext_state[id] = module_finished; + qstate->return_rcode = LDNS_RCODE_NOERROR; + qstate->return_msg = forged_response; + iq->response = forged_response; + next_state(iq, FINISHED_STATE); + if(!iter_prepend(iq, qstate->return_msg, qstate->region)) { + log_err("rpz after cname, prepend rrsets: out of memory"); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } + qstate->return_msg->qinfo = qstate->qinfo; + return 0; + } + } /* Clear the query state, since this is a query restart. */ iq->deleg_msg = NULL; iq->dp = NULL; @@ -3188,7 +3201,7 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq) /* Convert our response to a delegation point */ dp = delegpt_from_message(qstate->return_msg, forq->region); if(!dp) { - /* if there is no convertable delegation point, then + /* if there is no convertible delegation point, then * the ANSWER type was (presumably) a negative answer. */ verbose(VERB_ALGO, "prime response was not a positive " "ANSWER; failing"); @@ -3330,21 +3343,22 @@ processTargetResponse(struct module_qstate* qstate, int id, log_err("out of memory adding pside glue"); } - /* This response is relevant to the current query, so we - * add (attempt to add, anyway) this target(s) and reactivate - * the original event. - * NOTE: we could only look for the AnswerRRset if the + /* This response is relevant to the current query, so we + * add (attempt to add, anyway) this target(s) and reactivate + * the original event. + * NOTE: we could only look for the AnswerRRset if the * response type was ANSWER. */ rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep); if(rrset) { int additions = 0; /* if CNAMEs have been followed - add new NS to delegpt. */ /* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */ - if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, + if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, rrset->rk.dname_len)) { /* if dpns->lame then set newcname ns lame too */ - if(!delegpt_add_ns(foriq->dp, forq->region, - rrset->rk.dname, dpns->lame)) + if(!delegpt_add_ns(foriq->dp, forq->region, + rrset->rk.dname, dpns->lame, dpns->tls_auth_name, + dpns->port)) log_err("out of memory adding cnamed-ns"); } /* if dpns->lame then set the address(es) lame too */ @@ -3694,7 +3708,7 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, cont = processQueryTargets(qstate, iq, ie, id); break; case QUERY_RESP_STATE: - cont = processQueryResponse(qstate, iq, id); + cont = processQueryResponse(qstate, iq, ie, id); break; case PRIME_RESP_STATE: cont = processPrimeResponse(qstate, id); @@ -3764,7 +3778,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq, iq->num_current_queries--; /* need fresh attempts for the 0x20 fallback, if * that was the cause for the failure */ - iter_dec_attempts(iq->dp, 3); + iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback"); goto handle_it; } @@ -3798,15 +3812,15 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq, goto handle_it; } /* edns is not examined, but removed from message to help cache */ - if(parse_extract_edns(prs, &edns, qstate->env->scratch) != + if(parse_extract_edns_from_response_msg(prs, &edns, qstate->env->scratch) != LDNS_RCODE_NOERROR) { iq->parse_failures++; goto handle_it; } /* Copy the edns options we may got from the back end */ - if(edns.opt_list) { - qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list, + if(edns.opt_list_in) { + qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in, qstate->region); if(!qstate->edns_opts_back_in) { log_err("out of memory on incoming message"); diff --git a/sbin/unwind/libunbound/iterator/iterator.h b/sbin/unwind/libunbound/iterator/iterator.h index dc5e57527d8..8b840528d9d 100644 --- a/sbin/unwind/libunbound/iterator/iterator.h +++ b/sbin/unwind/libunbound/iterator/iterator.h @@ -80,7 +80,7 @@ struct rbtree_type; /** * number of labels from QNAME that are always send individually when using * QNAME minimisation, even when the number of labels of the QNAME is bigger - * tham MAX_MINIMISE_COUNT */ + * than MAX_MINIMISE_COUNT */ #define MINIMISE_ONE_LAB 4 #define MINIMISE_MULTIPLE_LABS (MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB) /** at what query-sent-count to stop target fetch policy */ @@ -94,8 +94,6 @@ extern int UNKNOWN_SERVER_NICENESS; * Equals RTT_MAX_TIMEOUT */ #define USEFUL_SERVER_TOP_TIMEOUT 120000 -/** number of retries on outgoing queries */ -#define OUTBOUND_MSG_RETRY 5 /** RTT band, within this amount from the best, servers are chosen randomly. * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a * fast server, this causes server exploration as a side benefit. msec. */ @@ -139,6 +137,9 @@ struct iter_env { lock_basic_type queries_ratelimit_lock; /** number of queries that have been ratelimited */ size_t num_queries_ratelimited; + + /** number of retries on outgoing queries */ + int outbound_msg_retry; }; /** @@ -378,7 +379,7 @@ struct iter_qstate { /** list of pending queries to authoritative servers. */ struct outbound_list outlist; - /** QNAME minimisation state, RFC7816 */ + /** QNAME minimisation state, RFC9156 */ enum minimisation_state minimisation_state; /** State for capsfail: QNAME minimisation state for comparisons. */ diff --git a/sbin/unwind/libunbound/libunbound/context.c b/sbin/unwind/libunbound/libunbound/context.c index e589c6ae28d..c8d911f13c7 100644 --- a/sbin/unwind/libunbound/libunbound/context.c +++ b/sbin/unwind/libunbound/libunbound/context.c @@ -48,6 +48,7 @@ #include "services/cache/rrset.h" #include "services/cache/infra.h" #include "services/authzone.h" +#include "services/listen_dnsport.h" #include "util/data/msgreply.h" #include "util/storage/slabhash.h" #include "util/edns.h" @@ -73,6 +74,7 @@ context_finalize(struct ub_ctx* ctx) config_apply(cfg); if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env)) return UB_INITFAIL; + listen_setup_locks(); log_edns_known_options(VERB_ALGO, ctx->env); ctx->local_zones = local_zones_create(); if(!ctx->local_zones) diff --git a/sbin/unwind/libunbound/libunbound/context.h b/sbin/unwind/libunbound/libunbound/context.h index 78f8731e236..c0c86fb5269 100644 --- a/sbin/unwind/libunbound/libunbound/context.h +++ b/sbin/unwind/libunbound/libunbound/context.h @@ -176,35 +176,6 @@ struct ctx_query { struct ub_result* res; }; -/** - * The error constants - */ -enum ub_ctx_err { - /** no error */ - UB_NOERROR = 0, - /** socket operation. Set to -1, so that if an error from _fd() is - * passed (-1) it gives a socket error. */ - UB_SOCKET = -1, - /** alloc failure */ - UB_NOMEM = -2, - /** syntax error */ - UB_SYNTAX = -3, - /** DNS service failed */ - UB_SERVFAIL = -4, - /** fork() failed */ - UB_FORKFAIL = -5, - /** cfg change after finalize() */ - UB_AFTERFINAL = -6, - /** initialization failed (bad settings) */ - UB_INITFAIL = -7, - /** error in pipe communication with async bg worker */ - UB_PIPE = -8, - /** error reading from file (resolv.conf) */ - UB_READFILE = -9, - /** error async_id does not exist or result already been delivered */ - UB_NOID = -10 -}; - /** * Command codes for libunbound pipe. * diff --git a/sbin/unwind/libunbound/libunbound/libunbound.c b/sbin/unwind/libunbound/libunbound/libunbound.c index c9e24ba8d8f..038b7b927a7 100644 --- a/sbin/unwind/libunbound/libunbound/libunbound.c +++ b/sbin/unwind/libunbound/libunbound/libunbound.c @@ -64,6 +64,7 @@ #include "services/cache/infra.h" #include "services/cache/rrset.h" #include "services/authzone.h" +#include "services/listen_dnsport.h" #include "sldns/sbuffer.h" #ifdef HAVE_PTHREAD #include @@ -185,6 +186,7 @@ ub_ctx_create(void) ub_randfree(ctx->seed_rnd); config_delete(ctx->env->cfg); modstack_desetup(&ctx->mods, ctx->env); + listen_desetup_locks(); edns_known_options_delete(ctx->env); edns_strings_delete(ctx->env->edns_strings); free(ctx->env); @@ -198,6 +200,7 @@ ub_ctx_create(void) ub_randfree(ctx->seed_rnd); config_delete(ctx->env->cfg); modstack_desetup(&ctx->mods, ctx->env); + listen_desetup_locks(); edns_known_options_delete(ctx->env); edns_strings_delete(ctx->env->edns_strings); free(ctx->env); @@ -344,6 +347,7 @@ ub_ctx_delete(struct ub_ctx* ctx) } ub_randfree(ctx->seed_rnd); alloc_clear(&ctx->superalloc); + listen_desetup_locks(); traverse_postorder(&ctx->queries, delq, NULL); if(ctx_logfile_overridden) { log_file(NULL); diff --git a/sbin/unwind/libunbound/libunbound/libworker.c b/sbin/unwind/libunbound/libunbound/libworker.c index 8a9ca941948..ab28dd54f94 100644 --- a/sbin/unwind/libunbound/libunbound/libworker.c +++ b/sbin/unwind/libunbound/libunbound/libworker.c @@ -600,7 +600,9 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q, edns->ext_rcode = 0; edns->edns_version = 0; edns->bits = EDNS_DO; - edns->opt_list = NULL; + edns->opt_list_in = NULL; + edns->opt_list_out = NULL; + edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; if(sldns_buffer_capacity(w->back->udp_buff) < 65535) edns->udp_size = (uint16_t)sldns_buffer_capacity( @@ -880,9 +882,10 @@ void libworker_alloc_cleanup(void* arg) struct outbound_entry* libworker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, int nocaps, + int check_ratelimit, struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, - size_t zonelen, int ssl_upstream, char* tls_auth_name, - struct module_qstate* q) + size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name, + struct module_qstate* q, int* was_ratelimited) { struct libworker* w = (struct libworker*)q->env->worker; struct outbound_entry* e = (struct outbound_entry*)regional_alloc( @@ -891,9 +894,10 @@ struct outbound_entry* libworker_send_query(struct query_info* qinfo, return NULL; e->qstate = q; e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec, - want_dnssec, nocaps, q->env->cfg->tcp_upstream, ssl_upstream, + want_dnssec, nocaps, check_ratelimit, tcp_upstream, ssl_upstream, tls_auth_name, addr, addrlen, zone, zonelen, q, - libworker_handle_service_reply, e, w->back->udp_buff, q->env); + libworker_handle_service_reply, e, w->back->udp_buff, q->env, + was_ratelimited); if(!e->qsent) { return NULL; } @@ -974,10 +978,11 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg)) struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps), + int ATTR_UNUSED(check_ratelimit), struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen), - uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), + uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream), int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name), - struct module_qstate* ATTR_UNUSED(q)) + struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited)) { log_assert(0); return 0; diff --git a/sbin/unwind/libunbound/libunbound/unbound-event.h b/sbin/unwind/libunbound/libunbound/unbound-event.h index 4d694b8b4c5..a5d5c038b68 100644 --- a/sbin/unwind/libunbound/libunbound/unbound-event.h +++ b/sbin/unwind/libunbound/libunbound/unbound-event.h @@ -41,7 +41,7 @@ * * Use ub_ctx_create_event_ub_base() to create an unbound context that uses * the user provided event base API. Then, use the ub_resolve_event call - * to add DNS resolve queries to the context. Those then run whith the + * to add DNS resolve queries to the context. Those then run with the * provided event_base, and when they are done you get a function callback. * * This method does not fork another process or create a thread, the effort diff --git a/sbin/unwind/libunbound/libunbound/unbound.h b/sbin/unwind/libunbound/libunbound/unbound.h index 945c17a8fb5..ee855875906 100644 --- a/sbin/unwind/libunbound/libunbound/unbound.h +++ b/sbin/unwind/libunbound/libunbound/unbound.h @@ -224,7 +224,7 @@ struct ub_result { * It is called with * void* my_arg: your pointer to a (struct of) data of your choice, * or NULL. - * int err: if 0 all is OK, otherwise an error occured and no results + * int err: if 0 all is OK, otherwise an error occurred and no results * are forthcoming. * struct result: pointer to more detailed result structure. * This structure is allocated on the heap and needs to be @@ -232,6 +232,35 @@ struct ub_result { */ typedef void (*ub_callback_type)(void*, int, struct ub_result*); +/** + * The error constants + */ +enum ub_ctx_err { + /** no error */ + UB_NOERROR = 0, + /** socket operation. Set to -1, so that if an error from _fd() is + * passed (-1) it gives a socket error. */ + UB_SOCKET = -1, + /** alloc failure */ + UB_NOMEM = -2, + /** syntax error */ + UB_SYNTAX = -3, + /** DNS service failed */ + UB_SERVFAIL = -4, + /** fork() failed */ + UB_FORKFAIL = -5, + /** cfg change after finalize() */ + UB_AFTERFINAL = -6, + /** initialization failed (bad settings) */ + UB_INITFAIL = -7, + /** error in pipe communication with async bg worker */ + UB_PIPE = -8, + /** error reading from file (resolv.conf) */ + UB_READFILE = -9, + /** error async_id does not exist or result already been delivered */ + UB_NOID = -10 +}; + /** * Create a resolving and validation context. * The information from /etc/resolv.conf and /etc/hosts is not utilised by @@ -563,6 +592,7 @@ void ub_resolve_free(struct ub_result* result); /** * Convert error value to a human readable string. * @param err: error code from one of the libunbound functions. + * The error codes are from the type enum ub_ctx_err. * @return pointer to constant text string, zero terminated. */ const char* ub_strerror(int err); diff --git a/sbin/unwind/libunbound/libunbound/worker.h b/sbin/unwind/libunbound/libunbound/worker.h index bf7473861af..0fa5bfa9943 100644 --- a/sbin/unwind/libunbound/libunbound/worker.h +++ b/sbin/unwind/libunbound/libunbound/worker.h @@ -58,22 +58,27 @@ struct query_info; * @param dnssec: if set, EDNS record will have DO bit set. * @param want_dnssec: signatures needed. * @param nocaps: ignore capsforid(if in config), do not perturb qname. + * @param check_ratelimit: if set, will check ratelimit before sending out. * @param addr: where to. * @param addrlen: length of addr. * @param zone: delegation point name. * @param zonelen: length of zone name wireformat dname. + * @param tcp_upstream: use TCP for upstream queries. * @param ssl_upstream: use SSL for upstream queries. * @param tls_auth_name: if ssl_upstream, use this name with TLS * authentication. - * @param q: wich query state to reactivate upon return. + * @param q: which query state to reactivate upon return. + * @param was_ratelimited: it will signal back if the query failed to pass the + * ratelimit check. * @return: false on failure (memory or socket related). no query was * sent. */ struct outbound_entry* libworker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, int nocaps, + int check_ratelimit, struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, - size_t zonelen, int ssl_upstream, char* tls_auth_name, - struct module_qstate* q); + size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name, + struct module_qstate* q, int* was_ratelimited); /** process incoming serviced query replies from the network */ int libworker_handle_service_reply(struct comm_point* c, void* arg, int error, @@ -109,22 +114,27 @@ void worker_sighandler(int sig, void* arg); * @param dnssec: if set, EDNS record will have DO bit set. * @param want_dnssec: signatures needed. * @param nocaps: ignore capsforid(if in config), do not perturb qname. + * @param check_ratelimit: if set, will check ratelimit before sending out. * @param addr: where to. * @param addrlen: length of addr. * @param zone: wireformat dname of the zone. * @param zonelen: length of zone name. + * @param tcp_upstream: use TCP for upstream queries. * @param ssl_upstream: use SSL for upstream queries. * @param tls_auth_name: if ssl_upstream, use this name with TLS * authentication. - * @param q: wich query state to reactivate upon return. + * @param q: which query state to reactivate upon return. + * @param was_ratelimited: it will signal back if the query failed to pass the + * ratelimit check. * @return: false on failure (memory or socket related). no query was * sent. */ struct outbound_entry* worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, int nocaps, + int check_ratelimit, struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, - size_t zonelen, int ssl_upstream, char* tls_auth_name, - struct module_qstate* q); + size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name, + struct module_qstate* q, int* was_ratelimited); /** * process control messages from the main thread. Frees the control diff --git a/sbin/unwind/libunbound/respip/respip.c b/sbin/unwind/libunbound/respip/respip.c index aae41f5d636..3d1b3feaf46 100644 --- a/sbin/unwind/libunbound/respip/respip.c +++ b/sbin/unwind/libunbound/respip/respip.c @@ -25,6 +25,7 @@ #include "respip/respip.h" #include "services/view.h" #include "sldns/rrdef.h" +#include "util/data/dname.h" /** Subset of resp_addr.node, used for inform-variant logging */ @@ -483,8 +484,8 @@ respip_views_apply_cfg(struct views* vs, struct config_file* cfg, * This function returns the copied rrset key on success, and NULL on memory * allocation failure. */ -static struct ub_packed_rrset_key* -copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region) +struct ub_packed_rrset_key* +respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region) { struct ub_packed_rrset_key* ck = regional_alloc(region, sizeof(struct ub_packed_rrset_key)); @@ -602,7 +603,7 @@ rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i, */ static struct resp_addr* respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs, - size_t* rrset_id) + size_t* rrset_id, size_t* rr_id) { size_t i; struct resp_addr* ra; @@ -625,6 +626,7 @@ respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs, &ss, addrlen); if(ra) { *rrset_id = i; + *rr_id = j; lock_rw_rdlock(&ra->lock); lock_rw_unlock(&rs->lock); return ra; @@ -635,43 +637,6 @@ respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs, return NULL; } -/* - * Create a new reply_info based on 'rep'. The new info is based on - * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets' - * RRsets in the answer section. These answer rrsets are copied to the - * new info, up to 'copy_rrsets' rrsets (which must not be larger than - * 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array - * entries will be kept empty so the caller can fill them later. When rrsets - * are copied, they are shallow copied. The caller must ensure that the - * copied rrsets are valid throughout its lifetime and must provide appropriate - * mutex if it can be shared by multiple threads. - */ -static struct reply_info * -make_new_reply_info(const struct reply_info* rep, struct regional* region, - size_t an_numrrsets, size_t copy_rrsets) -{ - struct reply_info* new_rep; - size_t i; - - /* create a base struct. we specify 'insecure' security status as - * the modified response won't be DNSSEC-valid. In our faked response - * the authority and additional sections will be empty (except possible - * EDNS0 OPT RR in the additional section appended on sending it out), - * so the total number of RRsets is an_numrrsets. */ - new_rep = construct_reply_info_base(region, rep->flags, - rep->qdcount, rep->ttl, rep->prefetch_ttl, - rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets, - sec_status_insecure); - if(!new_rep) - return NULL; - if(!reply_info_alloc_rrset_keys(new_rep, NULL, region)) - return NULL; - for(i=0; irrsets[i] = rep->rrsets[i]; - - return new_rep; -} - /** * See if response-ip or tag data should override the original answer rrset * (which is rep->rrsets[rrset_id]) and if so override it. @@ -730,7 +695,7 @@ respip_data_answer(enum respip_action action, "response-ip redirect with tag data [%d] %s", tag, (tagrk.dname = rep->rrsets[rrset_id]->rk.dname; @@ -807,7 +772,6 @@ respip_nodata_answer(uint16_t qtype, enum respip_action action, * is explicitly specified. */ int rcode = (action == respip_always_nxdomain)? LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR; - /* We should empty the answer section except for any preceding * CNAMEs (in that case rrset_id > 0). Type-ANY case is * special as noted in respip_data_answer(). */ @@ -907,7 +871,7 @@ respip_rewrite_reply(const struct query_info* qinfo, size_t tag_datas_size; struct view* view = NULL; struct respip_set* ipset = NULL; - size_t rrset_id = 0; + size_t rrset_id = 0, rr_id = 0; enum respip_action action = respip_none; int tag = -1; struct resp_addr* raddr = NULL; @@ -948,7 +912,7 @@ respip_rewrite_reply(const struct query_info* qinfo, lock_rw_rdlock(&view->lock); if(view->respip_set) { if((raddr = respip_addr_lookup(rep, - view->respip_set, &rrset_id))) { + view->respip_set, &rrset_id, &rr_id))) { /** for per-view respip directives the action * can only be direct (i.e. not tag-based) */ action = raddr->action; @@ -962,7 +926,7 @@ respip_rewrite_reply(const struct query_info* qinfo, } } if(!raddr && (raddr = respip_addr_lookup(rep, ipset, - &rrset_id))) { + &rrset_id, &rr_id))) { action = (enum respip_action)local_data_find_tag_action( raddr->taglist, raddr->taglen, ctaglist, ctaglen, tag_actions, tag_actions_size, @@ -976,7 +940,7 @@ respip_rewrite_reply(const struct query_info* qinfo, if(!r->taglist || taglist_intersect(r->taglist, r->taglistlen, ctaglist, ctaglen)) { if((raddr = respip_addr_lookup(rep, - r->respip_set, &rrset_id))) { + r->respip_set, &rrset_id, &rr_id))) { if(!respip_use_rpz(raddr, r, &action, &data, &rpz_log, &log_name, &rpz_cname_override, region, &rpz_used)) { @@ -987,6 +951,21 @@ respip_rewrite_reply(const struct query_info* qinfo, return 0; } if(rpz_used) { + if(verbosity >= VERB_ALGO) { + struct sockaddr_storage ss; + socklen_t ss_len = 0; + char nm[256], ip[256]; + char qn[255+1]; + if(!rdata2sockaddr(rep->rrsets[rrset_id]->entry.data, ntohs(rep->rrsets[rrset_id]->rk.type), rr_id, &ss, &ss_len)) + snprintf(ip, sizeof(ip), "invalidRRdata"); + else + addr_to_str(&ss, ss_len, ip, sizeof(ip)); + dname_str(qinfo->qname, qn); + addr_to_str(&raddr->node.addr, + raddr->node.addrlen, + nm, sizeof(nm)); + verbose(VERB_ALGO, "respip: rpz response-ip trigger %s/%d on %s %s with action %s", nm, raddr->node.net, qn, ip, rpz_action_to_string(respip_action_to_rpz_action(action))); + } /* break to make sure 'a' stays pointed * to used auth_zone, and keeps lock */ break; @@ -1209,7 +1188,7 @@ respip_merge_cname(struct reply_info* base_rep, if(!new_rep) return 0; for(i=0,j=base_rep->an_numrrsets; ian_numrrsets; i++,j++) { - new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region); + new_rep->rrsets[j] = respip_copy_rrset(tgt_rep->rrsets[i], region); if(!new_rep->rrsets[j]) return 0; } diff --git a/sbin/unwind/libunbound/respip/respip.h b/sbin/unwind/libunbound/respip/respip.h index bbd471421c1..3dfb4e9f01c 100644 --- a/sbin/unwind/libunbound/respip/respip.h +++ b/sbin/unwind/libunbound/respip/respip.h @@ -294,4 +294,7 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr, */ void respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node); + +struct ub_packed_rrset_key* +respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region); #endif /* RESPIP_RESPIP_H */ diff --git a/sbin/unwind/libunbound/services/authzone.c b/sbin/unwind/libunbound/services/authzone.c index e6e3a8cff9b..e83af533dbc 100644 --- a/sbin/unwind/libunbound/services/authzone.c +++ b/sbin/unwind/libunbound/services/authzone.c @@ -84,7 +84,7 @@ #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */ /* auth transfer timeout for TCP connections, in msec */ #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */ -/* auth transfer max backoff for failed tranfers and probes */ +/* auth transfer max backoff for failed transfers and probes */ #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */ /* auth http port number */ #define AUTH_HTTP_PORT 80 @@ -243,7 +243,7 @@ msg_add_rrset_an(struct auth_zone* z, struct regional* region, return 1; } -/** add rrset to authority section (no additonal section rrsets yet) */ +/** add rrset to authority section (no additional section rrsets yet) */ static int msg_add_rrset_ns(struct auth_zone* z, struct regional* region, struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset) @@ -1950,6 +1950,17 @@ static int auth_zone_zonemd_check_hash(struct auth_zone* z, return 0; } +/** find the apex SOA RRset, if it exists */ +struct auth_rrset* auth_zone_get_soa_rrset(struct auth_zone* z) +{ + struct auth_data* apex; + struct auth_rrset* soa; + apex = az_find_name(z, z->name, z->namelen); + if(!apex) return NULL; + soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA); + return soa; +} + /** find serial number of zone or false if none */ int auth_zone_get_serial(struct auth_zone* z, uint32_t* serial) @@ -3507,7 +3518,7 @@ auth_error_encode(struct query_info* qinfo, struct module_env* env, if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL, rcode, edns, repinfo, temp, env->now_tv)) - edns->opt_list = NULL; + edns->opt_list_inplace_cb_out = NULL; error_encode(buf, rcode|BIT_AA, qinfo, *(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2), edns); @@ -5347,7 +5358,9 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.ext_rcode = 0; edns.edns_version = 0; edns.bits = EDNS_DO; - edns.opt_list = NULL; + edns.opt_list_in = NULL; + edns.opt_list_out = NULL; + edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); @@ -6480,7 +6493,7 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err, comm_point_delete(xfr->task_probe->cp); xfr->task_probe->cp = NULL; - /* if the result was not a successfull probe, we need + /* if the result was not a successful probe, we need * to send the next one */ xfr_probe_nextmaster(xfr); xfr_probe_send_or_end(xfr, env); @@ -6536,7 +6549,9 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.ext_rcode = 0; edns.edns_version = 0; edns.bits = EDNS_DO; - edns.opt_list = NULL; + edns.opt_list_in = NULL; + edns.opt_list_out = NULL; + edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); @@ -7149,7 +7164,7 @@ parse_url(char* url, char** host, char** file, int* port, int* ssl) while(p && *p == '/') p++; if(!p || p[0] == 0) - *file = strdup("index.html"); + *file = strdup("/"); else *file = strdup(p); if(!*file) { log_err("malloc failure"); @@ -7683,7 +7698,7 @@ static void auth_zone_log(uint8_t* name, enum verbosity_value level, static int zonemd_dnssec_verify_rrset(struct auth_zone* z, struct module_env* env, struct module_stack* mods, struct ub_packed_rrset_key* dnskey, struct auth_data* node, - struct auth_rrset* rrset, char** why_bogus) + struct auth_rrset* rrset, char** why_bogus, uint8_t* sigalg) { struct ub_packed_rrset_key pk; enum sec_status sec; @@ -7711,7 +7726,7 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z, auth_zone_log(z->name, VERB_ALGO, "zonemd: verify %s RRset with DNSKEY", typestr); } - sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, NULL, why_bogus, + sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, LDNS_SECTION_ANSWER, NULL); if(sec == sec_status_secure) { return 1; @@ -7755,7 +7770,7 @@ static int nsec3_of_param_has_type(struct auth_rrset* nsec3, int algo, static int zonemd_check_dnssec_absence(struct auth_zone* z, struct module_env* env, struct module_stack* mods, struct ub_packed_rrset_key* dnskey, struct auth_data* apex, - char** reason, char** why_bogus) + char** reason, char** why_bogus, uint8_t* sigalg) { struct auth_rrset* nsec = NULL; if(!apex) { @@ -7767,7 +7782,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z, struct ub_packed_rrset_key pk; /* dnssec verify the NSEC */ if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, - nsec, why_bogus)) { + nsec, why_bogus, sigalg)) { *reason = "DNSSEC verify failed for NSEC RRset"; return 0; } @@ -7810,7 +7825,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z, } /* dnssec verify the NSEC3 */ if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, match, - nsec3, why_bogus)) { + nsec3, why_bogus, sigalg)) { *reason = "DNSSEC verify failed for NSEC3 RRset"; return 0; } @@ -7831,7 +7846,8 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z, static int zonemd_check_dnssec_soazonemd(struct auth_zone* z, struct module_env* env, struct module_stack* mods, struct ub_packed_rrset_key* dnskey, struct auth_data* apex, - struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus) + struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus, + uint8_t* sigalg) { struct auth_rrset* soa; if(!apex) { @@ -7844,12 +7860,12 @@ static int zonemd_check_dnssec_soazonemd(struct auth_zone* z, return 0; } if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, soa, - why_bogus)) { + why_bogus, sigalg)) { *reason = "DNSSEC verify failed for SOA RRset"; return 0; } if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, - zonemd_rrset, why_bogus)) { + zonemd_rrset, why_bogus, sigalg)) { *reason = "DNSSEC verify failed for ZONEMD RRset"; return 0; } @@ -7908,12 +7924,14 @@ static void auth_zone_zonemd_fail(struct auth_zone* z, struct module_env* env, * @param is_insecure: if true, the dnskey is not used, the zone is insecure. * And dnssec is not used. It is DNSSEC secure insecure or not under * a trust anchor. + * @param sigalg: if nonNULL provide algorithm downgrade protection. + * Otherwise one algorithm is enough. Must have space of ALGO_NEEDS_MAX+1. * @param result: if not NULL result reason copied here. */ static void auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env, struct module_stack* mods, struct ub_packed_rrset_key* dnskey, - int is_insecure, char** result) + int is_insecure, char** result, uint8_t* sigalg) { char* reason = NULL, *why_bogus = NULL; struct auth_data* apex = NULL; @@ -7943,7 +7961,7 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env, } else if(!zonemd_rrset && dnskey && !is_insecure) { /* fetch, DNSSEC verify, and check NSEC/NSEC3 */ if(!zonemd_check_dnssec_absence(z, env, mods, dnskey, apex, - &reason, &why_bogus)) { + &reason, &why_bogus, sigalg)) { auth_zone_zonemd_fail(z, env, reason, why_bogus, result); return; } @@ -7951,7 +7969,7 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env, } else if(zonemd_rrset && dnskey && !is_insecure) { /* check DNSSEC verify of SOA and ZONEMD */ if(!zonemd_check_dnssec_soazonemd(z, env, mods, dnskey, apex, - zonemd_rrset, &reason, &why_bogus)) { + zonemd_rrset, &reason, &why_bogus, sigalg)) { auth_zone_zonemd_fail(z, env, reason, why_bogus, result); return; } @@ -8065,15 +8083,78 @@ zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env, return NULL; } +/** verify the DNSKEY from the zone with looked up DS record */ +static struct ub_packed_rrset_key* +auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z, + struct module_env* env, struct module_stack* mods, + struct ub_packed_rrset_key* ds, int* is_insecure, char** why_bogus, + struct ub_packed_rrset_key* keystorage, uint8_t* sigalg) +{ + struct auth_data* apex; + struct auth_rrset* dnskey_rrset; + enum sec_status sec; + struct val_env* ve; + int m; + + /* fetch DNSKEY from zone data */ + apex = az_find_name(z, z->name, z->namelen); + if(!apex) { + *why_bogus = "in verifywithDS, zone has no apex"; + return NULL; + } + dnskey_rrset = az_domain_rrset(apex, LDNS_RR_TYPE_DNSKEY); + if(!dnskey_rrset || dnskey_rrset->data->count==0) { + *why_bogus = "in verifywithDS, zone has no DNSKEY"; + return NULL; + } + + m = modstack_find(mods, "validator"); + if(m == -1) { + *why_bogus = "in verifywithDS, have no validator module"; + return NULL; + } + ve = (struct val_env*)env->modinfo[m]; + + memset(keystorage, 0, sizeof(*keystorage)); + keystorage->entry.key = keystorage; + keystorage->entry.data = dnskey_rrset->data; + keystorage->rk.dname = apex->name; + keystorage->rk.dname_len = apex->namelen; + keystorage->rk.type = htons(LDNS_RR_TYPE_DNSKEY); + keystorage->rk.rrset_class = htons(z->dclass); + auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS"); + sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg, + why_bogus, NULL); + regional_free_all(env->scratch); + if(sec == sec_status_secure) { + /* success */ + return keystorage; + } else if(sec == sec_status_insecure) { + /* insecure */ + *is_insecure = 1; + } else { + /* bogus */ + *is_insecure = 0; + if(*why_bogus == NULL) + *why_bogus = "verify failed"; + auth_zone_log(z->name, VERB_ALGO, + "zonemd: verify DNSKEY RRset with DS failed: %s", + *why_bogus); + } + return NULL; +} + /** callback for ZONEMD lookup of DNSKEY */ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf, enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited)) { struct auth_zone* z = (struct auth_zone*)arg; struct module_env* env; - char* reason = NULL; - struct ub_packed_rrset_key* dnskey = NULL; - int is_insecure = 0; + char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY"; + struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL; + int is_insecure = 0, downprot; + struct ub_packed_rrset_key keystorage; + uint8_t sigalg[ALGO_NEEDS_MAX+1]; lock_rw_wrlock(&z->lock); env = z->zonemd_callback_env; @@ -8084,16 +8165,22 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf, lock_rw_unlock(&z->lock); return; /* stop on quit */ } + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DS) + typestr = "DS"; + downprot = env->cfg->harden_algo_downgrade; /* process result */ if(sec == sec_status_bogus) { reason = why_bogus; - if(!reason) - reason = "lookup of DNSKEY was bogus"; + if(!reason) { + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) + reason = "lookup of DNSKEY was bogus"; + else reason = "lookup of DS was bogus"; + } auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was bogus: %s", reason); + "zonemd lookup of %s was bogus: %s", typestr, reason); } else if(rcode == LDNS_RCODE_NOERROR) { - uint16_t wanted_qtype = LDNS_RR_TYPE_DNSKEY; + uint16_t wanted_qtype = z->zonemd_callback_qtype; struct regional* temp = env->scratch; struct query_info rq; struct reply_info* rep; @@ -8106,25 +8193,29 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf, struct ub_packed_rrset_key* answer = reply_find_answer_rrset(&rq, rep); if(answer && sec == sec_status_secure) { - dnskey = answer; + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) + dnskey = answer; + else ds = answer; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was secure"); + "zonemd lookup of %s was secure", typestr); } else if(sec == sec_status_secure && !answer) { is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY has no content, but is secure, treat as insecure"); + "zonemd lookup of %s has no content, but is secure, treat as insecure", typestr); } else if(sec == sec_status_insecure) { is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was insecure"); + "zonemd lookup of %s was insecure", typestr); } else if(sec == sec_status_indeterminate) { is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was indeterminate, treat as insecure"); + "zonemd lookup of %s was indeterminate, treat as insecure", typestr); } else { auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY has nodata"); - reason = "lookup of DNSKEY has nodata"; + "zonemd lookup of %s has nodata", typestr); + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) + reason = "lookup of DNSKEY has nodata"; + else reason = "lookup of DS has nodata"; } } else if(rep && rq.qtype == wanted_qtype && query_dname_compare(z->name, rq.qname) == 0 && @@ -8137,40 +8228,52 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf, * trust, as insecure. */ is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was secure NXDOMAIN, treat as insecure"); + "zonemd lookup of %s was secure NXDOMAIN, treat as insecure", typestr); } else if(rep && rq.qtype == wanted_qtype && query_dname_compare(z->name, rq.qname) == 0 && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN && sec == sec_status_insecure) { is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was insecure NXDOMAIN, treat as insecure"); + "zonemd lookup of %s was insecure NXDOMAIN, treat as insecure", typestr); } else if(rep && rq.qtype == wanted_qtype && query_dname_compare(z->name, rq.qname) == 0 && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN && sec == sec_status_indeterminate) { is_insecure = 1; auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY was indeterminate NXDOMAIN, treat as insecure"); + "zonemd lookup of %s was indeterminate NXDOMAIN, treat as insecure", typestr); } else { auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY has no answer"); - reason = "lookup of DNSKEY has no answer"; + "zonemd lookup of %s has no answer", typestr); + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) + reason = "lookup of DNSKEY has no answer"; + else reason = "lookup of DS has no answer"; } } else { auth_zone_log(z->name, VERB_ALGO, - "zonemd lookup of DNSKEY failed"); - reason = "lookup of DNSKEY failed"; + "zonemd lookup of %s failed", typestr); + if(z->zonemd_callback_qtype == LDNS_RR_TYPE_DNSKEY) + reason = "lookup of DNSKEY failed"; + else reason = "lookup of DS failed"; + } + + if(!reason && !is_insecure && !dnskey && ds) { + dnskey = auth_zone_verify_zonemd_key_with_ds(z, env, + &env->mesh->mods, ds, &is_insecure, &ds_bogus, + &keystorage, downprot?sigalg:NULL); + if(!dnskey && !is_insecure && !reason) + reason = "DNSKEY verify with DS failed"; } if(reason) { - auth_zone_zonemd_fail(z, env, reason, NULL, NULL); + auth_zone_zonemd_fail(z, env, reason, ds_bogus, NULL); lock_rw_unlock(&z->lock); return; } auth_zone_verify_zonemd_with_key(z, env, &env->mesh->mods, dnskey, - is_insecure, NULL); + is_insecure, NULL, downprot?sigalg:NULL); regional_free_all(env->scratch); lock_rw_unlock(&z->lock); } @@ -8183,14 +8286,21 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env) uint16_t qflags = BIT_RD; struct edns_data edns; sldns_buffer* buf = env->scratch_buffer; + int fetch_ds = 0; + if(!z->fallback_enabled) { + /* we cannot actually get the DNSKEY, because it is in the + * zone we have ourselves, and it is not served yet + * (possibly), so fetch type DS */ + fetch_ds = 1; + } if(z->zonemd_callback_env) { /* another worker is already working on the callback * for the DNSKEY lookup for ZONEMD verification. * We do not also have to do ZONEMD verification, let that * worker do it */ auth_zone_log(z->name, VERB_ALGO, - "zonemd needs lookup of DNSKEY and that already worked on by another worker"); + "zonemd needs lookup of %s and that already is worked on by another worker", (fetch_ds?"DS":"DNSKEY")); return 1; } @@ -8199,21 +8309,26 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env) qinfo.qname_len = z->namelen; qinfo.qname = z->name; qinfo.qclass = z->dclass; - qinfo.qtype = LDNS_RR_TYPE_DNSKEY; + if(fetch_ds) + qinfo.qtype = LDNS_RR_TYPE_DS; + else qinfo.qtype = LDNS_RR_TYPE_DNSKEY; qinfo.local_alias = NULL; if(verbosity >= VERB_ALGO) { char buf1[512]; char buf2[LDNS_MAX_DOMAINLEN+1]; dname_str(z->name, buf2); - snprintf(buf1, sizeof(buf1), "auth zone %s: lookup DNSKEY " - "for zonemd verification", buf2); + snprintf(buf1, sizeof(buf1), "auth zone %s: lookup %s " + "for zonemd verification", buf2, + (fetch_ds?"DS":"DNSKEY")); log_query_info(VERB_ALGO, buf1, &qinfo); } edns.edns_present = 1; edns.ext_rcode = 0; edns.edns_version = 0; edns.bits = EDNS_DO; - edns.opt_list = NULL; + edns.opt_list_in = NULL; + edns.opt_list_out = NULL; + edns.opt_list_inplace_cb_out = NULL; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; @@ -8221,12 +8336,14 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env) /* store the worker-specific module env for the callback. * We can then reference this when the callback executes */ z->zonemd_callback_env = env; + z->zonemd_callback_qtype = qinfo.qtype; /* the callback can be called straight away */ lock_rw_unlock(&z->lock); if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, &auth_zonemd_dnskey_lookup_callback, z)) { lock_rw_wrlock(&z->lock); - log_err("out of memory lookup up dnskey for zonemd"); + log_err("out of memory lookup of %s for zonemd", + (fetch_ds?"DS":"DNSKEY")); return 0; } lock_rw_wrlock(&z->lock); @@ -8245,6 +8362,8 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env, * If not present check if absence is allowed by DNSSEC */ if(!z->zonemd_check) return; + if(z->data.count == 0) + return; /* no data */ /* if zone is under a trustanchor */ /* is it equal to trustanchor - get dnskey's verified */ @@ -8298,7 +8417,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env, } auth_zone_verify_zonemd_with_key(z, env, mods, dnskey, is_insecure, - result); + result, NULL); regional_free_all(env->scratch); } diff --git a/sbin/unwind/libunbound/services/authzone.h b/sbin/unwind/libunbound/services/authzone.h index ffe234d59b5..d24e569d3b8 100644 --- a/sbin/unwind/libunbound/services/authzone.h +++ b/sbin/unwind/libunbound/services/authzone.h @@ -143,6 +143,8 @@ struct auth_zone { * worker has already picked up the zonemd verification task and * this worker does not have to do it as well. */ struct module_env* zonemd_callback_env; + /** for the zonemd callback, the type of data looked up */ + uint16_t zonemd_callback_qtype; /** zone has been deleted */ int zone_deleted; /** deletelist pointer, unused normally except during delete */ @@ -634,6 +636,9 @@ int auth_zones_startprobesequence(struct auth_zones* az, /** read auth zone from zonefile. caller must lock zone. false on failure */ int auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg); +/** find the apex SOA RRset, if it exists. NULL if no SOA RRset. */ +struct auth_rrset* auth_zone_get_soa_rrset(struct auth_zone* z); + /** find serial number of zone or false if none (no SOA record) */ int auth_zone_get_serial(struct auth_zone* z, uint32_t* serial); diff --git a/sbin/unwind/libunbound/services/cache/infra.c b/sbin/unwind/libunbound/services/cache/infra.c index 518e69622f8..252e1e288b3 100644 --- a/sbin/unwind/libunbound/services/cache/infra.c +++ b/sbin/unwind/libunbound/services/cache/infra.c @@ -898,8 +898,9 @@ static void infra_ip_create_ratedata(struct infra_cache* infra, slabhash_insert(infra->client_ip_rates, h, &k->entry, d, NULL); } -/** find the second and return its rate counter, if none, remove oldest */ -static int* infra_rate_find_second(void* data, time_t t) +/** Find the second and return its rate counter. If none and should_add, remove + * oldest to accommodate. Else return none. */ +static int* infra_rate_find_second_or_none(void* data, time_t t, int should_add) { struct rate_data* d = (struct rate_data*)data; int i, oldest; @@ -907,6 +908,7 @@ static int* infra_rate_find_second(void* data, time_t t) if(d->timestamp[i] == t) return &(d->qps[i]); } + if(!should_add) return NULL; /* remove oldest timestamp, and insert it at t with 0 qps */ oldest = 0; for(i=0; iqps[oldest]); } -int infra_rate_max(void* data, time_t now) +/** find the second and return its rate counter, if none, remove oldest to + * accommodate */ +static int* infra_rate_give_second(void* data, time_t t) +{ + return infra_rate_find_second_or_none(data, t, 1); +} + +/** find the second and return its rate counter only if it exists. Caller + * should check for NULL return value */ +static int* infra_rate_get_second(void* data, time_t t) +{ + return infra_rate_find_second_or_none(data, t, 0); +} + +int infra_rate_max(void* data, time_t now, int backoff) { struct rate_data* d = (struct rate_data*)data; int i, max = 0; for(i=0; itimestamp[i] <= RATE_WINDOW) { - if(d->qps[i] > max) + if(backoff) { + if(now-d->timestamp[i] <= RATE_WINDOW && + d->qps[i] > max) { max = d->qps[i]; + } + } else { + if(now == d->timestamp[i]) { + return d->qps[i]; + } } } return max; } int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name, - size_t namelen, time_t timenow, struct query_info* qinfo, + size_t namelen, time_t timenow, int backoff, struct query_info* qinfo, struct comm_reply* replylist) { int lim, max; @@ -949,13 +971,13 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name, /* find or insert ratedata */ entry = infra_find_ratedata(infra, name, namelen, 1); if(entry) { - int premax = infra_rate_max(entry->data, timenow); - int* cur = infra_rate_find_second(entry->data, timenow); + int premax = infra_rate_max(entry->data, timenow, backoff); + int* cur = infra_rate_give_second(entry->data, timenow); (*cur)++; - max = infra_rate_max(entry->data, timenow); + max = infra_rate_max(entry->data, timenow, backoff); lock_rw_unlock(&entry->lock); - if(premax < lim && max >= lim) { + if(premax <= lim && max > lim) { char buf[257], qnm[257], ts[12], cs[12], ip[128]; dname_str(name, buf); dname_str(qinfo->qname, qnm); @@ -970,12 +992,12 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name, verbose(VERB_OPS, "ratelimit exceeded %s %d query %s %s %s", buf, lim, qnm, cs, ts); } } - return (max < lim); + return (max <= lim); } /* create */ infra_create_ratedata(infra, name, namelen, timenow); - return (1 < lim); + return (1 <= lim); } void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name, @@ -987,14 +1009,19 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name, return; /* not enabled */ entry = infra_find_ratedata(infra, name, namelen, 1); if(!entry) return; /* not cached */ - cur = infra_rate_find_second(entry->data, timenow); + cur = infra_rate_get_second(entry->data, timenow); + if(cur == NULL) { + /* our timenow is not available anymore; nothing to decrease */ + lock_rw_unlock(&entry->lock); + return; + } if((*cur) > 0) (*cur)--; lock_rw_unlock(&entry->lock); } int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name, - size_t namelen, time_t timenow) + size_t namelen, time_t timenow, int backoff) { struct lruhash_entry* entry; int lim, max; @@ -1010,7 +1037,7 @@ int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name, entry = infra_find_ratedata(infra, name, namelen, 0); if(!entry) return 0; /* not cached */ - max = infra_rate_max(entry->data, timenow); + max = infra_rate_max(entry->data, timenow, backoff); lock_rw_unlock(&entry->lock); return (max >= lim); @@ -1027,7 +1054,8 @@ infra_get_mem(struct infra_cache* infra) } int infra_ip_ratelimit_inc(struct infra_cache* infra, - struct comm_reply* repinfo, time_t timenow, struct sldns_buffer* buffer) + struct comm_reply* repinfo, time_t timenow, int backoff, + struct sldns_buffer* buffer) { int max; struct lruhash_entry* entry; @@ -1039,10 +1067,10 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra, /* find or insert ratedata */ entry = infra_find_ip_ratedata(infra, repinfo, 1); if(entry) { - int premax = infra_rate_max(entry->data, timenow); - int* cur = infra_rate_find_second(entry->data, timenow); + int premax = infra_rate_max(entry->data, timenow, backoff); + int* cur = infra_rate_give_second(entry->data, timenow); (*cur)++; - max = infra_rate_max(entry->data, timenow); + max = infra_rate_max(entry->data, timenow, backoff); lock_rw_unlock(&entry->lock); if(premax < infra_ip_ratelimit && max >= infra_ip_ratelimit) { diff --git a/sbin/unwind/libunbound/services/cache/infra.h b/sbin/unwind/libunbound/services/cache/infra.h index 14f97c4c64d..6a2371aca47 100644 --- a/sbin/unwind/libunbound/services/cache/infra.h +++ b/sbin/unwind/libunbound/services/cache/infra.h @@ -368,6 +368,7 @@ long long infra_get_host_rto(struct infra_cache* infra, * @param name: zone name * @param namelen: zone name length * @param timenow: what time it is now. + * @param backoff: if backoff is enabled. * @param qinfo: for logging, query name. * @param replylist: for logging, querier's address (if any). * @return 1 if it could be incremented. 0 if the increment overshot the @@ -375,7 +376,7 @@ long long infra_get_host_rto(struct infra_cache* infra, * Failures like alloc failures are not returned (probably as 1). */ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name, - size_t namelen, time_t timenow, struct query_info* qinfo, + size_t namelen, time_t timenow, int backoff, struct query_info* qinfo, struct comm_reply* replylist); /** @@ -398,13 +399,15 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name, * @param name: zone name * @param namelen: zone name length * @param timenow: what time it is now. + * @param backoff: if backoff is enabled. * @return true if exceeded. */ int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name, - size_t namelen, time_t timenow); + size_t namelen, time_t timenow, int backoff); -/** find the maximum rate stored, not too old. 0 if no information. */ -int infra_rate_max(void* data, time_t now); +/** find the maximum rate stored. 0 if no information. + * When backoff is enabled look for the maximum in the whole RATE_WINDOW. */ +int infra_rate_max(void* data, time_t now, int backoff); /** find the ratelimit in qps for a domain. 0 if no limit for domain. */ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name, @@ -415,11 +418,12 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name, * @param infra: infra cache * @param repinfo: information about client * @param timenow: what time it is now. + * @param backoff: if backoff is enabled. * @param buffer: with query for logging. * @return 1 if it could be incremented. 0 if the increment overshot the * ratelimit and the query should be dropped. */ int infra_ip_ratelimit_inc(struct infra_cache* infra, - struct comm_reply* repinfo, time_t timenow, + struct comm_reply* repinfo, time_t timenow, int backoff, struct sldns_buffer* buffer); /** diff --git a/sbin/unwind/libunbound/services/cache/rrset.h b/sbin/unwind/libunbound/services/cache/rrset.h index 35a0d732b04..7c36d4032eb 100644 --- a/sbin/unwind/libunbound/services/cache/rrset.h +++ b/sbin/unwind/libunbound/services/cache/rrset.h @@ -120,7 +120,7 @@ void rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key, * the new rrset. The reference may be changed if the cached rrset is * superior. * Before calling the rrset is presumed newly allocated and changeable. - * Afer calling you do not hold a lock, and the rrset is inserted in + * After calling you do not hold a lock, and the rrset is inserted in * the hashtable so you need a lock to change it. * @param alloc: how to allocate (and deallocate) the special rrset key. * @param timenow: current time (to see if ttl in cache is expired). @@ -143,7 +143,7 @@ int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref, * @param rrset: which rrset to cache as wildcard. This rrset is left * untouched. * @param ce: the closest encloser, will be uses to generate the wildcard dname. - * @param ce_len: the closest encloser lenght. + * @param ce_len: the closest encloser length. * @param alloc: how to allocate (and deallocate) the special rrset key. * @param timenow: current time (to see if ttl in cache is expired). */ diff --git a/sbin/unwind/libunbound/services/listen_dnsport.c b/sbin/unwind/libunbound/services/listen_dnsport.c index b43def56750..d6a90f1e68d 100644 --- a/sbin/unwind/libunbound/services/listen_dnsport.c +++ b/sbin/unwind/libunbound/services/listen_dnsport.c @@ -869,9 +869,14 @@ set_ip_dscp(int socket, int addrfamily, int dscp) ds = dscp << 2; switch(addrfamily) { case AF_INET6: - if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds, sizeof(ds)) < 0) + #ifdef IPV6_TCLASS + if(setsockopt(socket, IPPROTO_IPV6, IPV6_TCLASS, (void*)&ds, + sizeof(ds)) < 0) return sock_strerror(errno); break; + #else + return "IPV6_TCLASS not defined on this system"; + #endif default: if(setsockopt(socket, IPPROTO_IP, IP_TOS, (void*)&ds, sizeof(ds)) < 0) return sock_strerror(errno); @@ -1306,6 +1311,38 @@ listen_cp_insert(struct comm_point* c, struct listen_dnsport* front) return 1; } +void listen_setup_locks(void) +{ + if(!stream_wait_lock_inited) { + lock_basic_init(&stream_wait_count_lock); + stream_wait_lock_inited = 1; + } + if(!http2_query_buffer_lock_inited) { + lock_basic_init(&http2_query_buffer_count_lock); + http2_query_buffer_lock_inited = 1; + } + if(!http2_response_buffer_lock_inited) { + lock_basic_init(&http2_response_buffer_count_lock); + http2_response_buffer_lock_inited = 1; + } +} + +void listen_desetup_locks(void) +{ + if(stream_wait_lock_inited) { + stream_wait_lock_inited = 0; + lock_basic_destroy(&stream_wait_count_lock); + } + if(http2_query_buffer_lock_inited) { + http2_query_buffer_lock_inited = 0; + lock_basic_destroy(&http2_query_buffer_count_lock); + } + if(http2_response_buffer_lock_inited) { + http2_response_buffer_lock_inited = 0; + lock_basic_destroy(&http2_response_buffer_count_lock); + } +} + struct listen_dnsport* listen_create(struct comm_base* base, struct listen_port* ports, size_t bufsize, int tcp_accept_count, int tcp_idle_timeout, @@ -1327,57 +1364,44 @@ listen_create(struct comm_base* base, struct listen_port* ports, free(front); return NULL; } - if(!stream_wait_lock_inited) { - lock_basic_init(&stream_wait_count_lock); - stream_wait_lock_inited = 1; - } - if(!http2_query_buffer_lock_inited) { - lock_basic_init(&http2_query_buffer_count_lock); - http2_query_buffer_lock_inited = 1; - } - if(!http2_response_buffer_lock_inited) { - lock_basic_init(&http2_response_buffer_count_lock); - http2_response_buffer_lock_inited = 1; - } /* create comm points as needed */ while(ports) { struct comm_point* cp = NULL; if(ports->ftype == listen_type_udp || - ports->ftype == listen_type_udp_dnscrypt) - cp = comm_point_create_udp(base, ports->fd, + ports->ftype == listen_type_udp_dnscrypt) { + cp = comm_point_create_udp(base, ports->fd, front->udp_buff, cb, cb_arg, ports->socket); - else if(ports->ftype == listen_type_tcp || - ports->ftype == listen_type_tcp_dnscrypt) - cp = comm_point_create_tcp(base, ports->fd, + } else if(ports->ftype == listen_type_tcp || + ports->ftype == listen_type_tcp_dnscrypt) { + cp = comm_point_create_tcp(base, ports->fd, tcp_accept_count, tcp_idle_timeout, harden_large_queries, 0, NULL, tcp_conn_limit, bufsize, front->udp_buff, ports->ftype, cb, cb_arg, ports->socket); - else if(ports->ftype == listen_type_ssl || + } else if(ports->ftype == listen_type_ssl || ports->ftype == listen_type_http) { - cp = comm_point_create_tcp(base, ports->fd, + cp = comm_point_create_tcp(base, ports->fd, tcp_accept_count, tcp_idle_timeout, harden_large_queries, http_max_streams, http_endpoint, tcp_conn_limit, bufsize, front->udp_buff, ports->ftype, cb, cb_arg, ports->socket); - if(http_notls && ports->ftype == listen_type_http) - cp->ssl = NULL; - else - cp->ssl = sslctx; if(ports->ftype == listen_type_http) { if(!sslctx && !http_notls) { - log_warn("HTTPS port configured, but no TLS " - "tls-service-key or tls-service-pem " - "set"); + log_warn("HTTPS port configured, but " + "no TLS tls-service-key or " + "tls-service-pem set"); } #ifndef HAVE_SSL_CTX_SET_ALPN_SELECT_CB - if(!http_notls) - log_warn("Unbound is not compiled with an " - "OpenSSL version supporting ALPN " - " (OpenSSL >= 1.0.2). This is required " - "to use DNS-over-HTTPS"); + if(!http_notls) { + log_warn("Unbound is not compiled " + "with an OpenSSL version " + "supporting ALPN " + "(OpenSSL >= 1.0.2). This " + "is required to use " + "DNS-over-HTTPS"); + } #endif #ifndef HAVE_NGHTTP2_NGHTTP2_H log_warn("Unbound is not compiled with " @@ -1386,14 +1410,25 @@ listen_create(struct comm_base* base, struct listen_port* ports, #endif } } else if(ports->ftype == listen_type_udpancil || - ports->ftype == listen_type_udpancil_dnscrypt) - cp = comm_point_create_udp_ancil(base, ports->fd, + ports->ftype == listen_type_udpancil_dnscrypt) { + cp = comm_point_create_udp_ancil(base, ports->fd, front->udp_buff, cb, cb_arg, ports->socket); + } if(!cp) { - log_err("can't create commpoint"); + log_err("can't create commpoint"); listen_delete(front); return NULL; } + if((http_notls && ports->ftype == listen_type_http) || + (ports->ftype == listen_type_tcp) || + (ports->ftype == listen_type_udp) || + (ports->ftype == listen_type_udpancil) || + (ports->ftype == listen_type_tcp_dnscrypt) || + (ports->ftype == listen_type_udp_dnscrypt) || + (ports->ftype == listen_type_udpancil_dnscrypt)) + cp->ssl = NULL; + else + cp->ssl = sslctx; cp->dtenv = dtenv; cp->do_not_close = 1; #ifdef USE_DNSCRYPT @@ -1454,18 +1489,6 @@ listen_delete(struct listen_dnsport* front) #endif sldns_buffer_free(front->udp_buff); free(front); - if(stream_wait_lock_inited) { - stream_wait_lock_inited = 0; - lock_basic_destroy(&stream_wait_count_lock); - } - if(http2_query_buffer_lock_inited) { - http2_query_buffer_lock_inited = 0; - lock_basic_destroy(&http2_query_buffer_count_lock); - } - if(http2_response_buffer_lock_inited) { - http2_response_buffer_lock_inited = 0; - lock_basic_destroy(&http2_response_buffer_count_lock); - } } #ifdef HAVE_GETIFADDRS @@ -2610,7 +2633,7 @@ static int http2_req_begin_headers_cb(nghttp2_session* session, int ret; if(frame->hd.type != NGHTTP2_HEADERS || frame->headers.cat != NGHTTP2_HCAT_REQUEST) { - /* only interrested in request headers */ + /* only interested in request headers */ return 0; } if(!(h2_stream = http2_stream_create(frame->hd.stream_id))) { @@ -2738,7 +2761,7 @@ static int http2_req_header_cb(nghttp2_session* session, * the HEADER */ if(frame->hd.type != NGHTTP2_HEADERS || frame->headers.cat != NGHTTP2_HCAT_REQUEST) { - /* only interrested in request headers */ + /* only interested in request headers */ return 0; } if(!(h2_stream = nghttp2_session_get_stream_user_data(session, @@ -2834,7 +2857,7 @@ static int http2_req_header_cb(nghttp2_session* session, h2_stream->query_too_large = 1; return 0; } - /* guaranteed to only contian digits and be null terminated */ + /* guaranteed to only contain digits and be null terminated */ h2_stream->content_length = atoi((const char*)value); if(h2_stream->content_length > h2_session->c->http2_stream_max_qbuffer_size) { @@ -2874,7 +2897,7 @@ static int http2_req_data_chunk_recv_cb(nghttp2_session* ATTR_UNUSED(session), /* setting this to msg-buffer-size can result in a lot * of memory consuption. Most queries should fit in a * single DATA frame, and most POST queries will - * containt content-length which does not impose this + * contain content-length which does not impose this * limit. */ qlen = len; } diff --git a/sbin/unwind/libunbound/services/listen_dnsport.h b/sbin/unwind/libunbound/services/listen_dnsport.h index 1e51be9bfca..0e63236bcbc 100644 --- a/sbin/unwind/libunbound/services/listen_dnsport.h +++ b/sbin/unwind/libunbound/services/listen_dnsport.h @@ -199,6 +199,11 @@ listen_create(struct comm_base* base, struct listen_port* ports, */ void listen_delete(struct listen_dnsport* listen); +/** setup the locks for the listen ports */ +void listen_setup_locks(void); +/** desetup the locks for the listen ports */ +void listen_desetup_locks(void); + /** * delete listen_list of commpoints. Calls commpointdelete() on items. * This may close the fds or not depending on flags. diff --git a/sbin/unwind/libunbound/services/localzone.c b/sbin/unwind/libunbound/services/localzone.c index 54f55ab810e..3e3a71aea3c 100644 --- a/sbin/unwind/libunbound/services/localzone.c +++ b/sbin/unwind/libunbound/services/localzone.c @@ -56,6 +56,44 @@ * with 16 bytes for an A record, a 64K packet has about 4000 max */ #define LOCALZONE_RRSET_COUNT_MAX 4096 +/** print all RRsets in local zone */ +static void +local_zone_out(struct local_zone* z) +{ + struct local_data* d; + struct local_rrset* p; + RBTREE_FOR(d, struct local_data*, &z->data) { + for(p = d->rrsets; p; p = p->next) { + log_nametypeclass(NO_VERBOSE, "rrset", d->name, + ntohs(p->rrset->rk.type), + ntohs(p->rrset->rk.rrset_class)); + } + } +} + +static void +local_zone_print(struct local_zone* z) +{ + char buf[64]; + lock_rw_rdlock(&z->lock); + snprintf(buf, sizeof(buf), "%s zone", + local_zone_type2str(z->type)); + log_nametypeclass(NO_VERBOSE, buf, z->name, 0, z->dclass); + local_zone_out(z); + lock_rw_unlock(&z->lock); +} + +void local_zones_print(struct local_zones* zones) +{ + struct local_zone* z; + lock_rw_rdlock(&zones->lock); + log_info("number of auth zones %u", (unsigned)zones->ztree.count); + RBTREE_FOR(z, struct local_zone*, &zones->ztree) { + local_zone_print(z); + } + lock_rw_unlock(&zones->lock); +} + struct local_zones* local_zones_create(void) { @@ -465,7 +503,7 @@ lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen, /* Mark the SOA record for the zone. This only marks the SOA rrset; the data * for the RR is entered later on local_zone_enter_rr() as with the other - * records. An artifical soa_negative record with a modified TTL (minimum of + * records. An artificial soa_negative record with a modified TTL (minimum of * the TTL and the SOA.MINIMUM) is also created and marked for usage with * negative answers and to avoid allocations during those answers. */ static int @@ -898,6 +936,11 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg } lock_rw_unlock(&z->lock); } + /* home.arpa. zone (RFC 8375) */ + if(!add_empty_default(zones, cfg, "home.arpa.")) { + log_err("out of memory adding default zone"); + return 0; + } /* onion. zone (RFC 7686) */ if(!add_empty_default(zones, cfg, "onion.")) { log_err("out of memory adding default zone"); @@ -1005,6 +1048,38 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg) lock_rw_rdlock(&zones->lock); if(!local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type)) { + /* Check if there is a zone that this could go + * under but for different class; created zones are + * always for LDNS_RR_CLASS_IN. Create the zone with + * a different class but the same configured + * local_zone_type. */ + struct local_zone* z = local_zones_lookup(zones, + rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type); + if(z) { + uint8_t* name = memdup(z->name, z->namelen); + size_t znamelen = z->namelen; + int znamelabs = z->namelabs; + enum localzone_type ztype = z->type; + lock_rw_unlock(&zones->lock); + if(!name) { + log_err("out of memory"); + free(rr_name); + return 0; + } + if(!( +#ifndef THREADS_DISABLED + z = +#endif + lz_enter_zone_dname(zones, name, + znamelen, znamelabs, + ztype, rr_class))) { + free(rr_name); + return 0; + } + lock_rw_unlock(&z->lock); + free(rr_name); + continue; + } if(!have_name) { dclass = rr_class; nm = rr_name; @@ -1215,38 +1290,6 @@ local_zones_find_le(struct local_zones* zones, return (struct local_zone*)node; } -/** print all RRsets in local zone */ -static void -local_zone_out(struct local_zone* z) -{ - struct local_data* d; - struct local_rrset* p; - RBTREE_FOR(d, struct local_data*, &z->data) { - for(p = d->rrsets; p; p = p->next) { - log_nametypeclass(NO_VERBOSE, "rrset", d->name, - ntohs(p->rrset->rk.type), - ntohs(p->rrset->rk.rrset_class)); - } - } -} - -void local_zones_print(struct local_zones* zones) -{ - struct local_zone* z; - lock_rw_rdlock(&zones->lock); - log_info("number of auth zones %u", (unsigned)zones->ztree.count); - RBTREE_FOR(z, struct local_zone*, &zones->ztree) { - char buf[64]; - lock_rw_rdlock(&z->lock); - snprintf(buf, sizeof(buf), "%s zone", - local_zone_type2str(z->type)); - log_nametypeclass(NO_VERBOSE, buf, z->name, 0, z->dclass); - local_zone_out(z); - lock_rw_unlock(&z->lock); - } - lock_rw_unlock(&zones->lock); -} - /** encode answer consisting of 1 rrset */ static int local_encode(struct query_info* qinfo, struct module_env* env, @@ -1294,7 +1337,7 @@ local_error_encode(struct query_info* qinfo, struct module_env* env, if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL, rcode, edns, repinfo, temp, env->now_tv)) - edns->opt_list = NULL; + edns->opt_list_inplace_cb_out = NULL; error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2), edns); } @@ -1521,7 +1564,7 @@ local_data_answer(struct local_zone* z, struct module_env* env, /* write qname */ memmove(d->rr_data[0] + sizeof(uint16_t), qinfo->qname, qinfo->qname_len - 1); - /* write cname target wilcard wildcard label */ + /* write cname target wildcard label */ memmove(d->rr_data[0] + sizeof(uint16_t) + qinfo->qname_len - 1, ctarget + 2, ctargetlen - 2); @@ -1570,6 +1613,15 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo, return (lr == NULL); } +static inline int +local_zone_is_udp_query(struct comm_reply* repinfo) { + return repinfo != NULL + ? (repinfo->c != NULL + ? repinfo->c->type == comm_udp + : 0) + : 0; +} + int local_zones_zone_answer(struct local_zone* z, struct module_env* env, struct query_info* qinfo, struct edns_data* edns, @@ -1592,7 +1644,9 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env, lz_type == local_zone_redirect || lz_type == local_zone_inform_redirect || lz_type == local_zone_always_nxdomain || - lz_type == local_zone_always_nodata) { + lz_type == local_zone_always_nodata || + (lz_type == local_zone_truncate + && local_zone_is_udp_query(repinfo))) { /* for static, reply nodata or nxdomain * for redirect, reply nodata */ /* no additional section processing, @@ -1602,9 +1656,11 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env, */ int rcode = (ld || lz_type == local_zone_redirect || lz_type == local_zone_inform_redirect || - lz_type == local_zone_always_nodata)? + lz_type == local_zone_always_nodata || + lz_type == local_zone_truncate)? LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN; - if(z->soa && z->soa_negative) + rcode = (lz_type == local_zone_truncate ? (rcode|BIT_TC) : rcode); + if(z != NULL && z->soa && z->soa_negative) return local_encode(qinfo, env, edns, repinfo, buf, temp, z->soa_negative, 0, rcode); local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode, @@ -1661,7 +1717,7 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env, * does not, then we should make this noerror/nodata */ if(ld && ld->rrsets) { int rcode = LDNS_RCODE_NOERROR; - if(z->soa && z->soa_negative) + if(z != NULL && z->soa && z->soa_negative) return local_encode(qinfo, env, edns, repinfo, buf, temp, z->soa_negative, 0, rcode); local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode, @@ -1860,6 +1916,7 @@ const char* local_zone_type2str(enum localzone_type t) case local_zone_always_deny: return "always_deny"; case local_zone_always_null: return "always_null"; case local_zone_noview: return "noview"; + case local_zone_truncate: return "truncate"; case local_zone_invalid: return "invalid"; } return "badtyped"; @@ -1899,6 +1956,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t) *t = local_zone_always_null; else if(strcmp(type, "noview") == 0) *t = local_zone_noview; + else if(strcmp(type, "truncate") == 0) + *t = local_zone_truncate; else if(strcmp(type, "nodefault") == 0) *t = local_zone_nodefault; else return 0; diff --git a/sbin/unwind/libunbound/services/localzone.h b/sbin/unwind/libunbound/services/localzone.h index b52d81dc72c..19534f7509e 100644 --- a/sbin/unwind/libunbound/services/localzone.h +++ b/sbin/unwind/libunbound/services/localzone.h @@ -101,6 +101,8 @@ enum localzone_type { local_zone_always_null, /** answer not from the view, but global or no-answer */ local_zone_noview, + /** truncate the response; client should retry via tcp */ + local_zone_truncate, /** Invalid type, cannot be used to generate answer */ local_zone_invalid }; @@ -255,7 +257,7 @@ void local_zone_delete(struct local_zone* z); * @param dclass: class to lookup. * @param dtype: type to lookup, if type DS a zone higher is used for zonecuts. * @param taglist: taglist to lookup. - * @param taglen: lenth of taglist. + * @param taglen: length of taglist. * @param ignoretags: lookup zone by name and class, regardless the * local-zone's tags. * @return closest local_zone or NULL if no covering zone is found. @@ -563,6 +565,8 @@ enum respip_action { respip_always_nodata = local_zone_always_nodata, /** answer with nodata response */ respip_always_deny = local_zone_always_deny, + /** RPZ: truncate answer in order to force switch to tcp */ + respip_truncate = local_zone_truncate, /* The rest of the values are only possible as * access-control-tag-action */ diff --git a/sbin/unwind/libunbound/services/mesh.c b/sbin/unwind/libunbound/services/mesh.c index 5679a8b64e5..cdcfedda270 100644 --- a/sbin/unwind/libunbound/services/mesh.c +++ b/sbin/unwind/libunbound/services/mesh.c @@ -461,7 +461,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, struct edns_data* edns, struct comm_reply* rep, uint16_t qid) { struct mesh_state* s = NULL; - int unique = unique_mesh_state(edns->opt_list, mesh->env); + int unique = unique_mesh_state(edns->opt_list_in, mesh->env); int was_detached = 0; int was_noreply = 0; int added = 0; @@ -505,7 +505,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, log_err("mesh_state_create: out of memory; SERVFAIL"); if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv)) - edns->opt_list = NULL; + edns->opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, qinfo, qid, qflags, edns); comm_point_send_reply(rep); @@ -514,14 +514,14 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, if(unique) mesh_state_make_unique(s); /* copy the edns options we got from the front */ - if(edns->opt_list) { - s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list, + if(edns->opt_list_in) { + s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { log_err("mesh_state_create: out of memory; SERVFAIL"); if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv)) - edns->opt_list = NULL; + edns->opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, qinfo, qid, qflags, edns); comm_point_send_reply(rep); @@ -594,7 +594,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, servfail_mem: if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s, NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv)) - edns->opt_list = NULL; + edns->opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, qinfo, qid, qflags, edns); comm_point_send_reply(rep); @@ -609,7 +609,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qid, mesh_cb_func_type cb, void* cb_arg) { struct mesh_state* s = NULL; - int unique = unique_mesh_state(edns->opt_list, mesh->env); + int unique = unique_mesh_state(edns->opt_list_in, mesh->env); int timeout = mesh->env->cfg->serve_expired? mesh->env->cfg->serve_expired_client_timeout:0; int was_detached = 0; @@ -632,8 +632,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, } if(unique) mesh_state_make_unique(s); - if(edns->opt_list) { - s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list, + if(edns->opt_list_in) { + s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { return 0; @@ -1145,11 +1145,11 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, if(rcode == LDNS_RCODE_SERVFAIL) { if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, NULL, m->s.region, start_time)) - r->edns.opt_list = NULL; + r->edns.opt_list_inplace_cb_out = NULL; } else { if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, NULL, m->s.region, start_time)) - r->edns.opt_list = NULL; + r->edns.opt_list_inplace_cb_out = NULL; } fptr_ok(fptr_whitelist_mesh_cb(r->cb)); (*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked, NULL, @@ -1183,6 +1183,22 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, m->s.env->mesh->num_reply_addrs--; } +static inline int +mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m) +{ + struct respip_action_info const* respip_info = m->s.respip_action_info; + return respip_info == NULL + ? 0 + : (respip_info->rpz_used + && !respip_info->rpz_disabled + && respip_info->action == respip_truncate); +} + +static inline int +mesh_is_udp(struct mesh_reply const* r) { + return r->query_reply.c->type == comm_udp; +} + /** * Send reply to mesh reply entry * @param m: mesh state to send it for. @@ -1201,15 +1217,17 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, struct timeval end_time; struct timeval duration; int secure; - /* Copy the client's EDNS for later restore, to make sure the edns - * compare is with the correct edns options. */ - struct edns_data edns_bak = r->edns; /* briefly set the replylist to null in case the * meshsendreply calls tcpreqinfo sendreply that * comm_point_drops because of size, and then the * null stops the mesh state remove and thus * reply_list modification and accounting */ struct mesh_reply* rlist = m->reply_list; + + /* rpz: apply actions */ + rcode = mesh_is_udp(r) && mesh_is_rpz_respip_tcponly_action(m) + ? (rcode|BIT_TC) : rcode; + /* examine security status */ if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) || m->s.env->cfg->ignore_cd) && rep && @@ -1248,8 +1266,9 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, prev->edns.edns_present == r->edns.edns_present && prev->edns.bits == r->edns.bits && prev->edns.udp_size == r->edns.udp_size && - edns_opt_list_compare(prev->edns.opt_list, r->edns.opt_list) - == 0) { + edns_opt_list_compare(prev->edns.opt_list_out, r->edns.opt_list_out) == 0 && + edns_opt_list_compare(prev->edns.opt_list_inplace_cb_out, r->edns.opt_list_inplace_cb_out) == 0 + ) { /* if the previous reply is identical to this one, fix ID */ if(prev_buffer != r_buffer) sldns_buffer_copy(r_buffer, prev_buffer); @@ -1265,11 +1284,11 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, if(rcode == LDNS_RCODE_SERVFAIL) { if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time)) - r->edns.opt_list = NULL; + r->edns.opt_list_inplace_cb_out = NULL; } else { if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time)) - r->edns.opt_list = NULL; + r->edns.opt_list_inplace_cb_out = NULL; } error_encode(r_buffer, rcode, &m->s.qinfo, r->qid, r->qflags, &r->edns); @@ -1286,9 +1305,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, m->s.qinfo.local_alias = r->local_alias; if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) || - !apply_edns_options(&r->edns, &edns_bak, - m->s.env->cfg, r->query_reply.c, - m->s.region) || !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, r->qflags, r_buffer, 0, 1, m->s.env->scratch, udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO), @@ -1296,11 +1312,10 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, { if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time)) - r->edns.opt_list = NULL; + r->edns.opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, &m->s.qinfo, r->qid, r->qflags, &r->edns); } - r->edns = edns_bak; m->reply_list = NULL; comm_point_send_reply(&r->query_reply); m->reply_list = rlist; @@ -1346,7 +1361,7 @@ void mesh_query_done(struct mesh_state* mstate) } if(mstate->s.return_rcode == LDNS_RCODE_SERVFAIL || (rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL)) { - /* we are SERVFAILing; check for expired asnwer here */ + /* we are SERVFAILing; check for expired answer here */ mesh_serve_expired_callback(mstate); if((mstate->reply_list || mstate->cb_list) && mstate->s.env->cfg->log_servfail @@ -1488,12 +1503,15 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns, r->cb = cb; r->cb_arg = cb_arg; r->edns = *edns; - if(edns->opt_list) { - r->edns.opt_list = edns_opt_copy_region(edns->opt_list, - s->s.region); - if(!r->edns.opt_list) - return 0; - } + if(edns->opt_list_in && !(r->edns.opt_list_in = + edns_opt_copy_region(edns->opt_list_in, s->s.region))) + return 0; + if(edns->opt_list_out && !(r->edns.opt_list_out = + edns_opt_copy_region(edns->opt_list_out, s->s.region))) + return 0; + if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out = + edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region))) + return 0; r->qid = qid; r->qflags = qflags; r->next = s->cb_list; @@ -1512,12 +1530,15 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns, return 0; r->query_reply = *rep; r->edns = *edns; - if(edns->opt_list) { - r->edns.opt_list = edns_opt_copy_region(edns->opt_list, - s->s.region); - if(!r->edns.opt_list) - return 0; - } + if(edns->opt_list_in && !(r->edns.opt_list_in = + edns_opt_copy_region(edns->opt_list_in, s->s.region))) + return 0; + if(edns->opt_list_out && !(r->edns.opt_list_out = + edns_opt_copy_region(edns->opt_list_out, s->s.region))) + return 0; + if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out = + edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region))) + return 0; r->qid = qid; r->qflags = qflags; r->start_time = *s->s.env->now_tv; @@ -1563,7 +1584,7 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns, return 0; /* the rrset is not packed, like in the cache, but it is - * individualy allocated with an allocator from localzone. */ + * individually allocated with an allocator from localzone. */ d = regional_alloc_zero(s->s.region, sizeof(*d)); if(!d) return 0; diff --git a/sbin/unwind/libunbound/services/outbound_list.h b/sbin/unwind/libunbound/services/outbound_list.h index ad59e42d192..73c137d5099 100644 --- a/sbin/unwind/libunbound/services/outbound_list.h +++ b/sbin/unwind/libunbound/services/outbound_list.h @@ -79,7 +79,7 @@ void outbound_list_init(struct outbound_list* list); * Clear the user owner outbound list structure. * Deletes serviced queries. * @param list: the list structure. It is cleared, but the list struct itself - * is callers responsability to delete. + * is callers responsibility to delete. */ void outbound_list_clear(struct outbound_list* list); diff --git a/sbin/unwind/libunbound/services/outside_network.c b/sbin/unwind/libunbound/services/outside_network.c index a3f982e7218..a7e5fa3ad58 100644 --- a/sbin/unwind/libunbound/services/outside_network.c +++ b/sbin/unwind/libunbound/services/outside_network.c @@ -94,6 +94,16 @@ static void waiting_list_remove(struct outside_network* outnet, static uint16_t tcp_select_id(struct outside_network* outnet, struct reuse_tcp* reuse); +/** Perform serviced query UDP sending operation */ +static int serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff); + +/** Send serviced query over TCP return false on initial failure */ +static int serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff); + +/** call the callbacks for a serviced query */ +static void serviced_callbacks(struct serviced_query* sq, int error, + struct comm_point* c, struct comm_reply* rep); + int pending_cmp(const void* key1, const void* key2) { @@ -836,6 +846,7 @@ outnet_add_tcp_waiting_first(struct outside_network* outnet, if(w->on_tcp_waiting_list) return; w->next_waiting = outnet->tcp_wait_first; + log_assert(w->next_waiting != w); if(!outnet->tcp_wait_last) outnet->tcp_wait_last = w; outnet->tcp_wait_first = w; @@ -1136,6 +1147,22 @@ static void reuse_cb_readwait_for_failure(rbtree_type* tree_by_id, int err) } } +/** mark the entry for being in the cb_and_decommission stage */ +static void mark_for_cb_and_decommission(rbnode_type* node, + void* ATTR_UNUSED(arg)) +{ + struct waiting_tcp* w = (struct waiting_tcp*)node->key; + /* Mark the waiting_tcp to signal later code (serviced_delete) that + * this item is part of the backed up tree_by_id and will be deleted + * later. */ + w->in_cb_and_decommission = 1; + /* Mark the serviced_query for deletion so that later code through + * callbacks (iter_clear .. outnet_serviced_query_stop) won't + * prematurely delete it. */ + if(w->cb) + ((struct serviced_query*)w->cb_arg)->to_be_deleted = 1; +} + /** perform callbacks for failure and also decommission pending tcp. * the callbacks remove references in sq->pending to the waiting_tcp * members of the tree_by_id in the pending tcp. The pending_tcp is @@ -1151,6 +1178,9 @@ static void reuse_cb_and_decommission(struct outside_network* outnet, pend->reuse.write_wait_first = NULL; pend->reuse.write_wait_last = NULL; decommission_pending_tcp(outnet, pend); + if(store.root != NULL && store.root != RBTREE_NULL) { + traverse_postorder(&store, &mark_for_cb_and_decommission, NULL); + } reuse_cb_readwait_for_failure(&store, error); reuse_del_readwait(&store); } @@ -1248,6 +1278,12 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error, c->buffer)); /* find the query the reply is for */ w = reuse_tcp_by_id_find(&pend->reuse, id); + /* Make sure that the reply we got is at least for a + * sent query with the same ID; the waiting_tcp that + * gets a reply is assumed to not be waiting to be + * sent. */ + if(w && (w->on_tcp_waiting_list || w->write_wait_queued)) + w = NULL; } } if(error == NETEVENT_NOERROR && !w) { @@ -1265,6 +1301,8 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error, } } if(w) { + log_assert(!w->on_tcp_waiting_list); + log_assert(!w->write_wait_queued); reuse_tree_by_id_delete(&pend->reuse, w); verbose(VERB_CLIENT, "outnet tcp callback query err %d buflen %d", error, (int)sldns_buffer_limit(c->buffer)); @@ -1324,7 +1362,7 @@ outnet_send_wait_udp(struct outside_network* outnet) { struct pending* pend; /* process waiting queries */ - while(outnet->udp_wait_first && outnet->unused_fds + while(outnet->udp_wait_first && outnet->unused_fds && !outnet->want_to_quit) { pend = outnet->udp_wait_first; outnet->udp_wait_first = pend->next_waiting; @@ -1333,8 +1371,10 @@ outnet_send_wait_udp(struct outside_network* outnet) sldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len); sldns_buffer_flip(outnet->udp_buff); free(pend->pkt); /* freeing now makes get_mem correct */ - pend->pkt = NULL; + pend->pkt = NULL; pend->pkt_len = 0; + log_assert(!pend->sq->busy); + pend->sq->busy = 1; if(!randomize_and_send_udp(pend, outnet->udp_buff, pend->timeout)) { /* callback error on pending */ @@ -1344,6 +1384,8 @@ outnet_send_wait_udp(struct outside_network* outnet) NETEVENT_CLOSED, NULL); } pending_delete(outnet, pend); + } else { + pend->sq->busy = 0; } } } @@ -1454,7 +1496,6 @@ calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6, (*num_ip4)++; } } - } void @@ -1708,16 +1749,9 @@ static void serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg)) { struct serviced_query* sq = (struct serviced_query*)node; - struct service_callback* p = sq->cblist, *np; - free(sq->qbuf); - free(sq->zone); - free(sq->tls_auth_name); - edns_opt_list_free(sq->opt_list); - while(p) { - np = p->next; - free(p); - p = np; - } + alloc_reg_release(sq->alloc, sq->region); + if(sq->timer) + comm_timer_delete(sq->timer); free(sq); } @@ -1935,7 +1969,7 @@ select_id(struct outside_network* outnet, struct pending* pend, LDNS_ID_SET(sldns_buffer_begin(packet), pend->id); id_tries++; if(id_tries == MAX_ID_RETRY) { - pend->id=99999; /* non existant ID */ + pend->id=99999; /* non existent ID */ log_err("failed to generate unique ID, drop msg"); return 0; } @@ -1962,6 +1996,7 @@ static int udp_connect_needs_log(int err) case ENETDOWN: # endif case EPERM: + case EACCES: if(verbosity >= VERB_ALGO) return 1; return 0; @@ -2173,10 +2208,13 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet, sq->outnet->udp_wait_last = pend; return pend; } + log_assert(!sq->busy); + sq->busy = 1; if(!randomize_and_send_udp(pend, packet, timeout)) { pending_delete(sq->outnet, pend); return NULL; } + sq->busy = 0; return pend; } @@ -2246,7 +2284,7 @@ reuse_tcp_select_id(struct reuse_tcp* reuse, struct outside_network* outnet) } /* equally pick a random unused element from the tree that is - * not in use. Pick a the n-th index of an ununused number, + * not in use. Pick a the n-th index of an unused number, * then loop over the empty spaces in the tree and find it */ log_assert(reuse->tree_by_id.count < 0xffff); select = ub_random_max(outnet->rnd, 0xffff - reuse->tree_by_id.count); @@ -2359,6 +2397,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet, #ifdef USE_DNSTAP w->sq = NULL; #endif + w->in_cb_and_decommission = 0; if(pend) { /* we have a buffer available right now */ if(reuse) { @@ -2455,30 +2494,62 @@ lookup_serviced(struct outside_network* outnet, sldns_buffer* buff, int dnssec, return (struct serviced_query*)rbtree_search(outnet->serviced, &key); } +void +serviced_timer_cb(void* arg) +{ + struct serviced_query* sq = (struct serviced_query*)arg; + struct outside_network* outnet = sq->outnet; + verbose(VERB_ALGO, "serviced send timer"); + /* By the time this cb is called, if we don't have any registered + * callbacks for this serviced_query anymore; do not send. */ + if(!sq->cblist) + goto delete; + /* perform first network action */ + if(outnet->do_udp && !(sq->tcp_upstream || sq->ssl_upstream)) { + if(!serviced_udp_send(sq, outnet->udp_buff)) + goto delete; + } else { + if(!serviced_tcp_send(sq, outnet->udp_buff)) + goto delete; + } + /* Maybe by this time we don't have callbacks attached anymore. Don't + * proactively try to delete; let it run and maybe another callback + * will get attached by the time we get an answer. */ + return; +delete: + serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL); +} + /** Create new serviced entry */ static struct serviced_query* serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec, int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list, - size_t pad_queries_block_size) + size_t pad_queries_block_size, struct alloc_cache* alloc, + struct regional* region) { struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq)); + struct timeval t; #ifdef UNBOUND_DEBUG rbnode_type* ins; #endif if(!sq) return NULL; sq->node.key = sq; - sq->qbuf = memdup(sldns_buffer_begin(buff), sldns_buffer_limit(buff)); + sq->alloc = alloc; + sq->region = region; + sq->qbuf = regional_alloc_init(region, sldns_buffer_begin(buff), + sldns_buffer_limit(buff)); if(!sq->qbuf) { + alloc_reg_release(alloc, region); free(sq); return NULL; } sq->qbuflen = sldns_buffer_limit(buff); - sq->zone = memdup(zone, zonelen); + sq->zone = regional_alloc_init(region, zone, zonelen); if(!sq->zone) { - free(sq->qbuf); + alloc_reg_release(alloc, region); free(sq); return NULL; } @@ -2490,10 +2561,9 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec, sq->tcp_upstream = tcp_upstream; sq->ssl_upstream = ssl_upstream; if(tls_auth_name) { - sq->tls_auth_name = strdup(tls_auth_name); + sq->tls_auth_name = regional_strdup(region, tls_auth_name); if(!sq->tls_auth_name) { - free(sq->zone); - free(sq->qbuf); + alloc_reg_release(alloc, region); free(sq); return NULL; } @@ -2502,17 +2572,16 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec, } memcpy(&sq->addr, addr, addrlen); sq->addrlen = addrlen; - sq->opt_list = NULL; - if(opt_list) { - sq->opt_list = edns_opt_copy_alloc(opt_list); - if(!sq->opt_list) { - free(sq->tls_auth_name); - free(sq->zone); - free(sq->qbuf); - free(sq); - return NULL; - } + sq->opt_list = opt_list; + sq->busy = 0; + sq->timer = comm_timer_create(outnet->base, serviced_timer_cb, sq); + if(!sq->timer) { + alloc_reg_release(alloc, region); + free(sq); + return NULL; } + memset(&t, 0, sizeof(t)); + comm_timer_set(sq->timer, &t); sq->outnet = outnet; sq->cblist = NULL; sq->pending = NULL; @@ -2521,7 +2590,7 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec, sq->to_be_deleted = 0; sq->padding_block_size = pad_queries_block_size; #ifdef UNBOUND_DEBUG - ins = + ins = #else (void) #endif @@ -2619,29 +2688,38 @@ serviced_delete(struct serviced_query* sq) struct waiting_tcp* w = (struct waiting_tcp*) sq->pending; verbose(VERB_CLIENT, "serviced_delete: TCP"); + log_assert(!(w->write_wait_queued && w->on_tcp_waiting_list)); /* if on stream-write-waiting list then * remove from waiting list and waiting_tcp_delete */ if(w->write_wait_queued) { struct pending_tcp* pend = (struct pending_tcp*)w->next_waiting; verbose(VERB_CLIENT, "serviced_delete: writewait"); - reuse_tree_by_id_delete(&pend->reuse, w); + if(!w->in_cb_and_decommission) + reuse_tree_by_id_delete(&pend->reuse, w); reuse_write_wait_remove(&pend->reuse, w); - waiting_tcp_delete(w); + if(!w->in_cb_and_decommission) + waiting_tcp_delete(w); } else if(!w->on_tcp_waiting_list) { struct pending_tcp* pend = (struct pending_tcp*)w->next_waiting; verbose(VERB_CLIENT, "serviced_delete: tcpreusekeep"); + /* w needs to stay on tree_by_id to not assign + * the same ID; remove the callback since its + * serviced_query will be gone. */ + w->cb = NULL; if(!reuse_tcp_remove_serviced_keep(w, sq)) { - reuse_cb_and_decommission(sq->outnet, - pend, NETEVENT_CLOSED); + if(!w->in_cb_and_decommission) + reuse_cb_and_decommission(sq->outnet, + pend, NETEVENT_CLOSED); use_free_buffer(sq->outnet); } sq->pending = NULL; } else { verbose(VERB_CLIENT, "serviced_delete: tcpwait"); waiting_list_remove(sq->outnet, w); - waiting_tcp_delete(w); + if(!w->in_cb_and_decommission) + waiting_tcp_delete(w); } } } @@ -2708,7 +2786,9 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns) edns.edns_present = 1; edns.ext_rcode = 0; edns.edns_version = EDNS_ADVERTISED_VERSION; - edns.opt_list = sq->opt_list; + edns.opt_list_in = NULL; + edns.opt_list_out = sq->opt_list; + edns.opt_list_inplace_cb_out = NULL; if(sq->status == serviced_query_UDP_EDNS_FRAG) { if(addr_is_ip6(&sq->addr, sq->addrlen)) { if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE) @@ -2731,8 +2811,8 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns) padding_option.opt_code = LDNS_EDNS_PADDING; padding_option.opt_len = 0; padding_option.opt_data = NULL; - padding_option.next = edns.opt_list; - edns.opt_list = &padding_option; + padding_option.next = edns.opt_list_out; + edns.opt_list_out = &padding_option; edns.padding_block_size = sq->padding_block_size; } attach_edns_record(buff, &edns); @@ -2889,7 +2969,8 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c, * use secondary buffer to store the query. * This is a data copy, but faster than packet to server */ backlen = sldns_buffer_limit(c->buffer); - backup_p = memdup(sldns_buffer_begin(c->buffer), backlen); + backup_p = regional_alloc_init(sq->region, + sldns_buffer_begin(c->buffer), backlen); if(!backup_p) { log_err("malloc failure in serviced query callbacks"); error = NETEVENT_CLOSED; @@ -2907,10 +2988,8 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c, } fptr_ok(fptr_whitelist_serviced_query(p->cb)); (void)(*p->cb)(c, p->cb_arg, error, rep); - free(p); } if(backup_p) { - free(backup_p); sq->outnet->svcd_overhead = 0; } verbose(VERB_ALGO, "svcd callbacks end"); @@ -2928,7 +3007,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error, struct waiting_tcp* w = (struct waiting_tcp*)sq->pending; struct pending_tcp* pend_tcp = NULL; struct port_if* pi = NULL; - if(!w->on_tcp_waiting_list && w->next_waiting) { + if(w && !w->on_tcp_waiting_list && w->next_waiting) { pend_tcp = (struct pending_tcp*)w->next_waiting; pi = pend_tcp->pi; } @@ -3024,8 +3103,11 @@ serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff) sq->status==serviced_query_TCP_EDNS?"EDNS":""); serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS); sq->last_sent_time = *sq->outnet->now_tv; + log_assert(!sq->busy); + sq->busy = 1; sq->pending = pending_tcp_query(sq, buff, sq->outnet->tcp_auth_query_timeout, serviced_tcp_callback, sq); + sq->busy = 0; if(!sq->pending) { /* delete from tree so that a retry by above layer does not * clash with this entry */ @@ -3057,8 +3139,11 @@ serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff) } else { timeout = sq->outnet->tcp_auth_query_timeout; } + log_assert(!sq->busy); + sq->busy = 1; sq->pending = pending_tcp_query(sq, buff, timeout, serviced_tcp_callback, sq); + sq->busy = 0; return sq->pending != NULL; } @@ -3109,7 +3194,6 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error, struct timeval now = *sq->outnet->now_tv; #ifdef USE_DNSTAP struct pending* p = (struct pending*)sq->pending; - struct port_if* pi = p->pc->pif; #endif sq->pending = NULL; /* removed after callback */ @@ -3151,14 +3235,16 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error, /* * sending src (local service)/dst (upstream) addresses over DNSTAP */ - if(error == NETEVENT_NOERROR && outnet->dtenv && - (outnet->dtenv->log_resolver_response_messages || - outnet->dtenv->log_forwarder_response_messages)) { + if(error == NETEVENT_NOERROR && outnet->dtenv && p->pc && + (outnet->dtenv->log_resolver_response_messages || + outnet->dtenv->log_forwarder_response_messages)) { log_addr(VERB_ALGO, "response from upstream", &sq->addr, sq->addrlen); - log_addr(VERB_ALGO, "to local addr", &pi->addr, pi->addrlen); - dt_msg_send_outside_response(outnet->dtenv, &sq->addr, &pi->addr, c->type, - sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen, - &sq->last_sent_time, sq->outnet->now_tv, c->buffer); + log_addr(VERB_ALGO, "to local addr", &p->pc->pif->addr, + p->pc->pif->addrlen); + dt_msg_send_outside_response(outnet->dtenv, &sq->addr, + &p->pc->pif->addr, c->type, sq->zone, sq->zonelen, + sq->qbuf, sq->qbuflen, &sq->last_sent_time, + sq->outnet->now_tv, c->buffer); } #endif if( (sq->status == serviced_query_UDP_EDNS @@ -3248,64 +3334,117 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error, struct serviced_query* outnet_serviced_query(struct outside_network* outnet, struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, - int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name, - struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, - size_t zonelen, struct module_qstate* qstate, - comm_point_callback_type* callback, void* callback_arg, sldns_buffer* buff, - struct module_env* env) + int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream, + char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen, + uint8_t* zone, size_t zonelen, struct module_qstate* qstate, + comm_point_callback_type* callback, void* callback_arg, + sldns_buffer* buff, struct module_env* env, int* was_ratelimited) { struct serviced_query* sq; struct service_callback* cb; struct edns_string_addr* client_string_addr; - - if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen, - qstate, qstate->region)) + struct regional* region; + struct edns_option* backed_up_opt_list = qstate->edns_opts_back_out; + struct edns_option* per_upstream_opt_list = NULL; + time_t timenow = 0; + + /* If we have an already populated EDNS option list make a copy since + * we may now add upstream specific EDNS options. */ + /* Use a region that could be attached to a serviced_query, if it needs + * to be created. If an existing one is found then this region will be + * destroyed here. */ + region = alloc_reg_obtain(env->alloc); + if(!region) return NULL; + if(qstate->edns_opts_back_out) { + per_upstream_opt_list = edns_opt_copy_region( + qstate->edns_opts_back_out, region); + if(!per_upstream_opt_list) { + alloc_reg_release(env->alloc, region); return NULL; + } + qstate->edns_opts_back_out = per_upstream_opt_list; + } + + if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, + zonelen, qstate, region)) { + alloc_reg_release(env->alloc, region); + return NULL; + } + /* Restore the option list; we can explicitly use the copied one from + * now on. */ + per_upstream_opt_list = qstate->edns_opts_back_out; + qstate->edns_opts_back_out = backed_up_opt_list; if((client_string_addr = edns_string_addr_lookup( &env->edns_strings->client_strings, addr, addrlen))) { - edns_opt_list_append(&qstate->edns_opts_back_out, + edns_opt_list_append(&per_upstream_opt_list, env->edns_strings->client_string_opcode, client_string_addr->string_len, - client_string_addr->string, qstate->region); + client_string_addr->string, region); } serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype, qinfo->qclass, flags); sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen, - qstate->edns_opts_back_out); - /* duplicate entries are included in the callback list, because - * there is a counterpart registration by our caller that needs to - * be doubly-removed (with callbacks perhaps). */ - if(!(cb = (struct service_callback*)malloc(sizeof(*cb)))) - return NULL; + per_upstream_opt_list); if(!sq) { + /* Check ratelimit only for new serviced_query */ + if(check_ratelimit) { + timenow = *env->now; + if(!infra_ratelimit_inc(env->infra_cache, zone, + zonelen, timenow, env->cfg->ratelimit_backoff, + &qstate->qinfo, qstate->reply)) { + /* Can we pass through with slip factor? */ + if(env->cfg->ratelimit_factor == 0 || + ub_random_max(env->rnd, + env->cfg->ratelimit_factor) != 1) { + *was_ratelimited = 1; + alloc_reg_release(env->alloc, region); + return NULL; + } + log_nametypeclass(VERB_ALGO, + "ratelimit allowed through for " + "delegation point", zone, + LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN); + } + } /* make new serviced query entry */ sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps, tcp_upstream, ssl_upstream, tls_auth_name, addr, addrlen, zone, zonelen, (int)qinfo->qtype, - qstate->edns_opts_back_out, + per_upstream_opt_list, ( ssl_upstream && env->cfg->pad_queries - ? env->cfg->pad_queries_block_size : 0 )); + ? env->cfg->pad_queries_block_size : 0 ), + env->alloc, region); if(!sq) { - free(cb); + if(check_ratelimit) { + infra_ratelimit_dec(env->infra_cache, + zone, zonelen, timenow); + } + alloc_reg_release(env->alloc, region); return NULL; } - /* perform first network action */ - if(outnet->do_udp && !(tcp_upstream || ssl_upstream)) { - if(!serviced_udp_send(sq, buff)) { - (void)rbtree_delete(outnet->serviced, sq); - serviced_node_del(&sq->node, NULL); - free(cb); - return NULL; - } - } else { - if(!serviced_tcp_send(sq, buff)) { - (void)rbtree_delete(outnet->serviced, sq); - serviced_node_del(&sq->node, NULL); - free(cb); - return NULL; + if(!(cb = (struct service_callback*)regional_alloc( + sq->region, sizeof(*cb)))) { + if(check_ratelimit) { + infra_ratelimit_dec(env->infra_cache, + zone, zonelen, timenow); } + (void)rbtree_delete(outnet->serviced, sq); + serviced_node_del(&sq->node, NULL); + return NULL; + } + /* No network action at this point; it will be invoked with the + * serviced_query timer instead to run outside of the mesh. */ + } else { + /* We don't need this region anymore. */ + alloc_reg_release(env->alloc, region); + /* duplicate entries are included in the callback list, because + * there is a counterpart registration by our caller that needs + * to be doubly-removed (with callbacks perhaps). */ + if(!(cb = (struct service_callback*)regional_alloc( + sq->region, sizeof(*cb)))) { + return NULL; } } /* add callback to list of callbacks */ @@ -3325,7 +3464,6 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg) if((*pp)->cb_arg == cb_arg) { struct service_callback* del = *pp; *pp = del->next; - free(del); return; } pp = &(*pp)->next; @@ -3334,13 +3472,13 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg) void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg) { - if(!sq) + if(!sq) return; callback_list_remove(sq, cb_arg); /* if callbacks() routine scheduled deletion, let it do that */ - if(!sq->cblist && !sq->to_be_deleted) { + if(!sq->cblist && !sq->busy && !sq->to_be_deleted) { (void)rbtree_delete(sq->outnet->serviced, sq); - serviced_delete(sq); + serviced_delete(sq); } } diff --git a/sbin/unwind/libunbound/services/outside_network.h b/sbin/unwind/libunbound/services/outside_network.h index d0d532e6425..4c5b96f8342 100644 --- a/sbin/unwind/libunbound/services/outside_network.h +++ b/sbin/unwind/libunbound/services/outside_network.h @@ -43,7 +43,9 @@ #ifndef OUTSIDE_NETWORK_H #define OUTSIDE_NETWORK_H +#include "util/alloc.h" #include "util/rbtree.h" +#include "util/regional.h" #include "util/netevent.h" #include "dnstap/dnstap_config.h" struct pending; @@ -412,6 +414,8 @@ struct waiting_tcp { char* tls_auth_name; /** the packet was involved in an error, to stop looping errors */ int error_count; + /** if true, the item is at the cb_and_decommission stage */ + int in_cb_and_decommission; #ifdef USE_DNSTAP /** serviced query pointer for dnstap to get logging info, if nonNULL*/ struct serviced_query* sq; @@ -512,6 +516,15 @@ struct serviced_query { void* pending; /** block size with which to pad encrypted queries (default: 128) */ size_t padding_block_size; + /** region for this serviced query. Will be cleared when this + * serviced_query will be deleted */ + struct regional* region; + /** allocation service for the region */ + struct alloc_cache* alloc; + /** flash timer to start the net I/O as a separate event */ + struct comm_timer* timer; + /** true if serviced_query is currently doing net I/O and may block */ + int busy; }; /** @@ -619,6 +632,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p); * @param want_dnssec: signatures are needed, without EDNS the answer is * likely to be useless. * @param nocaps: ignore use_caps_for_id and use unperturbed qname. + * @param check_ratelimit: if set, will check ratelimit before sending out. * @param tcp_upstream: use TCP for upstream queries. * @param ssl_upstream: use SSL for upstream queries. * @param tls_auth_name: when ssl_upstream is true, use this name to check @@ -635,16 +649,18 @@ void pending_delete(struct outside_network* outnet, struct pending* p); * @param callback_arg: user argument to callback function. * @param buff: scratch buffer to create query contents in. Empty on exit. * @param env: the module environment. + * @param was_ratelimited: it will signal back if the query failed to pass the + * ratelimit check. * @return 0 on error, or pointer to serviced query that is used to answer * this serviced query may be shared with other callbacks as well. */ struct serviced_query* outnet_serviced_query(struct outside_network* outnet, struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, - int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name, - struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone, - size_t zonelen, struct module_qstate* qstate, + int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream, + char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen, + uint8_t* zone, size_t zonelen, struct module_qstate* qstate, comm_point_callback_type* callback, void* callback_arg, - struct sldns_buffer* buff, struct module_env* env); + struct sldns_buffer* buff, struct module_env* env, int* was_ratelimited); /** * Remove service query callback. @@ -785,6 +801,9 @@ void pending_udp_timer_delay_cb(void *arg); /** callback for outgoing TCP timer event */ void outnet_tcptimer(void* arg); +/** callback to send serviced queries */ +void serviced_timer_cb(void *arg); + /** callback for serviced query UDP answers */ int serviced_udp_callback(struct comm_point* c, void* arg, int error, struct comm_reply* rep); diff --git a/sbin/unwind/libunbound/services/rpz.c b/sbin/unwind/libunbound/services/rpz.c index 3a1ec00d7d3..322e9d1393c 100644 --- a/sbin/unwind/libunbound/services/rpz.c +++ b/sbin/unwind/libunbound/services/rpz.c @@ -50,45 +50,50 @@ #include "util/data/dname.h" #include "util/locks.h" #include "util/regional.h" +#include "util/data/msgencode.h" +#include "services/cache/dns.h" +#include "iterator/iterator.h" +#include "iterator/iter_delegpt.h" +#include "daemon/worker.h" + +typedef struct resp_addr rpz_aclnode_type; + +struct matched_delegation_point { + uint8_t* dname; + size_t dname_len; +}; /** string for RPZ action enum */ const char* rpz_action_to_string(enum rpz_action a) { switch(a) { - case RPZ_NXDOMAIN_ACTION: return "nxdomain"; - case RPZ_NODATA_ACTION: return "nodata"; - case RPZ_PASSTHRU_ACTION: return "passthru"; - case RPZ_DROP_ACTION: return "drop"; - case RPZ_TCP_ONLY_ACTION: return "tcp_only"; - case RPZ_INVALID_ACTION: return "invalid"; - case RPZ_LOCAL_DATA_ACTION: return "local_data"; - case RPZ_DISABLED_ACTION: return "disabled"; - case RPZ_CNAME_OVERRIDE_ACTION: return "cname_override"; - case RPZ_NO_OVERRIDE_ACTION: return "no_override"; + case RPZ_NXDOMAIN_ACTION: return "rpz-nxdomain"; + case RPZ_NODATA_ACTION: return "rpz-nodata"; + case RPZ_PASSTHRU_ACTION: return "rpz-passthru"; + case RPZ_DROP_ACTION: return "rpz-drop"; + case RPZ_TCP_ONLY_ACTION: return "rpz-tcp-only"; + case RPZ_INVALID_ACTION: return "rpz-invalid"; + case RPZ_LOCAL_DATA_ACTION: return "rpz-local-data"; + case RPZ_DISABLED_ACTION: return "rpz-disabled"; + case RPZ_CNAME_OVERRIDE_ACTION: return "rpz-cname-override"; + case RPZ_NO_OVERRIDE_ACTION: return "rpz-no-override"; + default: return "rpz-unknown-action"; } - return "unknown"; } /** RPZ action enum for config string */ static enum rpz_action rpz_config_to_action(char* a) { - if(strcmp(a, "nxdomain") == 0) - return RPZ_NXDOMAIN_ACTION; - else if(strcmp(a, "nodata") == 0) - return RPZ_NODATA_ACTION; - else if(strcmp(a, "passthru") == 0) - return RPZ_PASSTHRU_ACTION; - else if(strcmp(a, "drop") == 0) - return RPZ_DROP_ACTION; - else if(strcmp(a, "tcp_only") == 0) - return RPZ_TCP_ONLY_ACTION; - else if(strcmp(a, "cname") == 0) - return RPZ_CNAME_OVERRIDE_ACTION; - else if(strcmp(a, "disabled") == 0) - return RPZ_DISABLED_ACTION; - return RPZ_INVALID_ACTION; + if(strcmp(a, "nxdomain") == 0) return RPZ_NXDOMAIN_ACTION; + else if(strcmp(a, "nodata") == 0) return RPZ_NODATA_ACTION; + else if(strcmp(a, "passthru") == 0) return RPZ_PASSTHRU_ACTION; + else if(strcmp(a, "drop") == 0) return RPZ_DROP_ACTION; + else if(strcmp(a, "tcp_only") == 0) return RPZ_TCP_ONLY_ACTION; + else if(strcmp(a, "cname") == 0) return RPZ_CNAME_OVERRIDE_ACTION; + else if(strcmp(a, "disabled") == 0) return RPZ_DISABLED_ACTION; + else return RPZ_INVALID_ACTION; } /** string for RPZ trigger enum */ @@ -96,14 +101,14 @@ static const char* rpz_trigger_to_string(enum rpz_trigger r) { switch(r) { - case RPZ_QNAME_TRIGGER: return "qname"; - case RPZ_CLIENT_IP_TRIGGER: return "client_ip"; - case RPZ_RESPONSE_IP_TRIGGER: return "response_ip"; - case RPZ_NSDNAME_TRIGGER: return "nsdname"; - case RPZ_NSIP_TRIGGER: return "nsip"; - case RPZ_INVALID_TRIGGER: return "invalid"; + case RPZ_QNAME_TRIGGER: return "rpz-qname"; + case RPZ_CLIENT_IP_TRIGGER: return "rpz-client-ip"; + case RPZ_RESPONSE_IP_TRIGGER: return "rpz-response-ip"; + case RPZ_NSDNAME_TRIGGER: return "rpz-nsdname"; + case RPZ_NSIP_TRIGGER: return "rpz-nsip"; + case RPZ_INVALID_TRIGGER: return "rpz-invalid"; + default: return "rpz-unknown-trigger"; } - return "unknown"; } /** @@ -137,6 +142,31 @@ get_tld_label(uint8_t* dname, size_t maxdnamelen) return prevlab; } +/** + * The RR types that are to be ignored. + * DNSSEC RRs at the apex, and SOA and NS are ignored. + */ +static int +rpz_type_ignored(uint16_t rr_type) +{ + switch(rr_type) { + case LDNS_RR_TYPE_SOA: + case LDNS_RR_TYPE_NS: + case LDNS_RR_TYPE_DNAME: + /* all DNSSEC-related RRs must be ignored */ + case LDNS_RR_TYPE_DNSKEY: + case LDNS_RR_TYPE_DS: + case LDNS_RR_TYPE_RRSIG: + case LDNS_RR_TYPE_NSEC: + case LDNS_RR_TYPE_NSEC3: + case LDNS_RR_TYPE_NSEC3PARAM: + return 1; + default: + break; + } + return 0; +} + /** * Classify RPZ action for RR type/rdata * @param rr_type: the RR type @@ -208,15 +238,15 @@ static enum localzone_type rpz_action_to_localzone_type(enum rpz_action a) { switch(a) { - case RPZ_NXDOMAIN_ACTION: return local_zone_always_nxdomain; - case RPZ_NODATA_ACTION: return local_zone_always_nodata; - case RPZ_DROP_ACTION: return local_zone_always_deny; - case RPZ_PASSTHRU_ACTION: return local_zone_always_transparent; + case RPZ_NXDOMAIN_ACTION: return local_zone_always_nxdomain; + case RPZ_NODATA_ACTION: return local_zone_always_nodata; + case RPZ_DROP_ACTION: return local_zone_always_deny; + case RPZ_PASSTHRU_ACTION: return local_zone_always_transparent; case RPZ_LOCAL_DATA_ACTION: /* fallthrough */ case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect; - case RPZ_INVALID_ACTION: /* fallthrough */ - case RPZ_TCP_ONLY_ACTION: /* fallthrough */ - default: return local_zone_invalid; + case RPZ_TCP_ONLY_ACTION: return local_zone_truncate; + case RPZ_INVALID_ACTION: /* fallthrough */ + default: return local_zone_invalid; } } @@ -224,15 +254,15 @@ enum respip_action rpz_action_to_respip_action(enum rpz_action a) { switch(a) { - case RPZ_NXDOMAIN_ACTION: return respip_always_nxdomain; - case RPZ_NODATA_ACTION: return respip_always_nodata; - case RPZ_DROP_ACTION: return respip_always_deny; - case RPZ_PASSTHRU_ACTION: return respip_always_transparent; - case RPZ_LOCAL_DATA_ACTION: /* fallthrough */ + case RPZ_NXDOMAIN_ACTION: return respip_always_nxdomain; + case RPZ_NODATA_ACTION: return respip_always_nodata; + case RPZ_DROP_ACTION: return respip_always_deny; + case RPZ_PASSTHRU_ACTION: return respip_always_transparent; + case RPZ_LOCAL_DATA_ACTION: /* fallthrough */ case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect; - case RPZ_INVALID_ACTION: /* fallthrough */ - case RPZ_TCP_ONLY_ACTION: /* fallthrough */ - default: return respip_invalid; + case RPZ_TCP_ONLY_ACTION: return respip_truncate; + case RPZ_INVALID_ACTION: /* fallthrough */ + default: return respip_invalid; } } @@ -240,14 +270,14 @@ static enum rpz_action localzone_type_to_rpz_action(enum localzone_type lzt) { switch(lzt) { - case local_zone_always_nxdomain: return RPZ_NXDOMAIN_ACTION; - case local_zone_always_nodata: return RPZ_NODATA_ACTION; - case local_zone_always_deny: return RPZ_DROP_ACTION; - case local_zone_always_transparent: return RPZ_PASSTHRU_ACTION; - case local_zone_redirect: return RPZ_LOCAL_DATA_ACTION; - case local_zone_invalid: - default: - return RPZ_INVALID_ACTION; + case local_zone_always_nxdomain: return RPZ_NXDOMAIN_ACTION; + case local_zone_always_nodata: return RPZ_NODATA_ACTION; + case local_zone_always_deny: return RPZ_DROP_ACTION; + case local_zone_always_transparent: return RPZ_PASSTHRU_ACTION; + case local_zone_redirect: return RPZ_LOCAL_DATA_ACTION; + case local_zone_truncate: return RPZ_TCP_ONLY_ACTION; + case local_zone_invalid: /* fallthrough */ + default: return RPZ_INVALID_ACTION; } } @@ -255,14 +285,14 @@ enum rpz_action respip_action_to_rpz_action(enum respip_action a) { switch(a) { - case respip_always_nxdomain: return RPZ_NXDOMAIN_ACTION; - case respip_always_nodata: return RPZ_NODATA_ACTION; - case respip_always_deny: return RPZ_DROP_ACTION; - case respip_always_transparent: return RPZ_PASSTHRU_ACTION; - case respip_redirect: return RPZ_LOCAL_DATA_ACTION; - case respip_invalid: - default: - return RPZ_INVALID_ACTION; + case respip_always_nxdomain: return RPZ_NXDOMAIN_ACTION; + case respip_always_nodata: return RPZ_NODATA_ACTION; + case respip_always_deny: return RPZ_DROP_ACTION; + case respip_always_transparent: return RPZ_PASSTHRU_ACTION; + case respip_redirect: return RPZ_LOCAL_DATA_ACTION; + case respip_truncate: return RPZ_TCP_ONLY_ACTION; + case respip_invalid: /* fallthrough */ + default: return RPZ_INVALID_ACTION; } } @@ -298,12 +328,55 @@ rpz_dname_to_trigger(uint8_t* dname, size_t dname_len) return RPZ_QNAME_TRIGGER; } -void rpz_delete(struct rpz* r) +static inline struct clientip_synthesized_rrset* +rpz_clientip_synthesized_set_create(void) +{ + struct clientip_synthesized_rrset* set = calloc(1, sizeof(*set)); + if(set == NULL) { + return NULL; + } + set->region = regional_create(); + if(set->region == NULL) { + free(set); + return NULL; + } + addr_tree_init(&set->entries); + lock_rw_init(&set->lock); + return set; +} + +static void +rpz_clientip_synthesized_rr_delete(rbnode_type* n, void* ATTR_UNUSED(arg)) +{ + struct clientip_synthesized_rr* r = (struct clientip_synthesized_rr*)n->key; + lock_rw_destroy(&r->lock); +#ifdef THREADS_DISABLED + (void)r; +#endif +} + +static inline void +rpz_clientip_synthesized_set_delete(struct clientip_synthesized_rrset* set) +{ + if(set == NULL) { + return; + } + lock_rw_destroy(&set->lock); + traverse_postorder(&set->entries, rpz_clientip_synthesized_rr_delete, NULL); + regional_destroy(set->region); + free(set); +} + +void +rpz_delete(struct rpz* r) { if(!r) return; local_zones_delete(r->local_zones); + local_zones_delete(r->nsdname_zones); respip_set_delete(r->respip_set); + rpz_clientip_synthesized_set_delete(r->client_set); + rpz_clientip_synthesized_set_delete(r->ns_set); regional_destroy(r->region); free(r->taglist); free(r->log_name); @@ -315,13 +388,31 @@ rpz_clear(struct rpz* r) { /* must hold write lock on auth_zone */ local_zones_delete(r->local_zones); + r->local_zones = NULL; + local_zones_delete(r->nsdname_zones); + r->nsdname_zones = NULL; respip_set_delete(r->respip_set); + r->respip_set = NULL; + rpz_clientip_synthesized_set_delete(r->client_set); + r->client_set = NULL; + rpz_clientip_synthesized_set_delete(r->ns_set); + r->ns_set = NULL; if(!(r->local_zones = local_zones_create())){ return 0; } + r->nsdname_zones = local_zones_create(); + if(r->nsdname_zones == NULL) { + return 0; + } if(!(r->respip_set = respip_set_create())) { return 0; } + if(!(r->client_set = rpz_clientip_synthesized_set_create())) { + return 0; + } + if(!(r->ns_set = rpz_clientip_synthesized_set_create())) { + return 0; + } return 1; } @@ -331,6 +422,14 @@ rpz_finish_config(struct rpz* r) lock_rw_wrlock(&r->respip_set->lock); addr_tree_init_parents(&r->respip_set->ip_tree); lock_rw_unlock(&r->respip_set->lock); + + lock_rw_wrlock(&r->client_set->lock); + addr_tree_init_parents(&r->client_set->entries); + lock_rw_unlock(&r->client_set->lock); + + lock_rw_wrlock(&r->ns_set->lock); + addr_tree_init_parents(&r->ns_set->entries); + lock_rw_unlock(&r->ns_set->lock); } /** new rrset containing CNAME override, does not yet contain a dname */ @@ -394,9 +493,26 @@ rpz_create(struct config_auth* p) if(!(r->local_zones = local_zones_create())){ goto err; } + + r->nsdname_zones = local_zones_create(); + if(r->local_zones == NULL){ + goto err; + } + if(!(r->respip_set = respip_set_create())) { goto err; } + + r->client_set = rpz_clientip_synthesized_set_create(); + if(r->client_set == NULL) { + goto err; + } + + r->ns_set = rpz_clientip_synthesized_set_create(); + if(r->ns_set == NULL) { + goto err; + } + r->taglistlen = p->rpz_taglistlen; r->taglist = memdup(p->rpz_taglist, r->taglistlen); if(p->rpz_action_override) { @@ -426,6 +542,7 @@ rpz_create(struct config_auth* p) } } r->log = p->rpz_log; + r->signal_nxdomain_ra = p->rpz_signal_nxdomain_ra; if(p->rpz_log_name) { if(!(r->log_name = strdup(p->rpz_log_name))) { log_err("malloc failure on RPZ log_name strdup"); @@ -437,8 +554,14 @@ err: if(r) { if(r->local_zones) local_zones_delete(r->local_zones); + if(r->nsdname_zones) + local_zones_delete(r->nsdname_zones); if(r->respip_set) respip_set_delete(r->respip_set); + if(r->client_set != NULL) + rpz_clientip_synthesized_set_delete(r->client_set); + if(r->ns_set != NULL) + rpz_clientip_synthesized_set_delete(r->ns_set); if(r->taglist) free(r->taglist); if(r->region) @@ -467,19 +590,17 @@ strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen, return newdnamelen + 1; /* + 1 for root label */ } -/** Insert RR into RPZ's local-zone */ static void -rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, - enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, - uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) +rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname, + size_t dnamelen, enum rpz_action a, uint16_t rrtype, uint16_t rrclass, + uint32_t ttl, uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) { struct local_zone* z; enum localzone_type tp = local_zone_always_transparent; int dnamelabs = dname_count_labels(dname); - char* rrstr; int newzone = 0; - if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) { + if(a == RPZ_INVALID_ACTION) { char str[255+1]; if(rrtype == LDNS_RR_TYPE_SOA || rrtype == LDNS_RR_TYPE_NS || rrtype == LDNS_RR_TYPE_DNAME || @@ -499,237 +620,542 @@ rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, return; } - lock_rw_wrlock(&r->local_zones->lock); + lock_rw_wrlock(&lz->lock); /* exact match */ - z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs, - LDNS_RR_CLASS_IN); - if(z && a != RPZ_LOCAL_DATA_ACTION) { - rrstr = sldns_wire2str_rr(rr, rr_len); - if(!rrstr) { - log_err("malloc error while inserting RPZ qname " - "trigger"); + z = local_zones_find(lz, dname, dnamelen, dnamelabs, LDNS_RR_CLASS_IN); + if(z != NULL && a != RPZ_LOCAL_DATA_ACTION) { + char* rrstr = sldns_wire2str_rr(rr, rr_len); + if(rrstr == NULL) { + log_err("malloc error while inserting rpz nsdname trigger"); free(dname); - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&lz->lock); return; } - verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'", - rrstr); + if(rrstr[0]) + rrstr[strlen(rrstr)-1]=0; /* remove newline */ + verbose(VERB_ALGO, "rpz: skipping duplicate record: '%s'", rrstr); free(rrstr); free(dname); - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&lz->lock); return; } - if(!z) { + if(z == NULL) { tp = rpz_action_to_localzone_type(a); - if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen, - dnamelabs, rrclass, tp))) { - log_warn("RPZ create failed"); - lock_rw_unlock(&r->local_zones->lock); + z = local_zones_add_zone(lz, dname, dnamelen, + dnamelabs, rrclass, tp); + if(z == NULL) { + log_warn("rpz: create failed"); + lock_rw_unlock(&lz->lock); /* dname will be free'd in failed local_zone_create() */ return; } newzone = 1; } if(a == RPZ_LOCAL_DATA_ACTION) { - rrstr = sldns_wire2str_rr(rr, rr_len); - if(!rrstr) { - log_err("malloc error while inserting RPZ qname " - "trigger"); + char* rrstr = sldns_wire2str_rr(rr, rr_len); + if(rrstr == NULL) { + log_err("malloc error while inserting rpz nsdname trigger"); free(dname); - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&lz->lock); return; } lock_rw_wrlock(&z->lock); - local_zone_enter_rr(z, dname, dnamelen, dnamelabs, - rrtype, rrclass, ttl, rdata, rdata_len, rrstr); + local_zone_enter_rr(z, dname, dnamelen, dnamelabs, rrtype, + rrclass, ttl, rdata, rdata_len, rrstr); lock_rw_unlock(&z->lock); free(rrstr); } - if(!newzone) + if(!newzone) { free(dname); - lock_rw_unlock(&r->local_zones->lock); - return; + } + lock_rw_unlock(&lz->lock); } -/** Insert RR into RPZ's respip_set */ -static int -rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, +static void +rpz_log_dname(char const* msg, uint8_t* dname, size_t dname_len) +{ + char buf[LDNS_MAX_DOMAINLEN+1]; + (void)dname_len; + dname_str(dname, buf); + verbose(VERB_ALGO, "rpz: %s: <%s>", msg, buf); +} + +static void +rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) { - struct resp_addr* node; - struct sockaddr_storage addr; - socklen_t addrlen; - int net, af; - char* rrstr; - enum respip_action respa = rpz_action_to_respip_action(a); + if(a == RPZ_INVALID_ACTION) { + verbose(VERB_ALGO, "rpz: skipping invalid action"); + free(dname); + return; + } - if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION || - respa == respip_invalid) { - char str[255+1]; - dname_str(dname, str); - verbose(VERB_ALGO, "RPZ: respip trigger, %s skipping unsupported action: %s", - str, rpz_action_to_string(a)); + rpz_insert_local_zones_trigger(r->local_zones, dname, dnamelen, a, rrtype, + rrclass, ttl, rdata, rdata_len, rr, rr_len); +} + +static int +rpz_strip_nsdname_suffix(uint8_t* dname, size_t maxdnamelen, + uint8_t** stripdname, size_t* stripdnamelen) +{ + uint8_t* tldstart = get_tld_label(dname, maxdnamelen); + uint8_t swap; + if(tldstart == NULL) { + if(dname == NULL) { + *stripdname = NULL; + *stripdnamelen = 0; + return 0; + } + *stripdname = memdup(dname, maxdnamelen); + if(!*stripdname) { + *stripdnamelen = 0; + log_err("malloc failure for rpz strip suffix"); + return 0; + } + *stripdnamelen = maxdnamelen; + return 1; + } + /* shorten the domain name briefly, + * then we allocate a new name with the correct length */ + swap = *tldstart; + *tldstart = 0; + (void)dname_count_size_labels(dname, stripdnamelen); + *stripdname = memdup(dname, *stripdnamelen); + *tldstart = swap; + if(!*stripdname) { + *stripdnamelen = 0; + log_err("malloc failure for rpz strip suffix"); return 0; } + return 1; +} - if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) - return 0; +static void +rpz_insert_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, + uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) +{ + uint8_t* dname_stripped = NULL; + size_t dnamelen_stripped = 0; - lock_rw_wrlock(&r->respip_set->lock); + rpz_strip_nsdname_suffix(dname, dnamelen, &dname_stripped, + &dnamelen_stripped); + if(a == RPZ_INVALID_ACTION) { + verbose(VERB_ALGO, "rpz: skipping invalid action"); + free(dname_stripped); + return; + } + + /* dname_stripped is consumed or freed by the insert routine */ + rpz_insert_local_zones_trigger(r->nsdname_zones, dname_stripped, + dnamelen_stripped, a, rrtype, rrclass, ttl, rdata, rdata_len, + rr, rr_len); +} + +static int +rpz_insert_ipaddr_based_trigger(struct respip_set* set, struct sockaddr_storage* addr, + socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype, + uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len, + uint8_t* rr, size_t rr_len) +{ + struct resp_addr* node; + char* rrstr; + enum respip_action respa = rpz_action_to_respip_action(a); + + lock_rw_wrlock(&set->lock); rrstr = sldns_wire2str_rr(rr, rr_len); - if(!rrstr) { - log_err("malloc error while inserting RPZ respip trigger"); - lock_rw_unlock(&r->respip_set->lock); + if(rrstr == NULL) { + log_err("malloc error while inserting rpz ipaddr based trigger"); + lock_rw_unlock(&set->lock); return 0; } - if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen, - net, 1, rrstr))) { - lock_rw_unlock(&r->respip_set->lock); + + node = respip_sockaddr_find_or_create(set, addr, addrlen, net, 1, rrstr); + if(node == NULL) { + lock_rw_unlock(&set->lock); free(rrstr); return 0; } lock_rw_wrlock(&node->lock); - lock_rw_unlock(&r->respip_set->lock); + lock_rw_unlock(&set->lock); + node->action = respa; if(a == RPZ_LOCAL_DATA_ACTION) { - respip_enter_rr(r->respip_set->region, node, rrtype, - rrclass, ttl, rdata, rdata_len, rrstr, ""); + respip_enter_rr(set->region, node, rrtype, + rrclass, ttl, rdata, rdata_len, rrstr, ""); } + lock_rw_unlock(&node->lock); free(rrstr); return 1; } -int -rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, - size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, - uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len) +static inline struct clientip_synthesized_rr* +rpz_clientip_ensure_entry(struct clientip_synthesized_rrset* set, + struct sockaddr_storage* addr, socklen_t addrlen, int net) { - size_t policydnamelen; - /* name is free'd in local_zone delete */ - enum rpz_trigger t; - enum rpz_action a; - uint8_t* policydname; + int insert_ok; + struct clientip_synthesized_rr* node = + (struct clientip_synthesized_rr*)addr_tree_find(&set->entries, + addr, addrlen, net); - if(!dname_subdomain_c(dname, azname)) { - char* dname_str = sldns_wire2str_dname(dname, dnamelen); - char* azname_str = sldns_wire2str_dname(azname, aznamelen); - if(dname_str && azname_str) { - log_err("RPZ: name of record (%s) to insert into RPZ is not a " - "subdomain of the configured name of the RPZ zone (%s)", - dname_str, azname_str); - } else { - log_err("RPZ: name of record to insert into RPZ is not a " - "subdomain of the configured name of the RPZ zone"); - } - free(dname_str); - free(azname_str); - return 0; + if(node != NULL) { return node; } + + /* node does not yet exist => allocate one */ + node = regional_alloc_zero(set->region, sizeof(*node)); + if(node == NULL) { + log_err("out of memory"); + return NULL; } - log_assert(dnamelen >= aznamelen); - if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) { - log_err("malloc error while inserting RPZ RR"); - return 0; + lock_rw_init(&node->lock); + node->action = RPZ_INVALID_ACTION; + insert_ok = addr_tree_insert(&set->entries, &node->node, + addr, addrlen, net); + if (!insert_ok) { + log_warn("rpz: unexpected: unable to insert clientip address node"); + /* we can not free the just allocated node. + * theoretically a memleak */ + return NULL; } - a = rpz_rr_to_action(rr_type, rdatawl, rdatalen); - if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen, - policydname, (dnamelen-aznamelen)+1))) { - free(policydname); - return 0; + return node; +} + +static void +rpz_report_rrset_error(const char* msg, uint8_t* rr, size_t rr_len) { + char* rrstr = sldns_wire2str_rr(rr, rr_len); + if(rrstr == NULL) { + log_err("malloc error while inserting rpz clientip based record"); + return; } - t = rpz_dname_to_trigger(policydname, policydnamelen); - if(t == RPZ_INVALID_TRIGGER) { - free(policydname); - verbose(VERB_ALGO, "RPZ: skipping invalid trigger"); - return 1; + log_err("rpz: unexpected: unable to insert %s: %s", msg, rrstr); + free(rrstr); +} + +/* from localzone.c; difference is we don't have a dname */ +static struct local_rrset* +rpz_clientip_new_rrset(struct regional* region, + struct clientip_synthesized_rr* raddr, uint16_t rrtype, uint16_t rrclass) +{ + struct packed_rrset_data* pd; + struct local_rrset* rrset = (struct local_rrset*) + regional_alloc_zero(region, sizeof(*rrset)); + if(rrset == NULL) { + log_err("out of memory"); + return NULL; } - if(t == RPZ_QNAME_TRIGGER) { - rpz_insert_qname_trigger(r, policydname, policydnamelen, - a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, - rr_len); + rrset->next = raddr->data; + raddr->data = rrset; + rrset->rrset = (struct ub_packed_rrset_key*) + regional_alloc_zero(region, sizeof(*rrset->rrset)); + if(rrset->rrset == NULL) { + log_err("out of memory"); + return NULL; } - else if(t == RPZ_RESPONSE_IP_TRIGGER) { - rpz_insert_response_ip_trigger(r, policydname, policydnamelen, - a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, - rr_len); - free(policydname); + rrset->rrset->entry.key = rrset->rrset; + pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd)); + if(pd == NULL) { + log_err("out of memory"); + return NULL; } - else { - free(policydname); - verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s", - rpz_trigger_to_string(t)); + pd->trust = rrset_trust_prim_noglue; + pd->security = sec_status_insecure; + rrset->rrset->entry.data = pd; + rrset->rrset->rk.type = htons(rrtype); + rrset->rrset->rk.rrset_class = htons(rrclass); + rrset->rrset->rk.dname = regional_alloc_zero(region, 1); + if(rrset->rrset->rk.dname == NULL) { + log_err("out of memory"); + return NULL; } - return 1; + rrset->rrset->rk.dname_len = 1; + return rrset; } -/** - * Find RPZ local-zone by qname. - * @param r: rpz containing local-zone tree - * @param qname: qname - * @param qname_len: length of qname - * @param qclass: qclass - * @param only_exact: if 1 only excact (non wildcard) matches are returned - * @param wr: get write lock for local-zone if 1, read lock if 0 - * @param zones_keep_lock: if set do not release the r->local_zones lock, this - * makes the caller of this function responsible for releasing the lock. - * @return: NULL or local-zone holding rd or wr lock - */ -static struct local_zone* -rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass, - int only_exact, int wr, int zones_keep_lock) +static int +rpz_clientip_enter_rr(struct regional* region, struct clientip_synthesized_rr* raddr, + uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata, + size_t rdata_len) { - uint8_t* ce; - size_t ce_len; - int ce_labs; - uint8_t wc[LDNS_MAX_DOMAINLEN+1]; - int exact; - struct local_zone* z = NULL; - if(wr) { - lock_rw_wrlock(&r->local_zones->lock); - } else { - lock_rw_rdlock(&r->local_zones->lock); - } - z = local_zones_find_le(r->local_zones, qname, qname_len, - dname_count_labels(qname), - LDNS_RR_CLASS_IN, &exact); - if(!z || (only_exact && !exact)) { - lock_rw_unlock(&r->local_zones->lock); - return NULL; - } - if(wr) { - lock_rw_wrlock(&z->lock); - } else { - lock_rw_rdlock(&z->lock); + struct local_rrset* rrset; + if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data != NULL) { + log_err("CNAME response-ip data can not co-exist with other " + "client-ip data"); + return 0; } - if(!zones_keep_lock) { - lock_rw_unlock(&r->local_zones->lock); + + rrset = rpz_clientip_new_rrset(region, raddr, rrtype, rrclass); + if(raddr->data == NULL) { + return 0; } - if(exact) - return z; + return rrset_insert_rr(region, rrset->rrset->entry.data, rdata, rdata_len, ttl, ""); +} - /* No exact match found, lookup wildcard. closest encloser must - * be the shared parent between the qname and the best local - * zone match, append '*' to that and do another lookup. */ +static int +rpz_clientip_insert_trigger_rr(struct clientip_synthesized_rrset* set, struct sockaddr_storage* addr, + socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype, + uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len, + uint8_t* rr, size_t rr_len) +{ + struct clientip_synthesized_rr* node; - ce = dname_get_shared_topdomain(z->name, qname); - if(!ce /* should not happen */) { - lock_rw_unlock(&z->lock); - if(zones_keep_lock) { - lock_rw_unlock(&r->local_zones->lock); - } - return NULL; + lock_rw_wrlock(&set->lock); + + node = rpz_clientip_ensure_entry(set, addr, addrlen, net); + if(node == NULL) { + lock_rw_unlock(&set->lock); + rpz_report_rrset_error("client ip address", rr, rr_len); + return 0; + } + + lock_rw_wrlock(&node->lock); + lock_rw_unlock(&set->lock); + + node->action = a; + if(a == RPZ_LOCAL_DATA_ACTION) { + if(!rpz_clientip_enter_rr(set->region, node, rrtype, + rrclass, ttl, rdata, rdata_len)) { + verbose(VERB_ALGO, "rpz: unable to insert clientip rr"); + lock_rw_unlock(&node->lock); + return 0; + } + + } + + lock_rw_unlock(&node->lock); + + return 1; +} + +static int +rpz_insert_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, + uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + + if(a == RPZ_INVALID_ACTION) { + return 0; + } + + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) { + verbose(VERB_ALGO, "rpz: unable to parse client ip"); + return 0; + } + + return rpz_clientip_insert_trigger_rr(r->client_set, &addr, addrlen, net, + a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len); +} + +static int +rpz_insert_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, + uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + + if(a == RPZ_INVALID_ACTION) { + return 0; + } + + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) { + verbose(VERB_ALGO, "rpz: unable to parse ns ip"); + return 0; + } + + return rpz_clientip_insert_trigger_rr(r->ns_set, &addr, addrlen, net, + a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len); +} + +/** Insert RR into RPZ's respip_set */ +static int +rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl, + uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + + if(a == RPZ_INVALID_ACTION) { + return 0; + } + + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) { + verbose(VERB_ALGO, "rpz: unable to parse response ip"); + return 0; + } + + if(a == RPZ_INVALID_ACTION || + rpz_action_to_respip_action(a) == respip_invalid) { + char str[255+1]; + dname_str(dname, str); + verbose(VERB_ALGO, "RPZ: respip trigger, %s skipping unsupported action: %s", + str, rpz_action_to_string(a)); + return 0; + } + + return rpz_insert_ipaddr_based_trigger(r->respip_set, &addr, addrlen, net, + a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len); +} + +int +rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, + size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, + uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len) +{ + size_t policydnamelen; + /* name is free'd in local_zone delete */ + enum rpz_trigger t; + enum rpz_action a; + uint8_t* policydname; + + if(rpz_type_ignored(rr_type)) { + /* this rpz action is not valid, eg. this is the SOA or NS RR */ + return 1; + } + if(!dname_subdomain_c(dname, azname)) { + char* dname_str = sldns_wire2str_dname(dname, dnamelen); + char* azname_str = sldns_wire2str_dname(azname, aznamelen); + if(dname_str && azname_str) { + log_err("rpz: name of record (%s) to insert into RPZ is not a " + "subdomain of the configured name of the RPZ zone (%s)", + dname_str, azname_str); + } else { + log_err("rpz: name of record to insert into RPZ is not a " + "subdomain of the configured name of the RPZ zone"); + } + free(dname_str); + free(azname_str); + return 0; + } + + log_assert(dnamelen >= aznamelen); + if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) { + log_err("malloc error while inserting RPZ RR"); + return 0; + } + + a = rpz_rr_to_action(rr_type, rdatawl, rdatalen); + if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen, + policydname, (dnamelen-aznamelen)+1))) { + free(policydname); + return 0; + } + t = rpz_dname_to_trigger(policydname, policydnamelen); + if(t == RPZ_INVALID_TRIGGER) { + free(policydname); + verbose(VERB_ALGO, "rpz: skipping invalid trigger"); + return 1; + } + if(t == RPZ_QNAME_TRIGGER) { + /* policydname will be consumed, no free */ + rpz_insert_qname_trigger(r, policydname, policydnamelen, + a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, + rr_len); + } else if(t == RPZ_RESPONSE_IP_TRIGGER) { + rpz_insert_response_ip_trigger(r, policydname, policydnamelen, + a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, + rr_len); + free(policydname); + } else if(t == RPZ_CLIENT_IP_TRIGGER) { + rpz_insert_clientip_trigger(r, policydname, policydnamelen, + a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, + rr_len); + free(policydname); + } else if(t == RPZ_NSIP_TRIGGER) { + rpz_insert_nsip_trigger(r, policydname, policydnamelen, + a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, + rr_len); + free(policydname); + } else if(t == RPZ_NSDNAME_TRIGGER) { + rpz_insert_nsdname_trigger(r, policydname, policydnamelen, + a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr, + rr_len); + free(policydname); + } else { + free(policydname); + verbose(VERB_ALGO, "rpz: skipping unsupported trigger: %s", + rpz_trigger_to_string(t)); + } + return 1; +} + +/** + * Find RPZ local-zone by qname. + * @param zones: local-zone tree + * @param qname: qname + * @param qname_len: length of qname + * @param qclass: qclass + * @param only_exact: if 1 only exact (non wildcard) matches are returned + * @param wr: get write lock for local-zone if 1, read lock if 0 + * @param zones_keep_lock: if set do not release the r->local_zones lock, this + * makes the caller of this function responsible for releasing the lock. + * @return: NULL or local-zone holding rd or wr lock + */ +static struct local_zone* +rpz_find_zone(struct local_zones* zones, uint8_t* qname, size_t qname_len, uint16_t qclass, + int only_exact, int wr, int zones_keep_lock) +{ + uint8_t* ce; + size_t ce_len; + int ce_labs; + uint8_t wc[LDNS_MAX_DOMAINLEN+1]; + int exact; + struct local_zone* z = NULL; + + if(wr) { + lock_rw_wrlock(&zones->lock); + } else { + lock_rw_rdlock(&zones->lock); + } + z = local_zones_find_le(zones, qname, qname_len, + dname_count_labels(qname), + LDNS_RR_CLASS_IN, &exact); + if(!z || (only_exact && !exact)) { + if(!zones_keep_lock) { + lock_rw_unlock(&zones->lock); + } + return NULL; + } + if(wr) { + lock_rw_wrlock(&z->lock); + } else { + lock_rw_rdlock(&z->lock); + } + if(!zones_keep_lock) { + lock_rw_unlock(&zones->lock); + } + + if(exact) + return z; + + /* No exact match found, lookup wildcard. closest encloser must + * be the shared parent between the qname and the best local + * zone match, append '*' to that and do another lookup. */ + + ce = dname_get_shared_topdomain(z->name, qname); + if(!ce /* should not happen */) { + lock_rw_unlock(&z->lock); + if(zones_keep_lock) { + lock_rw_unlock(&zones->lock); + } + return NULL; } ce_labs = dname_count_size_labels(ce, &ce_len); if(ce_len+2 > sizeof(wc)) { lock_rw_unlock(&z->lock); if(zones_keep_lock) { - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&zones->lock); } return NULL; } @@ -740,15 +1166,15 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass, if(!zones_keep_lock) { if(wr) { - lock_rw_wrlock(&r->local_zones->lock); + lock_rw_wrlock(&zones->lock); } else { - lock_rw_rdlock(&r->local_zones->lock); + lock_rw_rdlock(&zones->lock); } } - z = local_zones_find_le(r->local_zones, wc, + z = local_zones_find_le(zones, wc, ce_len+2, ce_labs+1, qclass, &exact); if(!z || !exact) { - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&zones->lock); return NULL; } if(wr) { @@ -757,7 +1183,7 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass, lock_rw_rdlock(&z->lock); } if(!zones_keep_lock) { - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&zones->lock); } return z; } @@ -766,7 +1192,7 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass, * Remove RR from RPZ's local-data * @param z: local-zone for RPZ, holding write lock * @param policydname: dname of RR to remove - * @param policydnamelen: lenth of policydname + * @param policydnamelen: length of policydname * @param rr_type: RR type of RR to remove * @param rdata: rdata of RR to remove * @param rdatalen: length of rdata @@ -852,10 +1278,10 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, { struct local_zone* z; int delete_zone = 1; - z = rpz_find_zone(r, dname, dnamelen, rr_class, + z = rpz_find_zone(r->local_zones, dname, dnamelen, rr_class, 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/); if(!z) { - verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, " + verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " "RPZ domain not found"); return; } @@ -891,7 +1317,7 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, lock_rw_wrlock(&r->respip_set->lock); if(!(node = (struct resp_addr*)addr_tree_find( &r->respip_set->ip_tree, &addr, addrlen, net))) { - verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, " + verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " "RPZ domain not found"); lock_rw_unlock(&r->respip_set->lock); return; @@ -944,118 +1370,1009 @@ rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen, /** print log information for an applied RPZ policy. Based on local-zone's * lz_inform_print(). + * The repinfo contains the reply address. If it is NULL, the module + * state is used to report the first IP address (if any). + * The dname is used, for the applied rpz, if NULL, addrnode is used. */ static void -log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo, - struct comm_reply* repinfo, char* log_name) +log_rpz_apply(char* trigger, uint8_t* dname, struct addr_tree_node* addrnode, + enum rpz_action a, struct query_info* qinfo, + struct comm_reply* repinfo, struct module_qstate* ms, char* log_name) { - char ip[128], txt[512]; + char ip[128], txt[512], portstr[32]; char dnamestr[LDNS_MAX_DOMAINLEN+1]; - uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port); - dname_str(dname, dnamestr); - addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip)); - if(log_name) - snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u", - log_name, dnamestr, rpz_action_to_string(a), ip, - (unsigned)port); - else - snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u", - dnamestr, rpz_action_to_string(a), ip, (unsigned)port); + uint16_t port = 0; + if(dname) { + dname_str(dname, dnamestr); + } else if(addrnode) { + char addrbuf[128]; + addr_to_str(&addrnode->addr, addrnode->addrlen, addrbuf, sizeof(addrbuf)); + snprintf(dnamestr, sizeof(dnamestr), "%s/%d", addrbuf, addrnode->net); + } else { + dnamestr[0]=0; + } + if(repinfo) { + addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip)); + port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port); + } else if(ms && ms->mesh_info && ms->mesh_info->reply_list) { + addr_to_str(&ms->mesh_info->reply_list->query_reply.addr, ms->mesh_info->reply_list->query_reply.addrlen, ip, sizeof(ip)); + port = ntohs(((struct sockaddr_in*)&ms->mesh_info->reply_list->query_reply.addr)->sin_port); + } else { + ip[0]=0; + port = 0; + } + snprintf(portstr, sizeof(portstr), "@%u", (unsigned)port); + snprintf(txt, sizeof(txt), "rpz: applied %s%s%s%s%s%s %s %s%s", + (log_name?"[":""), (log_name?log_name:""), (log_name?"] ":""), + (strcmp(trigger,"qname")==0?"":trigger), + (strcmp(trigger,"qname")==0?"":" "), + dnamestr, rpz_action_to_string(a), + (ip[0]?ip:""), (ip[0]?portstr:"")); log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass); } -int -rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env, - struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, - struct regional* temp, struct comm_reply* repinfo, - uint8_t* taglist, size_t taglen, struct ub_server_stats* stats) +static struct clientip_synthesized_rr* +rpz_ipbased_trigger_lookup(struct clientip_synthesized_rrset* set, + struct sockaddr_storage* addr, socklen_t addrlen, char* triggername) +{ + struct clientip_synthesized_rr* raddr = NULL; + enum rpz_action action = RPZ_INVALID_ACTION; + + lock_rw_rdlock(&set->lock); + + raddr = (struct clientip_synthesized_rr*)addr_tree_lookup(&set->entries, + addr, addrlen); + if(raddr != NULL) { + lock_rw_rdlock(&raddr->lock); + action = raddr->action; + if(verbosity >= VERB_ALGO) { + char ip[256], net[256]; + addr_to_str(addr, addrlen, ip, sizeof(ip)); + addr_to_str(&raddr->node.addr, raddr->node.addrlen, + net, sizeof(net)); + verbose(VERB_ALGO, "rpz: trigger %s %s/%d on %s action=%s", + triggername, net, raddr->node.net, ip, rpz_action_to_string(action)); + } + } + lock_rw_unlock(&set->lock); + + return raddr; +} + +static inline +struct clientip_synthesized_rr* +rpz_resolve_client_action_and_zone(struct auth_zones* az, struct query_info* qinfo, + struct comm_reply* repinfo, uint8_t* taglist, size_t taglen, + struct ub_server_stats* stats, + /* output parameters */ + struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out) { + struct clientip_synthesized_rr* node = NULL; + struct auth_zone* a = NULL; struct rpz* r = NULL; - struct auth_zone* a; - int ret; - enum localzone_type lzt; struct local_zone* z = NULL; - struct local_data* ld = NULL; + lock_rw_rdlock(&az->rpz_lock); + for(a = az->rpz_first; a; a = a->rpz_az_next) { lock_rw_rdlock(&a->lock); r = a->rpz; - if(!r->disabled && (!r->taglist || taglist_intersect(r->taglist, - r->taglistlen, taglist, taglen))) { - z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len, - qinfo->qclass, 0, 0, 0); - if(z && r->action_override == RPZ_DISABLED_ACTION) { - if(r->log) - log_rpz_apply(z->name, - r->action_override, - qinfo, repinfo, r->log_name); - /* TODO only register stats when stats_extended? - * */ - stats->rpz_action[r->action_override]++; + if(r->disabled) { + lock_rw_unlock(&a->lock); + continue; + } + if(r->taglist && !taglist_intersect(r->taglist, + r->taglistlen, taglist, taglen)) { + lock_rw_unlock(&a->lock); + continue; + } + z = rpz_find_zone(r->local_zones, qinfo->qname, qinfo->qname_len, + qinfo->qclass, 0, 0, 0); + node = rpz_ipbased_trigger_lookup(r->client_set, &repinfo->addr, repinfo->addrlen, "clientip"); + if((z || node) && r->action_override == RPZ_DISABLED_ACTION) { + if(r->log) + log_rpz_apply((node?"clientip":"qname"), + (z?z->name:NULL), + (node?&node->node:NULL), + r->action_override, + qinfo, repinfo, NULL, r->log_name); + stats->rpz_action[r->action_override]++; + if(z != NULL) { lock_rw_unlock(&z->lock); z = NULL; } - if(z) - break; + if(node != NULL) { + lock_rw_unlock(&node->lock); + node = NULL; + } + } + if(z || node) { + break; } - lock_rw_unlock(&a->lock); /* not found in this auth_zone */ + /* not found in this auth_zone */ + lock_rw_unlock(&a->lock); } + lock_rw_unlock(&az->rpz_lock); - if(!z) - return 0; /* not holding auth_zone.lock anymore */ - log_assert(r); - if(r->action_override == RPZ_NO_OVERRIDE_ACTION) - lzt = z->type; - else - lzt = rpz_action_to_localzone_type(r->action_override); + *r_out = r; + *a_out = a; + *z_out = z; + + return node; +} + +static inline int +rpz_is_udp_query(struct comm_reply* repinfo) { + return repinfo != NULL + ? (repinfo->c != NULL + ? repinfo->c->type == comm_udp + : 0) + : 0; +} + +/** encode answer consisting of 1 rrset */ +static int +rpz_local_encode(struct module_env* env, struct query_info* qinfo, + struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, + struct regional* temp, struct ub_packed_rrset_key* rrset, int ansec, + int rcode, struct ub_packed_rrset_key* soa_rrset) +{ + struct reply_info rep; + uint16_t udpsize; + struct ub_packed_rrset_key* rrsetlist[3]; + + memset(&rep, 0, sizeof(rep)); + rep.flags = (uint16_t)((BIT_QR | BIT_AA | BIT_RA) | rcode); + rep.qdcount = 1; + rep.rrset_count = ansec; + rep.rrsets = rrsetlist; + if(ansec > 0) { + rep.an_numrrsets = 1; + rep.rrsets[0] = rrset; + rep.ttl = ((struct packed_rrset_data*)rrset->entry.data)->rr_ttl[0]; + } + if(soa_rrset != NULL) { + rep.ar_numrrsets = 1; + rep.rrsets[rep.rrset_count] = soa_rrset; + rep.rrset_count ++; + if(rep.ttl < ((struct packed_rrset_data*)soa_rrset->entry.data)->rr_ttl[0]) { + rep.ttl = ((struct packed_rrset_data*)soa_rrset->entry.data)->rr_ttl[0]; + } + } + + udpsize = edns->udp_size; + edns->edns_version = EDNS_ADVERTISED_VERSION; + edns->udp_size = EDNS_ADVERTISED_SIZE; + edns->ext_rcode = 0; + edns->bits &= EDNS_DO; + if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns, + repinfo, temp, env->now_tv) || + !reply_info_answer_encode(qinfo, &rep, + *(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2), + buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) { + error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo, + *(uint16_t*)sldns_buffer_begin(buf), + sldns_buffer_read_u16_at(buf, 2), edns); + } + + return 1; +} + +static struct local_rrset* +rpz_find_synthesized_rrset(int qtype, struct clientip_synthesized_rr* data) { + struct local_rrset* cursor = data->data; + while( cursor != NULL) { + struct packed_rrset_key* packed_rrset = &cursor->rrset->rk; + if(htons(qtype) == packed_rrset->type) { + return cursor; + } + cursor = cursor->next; + } + return NULL; +} +/** allocate SOA record ubrrsetkey in region */ +static struct ub_packed_rrset_key* +make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa, + struct regional* temp) +{ + struct ub_packed_rrset_key csoa; + if(!soa) + return NULL; + memset(&csoa, 0, sizeof(csoa)); + csoa.entry.key = &csoa; + csoa.rk.rrset_class = htons(LDNS_RR_CLASS_IN); + csoa.rk.type = htons(LDNS_RR_TYPE_SOA); + csoa.rk.flags |= PACKED_RRSET_FIXEDTTL + | PACKED_RRSET_RPZ; + csoa.rk.dname = auth_zone->name; + csoa.rk.dname_len = auth_zone->namelen; + csoa.entry.hash = rrset_key_hash(&csoa.rk); + csoa.entry.data = soa->data; + return respip_copy_rrset(&csoa, temp); +} + +static void +rpz_apply_clientip_localdata_action(struct clientip_synthesized_rr* raddr, + struct module_env* env, struct query_info* qinfo, + struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf, + struct regional* temp, struct auth_zone* auth_zone) +{ + struct local_rrset* rrset; + enum rpz_action action = RPZ_INVALID_ACTION; + struct ub_packed_rrset_key* rp = NULL; + struct ub_packed_rrset_key* rsoa = NULL; + int rcode = LDNS_RCODE_NOERROR|BIT_AA; + int rrset_count = 1; + + /* prepare synthesized answer for client */ + action = raddr->action; + if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL ) { + verbose(VERB_ALGO, "rpz: bug: local-data action but no local data"); + return; + } + + /* check query type / rr type */ + rrset = rpz_find_synthesized_rrset(qinfo->qtype, raddr); + if(rrset == NULL) { + verbose(VERB_ALGO, "rpz: unable to find local-data for query"); + rrset_count = 0; + goto nodata; + } + + rp = respip_copy_rrset(rrset->rrset, temp); + if(!rp) { + verbose(VERB_ALGO, "rpz: local data action: out of memory"); + return; + } + + rp->rk.flags |= PACKED_RRSET_FIXEDTTL | PACKED_RRSET_RPZ; + rp->rk.dname = qinfo->qname; + rp->rk.dname_len = qinfo->qname_len; + rp->entry.hash = rrset_key_hash(&rp->rk); +nodata: + if(auth_zone) { + struct auth_rrset* soa = NULL; + soa = auth_zone_get_soa_rrset(auth_zone); + if(soa) { + rsoa = make_soa_ubrrset(auth_zone, soa, temp); + if(!rsoa) { + verbose(VERB_ALGO, "rpz: local data action soa: out of memory"); + return; + } + } + } + + rpz_local_encode(env, qinfo, edns, repinfo, buf, temp, rp, + rrset_count, rcode, rsoa); +} + +/** add additional section SOA record to the reply. + * Since this gets fed into the normal iterator answer creation, it + * gets minimal-responses applied to it, that can remove the additional SOA + * again. */ +static int +rpz_add_soa(struct reply_info* rep, struct module_qstate* ms, + struct auth_zone* az) +{ + struct auth_rrset* soa = NULL; + struct ub_packed_rrset_key* rsoa = NULL; + struct ub_packed_rrset_key** prevrrsets; + if(!az) return 1; + soa = auth_zone_get_soa_rrset(az); + if(!soa) return 1; + if(!rep) return 0; + rsoa = make_soa_ubrrset(az, soa, ms->region); + if(!rsoa) return 0; + prevrrsets = rep->rrsets; + rep->rrsets = regional_alloc_zero(ms->region, + sizeof(*rep->rrsets)*(rep->rrset_count+1)); + if(!rep->rrsets) + return 0; + if(prevrrsets && rep->rrset_count > 0) + memcpy(rep->rrsets, prevrrsets, rep->rrset_count*sizeof(*rep->rrsets)); + rep->rrset_count++; + rep->ar_numrrsets++; + rep->rrsets[rep->rrset_count-1] = rsoa; + return 1; +} + +static inline struct dns_msg* +rpz_dns_msg_new(struct regional* region) +{ + struct dns_msg* msg = + (struct dns_msg*)regional_alloc(region, + sizeof(struct dns_msg)); + if(msg == NULL) { return NULL; } + memset(msg, 0, sizeof(struct dns_msg)); + + return msg; +} + +static inline struct dns_msg* +rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms, + struct query_info* qinfo, struct auth_zone* az) +{ + struct dns_msg* msg = rpz_dns_msg_new(ms->region); + if(msg == NULL) { return msg; } + msg->qinfo = *qinfo; + msg->rep = construct_reply_info_base(ms->region, + LDNS_RCODE_NOERROR | BIT_QR | BIT_AA | BIT_RA, + 1, /* qd */ + 0, /* ttl */ + 0, /* prettl */ + 0, /* expttl */ + 0, /* an */ + 0, /* ns */ + 0, /* ar */ + 0, /* total */ + sec_status_insecure); + if(msg->rep) + msg->rep->authoritative = 1; + if(!rpz_add_soa(msg->rep, ms, az)) + return NULL; + return msg; +} + +static inline struct dns_msg* +rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms, + struct query_info* qinfo, struct auth_zone* az) +{ + struct dns_msg* msg = rpz_dns_msg_new(ms->region); + uint16_t flags; + if(msg == NULL) { return msg; } + msg->qinfo = *qinfo; + flags = LDNS_RCODE_NXDOMAIN | BIT_QR | BIT_AA | BIT_RA; + if(r->signal_nxdomain_ra) + flags &= ~BIT_RA; + msg->rep = construct_reply_info_base(ms->region, + flags, + 1, /* qd */ + 0, /* ttl */ + 0, /* prettl */ + 0, /* expttl */ + 0, /* an */ + 0, /* ns */ + 0, /* ar */ + 0, /* total */ + sec_status_insecure); + if(msg->rep) + msg->rep->authoritative = 1; + if(!rpz_add_soa(msg->rep, ms, az)) + return NULL; + return msg; +} + +static inline struct dns_msg* +rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms, + struct query_info* qi, struct local_rrset* rrset, struct auth_zone* az) +{ + struct dns_msg* msg = NULL; + struct reply_info* new_reply_info; + struct ub_packed_rrset_key* rp; + + + msg = rpz_dns_msg_new(ms->region); + if(msg == NULL) { return NULL; } + + new_reply_info = construct_reply_info_base(ms->region, + LDNS_RCODE_NOERROR | BIT_QR | BIT_AA | BIT_RA, + 1, /* qd */ + 0, /* ttl */ + 0, /* prettl */ + 0, /* expttl */ + 1, /* an */ + 0, /* ns */ + 0, /* ar */ + 1, /* total */ + sec_status_insecure); + if(new_reply_info == NULL) { + log_err("out of memory"); + return NULL; + } + new_reply_info->authoritative = 1; + rp = respip_copy_rrset(rrset->rrset, ms->region); + if(rp == NULL) { + log_err("out of memory"); + return NULL; + } + rp->rk.dname = qi->qname; + rp->rk.dname_len = qi->qname_len; + /* this rrset is from the rpz data, or synthesized. + * It is not actually from the network, so we flag it with this + * flags as a fake RRset. If later the cache is used to look up + * rrsets, then the fake ones are not returned (if you look without + * the flag). For like CNAME lookups from the iterator or A, AAAA + * lookups for nameserver targets, it would use the without flag + * actual data. So that the actual network data and fake data + * are kept track of separately. */ + rp->rk.flags |= PACKED_RRSET_RPZ; + new_reply_info->rrsets[0] = rp; + msg->rep = new_reply_info; + if(!rpz_add_soa(msg->rep, ms, az)) + return NULL; + return msg; +} + +static inline struct dns_msg* +rpz_synthesize_nsip_localdata(struct rpz* r, struct module_qstate* ms, + struct clientip_synthesized_rr* data, struct auth_zone* az) +{ + struct query_info* qi = &ms->qinfo; + struct local_rrset* rrset; + + rrset = rpz_find_synthesized_rrset(qi->qtype, data); + if(rrset == NULL) { + verbose(VERB_ALGO, "rpz: nsip: no matching local data found"); + return NULL; + } + + return rpz_synthesize_localdata_from_rrset(r, ms, &ms->qinfo, rrset, az); +} + +/* copy'n'paste from localzone.c */ +static struct local_rrset* +local_data_find_type(struct local_data* data, uint16_t type, int alias_ok) +{ + struct local_rrset* p; + type = htons(type); + for(p = data->rrsets; p; p = p->next) { + if(p->rrset->rk.type == type) + return p; + if(alias_ok && p->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME)) + return p; + } + return NULL; +} + +/* based on localzone.c:local_data_answer() */ +static inline struct dns_msg* +rpz_synthesize_nsdname_localdata(struct rpz* r, struct module_qstate* ms, + struct local_zone* z, struct matched_delegation_point const* match, + struct auth_zone* az) +{ + struct local_data key; + struct local_data* ld; + struct local_rrset* rrset; + + if(match->dname == NULL) { return NULL; } + + key.node.key = &key; + key.name = match->dname; + key.namelen = match->dname_len; + key.namelabs = dname_count_labels(match->dname); + + rpz_log_dname("nsdname local data", key.name, key.namelen); + + ld = (struct local_data*)rbtree_search(&z->data, &key.node); + if(ld == NULL) { + verbose(VERB_ALGO, "rpz: nsdname: impossible: qname not found"); + return NULL; + } + + rrset = local_data_find_type(ld, ms->qinfo.qtype, 1); + if(rrset == NULL) { + verbose(VERB_ALGO, "rpz: nsdname: no matching local data found"); + return NULL; + } + + return rpz_synthesize_localdata_from_rrset(r, ms, &ms->qinfo, rrset, az); +} + +/* like local_data_answer for qname triggers after a cname */ +static struct dns_msg* +rpz_synthesize_qname_localdata_msg(struct rpz* r, struct module_qstate* ms, + struct query_info* qinfo, struct local_zone* z, struct auth_zone* az) +{ + struct local_data key; + struct local_data* ld; + struct local_rrset* rrset; + key.node.key = &key; + key.name = qinfo->qname; + key.namelen = qinfo->qname_len; + key.namelabs = dname_count_labels(qinfo->qname); + ld = (struct local_data*)rbtree_search(&z->data, &key.node); + if(ld == NULL) { + verbose(VERB_ALGO, "rpz: qname after cname: name not found"); + return NULL; + } + rrset = local_data_find_type(ld, qinfo->qtype, 1); + if(rrset == NULL) { + verbose(VERB_ALGO, "rpz: qname after cname: type not found"); + return NULL; + } + return rpz_synthesize_localdata_from_rrset(r, ms, qinfo, rrset, az); +} + +static int +rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r, + struct local_zone* z, enum localzone_type lzt, struct query_info* qinfo, + struct edns_data* edns, sldns_buffer* buf, struct regional* temp, + struct comm_reply* repinfo, struct ub_server_stats* stats) +{ + struct local_data* ld = NULL; + int ret = 0; if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) { - qinfo->local_alias = - regional_alloc_zero(temp, sizeof(struct local_rrset)); - if(!qinfo->local_alias) { - lock_rw_unlock(&z->lock); - lock_rw_unlock(&a->lock); + qinfo->local_alias = regional_alloc_zero(temp, sizeof(struct local_rrset)); + if(qinfo->local_alias == NULL) { return 0; /* out of memory */ } - qinfo->local_alias->rrset = - regional_alloc_init(temp, r->cname_override, - sizeof(*r->cname_override)); - if(!qinfo->local_alias->rrset) { - lock_rw_unlock(&z->lock); - lock_rw_unlock(&a->lock); + qinfo->local_alias->rrset = regional_alloc_init(temp, r->cname_override, + sizeof(*r->cname_override)); + if(qinfo->local_alias->rrset == NULL) { return 0; /* out of memory */ } qinfo->local_alias->rrset->rk.dname = qinfo->qname; qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len; - if(r->log) - log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION, - qinfo, repinfo, r->log_name); + if(r->log) { + log_rpz_apply("qname", z->name, NULL, RPZ_CNAME_OVERRIDE_ACTION, + qinfo, repinfo, NULL, r->log_name); + } stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++; - lock_rw_unlock(&z->lock); - lock_rw_unlock(&a->lock); return 0; } if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo, edns, repinfo, buf, temp, dname_count_labels(qinfo->qname), &ld, lzt, -1, NULL, 0, NULL, 0)) { - if(r->log) - log_rpz_apply(z->name, + if(r->log) { + log_rpz_apply("qname", z->name, NULL, localzone_type_to_rpz_action(lzt), qinfo, - repinfo, r->log_name); + repinfo, NULL, r->log_name); + } stats->rpz_action[localzone_type_to_rpz_action(lzt)]++; - lock_rw_unlock(&z->lock); - lock_rw_unlock(&a->lock); return !qinfo->local_alias; } ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, 0 /* no local data used */, lzt); - if(r->log) - log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt), - qinfo, repinfo, r->log_name); + if(r->signal_nxdomain_ra && LDNS_RCODE_WIRE(sldns_buffer_begin(buf)) + == LDNS_RCODE_NXDOMAIN) + LDNS_RA_CLR(sldns_buffer_begin(buf)); + if(r->log) { + log_rpz_apply("qname", z->name, NULL, localzone_type_to_rpz_action(lzt), + qinfo, repinfo, NULL, r->log_name); + } stats->rpz_action[localzone_type_to_rpz_action(lzt)]++; + return ret; +} + +static struct clientip_synthesized_rr* +rpz_delegation_point_ipbased_trigger_lookup(struct rpz* rpz, struct iter_qstate* is) +{ + struct delegpt_addr* cursor; + struct clientip_synthesized_rr* action = NULL; + if(is->dp == NULL) { return NULL; } + for(cursor = is->dp->target_list; + cursor != NULL; + cursor = cursor->next_target) { + if(cursor->bogus) { continue; } + action = rpz_ipbased_trigger_lookup(rpz->ns_set, &cursor->addr, + cursor->addrlen, "nsip"); + if(action != NULL) { return action; } + } + return NULL; +} + +static struct dns_msg* +rpz_apply_nsip_trigger(struct module_qstate* ms, struct rpz* r, + struct clientip_synthesized_rr* raddr, struct auth_zone* az) +{ + enum rpz_action action = raddr->action; + struct dns_msg* ret = NULL; + + if(r->action_override != RPZ_NO_OVERRIDE_ACTION) { + verbose(VERB_ALGO, "rpz: using override action=%s (replaces=%s)", + rpz_action_to_string(r->action_override), rpz_action_to_string(action)); + action = r->action_override; + } + + if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL) { + verbose(VERB_ALGO, "rpz: bug: nsip local data action but no local data"); + ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); + goto done; + } + + switch(action) { + case RPZ_NXDOMAIN_ACTION: + ret = rpz_synthesize_nxdomain(r, ms, &ms->qinfo, az); + break; + case RPZ_NODATA_ACTION: + ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); + break; + case RPZ_TCP_ONLY_ACTION: + /* basically a passthru here but the tcp-only will be + * honored before the query gets sent. */ + ms->respip_action_info->action = respip_truncate; + ret = NULL; + break; + case RPZ_DROP_ACTION: + ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); + ms->is_drop = 1; + break; + case RPZ_LOCAL_DATA_ACTION: + ret = rpz_synthesize_nsip_localdata(r, ms, raddr, az); + if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); } + break; + case RPZ_PASSTHRU_ACTION: + ret = NULL; + break; + default: + verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'", + rpz_action_to_string(action)); + ret = NULL; + } + +done: + if(r->log) + log_rpz_apply("nsip", NULL, &raddr->node, + action, &ms->qinfo, NULL, ms, r->log_name); + if(ms->env->worker) + ms->env->worker->stats.rpz_action[action]++; + lock_rw_unlock(&raddr->lock); + return ret; +} + +static struct dns_msg* +rpz_apply_nsdname_trigger(struct module_qstate* ms, struct rpz* r, + struct local_zone* z, struct matched_delegation_point const* match, + struct auth_zone* az) +{ + struct dns_msg* ret = NULL; + enum rpz_action action = localzone_type_to_rpz_action(z->type); + + if(r->action_override != RPZ_NO_OVERRIDE_ACTION) { + verbose(VERB_ALGO, "rpz: using override action=%s (replaces=%s)", + rpz_action_to_string(r->action_override), rpz_action_to_string(action)); + action = r->action_override; + } + + switch(action) { + case RPZ_NXDOMAIN_ACTION: + ret = rpz_synthesize_nxdomain(r, ms, &ms->qinfo, az); + break; + case RPZ_NODATA_ACTION: + ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); + break; + case RPZ_TCP_ONLY_ACTION: + /* basically a passthru here but the tcp-only will be + * honored before the query gets sent. */ + ms->respip_action_info->action = respip_truncate; + ret = NULL; + break; + case RPZ_DROP_ACTION: + ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); + ms->is_drop = 1; + break; + case RPZ_LOCAL_DATA_ACTION: + ret = rpz_synthesize_nsdname_localdata(r, ms, z, match, az); + if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &ms->qinfo, az); } + break; + case RPZ_PASSTHRU_ACTION: + ret = NULL; + break; + default: + verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'", + rpz_action_to_string(action)); + ret = NULL; + } + + if(r->log) + log_rpz_apply("nsdname", match->dname, NULL, + action, &ms->qinfo, NULL, ms, r->log_name); + if(ms->env->worker) + ms->env->worker->stats.rpz_action[action]++; + lock_rw_unlock(&z->lock); + return ret; +} + +static struct local_zone* +rpz_delegation_point_zone_lookup(struct delegpt* dp, struct local_zones* zones, + uint16_t qclass, + /* output parameter */ + struct matched_delegation_point* match) +{ + struct delegpt_ns* nameserver; + struct local_zone* z = NULL; + + /* the rpz specs match the nameserver names (NS records), not the + * name of the delegation point itself, to the nsdname triggers */ + for(nameserver = dp->nslist; + nameserver != NULL; + nameserver = nameserver->next) { + z = rpz_find_zone(zones, nameserver->name, nameserver->namelen, + qclass, 0, 0, 0); + if(z != NULL) { + match->dname = nameserver->name; + match->dname_len = nameserver->namelen; + if(verbosity >= VERB_ALGO) { + char nm[255+1], zn[255+1]; + dname_str(match->dname, nm); + dname_str(z->name, zn); + if(strcmp(nm, zn) != 0) + verbose(VERB_ALGO, "rpz: trigger nsdname %s on %s action=%s", + zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(z->type))); + else + verbose(VERB_ALGO, "rpz: trigger nsdname %s action=%s", + nm, rpz_action_to_string(localzone_type_to_rpz_action(z->type))); + } + break; + } + } + + return z; +} + +struct dns_msg* +rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate* is) +{ + struct auth_zones* az; + struct auth_zone* a; + struct clientip_synthesized_rr* raddr = NULL; + struct rpz* r = NULL; + struct local_zone* z = NULL; + struct matched_delegation_point match = {0}; + + if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; } + + az = ms->env->auth_zones; + + verbose(VERB_ALGO, "rpz: iterator module callback: have_rpz=%d", az->rpz_first != NULL); + + lock_rw_rdlock(&az->rpz_lock); + + /* precedence of RPZ works, loosely, like this: + * CNAMEs in order of the CNAME chain. rpzs in the order they are + * configured. In an RPZ: first client-IP addr, then QNAME, then + * response IP, then NSDNAME, then NSIP. Longest match first. Smallest + * one from a set. */ + /* we use the precedence rules for the topics and triggers that + * are pertinent at this stage of the resolve processing */ + for(a = az->rpz_first; a != NULL; a = a->rpz_az_next) { + lock_rw_rdlock(&a->lock); + r = a->rpz; + if(r->disabled) { + lock_rw_unlock(&a->lock); + continue; + } + + /* the nsdname has precedence over the nsip triggers */ + z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones, + ms->qinfo.qclass, &match); + if(z != NULL) { + lock_rw_unlock(&a->lock); + break; + } + + raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is); + if(raddr != NULL) { + lock_rw_unlock(&a->lock); + break; + } + lock_rw_unlock(&a->lock); + } + + lock_rw_unlock(&az->rpz_lock); + + if(raddr == NULL && z == NULL) { return NULL; } + else if(raddr != NULL) { + if(z) { + lock_rw_unlock(&z->lock); + } + return rpz_apply_nsip_trigger(ms, r, raddr, a); + } else if(z != NULL) { + if(raddr) { + lock_rw_unlock(&raddr->lock); + } + return rpz_apply_nsdname_trigger(ms, r, z, &match, a); + } else { return NULL; } +} + +struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms, + struct iter_qstate* is) +{ + struct auth_zones* az; + struct auth_zone* a = NULL; + struct rpz* r = NULL; + struct local_zone* z = NULL; + enum localzone_type lzt; + struct dns_msg* ret = NULL; + + if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; } + az = ms->env->auth_zones; + + lock_rw_rdlock(&az->rpz_lock); + + for(a = az->rpz_first; a; a = a->rpz_az_next) { + lock_rw_rdlock(&a->lock); + r = a->rpz; + if(r->disabled) { + lock_rw_unlock(&a->lock); + continue; + } + z = rpz_find_zone(r->local_zones, is->qchase.qname, + is->qchase.qname_len, is->qchase.qclass, 0, 0, 0); + if(z && r->action_override == RPZ_DISABLED_ACTION) { + if(r->log) + log_rpz_apply("qname", z->name, NULL, + r->action_override, + &ms->qinfo, NULL, ms, r->log_name); + if(ms->env->worker) + ms->env->worker->stats.rpz_action[r->action_override]++; + lock_rw_unlock(&z->lock); + z = NULL; + } + if(z) { + break; + } + /* not found in this auth_zone */ + lock_rw_unlock(&a->lock); + } + lock_rw_unlock(&az->rpz_lock); + + if(z == NULL) + return NULL; + if(r->action_override == RPZ_NO_OVERRIDE_ACTION) { + lzt = z->type; + } else { + lzt = rpz_action_to_localzone_type(r->action_override); + } + + if(verbosity >= VERB_ALGO) { + char nm[255+1], zn[255+1]; + dname_str(is->qchase.qname, nm); + dname_str(z->name, zn); + if(strcmp(zn, nm) != 0) + verbose(VERB_ALGO, "rpz: qname trigger after cname %s on %s, with action=%s", + zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt))); + else + verbose(VERB_ALGO, "rpz: qname trigger after cname %s, with action=%s", + nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt))); + } + switch(localzone_type_to_rpz_action(lzt)) { + case RPZ_NXDOMAIN_ACTION: + ret = rpz_synthesize_nxdomain(r, ms, &is->qchase, a); + break; + case RPZ_NODATA_ACTION: + ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); + break; + case RPZ_TCP_ONLY_ACTION: + /* basically a passthru here but the tcp-only will be + * honored before the query gets sent. */ + ms->respip_action_info->action = respip_truncate; + ret = NULL; + break; + case RPZ_DROP_ACTION: + ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); + ms->is_drop = 1; + break; + case RPZ_LOCAL_DATA_ACTION: + ret = rpz_synthesize_qname_localdata_msg(r, ms, &is->qchase, z, a); + if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); } + break; + case RPZ_PASSTHRU_ACTION: + ret = NULL; + break; + default: + verbose(VERB_ALGO, "rpz: qname trigger after cname: bug: unhandled or invalid action: '%s'", + rpz_action_to_string(localzone_type_to_rpz_action(lzt))); + ret = NULL; + } + lock_rw_unlock(&z->lock); + lock_rw_unlock(&a->lock); + return ret; +} + +static int +rpz_apply_maybe_clientip_trigger(struct auth_zones* az, struct module_env* env, + struct query_info* qinfo, struct edns_data* edns, struct comm_reply* repinfo, + uint8_t* taglist, size_t taglen, struct ub_server_stats* stats, + sldns_buffer* buf, struct regional* temp, + /* output parameters */ + struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out) +{ + int ret = 0; + enum rpz_action client_action; + struct clientip_synthesized_rr* node = rpz_resolve_client_action_and_zone( + az, qinfo, repinfo, taglist, taglen, stats, z_out, a_out, r_out); + + client_action = ((node == NULL) ? RPZ_INVALID_ACTION : node->action); + + if(*z_out == NULL || (client_action != RPZ_INVALID_ACTION && + client_action != RPZ_PASSTHRU_ACTION)) { + if(client_action == RPZ_PASSTHRU_ACTION + || client_action == RPZ_INVALID_ACTION + || (client_action == RPZ_TCP_ONLY_ACTION + && !rpz_is_udp_query(repinfo))) { + ret = 0; + goto done; + } + stats->rpz_action[client_action]++; + if(client_action == RPZ_LOCAL_DATA_ACTION) { + rpz_apply_clientip_localdata_action(node, env, qinfo, + edns, repinfo, buf, temp, *a_out); + } else { + if(*r_out && (*r_out)->log) + log_rpz_apply( + (node?"clientip":"qname"), + ((*z_out)?(*z_out)->name:NULL), + (node?&node->node:NULL), + client_action, qinfo, repinfo, NULL, + (*r_out)->log_name); + local_zones_zone_answer(*z_out /*likely NULL, no zone*/, env, qinfo, edns, + repinfo, buf, temp, 0 /* no local data used */, + rpz_action_to_localzone_type(client_action)); + if(*r_out && (*r_out)->signal_nxdomain_ra && + LDNS_RCODE_WIRE(sldns_buffer_begin(buf)) + == LDNS_RCODE_NXDOMAIN) + LDNS_RA_CLR(sldns_buffer_begin(buf)); + } + ret = 1; + goto done; + } + ret = -1; +done: + if(node != NULL) { + lock_rw_unlock(&node->lock); + } + return ret; +} + +int +rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env, + struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, + struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist, + size_t taglen, struct ub_server_stats* stats) +{ + struct rpz* r = NULL; + struct auth_zone* a = NULL; + struct local_zone* z = NULL; + int ret; + enum localzone_type lzt; + + int clientip_trigger = rpz_apply_maybe_clientip_trigger(az, env, qinfo, + edns, repinfo, taglist, taglen, stats, buf, temp, &z, &a, &r); + if(clientip_trigger >= 0) { + if(a) { + lock_rw_unlock(&a->lock); + } + if(z) { + lock_rw_unlock(&z->lock); + } + return clientip_trigger; + } + + if(z == NULL) { + if(a) { + lock_rw_unlock(&a->lock); + } + return 0; + } + + log_assert(r); + + if(r->action_override == RPZ_NO_OVERRIDE_ACTION) { + lzt = z->type; + } else { + lzt = rpz_action_to_localzone_type(r->action_override); + } + + if(verbosity >= VERB_ALGO) { + char nm[255+1], zn[255+1]; + dname_str(qinfo->qname, nm); + dname_str(z->name, zn); + if(strcmp(zn, nm) != 0) + verbose(VERB_ALGO, "rpz: qname trigger %s on %s with action=%s", + zn, nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt))); + else + verbose(VERB_ALGO, "rpz: qname trigger %s with action=%s", + nm, rpz_action_to_string(localzone_type_to_rpz_action(lzt))); + } + + ret = rpz_synthesize_qname_localdata(env, r, z, lzt, qinfo, edns, buf, temp, + repinfo, stats); + lock_rw_unlock(&z->lock); lock_rw_unlock(&a->lock); diff --git a/sbin/unwind/libunbound/services/rpz.h b/sbin/unwind/libunbound/services/rpz.h index d5996a6cfa2..c29d30dff50 100644 --- a/sbin/unwind/libunbound/services/rpz.h +++ b/sbin/unwind/libunbound/services/rpz.h @@ -50,6 +50,7 @@ #include "sldns/sbuffer.h" #include "daemon/stats.h" #include "respip/respip.h" +struct iter_qstate; /** * RPZ triggers, only the QNAME trigger is currently supported in Unbound. @@ -83,6 +84,27 @@ enum rpz_action { RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ }; +struct clientip_synthesized_rrset{ + struct regional* region; + struct rbtree_type entries; + lock_rw_type lock; /* lock on the respip tree */ +}; + +struct clientip_synthesized_rr { + /** node in address tree */ + struct addr_tree_node node; + /** lock on the node item */ + lock_rw_type lock; + /** tag bitlist */ + uint8_t* taglist; + /** length of the taglist (in bytes) */ + size_t taglen; + /** action for this address span */ + enum rpz_action action; + /** "local data" for this node */ + struct local_rrset* data; +}; + /** * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a * linked list to keep configuration order. Iterating or changing the linked @@ -92,12 +114,17 @@ enum rpz_action { struct rpz { struct local_zones* local_zones; struct respip_set* respip_set; + struct clientip_synthesized_rrset* client_set; + struct clientip_synthesized_rrset* ns_set; + struct local_zones* nsdname_zones; uint8_t* taglist; size_t taglistlen; enum rpz_action action_override; struct ub_packed_rrset_key* cname_override; int log; char* log_name; + /** signal NXDOMAIN blocked with unset RA flag */ + int signal_nxdomain_ra; struct regional* region; int disabled; }; @@ -147,15 +174,38 @@ void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, * @param temp: scratchpad * @param repinfo: reply info * @param taglist: taglist to lookup. - * @param taglen: lenth of taglist. + * @param taglen: length of taglist. * @param stats: worker stats struct * @return: 1 if client answer is ready, 0 to continue resolving */ -int rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env, +int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env, struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist, size_t taglen, struct ub_server_stats* stats); +/** + * Callback to process when the iterator module is about to send queries. + * Checks for nsip and nsdname triggers. + * @param qstate: the query state. + * @param iq: iterator module query state. + * @return NULL if nothing is done. Or a new message with the contents from + * the rpz, based on the delegation point. It is allocated in the + * qstate region. + */ +struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate, + struct iter_qstate* iq); + +/** + * Callback to process when the iterator module has followed a cname. + * There can be a qname trigger for the new query name. + * @param qstate: the query state. + * @param iq: iterator module query state. + * @return NULL if nothing is done. Or a new message with the contents from + * the rpz, based on the iq.qchase. It is allocated in the qstate region. + */ +struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate, + struct iter_qstate* iq); + /** * Delete RPZ * @param r: RPZ struct to delete @@ -186,7 +236,7 @@ enum rpz_action respip_action_to_rpz_action(enum respip_action a); /** - * Prepare RPZ after procesing feed content. + * Prepare RPZ after processing feed content. * @param r: RPZ to use */ void rpz_finish_config(struct rpz* r); diff --git a/sbin/unwind/libunbound/sldns/keyraw.c b/sbin/unwind/libunbound/sldns/keyraw.c index a40f1e8601a..befe1f72242 100644 --- a/sbin/unwind/libunbound/sldns/keyraw.c +++ b/sbin/unwind/libunbound/sldns/keyraw.c @@ -250,7 +250,8 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len) if(!(dsa = DSA_new())) { return NULL; } -#if OPENSSL_VERSION_NUMBER < 0x10100000 +#if OPENSSL_VERSION_NUMBER < 0x10100000 || \ + (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f) #ifndef S_SPLINT_S dsa->p = P; dsa->q = Q; @@ -428,7 +429,8 @@ sldns_key_buf2rsa_raw(unsigned char* key, size_t len) BN_free(modulus); return NULL; } -#if OPENSSL_VERSION_NUMBER < 0x10100000 +#if OPENSSL_VERSION_NUMBER < 0x10100000 || \ + (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f) #ifndef S_SPLINT_S rsa->n = modulus; rsa->e = exponent; diff --git a/sbin/unwind/libunbound/sldns/parseutil.h b/sbin/unwind/libunbound/sldns/parseutil.h index 74d7c727571..208fd2fbca8 100644 --- a/sbin/unwind/libunbound/sldns/parseutil.h +++ b/sbin/unwind/libunbound/sldns/parseutil.h @@ -58,7 +58,7 @@ time_t sldns_mktime_from_utc(const struct tm *tm); * The function interprets time as the number of seconds since epoch * with respect to now using serial arithmetics (rfc1982). * That number of seconds is then converted to broken-out time information. - * This is especially usefull when converting the inception and expiration + * This is especially useful when converting the inception and expiration * fields of RRSIG records. * * \param[in] time number of seconds since epoch (midnight, January 1st, 1970) diff --git a/sbin/unwind/libunbound/sldns/str2wire.c b/sbin/unwind/libunbound/sldns/str2wire.c index 293abf79a62..d2cefae1c09 100644 --- a/sbin/unwind/libunbound/sldns/str2wire.c +++ b/sbin/unwind/libunbound/sldns/str2wire.c @@ -25,8 +25,10 @@ #include #endif +/** bits for the offset */ +#define RET_OFFSET_MASK (((unsigned)(~LDNS_WIREPARSE_MASK))>>LDNS_WIREPARSE_SHIFT) /** return an error */ -#define RET_ERR(e, off) ((int)((e)|((off)< 0 && !*quoted && - *(sldns_buffer_current(strbuf)) == ' ') { + (*(sldns_buffer_current(strbuf)) == ' ' || + *(sldns_buffer_current(strbuf)) == '\t')) { sldns_buffer_skip(strbuf, 1); } @@ -601,7 +604,10 @@ sldns_affix_token(sldns_buffer* strbuf, char* token, size_t* token_len, size_t addstrlen = 0; /* add space */ - if(addlen < 1) return 0; + /* when addlen < 2, the token buffer is full considering the NULL byte + * from strlen and will lead to buffer overflow with the second + * assignement below. */ + if(addlen < 2) return 0; token[*token_strlen] = ' '; token[++(*token_strlen)] = 0; @@ -1427,7 +1433,7 @@ sldns_str2wire_svcbparam_parse_next_unescaped_comma(const char *val) } /* The source is already properly unescaped, this double unescaping is purely to allow for - * comma's in comma seperated alpn lists. + * comma's in comma separated alpn lists. * * In draft-ietf-dnsop-svcb-https-06 Section 7: * To enable simpler parsing, this SvcParamValue MUST NOT contain escape sequences. diff --git a/sbin/unwind/libunbound/sldns/str2wire.h b/sbin/unwind/libunbound/sldns/str2wire.h index 0c316498956..baee4236fe5 100644 --- a/sbin/unwind/libunbound/sldns/str2wire.h +++ b/sbin/unwind/libunbound/sldns/str2wire.h @@ -187,7 +187,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len); #define LDNS_WIREPARSE_MASK 0x0fff #define LDNS_WIREPARSE_SHIFT 12 #define LDNS_WIREPARSE_ERROR(e) ((e)&LDNS_WIREPARSE_MASK) -#define LDNS_WIREPARSE_OFFSET(e) (((e)&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT) +#define LDNS_WIREPARSE_OFFSET(e) ((((unsigned)(e))&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT) /* use lookuptable to get error string, sldns_wireparse_errors */ #define LDNS_WIREPARSE_ERR_OK 0 #define LDNS_WIREPARSE_ERR_GENERAL 342 diff --git a/sbin/unwind/libunbound/sldns/wire2str.c b/sbin/unwind/libunbound/sldns/wire2str.c index 6a177ec0b06..b70efe299d4 100644 --- a/sbin/unwind/libunbound/sldns/wire2str.c +++ b/sbin/unwind/libunbound/sldns/wire2str.c @@ -817,6 +817,7 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen, unsigned i, counter=0; unsigned maxcompr = MAX_COMPRESS_PTRS; /* loop detection, max compr ptrs */ int in_buf = 1; + size_t dname_len = 0; if(comprloop) { if(*comprloop != 0) maxcompr = 30; /* for like ipv6 reverse name, per label */ @@ -872,6 +873,16 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen, labellen = (uint8_t)*dlen; else if(!in_buf && pos+(size_t)labellen > pkt+pktlen) labellen = (uint8_t)(pkt + pktlen - pos); + dname_len += ((size_t)labellen)+1; + if(dname_len > LDNS_MAX_DOMAINLEN) { + /* dname_len counts the uncompressed length we have + * seen so far, and the domain name has become too + * long, prevent the loop from printing overly long + * content. */ + w += sldns_str_print(s, slen, + "ErrorDomainNameTooLong"); + return w; + } for(i=0; i<(unsigned)labellen; i++) { w += dname_char_print(s, slen, *pos++); } diff --git a/sbin/unwind/libunbound/sldns/wire2str.h b/sbin/unwind/libunbound/sldns/wire2str.h index b1ad459e378..548c66300d9 100644 --- a/sbin/unwind/libunbound/sldns/wire2str.h +++ b/sbin/unwind/libunbound/sldns/wire2str.h @@ -59,7 +59,7 @@ char* sldns_wire2str_pkt(uint8_t* data, size_t len); char* sldns_wire2str_rr(uint8_t* rr, size_t len); /** - * Conver wire dname to a string. + * Convert wire dname to a string. * @param dname: the dname in uncompressed wireformat. * @param dname_len: length of the dname. * @return string or NULL on failure. diff --git a/sbin/unwind/libunbound/util/config_file.c b/sbin/unwind/libunbound/util/config_file.c index 4725e7db68d..15a090c7989 100644 --- a/sbin/unwind/libunbound/util/config_file.c +++ b/sbin/unwind/libunbound/util/config_file.c @@ -260,7 +260,7 @@ config_create(void) cfg->val_log_level = 0; cfg->val_log_squelch = 0; cfg->val_permissive_mode = 0; - cfg->aggressive_nsec = 0; + cfg->aggressive_nsec = 1; cfg->ignore_cd = 0; cfg->serve_expired = 0; cfg->serve_expired_ttl = 0; @@ -330,6 +330,9 @@ config_create(void) cfg->ratelimit_below_domain = NULL; cfg->ip_ratelimit_factor = 10; cfg->ratelimit_factor = 10; + cfg->ip_ratelimit_backoff = 0; + cfg->ratelimit_backoff = 0; + cfg->outbound_msg_retry = 5; cfg->qname_minimisation = 1; cfg->qname_minimisation_strict = 0; cfg->shm_enable = 0; @@ -530,11 +533,17 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive) else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout) else S_YNO("ssl-upstream:", ssl_upstream) + else S_YNO("tls-upstream:", ssl_upstream) else S_STR("ssl-service-key:", ssl_service_key) + else S_STR("tls-service-key:", ssl_service_key) else S_STR("ssl-service-pem:", ssl_service_pem) + else S_STR("tls-service-pem:", ssl_service_pem) else S_NUMBER_NONZERO("ssl-port:", ssl_port) + else S_NUMBER_NONZERO("tls-port:", ssl_port) + else S_STR("ssl-cert-bundle:", tls_cert_bundle) else S_STR("tls-cert-bundle:", tls_cert_bundle) else S_YNO("tls-win-cert:", tls_win_cert) + else S_STRLIST("additional-ssl-port:", tls_additional_port) else S_STRLIST("additional-tls-port:", tls_additional_port) else S_STRLIST("tls-additional-ports:", tls_additional_port) else S_STRLIST("tls-additional-port:", tls_additional_port) @@ -752,6 +761,9 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_POW2("ratelimit-slabs:", ratelimit_slabs) else S_NUMBER_OR_ZERO("ip-ratelimit-factor:", ip_ratelimit_factor) else S_NUMBER_OR_ZERO("ratelimit-factor:", ratelimit_factor) + else S_YNO("ip-ratelimit-backoff:", ip_ratelimit_backoff) + else S_YNO("ratelimit-backoff:", ratelimit_backoff) + else S_NUMBER_NONZERO("outbound-msg-retry:", outbound_msg_retry) else S_SIZET_NONZERO("fast-server-num:", fast_server_num) else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil) else S_YNO("qname-minimisation:", qname_minimisation) @@ -1027,11 +1039,19 @@ config_get_option(struct config_file* cfg, const char* opt, else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive) else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout) else O_YNO(opt, "ssl-upstream", ssl_upstream) + else O_YNO(opt, "tls-upstream", ssl_upstream) else O_STR(opt, "ssl-service-key", ssl_service_key) + else O_STR(opt, "tls-service-key", ssl_service_key) else O_STR(opt, "ssl-service-pem", ssl_service_pem) + else O_STR(opt, "tls-service-pem", ssl_service_pem) else O_DEC(opt, "ssl-port", ssl_port) + else O_DEC(opt, "tls-port", ssl_port) + else O_STR(opt, "ssl-cert-bundle", tls_cert_bundle) else O_STR(opt, "tls-cert-bundle", tls_cert_bundle) else O_YNO(opt, "tls-win-cert", tls_win_cert) + else O_LST(opt, "additional-ssl-port", tls_additional_port) + else O_LST(opt, "additional-tls-port", tls_additional_port) + else O_LST(opt, "tls-additional-ports", tls_additional_port) else O_LST(opt, "tls-additional-port", tls_additional_port) else O_LST(opt, "tls-session-ticket-keys", tls_session_ticket_keys.first) else O_STR(opt, "tls-ciphers", tls_ciphers) @@ -1195,6 +1215,9 @@ config_get_option(struct config_file* cfg, const char* opt, else O_LS2(opt, "ratelimit-below-domain", ratelimit_below_domain) else O_DEC(opt, "ip-ratelimit-factor", ip_ratelimit_factor) else O_DEC(opt, "ratelimit-factor", ratelimit_factor) + else O_YNO(opt, "ip-ratelimit-backoff", ip_ratelimit_backoff) + else O_YNO(opt, "ratelimit-backoff", ratelimit_backoff) + else O_UNS(opt, "outbound-msg-retry", outbound_msg_retry) else O_DEC(opt, "fast-server-num", fast_server_num) else O_DEC(opt, "fast-server-permil", fast_server_permil) else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min) diff --git a/sbin/unwind/libunbound/util/config_file.h b/sbin/unwind/libunbound/util/config_file.h index aed6812dafe..c7c9a0a48e6 100644 --- a/sbin/unwind/libunbound/util/config_file.h +++ b/sbin/unwind/libunbound/util/config_file.h @@ -565,6 +565,10 @@ struct config_file { size_t ip_ratelimit_size; /** ip_ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */ int ip_ratelimit_factor; + /** ratelimit backoff, when on, if the limit is reached it is + * considered an attack and it backs off until 'demand' decreases over + * the RATE_WINDOW. */ + int ip_ratelimit_backoff; /** ratelimit for domains. 0 is off, otherwise qps (unless overridden) */ int ratelimit; @@ -578,6 +582,13 @@ struct config_file { struct config_str2list* ratelimit_below_domain; /** ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */ int ratelimit_factor; + /** ratelimit backoff, when on, if the limit is reached it is + * considered an attack and it backs off until 'demand' decreases over + * the RATE_WINDOW. */ + int ratelimit_backoff; + + /** number of retries on outgoing queries */ + int outbound_msg_retry; /** minimise outgoing QNAME and hide original QTYPE if possible */ int qname_minimisation; /** minimise QNAME in strict mode, minimise according to RFC. @@ -697,6 +708,8 @@ struct config_stub { int isprime; /** if forward-first is set (failover to without if fails) */ int isfirst; + /** use tcp for queries to this stub */ + int tcp_upstream; /** use SSL for queries to this stub */ int ssl_upstream; /*** no cache */ @@ -741,6 +754,8 @@ struct config_auth { /** Always reply with this CNAME target if the cname override action is * used */ char* rpz_cname; + /** signal nxdomain block with unset RA */ + int rpz_signal_nxdomain_ra; /** Check ZONEMD records for this zone */ int zonemd_check; /** Reject absence of ZONEMD records, zone must have one */ @@ -1106,7 +1121,7 @@ int cfg_count_numbers(const char* str); int cfg_parse_memsize(const char* str, size_t* res); /** - * Parse nsid from string into binary nsid. nsid is either a hexidecimal + * Parse nsid from string into binary nsid. nsid is either a hexadecimal * string or an ascii string prepended with ascii_ in which case the * characters after ascii_ are simply copied. * @param str: the string to parse. diff --git a/sbin/unwind/libunbound/util/configlexer.c b/sbin/unwind/libunbound/util/configlexer.c index 186860b471f..ed1712991a5 100644 --- a/sbin/unwind/libunbound/util/configlexer.c +++ b/sbin/unwind/libunbound/util/configlexer.c @@ -5,7 +5,7 @@ #define YY_INT_ALIGNED short int -/* $OpenBSD: configlexer.c,v 1.11 2021/08/14 07:32:46 florian Exp $ */ +/* $OpenBSD: configlexer.c,v 1.12 2022/03/01 18:34:22 florian Exp $ */ /* A lexical scanner generated by flex */ @@ -27,7 +27,7 @@ /* end standard C headers. */ -/* $OpenBSD: configlexer.c,v 1.11 2021/08/14 07:32:46 florian Exp $ */ +/* $OpenBSD: configlexer.c,v 1.12 2022/03/01 18:34:22 florian Exp $ */ /* flex integer type definitions */ @@ -368,8 +368,8 @@ static void yy_fatal_error (yyconst char msg[] ); *yy_cp = '\0'; \ (yy_c_buf_p) = yy_cp; -#define YY_NUM_RULES 352 -#define YY_END_OF_BUFFER 353 +#define YY_NUM_RULES 358 +#define YY_END_OF_BUFFER 359 /* This struct is not used in this scanner, but its presence is necessary. */ struct yy_trans_info @@ -377,391 +377,399 @@ struct yy_trans_info flex_int32_t yy_verify; flex_int32_t yy_nxt; }; -static yyconst flex_int16_t yy_accept[3484] = +static yyconst flex_int16_t yy_accept[3558] = { 0, - 1, 1, 326, 326, 330, 330, 334, 334, 338, 338, - 1, 1, 342, 342, 346, 346, 353, 350, 1, 324, - 324, 351, 2, 351, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 326, 327, 327, 328, - 351, 330, 331, 331, 332, 351, 337, 334, 335, 335, - 336, 351, 338, 339, 339, 340, 351, 349, 325, 2, - 329, 351, 349, 345, 342, 343, 343, 344, 351, 346, - 347, 347, 348, 351, 350, 0, 1, 2, 2, 2, - 2, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 326, - 0, 330, 0, 337, 0, 334, 338, 0, 349, 0, - 2, 2, 349, 345, 0, 342, 346, 0, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 349, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 128, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 137, - 350, 350, 350, 350, 350, 350, 350, 349, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 112, 350, 323, - 350, 350, 350, 350, 350, 350, 350, 8, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 129, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 142, 350, 350, 349, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 316, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 349, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 67, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 248, 350, 14, 15, 350, 19, 18, 350, - 350, 232, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 135, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 230, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 3, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 349, - 350, 350, 350, 350, 350, 350, 350, 310, 350, 350, - 309, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 333, 350, 350, 350, 350, 350, 350, 350, 350, 66, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 70, 350, 279, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 317, 318, - 350, 350, 350, 350, 350, 350, 350, 71, 350, 350, - 136, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 132, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 219, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 21, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 162, - 350, 350, 350, 350, 350, 349, 333, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 110, 350, - 350, 350, 350, 350, 350, 350, 287, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 188, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 161, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 109, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 35, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 36, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 68, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 134, 350, 350, 350, 349, 350, 350, 350, 350, 350, - 127, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 69, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 252, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 189, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 57, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 270, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 61, 350, 62, - - 350, 350, 350, 350, 350, 113, 350, 114, 350, 350, - 350, 350, 111, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 7, 350, 350, 350, 350, - 349, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 241, - 350, 350, 350, 350, 165, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 253, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 48, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 58, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 211, 350, 210, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 16, 17, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 72, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 218, 350, 350, 350, 350, - 350, 350, 116, 350, 115, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 202, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 143, - 350, 350, 350, 349, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 104, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 92, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 231, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 97, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 65, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 205, 206, 350, 350, 350, 281, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 6, 350, 350, 350, 350, 350, 350, 300, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 285, 350, 350, 350, - 350, 350, 350, 311, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 45, 350, 350, - 350, 350, 47, 350, 350, 350, 93, 350, 350, 350, - 350, 350, 55, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 349, 350, 198, 350, 350, 350, - 138, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 223, 350, 199, 350, 350, 350, 238, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 56, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 140, - 121, 350, 122, 350, 350, 350, 120, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 158, 350, 350, 53, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 269, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 200, 350, 350, - 350, 350, 350, 203, 350, 209, 350, 350, 350, 350, - 350, 350, 237, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 108, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 133, 350, - 350, 350, 350, 350, 350, 350, 63, 350, 350, 350, - 29, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 20, 350, 350, 350, 350, 350, 350, 30, - 39, 350, 170, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 196, 350, 350, - 349, 350, 350, 350, 350, 350, 350, 80, 82, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 289, 350, 350, 350, 350, 249, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 123, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 157, 350, 49, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 304, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 164, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 298, - - 350, 350, 350, 229, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 314, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 182, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 117, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 177, 350, 190, - 350, 350, 350, 350, 350, 350, 350, 349, 350, 146, - 350, 350, 350, 350, 350, 103, 350, 350, 350, 350, - 221, 350, 350, 350, 350, 350, 350, 239, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 261, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 139, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 181, 350, 350, 350, 350, 350, 350, 83, - 350, 84, 350, 350, 350, 350, 350, 64, 307, 350, - 350, 350, 350, 350, 91, 191, 350, 212, 350, 242, - 350, 350, 204, 282, 350, 350, 350, 350, 350, 350, - 76, 350, 193, 350, 350, 350, 350, 350, 9, 350, - 350, 350, 350, 350, 107, 350, 350, 350, 350, 274, - 350, 350, 350, 350, 220, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 349, 350, 350, 350, - 350, 180, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 166, 350, 288, 350, 350, 350, 350, 350, - 260, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 233, 350, 350, 350, 350, 350, 280, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 163, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 308, 350, 192, 350, 350, 350, 350, 350, 350, - 350, 350, 75, 77, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 106, 350, 350, 350, 350, 272, 350, - 350, 350, 350, 284, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 225, 37, 31, 33, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 38, 350, 32, 34, 350, 350, 350, 350, 350, - 350, 350, 350, 102, 350, 176, 350, 350, 350, 350, - - 350, 350, 350, 349, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 227, 224, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 74, 350, 350, 350, 141, - 350, 124, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 159, 50, 350, 350, 350, 341, 13, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 302, 350, - 305, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 12, 350, 350, 22, 350, 350, 350, 350, - 350, 278, 350, 350, 350, 350, 286, 350, 350, 350, - - 78, 350, 235, 350, 350, 350, 350, 350, 226, 350, - 350, 73, 350, 350, 350, 350, 350, 23, 350, 350, - 46, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 175, 174, 350, 350, 341, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 228, 222, 350, - 240, 350, 350, 290, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 85, 350, 350, - 350, 350, 273, 350, 350, 350, 350, 208, 350, 350, - - 350, 350, 350, 234, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 312, 313, 172, 350, 350, - 79, 350, 350, 350, 350, 183, 350, 350, 350, 118, - 119, 350, 350, 350, 25, 350, 350, 167, 350, 169, - 350, 213, 350, 350, 350, 350, 173, 350, 350, 350, - 350, 243, 350, 350, 350, 350, 350, 350, 350, 148, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 251, 350, 350, 350, 350, 350, 350, 350, - 321, 350, 27, 350, 283, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - - 89, 214, 350, 350, 271, 350, 306, 350, 207, 350, - 350, 350, 350, 350, 59, 350, 350, 350, 350, 350, - 350, 4, 350, 350, 350, 350, 131, 147, 350, 350, - 350, 187, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 246, 40, 41, 350, 350, 350, 350, 350, 350, 350, - 291, 350, 350, 350, 350, 350, 350, 350, 259, 350, - 350, 350, 350, 350, 350, 350, 350, 217, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 88, 350, 60, 277, 350, 247, 350, 350, 350, - - 350, 350, 11, 350, 350, 350, 350, 350, 350, 350, - 350, 130, 350, 350, 350, 350, 215, 94, 350, 350, - 43, 350, 350, 350, 350, 350, 350, 350, 350, 179, - 350, 350, 350, 350, 350, 350, 350, 150, 350, 350, - 350, 350, 250, 350, 350, 350, 350, 350, 258, 350, - 350, 350, 350, 144, 350, 350, 350, 125, 126, 350, - 350, 350, 96, 100, 95, 160, 350, 350, 350, 350, - 86, 350, 350, 350, 350, 350, 350, 10, 350, 350, - 350, 350, 350, 275, 315, 350, 350, 350, 350, 350, - 320, 42, 350, 350, 350, 350, 350, 178, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 101, 99, 350, 54, 350, 350, 87, - 303, 350, 350, 350, 350, 24, 350, 350, 350, 350, - 350, 201, 350, 350, 350, 350, 350, 216, 350, 350, - 350, 350, 350, 350, 350, 350, 197, 350, 350, 168, - 81, 350, 350, 350, 350, 350, 292, 350, 350, 350, - 350, 350, 350, 350, 255, 350, 350, 254, 145, 350, - 350, 98, 51, 350, 151, 152, 155, 156, 153, 154, - 90, 301, 350, 350, 276, 350, 350, 350, 26, 350, - - 171, 350, 350, 350, 350, 195, 350, 245, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 185, 184, - 44, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 299, 350, 350, 350, 350, 105, 350, - 244, 350, 268, 296, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 322, 350, 52, 5, 350, - 350, 236, 350, 350, 297, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 256, 28, 350, 350, 350, 350, - - 350, 350, 350, 350, 350, 350, 350, 350, 257, 350, - 350, 350, 149, 350, 350, 350, 350, 350, 350, 350, - 350, 186, 350, 194, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 293, 350, 350, 350, 350, 350, 350, - 350, 350, 350, 350, 350, 350, 350, 350, 350, 350, - 350, 319, 350, 350, 264, 350, 350, 350, 350, 350, - 294, 350, 350, 350, 350, 350, 350, 295, 350, 350, - 350, 262, 350, 265, 266, 350, 350, 350, 350, 350, - 263, 267, 0 + 1, 1, 332, 332, 336, 336, 340, 340, 344, 344, + 1, 1, 348, 348, 352, 352, 359, 356, 1, 330, + 330, 357, 2, 357, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 332, 333, 333, 334, + 357, 336, 337, 337, 338, 357, 343, 340, 341, 341, + 342, 357, 344, 345, 345, 346, 357, 355, 331, 2, + 335, 357, 355, 351, 348, 349, 349, 350, 357, 352, + 353, 353, 354, 357, 356, 0, 1, 2, 2, 2, + 2, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 332, + 0, 336, 0, 343, 0, 340, 344, 0, 355, 0, + 2, 2, 355, 351, 0, 348, 352, 0, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 355, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 130, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 140, 356, 356, 356, 356, 356, 356, 356, 355, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 112, 356, + 329, 356, 356, 356, 356, 356, 356, 356, 356, 8, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 131, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 145, 356, 356, 355, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 322, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 355, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 67, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 251, 356, 14, + 15, 356, 19, 18, 356, 356, 235, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 138, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 233, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 3, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 355, 356, 356, + 356, 356, 356, 356, 356, 316, 356, 356, 315, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 339, 356, + + 356, 356, 356, 356, 356, 356, 356, 66, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 70, 356, 285, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 323, 324, 356, 356, + 356, 356, 356, 356, 356, 356, 71, 356, 356, 139, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 134, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 222, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 21, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 165, 356, 356, 356, 356, 356, 355, 339, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 110, + 356, 356, 356, 356, 356, 356, 356, 293, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 191, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 164, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 109, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 35, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 36, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 68, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 137, 356, 356, 356, 355, 356, + 356, 356, 356, 356, 129, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 69, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 255, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 192, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 57, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 273, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 61, 356, 62, 356, 356, 356, + 356, 356, 113, 356, 114, 356, 356, 356, 356, 356, + 111, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 7, 356, 356, 356, 356, 355, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 244, 356, 356, + 356, 356, 168, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 256, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 48, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 58, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 214, 356, 213, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 16, 17, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 72, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 221, 356, 356, 356, + 356, 356, 356, 116, 356, 115, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 205, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 146, 356, 356, 356, 355, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 104, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 92, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 234, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 97, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 65, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 208, 209, 356, 356, 356, + + 287, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 6, 356, 356, 356, 356, 356, + 356, 356, 306, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 291, 356, 356, 356, 356, 356, 356, 356, 317, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 45, 356, 356, 356, 356, 47, + 356, 356, 356, 93, 356, 356, 356, 356, 356, 55, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 355, 356, 201, 356, 356, 356, 141, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 226, 356, + 202, 356, 356, 356, 241, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 56, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 143, 122, 356, 123, + 356, 356, 356, 356, 121, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 161, 356, 356, 53, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 272, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 203, 356, 356, 356, 356, + 356, 206, 356, 212, 356, 356, 356, 356, 356, 356, + 240, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 108, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 135, 356, + 356, 356, 356, 356, 356, 356, 356, 63, 356, 356, + 356, 29, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 20, 356, 356, 356, 356, 356, + 356, 30, 39, 356, 173, 356, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 199, + 356, 356, 355, 356, 356, 356, 356, 356, 356, 80, + 82, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 295, 356, 356, 356, 356, 252, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 124, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 160, 356, 49, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 310, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 167, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 304, 356, 356, 356, 232, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 320, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 185, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 117, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 180, 356, 193, 356, 356, + + 356, 356, 356, 356, 356, 355, 356, 149, 356, 356, + 356, 356, 356, 103, 356, 356, 356, 356, 224, 356, + 356, 356, 356, 356, 356, 242, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 264, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 142, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 184, 356, 356, 356, 356, 356, 356, 83, 356, + 84, 356, 356, 356, 356, 356, 356, 64, 313, 356, + 356, 356, 356, 356, 91, 194, 356, 215, 356, 245, + + 356, 356, 207, 288, 356, 356, 356, 356, 356, 356, + 76, 356, 196, 356, 356, 356, 356, 356, 356, 9, + 356, 356, 356, 356, 356, 107, 356, 356, 356, 356, + 356, 277, 356, 356, 356, 356, 223, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 355, 356, 356, 356, 356, 183, 356, 356, 356, 356, + + 356, 356, 356, 356, 356, 356, 169, 356, 294, 356, + 356, 356, 356, 356, 263, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 236, 356, 356, 356, + 356, 356, 286, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 166, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 314, 356, 195, + 356, 356, 356, 356, 356, 356, 356, 356, 75, 77, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 106, 356, 356, 356, 356, 356, 275, 356, 356, 356, + + 356, 290, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 228, 37, 31, 33, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 38, 356, 32, 34, 356, 356, 356, 356, 356, + 356, 356, 356, 102, 356, 179, 356, 356, 356, 356, + 356, 356, 356, 355, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 230, 227, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 74, 356, 356, 356, 144, + 356, 125, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 162, 50, 356, 356, 356, 347, 13, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 308, 356, 311, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 12, 356, 356, 22, 356, + 356, 356, 356, 356, 356, 281, 356, 356, 356, 356, + 292, 356, 356, 356, 356, 78, 356, 238, 356, 356, + 356, 356, 356, 229, 356, 356, 73, 356, 356, 356, + 356, 356, 356, 23, 356, 356, 46, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 178, + 177, 356, 356, 347, 356, 356, 356, 356, 356, 356, + + 356, 356, 356, 231, 225, 356, 243, 356, 356, 296, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 85, 356, 356, 356, 356, 356, + 276, 356, 356, 356, 356, 211, 356, 356, 356, 356, + 356, 237, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 283, 356, 356, 356, 318, 319, 175, 356, 356, + 356, 79, 356, 356, 356, 356, 186, 356, 356, 356, + 118, 120, 119, 356, 356, 356, 25, 356, 356, 170, + + 356, 172, 356, 216, 356, 356, 356, 356, 176, 356, + 356, 356, 356, 246, 356, 356, 356, 356, 356, 356, + 356, 151, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 254, 356, 356, 356, 356, 356, + 356, 356, 327, 356, 27, 356, 289, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 89, 217, 356, 356, 356, 274, 356, + 312, 356, 210, 356, 356, 356, 356, 356, 284, 59, + 356, 356, 356, 356, 356, 356, 4, 356, 356, 356, + 356, 133, 356, 150, 356, 356, 356, 190, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 249, 40, 41, 356, + 356, 356, 356, 356, 356, 356, 297, 356, 356, 356, + 356, 356, 356, 356, 262, 356, 356, 356, 356, 356, + 356, 356, 356, 220, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 88, 356, + 60, 356, 280, 356, 250, 356, 356, 356, 356, 356, + 11, 356, 356, 356, 356, 356, 356, 356, 356, 132, + 356, 356, 356, 356, 356, 218, 94, 356, 356, 43, + 356, 356, 356, 356, 356, 356, 356, 356, 182, 356, + + 356, 356, 356, 356, 356, 356, 153, 356, 356, 356, + 356, 253, 356, 356, 356, 356, 356, 261, 356, 356, + 356, 356, 147, 356, 356, 356, 126, 128, 127, 356, + 356, 356, 96, 100, 95, 163, 356, 356, 356, 356, + 86, 282, 356, 356, 356, 356, 356, 356, 10, 356, + 356, 356, 356, 356, 278, 321, 356, 356, 356, 356, + 356, 356, 326, 42, 356, 356, 356, 356, 356, 181, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 101, 99, 356, 54, 356, + + 356, 87, 309, 356, 356, 356, 356, 24, 356, 356, + 356, 356, 356, 204, 356, 356, 356, 356, 356, 356, + 219, 356, 356, 356, 356, 356, 356, 356, 356, 200, + 356, 356, 171, 81, 356, 356, 356, 356, 356, 298, + 356, 356, 356, 356, 356, 356, 356, 258, 356, 356, + 257, 148, 356, 356, 98, 51, 356, 154, 155, 158, + 159, 156, 157, 90, 307, 356, 356, 279, 136, 356, + 356, 356, 26, 356, 174, 356, 356, 356, 356, 198, + 356, 248, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + + 356, 356, 188, 187, 44, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 305, 356, 356, + 356, 356, 105, 356, 247, 356, 271, 302, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 328, + 356, 52, 5, 356, 356, 239, 356, 356, 303, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 259, 28, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 260, 356, 356, 356, 152, 356, 356, 356, + 356, 356, 356, 356, 356, 189, 356, 197, 356, 356, + + 356, 356, 356, 356, 356, 356, 356, 299, 356, 356, + 356, 356, 356, 356, 356, 356, 356, 356, 356, 356, + 356, 356, 356, 356, 356, 325, 356, 356, 267, 356, + 356, 356, 356, 356, 300, 356, 356, 356, 356, 356, + 356, 301, 356, 356, 356, 265, 356, 268, 269, 356, + 356, 356, 356, 356, 266, 270, 0 } ; static yyconst flex_int32_t yy_ec[256] = @@ -804,17 +812,17 @@ static yyconst flex_int32_t yy_meta[41] = 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 } ; -static yyconst flex_int16_t yy_base[3502] = +static yyconst flex_int16_t yy_base[3576] = { 0, 0, 0, 38, 41, 44, 46, 59, 65, 71, 77, - 90, 112, 96, 118, 124, 136, 5204, 5022, 81, 6793, - 6793, 6793, 129, 52, 130, 63, 131, 152, 70, 140, + 90, 112, 96, 118, 124, 136, 3060, 2545, 81, 6947, + 6947, 6947, 129, 52, 130, 63, 131, 152, 70, 140, 149, 156, 57, 88, 76, 173, 175, 95, 197, 145, - 185, 199, 208, 213, 178, 123, 4580, 6793, 6793, 6793, - 107, 3835, 6793, 6793, 6793, 154, 3459, 3338, 6793, 6793, - 6793, 245, 3159, 6793, 6793, 6793, 163, 2930, 6793, 249, - 6793, 253, 148, 2502, 2483, 6793, 6793, 6793, 257, 2236, - 6793, 6793, 6793, 233, 1695, 263, 201, 0, 267, 0, + 185, 199, 208, 213, 178, 123, 2505, 6947, 6947, 6947, + 107, 2460, 6947, 6947, 6947, 154, 2315, 2089, 6947, 6947, + 6947, 245, 2007, 6947, 6947, 6947, 163, 1936, 6947, 249, + 6947, 253, 148, 1835, 1793, 6947, 6947, 6947, 257, 1696, + 6947, 6947, 6947, 233, 1543, 263, 201, 0, 267, 0, 0, 165, 191, 221, 252, 205, 181, 265, 92, 261, 216, 263, 271, 272, 210, 279, 274, 282, 278, 291, @@ -822,8 +830,8 @@ static yyconst flex_int16_t yy_base[3502] = 317, 311, 315, 319, 321, 331, 327, 332, 336, 322, 339, 337, 346, 345, 347, 348, 353, 351, 357, 284, 358, 359, 369, 360, 380, 365, 381, 379, 375, 366, - 367, 389, 390, 394, 393, 395, 396, 403, 404, 1436, - 419, 1297, 422, 1003, 429, 930, 888, 433, 775, 437, + 367, 389, 390, 394, 393, 395, 396, 403, 404, 1277, + 419, 1241, 422, 1199, 429, 1020, 925, 433, 779, 437, 441, 0, 433, 705, 447, 479, 287, 452, 411, 445, 426, 446, 447, 448, 449, 450, 451, 453, 452, 456, 470, 234, 463, 473, 481, 479, 476, 483, 486, 487, @@ -831,760 +839,774 @@ static yyconst flex_int16_t yy_base[3502] = 488, 489, 491, 492, 501, 500, 502, 505, 508, 510, 511, 460, 509, 513, 527, 515, 516, 519, 538, 529, 540, 543, 539, 548, 555, 400, 550, 551, 558, 553, - 560, 561, 569, 562, 565, 566, 567, 570, 572, 574, - 576, 579, 578, 582, 577, 590, 591, 585, 595, 594, - 606, 601, 608, 604, 605, 362, 607, 611, 615, 623, - 612, 627, 613, 614, 629, 633, 640, 641, 636, 622, - 637, 639, 643, 644, 646, 648, 647, 656, 660, 659, - 663, 667, 657, 665, 669, 671, 673, 649, 682, 675, - 684, 688, 680, 683, 690, 692, 694, 696, 695, 699, - - 697, 700, 708, 704, 713, 712, 721, 716, 722, 719, - 731, 732, 727, 717, 728, 729, 733, 736, 730, 740, - 738, 741, 745, 743, 750, 752, 760, 755, 756, 771, - 763, 766, 762, 774, 773, 765, 769, 794, 799, 782, - 787, 800, 801, 804, 802, 803, 806, 808, 809, 814, - 818, 819, 823, 807, 825, 827, 834, 829, 6793, 831, - 838, 846, 839, 847, 850, 848, 854, 856, 836, 866, - 864, 867, 876, 898, 849, 871, 868, 878, 881, 6793, - 884, 882, 922, 890, 891, 908, 910, 859, 909, 911, - 904, 912, 933, 906, 920, 915, 945, 942, 930, 943, - - 944, 946, 952, 954, 955, 953, 957, 958, 966, 861, - 961, 970, 981, 962, 964, 968, 971, 974, 986, 983, - 990, 991, 993, 995, 997, 996, 1001, 999, 1022, 1004, - 1002, 1000, 1016, 1017, 1024, 1023, 1025, 1028, 1030, 1029, - 1037, 1041, 1038, 1046, 1047, 1048, 1049, 1059, 1054, 1055, - 1056, 1060, 1062, 1063, 1066, 1068, 1069, 1071, 1073, 1074, - 1080, 1081, 1085, 1089, 1075, 1090, 1082, 6793, 1097, 6793, - 1092, 1095, 1099, 1100, 1101, 1102, 1105, 6793, 1107, 1110, - 1109, 1112, 1120, 1115, 1136, 1111, 1118, 1123, 1135, 1119, - 1137, 1145, 1140, 1141, 1148, 1143, 1146, 1147, 1149, 1150, - - 1153, 1156, 1159, 1161, 1155, 1162, 1178, 6793, 1163, 1167, - 1165, 1168, 1176, 1182, 1173, 1181, 1191, 1190, 1201, 1193, - 1199, 1213, 1202, 1203, 1211, 1210, 1215, 1220, 1216, 1222, - 1224, 1225, 1227, 1228, 1226, 1230, 1231, 1234, 1232, 1238, - 1240, 6793, 1247, 1244, 1250, 1255, 1257, 1258, 1259, 1260, - 1261, 1262, 1263, 1264, 1266, 517, 1271, 1282, 1289, 1272, - 1291, 1275, 1290, 1286, 1288, 1265, 1292, 1296, 1294, 1307, - 1298, 1309, 1314, 1322, 1318, 1320, 1327, 1329, 1304, 1324, - 1299, 1326, 1330, 1332, 1334, 1333, 1335, 1341, 1339, 1348, - 1344, 1346, 1345, 1347, 1351, 1353, 1355, 1356, 1357, 1359, - - 1366, 1361, 1373, 1369, 1371, 1372, 1368, 1387, 1376, 1379, - 1391, 1392, 1389, 1390, 6793, 1399, 1398, 1401, 1402, 1408, - 1409, 1410, 1400, 1411, 1414, 1417, 1418, 1419, 1425, 1422, - 1426, 1420, 1427, 1433, 1432, 1440, 1446, 1435, 1450, 1451, - 1453, 1437, 1449, 1456, 1457, 1465, 1462, 1466, 1468, 1464, - 1469, 1478, 1470, 1473, 1475, 1485, 1481, 1482, 1487, 1484, - 1496, 1498, 1490, 1507, 1499, 1509, 1516, 1502, 1488, 1517, - 1506, 1518, 1512, 1521, 1522, 1523, 1526, 1533, 1528, 1529, - 1534, 1535, 1536, 1537, 1531, 1544, 1547, 1545, 1548, 1551, - 1552, 1553, 1557, 1560, 1555, 1561, 1566, 1567, 1568, 1570, - - 1558, 1578, 1588, 1569, 1580, 1582, 1581, 1589, 1590, 1591, - 1596, 1597, 1598, 1600, 1601, 1608, 1611, 1602, 1605, 1614, - 1615, 1617, 1618, 1627, 1619, 1628, 1632, 1633, 1634, 1622, - 1635, 1638, 1640, 1641, 1645, 1646, 1648, 6793, 1652, 1660, - 1653, 1658, 1655, 1656, 1661, 1669, 1664, 1668, 1665, 1666, - 1670, 1692, 6793, 1674, 6793, 6793, 1676, 6793, 6793, 1677, - 1678, 6793, 1682, 1687, 1699, 1698, 1705, 1707, 1709, 1685, - 1710, 1680, 1719, 1725, 1716, 1717, 1718, 1723, 1730, 1721, - 1731, 1728, 1738, 1742, 1740, 1746, 1749, 1754, 1756, 1758, - 1750, 1761, 1767, 1764, 1770, 1772, 1775, 1760, 1776, 1778, - - 1779, 1780, 1782, 1781, 1784, 1787, 1790, 1791, 1793, 1786, - 1794, 1805, 1803, 1796, 1813, 6793, 1809, 1821, 1806, 1823, - 1819, 1826, 1827, 1822, 1810, 1832, 1834, 1829, 1835, 1836, - 1838, 1839, 1840, 1842, 1844, 1846, 1850, 1848, 1860, 1849, - 6793, 1862, 1863, 1851, 1859, 1865, 1866, 1873, 1867, 1852, - 1870, 1876, 1886, 1882, 1884, 1887, 1888, 1890, 1891, 1892, - 6793, 1894, 1901, 1898, 1902, 1904, 1893, 1908, 1905, 1910, - 1911, 1912, 1917, 1915, 1918, 1922, 1923, 1924, 1926, 1929, - 1934, 1931, 1938, 1941, 1948, 1942, 1944, 1949, 1950, 1951, - 1953, 1954, 1955, 1957, 1962, 1966, 1965, 1969, 1967, 1968, - - 1978, 1986, 1971, 1982, 1983, 1984, 1985, 1990, 1993, 1998, - 1994, 1996, 1999, 2008, 2000, 2005, 2007, 2010, 2013, 2023, - 2009, 2026, 2018, 2011, 2021, 2027, 2028, 6793, 2034, 2035, - 6793, 2037, 2036, 2038, 2060, 2039, 2042, 2051, 2044, 2045, - 2048, 2053, 2061, 2057, 2064, 2073, 2074, 2077, 2080, 2079, - 2082, 2086, 2085, 2088, 2089, 2092, 2095, 2093, 2100, 2107, - 2109, 2055, 2113, 2117, 2112, 2114, 2118, 2137, 2115, 2116, - 2125, 2119, 2122, 2124, 2120, 2126, 2130, 2135, 2140, 2132, - 2147, 2150, 2146, 2149, 2152, 2153, 2160, 2162, 2165, 2164, - 6793, 2172, 2170, 2174, 2175, 2176, 2183, 2181, 2179, 6793, - - 2182, 2185, 2187, 2196, 2188, 2192, 2195, 2199, 2201, 2202, - 2204, 2205, 2208, 2206, 2207, 2226, 6793, 2209, 6793, 2213, - 2210, 2218, 2221, 2228, 2229, 2231, 2232, 2233, 6793, 6793, - 2234, 2235, 2248, 2251, 2241, 2243, 2252, 6793, 2253, 2260, - 6793, 2262, 2261, 2256, 2255, 2257, 2267, 2268, 2271, 2278, - 2274, 2282, 2277, 2279, 2283, 6793, 2287, 2280, 2288, 2291, - 2289, 2295, 2298, 2302, 2299, 6793, 2300, 2308, 2309, 2316, - 2313, 2314, 2317, 2318, 2319, 2322, 2325, 2326, 2327, 2328, - 2337, 2338, 2329, 2342, 2339, 2343, 2351, 6793, 2349, 2350, - 2336, 2358, 2355, 2362, 2357, 2363, 2353, 2359, 2364, 2370, - - 2365, 2369, 2375, 2377, 2379, 2386, 2387, 2382, 2383, 2385, - 2390, 2391, 2392, 2394, 2399, 2396, 2401, 2400, 2402, 6793, - 2403, 2407, 2408, 2413, 2415, 2411, 171, 2421, 2417, 2424, - 2423, 2425, 2430, 2426, 2439, 2443, 2438, 2440, 2442, 2447, - 2441, 2448, 2451, 2449, 2450, 2453, 2457, 2458, 6793, 2466, - 2459, 2461, 2463, 2468, 2467, 2470, 6793, 2476, 2481, 2483, - 2491, 2485, 2493, 2494, 2495, 2498, 2496, 2499, 2500, 2501, - 2503, 2506, 2510, 2509, 6793, 2512, 2517, 2518, 2515, 2524, - 2526, 2525, 2527, 2531, 2532, 2533, 2537, 2536, 2538, 2539, - 2540, 2541, 2547, 2548, 2555, 2544, 2554, 2556, 2557, 2560, - - 2566, 2562, 2567, 2568, 2575, 2570, 6793, 2577, 2573, 2580, - 2576, 2582, 2585, 2586, 2587, 2604, 2589, 2593, 2596, 2605, - 2610, 2600, 2612, 2620, 2616, 2622, 2625, 2630, 2626, 2632, - 2635, 2628, 2638, 2640, 2641, 2642, 2650, 2646, 2647, 2648, - 2651, 2652, 2662, 2663, 2654, 2664, 2666, 2669, 2658, 2676, - 2681, 2683, 6793, 2685, 2673, 2687, 2690, 2697, 2692, 2671, - 2695, 2698, 2702, 2703, 2704, 2706, 2713, 2708, 2710, 2714, - 2716, 2715, 2717, 2724, 2719, 2725, 2727, 2734, 2730, 2736, - 2595, 6793, 2738, 2739, 2740, 2742, 2747, 2743, 2749, 2752, - 2755, 2754, 2756, 2758, 2761, 2762, 2764, 2765, 2772, 2768, - - 2769, 2774, 2770, 6793, 2780, 2771, 2782, 2784, 2789, 2791, - 2790, 2793, 2792, 2800, 2802, 2803, 2804, 2805, 2806, 6793, - 2814, 2815, 2811, 2813, 2823, 2820, 2822, 2824, 2826, 2827, - 6793, 2828, 2830, 2832, 2831, 2834, 2836, 2843, 2844, 2839, - 6793, 2855, 2850, 2840, 2851, 2853, 2852, 2856, 2857, 2861, - 2862, 2867, 2863, 2873, 2869, 2875, 6793, 2876, 2883, 2878, - 2879, 2886, 2884, 2889, 2890, 2901, 2891, 2897, 2893, 6793, - 2916, 2911, 2902, 2918, 2903, 2914, 2919, 2920, 2921, 2923, - 2924, 2927, 2928, 6793, 2929, 2931, 2933, 2934, 2938, 2936, - 2939, 2952, 2945, 2947, 2950, 2953, 2955, 2956, 2960, 2962, - - 2967, 2959, 2961, 2971, 2973, 2963, 2976, 2979, 2983, 2987, - 2992, 2988, 2989, 2994, 2991, 2995, 2996, 2998, 3006, 3007, - 3010, 3008, 3012, 6793, 3015, 3016, 3018, 3005, 3019, 3021, - 3022, 3025, 3028, 3024, 3026, 3033, 3036, 3030, 3046, 3048, - 3039, 3051, 3041, 3043, 3054, 3053, 3055, 3056, 3057, 3067, - 3064, 3065, 3066, 3077, 3068, 3072, 3079, 3070, 3080, 3081, - 3082, 3083, 3084, 3088, 3090, 3093, 3094, 3095, 3086, 3107, - 3109, 3110, 3112, 3104, 3102, 3118, 3119, 6793, 3122, 3123, - 3120, 3124, 3126, 3130, 3127, 3139, 3134, 3137, 3136, 3143, - 3148, 3145, 3146, 3151, 3153, 3161, 3157, 6793, 3154, 6793, - - 3158, 3162, 3168, 3176, 3163, 6793, 3175, 6793, 3177, 3182, - 3171, 3178, 6793, 3185, 3184, 3166, 3189, 3190, 3191, 3193, - 3195, 3196, 3197, 3199, 3200, 3203, 3204, 3206, 3207, 3209, - 3217, 3211, 3219, 3223, 3220, 3227, 3230, 3224, 3238, 3214, - 3231, 3240, 3241, 3233, 3242, 6793, 3249, 3243, 3253, 3254, - 3255, 3256, 3258, 3257, 3261, 3260, 3262, 3264, 3267, 3268, - 3279, 3273, 3265, 3280, 3281, 3284, 3292, 3290, 3297, 6793, - 3293, 3295, 3296, 3298, 6793, 3301, 3299, 3302, 3308, 3305, - 3311, 3312, 3313, 3317, 3314, 3321, 3320, 3325, 3330, 3334, - 3335, 6793, 3336, 3337, 3322, 3341, 3349, 3352, 3356, 3353, - - 3359, 3361, 3357, 3363, 3364, 3355, 3365, 3366, 3367, 3375, - 3378, 3371, 3380, 3379, 3382, 3389, 3385, 3381, 3383, 3391, - 3392, 3393, 3394, 3395, 3396, 3397, 3400, 3411, 3398, 3416, - 6793, 3406, 3415, 3419, 3426, 3401, 3424, 3405, 3428, 3429, - 6793, 3431, 3433, 3434, 3435, 3436, 3441, 3438, 3443, 3444, - 3445, 3446, 3448, 3451, 3449, 6793, 3457, 6793, 3458, 3466, - 3471, 3474, 3464, 3468, 3475, 3480, 3481, 3482, 3484, 3485, - 3487, 3490, 3491, 3493, 3495, 3496, 3497, 3504, 3500, 3503, - 3511, 3510, 3512, 3513, 3521, 3517, 3518, 6793, 6793, 3516, - 3519, 3531, 3527, 3525, 3533, 3535, 3539, 3540, 3542, 3544, - - 3546, 3553, 6793, 3549, 3554, 3555, 3556, 3568, 3557, 3559, - 3572, 3571, 3567, 3579, 3574, 6793, 3570, 3578, 3588, 3583, - 3584, 3591, 6793, 3586, 6793, 3589, 3595, 3597, 3598, 3600, - 3599, 3601, 3602, 3604, 3606, 3617, 3613, 3625, 3611, 3622, - 3623, 3626, 3627, 3629, 3632, 3636, 3631, 3633, 3634, 6793, - 3640, 3635, 3637, 3642, 3648, 3651, 3654, 3657, 3650, 6793, - 3658, 3661, 3660, 3662, 3664, 3672, 3665, 3675, 3667, 3677, - 3678, 3681, 3682, 3683, 6793, 3680, 3685, 3696, 3689, 3691, - 3697, 3707, 3708, 3713, 6793, 3693, 3710, 3720, 3716, 3717, - 3700, 3718, 3704, 3722, 3723, 3725, 3726, 3727, 3728, 3730, - - 3733, 3734, 3736, 3735, 3747, 3746, 3738, 3750, 3760, 3740, - 6793, 3756, 3757, 3762, 3763, 3764, 3765, 3767, 3770, 3772, - 3773, 3785, 3786, 3774, 3777, 3789, 3790, 3797, 3796, 6793, - 3806, 3792, 3807, 3803, 3780, 3809, 3814, 3782, 3811, 3818, - 3804, 3815, 3820, 3821, 3822, 3824, 3833, 3828, 3830, 3831, - 3832, 3843, 3834, 6793, 3845, 3846, 3838, 3855, 3848, 3851, - 3862, 3858, 3861, 3863, 3865, 3868, 3869, 3871, 3873, 3874, - 3877, 3872, 6793, 6793, 3879, 3880, 3887, 6793, 3888, 3882, - 3889, 3885, 3899, 3886, 3893, 3902, 3904, 3890, 3910, 3900, - 3906, 6793, 3912, 3920, 3915, 3918, 3927, 3928, 6793, 3919, - - 3929, 3932, 3934, 3924, 3936, 3940, 3937, 3941, 3942, 3943, - 3945, 3953, 3954, 3950, 3951, 3957, 6793, 3952, 3958, 3962, - 3964, 3955, 3968, 6793, 3965, 3971, 3978, 3976, 3981, 3986, - 3987, 3988, 3993, 3973, 3989, 3995, 3996, 3997, 3998, 4006, - 4002, 4007, 4005, 4008, 4012, 4015, 4009, 6793, 4019, 4023, - 4024, 4026, 6793, 4030, 4033, 4037, 6793, 4041, 4036, 4038, - 4040, 4048, 6793, 4045, 4046, 4047, 4053, 4049, 4061, 4051, - 4064, 4066, 4056, 4060, 4063, 4067, 6793, 4069, 4070, 4071, - 6793, 4082, 4077, 4084, 4087, 4072, 4094, 4090, 4093, 4091, - 4095, 6793, 4100, 6793, 4099, 4101, 4106, 6793, 4103, 4108, - - 4109, 4111, 4112, 4117, 4118, 4116, 4125, 4126, 4127, 4129, - 4130, 4128, 4133, 4137, 4134, 4135, 4139, 4140, 6793, 4141, - 4143, 4150, 4145, 4155, 4151, 4158, 4148, 4162, 4163, 6793, - 6793, 4172, 6793, 4174, 4164, 4166, 6793, 4168, 4173, 4181, - 4178, 4184, 4186, 4179, 4190, 4191, 6793, 4193, 4200, 6793, - 4194, 4196, 4204, 4205, 4203, 4206, 4207, 4208, 4211, 4212, - 4213, 4214, 4215, 4222, 4216, 4221, 4218, 6793, 4223, 4229, - 4232, 4239, 4231, 4235, 4245, 4241, 4240, 6793, 4251, 4257, - 4247, 4253, 4254, 6793, 4262, 6793, 4250, 4263, 4264, 4267, - 4266, 4279, 6793, 4275, 4270, 4281, 4274, 4278, 4286, 4282, - - 4289, 4290, 4291, 4298, 4296, 4293, 4295, 4303, 4304, 6793, - 4299, 4305, 4310, 4313, 4315, 4316, 4323, 4320, 4322, 4321, - 4326, 4328, 4329, 4331, 4337, 4335, 4340, 4333, 6793, 4343, - 4346, 4347, 4359, 4349, 4354, 4350, 6793, 4357, 4360, 4366, - 6793, 4364, 4356, 4370, 4373, 4367, 4374, 4375, 4378, 4380, - 4381, 4382, 6793, 4383, 4386, 4384, 4388, 4397, 4390, 6793, - 6793, 4400, 6793, 4401, 4389, 4405, 4408, 4409, 4413, 4411, - 4414, 4416, 4417, 4418, 4421, 4424, 4427, 6793, 4428, 4436, - 4431, 4439, 4448, 4449, 4441, 4446, 4432, 6793, 6793, 4451, - 4455, 4457, 4459, 4460, 4462, 4445, 4471, 4464, 4467, 4473, - - 4475, 4482, 6793, 4479, 4477, 4484, 4478, 6793, 4485, 4486, - 4489, 4487, 4490, 4493, 4492, 4494, 4496, 4499, 4504, 4505, - 4500, 4513, 4506, 4507, 4516, 4517, 4519, 4520, 4522, 4527, - 6793, 4523, 4529, 4530, 4534, 4535, 4537, 4539, 4538, 4541, - 4551, 6793, 4543, 6793, 4542, 4547, 4546, 4563, 4544, 4554, - 4566, 4567, 4568, 4569, 4572, 4573, 4576, 4577, 4587, 4578, - 4582, 4588, 4590, 4592, 4597, 4598, 6793, 4600, 4584, 4594, - 4601, 4607, 4609, 4610, 4612, 4615, 4617, 4619, 4618, 4621, - 4625, 4622, 4626, 4627, 4628, 4630, 6793, 4632, 4639, 4631, - 4641, 4643, 4645, 4652, 4646, 4654, 4648, 4656, 4657, 6793, - - 4658, 4660, 4664, 6793, 4665, 4666, 4668, 4670, 4676, 4669, - 4672, 4678, 4680, 6793, 4682, 4684, 4687, 4686, 4690, 4691, - 4692, 4696, 4698, 4699, 4702, 6793, 4712, 4703, 4711, 4714, - 4710, 4713, 4717, 4723, 4721, 6793, 4724, 4725, 4727, 4737, - 4739, 4732, 4734, 4746, 4736, 4743, 4744, 4745, 4751, 4750, - 4752, 4755, 4756, 4757, 4766, 4768, 4763, 6793, 4770, 6793, - 4772, 4773, 4774, 4783, 4778, 4776, 4780, 4784, 4786, 6793, - 4788, 4791, 4794, 4795, 4796, 6793, 4797, 4798, 4800, 4799, - 6793, 4813, 4812, 4801, 4818, 4803, 4819, 6793, 4823, 4824, - 4826, 4834, 4835, 4832, 4837, 4825, 4842, 4833, 4838, 4840, - - 4846, 4850, 4848, 4849, 6793, 4851, 4853, 4858, 4860, 4861, - 4863, 4864, 4867, 4869, 4866, 6793, 4873, 4874, 4875, 4876, - 4877, 4880, 4882, 4889, 4885, 4892, 4886, 4888, 4896, 4897, - 4898, 4906, 6793, 4899, 4901, 4903, 4916, 4912, 4921, 6793, - 4909, 6793, 4913, 4924, 4926, 4914, 4930, 6793, 6793, 4928, - 4939, 4922, 4936, 4937, 6793, 6793, 4942, 6793, 4938, 6793, - 4943, 4944, 6793, 6793, 4945, 4947, 4948, 4949, 4953, 4952, - 6793, 4962, 6793, 4965, 4963, 4955, 4966, 4967, 6793, 4968, - 4974, 4970, 4978, 4976, 6793, 4980, 4985, 4981, 4983, 6793, - 4992, 4993, 4984, 4986, 6793, 4994, 5001, 4997, 5005, 5006, - - 5007, 5008, 5011, 5013, 5009, 5014, 5016, 5017, 5024, 5031, - 5033, 5035, 5039, 5028, 5026, 5041, 5042, 5047, 5045, 5049, - 5050, 5051, 5052, 5054, 5056, 5053, 5059, 5061, 5063, 5064, - 5068, 5065, 5066, 5078, 5067, 5079, 5081, 5082, 5085, 5088, - 5089, 5090, 5092, 5093, 5095, 5018, 5094, 5096, 5101, 5098, - 5100, 6793, 5102, 5104, 5105, 5108, 5118, 5119, 5122, 5130, - 5134, 5135, 6793, 5137, 6793, 5139, 5123, 5131, 5125, 5143, - 6793, 5145, 5146, 5147, 5148, 5112, 5150, 5149, 5152, 5153, - 5155, 5156, 6793, 5160, 5161, 5154, 5174, 5163, 6793, 5177, - 5167, 5178, 5179, 5180, 5184, 5182, 5185, 5188, 5189, 5191, - - 5193, 5195, 5181, 5202, 5205, 6793, 5207, 5210, 5218, 5213, - 5214, 5215, 5216, 5217, 5219, 5221, 5223, 5224, 5233, 5225, - 5236, 6793, 5237, 6793, 5238, 5240, 5242, 5243, 5244, 5245, - 5246, 5248, 6793, 6793, 5251, 5252, 5258, 5253, 5260, 5262, - 5264, 5265, 5269, 6793, 5270, 5272, 5282, 5274, 6793, 5277, - 5279, 5283, 5289, 6793, 5284, 5286, 5290, 5298, 5291, 5301, - 5302, 5304, 5293, 5305, 5306, 5312, 6793, 6793, 6793, 6793, - 5314, 5308, 5319, 5316, 5320, 5322, 5323, 5325, 5328, 5321, - 5324, 6793, 5336, 6793, 6793, 5337, 5338, 5340, 5344, 5345, - 5346, 5347, 5350, 6793, 5348, 6793, 5352, 5355, 5351, 5362, - - 5368, 5359, 5369, 5371, 5372, 5373, 5374, 5375, 5382, 5380, - 5383, 5381, 5386, 5390, 5395, 6793, 6793, 5387, 5398, 5399, - 5407, 5403, 5404, 5405, 5416, 5411, 5412, 5413, 5414, 5418, - 5420, 5427, 5430, 5423, 5425, 6793, 5431, 5434, 5432, 6793, - 5433, 6793, 5442, 5443, 5436, 5440, 5446, 5449, 5450, 5452, - 5457, 6793, 6793, 5456, 5465, 5460, 6793, 6793, 5444, 5464, - 5467, 5469, 5470, 5471, 5472, 5473, 5476, 5478, 6793, 5479, - 6793, 5480, 5483, 5492, 5482, 5495, 5499, 5485, 5502, 5505, - 5498, 5508, 6793, 5501, 5509, 6793, 5517, 5512, 5514, 5516, - 5519, 6793, 5520, 5523, 5525, 5527, 6793, 5529, 5531, 5532, - - 6793, 5539, 6793, 5533, 5540, 5536, 5550, 5542, 6793, 5543, - 5546, 6793, 5552, 5556, 5557, 5558, 5559, 6793, 5562, 5564, - 6793, 5565, 5567, 5568, 5574, 5575, 5577, 5570, 5578, 5579, - 5586, 5588, 5591, 6793, 6793, 5598, 5584, 135, 5600, 5581, - 5597, 5601, 5602, 5609, 5605, 5606, 5612, 6793, 6793, 5613, - 6793, 5607, 5616, 6793, 5614, 5620, 5624, 5626, 5622, 5628, - 5629, 5631, 5633, 5634, 5647, 5637, 5635, 5652, 5642, 5662, - 5638, 5664, 5665, 5667, 5669, 5671, 5659, 5673, 5674, 5653, - 5676, 5677, 5680, 5681, 5683, 5684, 5685, 6793, 5688, 5696, - 5697, 5689, 6793, 5702, 5691, 5709, 5706, 6793, 5713, 5710, - - 5714, 5715, 5716, 6793, 5703, 5718, 5722, 5720, 5727, 5728, - 5640, 5736, 5731, 5732, 5733, 6793, 6793, 6793, 5738, 5748, - 6793, 5750, 5740, 5734, 5742, 6793, 5752, 5753, 5745, 6793, - 6793, 5755, 5756, 5758, 6793, 5763, 5770, 6793, 5765, 6793, - 5766, 6793, 5768, 5769, 5771, 5775, 6793, 5776, 5778, 5779, - 5785, 6793, 5795, 5797, 5799, 5792, 5782, 5788, 5800, 6793, - 5809, 5806, 5808, 5815, 5804, 5812, 5810, 5816, 5817, 5825, - 5818, 5827, 6793, 5828, 5829, 5833, 5836, 5820, 5830, 5840, - 6793, 5841, 6793, 5847, 6793, 5844, 5849, 5848, 5842, 5850, - 5853, 5856, 5854, 5858, 5867, 5860, 5863, 5865, 5871, 5873, - - 6793, 6793, 5875, 5877, 6793, 5879, 6793, 5883, 6793, 5880, - 5885, 5884, 5886, 5888, 6793, 5895, 5887, 5890, 5903, 5898, - 5904, 6793, 5905, 5908, 5909, 5911, 6793, 6793, 5912, 5919, - 5915, 6793, 5914, 5917, 5925, 5918, 5926, 5930, 5927, 5931, - 5934, 5941, 5937, 5939, 5942, 5944, 5945, 5947, 5952, 5957, - 6793, 6793, 6793, 5953, 5948, 5967, 5964, 5966, 5976, 5959, - 6793, 5973, 5972, 5974, 5975, 5986, 5981, 5983, 6793, 5984, - 5985, 5987, 5988, 5990, 5991, 5992, 5993, 6793, 6005, 6007, - 5995, 5997, 6009, 6016, 6018, 6020, 6022, 6013, 6023, 6030, - 6027, 6793, 6029, 6793, 6793, 6025, 6793, 6031, 6033, 6035, - - 6034, 6036, 6793, 6039, 6040, 6041, 6043, 6042, 6050, 6046, - 6048, 6793, 6058, 6051, 6061, 6063, 6793, 6793, 6064, 6070, - 6793, 6073, 6074, 6067, 6082, 6065, 6075, 6087, 6084, 6793, - 6088, 6090, 6078, 6091, 6094, 6093, 6096, 6793, 6100, 6097, - 6101, 6103, 6793, 6104, 6109, 6110, 6112, 6113, 6793, 6114, - 6106, 6130, 6115, 6793, 6117, 6129, 6131, 6793, 6793, 6135, - 6139, 6136, 6793, 6793, 6793, 6793, 6142, 6143, 6145, 6147, - 6793, 6150, 6154, 6158, 6160, 6165, 6153, 6793, 6161, 6167, - 6169, 6170, 6171, 6793, 6793, 6172, 6173, 6174, 6178, 6175, - 6793, 6793, 6180, 6182, 6183, 6181, 6184, 6793, 6186, 6191, - - 6198, 6194, 6200, 6207, 6209, 6202, 6210, 6211, 6219, 6222, - 6212, 6214, 6221, 6225, 6226, 6224, 6228, 6238, 6233, 6235, - 6241, 6236, 6244, 6793, 6793, 6246, 6793, 6248, 6250, 6793, - 6793, 6253, 6255, 6257, 6261, 6793, 6263, 6265, 6267, 6269, - 6258, 6793, 6270, 6272, 6273, 6274, 6275, 6793, 6277, 6278, - 6281, 6283, 6287, 6289, 6290, 6293, 6793, 6288, 6305, 6793, - 6793, 6294, 6296, 6285, 6306, 6302, 6793, 6310, 6314, 6309, - 6316, 6315, 6317, 6322, 6793, 6318, 6319, 6793, 6793, 6325, - 6326, 6793, 6793, 6327, 6793, 6793, 6793, 6793, 6793, 6793, - 6793, 6793, 6331, 6330, 6793, 6332, 6340, 6343, 6793, 6347, - - 6793, 6337, 6348, 6350, 6344, 6793, 6349, 6793, 6351, 6355, - 6356, 6365, 6358, 6368, 6359, 6352, 6362, 6370, 6375, 6376, - 6378, 6377, 6379, 6381, 6383, 6393, 6385, 6390, 6793, 6793, - 6793, 6382, 6394, 6398, 6399, 6404, 6406, 6410, 6412, 6401, - 6413, 6415, 6416, 6417, 6419, 6423, 6430, 6425, 6428, 6426, - 6435, 6427, 6437, 6793, 6442, 6443, 6429, 6446, 6793, 6449, - 6793, 6432, 6793, 6793, 6452, 6453, 6455, 6456, 6465, 6466, - 6457, 6461, 6462, 6467, 6469, 6793, 6477, 6793, 6793, 6470, - 6473, 6793, 6478, 6479, 6793, 6480, 6482, 6484, 6485, 6486, - 6488, 6489, 6490, 6497, 6793, 6793, 6501, 6502, 6504, 6506, - - 6508, 6515, 6510, 6512, 6514, 6522, 6516, 6524, 6793, 6526, - 6528, 6530, 6793, 6532, 6531, 6534, 6537, 6538, 6545, 6540, - 6542, 6793, 6543, 6793, 6547, 6549, 6548, 6551, 6552, 6554, - 6562, 6560, 6564, 6793, 6566, 6568, 6572, 6573, 6575, 6578, - 6579, 6580, 6582, 6584, 6585, 6594, 6588, 6590, 6596, 6598, - 6600, 6793, 6602, 6604, 6793, 6605, 6606, 6607, 6608, 6612, - 6793, 6617, 6609, 6614, 6620, 6625, 6622, 6793, 6631, 6635, - 6632, 6793, 6636, 6793, 6793, 6637, 6638, 6640, 6644, 6646, - 6793, 6793, 6793, 6673, 6680, 6687, 6694, 6701, 6708, 6715, - 88, 6722, 6729, 6736, 6743, 6750, 6757, 6764, 6771, 6778, - - 6785 + 560, 561, 571, 562, 566, 567, 570, 569, 573, 577, + 574, 580, 578, 583, 584, 598, 595, 585, 601, 586, + 594, 596, 612, 602, 611, 362, 607, 610, 619, 624, + 609, 627, 620, 623, 629, 634, 631, 641, 636, 639, + 640, 642, 644, 643, 646, 647, 648, 656, 659, 660, + 664, 667, 657, 668, 658, 670, 673, 674, 683, 675, + 685, 679, 689, 688, 690, 692, 694, 696, 695, 697, + + 700, 703, 708, 704, 713, 714, 721, 719, 724, 717, + 726, 733, 728, 729, 730, 731, 734, 736, 732, 737, + 738, 742, 745, 743, 753, 754, 755, 759, 758, 774, + 763, 764, 771, 784, 765, 767, 769, 775, 796, 785, + 798, 799, 800, 803, 804, 801, 808, 807, 809, 811, + 823, 813, 820, 826, 827, 829, 830, 837, 832, 6947, + 834, 836, 848, 847, 850, 853, 843, 859, 860, 839, + 870, 866, 863, 881, 903, 867, 871, 873, 876, 872, + 6947, 893, 883, 927, 885, 889, 911, 895, 907, 913, + 916, 909, 914, 921, 923, 917, 920, 944, 945, 935, + + 936, 947, 952, 951, 959, 960, 954, 958, 963, 971, + 964, 967, 973, 982, 972, 969, 975, 976, 877, 984, + 993, 994, 995, 981, 988, 999, 1001, 1002, 1009, 1032, + 1011, 1012, 1020, 1006, 1014, 1028, 1026, 1024, 1034, 1033, + 1035, 1007, 1041, 1039, 1044, 1051, 1048, 1054, 1063, 1058, + 1059, 1060, 1064, 1065, 1066, 1068, 1071, 1072, 1073, 1076, + 1077, 1083, 1084, 1088, 1092, 1078, 1093, 1086, 6947, 1100, + 6947, 1095, 1098, 1102, 1103, 1104, 1105, 1107, 1109, 6947, + 1111, 1114, 1113, 1120, 1124, 1117, 1128, 1130, 1136, 1137, + 1138, 1139, 1140, 1142, 1149, 1144, 1154, 1152, 1147, 1158, + + 1156, 1159, 1115, 1160, 1162, 1166, 1167, 1168, 1169, 1188, + 6947, 1172, 1174, 1175, 1181, 1179, 1186, 1184, 1193, 1201, + 1203, 1211, 1205, 1213, 1215, 1212, 1217, 1173, 1219, 1223, + 1225, 1228, 1229, 1231, 1232, 1234, 1235, 1237, 1238, 1240, + 1239, 1247, 1250, 1251, 6947, 1252, 1254, 1255, 1268, 1263, + 1264, 1267, 1269, 1270, 1271, 1272, 1274, 1278, 517, 1273, + 1291, 1288, 1284, 1298, 1293, 1294, 1295, 1299, 1301, 1300, + 1302, 1304, 1313, 1310, 1316, 1325, 1328, 1327, 1330, 1337, + 1339, 1319, 1332, 1342, 1336, 1334, 1335, 1346, 1347, 1348, + 1350, 1351, 1360, 1356, 1357, 1359, 1358, 1364, 1365, 1367, + + 1362, 1368, 1370, 1372, 1374, 1381, 1379, 1385, 1390, 1386, + 1391, 1387, 1380, 1395, 1403, 1397, 1406, 6947, 1413, 1308, + 1409, 1410, 1415, 1416, 1417, 1418, 1423, 1424, 1425, 1427, + 1426, 1429, 1430, 1433, 1435, 1437, 1440, 1442, 1450, 1445, + 1455, 1462, 1461, 1443, 1447, 1457, 1463, 1467, 1466, 1474, + 1470, 1479, 1478, 1469, 1482, 1489, 1480, 1484, 1486, 1496, + 1476, 1492, 1498, 1499, 1507, 1502, 1504, 1510, 1518, 1514, + 1515, 1522, 1523, 1500, 1527, 1517, 1531, 1532, 1534, 1535, + 1537, 1538, 1545, 1540, 1542, 1546, 1547, 1541, 1548, 1554, + 1549, 1569, 1555, 1560, 1565, 1568, 1570, 1571, 1572, 1578, + + 1573, 1579, 1580, 1581, 1583, 1592, 1584, 1582, 1593, 1594, + 1601, 1595, 1603, 1602, 1604, 1611, 1610, 1614, 1615, 1605, + 1616, 1620, 1626, 1627, 1628, 1631, 1630, 1635, 1638, 1636, + 1640, 1642, 1648, 1649, 1650, 1652, 1633, 1656, 1659, 1664, + 1667, 1661, 6947, 1657, 1675, 1651, 1673, 1674, 1653, 1679, + 1687, 1680, 1682, 1683, 1684, 1685, 1710, 6947, 1691, 6947, + 6947, 1690, 6947, 6947, 1693, 1692, 6947, 1694, 1695, 1708, + 1699, 1713, 1716, 1720, 1718, 1711, 1721, 1733, 1742, 1728, + 1734, 1726, 1735, 1751, 1738, 1752, 1740, 1750, 1758, 1759, + 1757, 1764, 1771, 1766, 1775, 1768, 1779, 1777, 1780, 1786, + + 1787, 1791, 1793, 1788, 1794, 1797, 1796, 1798, 1799, 1802, + 1804, 1723, 1805, 1808, 1809, 1810, 1818, 1815, 1823, 1830, + 6947, 1828, 1831, 1827, 1840, 1836, 1843, 1811, 1838, 1839, + 1849, 1851, 1845, 1842, 1852, 1854, 1855, 1856, 1859, 1861, + 1864, 1867, 1865, 1869, 1872, 1870, 6947, 1877, 1878, 1871, + 1879, 1881, 1882, 1883, 1891, 1892, 1893, 1894, 1904, 1896, + 1899, 1897, 1901, 1906, 1908, 1909, 1911, 6947, 1916, 1924, + 1913, 1921, 1919, 1925, 1928, 1929, 1930, 1933, 1931, 1935, + 1937, 1938, 1947, 1943, 1944, 1946, 1949, 1953, 1958, 1961, + 1959, 1960, 1971, 1963, 1966, 1972, 1974, 1975, 1976, 1977, + + 1978, 1980, 1985, 1990, 1987, 1995, 1988, 1991, 1998, 2009, + 2004, 1993, 2005, 2010, 2006, 2013, 2022, 2024, 2020, 2019, + 2021, 2032, 2028, 2030, 2031, 2033, 2036, 2041, 2042, 2043, + 2044, 2046, 2050, 2051, 2053, 6947, 2055, 2059, 6947, 2058, + 2060, 2061, 2083, 2062, 2065, 2066, 2075, 2064, 2087, 2078, + 2076, 2095, 2084, 2102, 2097, 2103, 2105, 2107, 2108, 2112, + 2110, 2111, 2114, 2116, 2118, 2120, 2128, 2137, 2138, 2140, + 2134, 2142, 2119, 2143, 2067, 2163, 2144, 2145, 2146, 2147, + 2148, 2152, 2153, 2151, 2154, 2155, 2165, 2170, 2172, 2173, + 2175, 2158, 2179, 2180, 2181, 2191, 2188, 2185, 6947, 2200, + + 2193, 2197, 2201, 2202, 2209, 2207, 2204, 6947, 2208, 2210, + 2211, 2220, 2213, 2218, 2221, 2224, 2225, 2228, 2229, 2231, + 2233, 2230, 2232, 2251, 6947, 2234, 6947, 2238, 2235, 2253, + 2243, 2246, 2247, 2254, 2256, 2259, 6947, 6947, 2263, 2257, + 2270, 2273, 2278, 2274, 2275, 2276, 6947, 2277, 2285, 6947, + 2287, 2292, 2280, 2281, 2282, 2286, 2296, 2297, 2305, 2300, + 2308, 2303, 2306, 2307, 6947, 2313, 2316, 2310, 2317, 2323, + 2324, 2325, 2327, 2330, 2326, 6947, 2333, 2329, 2336, 2343, + 2347, 2341, 2344, 2348, 2352, 2349, 2354, 2355, 2356, 2357, + 2364, 2366, 2369, 2371, 2372, 2374, 2378, 2385, 6947, 2381, + + 2380, 2382, 2390, 2387, 2389, 2391, 2394, 2393, 2395, 2396, + 2401, 2397, 2405, 2406, 2407, 2409, 2418, 2421, 2416, 2417, + 2426, 2413, 2420, 2423, 2427, 2365, 2429, 2430, 2433, 2436, + 6947, 2437, 2441, 2438, 2443, 2444, 2442, 171, 2450, 2451, + 2453, 2454, 2458, 2469, 2455, 2463, 2476, 2471, 2472, 2478, + 2474, 2481, 2482, 2483, 2484, 2473, 2486, 2485, 2489, 6947, + 2491, 2497, 2494, 2498, 2501, 2502, 2504, 6947, 2506, 2514, + 2516, 2525, 2519, 2503, 2527, 2528, 2531, 2529, 2532, 2533, + 2534, 2535, 2536, 2542, 2539, 6947, 2544, 2551, 2554, 2541, + 2555, 2562, 2548, 2563, 2564, 2565, 2568, 2567, 2569, 2573, + + 2570, 2572, 2574, 2575, 2583, 2594, 2577, 2586, 2587, 2590, + 2591, 2595, 2599, 2600, 2601, 2608, 2603, 6947, 2615, 2604, + 2612, 2613, 2611, 2614, 2617, 2620, 2634, 2624, 2627, 2629, + 2635, 2644, 2637, 2638, 2646, 2654, 2651, 2639, 2664, 2660, + 2661, 2668, 2659, 2670, 2672, 2662, 2673, 2684, 2674, 2676, + 2681, 2679, 2685, 2694, 2695, 2687, 2697, 2698, 2690, 2700, + 2702, 2712, 2717, 2707, 6947, 2719, 2709, 2720, 2721, 2728, + 2725, 2726, 2731, 2729, 2732, 2733, 2735, 2737, 2745, 2746, + 2744, 2742, 2749, 2753, 2755, 2757, 2760, 2759, 2740, 2768, + 2762, 2764, 2771, 2772, 6947, 2775, 2776, 2780, 2782, 2784, + + 2785, 2787, 2788, 2790, 2792, 2793, 2794, 2797, 2798, 2800, + 2801, 2802, 2809, 2806, 2807, 2808, 2812, 6947, 2820, 2819, + 2821, 2824, 2827, 2825, 2831, 2837, 2839, 2828, 2841, 2835, + 2842, 2843, 2845, 6947, 2855, 2857, 2847, 2854, 2862, 2860, + 2861, 2863, 2865, 2866, 6947, 2867, 2870, 2868, 2875, 2871, + 2873, 2882, 2883, 2879, 6947, 2887, 2884, 2889, 2892, 2893, + 2894, 2895, 2899, 2897, 2901, 2902, 2906, 2915, 2907, 2916, + 6947, 2903, 2924, 2910, 2925, 2919, 2929, 2931, 2932, 2933, + 2935, 2937, 2940, 6947, 2942, 2945, 2948, 2957, 2952, 2953, + 2955, 2958, 2960, 2962, 2961, 2964, 2966, 6947, 2968, 2967, + + 2970, 2974, 2972, 2977, 2978, 2989, 2984, 2987, 2990, 2991, + 2992, 2993, 2994, 2999, 3010, 3001, 2998, 3000, 3002, 3014, + 3012, 3019, 3018, 3022, 3026, 3030, 3025, 3031, 3034, 3029, + 3036, 3037, 3040, 3047, 3048, 3049, 3050, 3053, 6947, 3056, + 3057, 3059, 3044, 3060, 3063, 3064, 3066, 3069, 3065, 3067, + 3071, 3074, 3078, 3087, 3090, 3080, 3082, 3091, 3092, 3093, + 3094, 3095, 3096, 3101, 3104, 3103, 3105, 3106, 3113, 3109, + 3112, 3121, 3117, 3120, 3122, 3123, 3124, 3126, 3127, 3129, + 3130, 3134, 3133, 3135, 3138, 3146, 3156, 3153, 3147, 3149, + 3157, 3159, 3161, 6947, 3160, 3164, 3168, 3165, 3170, 3174, + + 3171, 3181, 3177, 3182, 3190, 3188, 3187, 3194, 3179, 3189, + 3196, 3197, 3206, 3202, 6947, 3203, 6947, 3204, 3208, 3209, + 3218, 3211, 6947, 3215, 6947, 3216, 3223, 3220, 3224, 3226, + 6947, 3227, 3228, 3232, 3229, 3233, 3234, 3239, 3237, 3241, + 3243, 3245, 3246, 3255, 3244, 3250, 3251, 3257, 3266, 3256, + 3261, 3263, 3269, 3272, 3274, 3273, 3280, 3275, 3282, 3283, + 3285, 3286, 3287, 6947, 3291, 3295, 3296, 3299, 3300, 3288, + 3303, 3302, 3310, 3307, 3311, 3308, 3314, 3315, 3319, 3320, + 3323, 3325, 3331, 3336, 3343, 3326, 3344, 6947, 3339, 3348, + 3330, 3350, 6947, 3352, 3327, 3354, 3358, 3360, 3361, 3362, + + 3363, 3364, 3367, 3368, 3369, 3370, 3378, 3381, 3384, 6947, + 3382, 3390, 3371, 3394, 3393, 3404, 3405, 3401, 3407, 3409, + 3417, 3413, 3402, 3412, 3400, 3414, 3420, 3422, 3427, 3431, + 3424, 3432, 3428, 3433, 3436, 3437, 3439, 3440, 3443, 3441, + 3444, 3445, 3449, 3446, 3447, 3448, 3340, 3450, 3466, 6947, + 3453, 3455, 3468, 3476, 3454, 3471, 3475, 3477, 3478, 6947, + 3480, 3482, 3483, 3484, 3485, 3489, 3492, 3490, 3493, 3494, + 3497, 3498, 3501, 3500, 6947, 3507, 6947, 3508, 3515, 3520, + 3524, 3509, 3517, 3525, 3530, 3526, 3531, 3532, 3538, 3540, + 3534, 3536, 3542, 3543, 3546, 3547, 3554, 3560, 3557, 3549, + + 3561, 3563, 3565, 3566, 3573, 3570, 3568, 6947, 6947, 3571, + 3576, 3577, 3583, 3584, 3585, 3587, 3589, 3592, 3591, 3595, + 3600, 3611, 6947, 3603, 3604, 3606, 3607, 3608, 3620, 3613, + 3624, 3621, 3625, 3626, 3633, 3629, 6947, 3632, 3634, 3642, + 3637, 3638, 3645, 6947, 3375, 6947, 3643, 3644, 3646, 3649, + 3651, 3655, 3653, 3658, 3659, 3654, 3660, 3670, 3677, 3679, + 3675, 3681, 3676, 3682, 3678, 3684, 3685, 3692, 3687, 3689, + 3690, 6947, 3694, 3695, 3699, 3701, 3702, 3707, 3711, 3704, + 3710, 6947, 3714, 3717, 3718, 3719, 3720, 3724, 3727, 3728, + 3729, 3737, 3730, 3732, 3738, 3741, 6947, 3742, 3734, 3749, + + 3745, 3747, 3752, 3756, 3759, 3764, 6947, 3766, 3751, 3773, + 3769, 3770, 3772, 3775, 3776, 3777, 3779, 3780, 3781, 3783, + 3784, 3789, 3785, 3787, 3794, 3790, 3802, 3804, 3791, 3812, + 3819, 3805, 6947, 3808, 3815, 3817, 3818, 3820, 3821, 3823, + 3829, 3831, 3825, 3840, 3841, 3832, 3836, 3843, 3847, 3844, + 3855, 3851, 6947, 3856, 3852, 3865, 3858, 3860, 3866, 3862, + 3867, 3868, 3872, 3874, 3875, 3876, 3877, 3878, 3883, 3886, + 3890, 3891, 3892, 3893, 3900, 3895, 6947, 3907, 3884, 3897, + 3914, 3908, 3905, 3923, 3918, 3921, 3922, 3925, 3926, 3928, + 3930, 3931, 3932, 3935, 3936, 6947, 6947, 3938, 3939, 3940, + + 6947, 3942, 3944, 3954, 3945, 3947, 3955, 3957, 3959, 3958, + 3960, 3962, 3968, 3969, 6947, 3977, 3970, 3979, 3978, 3974, + 3988, 3987, 6947, 3980, 3990, 3992, 3995, 3993, 3983, 3996, + 4001, 3997, 4005, 4006, 4007, 4010, 4018, 4019, 4014, 4016, + 4017, 6947, 4020, 4022, 4023, 4026, 4027, 4029, 4030, 6947, + 4035, 4032, 4038, 4041, 4043, 4050, 4042, 4053, 4056, 4057, + 4058, 4060, 4061, 4062, 4063, 4065, 4073, 4059, 4071, 4070, + 4068, 4088, 4089, 4076, 6947, 4084, 4091, 4074, 4096, 6947, + 4098, 4105, 4106, 6947, 4109, 4092, 4108, 4110, 4117, 6947, + 4112, 4115, 4114, 4120, 4116, 4129, 4125, 4133, 4131, 4132, + + 4128, 4134, 4137, 6947, 4138, 4135, 4140, 6947, 4143, 4152, + 4156, 4158, 4142, 4165, 4160, 4163, 4161, 4164, 6947, 4169, + 6947, 4172, 4170, 4176, 6947, 4171, 4178, 4179, 4181, 4185, + 4186, 4187, 4193, 4189, 4195, 4197, 4198, 4199, 4200, 4202, + 4209, 4201, 4205, 4208, 4210, 6947, 4211, 4213, 4220, 4217, + 4221, 4225, 4227, 4228, 4230, 4232, 6947, 6947, 4241, 6947, + 4233, 4238, 4242, 4243, 6947, 4246, 4248, 4250, 4247, 4251, + 4253, 4256, 4266, 4136, 6947, 4268, 4269, 6947, 4257, 4271, + 4278, 4273, 4275, 4263, 4276, 4283, 4279, 4260, 4286, 4289, + 4290, 4291, 4292, 4293, 4300, 6947, 4294, 4297, 4295, 4310, + + 4299, 4304, 4312, 4311, 4313, 6947, 4321, 4323, 4322, 4327, + 4328, 6947, 4329, 6947, 4330, 4334, 4337, 4339, 4331, 4342, + 6947, 4344, 4345, 4352, 4347, 4353, 4354, 4355, 4357, 4361, + 4363, 4364, 4371, 4367, 4369, 4366, 4376, 4377, 6947, 4368, + 4374, 4390, 4391, 4383, 4380, 4386, 4399, 4396, 4398, 4397, + 4402, 4404, 4405, 4407, 4411, 4413, 4409, 4416, 6947, 4419, + 4420, 4424, 4421, 4431, 4427, 4428, 4433, 6947, 4435, 4436, + 4438, 6947, 4440, 4444, 4446, 4449, 4450, 4451, 4452, 4456, + 4454, 4457, 4458, 4460, 6947, 4462, 4463, 4461, 4477, 4478, + 4467, 6947, 6947, 4480, 6947, 4484, 4466, 4485, 4487, 4488, + + 4492, 4494, 4495, 4497, 4491, 4498, 4502, 4503, 4507, 6947, + 4510, 4518, 4511, 4522, 4525, 4530, 4523, 4527, 4514, 6947, + 6947, 4532, 4536, 4538, 4540, 4541, 4543, 4528, 4550, 4548, + 4556, 4559, 4549, 4566, 6947, 4561, 4552, 4563, 4564, 6947, + 4545, 4568, 4569, 4571, 4574, 4575, 4578, 4576, 4577, 4580, + 4588, 4581, 4583, 4590, 4589, 4591, 4599, 4597, 4600, 4601, + 4603, 4607, 6947, 4604, 4608, 4610, 4613, 4617, 4618, 4619, + 4620, 4622, 4623, 4630, 6947, 4628, 6947, 4626, 4631, 4646, + 4633, 4636, 4648, 4649, 4650, 4651, 4655, 4657, 4658, 4661, + 4663, 4667, 4662, 4668, 4671, 4673, 4675, 4679, 4683, 4680, + + 6947, 4686, 4676, 4688, 4625, 4690, 4693, 4694, 4698, 4699, + 4701, 4695, 4702, 4704, 4706, 4709, 4711, 4712, 4714, 4715, + 6947, 4716, 4719, 4722, 4725, 4726, 4727, 4730, 4735, 4739, + 4743, 4731, 4733, 4745, 6947, 4737, 4746, 4754, 6947, 4749, + 4751, 4756, 4757, 4758, 4760, 4761, 4763, 4767, 4770, 6947, + 4774, 4764, 4771, 4775, 4776, 4777, 4781, 4783, 4786, 4788, + 4790, 4798, 6947, 4799, 4791, 4800, 4802, 4804, 4806, 4810, + 4808, 4811, 6947, 4812, 4815, 4821, 4823, 4828, 4830, 4814, + 4825, 4833, 4834, 4836, 4832, 4842, 4843, 4844, 4845, 4847, + 4849, 4848, 4865, 4866, 4863, 6947, 4850, 6947, 4851, 4852, + + 4868, 4878, 4873, 4875, 4876, 4880, 4879, 6947, 4881, 4886, + 4888, 4883, 4891, 6947, 4892, 4889, 4893, 4894, 6947, 4907, + 4890, 4896, 4903, 4912, 4913, 6947, 4918, 4919, 4920, 4927, + 4929, 4924, 4931, 4926, 4934, 4932, 4928, 4936, 4937, 4945, + 4943, 4941, 6947, 4947, 4949, 4954, 4956, 4950, 4958, 4948, + 4960, 4963, 4965, 6947, 4966, 4969, 4970, 4972, 4973, 4975, + 4974, 4976, 4983, 4980, 4984, 4982, 4988, 4991, 4993, 4995, + 4997, 6947, 4999, 5001, 5003, 5012, 5005, 5002, 6947, 5009, + 6947, 5014, 5019, 5021, 5022, 5015, 5026, 6947, 6947, 5029, + 5036, 5023, 5032, 5034, 6947, 6947, 5038, 6947, 5039, 6947, + + 5040, 5042, 6947, 6947, 5044, 5045, 5046, 5047, 5048, 5051, + 6947, 5056, 6947, 5065, 5060, 5061, 5063, 5064, 5068, 6947, + 5066, 5069, 5070, 5075, 5077, 6947, 5074, 5078, 5094, 5081, + 5089, 6947, 5091, 5092, 5093, 5096, 6947, 5097, 5101, 5102, + 5103, 5106, 5105, 5108, 5109, 5110, 5116, 5117, 5120, 5119, + 5122, 5123, 5127, 5132, 5134, 5136, 5137, 5138, 5140, 5143, + 5146, 5150, 5141, 5148, 5152, 5154, 5155, 5157, 5159, 5160, + 5162, 5166, 5167, 5163, 5170, 5169, 5171, 5180, 5172, 5182, + 5184, 5186, 5188, 5189, 5190, 5193, 5194, 5197, 5198, 5199, + 5196, 5203, 5200, 5207, 5212, 6947, 5205, 5213, 5214, 5216, + + 5217, 5221, 5224, 5233, 5239, 5240, 6947, 5242, 6947, 5244, + 5228, 5225, 5230, 5247, 6947, 5234, 5248, 5250, 5251, 5252, + 5253, 5255, 5256, 5259, 5260, 5263, 6947, 5268, 5265, 5258, + 5274, 5270, 6947, 5275, 5282, 5285, 5286, 5287, 5288, 5291, + 5289, 5290, 5293, 5292, 5294, 5297, 5299, 5300, 5310, 5312, + 6947, 5314, 5316, 5323, 5319, 5321, 5322, 5324, 5325, 5326, + 5329, 5327, 5334, 5331, 5343, 5348, 5345, 6947, 5332, 6947, + 5349, 5335, 5352, 5353, 5355, 5356, 5357, 5359, 6947, 6947, + 5362, 5363, 5365, 5367, 5369, 5370, 5372, 5374, 5375, 5376, + 6947, 5379, 5383, 5387, 5393, 5386, 6947, 5395, 5396, 5397, + + 5401, 6947, 5402, 5398, 5404, 5405, 5412, 5403, 5419, 5415, + 5421, 5409, 5423, 5413, 5427, 6947, 6947, 6947, 6947, 5428, + 5424, 5432, 5434, 5436, 5437, 5439, 5442, 5443, 5441, 5438, + 5444, 6947, 5454, 6947, 6947, 5455, 5456, 5457, 5462, 5464, + 5463, 5465, 5468, 6947, 5466, 6947, 5470, 5473, 5469, 5480, + 5486, 5483, 5477, 5490, 5487, 5492, 5491, 5493, 5501, 5498, + 5499, 5502, 5505, 5507, 5513, 6947, 6947, 5508, 5515, 5516, + 5524, 5520, 5522, 5526, 5534, 5529, 5530, 5532, 5531, 5536, + 5537, 5545, 5548, 5538, 5547, 6947, 5549, 5550, 5551, 6947, + 5552, 6947, 5557, 5560, 5561, 5553, 5563, 5568, 5569, 5572, + + 5570, 5575, 6947, 6947, 5567, 5587, 5582, 6947, 6947, 5574, + 5583, 5586, 5590, 5584, 5592, 5595, 5594, 5597, 5599, 5596, + 6947, 5601, 6947, 5600, 5602, 5608, 5610, 5619, 5623, 5614, + 5624, 5622, 5625, 5626, 5629, 6947, 5627, 5628, 6947, 5637, + 5639, 5640, 5638, 5646, 5643, 6947, 5647, 5649, 5654, 5656, + 6947, 5660, 5657, 5663, 5662, 6947, 5665, 6947, 5630, 5669, + 5666, 5676, 5672, 6947, 5673, 5679, 6947, 5682, 5686, 5688, + 5689, 5677, 5683, 6947, 5695, 5691, 6947, 5697, 5699, 5700, + 5703, 5704, 5706, 5707, 5708, 5710, 5718, 5714, 5711, 6947, + 6947, 5722, 5723, 135, 5731, 5721, 5727, 5729, 5732, 5739, + + 5734, 5736, 5742, 6947, 6947, 5743, 6947, 5737, 5750, 6947, + 5735, 5751, 5755, 5746, 5752, 5758, 5761, 5765, 5767, 5768, + 5769, 5770, 5771, 5775, 5792, 5794, 5777, 5774, 5797, 5799, + 5801, 5803, 5805, 5762, 5807, 5789, 5785, 5808, 5810, 5795, + 5813, 5816, 5817, 5819, 6947, 5821, 5824, 5826, 5827, 5828, + 6947, 5831, 5834, 5836, 5838, 6947, 5845, 5840, 5842, 5847, + 5848, 6947, 5832, 5853, 5855, 5858, 5859, 5860, 5861, 5863, + 5870, 6947, 5867, 5865, 5871, 6947, 6947, 6947, 5876, 5883, + 5873, 6947, 5885, 5877, 5886, 5888, 6947, 5890, 5892, 5893, + 6947, 6947, 6947, 5894, 5895, 5898, 6947, 5896, 5903, 6947, + + 5902, 6947, 5899, 6947, 5904, 5908, 5917, 5912, 6947, 5910, + 5922, 5923, 5924, 6947, 5927, 5930, 5932, 5933, 5934, 5936, + 5938, 6947, 5945, 5941, 5944, 5948, 5940, 5950, 5951, 5952, + 5953, 5965, 5956, 5961, 6947, 5963, 5964, 5968, 5974, 5966, + 5976, 5977, 6947, 5970, 6947, 5979, 6947, 5980, 5982, 5983, + 5984, 5989, 5986, 5987, 5997, 5994, 6000, 6003, 6001, 6007, + 6008, 6012, 6009, 6947, 6947, 6014, 6015, 6017, 6947, 6018, + 6947, 6023, 6947, 6019, 6024, 6026, 6027, 6032, 6947, 6947, + 6030, 6033, 6036, 6044, 6041, 6042, 6947, 6046, 6048, 6049, + 6051, 6947, 6058, 6947, 6054, 6063, 6055, 6947, 6056, 6066, + + 6070, 6067, 6059, 6072, 6073, 6076, 6075, 6083, 6080, 6081, + 6086, 6088, 6089, 6094, 6098, 6102, 6947, 6947, 6947, 6096, + 6090, 6111, 6113, 6114, 6115, 6100, 6947, 6116, 6120, 6122, + 6107, 6129, 6124, 6131, 6947, 6125, 6128, 6132, 6134, 6136, + 6133, 6138, 6139, 6947, 6144, 6150, 6156, 6140, 6151, 6153, + 6160, 6162, 6164, 6167, 6168, 6169, 6176, 6172, 6947, 6174, + 6947, 6179, 6947, 6171, 6947, 6175, 6180, 6182, 6183, 6184, + 6947, 6187, 6188, 6189, 6192, 6191, 6194, 6199, 6210, 6947, + 6200, 6213, 6196, 6193, 6215, 6947, 6947, 6204, 6222, 6947, + 6224, 6226, 6219, 6234, 6217, 6227, 6237, 6238, 6947, 6240, + + 6241, 6230, 6232, 6242, 6239, 6248, 6947, 6245, 6249, 6255, + 6256, 6947, 6259, 6257, 6261, 6260, 6258, 6947, 6262, 6264, + 6271, 6269, 6947, 6266, 6280, 6272, 6947, 6947, 6947, 6288, + 6290, 6291, 6947, 6947, 6947, 6947, 6293, 6294, 6282, 6297, + 6947, 6947, 6303, 6307, 6311, 6313, 6317, 6306, 6947, 6316, + 6318, 6320, 6322, 6323, 6947, 6947, 6324, 6326, 6328, 6329, + 6331, 6332, 6947, 6947, 6333, 6335, 6339, 6336, 6338, 6947, + 6341, 6344, 6351, 6347, 6354, 6361, 6363, 6357, 6364, 6365, + 6376, 6373, 6366, 6368, 6371, 6379, 6380, 6378, 6382, 6393, + 6388, 6390, 6396, 6386, 6398, 6947, 6947, 6400, 6947, 6405, + + 6402, 6947, 6947, 6407, 6409, 6413, 6415, 6947, 6417, 6419, + 6421, 6423, 6410, 6947, 6424, 6426, 6428, 6429, 6430, 6431, + 6947, 6435, 6437, 6440, 6432, 6441, 6443, 6444, 6449, 6947, + 6446, 6453, 6947, 6947, 6450, 6457, 6458, 6462, 6459, 6947, + 6464, 6471, 6466, 6469, 6470, 6472, 6475, 6947, 6473, 6476, + 6947, 6947, 6478, 6481, 6947, 6947, 6483, 6947, 6947, 6947, + 6947, 6947, 6947, 6947, 6947, 6487, 6494, 6947, 6947, 6486, + 6501, 6503, 6947, 6505, 6947, 6488, 6498, 6506, 6493, 6947, + 6508, 6947, 6495, 6512, 6514, 6298, 6515, 6516, 6520, 6521, + 6524, 6525, 6526, 6528, 6527, 6532, 6529, 6531, 6545, 6538, + + 6535, 6548, 6947, 6947, 6947, 6546, 6539, 6557, 6549, 6562, + 6563, 6566, 6568, 6554, 6569, 6571, 6570, 6572, 6576, 6578, + 6585, 6580, 6583, 6581, 6588, 6582, 6591, 6947, 6597, 6584, + 6592, 6604, 6947, 6598, 6947, 6600, 6947, 6947, 6606, 6607, + 6609, 6610, 6620, 6621, 6612, 6619, 6616, 6622, 6624, 6947, + 6631, 6947, 6947, 6625, 6628, 6947, 6633, 6634, 6947, 6636, + 6637, 6639, 6640, 6641, 6643, 6644, 6645, 6652, 6947, 6947, + 6655, 6659, 6657, 6661, 6663, 6670, 6665, 6667, 6669, 6673, + 6671, 6685, 6947, 6681, 6682, 6684, 6947, 6688, 6686, 6689, + 6691, 6693, 6700, 6695, 6698, 6947, 6701, 6947, 6704, 6697, + + 6708, 6699, 6707, 6715, 6716, 6719, 6720, 6947, 6721, 6722, + 6725, 6729, 6731, 6734, 6735, 6727, 6737, 6738, 6748, 6741, + 6745, 6749, 6751, 6753, 6754, 6947, 6760, 6755, 6947, 6757, + 6761, 6763, 6764, 6767, 6947, 6772, 6765, 6769, 6775, 6778, + 6779, 6947, 6781, 6790, 6785, 6947, 6791, 6947, 6947, 6793, + 6787, 6794, 6800, 6802, 6947, 6947, 6947, 6827, 6834, 6841, + 6848, 6855, 6862, 6869, 88, 6876, 6883, 6890, 6897, 6904, + 6911, 6918, 6925, 6932, 6939 } ; -static yyconst flex_int16_t yy_def[3502] = +static yyconst flex_int16_t yy_def[3576] = { 0, - 3483, 1, 3484, 3484, 3485, 3485, 3486, 3486, 3487, 3487, - 3488, 3488, 3489, 3489, 3490, 3490, 3483, 3491, 3483, 3483, - 3483, 3483, 3492, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3493, 3483, 3483, 3483, - 3493, 3494, 3483, 3483, 3483, 3494, 3495, 3483, 3483, 3483, - 3483, 3495, 3496, 3483, 3483, 3483, 3496, 3497, 3483, 3498, - 3483, 3497, 3497, 3499, 3483, 3483, 3483, 3483, 3499, 3500, - 3483, 3483, 3483, 3500, 3491, 3491, 3483, 3501, 3492, 3501, - 3492, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3493, - 3493, 3494, 3494, 3495, 3495, 3483, 3496, 3496, 3497, 3497, - 3498, 3498, 3497, 3499, 3499, 3483, 3500, 3500, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3483, 3483, 3491, 3483, 3483, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3497, 3497, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, - - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3497, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3497, 3491, 3483, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3483, 3491, 3483, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3497, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, - 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3483, 3491, 3483, - 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3497, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3483, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3497, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3483, 3491, 3491, 3491, 3483, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - - 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3497, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3491, - 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3483, 3483, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483, - 3483, 3491, 3491, 3491, 3483, 3491, 3491, 3483, 3491, 3483, - 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - - 3483, 3483, 3491, 3491, 3483, 3491, 3483, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3483, 3491, 3483, 3491, 3491, 3491, - - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3483, 3483, 3491, - 3491, 3491, 3483, 3483, 3483, 3483, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, - 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3483, 3491, 3483, 3491, 3491, 3483, - 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483, - 3483, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3491, 3491, 3483, 3483, 3491, - 3491, 3483, 3483, 3491, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3483, 3491, - - 3483, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3483, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3483, 3491, - 3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3483, 3483, 3491, - 3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3483, 3483, 3491, 3491, 3491, 3491, - - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, - 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, 3491, - 3491, 3483, 3491, 3491, 3483, 3491, 3491, 3491, 3491, 3491, - 3483, 3491, 3491, 3491, 3491, 3491, 3491, 3483, 3491, 3491, - 3491, 3483, 3491, 3483, 3483, 3491, 3491, 3491, 3491, 3491, - 3483, 3483, 0, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - - 3483 + 3557, 1, 3558, 3558, 3559, 3559, 3560, 3560, 3561, 3561, + 3562, 3562, 3563, 3563, 3564, 3564, 3557, 3565, 3557, 3557, + 3557, 3557, 3566, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3567, 3557, 3557, 3557, + 3567, 3568, 3557, 3557, 3557, 3568, 3569, 3557, 3557, 3557, + 3557, 3569, 3570, 3557, 3557, 3557, 3570, 3571, 3557, 3572, + 3557, 3571, 3571, 3573, 3557, 3557, 3557, 3557, 3573, 3574, + 3557, 3557, 3557, 3574, 3565, 3565, 3557, 3575, 3566, 3575, + 3566, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3567, + 3567, 3568, 3568, 3569, 3569, 3557, 3570, 3570, 3571, 3571, + 3572, 3572, 3571, 3573, 3573, 3557, 3574, 3574, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3571, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, + 3557, 3565, 3557, 3557, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3571, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3571, 3571, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3571, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3571, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3571, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, + + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3571, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3557, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3571, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565, 3557, + + 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3571, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3557, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3557, 3565, 3565, 3571, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3557, 3557, 3557, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3557, 3557, 3557, 3565, 3565, 3565, 3557, 3565, 3565, 3557, + + 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3557, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3557, 3565, + 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3557, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3557, 3557, 3557, 3565, + 3565, 3565, 3557, 3557, 3557, 3557, 3565, 3565, 3565, 3565, + 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3557, 3565, 3557, 3565, + + 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, + 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3557, 3557, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3557, 3557, 3565, 3565, 3557, 3557, 3565, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3565, 3565, 3557, 3557, 3565, + 3565, 3565, 3557, 3565, 3557, 3565, 3565, 3565, 3565, 3557, + 3565, 3557, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + + 3565, 3565, 3557, 3557, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3557, 3565, 3557, 3565, 3557, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, + 3565, 3557, 3557, 3565, 3565, 3557, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3557, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3557, 3565, 3565, + + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, 3565, + 3565, 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3557, 3565, + 3565, 3565, 3565, 3565, 3557, 3565, 3565, 3565, 3565, 3565, + 3565, 3557, 3565, 3565, 3565, 3557, 3565, 3557, 3557, 3565, + 3565, 3565, 3565, 3565, 3557, 3557, 0, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557 } ; -static yyconst flex_int16_t yy_nxt[6834] = +static yyconst flex_int16_t yy_nxt[6988] = { 0, 18, 19, 20, 21, 22, 23, 22, 18, 18, 18, 18, 18, 22, 24, 25, 26, 27, 28, 29, 30, @@ -1626,7 +1648,7 @@ static yyconst flex_int16_t yy_nxt[6834] = 86, 227, 225, 223, 86, 86, 216, 229, 224, 86, 86, 219, 86, 222, 230, 232, 233, 228, 86, 86, 86, 86, 231, 235, 86, 237, 86, 240, 234, 238, - 86, 86, 86, 86, 242, 86, 236, 370, 86, 86, + 86, 86, 86, 86, 242, 86, 236, 371, 86, 86, 86, 239, 86, 243, 241, 248, 251, 252, 86, 244, 253, 247, 86, 86, 86, 254, 249, 246, 260, 257, @@ -1646,701 +1668,717 @@ static yyconst flex_int16_t yy_nxt[6834] = 311, 86, 86, 86, 86, 307, 86, 318, 86, 86, 86, 319, 86, 325, 312, 313, 315, 309, 314, 316, 86, 320, 86, 329, 321, 328, 322, 330, 327, 326, - 332, 86, 86, 86, 736, 334, 86, 338, 323, 331, + 332, 86, 86, 86, 741, 334, 86, 338, 323, 331, 324, 86, 335, 86, 86, 340, 86, 342, 86, 339, - 341, 86, 333, 86, 86, 86, 344, 336, 86, 86, - 86, 343, 86, 86, 346, 86, 348, 86, 345, 86, - 86, 86, 86, 351, 353, 86, 349, 358, 86, 347, - - 352, 354, 359, 86, 86, 350, 355, 86, 86, 360, - 357, 356, 362, 364, 86, 367, 361, 86, 86, 86, - 86, 86, 373, 369, 86, 86, 86, 86, 86, 363, - 374, 372, 365, 366, 376, 86, 86, 368, 377, 371, - 86, 378, 86, 379, 375, 380, 86, 381, 383, 86, - 86, 384, 170, 86, 86, 387, 86, 86, 386, 86, - 86, 86, 86, 394, 388, 390, 392, 395, 385, 86, - 86, 382, 86, 86, 398, 389, 86, 396, 86, 391, - 86, 397, 86, 393, 86, 399, 86, 404, 86, 405, - 409, 406, 400, 86, 403, 86, 86, 86, 402, 407, - - 401, 86, 408, 86, 411, 86, 412, 86, 86, 86, - 86, 415, 86, 86, 410, 419, 416, 86, 175, 417, - 421, 86, 418, 413, 414, 86, 86, 422, 423, 86, - 86, 420, 86, 424, 86, 86, 426, 427, 428, 429, - 86, 86, 86, 86, 86, 86, 86, 435, 432, 86, - 425, 86, 436, 86, 86, 434, 86, 438, 86, 441, - 431, 437, 433, 86, 430, 86, 443, 446, 86, 86, - 439, 447, 440, 86, 442, 86, 86, 445, 86, 86, - 457, 448, 86, 444, 86, 455, 86, 86, 170, 462, - 458, 463, 459, 449, 464, 86, 450, 456, 469, 470, - - 86, 451, 452, 453, 454, 460, 467, 86, 461, 465, - 466, 468, 86, 86, 86, 86, 86, 86, 478, 86, - 86, 86, 86, 480, 476, 477, 479, 86, 481, 473, - 471, 86, 86, 472, 474, 475, 86, 483, 86, 485, - 86, 488, 86, 489, 86, 490, 482, 86, 484, 86, - 506, 86, 86, 494, 491, 487, 493, 495, 486, 86, - 86, 86, 86, 86, 492, 496, 498, 86, 499, 86, - 501, 497, 170, 507, 86, 500, 508, 86, 505, 86, - 86, 86, 522, 502, 86, 509, 503, 523, 504, 86, - 510, 86, 511, 545, 86, 86, 525, 86, 512, 569, - - 528, 168, 513, 86, 86, 524, 526, 514, 527, 530, - 515, 86, 516, 540, 517, 541, 529, 86, 539, 86, - 542, 86, 86, 86, 86, 86, 548, 518, 86, 543, - 519, 166, 520, 86, 521, 86, 544, 531, 532, 547, - 550, 546, 553, 86, 549, 551, 86, 533, 534, 535, - 536, 537, 554, 552, 538, 86, 86, 86, 86, 86, - 556, 563, 555, 558, 561, 86, 86, 86, 86, 564, - 86, 86, 560, 568, 86, 86, 559, 86, 557, 86, - 562, 86, 566, 86, 86, 567, 565, 86, 571, 578, - 570, 572, 573, 575, 86, 574, 86, 576, 577, 86, - - 582, 579, 580, 86, 86, 585, 86, 583, 86, 86, - 86, 601, 86, 86, 86, 86, 165, 86, 603, 581, - 591, 592, 584, 587, 602, 586, 588, 589, 590, 86, - 86, 606, 593, 604, 594, 86, 86, 86, 86, 605, - 595, 86, 86, 86, 608, 609, 610, 611, 596, 597, - 86, 86, 598, 599, 86, 613, 600, 607, 615, 86, - 86, 86, 86, 618, 614, 616, 619, 86, 86, 86, - 612, 620, 86, 86, 617, 86, 86, 625, 623, 86, - 624, 86, 86, 621, 86, 626, 86, 86, 86, 631, - 622, 627, 632, 86, 86, 86, 630, 633, 86, 635, - - 629, 628, 86, 86, 638, 86, 634, 636, 86, 637, - 86, 640, 86, 86, 86, 86, 642, 639, 86, 645, - 86, 643, 86, 86, 86, 86, 641, 653, 86, 656, - 647, 86, 86, 86, 644, 646, 86, 654, 648, 652, - 649, 650, 651, 655, 658, 657, 661, 659, 86, 86, - 86, 660, 663, 86, 86, 666, 86, 665, 86, 86, - 86, 86, 86, 86, 669, 662, 86, 672, 86, 86, - 668, 673, 86, 664, 86, 86, 86, 675, 86, 667, - 86, 86, 670, 671, 674, 690, 86, 677, 678, 86, - 676, 86, 679, 689, 86, 86, 687, 680, 694, 681, - - 692, 688, 693, 86, 86, 682, 86, 683, 691, 695, - 684, 685, 86, 696, 86, 86, 86, 686, 697, 698, - 702, 701, 699, 86, 86, 700, 86, 706, 86, 86, - 704, 703, 705, 86, 709, 86, 711, 86, 86, 86, - 86, 86, 715, 86, 86, 86, 707, 86, 708, 718, - 713, 86, 712, 86, 710, 714, 719, 86, 716, 722, - 86, 724, 726, 170, 720, 717, 721, 725, 86, 723, - 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, - 733, 735, 727, 746, 86, 86, 728, 730, 86, 731, - 734, 729, 737, 732, 738, 86, 739, 740, 741, 86, - - 742, 86, 86, 86, 86, 86, 743, 86, 747, 86, - 163, 86, 86, 744, 752, 765, 745, 86, 748, 753, - 86, 755, 86, 751, 754, 749, 756, 86, 750, 757, - 758, 86, 759, 86, 760, 86, 761, 86, 763, 86, - 86, 762, 86, 86, 766, 86, 86, 86, 86, 764, - 769, 770, 86, 768, 86, 774, 773, 86, 86, 86, - 86, 86, 767, 776, 86, 778, 86, 780, 86, 86, - 86, 771, 86, 772, 86, 783, 777, 775, 779, 86, - 787, 86, 86, 781, 86, 86, 86, 788, 790, 86, - 782, 784, 86, 791, 786, 785, 792, 793, 789, 794, - - 86, 795, 86, 86, 86, 86, 802, 796, 797, 798, - 799, 86, 86, 86, 86, 86, 800, 804, 801, 805, - 803, 86, 86, 86, 86, 808, 807, 86, 809, 810, - 86, 86, 86, 86, 812, 86, 814, 816, 86, 86, - 86, 806, 811, 813, 817, 86, 86, 823, 86, 161, - 86, 825, 815, 86, 819, 821, 820, 822, 818, 86, - 826, 827, 86, 86, 86, 824, 86, 828, 830, 86, - 86, 829, 834, 836, 832, 86, 831, 86, 86, 86, - 835, 86, 86, 86, 837, 840, 86, 839, 86, 833, - 841, 86, 847, 844, 86, 86, 842, 86, 86, 843, - - 86, 86, 838, 86, 849, 850, 854, 845, 846, 86, - 852, 86, 86, 848, 856, 86, 862, 851, 853, 86, - 86, 855, 86, 860, 857, 86, 863, 858, 861, 86, - 86, 86, 864, 866, 86, 86, 86, 859, 865, 86, - 872, 86, 86, 867, 86, 873, 86, 86, 86, 86, - 86, 874, 868, 869, 881, 870, 879, 86, 86, 871, - 86, 86, 875, 876, 86, 86, 86, 877, 86, 878, - 86, 86, 880, 86, 86, 883, 884, 888, 882, 86, - 86, 86, 86, 86, 885, 896, 889, 886, 895, 887, - 890, 86, 897, 86, 86, 86, 899, 891, 892, 893, - - 894, 86, 86, 86, 86, 898, 901, 903, 902, 86, - 86, 86, 900, 86, 86, 86, 908, 907, 86, 904, - 909, 86, 906, 905, 86, 914, 911, 86, 86, 912, - 86, 86, 170, 913, 919, 86, 915, 920, 910, 917, - 86, 86, 916, 918, 921, 86, 86, 86, 86, 922, - 925, 86, 928, 86, 86, 929, 924, 931, 86, 86, - 923, 86, 926, 930, 932, 86, 86, 935, 86, 86, - 933, 86, 927, 86, 86, 937, 941, 86, 86, 86, - 938, 86, 86, 86, 934, 942, 936, 86, 943, 86, - 86, 86, 940, 86, 939, 86, 944, 957, 86, 956, - - 86, 958, 954, 946, 945, 86, 955, 947, 86, 959, - 948, 86, 86, 967, 949, 961, 965, 950, 86, 962, - 86, 963, 86, 86, 951, 952, 968, 953, 960, 86, - 86, 86, 86, 964, 86, 977, 86, 966, 86, 969, - 970, 86, 971, 86, 86, 972, 984, 980, 982, 976, - 973, 86, 978, 86, 979, 86, 974, 975, 981, 86, - 986, 990, 86, 86, 983, 989, 991, 86, 987, 86, - 985, 86, 993, 86, 86, 1001, 992, 86, 994, 995, - 86, 996, 997, 86, 988, 86, 998, 1000, 86, 86, - 999, 86, 86, 86, 86, 86, 1004, 86, 1008, 86, - - 86, 1002, 1007, 86, 86, 1011, 86, 86, 1017, 86, - 1003, 1013, 1015, 1005, 1006, 1009, 86, 1010, 86, 86, - 1018, 1016, 86, 86, 1012, 1019, 86, 1020, 1021, 1014, - 1023, 1028, 86, 1025, 86, 86, 86, 1024, 1022, 86, - 86, 1027, 86, 1026, 1029, 86, 1030, 86, 86, 86, - 1031, 86, 86, 86, 1033, 86, 1038, 86, 1034, 86, - 1041, 86, 86, 86, 86, 86, 1032, 1042, 1039, 1036, - 1035, 1040, 86, 86, 1037, 86, 86, 1047, 86, 86, - 86, 1043, 1049, 86, 1044, 1045, 86, 1048, 1046, 86, - 1052, 1050, 1053, 1055, 1051, 86, 1057, 86, 1056, 86, - - 86, 86, 1054, 86, 86, 86, 86, 86, 1063, 1065, - 1060, 86, 1058, 1066, 86, 86, 1064, 86, 86, 1059, - 1068, 86, 1062, 86, 86, 86, 1070, 1061, 86, 1079, - 86, 86, 1067, 1074, 1076, 86, 86, 86, 1069, 86, - 1072, 1071, 86, 1073, 86, 1080, 1077, 86, 1075, 1081, - 1078, 86, 1085, 1084, 86, 86, 1083, 86, 1082, 1087, - 1088, 86, 86, 86, 86, 1086, 86, 86, 86, 1098, - 86, 1091, 1093, 1099, 1089, 86, 1101, 1090, 86, 86, - 86, 86, 86, 1092, 86, 1104, 1094, 1096, 1106, 1095, - 1097, 86, 1100, 1105, 1102, 86, 86, 86, 86, 86, - - 1113, 1103, 1110, 86, 1112, 1114, 86, 86, 1108, 86, - 1115, 86, 86, 86, 1107, 1118, 1109, 1120, 86, 1111, - 86, 86, 86, 86, 86, 1117, 86, 1116, 1122, 1123, - 1126, 86, 1130, 1119, 86, 1127, 170, 1128, 1121, 86, - 86, 86, 1124, 1129, 1125, 1133, 1131, 86, 86, 86, - 86, 86, 86, 1146, 1132, 86, 1149, 86, 86, 1147, - 1134, 86, 1136, 1137, 86, 1151, 86, 1175, 86, 1138, - 86, 1135, 1139, 86, 86, 1154, 1140, 86, 1141, 1148, - 1156, 1152, 1142, 1150, 1143, 1157, 86, 86, 1153, 1144, - 86, 1155, 86, 86, 1145, 86, 1158, 1160, 86, 86, - - 1163, 86, 86, 1166, 1159, 86, 86, 1162, 86, 1161, - 1164, 1165, 1171, 86, 1173, 1167, 1174, 1170, 1172, 1169, - 86, 1176, 86, 1168, 1177, 86, 86, 86, 86, 86, - 86, 86, 86, 86, 1189, 86, 1192, 86, 86, 86, - 1188, 1194, 1193, 86, 1191, 86, 1179, 1178, 86, 1180, - 86, 1181, 1190, 86, 1200, 1195, 1182, 1196, 1183, 86, - 86, 1199, 86, 86, 1184, 86, 86, 1197, 1201, 1185, - 1186, 1202, 1198, 86, 1207, 86, 1187, 86, 86, 1210, - 1203, 1204, 1208, 86, 1205, 86, 1211, 86, 86, 86, - 1215, 1206, 86, 1213, 86, 86, 86, 1209, 86, 1216, - - 86, 86, 1214, 1221, 1218, 86, 1212, 1219, 86, 86, - 1222, 1217, 86, 1224, 86, 86, 1220, 86, 86, 86, - 86, 86, 86, 86, 1223, 1231, 86, 1229, 1226, 1228, - 1230, 86, 1225, 1233, 86, 1227, 1237, 1232, 1234, 86, - 1235, 86, 86, 1236, 86, 86, 86, 86, 86, 178, - 1242, 1243, 1244, 1238, 86, 1239, 86, 1245, 1247, 1241, - 1240, 86, 1246, 1248, 86, 86, 86, 1252, 86, 86, - 86, 1249, 1253, 86, 86, 86, 1254, 1256, 1250, 1255, - 86, 86, 1251, 1257, 86, 1263, 1259, 86, 1258, 1265, - 86, 86, 86, 86, 1261, 86, 86, 1267, 1260, 1262, - - 86, 86, 86, 1269, 86, 1266, 1271, 1264, 86, 1272, - 1268, 86, 86, 86, 1270, 86, 1275, 1274, 1273, 1278, - 1276, 86, 86, 1281, 1277, 1282, 86, 86, 1280, 86, - 86, 86, 86, 1286, 1285, 86, 1283, 1279, 86, 86, - 86, 86, 86, 1290, 1292, 1293, 1296, 1294, 1284, 86, - 86, 86, 86, 1287, 1291, 86, 86, 1288, 1298, 1289, - 1295, 1297, 86, 86, 86, 1302, 86, 1299, 86, 1301, - 86, 86, 86, 1303, 1304, 86, 86, 86, 86, 1305, - 1309, 1300, 86, 86, 1307, 1306, 1310, 1312, 86, 1311, - 86, 1308, 86, 1316, 1317, 86, 86, 1320, 86, 86, - - 86, 1319, 1314, 86, 86, 86, 1313, 86, 1325, 86, - 1318, 1315, 86, 86, 86, 86, 86, 1323, 1322, 1331, - 86, 86, 1321, 1327, 170, 1324, 86, 1326, 86, 1332, - 86, 1333, 1328, 1334, 86, 1330, 86, 86, 86, 86, - 1329, 1339, 1341, 86, 1335, 1337, 1343, 1340, 1336, 1338, - 1344, 86, 86, 86, 86, 86, 86, 1347, 1346, 1342, - 86, 86, 86, 86, 86, 1348, 86, 1345, 1349, 1351, - 86, 86, 86, 1354, 86, 1350, 86, 1352, 1357, 86, - 86, 86, 1353, 86, 176, 1355, 1358, 1361, 1363, 86, - 1356, 1360, 1359, 1367, 86, 1368, 86, 1364, 86, 1365, - - 1362, 1369, 1366, 1370, 86, 1371, 86, 86, 86, 86, - 1373, 86, 86, 86, 86, 175, 86, 1377, 1376, 86, - 1372, 1380, 86, 86, 1384, 86, 1379, 1374, 86, 1375, - 86, 86, 1378, 1381, 1382, 1385, 1386, 86, 86, 86, - 86, 1383, 1388, 1389, 86, 86, 86, 1390, 1387, 86, - 86, 86, 86, 86, 86, 1391, 1396, 86, 1394, 1392, - 86, 86, 1403, 1397, 1393, 1395, 1401, 86, 86, 86, - 86, 1398, 1400, 86, 1399, 86, 1402, 1404, 1406, 86, - 86, 86, 1413, 86, 1415, 1407, 86, 1405, 86, 86, - 86, 1409, 1408, 86, 1410, 86, 1412, 1418, 86, 86, - - 86, 1416, 86, 1414, 1421, 1411, 86, 1417, 86, 86, - 1501, 1423, 1422, 86, 1420, 1419, 1424, 86, 86, 1428, - 1426, 1425, 1427, 86, 1429, 86, 1436, 1438, 1430, 86, - 1439, 1431, 1432, 86, 1437, 86, 1433, 1442, 86, 86, - 1440, 86, 1434, 86, 1443, 86, 1435, 1441, 86, 1445, - 1444, 86, 1447, 86, 86, 86, 1448, 1452, 1449, 86, - 86, 86, 1446, 86, 86, 86, 1455, 86, 1453, 1458, - 1459, 86, 1460, 1451, 1450, 86, 86, 86, 1456, 86, - 1454, 1461, 86, 1457, 86, 1468, 86, 1467, 1462, 86, - 1469, 1470, 1471, 1463, 86, 1464, 86, 1465, 86, 1466, - - 86, 1474, 1473, 86, 1477, 86, 1480, 1472, 86, 1478, - 86, 86, 1476, 1481, 1479, 86, 86, 86, 1475, 86, - 1487, 86, 1488, 86, 1483, 1482, 86, 86, 86, 86, - 86, 1489, 86, 1486, 1491, 1484, 1485, 86, 86, 1493, - 86, 1490, 1492, 86, 1494, 1497, 1498, 86, 1500, 86, - 1495, 86, 86, 86, 1502, 86, 86, 1503, 1499, 1506, - 86, 1508, 86, 1496, 1505, 86, 1509, 86, 86, 86, - 1513, 86, 1504, 1510, 86, 86, 1507, 86, 86, 1518, - 1516, 86, 86, 86, 86, 86, 1519, 86, 1511, 1521, - 1512, 1520, 1515, 86, 1514, 86, 1523, 86, 1517, 1524, - - 1525, 1522, 86, 86, 86, 86, 86, 1527, 1529, 1530, - 1531, 1526, 1528, 86, 1532, 86, 86, 86, 86, 86, - 1533, 1538, 1539, 1535, 86, 1536, 86, 86, 86, 1540, - 1542, 1541, 1537, 86, 1534, 86, 86, 86, 1546, 86, - 86, 86, 1543, 86, 170, 86, 1548, 86, 1545, 86, - 1554, 1555, 86, 86, 1544, 1550, 86, 86, 1556, 1551, - 1547, 1549, 1557, 86, 86, 86, 86, 1552, 86, 86, - 86, 1565, 1553, 1560, 86, 86, 86, 1558, 1562, 1563, - 86, 1569, 86, 1559, 1561, 1570, 86, 1564, 86, 86, - 1574, 86, 86, 1572, 1566, 1575, 86, 86, 1568, 86, - - 1567, 1577, 86, 86, 86, 1571, 86, 1578, 1573, 1576, - 86, 1579, 1586, 1585, 86, 86, 86, 1580, 1581, 1583, - 1587, 1582, 1584, 1588, 86, 1591, 1590, 86, 1589, 86, - 1592, 86, 86, 86, 86, 1593, 86, 86, 1596, 1597, - 86, 86, 86, 170, 86, 1600, 86, 86, 1605, 86, - 1595, 86, 86, 1594, 1598, 1606, 1602, 1599, 86, 1609, - 86, 1601, 1603, 86, 1604, 86, 86, 1607, 86, 86, - 1610, 1608, 86, 86, 86, 86, 86, 1612, 1616, 1611, - 86, 1613, 1617, 1614, 86, 1618, 86, 1622, 1615, 86, - 1619, 1623, 86, 1621, 1627, 1620, 86, 1626, 1624, 1628, - - 86, 86, 86, 1630, 86, 86, 1631, 86, 86, 86, - 1632, 86, 1625, 1636, 1637, 1629, 1635, 1638, 86, 86, - 86, 86, 1639, 86, 1633, 86, 1640, 1641, 86, 86, - 1634, 86, 86, 1642, 86, 86, 1644, 86, 86, 86, - 1643, 86, 1649, 86, 1645, 1648, 86, 1651, 1646, 86, - 1647, 1652, 86, 1655, 86, 1657, 86, 1650, 1656, 86, - 1658, 86, 1654, 1653, 86, 1660, 86, 86, 86, 86, - 86, 1664, 1659, 1661, 1668, 1662, 1663, 86, 86, 86, - 86, 86, 1669, 86, 1672, 86, 1675, 1665, 1667, 1666, - 86, 1674, 86, 86, 86, 86, 86, 86, 1670, 86, - - 1673, 86, 1676, 86, 1683, 1671, 86, 86, 86, 1684, - 1680, 1687, 1677, 1678, 1679, 86, 1682, 86, 1681, 1688, - 86, 1689, 86, 86, 1693, 86, 1685, 1686, 1690, 1691, - 1692, 86, 86, 86, 1695, 86, 86, 86, 1696, 86, - 86, 1699, 1703, 86, 1694, 1704, 1705, 86, 1700, 86, - 86, 1697, 86, 1698, 1708, 1702, 86, 1701, 86, 86, - 1709, 86, 1706, 1707, 86, 1710, 86, 86, 1715, 1716, - 86, 86, 168, 1713, 86, 86, 86, 1712, 1711, 86, - 1719, 86, 1720, 1721, 86, 1717, 1714, 1723, 86, 86, - 86, 86, 1718, 1724, 1725, 86, 1722, 86, 86, 1730, - - 1726, 1728, 86, 86, 86, 1733, 86, 1727, 86, 86, - 86, 1731, 86, 86, 1739, 1737, 86, 86, 1729, 86, - 86, 1734, 86, 1732, 86, 1740, 1738, 86, 1736, 1735, - 86, 1745, 86, 86, 1742, 1741, 86, 86, 1746, 1750, - 86, 1748, 1744, 86, 86, 1743, 86, 1751, 1749, 1754, - 1747, 86, 1753, 86, 86, 86, 86, 1752, 1757, 1761, - 1759, 1760, 86, 1755, 1756, 1758, 86, 86, 170, 86, - 86, 86, 1763, 86, 86, 86, 1771, 86, 86, 1762, - 86, 86, 1772, 1777, 1764, 1766, 86, 1765, 1769, 1767, - 1768, 1775, 86, 86, 86, 1776, 1779, 86, 1770, 1781, - - 1773, 1774, 1780, 86, 1783, 86, 86, 1785, 86, 86, - 86, 86, 86, 1778, 86, 86, 1790, 1787, 86, 1788, - 1784, 86, 1791, 1782, 86, 86, 86, 86, 1786, 1795, - 86, 1796, 1792, 86, 86, 86, 1789, 1803, 86, 166, - 1794, 1800, 1793, 86, 1801, 1797, 1798, 86, 86, 86, - 86, 1805, 1804, 1799, 86, 1808, 1802, 1810, 1807, 1812, - 1809, 1811, 86, 1813, 1817, 86, 86, 1806, 86, 86, - 86, 1814, 86, 1815, 86, 1816, 86, 86, 86, 86, - 86, 1818, 1824, 1823, 86, 1825, 1820, 1827, 86, 1826, - 1819, 86, 86, 86, 86, 86, 86, 1821, 86, 1822, - - 1829, 1830, 86, 1831, 86, 86, 86, 86, 86, 86, - 86, 86, 1832, 86, 86, 1828, 1833, 1841, 86, 86, - 1836, 1837, 1838, 1834, 86, 1835, 1842, 1839, 86, 86, - 1843, 1845, 86, 1848, 1849, 1840, 1844, 86, 1851, 86, - 1846, 86, 86, 1854, 86, 1847, 86, 86, 86, 86, - 1858, 86, 1856, 1850, 86, 1852, 86, 86, 86, 86, - 1857, 86, 86, 1853, 86, 1860, 1855, 1863, 1865, 1859, - 86, 86, 165, 1866, 1864, 1862, 1867, 86, 1868, 86, - 1861, 86, 1872, 1873, 86, 1869, 1874, 86, 86, 1875, - 1870, 1877, 1878, 86, 86, 86, 1871, 86, 86, 1876, - - 86, 1882, 1881, 86, 86, 1883, 86, 1879, 86, 86, - 86, 1891, 1892, 86, 1880, 1886, 86, 86, 1888, 1890, - 1885, 1889, 1884, 86, 86, 86, 86, 1887, 1898, 86, - 86, 86, 86, 1899, 86, 1900, 1893, 1894, 86, 1896, - 86, 1895, 1897, 1901, 86, 1904, 86, 1906, 86, 1908, - 1903, 1907, 86, 86, 1902, 86, 1905, 86, 1912, 86, - 1916, 1910, 86, 1909, 1911, 1917, 86, 86, 86, 86, - 86, 1924, 86, 1913, 1921, 1922, 1918, 1915, 1914, 1925, - 86, 86, 1919, 86, 86, 86, 1928, 86, 1923, 1926, - 1920, 86, 86, 1929, 1927, 1932, 86, 86, 1936, 86, - - 1934, 86, 86, 1930, 86, 1931, 1935, 1937, 86, 1933, - 86, 86, 86, 86, 86, 86, 1941, 86, 1940, 86, - 1950, 1938, 1942, 1944, 86, 1943, 86, 1939, 1945, 1948, - 86, 1946, 1951, 1947, 1953, 86, 86, 1952, 86, 86, - 86, 1957, 86, 1959, 86, 86, 86, 86, 86, 86, - 86, 1949, 1963, 86, 1965, 86, 1954, 1955, 1958, 1956, - 1966, 86, 1961, 86, 86, 1962, 1960, 86, 1964, 1968, - 86, 86, 1969, 86, 86, 170, 1974, 86, 86, 1970, - 86, 1967, 1972, 1973, 1977, 86, 1971, 1975, 86, 1981, - 86, 86, 1976, 86, 86, 86, 86, 1978, 86, 1980, - - 1979, 1983, 86, 1988, 86, 1982, 86, 1984, 1985, 86, - 86, 1995, 1986, 86, 1989, 2000, 1991, 86, 1987, 1992, - 86, 86, 1990, 86, 1993, 1994, 86, 1997, 1998, 86, - 86, 86, 1996, 86, 2001, 86, 86, 2002, 86, 86, - 86, 86, 1999, 86, 2006, 2007, 86, 86, 86, 86, - 2008, 86, 2011, 86, 2004, 2009, 2005, 2003, 2012, 86, - 86, 2010, 2019, 86, 2017, 2015, 2018, 2020, 2014, 86, - 86, 2013, 2016, 86, 2021, 86, 86, 86, 86, 2026, - 86, 2029, 2030, 86, 2031, 86, 86, 86, 2022, 2023, - 86, 2024, 2027, 86, 2028, 86, 2025, 2033, 86, 86, - - 2034, 2037, 86, 86, 2039, 86, 2032, 2038, 2035, 86, - 86, 2036, 2040, 2041, 2043, 2048, 86, 86, 2045, 86, - 86, 2044, 86, 2042, 86, 2046, 2047, 86, 86, 2049, - 2050, 86, 2051, 86, 86, 86, 2055, 86, 2053, 2054, - 2057, 86, 2056, 86, 86, 86, 86, 86, 163, 2052, - 2065, 86, 2067, 2058, 2059, 2060, 86, 2068, 86, 86, - 2061, 86, 2063, 2062, 86, 2064, 2070, 2066, 86, 2074, - 2071, 86, 2072, 2069, 86, 86, 86, 2078, 86, 2073, - 2075, 86, 86, 2080, 86, 86, 86, 86, 2083, 2084, - 86, 2086, 86, 86, 2076, 86, 2091, 2077, 86, 86, - - 86, 86, 86, 86, 2081, 2085, 86, 2079, 2082, 2088, - 2089, 2093, 86, 86, 2092, 86, 2090, 86, 2087, 86, - 2094, 2095, 2096, 86, 2099, 86, 2097, 2103, 86, 2098, - 2102, 86, 86, 86, 2106, 2101, 2109, 86, 2105, 2100, - 86, 86, 86, 2107, 2110, 86, 2112, 86, 2104, 86, - 86, 2108, 2111, 86, 86, 86, 86, 2116, 86, 2119, - 2120, 2121, 2115, 86, 86, 86, 86, 86, 86, 2113, - 86, 86, 2114, 2117, 2124, 86, 2129, 86, 86, 2123, - 2128, 86, 2118, 2122, 86, 2126, 86, 2130, 2133, 86, - 2125, 86, 2134, 2127, 86, 2135, 2131, 2132, 2137, 86, - - 86, 86, 86, 2136, 2138, 2141, 86, 2142, 86, 86, - 86, 86, 2139, 2148, 2145, 86, 2143, 2140, 86, 86, - 86, 86, 86, 2151, 2153, 86, 2155, 2144, 86, 2154, - 2146, 2147, 86, 2149, 2152, 2150, 86, 86, 2160, 86, - 2162, 2156, 2161, 86, 2164, 2163, 86, 2157, 2165, 86, - 86, 86, 2158, 86, 86, 2169, 2167, 2159, 86, 86, - 86, 86, 86, 2171, 86, 2168, 86, 2173, 2175, 86, - 2170, 2177, 2172, 86, 86, 2166, 170, 86, 2178, 86, - 86, 2181, 86, 86, 86, 86, 2176, 2174, 2179, 2185, - 86, 2187, 2182, 2180, 2183, 86, 2188, 86, 2186, 2189, - - 86, 2191, 2184, 86, 86, 2190, 86, 86, 86, 2192, - 2194, 2193, 86, 86, 86, 2197, 86, 2195, 2196, 86, - 2199, 86, 86, 2203, 86, 86, 2198, 2202, 2200, 86, - 86, 86, 2207, 2201, 2204, 2205, 2206, 2208, 86, 86, - 86, 86, 86, 86, 2215, 2213, 86, 86, 86, 2210, - 86, 2214, 86, 86, 86, 2220, 86, 2217, 86, 2209, - 2211, 86, 2212, 86, 86, 2216, 2221, 2219, 86, 2225, - 2218, 86, 2223, 2226, 2222, 86, 86, 86, 2224, 86, - 2229, 86, 2228, 2227, 2231, 86, 86, 86, 2237, 2230, - 2232, 86, 86, 2233, 86, 2234, 2235, 86, 2239, 86, - - 2236, 2240, 2242, 86, 86, 2244, 86, 86, 2238, 86, - 2241, 2248, 2243, 86, 2245, 2247, 86, 86, 86, 86, - 86, 86, 2253, 2250, 86, 86, 86, 86, 86, 86, - 2246, 86, 2249, 2254, 86, 86, 86, 2262, 2256, 2257, - 2252, 2251, 86, 2258, 86, 86, 2255, 2259, 86, 2261, - 2263, 2267, 86, 86, 86, 2260, 2264, 2266, 86, 2271, - 86, 2270, 2268, 86, 86, 2265, 86, 86, 2269, 2273, - 86, 2276, 2274, 2272, 2277, 86, 86, 86, 2275, 86, - 86, 2279, 2282, 86, 2278, 2280, 2284, 86, 86, 2281, - 2285, 86, 86, 2287, 86, 86, 2289, 2286, 2283, 86, - - 2291, 2290, 86, 86, 86, 2295, 86, 2292, 86, 86, - 2299, 86, 86, 2288, 2296, 2300, 86, 86, 86, 2297, - 2298, 2293, 2304, 86, 2294, 2301, 86, 2305, 86, 86, - 2308, 2302, 2303, 86, 86, 86, 86, 2310, 2309, 86, - 2314, 86, 86, 2306, 86, 2316, 86, 2312, 86, 2307, - 86, 2317, 2311, 86, 2315, 2313, 86, 2318, 2319, 86, - 86, 2323, 86, 86, 2320, 2321, 2325, 86, 2322, 86, - 86, 2326, 86, 86, 2327, 2329, 2328, 86, 2331, 86, - 86, 2324, 2330, 86, 2332, 2336, 86, 86, 86, 2334, - 2333, 86, 2335, 86, 86, 86, 86, 86, 2337, 86, - - 2343, 86, 86, 86, 2339, 2338, 2347, 2341, 2344, 2342, - 86, 2345, 2349, 86, 86, 2348, 2340, 2346, 86, 2350, - 2352, 86, 86, 2358, 86, 2353, 86, 86, 2360, 86, - 86, 86, 2351, 2354, 86, 2357, 2359, 86, 2363, 2355, - 86, 86, 2364, 2367, 170, 86, 2369, 2356, 2361, 86, - 2362, 2370, 86, 2365, 86, 2371, 2372, 2373, 86, 86, - 2366, 86, 86, 2376, 86, 2375, 2368, 2374, 86, 2377, - 86, 2381, 86, 86, 2382, 86, 2384, 86, 2385, 2380, - 86, 2387, 2386, 2378, 86, 2388, 86, 2383, 86, 2390, - 86, 86, 86, 2389, 2379, 86, 2391, 86, 86, 86, - - 86, 2393, 86, 86, 2396, 86, 86, 86, 2399, 86, - 2392, 2394, 86, 86, 2403, 2398, 2405, 86, 86, 86, - 86, 2401, 2406, 2395, 2400, 2397, 86, 2402, 2407, 86, - 86, 2408, 86, 86, 2404, 86, 86, 2413, 2410, 2416, - 86, 2411, 86, 86, 2417, 2409, 2414, 86, 86, 2412, - 86, 86, 86, 2415, 86, 86, 86, 86, 2426, 86, - 86, 2418, 2419, 2424, 86, 2430, 2433, 86, 2428, 2422, - 2420, 2427, 2421, 2423, 2429, 2425, 86, 2432, 2431, 86, - 86, 86, 86, 2435, 2434, 86, 86, 2439, 2440, 86, - 86, 86, 2441, 161, 2436, 86, 2437, 86, 2438, 2442, - - 86, 86, 2445, 86, 2448, 86, 2443, 86, 2444, 2449, - 86, 86, 2446, 86, 86, 2447, 2450, 2452, 2451, 2455, - 86, 2456, 86, 86, 2458, 86, 2454, 2453, 86, 2460, - 86, 86, 86, 2463, 86, 86, 2462, 2464, 86, 86, - 86, 86, 2457, 86, 86, 86, 2459, 2461, 2466, 2465, - 2470, 2471, 86, 2473, 86, 2468, 86, 2467, 86, 86, - 2477, 86, 2469, 2472, 2475, 86, 2479, 86, 2476, 86, - 86, 86, 2482, 86, 2474, 2478, 2485, 86, 86, 86, - 2480, 86, 86, 86, 2481, 86, 2483, 2489, 2490, 86, - 2492, 86, 2484, 86, 2495, 86, 2488, 86, 2486, 86, - - 86, 2491, 2487, 86, 86, 86, 2493, 2497, 2494, 86, - 2502, 86, 86, 2498, 2504, 86, 86, 2496, 2505, 2508, - 2503, 2499, 2500, 86, 86, 86, 86, 86, 2509, 2510, - 86, 2501, 2511, 2506, 86, 2507, 86, 86, 86, 2513, - 86, 2515, 2517, 2518, 2520, 86, 2521, 86, 2512, 86, - 86, 2514, 86, 2524, 2525, 2519, 86, 86, 86, 86, - 2516, 2526, 2523, 86, 86, 86, 2522, 2529, 86, 86, - 86, 2528, 2530, 2535, 2531, 2536, 86, 2532, 2533, 86, - 2537, 86, 2527, 86, 2534, 86, 86, 86, 2541, 86, - 2542, 86, 2543, 86, 2546, 2540, 86, 170, 2545, 86, - - 2544, 86, 2547, 2538, 86, 2539, 2552, 86, 86, 86, - 86, 86, 86, 86, 86, 2563, 86, 2550, 2554, 2548, - 2551, 2549, 2555, 2553, 2558, 86, 86, 2556, 2557, 2559, - 2560, 86, 86, 2564, 2561, 2565, 86, 86, 86, 86, - 2566, 2568, 2569, 2562, 2567, 86, 86, 86, 86, 2571, - 86, 86, 2572, 86, 2570, 86, 2573, 2578, 2574, 86, - 2577, 86, 86, 86, 86, 2575, 86, 2580, 2581, 2582, - 2583, 86, 2576, 86, 86, 2579, 86, 86, 2584, 86, - 86, 2589, 86, 2585, 2588, 2586, 86, 86, 86, 86, - 86, 2591, 2590, 86, 2595, 86, 2598, 2587, 86, 86, - - 2597, 86, 86, 2594, 2599, 86, 2600, 2592, 2593, 86, - 86, 86, 86, 2596, 86, 2604, 86, 2601, 2606, 86, - 2602, 2609, 86, 2610, 2607, 86, 86, 86, 2603, 86, - 2608, 2613, 2605, 2611, 86, 86, 2612, 86, 2615, 86, - 2614, 86, 2616, 86, 2618, 2619, 2620, 2621, 2622, 86, - 86, 86, 86, 2617, 2624, 86, 86, 86, 86, 2623, - 86, 86, 86, 2628, 2633, 86, 86, 2631, 86, 2625, - 2626, 2632, 2635, 2627, 2634, 86, 86, 2636, 86, 86, - 86, 86, 2630, 86, 2637, 2639, 2629, 86, 2644, 86, - 2641, 86, 2646, 86, 86, 2642, 86, 86, 86, 86, - - 2640, 2638, 2645, 2643, 2649, 86, 86, 86, 2653, 2650, - 86, 2648, 2647, 2654, 86, 2655, 2651, 2652, 86, 86, - 86, 86, 86, 2659, 86, 2658, 86, 86, 2657, 86, - 86, 86, 2663, 2703, 2662, 86, 2656, 86, 2660, 86, - 2661, 86, 2666, 2667, 86, 2668, 86, 2669, 86, 2664, - 2665, 2670, 86, 2671, 86, 86, 2674, 2672, 86, 2673, - 86, 2675, 86, 86, 86, 86, 86, 86, 2682, 86, - 2676, 2684, 86, 2685, 86, 2678, 86, 86, 86, 86, - 86, 86, 2677, 2681, 2679, 2683, 2680, 2686, 2688, 2687, - 2689, 86, 86, 2694, 86, 86, 2691, 2696, 86, 2690, - - 2692, 86, 86, 86, 2695, 86, 86, 170, 86, 86, - 2705, 86, 2693, 86, 86, 86, 2699, 86, 86, 2704, - 2701, 86, 2698, 2706, 2712, 86, 2707, 2697, 2708, 2700, - 2702, 86, 86, 2709, 2729, 86, 86, 2714, 86, 2710, - 2715, 2711, 2716, 86, 86, 2713, 2717, 86, 86, 2718, - 86, 2719, 86, 2720, 2721, 2722, 86, 2723, 86, 86, - 86, 86, 86, 86, 2731, 86, 86, 86, 86, 86, - 2735, 2724, 2736, 86, 86, 2740, 86, 2726, 2725, 2742, - 86, 2728, 2727, 2730, 2733, 2732, 2734, 86, 2737, 2738, - 86, 86, 86, 86, 86, 86, 2739, 86, 86, 2741, - - 2745, 86, 86, 3483, 86, 2752, 86, 2753, 86, 2743, - 2744, 2751, 2746, 2747, 2754, 86, 2748, 2749, 86, 2757, - 86, 2750, 2758, 86, 2756, 2759, 86, 86, 86, 86, - 86, 86, 86, 2755, 86, 2764, 86, 86, 86, 2768, - 2770, 2767, 2761, 2763, 2760, 2769, 86, 2762, 2771, 86, - 86, 86, 2765, 86, 2766, 86, 86, 86, 86, 86, - 2773, 86, 2777, 2778, 86, 86, 86, 2775, 2782, 2772, - 2783, 86, 2774, 86, 2786, 86, 2776, 86, 86, 2779, - 2780, 2784, 86, 86, 2781, 86, 2789, 86, 2787, 2791, - 86, 2785, 86, 2788, 2792, 86, 86, 86, 2790, 86, - - 2793, 2797, 86, 86, 86, 2794, 86, 2800, 2799, 2798, - 2801, 86, 2795, 2803, 86, 86, 2796, 86, 86, 86, - 2804, 86, 2806, 2802, 2809, 86, 2805, 86, 2810, 86, - 2807, 2812, 86, 86, 86, 86, 86, 86, 86, 2808, - 2818, 86, 2813, 2811, 2815, 2816, 2814, 2817, 2821, 86, - 86, 86, 2820, 86, 2819, 2822, 2823, 86, 86, 86, - 86, 86, 2825, 86, 86, 86, 2826, 2824, 86, 2828, - 2831, 2829, 86, 2832, 2834, 86, 2830, 2836, 2827, 2833, - 2835, 86, 86, 2838, 170, 86, 86, 86, 86, 2843, - 3483, 2840, 2839, 86, 86, 86, 86, 2845, 2844, 86, - - 86, 2837, 2848, 86, 2847, 2841, 2842, 2849, 86, 2846, - 2851, 86, 86, 2850, 2853, 2852, 86, 86, 86, 2854, - 86, 2855, 2856, 2858, 86, 86, 86, 86, 2859, 86, - 2860, 86, 2857, 86, 2865, 2861, 86, 2866, 86, 2863, - 86, 2867, 2862, 86, 86, 86, 86, 86, 2871, 86, - 2868, 2869, 2870, 86, 2864, 86, 86, 86, 2872, 86, - 2873, 2874, 86, 86, 2879, 86, 2876, 2875, 2877, 86, - 86, 2878, 2883, 86, 2880, 2881, 2885, 86, 86, 2884, - 86, 2888, 86, 86, 86, 86, 86, 2882, 2893, 86, - 2889, 86, 86, 86, 2891, 86, 86, 2886, 86, 2887, - - 2897, 2892, 2900, 2890, 2898, 86, 2901, 2895, 86, 2903, - 2894, 86, 86, 2896, 86, 86, 2902, 2904, 86, 2905, - 2899, 86, 86, 2907, 2909, 86, 2906, 86, 2910, 86, - 86, 2911, 86, 86, 2914, 2908, 86, 2916, 86, 2917, - 86, 2918, 86, 2912, 86, 86, 86, 2913, 2919, 86, - 2920, 2921, 86, 86, 2915, 86, 86, 2925, 2923, 86, - 2929, 2924, 2926, 86, 2930, 86, 2922, 2927, 2931, 86, - 86, 86, 86, 2932, 2935, 86, 2928, 86, 86, 2938, - 86, 86, 2939, 86, 2933, 2934, 2940, 86, 86, 2942, - 86, 86, 86, 2946, 86, 2936, 2943, 86, 2937, 86, - - 2947, 86, 2950, 2941, 86, 2949, 2945, 2951, 2948, 2944, - 86, 86, 2952, 86, 86, 86, 2957, 2953, 86, 86, - 86, 2956, 86, 2959, 2960, 86, 86, 86, 2962, 86, - 2954, 2961, 2963, 86, 2955, 86, 2965, 86, 2966, 86, - 2969, 86, 86, 2958, 86, 2973, 86, 86, 86, 2980, - 86, 86, 2964, 86, 2981, 86, 2967, 2968, 2972, 2970, - 86, 2974, 2971, 2975, 2977, 86, 86, 2978, 3020, 2982, - 2984, 2976, 86, 2979, 2983, 86, 2985, 86, 86, 2986, - 86, 2987, 86, 2988, 86, 2989, 86, 86, 2990, 86, - 86, 2991, 2993, 86, 86, 2995, 86, 86, 86, 2997, - - 3001, 86, 86, 2994, 86, 2998, 3483, 2992, 3002, 86, - 86, 3006, 2996, 3003, 3005, 86, 86, 2999, 3000, 86, - 3004, 3007, 86, 86, 3008, 3009, 86, 86, 86, 86, - 3015, 86, 3010, 86, 3014, 86, 3011, 3012, 3013, 3016, - 86, 86, 3017, 3021, 86, 86, 86, 86, 3022, 86, - 3025, 86, 3019, 86, 3024, 86, 3026, 3023, 86, 3018, - 3027, 86, 3028, 86, 3032, 86, 86, 3029, 86, 86, - 3034, 86, 3030, 3031, 3036, 3033, 86, 3039, 86, 86, - 3037, 86, 86, 86, 86, 3044, 3042, 3043, 86, 86, - 3040, 86, 86, 3035, 3046, 86, 3038, 3045, 86, 3049, - - 3041, 86, 3050, 3483, 3047, 86, 3048, 3051, 86, 3052, - 86, 3053, 86, 86, 3054, 3055, 3058, 86, 3057, 86, - 3056, 86, 86, 86, 3059, 86, 3060, 3061, 86, 86, - 86, 86, 3067, 86, 3065, 3062, 3483, 3063, 86, 3069, - 86, 86, 86, 86, 3064, 3070, 86, 3071, 3066, 86, - 3073, 3072, 3074, 86, 86, 86, 3068, 86, 3075, 3078, - 86, 86, 86, 86, 3082, 3081, 86, 86, 3076, 86, - 3079, 86, 3086, 86, 3077, 3080, 86, 3085, 86, 3083, - 86, 3088, 3089, 3092, 86, 3084, 86, 3094, 86, 3095, - 86, 3087, 86, 86, 3090, 3097, 86, 86, 86, 86, - - 86, 86, 3100, 86, 3091, 3093, 3102, 3103, 86, 3098, - 3106, 86, 3105, 3096, 3099, 3101, 86, 86, 86, 3109, - 3104, 86, 86, 3112, 86, 86, 3114, 86, 86, 3117, - 86, 86, 86, 3115, 3107, 3110, 3108, 3118, 86, 86, - 86, 3111, 3121, 86, 86, 3113, 3119, 86, 3126, 3116, - 86, 3123, 86, 3124, 86, 86, 3130, 86, 86, 3120, - 86, 86, 3122, 3132, 3128, 86, 86, 3125, 3133, 3127, - 86, 3134, 86, 3131, 3137, 3129, 3138, 86, 3135, 86, - 86, 3136, 3139, 3140, 3143, 86, 86, 86, 86, 86, - 3141, 3142, 3144, 3146, 86, 3149, 86, 86, 86, 86, - - 86, 86, 3154, 86, 86, 86, 86, 3145, 86, 3150, - 86, 3147, 3148, 3160, 3153, 3157, 3151, 3158, 86, 3159, - 86, 3156, 86, 3155, 3161, 3152, 86, 3162, 3163, 86, - 3164, 86, 3165, 86, 3166, 86, 86, 3169, 86, 3167, - 86, 3171, 86, 86, 86, 3170, 86, 86, 86, 86, - 3177, 3178, 86, 86, 86, 86, 86, 3172, 3184, 86, - 3185, 86, 3168, 86, 86, 3186, 3173, 3175, 3174, 3176, - 3181, 86, 3183, 3180, 86, 3182, 86, 86, 86, 3179, - 86, 3189, 3191, 86, 3187, 3192, 86, 86, 86, 3195, - 3196, 86, 3193, 3188, 3194, 86, 3197, 86, 3190, 3198, - - 86, 86, 3199, 86, 86, 3200, 86, 86, 3201, 86, - 86, 3202, 3204, 86, 86, 3206, 86, 86, 3205, 86, - 3483, 3207, 86, 86, 3203, 86, 86, 86, 86, 3208, - 86, 3216, 3217, 3220, 3209, 3211, 3210, 3219, 3212, 3218, - 3213, 3214, 86, 86, 86, 3222, 3215, 3224, 86, 86, - 3221, 3225, 86, 3226, 3227, 86, 86, 3223, 86, 3230, - 86, 3228, 3231, 86, 3232, 3233, 86, 86, 3234, 3235, - 3239, 86, 3236, 86, 86, 3237, 3238, 3229, 86, 3240, - 86, 3242, 86, 86, 86, 86, 86, 86, 86, 3241, - 3248, 86, 3247, 86, 86, 86, 86, 86, 3244, 86, - - 3252, 3243, 3251, 3253, 86, 3245, 3246, 86, 3249, 3256, - 3257, 86, 3254, 86, 3259, 86, 3258, 3255, 3250, 3260, - 86, 3261, 86, 86, 86, 86, 3266, 86, 3263, 3268, - 3262, 3267, 86, 3264, 86, 86, 3265, 86, 86, 86, - 3275, 86, 3270, 3272, 3273, 3276, 86, 3278, 86, 86, - 3269, 86, 3277, 3279, 86, 3271, 3274, 86, 3282, 86, - 3283, 86, 3281, 86, 3280, 3285, 86, 3286, 86, 3287, - 86, 86, 3284, 3288, 86, 3289, 86, 3290, 86, 3291, - 86, 3292, 86, 86, 3295, 86, 86, 86, 86, 3299, - 86, 86, 3294, 3301, 86, 3296, 86, 3293, 86, 3297, - - 86, 86, 86, 86, 3305, 3306, 86, 86, 3298, 86, - 3300, 3302, 3310, 3303, 3304, 86, 3307, 3308, 86, 86, - 3312, 3315, 86, 86, 3311, 3309, 3314, 86, 86, 86, - 86, 86, 86, 3313, 3317, 86, 3316, 3321, 86, 86, - 86, 3322, 3323, 86, 86, 86, 3327, 3318, 3319, 3326, - 86, 3320, 3329, 86, 3324, 3330, 86, 86, 3328, 3331, - 86, 86, 86, 86, 86, 86, 3325, 3334, 86, 86, - 3333, 86, 86, 3332, 3339, 86, 3336, 3335, 86, 3338, - 3340, 86, 3342, 86, 3344, 3343, 3341, 3337, 86, 86, - 86, 86, 86, 3345, 86, 86, 86, 3351, 86, 3346, - - 3349, 3353, 3350, 86, 3348, 3354, 86, 86, 3356, 3357, - 3359, 86, 86, 3347, 86, 3352, 3361, 86, 3355, 86, - 3362, 3360, 3363, 86, 3364, 86, 86, 3358, 86, 86, - 86, 3367, 86, 3365, 3368, 3369, 86, 3372, 86, 86, - 86, 86, 86, 86, 3375, 86, 3366, 3376, 86, 3378, - 86, 3371, 3373, 3374, 3379, 86, 86, 3370, 3382, 86, - 3377, 3381, 86, 3384, 3385, 86, 86, 3386, 86, 86, - 86, 3380, 3389, 3390, 86, 86, 3387, 3383, 86, 86, - 86, 3395, 86, 86, 3391, 3394, 86, 3392, 3388, 3396, - 86, 86, 86, 86, 3393, 86, 3400, 86, 86, 86, - - 3402, 86, 86, 86, 3397, 3399, 3398, 3407, 3408, 3409, - 86, 3404, 3405, 3401, 86, 86, 3403, 86, 3413, 86, - 3406, 86, 3415, 86, 3416, 86, 3414, 86, 86, 86, - 3417, 3421, 3418, 3411, 3410, 86, 3412, 86, 3422, 86, - 3419, 86, 3424, 86, 86, 86, 3423, 86, 3420, 3425, - 86, 86, 3430, 86, 3427, 86, 86, 3433, 86, 3434, - 86, 86, 86, 3426, 86, 86, 3437, 86, 3432, 3428, - 3429, 3435, 3431, 86, 3436, 86, 3441, 86, 3442, 86, - 3440, 86, 3445, 3438, 3439, 86, 86, 3447, 86, 3448, - 3443, 86, 86, 86, 3452, 86, 3449, 86, 86, 3450, - - 3454, 86, 3453, 86, 3446, 3444, 3455, 86, 3456, 86, - 3457, 86, 3451, 86, 3461, 86, 3459, 86, 86, 86, - 86, 86, 86, 3463, 3464, 86, 3467, 86, 3458, 3468, - 86, 3483, 3460, 86, 3471, 86, 3462, 3472, 86, 3465, - 3466, 3469, 3473, 3474, 86, 86, 3470, 3475, 86, 86, - 86, 86, 3476, 86, 3477, 3478, 3481, 86, 3482, 86, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3479, 3483, 3480, 47, 47, 47, 47, 47, 47, 47, - 52, 52, 52, 52, 52, 52, 52, 57, 57, 57, - 57, 57, 57, 57, 63, 63, 63, 63, 63, 63, - - 63, 68, 68, 68, 68, 68, 68, 68, 74, 74, - 74, 74, 74, 74, 74, 80, 80, 80, 80, 80, - 80, 80, 89, 89, 3483, 89, 89, 89, 89, 160, - 160, 3483, 3483, 3483, 160, 160, 162, 162, 3483, 3483, - 162, 3483, 162, 164, 3483, 3483, 3483, 3483, 3483, 164, - 167, 167, 3483, 3483, 3483, 167, 167, 169, 3483, 3483, - 3483, 3483, 3483, 169, 171, 171, 3483, 171, 171, 171, - 171, 174, 3483, 3483, 3483, 3483, 3483, 174, 177, 177, - 3483, 3483, 3483, 177, 177, 90, 90, 3483, 90, 90, - 90, 90, 17, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483 + 341, 86, 333, 86, 86, 86, 343, 336, 345, 86, + 86, 344, 86, 86, 86, 347, 86, 86, 346, 349, + 86, 86, 354, 86, 352, 350, 86, 86, 86, 86, + + 348, 365, 355, 353, 351, 359, 356, 86, 86, 86, + 360, 86, 357, 361, 86, 86, 362, 358, 363, 368, + 86, 364, 86, 86, 86, 86, 374, 366, 367, 370, + 373, 375, 86, 86, 377, 369, 86, 86, 382, 372, + 86, 376, 86, 380, 86, 378, 381, 86, 384, 86, + 379, 385, 86, 86, 86, 170, 86, 86, 388, 86, + 86, 86, 383, 395, 391, 393, 396, 389, 386, 86, + 86, 86, 86, 86, 399, 387, 390, 86, 397, 392, + 86, 86, 398, 86, 394, 400, 86, 86, 86, 402, + 406, 407, 86, 409, 404, 401, 86, 403, 86, 410, + + 408, 86, 86, 86, 412, 86, 413, 86, 86, 86, + 86, 416, 405, 86, 417, 420, 86, 86, 175, 411, + 422, 86, 418, 414, 415, 419, 86, 86, 424, 423, + 86, 421, 86, 429, 86, 428, 425, 86, 427, 86, + 430, 86, 86, 86, 86, 86, 86, 86, 436, 86, + 86, 86, 437, 426, 439, 86, 86, 435, 86, 442, + 433, 432, 447, 438, 434, 431, 86, 86, 86, 444, + 440, 86, 86, 441, 443, 448, 86, 86, 86, 446, + 86, 463, 86, 449, 86, 456, 445, 86, 86, 458, + 466, 467, 170, 464, 465, 457, 450, 86, 86, 451, + + 459, 470, 460, 468, 452, 453, 454, 455, 469, 86, + 471, 86, 86, 86, 86, 461, 86, 86, 462, 480, + 86, 86, 86, 478, 86, 482, 86, 481, 474, 472, + 479, 475, 473, 86, 476, 477, 86, 483, 485, 86, + 86, 484, 86, 86, 490, 86, 491, 86, 492, 86, + 86, 486, 86, 509, 496, 497, 86, 493, 489, 487, + 86, 86, 488, 86, 494, 498, 86, 495, 499, 501, + 503, 502, 86, 86, 500, 504, 86, 510, 511, 86, + 86, 512, 508, 86, 86, 86, 86, 526, 505, 86, + 86, 506, 581, 507, 86, 513, 86, 514, 86, 530, + + 525, 528, 86, 515, 529, 527, 86, 516, 86, 531, + 533, 543, 517, 542, 546, 518, 86, 519, 544, 520, + 170, 547, 86, 545, 86, 532, 86, 86, 553, 86, + 86, 551, 521, 86, 86, 522, 86, 523, 168, 524, + 86, 548, 534, 535, 550, 549, 552, 556, 86, 86, + 555, 557, 536, 537, 538, 539, 540, 86, 86, 541, + 86, 558, 554, 559, 86, 86, 566, 86, 561, 562, + 564, 86, 86, 86, 567, 563, 86, 86, 571, 565, + 86, 560, 86, 569, 86, 86, 86, 568, 86, 86, + 570, 574, 575, 576, 86, 86, 573, 86, 578, 582, + + 583, 86, 572, 580, 579, 577, 86, 86, 86, 588, + 585, 586, 86, 589, 86, 86, 590, 584, 604, 86, + 86, 166, 86, 607, 86, 86, 587, 86, 591, 593, + 594, 595, 592, 86, 605, 609, 608, 86, 606, 86, + 615, 86, 596, 611, 597, 86, 86, 86, 86, 613, + 598, 612, 86, 614, 86, 616, 618, 86, 599, 600, + 610, 86, 601, 602, 86, 617, 603, 86, 621, 619, + 622, 86, 86, 86, 620, 623, 86, 86, 86, 86, + 628, 86, 626, 627, 86, 86, 86, 624, 629, 86, + 86, 86, 634, 630, 625, 635, 86, 86, 633, 86, + + 636, 86, 638, 632, 631, 86, 86, 641, 86, 637, + 639, 86, 640, 86, 643, 86, 86, 86, 86, 645, + 86, 642, 86, 649, 86, 647, 86, 86, 86, 644, + 86, 657, 677, 86, 651, 659, 646, 86, 648, 658, + 650, 86, 652, 86, 653, 654, 655, 656, 660, 86, + 86, 86, 86, 86, 664, 86, 668, 86, 662, 671, + 86, 663, 86, 661, 667, 86, 665, 86, 666, 86, + 670, 86, 86, 86, 673, 86, 674, 669, 678, 86, + 86, 86, 86, 672, 680, 86, 86, 86, 86, 711, + 679, 675, 86, 676, 86, 683, 681, 86, 695, 86, + + 682, 86, 684, 694, 697, 692, 86, 685, 693, 686, + 699, 696, 165, 698, 86, 687, 86, 688, 86, 700, + 689, 690, 707, 701, 86, 86, 86, 691, 86, 703, + 86, 702, 86, 708, 704, 706, 86, 705, 86, 714, + 709, 86, 86, 716, 86, 86, 710, 86, 86, 720, + 86, 86, 86, 86, 163, 712, 713, 718, 723, 717, + 86, 724, 719, 86, 86, 86, 715, 86, 170, 721, + 727, 729, 730, 722, 728, 731, 86, 86, 726, 725, + 86, 86, 86, 86, 86, 86, 86, 86, 732, 738, + 161, 86, 733, 740, 742, 744, 735, 86, 736, 734, + + 739, 86, 737, 743, 86, 746, 86, 86, 86, 745, + 748, 86, 86, 86, 86, 86, 752, 86, 747, 751, + 757, 86, 749, 86, 753, 758, 86, 750, 760, 86, + 808, 754, 86, 756, 755, 762, 759, 761, 86, 763, + 86, 86, 764, 86, 765, 86, 766, 86, 86, 86, + 86, 767, 86, 768, 771, 86, 773, 769, 770, 86, + 86, 86, 774, 86, 86, 775, 772, 779, 778, 86, + 86, 86, 86, 86, 781, 86, 783, 86, 86, 785, + 86, 86, 777, 86, 776, 86, 788, 86, 792, 780, + 782, 784, 86, 86, 86, 786, 787, 793, 86, 86, + + 86, 790, 789, 86, 86, 800, 795, 791, 86, 802, + 86, 796, 794, 803, 797, 798, 86, 799, 801, 86, + 807, 804, 86, 86, 805, 809, 86, 810, 86, 86, + 86, 86, 813, 812, 806, 814, 86, 86, 86, 86, + 86, 821, 86, 86, 817, 819, 86, 815, 86, 811, + 86, 818, 822, 86, 816, 86, 86, 828, 86, 820, + 86, 834, 826, 86, 829, 823, 825, 827, 86, 824, + 86, 830, 831, 832, 86, 86, 86, 833, 835, 86, + 86, 840, 86, 86, 836, 838, 842, 86, 841, 86, + 837, 86, 86, 86, 843, 86, 846, 86, 839, 86, + + 845, 847, 86, 853, 850, 86, 848, 844, 854, 86, + 849, 86, 86, 86, 855, 86, 856, 86, 851, 852, + 86, 858, 859, 86, 860, 863, 861, 86, 86, 867, + 86, 86, 857, 865, 868, 86, 86, 869, 870, 864, + 86, 862, 871, 866, 86, 86, 873, 86, 86, 872, + 86, 86, 879, 86, 86, 86, 86, 880, 86, 86, + 86, 86, 86, 874, 881, 875, 876, 86, 86, 877, + 886, 878, 884, 86, 882, 883, 889, 888, 86, 887, + 885, 86, 86, 86, 86, 86, 86, 891, 890, 896, + 892, 86, 86, 86, 86, 86, 86, 86, 905, 906, + + 893, 903, 898, 895, 894, 86, 86, 86, 86, 897, + 899, 900, 901, 902, 86, 86, 86, 86, 86, 904, + 907, 911, 910, 86, 86, 909, 908, 86, 86, 86, + 915, 912, 916, 86, 919, 917, 913, 914, 920, 86, + 86, 86, 918, 86, 86, 927, 86, 922, 86, 170, + 923, 86, 925, 86, 928, 86, 929, 921, 924, 930, + 926, 86, 86, 86, 86, 86, 86, 935, 936, 86, + 86, 932, 86, 937, 86, 931, 939, 86, 933, 934, + 86, 938, 943, 941, 944, 940, 86, 86, 86, 942, + 945, 947, 86, 86, 949, 86, 86, 86, 86, 946, + + 86, 950, 951, 86, 86, 86, 86, 86, 86, 178, + 948, 965, 86, 966, 952, 964, 969, 967, 954, 962, + 963, 86, 953, 86, 86, 955, 86, 970, 956, 86, + 971, 86, 957, 86, 86, 958, 86, 968, 974, 86, + 976, 86, 959, 960, 972, 961, 86, 86, 86, 973, + 1018, 86, 985, 86, 975, 86, 977, 978, 992, 979, + 986, 984, 980, 86, 86, 86, 987, 981, 988, 990, + 86, 86, 86, 982, 983, 989, 994, 86, 998, 86, + 997, 86, 993, 999, 86, 991, 1000, 995, 86, 1001, + 86, 1004, 86, 86, 176, 996, 1002, 1003, 1005, 86, + + 86, 86, 1006, 1008, 86, 1007, 86, 86, 1009, 86, + 86, 86, 86, 1010, 1012, 86, 1016, 86, 86, 1019, + 1015, 86, 86, 86, 86, 1023, 1011, 1034, 86, 1013, + 1014, 86, 1017, 1024, 1021, 1025, 86, 1026, 1029, 1020, + 86, 86, 1027, 86, 86, 1022, 1028, 1031, 175, 86, + 1033, 86, 86, 86, 1032, 86, 86, 1035, 86, 1030, + 1036, 1037, 86, 1038, 86, 86, 1039, 86, 86, 86, + 1041, 1042, 86, 1040, 86, 1043, 1047, 86, 86, 1051, + 86, 1050, 86, 86, 86, 86, 1049, 1044, 1045, 1048, + 86, 86, 86, 1046, 86, 86, 86, 1056, 1058, 1053, + + 1054, 1059, 1052, 1057, 86, 86, 86, 86, 1055, 86, + 86, 1064, 86, 1067, 86, 1062, 1065, 86, 1060, 86, + 1063, 86, 86, 1066, 86, 1068, 86, 1073, 1070, 86, + 1061, 1075, 86, 1069, 86, 1074, 1076, 86, 86, 1078, + 1072, 86, 86, 86, 86, 1071, 86, 1077, 86, 170, + 86, 86, 1086, 1079, 1089, 1084, 86, 86, 1080, 86, + 86, 1081, 86, 1083, 1082, 1090, 86, 1085, 1087, 1091, + 1088, 86, 86, 86, 86, 1092, 86, 1095, 1098, 86, + 1094, 1093, 1096, 1099, 86, 86, 1097, 86, 86, 86, + 86, 86, 1109, 86, 1102, 1100, 1104, 1110, 86, 1101, + + 86, 86, 1112, 86, 86, 1115, 86, 1103, 86, 1105, + 1107, 86, 1106, 1108, 1111, 1113, 1116, 86, 86, 86, + 168, 1117, 86, 86, 1114, 1118, 86, 1123, 1121, 1124, + 1119, 1125, 86, 86, 86, 86, 1126, 86, 1120, 1129, + 1122, 86, 1131, 86, 86, 86, 86, 1128, 1137, 86, + 1127, 1133, 1134, 1138, 170, 86, 86, 86, 1141, 86, + 1140, 1130, 1132, 86, 86, 1135, 86, 1136, 86, 1144, + 1139, 86, 86, 86, 86, 86, 1157, 86, 86, 86, + 86, 1142, 1158, 1143, 1148, 1145, 1147, 1160, 86, 86, + 166, 86, 1146, 1149, 1159, 1150, 86, 86, 1191, 1151, + + 86, 1152, 1161, 1164, 1162, 1153, 1163, 1154, 86, 1167, + 86, 1166, 1155, 1165, 1168, 86, 86, 1156, 86, 1169, + 86, 86, 1171, 86, 86, 86, 1174, 86, 1177, 86, + 1170, 86, 86, 86, 1172, 1173, 1175, 1176, 1178, 1182, + 1181, 86, 1187, 1180, 1184, 1185, 1183, 86, 1179, 1188, + 86, 86, 1186, 86, 1189, 86, 86, 86, 86, 86, + 86, 86, 1203, 1200, 86, 86, 86, 86, 86, 1199, + 1204, 86, 1202, 1201, 1205, 1190, 86, 1192, 86, 1211, + 1206, 1207, 1193, 86, 1194, 86, 86, 1208, 86, 1214, + 1195, 1212, 86, 86, 86, 1196, 1197, 1209, 86, 1210, + + 1213, 86, 1198, 1218, 86, 1219, 86, 1221, 1215, 1222, + 86, 1216, 1217, 86, 86, 86, 1226, 86, 1220, 1224, + 86, 86, 86, 86, 86, 1227, 86, 1232, 1225, 1223, + 1229, 86, 1230, 86, 86, 1233, 1228, 86, 86, 1235, + 1231, 86, 86, 86, 86, 86, 86, 86, 86, 1242, + 1234, 86, 1237, 1240, 1239, 1241, 86, 1236, 1244, 86, + 86, 1238, 1243, 1245, 86, 1246, 86, 86, 1247, 86, + 86, 1248, 86, 1250, 1253, 1249, 86, 1254, 1251, 1256, + 1258, 1255, 1252, 86, 1257, 1259, 86, 86, 86, 86, + 86, 86, 1264, 86, 86, 86, 1260, 1265, 86, 86, + + 86, 1266, 1262, 1261, 1267, 86, 1263, 1269, 1268, 86, + 86, 1271, 1275, 86, 1270, 1277, 86, 1272, 86, 86, + 86, 86, 1273, 86, 1279, 1274, 86, 1281, 165, 86, + 86, 1278, 1282, 1276, 1280, 1284, 86, 86, 86, 86, + 86, 1285, 86, 86, 1283, 1288, 86, 1287, 1289, 86, + 1294, 1290, 1291, 1286, 86, 1293, 86, 86, 1292, 1295, + 86, 86, 86, 1296, 1298, 86, 1299, 86, 86, 86, + 86, 1305, 1303, 1306, 1339, 1297, 1307, 86, 86, 86, + 1300, 1310, 86, 1304, 86, 86, 1301, 86, 1302, 1308, + 1309, 86, 1312, 86, 86, 86, 1311, 1316, 86, 1313, + + 86, 1318, 86, 86, 86, 1317, 86, 86, 86, 86, + 86, 1314, 1323, 1319, 86, 1315, 1320, 1324, 86, 86, + 86, 1325, 86, 1326, 1321, 1330, 86, 1322, 1331, 86, + 86, 86, 1328, 86, 86, 1333, 86, 1327, 1334, 86, + 86, 1329, 86, 86, 1332, 1335, 86, 1336, 1337, 86, + 86, 86, 1341, 1345, 86, 170, 86, 86, 1338, 1346, + 1340, 1347, 1348, 86, 86, 1342, 86, 86, 86, 1344, + 1357, 86, 1353, 163, 1343, 1349, 86, 1350, 1352, 1351, + 1354, 1355, 86, 1358, 86, 86, 86, 86, 1356, 86, + 1360, 86, 1362, 1361, 86, 86, 86, 86, 86, 86, + + 1359, 1365, 86, 1371, 86, 1367, 1368, 86, 1363, 1364, + 86, 86, 1366, 1369, 86, 86, 86, 86, 161, 86, + 1375, 1370, 1377, 1381, 1372, 1373, 1374, 86, 1382, 86, + 1386, 1378, 86, 1379, 1383, 1376, 1380, 1384, 86, 1385, + 86, 86, 86, 1387, 86, 86, 86, 86, 86, 86, + 1391, 1390, 86, 1394, 86, 86, 1398, 86, 86, 1393, + 1388, 86, 1389, 1395, 86, 1392, 1396, 86, 86, 1399, + 1404, 1397, 1400, 1402, 1401, 86, 86, 86, 86, 1403, + 86, 86, 86, 86, 1408, 86, 86, 86, 86, 1411, + 86, 1405, 1406, 1409, 1416, 1410, 86, 1407, 1412, 86, + + 86, 1418, 1413, 86, 86, 1415, 1414, 86, 86, 1421, + 1419, 1417, 86, 86, 86, 1428, 86, 86, 1422, 1420, + 1424, 86, 1430, 1423, 86, 86, 86, 86, 86, 1427, + 86, 1425, 1431, 86, 1433, 1436, 1429, 86, 1426, 1432, + 86, 1438, 86, 1435, 1434, 1437, 1439, 86, 86, 1443, + 86, 86, 86, 1453, 1441, 1442, 1440, 86, 1444, 86, + 1452, 1456, 1445, 1451, 86, 1446, 1447, 86, 1454, 1455, + 1448, 1457, 86, 86, 86, 86, 1449, 86, 1458, 1459, + 1450, 86, 1460, 86, 1462, 86, 86, 86, 1463, 86, + 1464, 1467, 86, 1461, 86, 1465, 1468, 86, 86, 1470, + + 86, 1473, 1474, 86, 1466, 1475, 1471, 86, 86, 1469, + 86, 86, 1478, 86, 1476, 86, 1472, 1479, 1483, 1480, + 86, 1481, 86, 1482, 1477, 86, 1485, 1486, 1487, 1484, + 86, 1488, 86, 86, 86, 1493, 1489, 1490, 86, 86, + 1494, 86, 86, 1492, 86, 86, 86, 1495, 86, 1497, + 86, 1491, 1503, 86, 1499, 86, 1498, 86, 86, 86, + 1504, 1496, 86, 1506, 1502, 1500, 86, 1501, 86, 1505, + 86, 1508, 86, 86, 1515, 86, 1507, 86, 1513, 1510, + 1511, 86, 1509, 1517, 86, 86, 1514, 1518, 86, 86, + 1512, 1519, 1516, 86, 1520, 86, 1523, 86, 86, 1525, + + 86, 86, 1526, 86, 1522, 86, 86, 86, 1527, 1531, + 86, 86, 1521, 86, 86, 86, 1536, 1534, 1524, 86, + 86, 86, 86, 1539, 1537, 86, 1528, 1529, 1530, 1538, + 1533, 1532, 86, 86, 86, 1535, 1541, 86, 86, 1543, + 86, 86, 1550, 1540, 86, 1545, 1546, 1542, 86, 1547, + 86, 1544, 86, 1548, 86, 86, 86, 1549, 86, 1551, + 86, 1553, 1556, 1554, 1557, 1558, 1552, 86, 86, 1560, + 86, 1555, 1559, 86, 86, 86, 86, 1564, 86, 86, + 86, 86, 1561, 86, 86, 1566, 86, 1563, 170, 1572, + 1573, 1568, 86, 1562, 1575, 86, 86, 86, 1574, 1565, + + 86, 1567, 86, 1569, 1570, 86, 86, 86, 86, 1571, + 86, 1576, 86, 1583, 86, 86, 86, 1577, 1580, 86, + 86, 1581, 1578, 86, 1587, 1579, 1582, 1588, 86, 86, + 1584, 1592, 86, 1586, 1590, 1591, 1593, 86, 86, 1585, + 1596, 1594, 86, 1589, 86, 86, 86, 1595, 86, 1606, + 86, 1601, 1604, 86, 1602, 86, 1597, 1603, 86, 1598, + 1599, 86, 1607, 1600, 1609, 86, 86, 1605, 86, 1610, + 86, 86, 1608, 86, 86, 86, 1614, 86, 1615, 86, + 86, 86, 1618, 86, 1611, 86, 1613, 86, 1623, 1624, + 86, 86, 1612, 1616, 1617, 1620, 1627, 86, 1621, 1619, + + 86, 1622, 86, 86, 86, 86, 86, 86, 1625, 1628, + 1626, 86, 86, 86, 86, 86, 1629, 1635, 1631, 1637, + 1632, 1633, 1630, 86, 1640, 86, 1634, 86, 1641, 1638, + 1636, 86, 86, 1646, 1639, 86, 1645, 1647, 86, 86, + 1642, 1643, 86, 86, 86, 1649, 1650, 86, 1651, 86, + 86, 1644, 1648, 86, 1655, 1656, 1657, 86, 1654, 3557, + 86, 86, 86, 86, 1658, 1652, 86, 1659, 1660, 86, + 86, 1653, 86, 86, 1661, 1663, 86, 86, 86, 86, + 86, 1662, 86, 1668, 86, 1664, 1667, 86, 1670, 1671, + 1665, 86, 1666, 86, 1674, 86, 1679, 1676, 1669, 1675, + + 86, 1672, 1677, 86, 86, 86, 86, 86, 86, 86, + 1673, 1687, 1683, 1678, 86, 1682, 86, 86, 86, 86, + 1691, 1688, 86, 1680, 1681, 86, 86, 1684, 1694, 1685, + 86, 1693, 1686, 86, 86, 86, 86, 86, 1689, 86, + 86, 1692, 86, 86, 1703, 1690, 86, 86, 86, 1695, + 1704, 86, 1696, 1700, 1697, 1698, 1699, 1702, 1708, 86, + 86, 1701, 86, 1707, 1711, 1705, 86, 1706, 1709, 86, + 86, 1710, 86, 86, 86, 1712, 1715, 86, 86, 1713, + 1716, 86, 1719, 86, 86, 1714, 1723, 86, 1725, 1724, + 86, 1718, 86, 1717, 86, 86, 1720, 1728, 1721, 1722, + + 86, 86, 86, 86, 1730, 1726, 1729, 86, 1727, 86, + 86, 1731, 1732, 1736, 1737, 86, 86, 86, 1734, 86, + 1733, 86, 86, 1741, 86, 1742, 1740, 1744, 86, 86, + 1735, 86, 1745, 86, 1738, 1746, 86, 86, 1739, 86, + 86, 86, 86, 1750, 1743, 86, 86, 86, 1755, 1747, + 86, 1753, 86, 1748, 86, 1749, 86, 86, 86, 86, + 1761, 1759, 1751, 86, 86, 1752, 1754, 1756, 86, 86, + 86, 1757, 1760, 1758, 86, 1763, 86, 1762, 1764, 86, + 1767, 1770, 86, 1768, 1772, 86, 86, 86, 86, 1765, + 1766, 1773, 1769, 86, 1775, 86, 86, 1771, 86, 86, + + 86, 86, 1779, 1782, 86, 1781, 1774, 1778, 86, 86, + 1776, 1783, 86, 170, 1777, 86, 86, 1785, 1780, 1787, + 86, 86, 1784, 86, 86, 1793, 1794, 86, 86, 1786, + 1788, 1797, 86, 86, 1789, 1790, 86, 1791, 86, 86, + 86, 1799, 1798, 86, 86, 1792, 1801, 1795, 1796, 86, + 1803, 1805, 86, 86, 1802, 1865, 86, 86, 1800, 1804, + 1807, 86, 1808, 86, 1811, 86, 1806, 86, 1812, 1809, + 1810, 86, 1813, 86, 86, 86, 86, 86, 1818, 1817, + 86, 86, 86, 86, 86, 1825, 1822, 1814, 86, 1823, + 1816, 86, 1815, 1820, 86, 86, 1963, 86, 1819, 1826, + + 1827, 1824, 1821, 86, 1829, 1833, 86, 86, 1830, 1831, + 1832, 1834, 1835, 86, 86, 86, 1828, 86, 86, 1836, + 86, 1837, 86, 1838, 1839, 86, 86, 86, 1841, 1846, + 86, 1840, 1843, 86, 1847, 86, 1845, 86, 1848, 1850, + 86, 86, 1849, 1842, 86, 86, 86, 1844, 1853, 86, + 86, 1852, 86, 86, 86, 1854, 86, 86, 86, 86, + 86, 86, 86, 86, 1851, 1864, 86, 86, 86, 3557, + 1855, 1859, 1860, 1856, 1858, 1857, 1861, 1862, 1868, 86, + 1869, 86, 1866, 1871, 86, 1863, 1867, 1872, 86, 86, + 86, 86, 1877, 86, 1870, 86, 86, 86, 86, 1881, + + 1873, 1879, 86, 86, 1875, 86, 86, 86, 1874, 1880, + 86, 86, 1876, 86, 86, 1878, 1886, 1882, 1888, 1883, + 86, 86, 86, 1889, 1885, 1887, 1890, 1884, 86, 1891, + 86, 1895, 1896, 86, 1898, 1892, 1897, 86, 86, 86, + 1893, 1900, 1901, 86, 86, 86, 1894, 86, 1899, 86, + 1904, 86, 1902, 86, 1905, 86, 86, 3557, 1906, 86, + 86, 1914, 86, 1903, 1909, 1908, 1907, 86, 1911, 1913, + 86, 1912, 1915, 86, 86, 1910, 86, 1916, 86, 86, + 1922, 86, 1917, 86, 86, 1923, 86, 1918, 1924, 86, + 86, 1928, 1920, 1925, 1919, 1921, 86, 86, 86, 1931, + + 86, 1933, 86, 1932, 86, 86, 1930, 1927, 86, 1926, + 1937, 1935, 1929, 86, 1936, 1934, 86, 86, 1941, 86, + 86, 86, 1938, 1942, 86, 1946, 86, 1948, 1951, 1939, + 1943, 1940, 1944, 86, 86, 1947, 1950, 86, 86, 86, + 1954, 1945, 86, 1952, 1949, 86, 86, 86, 1955, 1958, + 86, 86, 1962, 1953, 1960, 86, 86, 86, 86, 86, + 1961, 1957, 86, 1959, 86, 1956, 86, 86, 86, 1968, + 1967, 86, 86, 86, 3557, 1964, 1965, 1969, 1966, 1970, + 1971, 1973, 1975, 86, 1977, 1972, 1978, 1974, 86, 86, + 86, 86, 86, 1980, 86, 86, 1984, 86, 86, 1986, + + 86, 1979, 86, 86, 1976, 86, 1990, 86, 86, 1981, + 1983, 1985, 86, 1982, 86, 86, 1992, 86, 1988, 1993, + 86, 1989, 1987, 86, 86, 1995, 1997, 86, 1991, 1996, + 86, 86, 170, 86, 2001, 1994, 2004, 86, 1999, 2000, + 86, 86, 86, 86, 2002, 86, 1998, 86, 2003, 2008, + 86, 86, 2010, 2006, 86, 86, 2015, 2009, 86, 2005, + 86, 2007, 86, 2011, 86, 86, 2012, 2014, 2019, 86, + 2016, 2018, 86, 2023, 2013, 2020, 2021, 86, 2017, 86, + 2024, 2025, 86, 86, 2022, 86, 86, 2027, 86, 86, + 86, 2028, 86, 86, 86, 2026, 86, 86, 86, 2033, + + 86, 2034, 86, 86, 86, 2038, 2035, 86, 3557, 2029, + 2031, 2032, 2030, 2037, 2036, 86, 2039, 86, 86, 2045, + 2042, 86, 2044, 2041, 2046, 86, 2047, 2043, 86, 2040, + 86, 86, 86, 86, 86, 2053, 86, 2056, 86, 2048, + 2049, 2057, 86, 2058, 86, 86, 2051, 2050, 2054, 86, + 2055, 2052, 2060, 86, 86, 2061, 86, 86, 2059, 2065, + 86, 2066, 2067, 2069, 86, 86, 2062, 2068, 86, 86, + 2063, 86, 2071, 86, 2075, 86, 2072, 2064, 86, 86, + 86, 86, 2074, 2070, 2078, 86, 2077, 86, 86, 86, + 86, 86, 2083, 2085, 2081, 2082, 86, 86, 2073, 86, + + 2076, 2084, 2079, 86, 86, 86, 86, 2093, 86, 2080, + 86, 2097, 3557, 86, 2095, 2086, 2087, 2088, 86, 2096, + 86, 86, 2089, 2091, 2090, 2098, 2092, 86, 2094, 2099, + 2102, 86, 2100, 2101, 86, 86, 86, 2106, 86, 86, + 2103, 86, 2108, 86, 86, 86, 2111, 2112, 86, 86, + 2114, 86, 86, 86, 2104, 86, 2105, 86, 86, 2121, + 86, 2119, 2116, 2109, 2117, 2107, 2110, 86, 86, 2113, + 86, 86, 86, 86, 2120, 86, 2127, 2115, 2118, 2124, + 2125, 86, 86, 86, 2130, 2123, 2132, 86, 2131, 2122, + 86, 86, 86, 86, 2134, 2135, 86, 2138, 2129, 2126, + + 86, 86, 2136, 86, 2139, 86, 86, 2128, 86, 86, + 86, 2133, 2137, 2140, 86, 2141, 2142, 2144, 86, 86, + 86, 2146, 2145, 86, 2149, 2150, 2151, 86, 2143, 86, + 86, 86, 86, 86, 2154, 86, 86, 2147, 2159, 86, + 86, 2158, 86, 86, 2153, 86, 2148, 2152, 86, 2164, + 2155, 86, 2165, 2156, 86, 86, 86, 2157, 2162, 2169, + 2166, 2161, 2168, 86, 2160, 2167, 86, 2163, 2172, 86, + 86, 86, 86, 86, 86, 86, 86, 2170, 86, 2176, + 2180, 86, 2171, 86, 86, 2174, 86, 86, 2183, 86, + 2181, 2173, 2175, 2187, 2184, 2177, 2178, 86, 2179, 2182, + + 2185, 86, 86, 2186, 86, 86, 2188, 2191, 2192, 86, + 2193, 86, 2194, 2196, 3557, 2189, 2197, 2195, 86, 86, + 2190, 86, 86, 86, 2201, 86, 2199, 86, 86, 86, + 86, 2198, 2203, 86, 2205, 2200, 2207, 2202, 86, 2204, + 2209, 86, 86, 2210, 86, 86, 86, 170, 86, 86, + 86, 86, 2213, 86, 2206, 86, 86, 2276, 2217, 2218, + 2208, 2212, 2214, 2215, 2211, 86, 2219, 2216, 2220, 86, + 2221, 86, 2223, 86, 86, 2222, 86, 86, 86, 2224, + 2226, 2225, 86, 86, 86, 86, 2227, 2228, 2229, 86, + 2231, 86, 86, 2235, 86, 2230, 2232, 2234, 86, 86, + + 86, 2240, 86, 2233, 2237, 2238, 86, 2236, 86, 2239, + 86, 86, 86, 86, 86, 86, 2247, 2245, 86, 2242, + 2246, 86, 86, 86, 86, 2252, 86, 2249, 2241, 2243, + 86, 2244, 2248, 86, 86, 2257, 2253, 2251, 86, 2250, + 86, 86, 2255, 86, 2254, 86, 86, 2258, 2261, 2264, + 2256, 86, 2259, 2263, 86, 86, 86, 2270, 2262, 86, + 86, 86, 2260, 86, 86, 2272, 86, 2265, 2273, 86, + 86, 2266, 2267, 86, 2268, 2269, 86, 2271, 2275, 86, + 2277, 86, 86, 2278, 86, 2281, 86, 2274, 86, 86, + 2280, 86, 86, 2279, 2288, 2283, 86, 2286, 2284, 86, + + 2282, 2287, 86, 86, 86, 86, 86, 86, 86, 2285, + 86, 2289, 86, 86, 2290, 2295, 2292, 86, 2291, 2296, + 2300, 2294, 2301, 86, 86, 86, 86, 2298, 2304, 2305, + 2302, 2293, 2297, 2299, 86, 86, 86, 2303, 2308, 2307, + 86, 86, 86, 86, 86, 2310, 2306, 86, 2311, 2318, + 86, 2312, 86, 2309, 2316, 86, 2314, 86, 86, 2319, + 86, 2313, 2315, 2317, 2321, 86, 86, 86, 86, 2324, + 86, 2323, 2320, 2325, 86, 2326, 86, 86, 2330, 86, + 86, 86, 86, 2334, 86, 2331, 2322, 86, 2335, 86, + 86, 2333, 2327, 86, 2328, 2332, 86, 2329, 2336, 86, + + 2337, 2338, 2339, 86, 86, 2340, 2344, 2341, 2342, 86, + 86, 86, 86, 2346, 2345, 86, 2350, 86, 86, 2343, + 86, 2352, 86, 2348, 86, 2353, 86, 2355, 2347, 86, + 2351, 2349, 86, 86, 86, 2354, 2357, 86, 2362, 2360, + 86, 86, 2358, 2363, 86, 2359, 86, 2356, 86, 86, + 2365, 86, 2364, 86, 2368, 2361, 2369, 86, 2366, 86, + 2367, 2373, 86, 86, 86, 86, 2370, 86, 2372, 86, + 86, 86, 3557, 86, 86, 86, 86, 2371, 2381, 86, + 86, 2374, 2375, 2376, 2379, 2377, 2380, 2382, 2383, 2387, + 86, 86, 2378, 86, 2384, 2385, 2386, 86, 86, 2388, + + 86, 86, 2391, 2390, 86, 86, 2396, 86, 86, 2398, + 86, 86, 2389, 2392, 2395, 86, 86, 2397, 2393, 2401, + 86, 2402, 2399, 86, 170, 2405, 2394, 86, 3557, 2407, + 2400, 86, 2409, 2403, 2408, 86, 86, 2410, 86, 2411, + 86, 86, 2404, 86, 2414, 86, 2406, 2413, 2412, 86, + 2415, 86, 2419, 86, 86, 2420, 86, 2423, 86, 2422, + 2418, 86, 86, 86, 2416, 86, 2424, 2427, 2421, 86, + 2425, 2426, 86, 2428, 86, 2417, 86, 86, 2429, 86, + 2431, 86, 86, 2433, 86, 2430, 2434, 86, 86, 86, + 86, 86, 2437, 86, 86, 2441, 86, 2432, 2444, 2436, + + 2443, 86, 86, 86, 86, 2435, 2438, 2439, 2446, 2440, + 86, 2445, 86, 86, 86, 2442, 86, 86, 2451, 2454, + 86, 86, 2448, 86, 2449, 2455, 86, 2452, 2447, 2450, + 86, 86, 86, 86, 2453, 86, 86, 2465, 86, 86, + 2456, 86, 2457, 86, 86, 2458, 86, 2463, 2470, 86, + 2494, 2461, 2467, 2459, 2462, 2460, 2466, 2464, 2468, 86, + 2472, 86, 86, 86, 86, 2469, 2474, 2473, 86, 2471, + 86, 86, 2478, 2479, 86, 86, 86, 2475, 2480, 2481, + 86, 86, 2476, 2477, 86, 2484, 86, 2485, 86, 86, + 2482, 2488, 86, 86, 2483, 2489, 86, 2486, 2490, 86, + + 2487, 86, 2495, 86, 2491, 2496, 86, 86, 86, 2492, + 2498, 86, 86, 2500, 86, 86, 2503, 86, 2504, 86, + 2502, 2493, 86, 2501, 86, 86, 2497, 86, 86, 86, + 2499, 2511, 86, 2506, 2510, 86, 2505, 2513, 86, 86, + 86, 2508, 2507, 86, 86, 2515, 86, 2509, 86, 2516, + 86, 2517, 86, 2518, 2512, 2520, 86, 2514, 86, 86, + 2523, 2522, 86, 2521, 86, 2524, 2526, 86, 2519, 86, + 86, 86, 2532, 86, 86, 2531, 86, 86, 2525, 2528, + 86, 2534, 2527, 86, 86, 2530, 2537, 86, 86, 86, + 86, 2539, 2529, 2533, 86, 2535, 86, 2538, 2536, 86, + + 2545, 86, 2540, 86, 86, 2547, 2551, 2541, 2542, 2543, + 2546, 86, 86, 86, 2548, 86, 2552, 86, 2553, 86, + 2554, 86, 2544, 86, 86, 86, 2558, 86, 86, 2549, + 2560, 2550, 2556, 2561, 86, 2564, 86, 2565, 86, 2562, + 2568, 86, 2555, 86, 2557, 86, 86, 86, 2566, 86, + 2559, 2563, 2569, 2567, 2570, 86, 86, 86, 86, 2573, + 86, 86, 86, 86, 86, 86, 2574, 2575, 2572, 2576, + 2571, 2577, 2579, 2580, 2584, 2578, 86, 3557, 86, 86, + 2581, 86, 2585, 2582, 2583, 2586, 86, 2587, 86, 86, + 2590, 86, 86, 170, 86, 2588, 86, 2589, 2591, 86, + + 2596, 86, 86, 86, 86, 86, 86, 86, 2604, 86, + 2594, 2597, 2592, 2598, 2593, 2595, 86, 2599, 2600, 2602, + 86, 2601, 3557, 2603, 2607, 86, 86, 2608, 2606, 2605, + 2609, 86, 86, 86, 2612, 2610, 2613, 86, 2611, 86, + 86, 86, 86, 2615, 86, 86, 2614, 86, 2617, 86, + 86, 2621, 2622, 2616, 86, 2619, 86, 2618, 86, 2624, + 86, 86, 86, 86, 2625, 2626, 2627, 86, 2620, 86, + 2623, 86, 2629, 86, 2628, 2633, 86, 2632, 86, 86, + 2630, 2631, 86, 86, 2635, 86, 86, 86, 86, 86, + 2643, 2634, 2640, 86, 2642, 86, 86, 86, 2645, 2644, + + 2639, 86, 2636, 2637, 86, 2638, 86, 2641, 86, 2651, + 86, 2649, 86, 2646, 86, 86, 86, 2657, 86, 2655, + 2647, 2654, 86, 2648, 2652, 86, 2656, 86, 86, 2650, + 2653, 2658, 86, 2660, 86, 86, 86, 2661, 2662, 86, + 2664, 2659, 86, 2666, 2668, 86, 2665, 86, 2667, 86, + 2670, 86, 86, 86, 2663, 86, 2669, 86, 86, 86, + 86, 86, 2674, 2679, 86, 2677, 2678, 2672, 2680, 86, + 2671, 2673, 2681, 86, 86, 2683, 86, 86, 86, 86, + 2676, 86, 86, 86, 2675, 2688, 2686, 86, 86, 2691, + 86, 86, 2684, 2682, 86, 2689, 2692, 2693, 2687, 2685, + + 2690, 2694, 86, 2697, 86, 86, 86, 86, 2698, 86, + 86, 2701, 2695, 2702, 86, 86, 86, 2696, 86, 86, + 2703, 86, 86, 86, 2708, 2699, 2707, 2700, 2705, 86, + 86, 2706, 86, 86, 2704, 86, 86, 2709, 2712, 2716, + 86, 2715, 2711, 2710, 2717, 86, 2718, 86, 2719, 86, + 86, 86, 2713, 86, 86, 2714, 86, 2723, 2722, 86, + 2724, 86, 2720, 86, 2725, 86, 2726, 86, 86, 2721, + 86, 2732, 86, 86, 2734, 86, 86, 2728, 2735, 86, + 86, 2727, 86, 86, 86, 86, 2731, 2729, 2737, 2730, + 2738, 2736, 2733, 86, 2739, 86, 2744, 86, 2741, 86, + + 2746, 86, 86, 86, 2740, 2742, 86, 86, 2745, 170, + 86, 86, 86, 86, 2753, 2743, 86, 2755, 86, 2749, + 86, 2754, 2756, 2748, 2751, 86, 86, 86, 2747, 86, + 86, 2750, 2762, 2752, 86, 2757, 2759, 86, 86, 2764, + 2758, 86, 2765, 86, 2763, 2766, 86, 86, 2760, 2772, + 2761, 2767, 86, 86, 2768, 86, 2769, 86, 2770, 2771, + 86, 86, 2773, 86, 86, 86, 86, 2775, 86, 86, + 2781, 86, 86, 86, 2779, 2774, 86, 2785, 86, 2776, + 2786, 86, 2790, 86, 2778, 2777, 2780, 86, 86, 2782, + 2783, 2784, 2787, 2788, 2792, 86, 2789, 2791, 86, 86, + + 86, 86, 86, 86, 86, 86, 86, 86, 2796, 2803, + 86, 2804, 86, 86, 2802, 3557, 2793, 2794, 2795, 2797, + 2798, 2799, 2800, 86, 2801, 86, 2808, 86, 2809, 86, + 2810, 2807, 86, 2805, 86, 86, 86, 86, 86, 86, + 86, 2806, 86, 2815, 86, 86, 2820, 86, 86, 2812, + 2811, 2814, 2819, 2817, 2813, 2821, 86, 2823, 86, 2816, + 2818, 86, 86, 2822, 2824, 86, 86, 2826, 86, 86, + 86, 2825, 86, 2829, 2830, 86, 86, 2827, 86, 2836, + 86, 2835, 86, 86, 2839, 86, 2828, 86, 86, 86, + 2831, 2832, 86, 2842, 2834, 2833, 86, 2837, 2840, 86, + + 86, 2838, 2844, 2841, 2845, 2846, 86, 2843, 86, 86, + 86, 86, 2847, 2851, 86, 86, 86, 86, 86, 2855, + 2853, 2854, 86, 2848, 2856, 86, 86, 2852, 86, 2849, + 2850, 2858, 86, 2859, 86, 2857, 86, 86, 2861, 2864, + 86, 86, 2865, 2860, 2867, 86, 2863, 86, 2862, 86, + 86, 86, 86, 2874, 86, 86, 86, 86, 3557, 2866, + 2868, 2871, 2869, 2870, 2872, 2873, 2877, 86, 86, 86, + 86, 2875, 2876, 2878, 2879, 86, 86, 86, 86, 86, + 2881, 86, 86, 86, 2880, 2882, 86, 2884, 2887, 2885, + 86, 2888, 2890, 86, 2886, 2883, 86, 2889, 2891, 86, + + 86, 2892, 2894, 170, 86, 86, 86, 2895, 2899, 2893, + 2896, 86, 86, 2901, 86, 86, 2900, 3557, 86, 2904, + 86, 86, 2897, 2903, 2898, 2905, 86, 2907, 86, 86, + 2902, 2909, 2908, 86, 2906, 86, 2910, 86, 2911, 86, + 2912, 2914, 86, 86, 86, 86, 2915, 86, 2916, 86, + 86, 86, 2921, 2913, 2917, 2922, 2923, 2919, 86, 2918, + 86, 86, 86, 86, 86, 86, 86, 2927, 2926, 2925, + 86, 2920, 2924, 86, 86, 2929, 86, 2928, 2930, 2931, + 86, 86, 86, 86, 2932, 86, 2936, 86, 86, 2933, + 2934, 2935, 2937, 2938, 2940, 86, 86, 86, 2939, 86, + + 86, 2941, 2945, 86, 2946, 86, 2942, 86, 86, 86, + 86, 2951, 86, 86, 86, 86, 2943, 2948, 2944, 2955, + 2956, 86, 2949, 86, 2947, 2950, 2958, 86, 2952, 2953, + 2959, 2961, 86, 2954, 2962, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 2968, 2960, 2963, 2965, 2957, 2966, + 86, 86, 86, 86, 2967, 2969, 86, 2970, 2972, 86, + 86, 2974, 86, 2983, 2964, 2971, 2976, 86, 2977, 86, + 86, 2973, 2978, 86, 2979, 86, 86, 2982, 86, 86, + 2975, 2980, 86, 2986, 2981, 86, 86, 2984, 2987, 86, + 86, 2985, 86, 2990, 2991, 86, 86, 2988, 2992, 86, + + 2993, 86, 86, 2995, 86, 2994, 2989, 2997, 86, 2996, + 86, 3000, 86, 86, 3001, 3002, 86, 86, 3004, 86, + 86, 86, 2998, 86, 86, 3008, 3009, 86, 3010, 3011, + 2999, 86, 3003, 3005, 86, 86, 86, 3007, 3013, 3006, + 86, 3012, 86, 3014, 86, 86, 3019, 86, 86, 86, + 86, 3018, 86, 3021, 3022, 86, 86, 3015, 3024, 86, + 3016, 3023, 3017, 86, 86, 86, 3025, 3027, 86, 3028, + 3031, 86, 3020, 3026, 86, 86, 3029, 3030, 86, 3035, + 86, 86, 86, 86, 86, 3037, 3047, 86, 86, 3032, + 86, 3053, 3034, 3038, 3033, 3036, 3041, 3039, 86, 3042, + + 3557, 3044, 86, 3040, 3043, 86, 3045, 86, 86, 3046, + 86, 3048, 86, 3049, 86, 3050, 86, 3051, 86, 3052, + 86, 86, 3055, 86, 3056, 3054, 86, 3059, 3058, 86, + 86, 3060, 86, 3064, 86, 3057, 3065, 86, 3061, 86, + 86, 86, 3066, 3069, 86, 86, 3067, 86, 3071, 86, + 3062, 86, 3063, 86, 3070, 86, 3072, 3073, 86, 3068, + 86, 86, 3074, 3078, 3075, 3079, 86, 3080, 86, 3076, + 3077, 86, 86, 86, 86, 3081, 86, 3086, 86, 3557, + 86, 3082, 3087, 86, 86, 3084, 86, 3089, 3090, 86, + 86, 3085, 3083, 3088, 3091, 3092, 86, 3094, 86, 86, + + 3093, 86, 3098, 86, 3095, 86, 86, 86, 86, 86, + 3105, 86, 86, 3102, 3099, 86, 86, 86, 3100, 3097, + 3103, 86, 3108, 86, 3096, 86, 3109, 3106, 3112, 3104, + 86, 3110, 3101, 3107, 3111, 86, 86, 86, 3115, 3117, + 86, 3116, 3118, 86, 3119, 86, 86, 86, 3113, 86, + 3114, 86, 3124, 86, 86, 3120, 3123, 86, 86, 3125, + 3127, 86, 3126, 86, 86, 86, 86, 3121, 3122, 86, + 3131, 3128, 3133, 3135, 86, 3129, 86, 86, 86, 86, + 3136, 86, 3137, 86, 3132, 3130, 3138, 86, 3139, 86, + 86, 3144, 86, 86, 3134, 86, 86, 86, 3140, 86, + + 86, 3148, 86, 3143, 3141, 3142, 3145, 86, 3146, 3147, + 86, 3149, 3153, 86, 86, 3150, 86, 3155, 3152, 3151, + 86, 86, 86, 3156, 3159, 86, 3161, 86, 86, 3163, + 86, 86, 86, 3154, 3162, 3165, 86, 86, 3157, 86, + 86, 3160, 3171, 86, 3168, 86, 86, 3158, 3166, 86, + 3170, 3174, 3164, 3167, 86, 86, 3169, 86, 3173, 86, + 3177, 86, 86, 3180, 86, 3181, 3172, 86, 86, 86, + 3183, 86, 86, 3184, 3176, 3178, 86, 3175, 3186, 86, + 86, 3179, 3187, 86, 3190, 86, 86, 3182, 86, 86, + 3195, 3185, 3189, 86, 86, 3188, 86, 3192, 3193, 86, + + 3199, 86, 86, 86, 3191, 3557, 3197, 86, 3194, 86, + 3201, 86, 3196, 86, 3202, 86, 3203, 3200, 3206, 3198, + 86, 3204, 3209, 3205, 86, 3207, 86, 86, 86, 86, + 3208, 3210, 3212, 86, 3211, 86, 3215, 86, 86, 3214, + 3213, 86, 86, 3218, 86, 86, 86, 86, 3223, 86, + 3219, 86, 86, 86, 3216, 3217, 3227, 86, 3230, 3220, + 3222, 3226, 3228, 86, 86, 3224, 86, 3225, 3229, 86, + 3221, 3232, 3233, 86, 3234, 86, 3235, 86, 3231, 3236, + 86, 86, 86, 3239, 86, 86, 3241, 86, 86, 86, + 3240, 3242, 86, 86, 3237, 86, 86, 86, 3248, 3249, + + 86, 86, 86, 3243, 86, 86, 86, 86, 3238, 86, + 3244, 3255, 86, 86, 3246, 3245, 3254, 86, 3247, 3252, + 3258, 3251, 3256, 86, 3253, 3260, 86, 3250, 86, 3259, + 86, 3257, 86, 3261, 3263, 86, 3264, 86, 3262, 86, + 86, 3267, 3268, 86, 3265, 86, 3266, 86, 3269, 3270, + 86, 86, 86, 86, 86, 86, 3271, 3272, 86, 3273, + 3276, 86, 86, 3274, 3277, 3275, 3279, 3278, 86, 86, + 86, 86, 86, 86, 86, 86, 3288, 86, 3291, 86, + 3289, 3280, 86, 3557, 86, 86, 3284, 3292, 3281, 3282, + 3283, 3285, 3286, 86, 3287, 86, 3294, 3290, 3295, 3293, + + 3296, 86, 3297, 86, 86, 3299, 86, 86, 3298, 3302, + 86, 86, 3300, 3414, 3301, 3303, 86, 3304, 3305, 86, + 86, 3306, 3307, 3311, 86, 3308, 86, 3309, 3310, 86, + 86, 86, 3314, 86, 3312, 86, 86, 86, 3317, 86, + 3313, 86, 86, 3321, 86, 86, 86, 3320, 86, 86, + 3316, 86, 86, 3315, 86, 3324, 3325, 86, 3326, 3318, + 86, 3319, 3329, 3330, 86, 3322, 3327, 86, 3332, 3331, + 86, 3323, 3328, 3333, 86, 3334, 86, 86, 86, 86, + 3341, 86, 3336, 3339, 86, 3335, 86, 3337, 3340, 86, + 3338, 86, 86, 86, 3348, 86, 3343, 3345, 3346, 86, + + 3349, 86, 3351, 86, 3342, 3344, 86, 3350, 3352, 86, + 3347, 86, 3355, 86, 3353, 86, 3354, 3356, 86, 3358, + 86, 3359, 86, 86, 3357, 3360, 86, 3361, 86, 3362, + 86, 3363, 86, 3364, 86, 3365, 86, 86, 3368, 86, + 3369, 86, 86, 86, 86, 86, 3367, 3373, 86, 3366, + 86, 3370, 3375, 86, 86, 3371, 86, 86, 3379, 86, + 3376, 3380, 86, 86, 3372, 3382, 86, 3377, 3378, 3374, + 86, 86, 86, 3384, 3381, 86, 3386, 86, 3389, 86, + 3388, 3383, 86, 86, 86, 86, 86, 3391, 86, 86, + 3387, 86, 3395, 3390, 86, 3397, 86, 3385, 3396, 86, + + 86, 86, 3392, 3393, 3394, 3400, 86, 86, 86, 3398, + 3401, 86, 3402, 3403, 86, 3404, 86, 3405, 86, 86, + 3407, 86, 3399, 3408, 3406, 86, 3409, 86, 86, 86, + 3416, 3411, 3413, 86, 86, 3410, 3412, 86, 86, 86, + 86, 86, 86, 3415, 86, 86, 3417, 3425, 86, 3423, + 3428, 86, 86, 3418, 3420, 3419, 3422, 3424, 86, 86, + 3557, 86, 86, 3427, 3421, 3426, 3430, 86, 3429, 3433, + 86, 3434, 3432, 3431, 3435, 86, 86, 3436, 3437, 86, + 3438, 86, 86, 86, 86, 86, 3439, 3441, 3442, 86, + 3443, 86, 3446, 86, 86, 86, 86, 86, 86, 3449, + + 3450, 86, 3440, 3452, 86, 86, 3445, 3447, 3448, 3453, + 86, 86, 3454, 86, 3444, 3451, 3456, 86, 3459, 86, + 86, 3460, 86, 86, 3455, 86, 3457, 3463, 3464, 86, + 3461, 3458, 86, 86, 86, 86, 3469, 86, 86, 3465, + 3468, 86, 3462, 3470, 86, 3466, 86, 86, 3467, 86, + 86, 3474, 86, 86, 86, 3476, 86, 86, 86, 3471, + 3473, 3472, 3481, 3482, 3483, 86, 3478, 3479, 86, 3475, + 86, 3477, 86, 3487, 86, 3480, 86, 3489, 86, 3490, + 86, 3488, 86, 86, 86, 3491, 86, 3492, 3484, 3486, + 3485, 3493, 3495, 3496, 86, 86, 3498, 86, 86, 86, + + 3497, 86, 86, 3494, 86, 3499, 86, 3504, 86, 3501, + 86, 86, 86, 86, 86, 3507, 3508, 86, 3500, 3509, + 86, 86, 3510, 3502, 3506, 3503, 3511, 3505, 86, 86, + 3515, 3512, 86, 86, 86, 86, 3519, 3516, 86, 3513, + 86, 3514, 86, 3521, 86, 3522, 3517, 86, 86, 3526, + 86, 86, 3523, 3529, 86, 3524, 3527, 3520, 86, 3525, + 3518, 86, 86, 3528, 86, 3530, 86, 86, 86, 3531, + 86, 3533, 3535, 86, 86, 3537, 86, 86, 86, 3538, + 86, 3541, 86, 3532, 3542, 86, 3534, 3536, 86, 3545, + 3546, 86, 86, 3548, 86, 3539, 3540, 3543, 86, 3547, + + 86, 3544, 3549, 86, 86, 3550, 86, 86, 3557, 3551, + 3557, 3552, 3555, 86, 3556, 86, 3557, 3557, 3557, 3553, + 3557, 3557, 3557, 3557, 3557, 3557, 3554, 47, 47, 47, + 47, 47, 47, 47, 52, 52, 52, 52, 52, 52, + 52, 57, 57, 57, 57, 57, 57, 57, 63, 63, + 63, 63, 63, 63, 63, 68, 68, 68, 68, 68, + 68, 68, 74, 74, 74, 74, 74, 74, 74, 80, + 80, 80, 80, 80, 80, 80, 89, 89, 3557, 89, + 89, 89, 89, 160, 160, 3557, 3557, 3557, 160, 160, + 162, 162, 3557, 3557, 162, 3557, 162, 164, 3557, 3557, + + 3557, 3557, 3557, 164, 167, 167, 3557, 3557, 3557, 167, + 167, 169, 3557, 3557, 3557, 3557, 3557, 169, 171, 171, + 3557, 171, 171, 171, 171, 174, 3557, 3557, 3557, 3557, + 3557, 174, 177, 177, 3557, 3557, 3557, 177, 177, 90, + 90, 3557, 90, 90, 90, 90, 17, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557 } ; -static yyconst flex_int16_t yy_chk[6834] = +static yyconst flex_int16_t yy_chk[6988] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, @@ -2350,18 +2388,18 @@ static yyconst flex_int16_t yy_chk[6834] = 5, 3, 6, 24, 4, 24, 24, 5, 24, 6, 7, 7, 7, 7, 24, 7, 8, 8, 8, 8, 33, 8, 7, 9, 9, 9, 26, 26, 8, 10, - 10, 10, 19, 29, 9, 33, 19, 29, 3491, 35, + 10, 10, 19, 29, 9, 33, 19, 29, 3565, 35, 10, 11, 11, 11, 11, 11, 11, 13, 13, 13, 13, 34, 13, 11, 35, 99, 34, 29, 38, 13, 51, 51, 11, 12, 12, 12, 12, 12, 12, 14, 14, 14, 14, 99, 14, 12, 15, 15, 15, 38, 23, 14, 23, 23, 12, 23, 46, 15, 16, 16, - 16, 23, 23, 25, 27, 27, 25, 25, 2838, 16, + 16, 23, 23, 25, 27, 27, 25, 25, 2894, 16, 25, 46, 27, 30, 30, 25, 27, 56, 40, 27, 56, 73, 31, 31, 25, 28, 67, 67, 30, 32, 28, 31, 40, 32, 28, 73, 32, 28, 92, 28, - 28, 92, 31, 32, 1127, 32, 36, 36, 37, 37, + 28, 92, 31, 32, 1138, 32, 36, 36, 37, 37, 28, 45, 45, 37, 97, 36, 45, 97, 41, 41, 45, 36, 87, 41, 93, 36, 87, 37, 93, 37, @@ -2400,700 +2438,716 @@ static yyconst flex_int16_t yy_chk[6834] = 200, 201, 202, 197, 203, 204, 201, 202, 205, 197, 197, 199, 196, 206, 205, 207, 203, 206, 208, 200, 207, 209, 213, 210, 211, 204, 214, 213, 216, 217, - 556, 214, 218, 216, 208, 209, 211, 205, 210, 211, + 559, 214, 218, 216, 208, 209, 211, 205, 210, 211, 215, 215, 220, 220, 215, 219, 215, 221, 218, 217, - 222, 219, 223, 221, 556, 224, 222, 227, 215, 221, + 222, 219, 223, 221, 559, 224, 222, 227, 215, 221, 215, 224, 225, 227, 228, 229, 230, 231, 225, 228, - 230, 229, 223, 231, 232, 234, 233, 225, 235, 236, - 237, 232, 233, 238, 235, 239, 237, 240, 234, 241, - 245, 243, 242, 239, 241, 244, 238, 246, 248, 236, - - 240, 242, 246, 246, 247, 238, 243, 250, 249, 247, - 245, 244, 249, 251, 252, 253, 248, 254, 255, 251, - 257, 253, 259, 255, 258, 261, 263, 264, 259, 250, - 260, 258, 252, 252, 262, 270, 260, 254, 263, 257, - 262, 264, 265, 265, 261, 266, 266, 267, 268, 269, - 271, 269, 272, 267, 268, 271, 273, 274, 270, 275, - 277, 276, 288, 278, 272, 274, 276, 279, 269, 278, - 283, 267, 280, 279, 282, 273, 281, 280, 284, 275, - 282, 281, 285, 277, 286, 283, 287, 288, 290, 289, - 293, 290, 284, 293, 287, 289, 294, 291, 286, 291, - - 285, 292, 292, 295, 295, 296, 296, 297, 299, 298, - 301, 299, 300, 302, 294, 303, 300, 304, 174, 301, - 305, 303, 302, 297, 298, 306, 305, 306, 307, 308, - 314, 304, 310, 308, 307, 309, 309, 310, 311, 312, - 313, 315, 316, 319, 311, 312, 317, 317, 314, 318, - 308, 321, 318, 320, 322, 316, 324, 320, 323, 323, - 313, 319, 315, 325, 312, 326, 325, 327, 328, 329, - 321, 328, 322, 327, 324, 333, 331, 326, 336, 332, - 333, 329, 337, 325, 330, 331, 335, 334, 169, 335, - 334, 336, 334, 330, 337, 340, 330, 332, 340, 341, - - 341, 330, 330, 330, 330, 334, 339, 338, 334, 338, - 338, 339, 339, 342, 343, 345, 346, 344, 347, 347, - 354, 348, 349, 349, 345, 346, 348, 350, 350, 343, - 342, 351, 352, 342, 344, 344, 353, 352, 355, 354, - 356, 357, 358, 358, 360, 358, 351, 357, 353, 369, - 369, 361, 363, 362, 358, 356, 361, 363, 355, 362, - 364, 366, 375, 365, 360, 364, 365, 367, 365, 368, - 367, 364, 388, 370, 410, 366, 371, 371, 368, 370, - 372, 377, 375, 367, 376, 372, 367, 376, 367, 373, - 373, 378, 373, 388, 379, 382, 377, 381, 373, 410, - - 381, 167, 373, 384, 385, 376, 378, 373, 379, 382, - 373, 374, 374, 385, 374, 386, 381, 391, 384, 394, - 386, 386, 389, 387, 390, 392, 391, 374, 396, 387, - 374, 166, 374, 395, 374, 383, 387, 383, 383, 390, - 393, 389, 396, 399, 392, 394, 393, 383, 383, 383, - 383, 383, 397, 395, 383, 398, 400, 401, 397, 402, - 398, 404, 397, 399, 402, 403, 406, 404, 405, 405, - 407, 408, 401, 409, 411, 414, 400, 415, 398, 409, - 403, 416, 407, 412, 417, 408, 406, 418, 412, 418, - 411, 413, 413, 415, 413, 414, 420, 416, 417, 419, - - 420, 419, 419, 421, 422, 422, 423, 421, 424, 426, - 425, 430, 428, 432, 427, 431, 164, 430, 432, 419, - 428, 428, 421, 424, 431, 423, 425, 426, 427, 433, - 434, 435, 428, 433, 428, 429, 436, 435, 437, 434, - 429, 438, 440, 439, 437, 438, 439, 440, 429, 429, - 441, 443, 429, 429, 442, 442, 429, 436, 444, 444, - 445, 446, 447, 447, 443, 445, 448, 449, 450, 451, - 441, 449, 448, 452, 446, 453, 454, 454, 452, 455, - 453, 456, 457, 450, 458, 454, 459, 460, 465, 459, - 451, 455, 460, 461, 462, 467, 458, 461, 463, 463, - - 457, 456, 464, 466, 466, 471, 462, 464, 472, 465, - 469, 469, 473, 474, 475, 476, 472, 467, 477, 475, - 479, 473, 481, 480, 486, 482, 471, 483, 484, 486, - 477, 487, 490, 483, 474, 476, 488, 484, 479, 482, - 479, 480, 481, 485, 488, 487, 490, 488, 489, 485, - 491, 489, 492, 493, 494, 495, 496, 494, 492, 497, - 498, 495, 499, 500, 497, 491, 501, 500, 505, 502, - 496, 501, 503, 493, 504, 506, 509, 503, 511, 495, - 510, 512, 498, 499, 502, 512, 515, 505, 506, 513, - 504, 507, 507, 511, 516, 514, 509, 507, 516, 507, - - 514, 510, 515, 518, 517, 507, 520, 507, 513, 517, - 507, 507, 521, 517, 519, 523, 524, 507, 518, 519, - 522, 521, 520, 526, 525, 520, 522, 525, 527, 529, - 523, 522, 524, 528, 528, 530, 530, 531, 532, 535, - 533, 534, 534, 536, 537, 539, 526, 538, 527, 537, - 532, 540, 531, 541, 529, 533, 538, 544, 535, 541, - 543, 544, 546, 545, 539, 536, 540, 545, 546, 543, - 547, 548, 549, 550, 551, 552, 553, 554, 566, 555, - 553, 555, 547, 566, 557, 560, 548, 550, 562, 551, - 554, 549, 557, 552, 558, 558, 559, 560, 561, 564, - - 562, 565, 559, 563, 561, 567, 563, 569, 567, 568, - 162, 571, 581, 564, 570, 581, 565, 579, 568, 570, - 570, 572, 572, 569, 571, 568, 573, 573, 568, 574, - 575, 575, 576, 576, 577, 574, 578, 580, 579, 582, - 577, 578, 578, 583, 582, 584, 586, 585, 587, 580, - 585, 586, 589, 584, 588, 590, 589, 591, 593, 592, - 594, 590, 583, 592, 595, 594, 596, 596, 597, 598, - 599, 587, 600, 588, 602, 599, 593, 591, 595, 601, - 603, 607, 604, 597, 605, 606, 603, 604, 606, 609, - 598, 600, 610, 606, 602, 601, 606, 606, 605, 607, - - 608, 608, 613, 614, 611, 612, 616, 609, 610, 611, - 612, 617, 616, 623, 618, 619, 613, 618, 614, 619, - 617, 620, 621, 622, 624, 621, 620, 625, 622, 623, - 626, 627, 628, 632, 625, 630, 627, 629, 629, 631, - 633, 619, 624, 626, 630, 635, 634, 636, 638, 160, - 642, 638, 628, 636, 632, 634, 633, 635, 631, 637, - 639, 639, 643, 639, 640, 637, 641, 640, 642, 644, - 645, 641, 646, 648, 644, 647, 643, 650, 646, 648, - 647, 649, 651, 653, 649, 652, 654, 651, 655, 645, - 652, 652, 656, 655, 657, 658, 653, 660, 656, 654, - - 659, 669, 650, 663, 658, 659, 663, 655, 655, 661, - 661, 662, 665, 657, 664, 668, 668, 660, 662, 671, - 664, 663, 666, 667, 665, 673, 669, 666, 667, 667, - 670, 672, 670, 672, 674, 675, 676, 666, 671, 677, - 678, 679, 680, 673, 685, 679, 678, 681, 682, 683, - 684, 680, 674, 675, 687, 676, 685, 686, 688, 677, - 687, 689, 681, 682, 690, 691, 692, 683, 695, 684, - 693, 701, 686, 694, 696, 689, 690, 694, 688, 697, - 698, 699, 704, 700, 691, 701, 695, 692, 700, 693, - 696, 702, 702, 705, 707, 706, 704, 697, 698, 698, - - 699, 703, 708, 709, 710, 703, 706, 708, 707, 711, - 712, 713, 705, 714, 715, 718, 713, 712, 719, 709, - 714, 716, 711, 710, 717, 719, 716, 720, 721, 717, - 722, 723, 725, 718, 724, 730, 720, 725, 715, 722, - 724, 726, 721, 723, 726, 727, 728, 729, 731, 727, - 730, 732, 733, 733, 734, 734, 729, 735, 735, 736, - 728, 737, 731, 734, 736, 739, 741, 740, 743, 744, - 737, 742, 732, 740, 745, 742, 746, 747, 749, 750, - 743, 748, 746, 751, 739, 747, 741, 754, 748, 757, - 760, 761, 745, 772, 744, 763, 749, 761, 770, 760, - - 764, 763, 754, 751, 750, 752, 757, 752, 85, 764, - 752, 766, 765, 772, 752, 766, 770, 752, 767, 767, - 768, 768, 769, 771, 752, 752, 773, 752, 765, 775, - 776, 777, 773, 769, 780, 776, 778, 771, 774, 774, - 774, 782, 774, 779, 781, 774, 782, 779, 781, 775, - 774, 783, 777, 785, 778, 784, 774, 774, 780, 786, - 784, 788, 787, 791, 781, 787, 788, 788, 785, 789, - 783, 790, 790, 798, 792, 798, 789, 794, 791, 792, - 793, 793, 794, 795, 786, 796, 795, 797, 797, 799, - 796, 800, 801, 802, 804, 803, 801, 805, 805, 810, - - 806, 799, 804, 807, 808, 808, 809, 811, 814, 814, - 800, 810, 812, 802, 803, 806, 813, 807, 812, 819, - 815, 813, 817, 825, 809, 815, 815, 817, 818, 811, - 820, 825, 821, 822, 818, 824, 820, 821, 819, 822, - 823, 824, 828, 823, 826, 826, 827, 827, 829, 830, - 828, 831, 832, 833, 830, 834, 835, 835, 831, 836, - 838, 838, 840, 837, 844, 850, 829, 839, 836, 833, - 832, 837, 845, 839, 834, 842, 843, 845, 846, 847, - 849, 840, 847, 851, 842, 843, 848, 846, 844, 852, - 850, 848, 851, 853, 849, 854, 854, 855, 853, 853, - - 856, 857, 852, 858, 859, 860, 867, 862, 860, 862, - 857, 864, 855, 863, 863, 865, 860, 866, 869, 856, - 865, 868, 859, 870, 871, 872, 867, 858, 874, 876, - 873, 875, 864, 871, 873, 876, 877, 878, 866, 879, - 869, 868, 880, 870, 882, 877, 874, 881, 872, 878, - 875, 883, 882, 881, 884, 886, 880, 887, 879, 884, - 885, 885, 888, 889, 890, 883, 891, 892, 893, 895, - 894, 888, 890, 896, 886, 895, 898, 887, 897, 896, - 899, 900, 898, 889, 903, 901, 891, 893, 903, 892, - 894, 901, 897, 902, 899, 904, 905, 906, 907, 902, - - 909, 900, 906, 908, 908, 910, 909, 911, 905, 912, - 911, 910, 913, 915, 904, 914, 905, 916, 916, 907, - 917, 914, 921, 918, 924, 913, 919, 912, 918, 919, - 920, 923, 923, 915, 925, 920, 920, 921, 917, 922, - 926, 927, 919, 922, 919, 926, 924, 929, 930, 933, - 932, 934, 936, 936, 925, 937, 939, 939, 940, 937, - 927, 941, 930, 932, 938, 941, 942, 962, 962, 933, - 944, 929, 934, 935, 943, 944, 935, 945, 935, 938, - 946, 942, 935, 940, 935, 946, 946, 947, 943, 935, - 948, 945, 950, 949, 935, 951, 947, 949, 953, 952, - - 951, 954, 955, 953, 948, 956, 958, 950, 957, 949, - 951, 952, 958, 959, 960, 954, 961, 957, 959, 956, - 960, 963, 961, 955, 964, 965, 963, 966, 969, 970, - 964, 967, 972, 975, 970, 973, 973, 974, 971, 976, - 969, 975, 974, 977, 972, 980, 966, 965, 978, 967, - 968, 968, 971, 979, 981, 976, 968, 977, 968, 983, - 981, 980, 984, 982, 968, 985, 986, 978, 982, 968, - 968, 983, 979, 987, 988, 988, 968, 990, 989, 992, - 984, 985, 989, 993, 986, 992, 993, 994, 995, 996, - 997, 987, 999, 995, 998, 1001, 997, 990, 1002, 998, - - 1003, 1005, 996, 1004, 1001, 1006, 994, 1002, 1007, 1004, - 1005, 999, 1008, 1007, 1009, 1010, 1003, 1011, 1012, 1014, - 1015, 1013, 1018, 1021, 1006, 1014, 1020, 1012, 1009, 1011, - 1013, 1022, 1008, 1016, 1023, 1010, 1022, 1015, 1018, 1016, - 1020, 1024, 1025, 1021, 1026, 1027, 1028, 1031, 1032, 80, - 1027, 1028, 1031, 1023, 1035, 1024, 1036, 1032, 1034, 1026, - 1025, 1033, 1033, 1035, 1034, 1037, 1039, 1040, 1045, 1044, - 1046, 1036, 1040, 1040, 1043, 1042, 1042, 1043, 1037, 1042, - 1047, 1048, 1039, 1044, 1049, 1050, 1046, 1051, 1045, 1052, - 1053, 1050, 1054, 1058, 1048, 1052, 1055, 1054, 1047, 1049, - - 1057, 1059, 1061, 1057, 1060, 1053, 1059, 1051, 1062, 1060, - 1055, 1063, 1065, 1067, 1058, 1064, 1063, 1062, 1061, 1067, - 1064, 1068, 1069, 1070, 1065, 1071, 1071, 1072, 1069, 1070, - 1073, 1074, 1075, 1075, 1074, 1076, 1072, 1068, 1077, 1078, - 1079, 1080, 1083, 1079, 1081, 1082, 1085, 1083, 1073, 1091, - 1081, 1082, 1085, 1076, 1080, 1084, 1086, 1077, 1087, 1078, - 1084, 1086, 1089, 1090, 1087, 1092, 1097, 1089, 1093, 1091, - 1095, 1092, 1098, 1093, 1094, 1094, 1096, 1099, 1101, 1095, - 1099, 1090, 1102, 1100, 1097, 1096, 1100, 1102, 1103, 1101, - 1104, 1098, 1105, 1106, 1107, 1108, 1109, 1110, 1110, 1106, - - 1107, 1109, 1104, 1111, 1112, 1113, 1103, 1114, 1115, 1116, - 1108, 1105, 1115, 1118, 1117, 1119, 1121, 1113, 1112, 1122, - 1122, 1123, 1111, 1117, 1126, 1114, 1124, 1116, 1125, 1123, - 1129, 1124, 1118, 1125, 1128, 1121, 1131, 1130, 1132, 1134, - 1119, 1131, 1133, 1133, 1126, 1129, 1135, 1132, 1128, 1130, - 1136, 1137, 1135, 1138, 1141, 1139, 1136, 1139, 1138, 1134, - 1140, 1142, 1144, 1145, 1143, 1140, 1146, 1137, 1141, 1143, - 1147, 1148, 1151, 1146, 1152, 1142, 1153, 1144, 1150, 1150, - 1155, 1154, 1145, 1156, 75, 1147, 1151, 1154, 1156, 1158, - 1148, 1153, 1152, 1158, 1159, 1159, 1160, 1156, 1162, 1156, - - 1155, 1160, 1156, 1161, 1161, 1162, 1163, 1164, 1165, 1167, - 1164, 1166, 1168, 1169, 1170, 74, 1171, 1168, 1167, 1172, - 1163, 1171, 1174, 1173, 1176, 1176, 1170, 1165, 1179, 1166, - 1177, 1178, 1169, 1172, 1173, 1177, 1178, 1180, 1182, 1181, - 1183, 1174, 1180, 1181, 1184, 1185, 1186, 1182, 1179, 1188, - 1187, 1189, 1190, 1191, 1192, 1183, 1188, 1196, 1186, 1184, - 1193, 1194, 1195, 1189, 1185, 1187, 1193, 1197, 1195, 1198, - 1199, 1190, 1192, 1200, 1191, 1202, 1194, 1196, 1198, 1201, - 1203, 1204, 1205, 1206, 1208, 1199, 1209, 1197, 1205, 1211, - 1208, 1201, 1200, 1210, 1202, 1212, 1204, 1211, 1213, 1214, - - 1215, 1209, 1217, 1206, 1214, 1203, 1218, 1210, 1281, 1219, - 1281, 1216, 1215, 1222, 1213, 1212, 1216, 1216, 1220, 1220, - 1218, 1217, 1219, 1221, 1221, 1223, 1222, 1224, 1221, 1225, - 1225, 1221, 1221, 1224, 1223, 1226, 1221, 1228, 1227, 1229, - 1226, 1232, 1221, 1228, 1229, 1230, 1221, 1227, 1231, 1231, - 1230, 1233, 1233, 1234, 1235, 1236, 1234, 1237, 1234, 1238, - 1239, 1240, 1232, 1237, 1241, 1242, 1240, 1245, 1238, 1243, - 1244, 1249, 1245, 1236, 1235, 1243, 1244, 1246, 1241, 1247, - 1239, 1246, 1248, 1242, 1260, 1249, 1255, 1248, 1247, 1250, - 1250, 1251, 1251, 1247, 1251, 1247, 1252, 1247, 1254, 1247, - - 1256, 1255, 1254, 1257, 1258, 1259, 1260, 1252, 1261, 1258, - 1258, 1262, 1257, 1261, 1259, 1263, 1264, 1265, 1256, 1266, - 1267, 1268, 1268, 1269, 1263, 1262, 1267, 1270, 1272, 1271, - 1273, 1269, 1275, 1266, 1271, 1264, 1265, 1274, 1276, 1273, - 1277, 1270, 1272, 1279, 1274, 1277, 1278, 1278, 1280, 1280, - 1275, 1283, 1284, 1285, 1283, 1286, 1288, 1284, 1279, 1287, - 1287, 1289, 1289, 1276, 1286, 1290, 1290, 1292, 1291, 1293, - 1294, 1294, 1285, 1291, 1295, 1296, 1288, 1297, 1298, 1299, - 1297, 1300, 1301, 1303, 1306, 1299, 1300, 1302, 1292, 1302, - 1293, 1301, 1296, 1305, 1295, 1307, 1305, 1308, 1298, 1306, - - 1307, 1303, 1309, 1311, 1310, 1313, 1312, 1309, 1311, 1312, - 1313, 1308, 1310, 1314, 1314, 1315, 1316, 1317, 1318, 1319, - 1315, 1321, 1322, 1317, 1323, 1318, 1324, 1321, 1322, 1323, - 1325, 1324, 1319, 1326, 1316, 1327, 1325, 1328, 1329, 1329, - 1330, 1332, 1326, 1333, 1335, 1334, 1332, 1336, 1328, 1337, - 1338, 1339, 1340, 1344, 1327, 1334, 1338, 1339, 1340, 1335, - 1330, 1333, 1342, 1343, 1345, 1347, 1346, 1336, 1342, 1348, - 1349, 1349, 1337, 1344, 1350, 1351, 1353, 1343, 1346, 1347, - 1352, 1353, 1355, 1343, 1345, 1354, 1354, 1348, 1356, 1358, - 1359, 1360, 1361, 1356, 1350, 1359, 1359, 1363, 1352, 1362, - - 1351, 1361, 1364, 1365, 1367, 1355, 1369, 1362, 1358, 1360, - 1368, 1363, 1368, 1367, 1366, 1373, 1375, 1364, 1365, 1366, - 1369, 1365, 1366, 1371, 1372, 1374, 1373, 1376, 1372, 1371, - 1374, 1374, 1377, 1378, 1379, 1375, 1380, 1381, 1378, 1379, - 1382, 1383, 1385, 68, 1386, 1382, 1387, 1388, 1388, 1390, - 1377, 1389, 1391, 1376, 1380, 1389, 1385, 1381, 1393, 1392, - 1394, 1383, 1386, 1395, 1387, 1392, 1396, 1390, 1397, 1398, - 1393, 1391, 1402, 1399, 1403, 1400, 1406, 1395, 1399, 1394, - 1401, 1396, 1400, 1397, 1404, 1401, 1405, 1405, 1398, 1407, - 1402, 1406, 1408, 1404, 1410, 1403, 1409, 1409, 1407, 1411, - - 1410, 1412, 1413, 1413, 1415, 1411, 1414, 1414, 1416, 1417, - 1415, 1418, 1408, 1419, 1420, 1412, 1418, 1421, 1428, 1419, - 1420, 1422, 1422, 1421, 1416, 1423, 1423, 1425, 1425, 1426, - 1417, 1427, 1429, 1426, 1430, 1431, 1428, 1434, 1432, 1435, - 1427, 1433, 1433, 1438, 1429, 1432, 1436, 1435, 1430, 1437, - 1431, 1436, 1441, 1439, 1443, 1440, 1444, 1434, 1439, 1439, - 1440, 1440, 1438, 1437, 1442, 1442, 1446, 1445, 1447, 1448, - 1449, 1446, 1441, 1443, 1450, 1444, 1445, 1451, 1452, 1453, - 1450, 1455, 1451, 1458, 1454, 1456, 1457, 1447, 1449, 1448, - 1454, 1456, 1457, 1459, 1460, 1461, 1462, 1463, 1452, 1469, - - 1455, 1464, 1458, 1465, 1465, 1453, 1466, 1467, 1468, 1466, - 1462, 1469, 1459, 1460, 1461, 1475, 1464, 1474, 1463, 1470, - 1470, 1471, 1471, 1472, 1475, 1473, 1467, 1468, 1472, 1473, - 1474, 1476, 1477, 1481, 1477, 1479, 1480, 1482, 1477, 1483, - 1485, 1480, 1484, 1484, 1476, 1485, 1486, 1487, 1481, 1489, - 1488, 1477, 1486, 1479, 1489, 1483, 1490, 1482, 1492, 1493, - 1490, 1491, 1487, 1488, 1494, 1491, 1495, 1499, 1496, 1497, - 1497, 1501, 63, 1494, 1496, 1502, 1505, 1493, 1492, 1516, - 1502, 1503, 1503, 1504, 1511, 1499, 1495, 1507, 1507, 1504, - 1509, 1512, 1501, 1509, 1510, 1510, 1505, 1515, 1514, 1516, - - 1511, 1514, 1517, 1518, 1519, 1519, 1520, 1512, 1521, 1522, - 1523, 1517, 1524, 1525, 1525, 1523, 1526, 1527, 1515, 1528, - 1529, 1520, 1530, 1518, 1532, 1526, 1524, 1540, 1522, 1521, - 1531, 1531, 1533, 1535, 1528, 1527, 1534, 1538, 1532, 1536, - 1536, 1534, 1530, 1537, 1541, 1529, 1544, 1537, 1535, 1540, - 1533, 1539, 1539, 1542, 1543, 1545, 1548, 1538, 1543, 1548, - 1545, 1547, 1547, 1541, 1542, 1544, 1549, 1550, 1551, 1552, - 1554, 1553, 1550, 1556, 1555, 1557, 1557, 1558, 1563, 1549, - 1559, 1560, 1558, 1563, 1551, 1553, 1562, 1552, 1555, 1554, - 1554, 1561, 1561, 1564, 1565, 1562, 1565, 1566, 1556, 1567, - - 1559, 1560, 1566, 1568, 1569, 1567, 1571, 1572, 1572, 1573, - 1569, 1574, 1577, 1564, 1576, 1578, 1578, 1574, 1580, 1576, - 1571, 1579, 1579, 1568, 1581, 1582, 1583, 1585, 1573, 1583, - 1584, 1584, 1580, 1587, 1586, 1595, 1577, 1589, 1588, 58, - 1582, 1588, 1581, 1589, 1588, 1585, 1586, 1590, 1591, 1593, - 1594, 1591, 1590, 1587, 1596, 1594, 1588, 1596, 1593, 1598, - 1595, 1597, 1597, 1599, 1603, 1598, 1600, 1591, 1606, 1599, - 1603, 1600, 1601, 1601, 1602, 1602, 1604, 1605, 1607, 1608, - 1609, 1604, 1610, 1609, 1612, 1611, 1606, 1613, 1610, 1612, - 1605, 1611, 1614, 1613, 1618, 1615, 1619, 1607, 1617, 1608, - - 1615, 1616, 1616, 1617, 1620, 1621, 1622, 1623, 1624, 1625, - 1626, 1629, 1618, 1627, 1636, 1614, 1619, 1627, 1638, 1632, - 1622, 1623, 1624, 1620, 1628, 1621, 1628, 1625, 1633, 1630, - 1629, 1632, 1634, 1635, 1636, 1626, 1630, 1637, 1638, 1635, - 1633, 1639, 1640, 1642, 1642, 1634, 1643, 1644, 1645, 1646, - 1646, 1648, 1644, 1637, 1647, 1639, 1649, 1650, 1651, 1652, - 1645, 1653, 1655, 1640, 1654, 1648, 1643, 1651, 1653, 1647, - 1657, 1659, 57, 1654, 1652, 1650, 1654, 1663, 1655, 1660, - 1649, 1664, 1660, 1661, 1661, 1657, 1662, 1662, 1665, 1663, - 1657, 1665, 1666, 1666, 1667, 1668, 1659, 1669, 1670, 1664, - - 1671, 1670, 1669, 1672, 1673, 1671, 1674, 1667, 1675, 1676, - 1677, 1678, 1679, 1679, 1668, 1674, 1680, 1678, 1676, 1677, - 1673, 1676, 1672, 1682, 1681, 1683, 1684, 1675, 1685, 1690, - 1686, 1687, 1691, 1685, 1685, 1686, 1680, 1681, 1694, 1683, - 1693, 1682, 1684, 1687, 1692, 1692, 1695, 1694, 1696, 1696, - 1691, 1695, 1697, 1698, 1690, 1699, 1693, 1700, 1698, 1701, - 1702, 1697, 1704, 1696, 1697, 1702, 1702, 1705, 1706, 1707, - 1709, 1710, 1710, 1699, 1707, 1708, 1704, 1701, 1700, 1711, - 1713, 1708, 1705, 1717, 1712, 1711, 1714, 1715, 1709, 1712, - 1706, 1718, 1714, 1715, 1713, 1719, 1720, 1721, 1722, 1724, - - 1721, 1719, 1726, 1717, 1722, 1718, 1721, 1724, 1727, 1720, - 1728, 1729, 1731, 1730, 1732, 1733, 1729, 1734, 1728, 1735, - 1737, 1726, 1730, 1732, 1739, 1731, 1737, 1727, 1733, 1736, - 1736, 1734, 1738, 1735, 1740, 1740, 1741, 1739, 1738, 1742, - 1743, 1744, 1744, 1746, 1747, 1745, 1748, 1749, 1752, 1746, - 1753, 1736, 1751, 1751, 1753, 1754, 1741, 1742, 1745, 1743, - 1754, 1755, 1748, 1759, 1756, 1749, 1747, 1757, 1752, 1756, - 1758, 1761, 1757, 1763, 1762, 1764, 1763, 1765, 1767, 1758, - 1769, 1755, 1761, 1762, 1766, 1766, 1759, 1764, 1768, 1770, - 1770, 1771, 1765, 1776, 1772, 1773, 1774, 1767, 1777, 1769, - - 1768, 1772, 1779, 1778, 1780, 1771, 1786, 1773, 1774, 1778, - 1781, 1786, 1776, 1791, 1779, 1791, 1781, 1793, 1777, 1782, - 1782, 1783, 1780, 1787, 1783, 1784, 1784, 1788, 1789, 1789, - 1790, 1792, 1787, 1788, 1792, 1794, 1795, 1793, 1796, 1797, - 1798, 1799, 1790, 1800, 1797, 1798, 1801, 1802, 1804, 1803, - 1799, 1807, 1802, 1810, 1795, 1800, 1796, 1794, 1803, 1806, - 1805, 1801, 1808, 1808, 1806, 1805, 1807, 1809, 1804, 1812, - 1813, 1803, 1805, 1809, 1810, 1814, 1815, 1816, 1817, 1816, - 1818, 1818, 1819, 1819, 1820, 1820, 1821, 1824, 1812, 1813, - 1825, 1814, 1817, 1835, 1817, 1838, 1815, 1822, 1822, 1823, - - 1823, 1826, 1826, 1827, 1828, 1832, 1821, 1827, 1824, 1829, - 1828, 1825, 1829, 1831, 1833, 1838, 1834, 1841, 1835, 1831, - 1833, 1834, 1836, 1832, 1839, 1836, 1837, 1837, 1842, 1839, - 1840, 1840, 1841, 1843, 1844, 1845, 1845, 1846, 1843, 1844, - 1847, 1848, 1846, 1849, 1850, 1851, 1847, 1853, 52, 1842, - 1852, 1857, 1855, 1848, 1848, 1848, 1852, 1855, 1855, 1856, - 1848, 1859, 1850, 1849, 1860, 1851, 1857, 1853, 1858, 1861, - 1858, 1862, 1859, 1856, 1863, 1861, 1864, 1865, 1865, 1860, - 1862, 1866, 1867, 1867, 1868, 1872, 1869, 1870, 1870, 1871, - 1871, 1875, 1875, 1876, 1863, 1880, 1881, 1864, 1882, 1884, - - 1877, 1879, 1881, 1888, 1868, 1872, 1885, 1866, 1869, 1877, - 1879, 1883, 1883, 1890, 1882, 1886, 1880, 1887, 1876, 1891, - 1884, 1885, 1886, 1889, 1889, 1893, 1887, 1894, 1895, 1888, - 1893, 1896, 1900, 1894, 1897, 1891, 1901, 1904, 1896, 1890, - 1897, 1898, 1901, 1898, 1902, 1902, 1904, 1903, 1895, 1905, - 1907, 1900, 1903, 1906, 1908, 1909, 1910, 1908, 1911, 1911, - 1912, 1913, 1907, 1914, 1915, 1918, 1912, 1913, 1922, 1905, - 1916, 1919, 1906, 1909, 1916, 1920, 1921, 1921, 1925, 1915, - 1920, 1923, 1910, 1914, 1926, 1918, 1934, 1922, 1926, 1928, - 1916, 1927, 1927, 1919, 1929, 1928, 1923, 1925, 1930, 1930, - - 1931, 1932, 1935, 1929, 1931, 1933, 1933, 1934, 1936, 1937, - 1938, 1939, 1932, 1940, 1937, 1941, 1935, 1932, 1943, 1940, - 1942, 1944, 1947, 1943, 1945, 1945, 1947, 1936, 1946, 1946, - 1938, 1939, 1949, 1941, 1944, 1942, 1950, 1951, 1952, 1952, - 1955, 1949, 1954, 1954, 1956, 1955, 1955, 1950, 1958, 1959, - 1956, 1960, 1950, 1961, 1958, 1962, 1960, 1951, 1964, 1965, - 1966, 1962, 1968, 1965, 1970, 1961, 1967, 1967, 1969, 1973, - 1964, 1971, 1966, 1974, 1969, 1959, 1975, 1971, 1972, 1972, - 1976, 1975, 1978, 1979, 1980, 1986, 1970, 1968, 1973, 1980, - 1983, 1983, 1976, 1974, 1978, 1982, 1984, 1984, 1982, 1985, - - 1985, 1987, 1979, 1988, 1990, 1986, 1989, 1987, 1991, 1988, - 1990, 1989, 1995, 1993, 1996, 1995, 1999, 1991, 1993, 1997, - 1997, 2000, 2001, 2002, 2002, 2003, 1996, 2001, 1999, 2006, - 2004, 2005, 2006, 2000, 2003, 2004, 2005, 2007, 2007, 2008, - 2009, 2012, 2010, 2011, 2014, 2012, 2013, 2015, 2016, 2009, - 2014, 2013, 2017, 2018, 2020, 2020, 2021, 2016, 2023, 2008, - 2010, 2027, 2011, 2022, 2025, 2015, 2020, 2018, 2024, 2024, - 2017, 2026, 2022, 2025, 2021, 2028, 2029, 2035, 2023, 2036, - 2028, 2038, 2027, 2026, 2032, 2032, 2039, 2034, 2040, 2029, - 2034, 2041, 2044, 2035, 2040, 2036, 2038, 2042, 2042, 2043, - - 2039, 2043, 2045, 2045, 2046, 2048, 2048, 2051, 2041, 2052, - 2044, 2053, 2046, 2049, 2049, 2052, 2055, 2053, 2054, 2056, - 2057, 2058, 2058, 2055, 2059, 2060, 2061, 2062, 2063, 2065, - 2051, 2067, 2054, 2059, 2066, 2064, 2069, 2067, 2061, 2062, - 2057, 2056, 2070, 2063, 2073, 2071, 2060, 2064, 2074, 2066, - 2067, 2072, 2072, 2077, 2076, 2065, 2069, 2071, 2075, 2076, - 2081, 2075, 2073, 2087, 2079, 2070, 2082, 2083, 2074, 2079, - 2080, 2082, 2080, 2077, 2083, 2085, 2088, 2089, 2081, 2091, - 2090, 2087, 2090, 2095, 2085, 2088, 2092, 2097, 2094, 2089, - 2094, 2098, 2092, 2096, 2096, 2100, 2098, 2095, 2091, 2099, - - 2100, 2099, 2101, 2102, 2103, 2104, 2106, 2101, 2107, 2105, - 2108, 2104, 2111, 2097, 2105, 2108, 2108, 2109, 2112, 2106, - 2107, 2102, 2113, 2113, 2103, 2109, 2114, 2114, 2115, 2116, - 2117, 2111, 2112, 2118, 2120, 2119, 2117, 2119, 2118, 2121, - 2122, 2122, 2123, 2115, 2124, 2124, 2128, 2121, 2126, 2116, - 2125, 2125, 2120, 2127, 2123, 2121, 2130, 2126, 2127, 2131, - 2132, 2131, 2134, 2136, 2128, 2130, 2133, 2135, 2130, 2143, - 2138, 2133, 2133, 2139, 2134, 2136, 2135, 2142, 2139, 2140, - 2146, 2132, 2138, 2144, 2140, 2145, 2145, 2147, 2148, 2143, - 2142, 2149, 2144, 2150, 2151, 2152, 2154, 2156, 2146, 2155, - - 2152, 2157, 2165, 2159, 2148, 2147, 2157, 2150, 2154, 2151, - 2158, 2155, 2159, 2162, 2164, 2158, 2149, 2156, 2166, 2162, - 2164, 2167, 2168, 2170, 2170, 2165, 2169, 2171, 2172, 2172, - 2173, 2174, 2162, 2166, 2175, 2169, 2171, 2176, 2175, 2167, - 2177, 2179, 2176, 2180, 2181, 2187, 2182, 2168, 2173, 2180, - 2174, 2182, 2182, 2177, 2185, 2183, 2184, 2185, 2196, 2186, - 2179, 2183, 2184, 2190, 2190, 2187, 2181, 2186, 2191, 2191, - 2192, 2193, 2193, 2194, 2194, 2195, 2196, 2198, 2197, 2192, - 2199, 2199, 2198, 2191, 2197, 2200, 2200, 2195, 2201, 2202, - 2205, 2207, 2204, 2201, 2191, 2202, 2204, 2206, 2209, 2210, - - 2212, 2206, 2211, 2213, 2210, 2215, 2214, 2216, 2213, 2217, - 2205, 2207, 2218, 2221, 2217, 2212, 2219, 2219, 2220, 2223, - 2224, 2215, 2220, 2209, 2214, 2211, 2222, 2216, 2221, 2225, - 2226, 2222, 2227, 2228, 2218, 2229, 2232, 2227, 2224, 2230, - 2230, 2225, 2233, 2234, 2232, 2223, 2228, 2235, 2236, 2226, - 2237, 2239, 2238, 2229, 2240, 2245, 2243, 2249, 2241, 2247, - 2246, 2233, 2234, 2239, 2241, 2247, 2250, 2250, 2245, 2237, - 2235, 2243, 2236, 2238, 2246, 2240, 2248, 2249, 2248, 2251, - 2252, 2253, 2254, 2252, 2251, 2255, 2256, 2256, 2257, 2257, - 2258, 2260, 2258, 47, 2253, 2261, 2254, 2269, 2255, 2259, - - 2259, 2262, 2262, 2263, 2264, 2264, 2260, 2270, 2261, 2265, - 2265, 2266, 2263, 2268, 2271, 2263, 2266, 2269, 2268, 2272, - 2272, 2273, 2273, 2274, 2275, 2275, 2271, 2270, 2276, 2277, - 2277, 2279, 2278, 2280, 2280, 2282, 2279, 2281, 2281, 2283, - 2284, 2285, 2274, 2286, 2290, 2288, 2276, 2278, 2283, 2282, - 2288, 2289, 2289, 2291, 2291, 2285, 2292, 2284, 2293, 2295, - 2295, 2297, 2286, 2290, 2293, 2294, 2296, 2296, 2294, 2298, - 2299, 2301, 2299, 2302, 2292, 2295, 2303, 2303, 2305, 2306, - 2297, 2307, 2310, 2308, 2298, 2311, 2301, 2308, 2309, 2309, - 2311, 2312, 2302, 2313, 2315, 2315, 2307, 2316, 2305, 2318, - - 2317, 2310, 2306, 2319, 2320, 2321, 2312, 2317, 2313, 2322, - 2322, 2323, 2324, 2318, 2324, 2325, 2328, 2316, 2325, 2327, - 2323, 2319, 2320, 2331, 2329, 2327, 2332, 2330, 2328, 2329, - 2333, 2321, 2330, 2325, 2335, 2325, 2334, 2337, 2338, 2332, - 2339, 2334, 2337, 2338, 2340, 2342, 2341, 2343, 2331, 2345, - 2340, 2333, 2341, 2344, 2345, 2339, 2346, 2347, 2348, 2344, - 2335, 2346, 2343, 2350, 2349, 2351, 2342, 2349, 2352, 2353, - 2354, 2348, 2350, 2355, 2351, 2356, 2357, 2352, 2353, 2355, - 2357, 2356, 2347, 2359, 2354, 2361, 2362, 2363, 2363, 2366, - 2364, 2365, 2365, 2367, 2367, 2362, 2364, 2368, 2366, 2369, - - 2365, 2371, 2368, 2359, 2372, 2361, 2373, 2373, 2374, 2375, - 2377, 2378, 2380, 2379, 2384, 2386, 2386, 2371, 2375, 2369, - 2372, 2369, 2377, 2374, 2380, 2383, 2382, 2378, 2379, 2382, - 2383, 2385, 2387, 2387, 2384, 2389, 2389, 2390, 2396, 2391, - 2390, 2392, 2393, 2385, 2391, 2394, 2398, 2392, 2393, 2395, - 2395, 2399, 2396, 2400, 2394, 2397, 2397, 2402, 2398, 2401, - 2401, 2403, 2404, 2402, 2406, 2399, 2407, 2404, 2406, 2407, - 2408, 2408, 2400, 2409, 2410, 2403, 2411, 2412, 2409, 2415, - 2413, 2414, 2414, 2410, 2413, 2411, 2417, 2418, 2419, 2420, - 2421, 2417, 2415, 2422, 2421, 2423, 2424, 2412, 2425, 2427, - - 2423, 2428, 2424, 2420, 2425, 2426, 2426, 2418, 2419, 2429, - 2430, 2431, 2434, 2422, 2435, 2430, 2436, 2427, 2432, 2432, - 2428, 2436, 2441, 2437, 2434, 2438, 2443, 2446, 2429, 2437, - 2435, 2441, 2431, 2438, 2439, 2452, 2439, 2444, 2444, 2445, - 2443, 2450, 2445, 2447, 2447, 2450, 2451, 2452, 2453, 2453, - 2454, 2459, 2451, 2446, 2457, 2457, 2461, 2462, 2465, 2454, - 2466, 2467, 2468, 2465, 2470, 2470, 2469, 2468, 2476, 2459, - 2461, 2469, 2474, 2462, 2472, 2472, 2475, 2475, 2474, 2477, - 2478, 2480, 2467, 2482, 2476, 2478, 2466, 2481, 2484, 2484, - 2481, 2483, 2487, 2486, 2488, 2482, 2489, 2493, 2487, 2494, - - 2480, 2477, 2486, 2483, 2491, 2491, 2492, 2496, 2496, 2492, - 2498, 2489, 2488, 2497, 2497, 2498, 2493, 2494, 2499, 2500, - 2501, 2502, 2505, 2502, 2503, 2501, 2504, 2506, 2500, 2507, - 2508, 2546, 2506, 2546, 2505, 18, 2499, 2509, 2503, 2515, - 2504, 2514, 2509, 2510, 2510, 2511, 2511, 2512, 2512, 2507, - 2508, 2513, 2513, 2514, 2516, 2517, 2517, 2515, 2519, 2516, - 2518, 2518, 2520, 2521, 2522, 2523, 2526, 2524, 2525, 2525, - 2519, 2527, 2527, 2528, 2528, 2521, 2529, 2530, 2532, 2533, - 2535, 2531, 2520, 2524, 2522, 2526, 2523, 2529, 2531, 2530, - 2532, 2534, 2536, 2537, 2537, 2538, 2534, 2539, 2539, 2533, - - 2535, 2540, 2541, 2542, 2538, 2543, 2544, 2547, 2545, 2548, - 2548, 2550, 2536, 2551, 2549, 2553, 2542, 2554, 2555, 2547, - 2544, 2556, 2541, 2549, 2556, 2576, 2550, 2540, 2551, 2543, - 2545, 2557, 2558, 2553, 2576, 2559, 2567, 2558, 2569, 2554, - 2559, 2555, 2560, 2560, 2568, 2557, 2561, 2561, 2562, 2562, - 2564, 2564, 2566, 2566, 2567, 2568, 2570, 2569, 2572, 2573, - 2574, 2575, 2578, 2577, 2578, 2579, 2580, 2586, 2581, 2582, - 2582, 2570, 2584, 2584, 2585, 2588, 2588, 2573, 2572, 2591, - 2591, 2575, 2574, 2577, 2580, 2579, 2581, 2587, 2585, 2586, - 2590, 2592, 2593, 2594, 2603, 2596, 2587, 2595, 2597, 2590, - - 2594, 2598, 2599, 17, 2600, 2601, 2601, 2602, 2602, 2592, - 2593, 2600, 2595, 2596, 2603, 2604, 2597, 2598, 2605, 2607, - 2607, 2599, 2608, 2608, 2605, 2609, 2610, 2611, 2612, 2613, - 2614, 2609, 2615, 2604, 2616, 2614, 2617, 2618, 2620, 2618, - 2620, 2617, 2611, 2613, 2610, 2619, 2619, 2612, 2621, 2621, - 2623, 2625, 2615, 2626, 2616, 2627, 2628, 2629, 2630, 2631, - 2625, 2632, 2629, 2630, 2635, 2636, 2638, 2627, 2636, 2623, - 2637, 2637, 2626, 2639, 2640, 2640, 2628, 2641, 2642, 2631, - 2632, 2638, 2643, 2645, 2635, 2646, 2643, 2648, 2641, 2646, - 2650, 2639, 2651, 2642, 2647, 2647, 2652, 2655, 2645, 2656, - - 2648, 2653, 2653, 2657, 2659, 2650, 2663, 2657, 2656, 2655, - 2658, 2658, 2651, 2660, 2660, 2661, 2652, 2662, 2664, 2665, - 2661, 2672, 2663, 2659, 2666, 2666, 2662, 2671, 2671, 2674, - 2664, 2673, 2673, 2675, 2680, 2676, 2677, 2681, 2678, 2665, - 2679, 2679, 2674, 2672, 2676, 2677, 2675, 2678, 2683, 2683, - 2686, 2687, 2681, 2688, 2680, 2686, 2687, 2689, 2690, 2691, - 2692, 2695, 2689, 2693, 2699, 2697, 2690, 2688, 2698, 2692, - 2697, 2693, 2702, 2698, 2700, 2700, 2695, 2702, 2691, 2699, - 2701, 2701, 2703, 2704, 2704, 2705, 2706, 2707, 2708, 2709, - 0, 2706, 2705, 2710, 2712, 2709, 2711, 2711, 2710, 2713, - - 2718, 2703, 2714, 2714, 2713, 2707, 2708, 2715, 2715, 2712, - 2719, 2719, 2720, 2718, 2721, 2720, 2722, 2723, 2724, 2721, - 2721, 2722, 2723, 2725, 2726, 2727, 2728, 2729, 2726, 2725, - 2727, 2730, 2724, 2731, 2732, 2728, 2734, 2733, 2735, 2730, - 2732, 2734, 2729, 2733, 2737, 2739, 2741, 2738, 2739, 2745, - 2735, 2737, 2738, 2746, 2731, 2743, 2744, 2759, 2741, 2747, - 2743, 2744, 2748, 2749, 2749, 2750, 2746, 2745, 2747, 2754, - 2751, 2748, 2755, 2756, 2750, 2751, 2759, 2760, 2755, 2756, - 2761, 2762, 2762, 2763, 2764, 2765, 2766, 2754, 2767, 2767, - 2763, 2768, 2770, 2772, 2765, 2775, 2773, 2760, 2778, 2761, - - 2773, 2766, 2776, 2764, 2774, 2774, 2777, 2770, 2776, 2779, - 2768, 2781, 2777, 2772, 2784, 2779, 2778, 2780, 2780, 2781, - 2775, 2782, 2785, 2784, 2787, 2788, 2782, 2789, 2788, 2790, - 2787, 2789, 2791, 2793, 2793, 2785, 2794, 2795, 2795, 2796, - 2796, 2798, 2798, 2790, 2799, 2800, 2804, 2791, 2799, 2806, - 2800, 2802, 2802, 2805, 2794, 2808, 2810, 2807, 2805, 2811, - 2811, 2806, 2807, 2807, 2813, 2813, 2804, 2808, 2814, 2814, - 2815, 2816, 2817, 2815, 2819, 2819, 2810, 2820, 2822, 2823, - 2823, 2824, 2824, 2828, 2816, 2817, 2825, 2825, 2826, 2827, - 2827, 2829, 2830, 2831, 2840, 2820, 2828, 2837, 2822, 2831, - - 2832, 2832, 2837, 2826, 2833, 2836, 2830, 2839, 2833, 2829, - 2841, 2836, 2839, 2839, 2842, 2843, 2844, 2840, 2845, 2846, - 2852, 2843, 2844, 2846, 2847, 2847, 2850, 2855, 2852, 2853, - 2841, 2850, 2853, 2856, 2842, 2859, 2856, 2857, 2857, 2858, - 2859, 2860, 2861, 2845, 2862, 2863, 2863, 2864, 2867, 2869, - 2866, 2871, 2855, 2911, 2869, 2869, 2858, 2858, 2862, 2860, - 2865, 2864, 2861, 2865, 2866, 2868, 2880, 2867, 2911, 2870, - 2871, 2865, 2877, 2868, 2870, 2870, 2872, 2872, 2873, 2873, - 2874, 2874, 2875, 2875, 2876, 2876, 2878, 2879, 2877, 2881, - 2882, 2878, 2880, 2883, 2884, 2882, 2885, 2886, 2887, 2884, - - 2889, 2889, 2892, 2881, 2895, 2885, 0, 2879, 2890, 2890, - 2891, 2895, 2883, 2891, 2894, 2894, 2905, 2886, 2887, 2897, - 2892, 2896, 2896, 2900, 2897, 2899, 2899, 2901, 2902, 2903, - 2906, 2906, 2900, 2908, 2905, 2907, 2901, 2902, 2903, 2907, - 2909, 2910, 2908, 2912, 2913, 2914, 2915, 2924, 2912, 2912, - 2915, 2919, 2910, 2923, 2914, 2925, 2919, 2913, 2929, 2909, - 2920, 2920, 2922, 2922, 2927, 2927, 2928, 2923, 2932, 2933, - 2929, 2934, 2924, 2925, 2933, 2928, 2936, 2937, 2939, 2941, - 2934, 2943, 2944, 2937, 2945, 2945, 2943, 2944, 2946, 2948, - 2939, 2949, 2950, 2932, 2948, 2957, 2936, 2946, 2951, 2951, - - 2941, 2958, 2951, 0, 2949, 2956, 2950, 2953, 2953, 2954, - 2954, 2955, 2955, 2959, 2956, 2957, 2961, 2965, 2959, 2962, - 2958, 2963, 2961, 2967, 2962, 2966, 2963, 2964, 2964, 2968, - 2969, 2971, 2970, 2978, 2968, 2965, 0, 2966, 2970, 2972, - 2972, 2974, 2975, 2979, 2967, 2974, 2976, 2975, 2969, 2977, - 2977, 2976, 2978, 2980, 2982, 2989, 2971, 2986, 2979, 2984, - 2984, 2988, 2987, 2990, 2989, 2988, 2991, 2993, 2980, 2992, - 2986, 2994, 2993, 2996, 2982, 2987, 2997, 2992, 2998, 2990, - 2995, 2995, 2996, 2999, 2999, 2991, 3000, 3003, 3003, 3004, - 3004, 2994, 3006, 3010, 2997, 3008, 3008, 3012, 3011, 3013, - - 3017, 3014, 3012, 3018, 2998, 3000, 3014, 3016, 3016, 3010, - 3019, 3020, 3018, 3006, 3011, 3013, 3019, 3021, 3023, 3023, - 3017, 3024, 3025, 3026, 3026, 3029, 3030, 3033, 3031, 3034, - 3034, 3036, 3030, 3031, 3020, 3024, 3021, 3035, 3035, 3037, - 3039, 3025, 3038, 3038, 3040, 3029, 3036, 3041, 3042, 3033, - 3043, 3039, 3044, 3040, 3042, 3045, 3046, 3046, 3047, 3037, - 3048, 3055, 3038, 3048, 3044, 3049, 3054, 3041, 3049, 3043, - 3050, 3050, 3060, 3047, 3056, 3045, 3057, 3057, 3054, 3058, - 3056, 3055, 3058, 3059, 3063, 3063, 3062, 3064, 3065, 3059, - 3060, 3062, 3064, 3066, 3067, 3068, 3068, 3070, 3071, 3066, - - 3072, 3073, 3074, 3074, 3075, 3076, 3077, 3065, 3081, 3070, - 3082, 3067, 3067, 3081, 3073, 3077, 3071, 3079, 3079, 3080, - 3080, 3076, 3083, 3075, 3082, 3072, 3088, 3083, 3084, 3084, - 3085, 3085, 3086, 3086, 3087, 3087, 3089, 3090, 3096, 3088, - 3091, 3093, 3093, 3090, 3098, 3091, 3099, 3101, 3100, 3102, - 3102, 3104, 3104, 3105, 3106, 3108, 3107, 3096, 3110, 3110, - 3111, 3111, 3089, 3109, 3114, 3113, 3098, 3100, 3099, 3101, - 3107, 3113, 3109, 3106, 3115, 3108, 3116, 3119, 3126, 3105, - 3124, 3116, 3120, 3120, 3114, 3122, 3122, 3123, 3127, 3125, - 3126, 3133, 3123, 3115, 3124, 3125, 3127, 3129, 3119, 3128, - - 3128, 3131, 3129, 3132, 3134, 3131, 3136, 3135, 3132, 3137, - 3140, 3133, 3135, 3139, 3141, 3137, 3142, 3144, 3136, 3151, - 0, 3139, 3145, 3146, 3134, 3147, 3148, 3150, 3153, 3140, - 3155, 3148, 3150, 3153, 3141, 3144, 3142, 3152, 3145, 3151, - 3146, 3146, 3156, 3152, 3157, 3156, 3147, 3160, 3160, 3162, - 3155, 3161, 3161, 3162, 3167, 3167, 3168, 3157, 3169, 3170, - 3170, 3168, 3172, 3172, 3173, 3173, 3177, 3173, 3174, 3174, - 3177, 3174, 3175, 3175, 3179, 3176, 3176, 3169, 3176, 3179, - 3180, 3181, 3181, 3182, 3183, 3186, 3187, 3188, 3190, 3180, - 3189, 3189, 3188, 3193, 3196, 3194, 3195, 3197, 3183, 3199, - - 3195, 3182, 3194, 3196, 3200, 3186, 3187, 3202, 3190, 3200, - 3201, 3201, 3197, 3203, 3203, 3206, 3202, 3199, 3193, 3204, - 3204, 3205, 3205, 3207, 3208, 3211, 3209, 3212, 3207, 3210, - 3206, 3209, 3209, 3208, 3213, 3210, 3208, 3216, 3214, 3215, - 3217, 3217, 3212, 3214, 3215, 3218, 3219, 3220, 3220, 3222, - 3211, 3218, 3219, 3221, 3221, 3213, 3216, 3223, 3226, 3226, - 3228, 3228, 3223, 3229, 3222, 3232, 3232, 3233, 3233, 3234, - 3234, 3241, 3229, 3235, 3235, 3237, 3237, 3238, 3238, 3239, - 3239, 3240, 3240, 3243, 3244, 3244, 3245, 3246, 3247, 3249, - 3249, 3250, 3243, 3251, 3251, 3245, 3252, 3241, 3264, 3246, - - 3253, 3258, 3254, 3255, 3255, 3256, 3256, 3262, 3247, 3263, - 3250, 3252, 3263, 3253, 3254, 3266, 3258, 3259, 3259, 3265, - 3265, 3269, 3270, 3268, 3264, 3262, 3268, 3269, 3272, 3271, - 3273, 3276, 3277, 3266, 3271, 3274, 3270, 3276, 3280, 3281, - 3284, 3277, 3280, 3294, 3293, 3296, 3294, 3272, 3273, 3293, - 3302, 3274, 3297, 3297, 3281, 3298, 3298, 3305, 3296, 3300, - 3300, 3303, 3307, 3304, 3309, 3316, 3284, 3304, 3310, 3311, - 3303, 3313, 3315, 3302, 3311, 3317, 3307, 3305, 3312, 3310, - 3312, 3314, 3314, 3318, 3316, 3315, 3313, 3309, 3319, 3320, - 3322, 3321, 3323, 3317, 3324, 3332, 3325, 3323, 3327, 3318, - - 3321, 3325, 3322, 3328, 3320, 3326, 3326, 3333, 3328, 3332, - 3334, 3334, 3335, 3319, 3340, 3324, 3336, 3336, 3327, 3337, - 3337, 3335, 3338, 3338, 3339, 3339, 3341, 3333, 3342, 3343, - 3344, 3342, 3345, 3340, 3343, 3344, 3346, 3347, 3348, 3350, - 3352, 3349, 3357, 3347, 3350, 3362, 3341, 3351, 3351, 3353, - 3353, 3346, 3348, 3349, 3355, 3355, 3356, 3345, 3358, 3358, - 3352, 3357, 3360, 3362, 3365, 3365, 3366, 3366, 3367, 3368, - 3371, 3356, 3369, 3370, 3372, 3373, 3367, 3360, 3369, 3370, - 3374, 3375, 3375, 3380, 3371, 3374, 3381, 3372, 3368, 3377, - 3377, 3383, 3384, 3386, 3373, 3387, 3384, 3388, 3389, 3390, - - 3387, 3391, 3392, 3393, 3380, 3383, 3381, 3392, 3393, 3394, - 3394, 3389, 3390, 3386, 3397, 3398, 3388, 3399, 3400, 3400, - 3391, 3401, 3402, 3403, 3403, 3404, 3401, 3405, 3402, 3407, - 3404, 3408, 3405, 3398, 3397, 3406, 3399, 3408, 3410, 3410, - 3406, 3411, 3412, 3412, 3415, 3414, 3411, 3416, 3407, 3414, - 3417, 3418, 3419, 3420, 3416, 3421, 3423, 3423, 3419, 3425, - 3425, 3427, 3426, 3415, 3428, 3429, 3427, 3430, 3421, 3417, - 3418, 3426, 3420, 3432, 3426, 3431, 3431, 3433, 3432, 3435, - 3430, 3436, 3436, 3428, 3429, 3437, 3438, 3438, 3439, 3439, - 3433, 3440, 3441, 3442, 3443, 3443, 3440, 3444, 3445, 3441, - - 3445, 3447, 3444, 3448, 3437, 3435, 3446, 3446, 3447, 3449, - 3448, 3450, 3442, 3451, 3453, 3453, 3450, 3454, 3456, 3457, - 3458, 3459, 3463, 3456, 3457, 3460, 3460, 3464, 3449, 3462, - 3462, 0, 3451, 3465, 3465, 3467, 3454, 3466, 3466, 3458, - 3459, 3463, 3467, 3469, 3469, 3471, 3464, 3470, 3470, 3473, - 3476, 3477, 3471, 3478, 3473, 3476, 3479, 3479, 3480, 3480, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 3477, 0, 3478, 3484, 3484, 3484, 3484, 3484, 3484, 3484, - 3485, 3485, 3485, 3485, 3485, 3485, 3485, 3486, 3486, 3486, - 3486, 3486, 3486, 3486, 3487, 3487, 3487, 3487, 3487, 3487, - - 3487, 3488, 3488, 3488, 3488, 3488, 3488, 3488, 3489, 3489, - 3489, 3489, 3489, 3489, 3489, 3490, 3490, 3490, 3490, 3490, - 3490, 3490, 3492, 3492, 0, 3492, 3492, 3492, 3492, 3493, - 3493, 0, 0, 0, 3493, 3493, 3494, 3494, 0, 0, - 3494, 0, 3494, 3495, 0, 0, 0, 0, 0, 3495, - 3496, 3496, 0, 0, 0, 3496, 3496, 3497, 0, 0, - 0, 0, 0, 3497, 3498, 3498, 0, 3498, 3498, 3498, - 3498, 3499, 0, 0, 0, 0, 0, 3499, 3500, 3500, - 0, 0, 0, 3500, 3500, 3501, 3501, 0, 3501, 3501, - 3501, 3501, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, 3483, - 3483, 3483, 3483 + 230, 229, 223, 231, 232, 234, 232, 225, 233, 235, + 236, 232, 238, 237, 233, 235, 239, 241, 234, 237, + 240, 243, 241, 242, 239, 238, 244, 245, 248, 250, + + 236, 251, 242, 240, 238, 246, 243, 251, 247, 252, + 246, 246, 244, 247, 249, 254, 248, 245, 249, 253, + 257, 250, 261, 258, 255, 253, 259, 252, 252, 255, + 258, 260, 259, 263, 262, 254, 264, 260, 267, 257, + 262, 261, 265, 265, 267, 263, 266, 266, 268, 269, + 264, 269, 270, 271, 268, 272, 274, 273, 271, 275, + 276, 277, 267, 278, 274, 276, 279, 272, 269, 278, + 283, 285, 279, 280, 282, 270, 273, 281, 280, 275, + 282, 284, 281, 286, 277, 283, 287, 288, 290, 285, + 289, 290, 292, 292, 287, 284, 289, 286, 291, 293, + + 291, 294, 293, 295, 295, 296, 296, 297, 299, 298, + 300, 299, 288, 301, 300, 303, 302, 304, 174, 294, + 305, 303, 301, 297, 298, 302, 305, 306, 307, 306, + 310, 304, 308, 311, 307, 310, 308, 309, 309, 311, + 312, 313, 314, 315, 316, 319, 312, 317, 317, 318, + 320, 321, 318, 308, 320, 322, 324, 316, 323, 323, + 314, 313, 327, 319, 315, 312, 325, 326, 327, 325, + 321, 329, 328, 322, 324, 328, 331, 332, 335, 326, + 336, 335, 337, 329, 333, 331, 325, 330, 338, 333, + 338, 338, 169, 336, 337, 332, 330, 334, 340, 330, + + 334, 340, 334, 339, 330, 330, 330, 330, 339, 339, + 341, 341, 342, 343, 346, 334, 344, 345, 334, 348, + 348, 347, 349, 346, 350, 350, 352, 349, 343, 342, + 347, 344, 342, 353, 345, 345, 351, 351, 353, 354, + 355, 352, 356, 357, 358, 359, 359, 361, 359, 362, + 358, 354, 370, 370, 362, 363, 367, 359, 357, 355, + 364, 363, 356, 365, 359, 364, 366, 361, 365, 366, + 367, 366, 368, 369, 365, 368, 373, 371, 372, 372, + 376, 373, 369, 371, 377, 380, 378, 377, 368, 379, + 419, 368, 419, 368, 374, 374, 383, 374, 385, 380, + + 376, 378, 386, 374, 379, 377, 382, 374, 388, 382, + 383, 386, 374, 385, 388, 374, 375, 375, 387, 375, + 389, 388, 392, 387, 387, 382, 390, 393, 394, 391, + 396, 392, 375, 397, 394, 375, 395, 375, 167, 375, + 384, 389, 384, 384, 391, 390, 393, 397, 400, 401, + 396, 398, 384, 384, 384, 384, 384, 398, 399, 384, + 402, 398, 395, 399, 404, 403, 405, 407, 400, 401, + 403, 408, 405, 406, 406, 402, 409, 411, 410, 404, + 412, 399, 416, 408, 410, 415, 413, 407, 417, 418, + 409, 413, 414, 414, 424, 414, 412, 420, 416, 420, + + 420, 425, 411, 418, 417, 415, 421, 422, 423, 423, + 421, 422, 426, 424, 427, 428, 425, 420, 431, 434, + 442, 166, 429, 434, 431, 432, 422, 435, 426, 428, + 429, 429, 427, 433, 432, 436, 435, 438, 433, 437, + 442, 436, 429, 438, 429, 430, 440, 439, 441, 440, + 430, 439, 444, 441, 443, 443, 445, 445, 430, 430, + 437, 447, 430, 430, 446, 444, 430, 448, 448, 446, + 449, 450, 451, 452, 447, 450, 449, 453, 454, 455, + 455, 456, 453, 454, 457, 458, 459, 451, 455, 460, + 461, 466, 460, 456, 452, 461, 462, 463, 459, 468, + + 462, 464, 464, 458, 457, 465, 467, 467, 472, 463, + 465, 473, 466, 470, 470, 474, 475, 476, 477, 473, + 478, 468, 479, 477, 481, 475, 483, 482, 503, 472, + 486, 485, 503, 484, 479, 487, 474, 485, 476, 486, + 478, 487, 481, 488, 481, 482, 483, 484, 488, 489, + 490, 491, 492, 493, 491, 494, 495, 496, 490, 498, + 499, 490, 495, 489, 494, 498, 492, 497, 493, 501, + 497, 500, 502, 504, 499, 505, 500, 496, 504, 506, + 507, 508, 509, 498, 506, 512, 528, 513, 514, 528, + 505, 501, 516, 502, 515, 509, 507, 518, 515, 517, + + 508, 510, 510, 514, 517, 512, 519, 510, 513, 510, + 519, 516, 164, 518, 520, 510, 521, 510, 523, 520, + 510, 510, 525, 520, 522, 526, 524, 510, 525, 522, + 527, 521, 529, 525, 523, 524, 530, 523, 531, 531, + 526, 532, 533, 533, 534, 535, 527, 536, 537, 537, + 538, 539, 541, 540, 162, 529, 530, 535, 540, 534, + 542, 541, 536, 543, 544, 546, 532, 547, 548, 538, + 544, 547, 548, 539, 546, 549, 550, 551, 543, 542, + 552, 549, 553, 554, 555, 556, 560, 557, 550, 556, + 160, 558, 551, 558, 560, 562, 553, 563, 554, 552, + + 557, 562, 555, 561, 561, 564, 565, 566, 567, 563, + 566, 564, 568, 570, 569, 571, 570, 572, 565, 569, + 573, 620, 567, 574, 571, 573, 573, 568, 575, 575, + 620, 571, 582, 572, 571, 577, 574, 576, 576, 578, + 578, 577, 579, 579, 580, 583, 581, 586, 587, 585, + 580, 581, 581, 582, 585, 584, 587, 583, 584, 588, + 589, 590, 588, 591, 592, 589, 586, 593, 592, 594, + 595, 597, 596, 593, 595, 601, 597, 598, 599, 599, + 600, 602, 591, 603, 590, 604, 602, 605, 606, 594, + 596, 598, 607, 613, 606, 600, 601, 607, 608, 610, + + 612, 604, 603, 609, 611, 611, 609, 605, 614, 613, + 616, 609, 608, 614, 609, 609, 615, 610, 612, 617, + 619, 615, 621, 622, 616, 621, 619, 622, 623, 624, + 625, 626, 624, 623, 617, 625, 627, 628, 629, 631, + 630, 632, 632, 633, 628, 630, 634, 626, 635, 622, + 636, 629, 633, 637, 627, 638, 644, 639, 640, 631, + 645, 644, 637, 639, 640, 634, 636, 638, 641, 635, + 646, 641, 642, 642, 643, 642, 647, 643, 645, 649, + 648, 650, 654, 651, 646, 648, 652, 650, 651, 661, + 647, 653, 652, 657, 653, 655, 656, 658, 649, 659, + + 655, 656, 656, 660, 659, 662, 657, 654, 661, 660, + 658, 663, 664, 674, 662, 666, 663, 667, 659, 659, + 665, 665, 666, 668, 667, 669, 668, 670, 671, 672, + 676, 669, 664, 671, 672, 672, 673, 673, 674, 670, + 675, 668, 675, 671, 677, 678, 677, 679, 680, 676, + 681, 682, 683, 684, 688, 685, 85, 684, 683, 686, + 687, 689, 691, 678, 685, 679, 680, 690, 693, 681, + 690, 682, 688, 694, 686, 687, 692, 691, 695, 690, + 689, 696, 692, 697, 698, 699, 701, 694, 693, 699, + 695, 700, 702, 703, 704, 708, 705, 707, 707, 708, + + 696, 705, 701, 698, 697, 706, 709, 710, 712, 700, + 702, 703, 703, 704, 711, 714, 713, 715, 720, 706, + 709, 713, 712, 717, 716, 711, 710, 718, 719, 721, + 717, 714, 718, 722, 721, 719, 715, 716, 722, 723, + 724, 725, 720, 727, 726, 729, 737, 724, 728, 730, + 725, 729, 727, 731, 730, 732, 731, 723, 726, 732, + 728, 733, 734, 735, 746, 736, 749, 737, 738, 738, + 744, 734, 739, 739, 742, 733, 740, 740, 735, 736, + 741, 739, 745, 742, 746, 741, 747, 748, 745, 744, + 747, 749, 750, 752, 751, 753, 754, 755, 756, 748, + + 751, 752, 753, 762, 759, 766, 765, 768, 769, 80, + 750, 766, 771, 768, 754, 765, 771, 769, 756, 759, + 762, 770, 755, 757, 776, 757, 772, 772, 757, 773, + 773, 775, 757, 774, 777, 757, 812, 770, 776, 782, + 778, 780, 757, 757, 774, 757, 778, 781, 783, 775, + 812, 785, 781, 787, 777, 779, 779, 779, 787, 779, + 782, 780, 779, 788, 784, 786, 783, 779, 784, 786, + 791, 789, 790, 779, 779, 785, 789, 792, 793, 794, + 792, 796, 788, 793, 793, 786, 794, 790, 795, 795, + 798, 798, 797, 799, 75, 791, 796, 797, 799, 800, + + 801, 804, 800, 802, 802, 801, 803, 805, 803, 807, + 806, 808, 809, 804, 806, 810, 810, 811, 813, 813, + 809, 814, 815, 816, 828, 817, 805, 828, 818, 807, + 808, 817, 811, 818, 815, 819, 819, 820, 823, 814, + 824, 822, 820, 820, 823, 816, 822, 825, 74, 826, + 827, 829, 830, 825, 826, 834, 827, 829, 833, 824, + 830, 831, 831, 832, 832, 835, 833, 836, 837, 838, + 835, 836, 839, 834, 840, 837, 841, 841, 843, 845, + 842, 844, 844, 846, 850, 845, 843, 838, 839, 842, + 848, 849, 851, 840, 852, 853, 854, 851, 853, 848, + + 849, 854, 846, 852, 855, 856, 857, 858, 850, 860, + 862, 859, 861, 861, 863, 857, 859, 859, 855, 864, + 858, 865, 866, 860, 867, 862, 871, 867, 864, 869, + 856, 869, 873, 863, 872, 867, 870, 870, 874, 872, + 866, 875, 876, 877, 879, 865, 878, 871, 880, 68, + 881, 882, 880, 873, 883, 878, 884, 885, 874, 886, + 883, 875, 887, 877, 876, 884, 888, 879, 881, 885, + 882, 889, 891, 892, 890, 886, 894, 889, 892, 895, + 888, 887, 890, 893, 893, 896, 891, 897, 898, 899, + 900, 901, 903, 902, 896, 894, 898, 904, 903, 895, + + 905, 907, 906, 904, 908, 909, 912, 897, 906, 899, + 901, 909, 900, 902, 905, 907, 910, 911, 913, 915, + 63, 911, 910, 914, 908, 912, 916, 916, 914, 917, + 913, 918, 920, 919, 921, 917, 919, 918, 913, 922, + 915, 923, 924, 924, 925, 922, 926, 921, 928, 927, + 920, 926, 927, 928, 928, 929, 930, 931, 931, 932, + 930, 923, 925, 933, 934, 927, 935, 927, 937, 934, + 929, 940, 938, 941, 942, 944, 944, 948, 945, 946, + 975, 932, 945, 933, 940, 935, 938, 947, 947, 951, + 58, 950, 937, 941, 946, 942, 943, 953, 975, 943, + + 949, 943, 948, 951, 949, 943, 950, 943, 952, 954, + 955, 953, 943, 952, 954, 954, 956, 943, 957, 955, + 958, 959, 957, 961, 962, 960, 959, 963, 961, 964, + 956, 965, 973, 966, 957, 958, 959, 960, 962, 966, + 965, 967, 971, 964, 968, 969, 967, 971, 963, 972, + 968, 969, 970, 970, 973, 972, 974, 977, 978, 979, + 980, 981, 981, 978, 984, 982, 983, 985, 986, 977, + 982, 992, 980, 979, 983, 974, 976, 976, 987, 989, + 984, 985, 976, 988, 976, 989, 990, 986, 991, 992, + 976, 990, 993, 994, 995, 976, 976, 987, 998, 988, + + 991, 997, 976, 996, 996, 997, 1001, 1000, 993, 1001, + 1002, 994, 995, 1000, 1003, 1004, 1005, 1007, 998, 1003, + 1006, 1009, 1005, 1010, 1011, 1006, 1013, 1012, 1004, 1002, + 1009, 1014, 1010, 1012, 1015, 1013, 1007, 1016, 1017, 1015, + 1011, 1018, 1019, 1022, 1020, 1023, 1021, 1026, 1029, 1022, + 1014, 1028, 1017, 1020, 1019, 1021, 1031, 1016, 1024, 1032, + 1033, 1018, 1023, 1026, 1024, 1028, 1030, 1034, 1029, 1035, + 1040, 1030, 1036, 1032, 1035, 1031, 1039, 1036, 1033, 1040, + 1042, 1039, 1034, 1041, 1041, 1043, 1042, 1044, 1045, 1046, + 1048, 1043, 1049, 1053, 1054, 1055, 1044, 1049, 1049, 1056, + + 1051, 1051, 1046, 1045, 1051, 1052, 1048, 1053, 1052, 1057, + 1058, 1055, 1059, 1060, 1054, 1061, 1062, 1056, 1059, 1063, + 1064, 1061, 1057, 1068, 1063, 1058, 1066, 1066, 57, 1067, + 1069, 1062, 1067, 1060, 1064, 1069, 1070, 1071, 1072, 1075, + 1073, 1070, 1078, 1074, 1068, 1073, 1077, 1072, 1074, 1079, + 1080, 1075, 1077, 1071, 1082, 1079, 1080, 1083, 1078, 1081, + 1081, 1084, 1086, 1082, 1084, 1085, 1085, 1087, 1088, 1089, + 1090, 1091, 1089, 1092, 1126, 1083, 1093, 1091, 1126, 1092, + 1086, 1096, 1093, 1090, 1094, 1095, 1087, 1096, 1088, 1094, + 1095, 1097, 1098, 1101, 1100, 1102, 1097, 1103, 1098, 1100, + + 1104, 1105, 1105, 1103, 1106, 1104, 1108, 1107, 1109, 1110, + 1112, 1101, 1110, 1106, 1111, 1102, 1107, 1111, 1113, 1114, + 1115, 1112, 1116, 1113, 1108, 1117, 1122, 1109, 1118, 1119, + 1120, 1117, 1115, 1123, 1118, 1120, 1124, 1114, 1121, 1121, + 1125, 1116, 1127, 1128, 1119, 1122, 1129, 1123, 1124, 1130, + 1132, 1134, 1128, 1133, 1133, 1137, 1135, 1136, 1125, 1134, + 1127, 1135, 1136, 1139, 1140, 1129, 1141, 1142, 1145, 1132, + 1146, 1143, 1142, 52, 1130, 1137, 1146, 1139, 1141, 1140, + 1143, 1144, 1144, 1147, 1148, 1149, 1156, 1151, 1145, 1147, + 1149, 1150, 1151, 1150, 1152, 1153, 1154, 1155, 1158, 1157, + + 1148, 1154, 1159, 1161, 1161, 1156, 1157, 1163, 1152, 1153, + 1162, 1164, 1155, 1158, 1165, 1166, 1174, 1167, 47, 1169, + 1165, 1159, 1167, 1169, 1162, 1163, 1164, 1170, 1170, 1171, + 1174, 1167, 1173, 1167, 1171, 1166, 1167, 1172, 1172, 1173, + 1175, 1176, 1178, 1175, 1177, 1179, 1180, 1181, 1182, 1183, + 1179, 1178, 1185, 1182, 1190, 1184, 1187, 1187, 18, 1181, + 1176, 1193, 1177, 1183, 1188, 1180, 1184, 1189, 1191, 1188, + 1193, 1185, 1189, 1191, 1190, 1192, 1194, 1195, 1196, 1192, + 1198, 1197, 1199, 1201, 1197, 1202, 1200, 1203, 1204, 1199, + 1207, 1194, 1195, 1197, 1204, 1198, 1205, 1196, 1200, 1208, + + 1209, 1206, 1201, 1210, 1211, 1203, 1202, 1206, 1212, 1209, + 1207, 1205, 1213, 1214, 1215, 1216, 1217, 1220, 1210, 1208, + 1212, 1216, 1219, 1211, 1223, 1221, 1222, 1224, 1219, 1215, + 1225, 1213, 1220, 1226, 1222, 1225, 1217, 1228, 1214, 1221, + 1229, 1227, 1230, 1224, 1223, 1226, 1227, 1227, 1231, 1231, + 1233, 1234, 1238, 1235, 1229, 1230, 1228, 1232, 1232, 1235, + 1234, 1238, 1232, 1233, 1237, 1232, 1232, 1236, 1236, 1237, + 1232, 1239, 1243, 1240, 1241, 1246, 1232, 1239, 1240, 1241, + 1232, 1242, 1242, 1244, 1244, 1245, 1247, 1249, 1245, 1250, + 1245, 1248, 1252, 1243, 1251, 1246, 1249, 1248, 1253, 1251, + + 1256, 1254, 1255, 1259, 1247, 1256, 1252, 1254, 1255, 1250, + 1257, 1258, 1259, 1260, 1257, 1261, 1253, 1259, 1260, 1259, + 1264, 1259, 1267, 1259, 1258, 1262, 1262, 1263, 1263, 1261, + 1263, 1264, 1266, 1268, 1269, 1270, 1266, 1267, 1271, 1272, + 1270, 1270, 1274, 1269, 1273, 1275, 1276, 1271, 1277, 1273, + 1278, 1268, 1279, 1289, 1275, 1282, 1274, 1281, 1279, 1280, + 1280, 1272, 1283, 1282, 1278, 1276, 1284, 1277, 1285, 1281, + 1286, 1284, 1288, 1287, 1291, 1291, 1283, 1292, 1289, 1286, + 1287, 1290, 1285, 1293, 1293, 1294, 1290, 1294, 1296, 1297, + 1288, 1296, 1292, 1298, 1297, 1299, 1300, 1300, 1301, 1302, + + 1302, 1303, 1303, 1304, 1299, 1305, 1306, 1307, 1304, 1308, + 1308, 1309, 1298, 1310, 1311, 1312, 1313, 1311, 1301, 1314, + 1315, 1316, 1313, 1316, 1314, 1317, 1305, 1306, 1307, 1315, + 1310, 1309, 1320, 1319, 1321, 1312, 1319, 1322, 1324, 1321, + 1323, 1328, 1328, 1317, 1325, 1323, 1324, 1320, 1330, 1325, + 1326, 1322, 1327, 1326, 1329, 1331, 1332, 1327, 1333, 1329, + 1337, 1331, 1335, 1332, 1336, 1337, 1330, 1338, 1335, 1339, + 1336, 1333, 1338, 1340, 1341, 1339, 1342, 1343, 1343, 1344, + 1346, 1348, 1340, 1347, 1350, 1346, 1351, 1342, 1349, 1352, + 1353, 1348, 1354, 1341, 1356, 1352, 1353, 1357, 1354, 1344, + + 1356, 1347, 1358, 1349, 1350, 1359, 1360, 1361, 1362, 1351, + 1364, 1357, 1363, 1363, 1365, 1366, 1372, 1357, 1360, 1367, + 1369, 1361, 1358, 1374, 1367, 1359, 1362, 1368, 1368, 1370, + 1364, 1373, 1376, 1366, 1370, 1372, 1373, 1373, 1375, 1365, + 1376, 1374, 1377, 1369, 1378, 1379, 1380, 1375, 1381, 1385, + 1382, 1380, 1382, 1383, 1380, 1385, 1377, 1381, 1386, 1378, + 1379, 1387, 1386, 1379, 1388, 1389, 1390, 1383, 1391, 1388, + 1388, 1392, 1387, 1393, 1395, 1394, 1392, 1396, 1393, 1397, + 1400, 1399, 1396, 1401, 1389, 1403, 1391, 1402, 1402, 1403, + 1404, 1405, 1390, 1394, 1395, 1399, 1406, 1407, 1400, 1397, + + 1408, 1401, 1406, 1409, 1410, 1411, 1412, 1413, 1404, 1407, + 1405, 1417, 1414, 1418, 1416, 1419, 1408, 1414, 1410, 1416, + 1411, 1412, 1409, 1415, 1419, 1421, 1413, 1420, 1420, 1417, + 1415, 1423, 1422, 1425, 1418, 1424, 1424, 1426, 1427, 1425, + 1421, 1422, 1430, 1426, 1428, 1428, 1429, 1429, 1430, 1431, + 1432, 1423, 1427, 1433, 1434, 1435, 1436, 1443, 1433, 17, + 1434, 1435, 1436, 1437, 1437, 1431, 1438, 1438, 1440, 1440, + 1441, 1432, 1442, 1444, 1441, 1443, 1445, 1446, 1449, 1447, + 1450, 1442, 1448, 1448, 1451, 1444, 1447, 1452, 1450, 1451, + 1445, 1453, 1446, 1456, 1454, 1457, 1457, 1455, 1449, 1454, + + 1454, 1452, 1455, 1455, 1458, 1459, 1460, 1461, 1462, 1463, + 1453, 1465, 1461, 1456, 1464, 1460, 1466, 1465, 1467, 1468, + 1469, 1466, 1470, 1458, 1459, 1471, 1469, 1462, 1472, 1463, + 1473, 1471, 1464, 1474, 1472, 1475, 1476, 1477, 1467, 1478, + 1479, 1470, 1480, 1481, 1481, 1468, 1483, 1482, 1484, 1473, + 1482, 1485, 1474, 1478, 1475, 1476, 1477, 1480, 1486, 1486, + 1489, 1479, 1490, 1485, 1489, 1483, 1488, 1484, 1487, 1487, + 1491, 1488, 1492, 1495, 1493, 1490, 1493, 1496, 1498, 1491, + 1493, 1497, 1496, 1499, 1501, 1492, 1500, 1500, 1502, 1501, + 1503, 1495, 1509, 1493, 1502, 1504, 1497, 1505, 1498, 1499, + + 1507, 1506, 1510, 1505, 1507, 1503, 1506, 1508, 1504, 1511, + 1512, 1508, 1509, 1513, 1514, 1514, 1516, 1518, 1511, 1513, + 1510, 1519, 1520, 1520, 1522, 1521, 1519, 1524, 1524, 1526, + 1512, 1521, 1526, 1528, 1516, 1527, 1527, 1529, 1518, 1530, + 1532, 1533, 1535, 1532, 1522, 1534, 1536, 1537, 1537, 1528, + 1539, 1535, 1538, 1529, 1540, 1530, 1541, 1545, 1542, 1543, + 1543, 1541, 1533, 1546, 1547, 1534, 1536, 1538, 1544, 1550, + 1548, 1539, 1542, 1540, 1551, 1545, 1552, 1544, 1546, 1549, + 1549, 1552, 1553, 1550, 1554, 1554, 1556, 1555, 1558, 1547, + 1548, 1555, 1551, 1557, 1557, 1559, 1560, 1553, 1561, 1562, + + 1563, 1570, 1561, 1565, 1565, 1563, 1556, 1560, 1566, 1567, + 1558, 1566, 1568, 1569, 1559, 1572, 1571, 1568, 1562, 1570, + 1574, 1576, 1567, 1573, 1575, 1575, 1576, 1577, 1578, 1569, + 1571, 1579, 1579, 1580, 1572, 1572, 1581, 1573, 1582, 1586, + 1595, 1581, 1580, 1591, 1583, 1574, 1583, 1577, 1578, 1584, + 1585, 1587, 1589, 1647, 1584, 1647, 1585, 1587, 1582, 1586, + 1590, 1590, 1591, 1592, 1595, 1594, 1589, 1596, 1596, 1592, + 1594, 1597, 1597, 1598, 1599, 1600, 1601, 1602, 1602, 1601, + 1603, 1604, 1605, 1606, 1613, 1607, 1606, 1598, 1745, 1606, + 1600, 1607, 1599, 1604, 1608, 1611, 1745, 1609, 1603, 1608, + + 1609, 1606, 1605, 1612, 1611, 1615, 1615, 1614, 1612, 1613, + 1614, 1616, 1617, 1625, 1618, 1623, 1609, 1616, 1617, 1618, + 1619, 1619, 1620, 1620, 1621, 1624, 1622, 1626, 1623, 1628, + 1621, 1622, 1625, 1627, 1629, 1628, 1627, 1631, 1630, 1632, + 1629, 1633, 1631, 1624, 1630, 1632, 1634, 1626, 1635, 1635, + 1636, 1634, 1637, 1638, 1640, 1636, 1639, 1641, 1642, 1644, + 1645, 1646, 1643, 1648, 1633, 1646, 1651, 1655, 1652, 0, + 1637, 1641, 1642, 1638, 1640, 1639, 1643, 1644, 1651, 1649, + 1652, 1653, 1648, 1654, 1656, 1645, 1649, 1655, 1657, 1654, + 1658, 1659, 1661, 1661, 1653, 1662, 1663, 1664, 1665, 1665, + + 1656, 1663, 1666, 1668, 1658, 1667, 1669, 1670, 1657, 1664, + 1671, 1672, 1659, 1674, 1673, 1662, 1670, 1666, 1672, 1667, + 1676, 1678, 1682, 1673, 1669, 1671, 1673, 1668, 1679, 1674, + 1683, 1679, 1680, 1680, 1682, 1676, 1681, 1681, 1684, 1686, + 1676, 1684, 1685, 1685, 1687, 1688, 1678, 1691, 1683, 1692, + 1688, 1689, 1686, 1690, 1689, 1693, 1694, 0, 1690, 1695, + 1696, 1697, 1700, 1687, 1693, 1692, 1691, 1697, 1695, 1696, + 1699, 1695, 1698, 1698, 1701, 1694, 1702, 1699, 1703, 1704, + 1705, 1707, 1700, 1706, 1710, 1705, 1705, 1701, 1706, 1711, + 1712, 1712, 1703, 1707, 1702, 1704, 1713, 1714, 1715, 1715, + + 1716, 1716, 1717, 1715, 1719, 1718, 1714, 1711, 1720, 1710, + 1718, 1717, 1713, 1721, 1717, 1716, 1724, 1725, 1722, 1726, + 1727, 1728, 1719, 1722, 1722, 1727, 1730, 1729, 1732, 1720, + 1724, 1721, 1725, 1729, 1732, 1728, 1731, 1731, 1733, 1734, + 1735, 1726, 1736, 1733, 1730, 1738, 1735, 1739, 1736, 1740, + 1741, 1742, 1743, 1734, 1742, 1740, 1747, 1748, 1743, 1749, + 1742, 1739, 1750, 1741, 1751, 1738, 1753, 1756, 1752, 1751, + 1750, 1754, 1755, 1757, 0, 1747, 1748, 1752, 1749, 1753, + 1754, 1756, 1758, 1758, 1759, 1755, 1760, 1757, 1761, 1763, + 1759, 1765, 1760, 1762, 1762, 1764, 1766, 1766, 1767, 1768, + + 1769, 1761, 1770, 1771, 1758, 1768, 1773, 1773, 1774, 1763, + 1765, 1767, 1775, 1764, 1776, 1777, 1775, 1780, 1770, 1776, + 1778, 1771, 1769, 1781, 1779, 1778, 1780, 1783, 1774, 1779, + 1784, 1785, 1786, 1787, 1785, 1777, 1788, 1788, 1783, 1784, + 1789, 1790, 1791, 1793, 1786, 1794, 1781, 1799, 1787, 1792, + 1792, 1795, 1794, 1790, 1796, 1798, 1800, 1793, 1801, 1789, + 1802, 1791, 1800, 1795, 1809, 1803, 1796, 1799, 1804, 1804, + 1801, 1803, 1805, 1809, 1798, 1805, 1806, 1806, 1802, 1808, + 1810, 1811, 1811, 1812, 1808, 1813, 1810, 1813, 1814, 1815, + 1816, 1814, 1817, 1818, 1819, 1812, 1820, 1821, 1823, 1819, + + 1824, 1820, 1822, 1826, 1829, 1824, 1821, 1825, 0, 1815, + 1817, 1818, 1816, 1823, 1822, 1827, 1825, 1828, 1832, 1829, + 1827, 1834, 1828, 1826, 1830, 1830, 1831, 1827, 1835, 1825, + 1836, 1837, 1831, 1838, 1839, 1838, 1840, 1840, 1843, 1832, + 1834, 1841, 1841, 1842, 1842, 1846, 1836, 1835, 1839, 1847, + 1839, 1837, 1844, 1844, 1845, 1845, 1848, 1850, 1843, 1849, + 1849, 1850, 1851, 1854, 1852, 1855, 1846, 1852, 1851, 1854, + 1847, 1857, 1856, 1858, 1860, 1860, 1857, 1848, 1856, 1859, + 1861, 1862, 1859, 1855, 1863, 1863, 1862, 1864, 1865, 1866, + 1867, 1868, 1868, 1870, 1866, 1867, 1869, 1879, 1858, 1870, + + 1861, 1869, 1864, 1871, 1872, 1873, 1874, 1875, 1876, 1865, + 1880, 1879, 0, 1875, 1878, 1871, 1871, 1871, 1883, 1878, + 1878, 1882, 1871, 1873, 1872, 1880, 1874, 1881, 1876, 1881, + 1884, 1885, 1882, 1883, 1886, 1887, 1884, 1888, 1888, 1889, + 1885, 1890, 1890, 1891, 1892, 1893, 1893, 1894, 1894, 1895, + 1898, 1898, 1899, 1900, 1886, 1902, 1887, 1903, 1905, 1906, + 1906, 1904, 1900, 1891, 1902, 1889, 1892, 1904, 1907, 1895, + 1908, 1910, 1909, 1911, 1905, 1912, 1912, 1899, 1903, 1909, + 1910, 1913, 1914, 1917, 1916, 1908, 1918, 1920, 1917, 1907, + 1916, 1919, 1918, 1924, 1920, 1921, 1929, 1925, 1914, 1911, + + 1922, 1921, 1922, 1925, 1926, 1926, 1928, 1913, 1927, 1930, + 1932, 1919, 1924, 1927, 1931, 1928, 1929, 1931, 1933, 1934, + 1935, 1933, 1932, 1936, 1936, 1937, 1938, 1939, 1930, 1940, + 1941, 1937, 1938, 1943, 1941, 1944, 1945, 1934, 1946, 1946, + 1947, 1945, 1948, 1949, 1940, 1952, 1935, 1939, 1951, 1952, + 1941, 1953, 1953, 1943, 1954, 1957, 1955, 1944, 1949, 1957, + 1954, 1948, 1956, 1956, 1947, 1955, 1958, 1951, 1959, 1959, + 1960, 1961, 1968, 1962, 1963, 1964, 1965, 1958, 1966, 1963, + 1967, 1971, 1958, 1970, 1969, 1961, 1967, 1978, 1970, 1974, + 1968, 1960, 1962, 1974, 1971, 1964, 1965, 1976, 1966, 1969, + + 1972, 1972, 1973, 1973, 1977, 1986, 1976, 1978, 1979, 1979, + 1981, 1981, 1982, 1983, 0, 1977, 1985, 1982, 1982, 1983, + 1977, 1987, 1985, 1988, 1989, 1991, 1987, 1993, 1992, 1995, + 1989, 1986, 1992, 1994, 1994, 1988, 1996, 1991, 1997, 1993, + 1998, 2001, 1996, 1999, 1999, 2000, 1998, 2002, 2006, 2074, + 2003, 2005, 2002, 2007, 1995, 2013, 2009, 2074, 2007, 2009, + 1997, 2001, 2003, 2005, 2000, 2010, 2010, 2006, 2011, 2011, + 2012, 2012, 2014, 2015, 2017, 2013, 2016, 2018, 2014, 2015, + 2017, 2016, 2020, 2023, 2026, 2022, 2018, 2020, 2022, 2024, + 2024, 2027, 2028, 2029, 2029, 2023, 2026, 2028, 2030, 2031, + + 2032, 2034, 2034, 2027, 2031, 2032, 2033, 2030, 2035, 2033, + 2036, 2037, 2038, 2039, 2042, 2040, 2041, 2039, 2043, 2036, + 2040, 2044, 2041, 2045, 2047, 2047, 2048, 2043, 2035, 2037, + 2050, 2038, 2042, 2049, 2051, 2051, 2047, 2045, 2052, 2044, + 2053, 2054, 2049, 2055, 2048, 2056, 2061, 2052, 2055, 2061, + 2050, 2062, 2053, 2059, 2059, 2063, 2064, 2068, 2056, 2066, + 2069, 2067, 2054, 2068, 2070, 2070, 2071, 2062, 2071, 2072, + 2079, 2063, 2064, 2088, 2066, 2067, 2084, 2069, 2073, 2073, + 2076, 2076, 2077, 2077, 2080, 2081, 2082, 2072, 2083, 2085, + 2080, 2081, 2087, 2079, 2088, 2083, 2086, 2086, 2084, 2089, + + 2082, 2087, 2090, 2091, 2092, 2093, 2094, 2097, 2099, 2085, + 2098, 2089, 2101, 2095, 2090, 2095, 2092, 2102, 2091, 2095, + 2099, 2094, 2100, 2100, 2104, 2103, 2105, 2097, 2103, 2104, + 2101, 2093, 2095, 2098, 2107, 2109, 2108, 2102, 2108, 2107, + 2110, 2111, 2113, 2115, 2119, 2110, 2105, 2116, 2111, 2120, + 2117, 2113, 2118, 2109, 2118, 2120, 2116, 2122, 2123, 2122, + 2125, 2115, 2117, 2119, 2124, 2124, 2126, 2127, 2128, 2127, + 2129, 2126, 2123, 2128, 2130, 2129, 2131, 2132, 2133, 2136, + 2134, 2140, 2135, 2137, 2133, 2134, 2125, 2141, 2137, 2137, + 2138, 2136, 2130, 2145, 2131, 2135, 2144, 2132, 2138, 2146, + + 2140, 2141, 2142, 2142, 2143, 2143, 2147, 2144, 2145, 2148, + 2150, 2149, 2147, 2149, 2148, 2151, 2152, 2152, 2153, 2146, + 2154, 2154, 2157, 2151, 2155, 2155, 2156, 2157, 2150, 2158, + 2153, 2151, 2160, 2161, 2163, 2156, 2160, 2162, 2164, 2162, + 2165, 2166, 2161, 2164, 2164, 2161, 2167, 2158, 2169, 2170, + 2166, 2171, 2165, 2173, 2170, 2163, 2171, 2174, 2167, 2175, + 2169, 2176, 2176, 2177, 2178, 2179, 2173, 2181, 2175, 2180, + 2182, 2183, 0, 2184, 2188, 2186, 2187, 2174, 2184, 2197, + 2191, 2177, 2178, 2179, 2182, 2180, 2183, 2186, 2187, 2191, + 2189, 2190, 2181, 2194, 2188, 2189, 2190, 2196, 2198, 2194, + + 2199, 2200, 2197, 2196, 2205, 2201, 2202, 2202, 2203, 2204, + 2204, 2206, 2194, 2198, 2201, 2207, 2208, 2203, 2199, 2207, + 2209, 2208, 2205, 2211, 2213, 2212, 2200, 2219, 0, 2214, + 2206, 2212, 2215, 2209, 2214, 2214, 2217, 2216, 2215, 2217, + 2218, 2228, 2211, 2216, 2222, 2222, 2213, 2219, 2218, 2223, + 2223, 2224, 2225, 2225, 2226, 2226, 2227, 2229, 2241, 2228, + 2224, 2230, 2233, 2229, 2223, 2237, 2230, 2233, 2227, 2231, + 2231, 2232, 2232, 2234, 2236, 2223, 2238, 2239, 2236, 2234, + 2238, 2242, 2243, 2241, 2244, 2237, 2242, 2245, 2246, 2248, + 2249, 2247, 2245, 2250, 2252, 2249, 2253, 2239, 2252, 2244, + + 2251, 2251, 2255, 2254, 2256, 2243, 2246, 2247, 2254, 2248, + 2258, 2253, 2257, 2259, 2260, 2250, 2261, 2264, 2259, 2262, + 2262, 2265, 2256, 2266, 2257, 2264, 2267, 2260, 2255, 2258, + 2268, 2269, 2270, 2271, 2261, 2272, 2273, 2274, 2305, 2278, + 2265, 2276, 2266, 2274, 2279, 2267, 2281, 2272, 2281, 2282, + 2305, 2270, 2278, 2268, 2271, 2269, 2276, 2273, 2279, 2280, + 2283, 2283, 2284, 2285, 2286, 2280, 2285, 2284, 2287, 2282, + 2288, 2289, 2289, 2290, 2290, 2293, 2291, 2286, 2291, 2292, + 2292, 2294, 2287, 2288, 2295, 2295, 2296, 2296, 2297, 2303, + 2293, 2298, 2298, 2300, 2294, 2299, 2299, 2297, 2300, 2302, + + 2297, 2304, 2306, 2306, 2302, 2307, 2307, 2308, 2312, 2303, + 2309, 2309, 2310, 2311, 2311, 2313, 2314, 2314, 2315, 2315, + 2313, 2304, 2316, 2312, 2317, 2318, 2308, 2319, 2320, 2322, + 2310, 2323, 2323, 2317, 2322, 2324, 2316, 2325, 2325, 2326, + 2327, 2319, 2318, 2328, 2332, 2327, 2333, 2320, 2329, 2328, + 2336, 2329, 2330, 2330, 2324, 2331, 2331, 2326, 2334, 2337, + 2334, 2333, 2340, 2332, 2341, 2336, 2338, 2338, 2330, 2342, + 2343, 2344, 2345, 2345, 2346, 2344, 2347, 2352, 2337, 2341, + 2348, 2347, 2340, 2349, 2353, 2343, 2351, 2351, 2354, 2355, + 2356, 2353, 2342, 2346, 2357, 2348, 2358, 2352, 2349, 2359, + + 2359, 2360, 2354, 2361, 2365, 2361, 2364, 2355, 2356, 2357, + 2360, 2362, 2364, 2366, 2362, 2367, 2365, 2368, 2366, 2369, + 2367, 2371, 2358, 2370, 2372, 2374, 2371, 2380, 2375, 2362, + 2374, 2362, 2369, 2375, 2376, 2378, 2377, 2379, 2381, 2376, + 2382, 2378, 2368, 2379, 2370, 2385, 2382, 2383, 2380, 2384, + 2372, 2377, 2383, 2381, 2384, 2386, 2387, 2388, 2389, 2387, + 2390, 2392, 2391, 2397, 2399, 2400, 2388, 2389, 2386, 2390, + 2385, 2391, 2393, 2394, 2400, 2392, 2395, 0, 2393, 2394, + 2395, 2401, 2401, 2397, 2399, 2402, 2403, 2403, 2404, 2405, + 2405, 2402, 2407, 2406, 2409, 2403, 2412, 2404, 2406, 2410, + + 2411, 2411, 2416, 2421, 2413, 2415, 2417, 2418, 2421, 2422, + 2409, 2412, 2407, 2413, 2407, 2410, 2423, 2415, 2416, 2418, + 2420, 2417, 0, 2420, 2424, 2424, 2425, 2425, 2423, 2422, + 2427, 2427, 2428, 2429, 2430, 2428, 2431, 2432, 2429, 2434, + 2430, 2437, 2431, 2433, 2433, 2436, 2432, 2435, 2435, 2438, + 2439, 2439, 2440, 2434, 2442, 2437, 2441, 2436, 2440, 2442, + 2444, 2450, 2445, 2448, 2444, 2445, 2446, 2446, 2438, 2447, + 2441, 2449, 2448, 2451, 2447, 2452, 2452, 2451, 2453, 2455, + 2449, 2450, 2456, 2457, 2455, 2458, 2459, 2461, 2460, 2462, + 2463, 2453, 2460, 2464, 2462, 2466, 2463, 2465, 2465, 2464, + + 2459, 2467, 2456, 2457, 2468, 2458, 2469, 2461, 2470, 2471, + 2471, 2469, 2473, 2466, 2474, 2478, 2475, 2478, 2477, 2476, + 2467, 2475, 2480, 2468, 2473, 2476, 2477, 2482, 2486, 2470, + 2474, 2480, 2483, 2483, 2484, 2485, 2492, 2484, 2485, 2487, + 2487, 2482, 2490, 2491, 2493, 2493, 2490, 2494, 2492, 2491, + 2497, 2497, 2499, 2501, 2486, 2502, 2494, 2505, 2506, 2507, + 2508, 2509, 2505, 2510, 2510, 2508, 2509, 2501, 2512, 2512, + 2499, 2502, 2514, 2515, 2516, 2516, 2517, 2518, 2514, 2521, + 2507, 2519, 2522, 2523, 2506, 2522, 2519, 2527, 2524, 2525, + 2525, 2528, 2517, 2515, 2530, 2523, 2527, 2528, 2521, 2518, + + 2524, 2529, 2531, 2533, 2533, 2534, 2535, 2529, 2534, 2536, + 2538, 2538, 2530, 2539, 2539, 2540, 2541, 2531, 2543, 2542, + 2540, 2544, 2545, 2546, 2545, 2535, 2544, 2536, 2542, 2547, + 2548, 2543, 2550, 2549, 2541, 2551, 2552, 2546, 2549, 2553, + 2553, 2552, 2548, 2547, 2554, 2554, 2555, 2555, 2556, 2556, + 2557, 2558, 2550, 2559, 2563, 2551, 2560, 2560, 2559, 2561, + 2561, 2564, 2557, 2562, 2562, 2565, 2563, 2566, 2567, 2558, + 2568, 2569, 2569, 2570, 2571, 2571, 2574, 2565, 2572, 2572, + 2573, 2564, 2576, 2575, 2577, 2579, 2568, 2566, 2574, 2567, + 2575, 2573, 2570, 2578, 2576, 2580, 2581, 2581, 2578, 2582, + + 2583, 2583, 2584, 2585, 2577, 2579, 2586, 2587, 2582, 2591, + 2588, 2589, 2590, 2593, 2590, 2580, 2592, 2592, 2597, 2586, + 2594, 2591, 2593, 2585, 2588, 2595, 2598, 2599, 2584, 2600, + 2601, 2587, 2600, 2589, 2602, 2594, 2597, 2603, 2612, 2602, + 2595, 2611, 2603, 2613, 2601, 2604, 2604, 2616, 2598, 2612, + 2599, 2605, 2605, 2606, 2606, 2608, 2608, 2610, 2610, 2611, + 2614, 2617, 2613, 2618, 2619, 2620, 2621, 2616, 2622, 2623, + 2622, 2630, 2624, 2625, 2620, 2614, 2626, 2626, 2629, 2617, + 2628, 2628, 2632, 2632, 2619, 2618, 2621, 2631, 2634, 2623, + 2624, 2625, 2629, 2630, 2635, 2635, 2631, 2634, 2636, 2637, + + 2638, 2639, 2641, 2642, 2640, 2644, 2643, 2645, 2639, 2646, + 2646, 2647, 2647, 2648, 2645, 0, 2636, 2637, 2638, 2640, + 2641, 2642, 2643, 2649, 2644, 2650, 2652, 2652, 2653, 2653, + 2654, 2650, 2655, 2648, 2656, 2657, 2654, 2658, 2659, 2660, + 2662, 2649, 2661, 2659, 2664, 2669, 2664, 2663, 2672, 2656, + 2655, 2658, 2663, 2661, 2657, 2665, 2665, 2667, 2667, 2660, + 2662, 2666, 2671, 2666, 2669, 2673, 2674, 2672, 2675, 2676, + 2677, 2671, 2678, 2675, 2676, 2681, 2682, 2673, 2683, 2684, + 2684, 2683, 2685, 2686, 2687, 2687, 2674, 2688, 2689, 2690, + 2677, 2678, 2692, 2690, 2682, 2681, 2693, 2685, 2688, 2696, + + 2694, 2686, 2693, 2689, 2694, 2695, 2695, 2692, 2698, 2699, + 2700, 2704, 2696, 2701, 2701, 2703, 2708, 2705, 2706, 2706, + 2704, 2705, 2712, 2698, 2707, 2707, 2714, 2703, 2710, 2699, + 2700, 2709, 2709, 2710, 2711, 2708, 2713, 2721, 2712, 2715, + 2715, 2720, 2720, 2711, 2722, 2722, 2714, 2723, 2713, 2724, + 2725, 2730, 2726, 2729, 2729, 2727, 2728, 2731, 0, 2721, + 2723, 2726, 2724, 2725, 2727, 2728, 2733, 2733, 2736, 2737, + 2738, 2730, 2731, 2736, 2737, 2739, 2741, 2740, 2742, 2745, + 2739, 2743, 2749, 2747, 2738, 2740, 2748, 2742, 2747, 2743, + 2753, 2748, 2750, 2750, 2745, 2741, 2752, 2749, 2751, 2751, + + 2755, 2752, 2754, 2754, 2757, 2756, 2758, 2755, 2759, 2753, + 2756, 2760, 2761, 2761, 2759, 2762, 2760, 0, 2763, 2764, + 2764, 2768, 2757, 2763, 2758, 2765, 2765, 2769, 2769, 2770, + 2762, 2771, 2770, 2772, 2768, 2773, 2771, 2771, 2772, 2774, + 2773, 2775, 2776, 2777, 2779, 2778, 2776, 2775, 2777, 2780, + 2781, 2784, 2782, 2774, 2778, 2783, 2784, 2780, 2782, 2779, + 2785, 2783, 2787, 2788, 2789, 2791, 2796, 2789, 2788, 2787, + 2793, 2781, 2785, 2794, 2795, 2793, 2797, 2791, 2794, 2795, + 2805, 2798, 2799, 2801, 2796, 2800, 2800, 2810, 2802, 2797, + 2798, 2799, 2801, 2802, 2806, 2807, 2811, 2814, 2805, 2812, + + 2806, 2807, 2813, 2813, 2814, 2815, 2810, 2817, 2816, 2820, + 2818, 2819, 2819, 2824, 2822, 2825, 2811, 2816, 2812, 2825, + 2826, 2826, 2817, 2827, 2815, 2818, 2828, 2830, 2820, 2822, + 2829, 2831, 2828, 2824, 2832, 2832, 2829, 2831, 2833, 2834, + 2837, 2838, 2835, 2859, 2840, 2830, 2833, 2835, 2827, 2837, + 2840, 2843, 2841, 2842, 2838, 2841, 2845, 2842, 2844, 2844, + 2847, 2847, 2848, 2859, 2834, 2843, 2849, 2849, 2850, 2850, + 2853, 2845, 2852, 2852, 2853, 2855, 2854, 2857, 2857, 2861, + 2848, 2854, 2860, 2862, 2855, 2863, 2865, 2860, 2862, 2862, + 2872, 2861, 2866, 2866, 2868, 2868, 2873, 2863, 2869, 2869, + + 2870, 2870, 2871, 2872, 2876, 2871, 2865, 2875, 2875, 2873, + 2878, 2879, 2879, 2880, 2880, 2881, 2881, 2882, 2883, 2883, + 2884, 2885, 2876, 2886, 2889, 2887, 2888, 2888, 2889, 2892, + 2878, 2887, 2882, 2884, 2896, 2892, 2893, 2886, 2895, 2885, + 2897, 2893, 2898, 2895, 2895, 2899, 2900, 2901, 2911, 2902, + 2908, 2899, 2900, 2902, 2903, 2903, 2906, 2896, 2908, 2914, + 2897, 2906, 2898, 2909, 2912, 2915, 2909, 2912, 2913, 2913, + 2915, 2916, 2901, 2911, 2917, 2934, 2914, 2914, 2918, 2919, + 2919, 2920, 2921, 2922, 2923, 2921, 2928, 2928, 2924, 2916, + 2927, 2934, 2918, 2921, 2917, 2920, 2924, 2922, 2937, 2925, + + 0, 2926, 2936, 2923, 2925, 2925, 2926, 2926, 2940, 2927, + 2929, 2929, 2930, 2930, 2931, 2931, 2932, 2932, 2933, 2933, + 2935, 2938, 2936, 2939, 2937, 2935, 2941, 2940, 2939, 2942, + 2943, 2941, 2944, 2946, 2946, 2938, 2947, 2947, 2942, 2948, + 2949, 2950, 2948, 2952, 2952, 2963, 2949, 2953, 2954, 2954, + 2943, 2955, 2944, 2958, 2953, 2959, 2955, 2957, 2957, 2950, + 2960, 2961, 2958, 2963, 2959, 2964, 2964, 2965, 2965, 2960, + 2961, 2966, 2967, 2968, 2969, 2966, 2970, 2971, 2974, 0, + 2973, 2967, 2971, 2971, 2975, 2969, 2981, 2974, 2975, 2979, + 2984, 2970, 2968, 2973, 2979, 2980, 2980, 2983, 2983, 2985, + + 2981, 2986, 2988, 2988, 2984, 2989, 2990, 2994, 2995, 2998, + 2999, 2996, 3003, 2995, 2989, 3001, 2999, 3005, 2990, 2986, + 2996, 3006, 3005, 3010, 2985, 3008, 3006, 3001, 3010, 2998, + 3007, 3007, 2994, 3003, 3008, 3011, 3012, 3013, 3013, 3015, + 3015, 3013, 3016, 3016, 3017, 3017, 3018, 3019, 3011, 3020, + 3012, 3021, 3023, 3027, 3024, 3018, 3021, 3025, 3023, 3024, + 3026, 3026, 3025, 3028, 3029, 3030, 3031, 3019, 3020, 3033, + 3030, 3027, 3032, 3034, 3034, 3028, 3036, 3037, 3032, 3040, + 3036, 3038, 3037, 3044, 3031, 3029, 3038, 3039, 3039, 3041, + 3042, 3046, 3046, 3048, 3033, 3049, 3050, 3051, 3040, 3053, + + 3054, 3051, 3052, 3044, 3041, 3042, 3048, 3056, 3049, 3050, + 3055, 3052, 3056, 3057, 3059, 3053, 3058, 3058, 3055, 3054, + 3060, 3061, 3063, 3059, 3062, 3062, 3066, 3066, 3067, 3068, + 3068, 3070, 3074, 3057, 3067, 3072, 3072, 3075, 3060, 3076, + 3077, 3063, 3081, 3081, 3076, 3078, 3082, 3061, 3074, 3083, + 3078, 3084, 3070, 3075, 3085, 3086, 3077, 3084, 3083, 3088, + 3088, 3089, 3090, 3091, 3091, 3093, 3082, 3095, 3097, 3099, + 3096, 3093, 3103, 3097, 3086, 3089, 3096, 3085, 3100, 3100, + 3102, 3090, 3101, 3101, 3104, 3104, 3105, 3095, 3107, 3106, + 3108, 3099, 3103, 3109, 3110, 3102, 3108, 3105, 3106, 3111, + + 3112, 3112, 3113, 3121, 3104, 0, 3110, 3114, 3107, 3120, + 3114, 3115, 3109, 3126, 3115, 3116, 3116, 3113, 3122, 3111, + 3131, 3120, 3125, 3121, 3122, 3123, 3123, 3124, 3125, 3128, + 3124, 3126, 3129, 3129, 3128, 3130, 3132, 3133, 3136, 3131, + 3130, 3137, 3132, 3134, 3134, 3138, 3141, 3139, 3140, 3140, + 3136, 3142, 3143, 3148, 3133, 3133, 3145, 3145, 3148, 3137, + 3139, 3143, 3146, 3146, 3149, 3141, 3150, 3142, 3147, 3147, + 3138, 3150, 3151, 3151, 3152, 3152, 3153, 3153, 3149, 3154, + 3154, 3155, 3156, 3157, 3164, 3158, 3160, 3160, 3166, 3157, + 3158, 3162, 3162, 3167, 3155, 3168, 3169, 3170, 3170, 3172, + + 3172, 3173, 3174, 3164, 3176, 3175, 3184, 3177, 3156, 3183, + 3166, 3178, 3178, 3181, 3168, 3167, 3177, 3188, 3169, 3175, + 3182, 3174, 3179, 3179, 3176, 3184, 3182, 3173, 3185, 3183, + 3195, 3181, 3193, 3185, 3189, 3189, 3191, 3191, 3188, 3192, + 3196, 3194, 3195, 3202, 3192, 3203, 3193, 3194, 3196, 3197, + 3197, 3198, 3205, 3200, 3201, 3204, 3198, 3200, 3208, 3201, + 3204, 3206, 3209, 3202, 3205, 3203, 3208, 3206, 3210, 3211, + 3214, 3217, 3213, 3216, 3215, 3219, 3217, 3220, 3221, 3224, + 3219, 3209, 3222, 0, 3221, 3226, 3214, 3222, 3210, 3211, + 3213, 3215, 3215, 3225, 3216, 3239, 3225, 3220, 3226, 3224, + + 3230, 3230, 3231, 3231, 3232, 3237, 3237, 3238, 3232, 3240, + 3240, 3386, 3238, 3386, 3239, 3243, 3243, 3244, 3244, 3248, + 3244, 3245, 3245, 3248, 3245, 3246, 3246, 3247, 3247, 3250, + 3247, 3251, 3252, 3252, 3250, 3253, 3254, 3257, 3257, 3258, + 3251, 3259, 3260, 3261, 3261, 3262, 3265, 3260, 3266, 3268, + 3254, 3269, 3267, 3253, 3271, 3266, 3267, 3272, 3268, 3258, + 3274, 3259, 3272, 3273, 3273, 3262, 3269, 3275, 3275, 3274, + 3278, 3265, 3271, 3276, 3276, 3277, 3277, 3279, 3280, 3283, + 3282, 3284, 3279, 3281, 3285, 3278, 3282, 3280, 3281, 3281, + 3280, 3288, 3286, 3287, 3289, 3289, 3284, 3286, 3287, 3294, + + 3290, 3291, 3292, 3292, 3283, 3285, 3290, 3291, 3293, 3293, + 3288, 3295, 3298, 3298, 3294, 3301, 3295, 3300, 3300, 3304, + 3304, 3305, 3305, 3313, 3301, 3306, 3306, 3307, 3307, 3309, + 3309, 3310, 3310, 3311, 3311, 3312, 3312, 3315, 3316, 3316, + 3317, 3317, 3318, 3319, 3320, 3325, 3315, 3322, 3322, 3313, + 3323, 3318, 3324, 3324, 3326, 3319, 3327, 3328, 3328, 3331, + 3325, 3329, 3329, 3335, 3320, 3332, 3332, 3326, 3327, 3323, + 3336, 3337, 3339, 3336, 3331, 3338, 3338, 3341, 3342, 3343, + 3341, 3335, 3344, 3345, 3342, 3346, 3349, 3344, 3347, 3350, + 3339, 3353, 3349, 3343, 3354, 3353, 3357, 3337, 3350, 3370, + + 3366, 3376, 3345, 3346, 3347, 3366, 3379, 3367, 3383, 3354, + 3367, 3377, 3370, 3371, 3371, 3372, 3372, 3374, 3374, 3378, + 3377, 3381, 3357, 3378, 3376, 3384, 3379, 3385, 3387, 3388, + 3388, 3383, 3385, 3389, 3390, 3381, 3384, 3391, 3392, 3393, + 3395, 3394, 3397, 3387, 3398, 3396, 3389, 3397, 3401, 3395, + 3400, 3400, 3407, 3390, 3392, 3391, 3394, 3396, 3399, 3406, + 0, 3402, 3409, 3399, 3393, 3398, 3402, 3414, 3401, 3408, + 3408, 3409, 3407, 3406, 3410, 3410, 3411, 3411, 3412, 3412, + 3413, 3413, 3415, 3417, 3416, 3418, 3414, 3416, 3417, 3419, + 3418, 3420, 3421, 3422, 3424, 3426, 3423, 3430, 3421, 3424, + + 3425, 3425, 3415, 3427, 3427, 3431, 3420, 3422, 3423, 3429, + 3429, 3434, 3430, 3436, 3419, 3426, 3432, 3432, 3439, 3439, + 3440, 3440, 3441, 3442, 3431, 3445, 3434, 3443, 3444, 3447, + 3441, 3436, 3446, 3443, 3444, 3448, 3449, 3449, 3454, 3445, + 3448, 3455, 3442, 3451, 3451, 3446, 3457, 3458, 3447, 3460, + 3461, 3458, 3462, 3463, 3464, 3461, 3465, 3466, 3467, 3454, + 3457, 3455, 3466, 3467, 3468, 3468, 3463, 3464, 3471, 3460, + 3473, 3462, 3472, 3474, 3474, 3465, 3475, 3476, 3477, 3477, + 3478, 3475, 3479, 3476, 3481, 3478, 3480, 3479, 3471, 3473, + 3472, 3480, 3482, 3484, 3484, 3485, 3486, 3486, 3482, 3489, + + 3485, 3488, 3490, 3481, 3491, 3488, 3492, 3493, 3494, 3490, + 3500, 3495, 3502, 3493, 3497, 3497, 3499, 3499, 3489, 3500, + 3503, 3501, 3500, 3491, 3495, 3492, 3501, 3494, 3504, 3505, + 3505, 3502, 3506, 3507, 3509, 3510, 3510, 3506, 3511, 3503, + 3516, 3504, 3512, 3512, 3513, 3513, 3507, 3514, 3515, 3517, + 3517, 3518, 3514, 3520, 3520, 3515, 3518, 3511, 3521, 3516, + 3509, 3519, 3522, 3519, 3523, 3521, 3524, 3525, 3528, 3522, + 3530, 3524, 3527, 3527, 3531, 3530, 3532, 3533, 3537, 3531, + 3534, 3534, 3538, 3523, 3536, 3536, 3525, 3528, 3539, 3539, + 3540, 3540, 3541, 3543, 3543, 3532, 3533, 3537, 3545, 3541, + + 3551, 3538, 3544, 3544, 3547, 3545, 3550, 3552, 0, 3547, + 0, 3550, 3553, 3553, 3554, 3554, 0, 0, 0, 3551, + 0, 0, 0, 0, 0, 0, 3552, 3558, 3558, 3558, + 3558, 3558, 3558, 3558, 3559, 3559, 3559, 3559, 3559, 3559, + 3559, 3560, 3560, 3560, 3560, 3560, 3560, 3560, 3561, 3561, + 3561, 3561, 3561, 3561, 3561, 3562, 3562, 3562, 3562, 3562, + 3562, 3562, 3563, 3563, 3563, 3563, 3563, 3563, 3563, 3564, + 3564, 3564, 3564, 3564, 3564, 3564, 3566, 3566, 0, 3566, + 3566, 3566, 3566, 3567, 3567, 0, 0, 0, 3567, 3567, + 3568, 3568, 0, 0, 3568, 0, 3568, 3569, 0, 0, + + 0, 0, 0, 3569, 3570, 3570, 0, 0, 0, 3570, + 3570, 3571, 0, 0, 0, 0, 0, 3571, 3572, 3572, + 0, 3572, 3572, 3572, 3572, 3573, 0, 0, 0, 0, + 0, 3573, 3574, 3574, 0, 0, 0, 3574, 3574, 3575, + 3575, 0, 3575, 3575, 3575, 3575, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, 3557, + 3557, 3557, 3557, 3557, 3557, 3557, 3557 } ; static yy_state_type yy_last_accepting_state; @@ -3308,7 +3362,7 @@ static void config_end_include(void) #define YY_NO_INPUT 1 #endif -#line 3310 "" +#line 3364 "" #define INITIAL 0 #define quotedstring 1 @@ -3526,7 +3580,7 @@ YY_DECL { #line 211 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -#line 3528 "" +#line 3582 "" while ( 1 ) /* loops until end-of-file is reached */ { @@ -3559,13 +3613,13 @@ yy_match: while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3484 ) + if ( yy_current_state >= 3558 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; ++yy_cp; } - while ( yy_base[yy_current_state] != 6793 ); + while ( yy_base[yy_current_state] != 6947 ); yy_find_action: yy_act = yy_accept[yy_current_state]; @@ -4190,32 +4244,32 @@ YY_RULE_SETUP case 120: YY_RULE_SETUP #line 334 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_FORWARD_ZONE) } +{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) } YY_BREAK case 121: YY_RULE_SETUP #line 335 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_ADDR) } +{ YDVAR(0, VAR_FORWARD_ZONE) } YY_BREAK case 122: YY_RULE_SETUP #line 336 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_HOST) } +{ YDVAR(1, VAR_FORWARD_ADDR) } YY_BREAK case 123: YY_RULE_SETUP #line 337 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_FIRST) } +{ YDVAR(1, VAR_FORWARD_HOST) } YY_BREAK case 124: YY_RULE_SETUP #line 338 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_NO_CACHE) } +{ YDVAR(1, VAR_FORWARD_FIRST) } YY_BREAK case 125: YY_RULE_SETUP #line 339 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } +{ YDVAR(1, VAR_FORWARD_NO_CACHE) } YY_BREAK case 126: YY_RULE_SETUP @@ -4225,1034 +4279,1064 @@ YY_RULE_SETUP case 127: YY_RULE_SETUP #line 341 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_AUTH_ZONE) } +{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } YY_BREAK case 128: YY_RULE_SETUP #line 342 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_RPZ) } +{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) } YY_BREAK case 129: YY_RULE_SETUP #line 343 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TAGS) } +{ YDVAR(0, VAR_AUTH_ZONE) } YY_BREAK case 130: YY_RULE_SETUP #line 344 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) } +{ YDVAR(0, VAR_RPZ) } YY_BREAK case 131: YY_RULE_SETUP #line 345 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) } +{ YDVAR(1, VAR_TAGS) } YY_BREAK case 132: YY_RULE_SETUP #line 346 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_LOG) } +{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) } YY_BREAK case 133: YY_RULE_SETUP #line 347 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_LOG_NAME) } +{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) } YY_BREAK case 134: YY_RULE_SETUP #line 348 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEFILE) } +{ YDVAR(1, VAR_RPZ_LOG) } YY_BREAK case 135: YY_RULE_SETUP #line 349 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MASTER) } +{ YDVAR(1, VAR_RPZ_LOG_NAME) } YY_BREAK case 136: YY_RULE_SETUP #line 350 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MASTER) } +{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) } YY_BREAK case 137: YY_RULE_SETUP #line 351 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_URL) } +{ YDVAR(1, VAR_ZONEFILE) } YY_BREAK case 138: YY_RULE_SETUP #line 352 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ALLOW_NOTIFY) } +{ YDVAR(1, VAR_MASTER) } YY_BREAK case 139: YY_RULE_SETUP #line 353 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FOR_DOWNSTREAM) } +{ YDVAR(1, VAR_MASTER) } YY_BREAK case 140: YY_RULE_SETUP #line 354 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FOR_UPSTREAM) } +{ YDVAR(1, VAR_URL) } YY_BREAK case 141: YY_RULE_SETUP #line 355 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FALLBACK_ENABLED) } +{ YDVAR(1, VAR_ALLOW_NOTIFY) } YY_BREAK case 142: YY_RULE_SETUP #line 356 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_VIEW) } +{ YDVAR(1, VAR_FOR_DOWNSTREAM) } YY_BREAK case 143: YY_RULE_SETUP #line 357 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VIEW_FIRST) } +{ YDVAR(1, VAR_FOR_UPSTREAM) } YY_BREAK case 144: YY_RULE_SETUP #line 358 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) } +{ YDVAR(1, VAR_FALLBACK_ENABLED) } YY_BREAK case 145: YY_RULE_SETUP #line 359 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) } +{ YDVAR(0, VAR_VIEW) } YY_BREAK case 146: YY_RULE_SETUP #line 360 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL) } +{ YDVAR(1, VAR_VIEW_FIRST) } YY_BREAK case 147: YY_RULE_SETUP #line 361 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) } +{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) } YY_BREAK case 148: YY_RULE_SETUP #line 362 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) } +{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) } YY_BREAK case 149: YY_RULE_SETUP #line 363 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) } +{ YDVAR(2, VAR_ACCESS_CONTROL) } YY_BREAK case 150: YY_RULE_SETUP #line 364 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) } +{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) } YY_BREAK case 151: YY_RULE_SETUP #line 365 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) } +{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) } YY_BREAK case 152: YY_RULE_SETUP #line 366 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) } +{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) } YY_BREAK case 153: YY_RULE_SETUP #line 367 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) } +{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) } YY_BREAK case 154: YY_RULE_SETUP #line 368 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) } +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) } YY_BREAK case 155: YY_RULE_SETUP #line 369 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) } +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) } YY_BREAK case 156: YY_RULE_SETUP #line 370 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) } +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) } YY_BREAK case 157: YY_RULE_SETUP #line 371 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_IDENTITY) } +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) } YY_BREAK case 158: YY_RULE_SETUP #line 372 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_VERSION) } +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) } YY_BREAK case 159: YY_RULE_SETUP #line 373 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) } +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) } YY_BREAK case 160: YY_RULE_SETUP #line 374 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) } +{ YDVAR(1, VAR_HIDE_IDENTITY) } YY_BREAK case 161: YY_RULE_SETUP #line 375 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IDENTITY) } +{ YDVAR(1, VAR_HIDE_VERSION) } YY_BREAK case 162: YY_RULE_SETUP #line 376 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VERSION) } +{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) } YY_BREAK case 163: YY_RULE_SETUP #line 377 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_USER_AGENT) } +{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) } YY_BREAK case 164: YY_RULE_SETUP #line 378 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MODULE_CONF) } +{ YDVAR(1, VAR_IDENTITY) } YY_BREAK case 165: YY_RULE_SETUP #line 379 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DLV_ANCHOR) } +{ YDVAR(1, VAR_VERSION) } YY_BREAK case 166: YY_RULE_SETUP #line 380 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DLV_ANCHOR_FILE) } +{ YDVAR(1, VAR_HTTP_USER_AGENT) } YY_BREAK case 167: YY_RULE_SETUP #line 381 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) } +{ YDVAR(1, VAR_MODULE_CONF) } YY_BREAK case 168: YY_RULE_SETUP #line 382 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) } +{ YDVAR(1, VAR_DLV_ANCHOR) } YY_BREAK case 169: YY_RULE_SETUP #line 383 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) } +{ YDVAR(1, VAR_DLV_ANCHOR_FILE) } YY_BREAK case 170: YY_RULE_SETUP #line 384 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR) } +{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) } YY_BREAK case 171: YY_RULE_SETUP #line 385 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) } +{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) } YY_BREAK case 172: YY_RULE_SETUP #line 386 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) } +{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) } YY_BREAK case 173: YY_RULE_SETUP #line 387 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) } +{ YDVAR(1, VAR_TRUST_ANCHOR) } YY_BREAK case 174: YY_RULE_SETUP #line 388 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) } +{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) } YY_BREAK case 175: YY_RULE_SETUP #line 389 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) } +{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) } YY_BREAK case 176: YY_RULE_SETUP #line 390 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_MAX_RESTART) } +{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) } YY_BREAK case 177: YY_RULE_SETUP #line 391 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_BOGUS_TTL) } +{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) } YY_BREAK case 178: YY_RULE_SETUP #line 392 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) } +{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) } YY_BREAK case 179: YY_RULE_SETUP #line 393 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) } +{ YDVAR(1, VAR_VAL_MAX_RESTART) } YY_BREAK case 180: YY_RULE_SETUP #line 394 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_AGGRESSIVE_NSEC) } +{ YDVAR(1, VAR_BOGUS_TTL) } YY_BREAK case 181: YY_RULE_SETUP #line 395 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IGNORE_CD_FLAG) } +{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) } YY_BREAK case 182: YY_RULE_SETUP #line 396 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED) } +{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) } YY_BREAK case 183: YY_RULE_SETUP #line 397 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) } +{ YDVAR(1, VAR_AGGRESSIVE_NSEC) } YY_BREAK case 184: YY_RULE_SETUP #line 398 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) } +{ YDVAR(1, VAR_IGNORE_CD_FLAG) } YY_BREAK case 185: YY_RULE_SETUP #line 399 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) } +{ YDVAR(1, VAR_SERVE_EXPIRED) } YY_BREAK case 186: YY_RULE_SETUP #line 400 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) } +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) } YY_BREAK case 187: YY_RULE_SETUP #line 401 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) } +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) } YY_BREAK case 188: YY_RULE_SETUP #line 402 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAKE_DSA) } +{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) } YY_BREAK case 189: YY_RULE_SETUP #line 403 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAKE_SHA1) } +{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) } YY_BREAK case 190: YY_RULE_SETUP #line 404 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_LOG_LEVEL) } +{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) } YY_BREAK case 191: YY_RULE_SETUP #line 405 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEY_CACHE_SIZE) } +{ YDVAR(1, VAR_FAKE_DSA) } YY_BREAK case 192: YY_RULE_SETUP #line 406 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEY_CACHE_SLABS) } +{ YDVAR(1, VAR_FAKE_SHA1) } YY_BREAK case 193: YY_RULE_SETUP #line 407 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NEG_CACHE_SIZE) } +{ YDVAR(1, VAR_VAL_LOG_LEVEL) } YY_BREAK case 194: YY_RULE_SETUP #line 408 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) } +{ YDVAR(1, VAR_KEY_CACHE_SIZE) } YY_BREAK case 195: YY_RULE_SETUP -#line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) } +#line 409 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_KEY_CACHE_SLABS) } YY_BREAK case 196: YY_RULE_SETUP -#line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_CHECK) } +#line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_NEG_CACHE_SIZE) } YY_BREAK case 197: YY_RULE_SETUP -#line 412 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) } +#line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) } YY_BREAK case 198: YY_RULE_SETUP #line 413 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ADD_HOLDDOWN) } +{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) } YY_BREAK case 199: YY_RULE_SETUP #line 414 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DEL_HOLDDOWN) } +{ YDVAR(1, VAR_ZONEMD_CHECK) } YY_BREAK case 200: YY_RULE_SETUP #line 415 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEEP_MISSING) } +{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) } YY_BREAK case 201: YY_RULE_SETUP #line 416 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) } +{ YDVAR(1, VAR_ADD_HOLDDOWN) } YY_BREAK case 202: YY_RULE_SETUP #line 417 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_USE_SYSLOG) } +{ YDVAR(1, VAR_DEL_HOLDDOWN) } YY_BREAK case 203: YY_RULE_SETUP #line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_IDENTITY) } +{ YDVAR(1, VAR_KEEP_MISSING) } YY_BREAK case 204: YY_RULE_SETUP #line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_TIME_ASCII) } +{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) } YY_BREAK case 205: YY_RULE_SETUP #line 420 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_QUERIES) } +{ YDVAR(1, VAR_USE_SYSLOG) } YY_BREAK case 206: YY_RULE_SETUP #line 421 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_REPLIES) } +{ YDVAR(1, VAR_LOG_IDENTITY) } YY_BREAK case 207: YY_RULE_SETUP #line 422 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) } +{ YDVAR(1, VAR_LOG_TIME_ASCII) } YY_BREAK case 208: YY_RULE_SETUP #line 423 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) } +{ YDVAR(1, VAR_LOG_QUERIES) } YY_BREAK case 209: YY_RULE_SETUP #line 424 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_SERVFAIL) } +{ YDVAR(1, VAR_LOG_REPLIES) } YY_BREAK case 210: YY_RULE_SETUP #line 425 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_LOCAL_ZONE) } +{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) } YY_BREAK case 211: YY_RULE_SETUP #line 426 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOCAL_DATA) } +{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) } YY_BREAK case 212: YY_RULE_SETUP #line 427 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOCAL_DATA_PTR) } +{ YDVAR(1, VAR_LOG_SERVFAIL) } YY_BREAK case 213: YY_RULE_SETUP #line 428 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) } +{ YDVAR(2, VAR_LOCAL_ZONE) } YY_BREAK case 214: YY_RULE_SETUP #line 429 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INSECURE_LAN_ZONES) } +{ YDVAR(1, VAR_LOCAL_DATA) } YY_BREAK case 215: YY_RULE_SETUP #line 430 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STATISTICS_INTERVAL) } +{ YDVAR(1, VAR_LOCAL_DATA_PTR) } YY_BREAK case 216: YY_RULE_SETUP #line 431 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) } +{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) } YY_BREAK case 217: YY_RULE_SETUP #line 432 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EXTENDED_STATISTICS) } +{ YDVAR(1, VAR_INSECURE_LAN_ZONES) } YY_BREAK case 218: YY_RULE_SETUP #line 433 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SHM_ENABLE) } +{ YDVAR(1, VAR_STATISTICS_INTERVAL) } YY_BREAK case 219: YY_RULE_SETUP #line 434 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SHM_KEY) } +{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) } YY_BREAK case 220: YY_RULE_SETUP #line 435 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_REMOTE_CONTROL) } +{ YDVAR(1, VAR_EXTENDED_STATISTICS) } YY_BREAK case 221: YY_RULE_SETUP #line 436 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_ENABLE) } +{ YDVAR(1, VAR_SHM_ENABLE) } YY_BREAK case 222: YY_RULE_SETUP #line 437 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_INTERFACE) } +{ YDVAR(1, VAR_SHM_KEY) } YY_BREAK case 223: YY_RULE_SETUP #line 438 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_PORT) } +{ YDVAR(0, VAR_REMOTE_CONTROL) } YY_BREAK case 224: YY_RULE_SETUP #line 439 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_USE_CERT) } +{ YDVAR(1, VAR_CONTROL_ENABLE) } YY_BREAK case 225: YY_RULE_SETUP #line 440 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVER_KEY_FILE) } +{ YDVAR(1, VAR_CONTROL_INTERFACE) } YY_BREAK case 226: YY_RULE_SETUP #line 441 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVER_CERT_FILE) } +{ YDVAR(1, VAR_CONTROL_PORT) } YY_BREAK case 227: YY_RULE_SETUP #line 442 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_KEY_FILE) } +{ YDVAR(1, VAR_CONTROL_USE_CERT) } YY_BREAK case 228: YY_RULE_SETUP #line 443 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_CERT_FILE) } +{ YDVAR(1, VAR_SERVER_KEY_FILE) } YY_BREAK case 229: YY_RULE_SETUP #line 444 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PYTHON_SCRIPT) } +{ YDVAR(1, VAR_SERVER_CERT_FILE) } YY_BREAK case 230: YY_RULE_SETUP #line 445 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_PYTHON) } +{ YDVAR(1, VAR_CONTROL_KEY_FILE) } YY_BREAK case 231: YY_RULE_SETUP #line 446 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DYNLIB_FILE) } +{ YDVAR(1, VAR_CONTROL_CERT_FILE) } YY_BREAK case 232: YY_RULE_SETUP #line 447 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DYNLIB) } +{ YDVAR(1, VAR_PYTHON_SCRIPT) } YY_BREAK case 233: YY_RULE_SETUP #line 448 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DOMAIN_INSECURE) } +{ YDVAR(0, VAR_PYTHON) } YY_BREAK case 234: YY_RULE_SETUP #line 449 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MINIMAL_RESPONSES) } +{ YDVAR(1, VAR_DYNLIB_FILE) } YY_BREAK case 235: YY_RULE_SETUP #line 450 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RRSET_ROUNDROBIN) } +{ YDVAR(0, VAR_DYNLIB) } YY_BREAK case 236: YY_RULE_SETUP #line 451 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) } +{ YDVAR(1, VAR_DOMAIN_INSECURE) } YY_BREAK case 237: YY_RULE_SETUP #line 452 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_UDP_SIZE) } +{ YDVAR(1, VAR_MINIMAL_RESPONSES) } YY_BREAK case 238: YY_RULE_SETUP #line 453 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_PREFIX) } +{ YDVAR(1, VAR_RRSET_ROUNDROBIN) } YY_BREAK case 239: YY_RULE_SETUP #line 454 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_SYNTHALL) } +{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) } YY_BREAK case 240: YY_RULE_SETUP #line 455 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) } +{ YDVAR(1, VAR_MAX_UDP_SIZE) } YY_BREAK case 241: YY_RULE_SETUP #line 456 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DEFINE_TAG) } +{ YDVAR(1, VAR_DNS64_PREFIX) } YY_BREAK case 242: YY_RULE_SETUP #line 457 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_LOCAL_ZONE_TAG) } +{ YDVAR(1, VAR_DNS64_SYNTHALL) } YY_BREAK case 243: YY_RULE_SETUP #line 458 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) } +{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) } YY_BREAK case 244: YY_RULE_SETUP #line 459 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) } +{ YDVAR(1, VAR_DEFINE_TAG) } YY_BREAK case 245: YY_RULE_SETUP #line 460 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) } +{ YDVAR(2, VAR_LOCAL_ZONE_TAG) } YY_BREAK case 246: YY_RULE_SETUP #line 461 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) } +{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) } YY_BREAK case 247: YY_RULE_SETUP #line 462 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) } +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) } YY_BREAK case 248: YY_RULE_SETUP #line 463 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DNSTAP) } +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) } YY_BREAK case 249: YY_RULE_SETUP #line 464 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_ENABLE) } +{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) } YY_BREAK case 250: YY_RULE_SETUP #line 465 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) } +{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) } YY_BREAK case 251: YY_RULE_SETUP #line 466 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) } +{ YDVAR(0, VAR_DNSTAP) } YY_BREAK case 252: YY_RULE_SETUP #line 467 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_IP) } +{ YDVAR(1, VAR_DNSTAP_ENABLE) } YY_BREAK case 253: YY_RULE_SETUP #line 468 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS) } +{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) } YY_BREAK case 254: YY_RULE_SETUP #line 469 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) } +{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) } YY_BREAK case 255: YY_RULE_SETUP #line 470 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) } +{ YDVAR(1, VAR_DNSTAP_IP) } YY_BREAK case 256: YY_RULE_SETUP #line 471 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) } +{ YDVAR(1, VAR_DNSTAP_TLS) } YY_BREAK case 257: YY_RULE_SETUP -#line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) } +#line 472 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) } YY_BREAK case 258: YY_RULE_SETUP -#line 475 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) } +#line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) } YY_BREAK case 259: YY_RULE_SETUP -#line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) } +#line 474 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) } YY_BREAK case 260: YY_RULE_SETUP -#line 477 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_IDENTITY) } +#line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) } YY_BREAK case 261: YY_RULE_SETUP #line 478 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_VERSION) } +{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) } YY_BREAK case 262: YY_RULE_SETUP #line 479 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) } +{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) } YY_BREAK case 263: YY_RULE_SETUP -#line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) } +#line 480 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_IDENTITY) } YY_BREAK case 264: YY_RULE_SETUP -#line 483 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) } +#line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_VERSION) } YY_BREAK case 265: YY_RULE_SETUP -#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 482 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { - YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) } + YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) } YY_BREAK case 266: YY_RULE_SETUP -#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 484 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { - YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) } + YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) } YY_BREAK case 267: YY_RULE_SETUP -#line 489 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 486 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { - YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } + YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) } YY_BREAK case 268: YY_RULE_SETUP -#line 491 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } +#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) } YY_BREAK case 269: YY_RULE_SETUP -#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT) } +#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) } YY_BREAK case 270: YY_RULE_SETUP -#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT) } +#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } YY_BREAK case 271: YY_RULE_SETUP #line 494 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) } +{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } YY_BREAK case 272: YY_RULE_SETUP #line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_SLABS) } +{ YDVAR(1, VAR_IP_RATELIMIT) } YY_BREAK case 273: YY_RULE_SETUP #line 496 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) } +{ YDVAR(1, VAR_RATELIMIT) } YY_BREAK case 274: YY_RULE_SETUP #line 497 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_SIZE) } +{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) } YY_BREAK case 275: YY_RULE_SETUP #line 498 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) } +{ YDVAR(1, VAR_RATELIMIT_SLABS) } YY_BREAK case 276: YY_RULE_SETUP #line 499 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) } +{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) } YY_BREAK case 277: YY_RULE_SETUP #line 500 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) } +{ YDVAR(1, VAR_RATELIMIT_SIZE) } YY_BREAK case 278: YY_RULE_SETUP #line 501 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_FACTOR) } +{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) } YY_BREAK case 279: YY_RULE_SETUP #line 502 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOW_RTT) } +{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) } YY_BREAK case 280: YY_RULE_SETUP #line 503 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_NUM) } +{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) } YY_BREAK case 281: YY_RULE_SETUP #line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_RATELIMIT_FACTOR) } YY_BREAK case 282: YY_RULE_SETUP #line 505 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } YY_BREAK case 283: YY_RULE_SETUP #line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_RATELIMIT_BACKOFF) } YY_BREAK case 284: YY_RULE_SETUP #line 507 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP_TAG) } +{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } YY_BREAK case 285: YY_RULE_SETUP #line 508 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP) } +{ YDVAR(1, VAR_LOW_RTT) } YY_BREAK case 286: YY_RULE_SETUP #line 509 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP_DATA) } +{ YDVAR(1, VAR_FAST_SERVER_NUM) } YY_BREAK case 287: YY_RULE_SETUP #line 510 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DNSCRYPT) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 288: YY_RULE_SETUP #line 511 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_ENABLE) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 289: YY_RULE_SETUP #line 512 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PORT) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 290: YY_RULE_SETUP #line 513 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) } +{ YDVAR(2, VAR_RESPONSE_IP_TAG) } YY_BREAK case 291: YY_RULE_SETUP #line 514 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) } +{ YDVAR(2, VAR_RESPONSE_IP) } YY_BREAK case 292: YY_RULE_SETUP #line 515 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) } +{ YDVAR(2, VAR_RESPONSE_IP_DATA) } YY_BREAK case 293: YY_RULE_SETUP #line 516 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) } +{ YDVAR(0, VAR_DNSCRYPT) } YY_BREAK case 294: YY_RULE_SETUP #line 517 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) } +{ YDVAR(1, VAR_DNSCRYPT_ENABLE) } YY_BREAK case 295: YY_RULE_SETUP -#line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) } +#line 518 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PORT) } YY_BREAK case 296: YY_RULE_SETUP -#line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) } +#line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) } YY_BREAK case 297: YY_RULE_SETUP -#line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) } +#line 520 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) } YY_BREAK case 298: YY_RULE_SETUP -#line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_RESPONSES) } +#line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) } YY_BREAK case 299: YY_RULE_SETUP -#line 524 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) } +#line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) } YY_BREAK case 300: YY_RULE_SETUP -#line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_QUERIES) } +#line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) } YY_BREAK case 301: YY_RULE_SETUP -#line 526 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) } +#line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) } YY_BREAK case 302: YY_RULE_SETUP #line 527 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_ENABLED) } +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) } YY_BREAK case 303: YY_RULE_SETUP #line 528 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) } +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) } YY_BREAK case 304: YY_RULE_SETUP #line 529 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_HOOK) } +{ YDVAR(1, VAR_PAD_RESPONSES) } YY_BREAK case 305: YY_RULE_SETUP #line 530 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) } +{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) } YY_BREAK case 306: YY_RULE_SETUP #line 531 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } +{ YDVAR(1, VAR_PAD_QUERIES) } YY_BREAK case 307: YY_RULE_SETUP #line 532 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } +{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) } YY_BREAK case 308: YY_RULE_SETUP #line 533 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_STRICT) } +{ YDVAR(1, VAR_IPSECMOD_ENABLED) } YY_BREAK case 309: YY_RULE_SETUP #line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_CACHEDB) } +{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) } YY_BREAK case 310: YY_RULE_SETUP #line 535 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_BACKEND) } +{ YDVAR(1, VAR_IPSECMOD_HOOK) } YY_BREAK case 311: YY_RULE_SETUP #line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_SECRETSEED) } +{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) } YY_BREAK case 312: YY_RULE_SETUP #line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISHOST) } +{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } YY_BREAK case 313: YY_RULE_SETUP #line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISPORT) } +{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } YY_BREAK case 314: YY_RULE_SETUP #line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } +{ YDVAR(1, VAR_IPSECMOD_STRICT) } YY_BREAK case 315: YY_RULE_SETUP #line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } +{ YDVAR(0, VAR_CACHEDB) } YY_BREAK case 316: YY_RULE_SETUP #line 541 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_IPSET) } +{ YDVAR(1, VAR_CACHEDB_BACKEND) } YY_BREAK case 317: YY_RULE_SETUP #line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSET_NAME_V4) } +{ YDVAR(1, VAR_CACHEDB_SECRETSEED) } YY_BREAK case 318: YY_RULE_SETUP #line 543 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSET_NAME_V6) } +{ YDVAR(1, VAR_CACHEDB_REDISHOST) } YY_BREAK case 319: YY_RULE_SETUP #line 544 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } +{ YDVAR(1, VAR_CACHEDB_REDISPORT) } YY_BREAK case 320: YY_RULE_SETUP #line 545 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } +{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } YY_BREAK case 321: YY_RULE_SETUP #line 546 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_EDNS_CLIENT_STRING) } +{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } YY_BREAK case 322: YY_RULE_SETUP #line 547 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } +{ YDVAR(0, VAR_IPSET) } YY_BREAK case 323: YY_RULE_SETUP #line 548 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NSID ) } +{ YDVAR(1, VAR_IPSET_NAME_V4) } YY_BREAK case 324: -/* rule 324 can match eol */ YY_RULE_SETUP #line 549 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ LEXOUT(("NL\n")); cfg_parser->line++; } +{ YDVAR(1, VAR_IPSET_NAME_V6) } YY_BREAK -/* Quoted strings. Strip leading and ending quotes */ case 325: YY_RULE_SETUP +#line 550 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } + YY_BREAK +case 326: +YY_RULE_SETUP +#line 551 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } + YY_BREAK +case 327: +YY_RULE_SETUP #line 552 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(2, VAR_EDNS_CLIENT_STRING) } + YY_BREAK +case 328: +YY_RULE_SETUP +#line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } + YY_BREAK +case 329: +YY_RULE_SETUP +#line 554 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_NSID ) } + YY_BREAK +case 330: +/* rule 330 can match eol */ +YY_RULE_SETUP +#line 555 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ LEXOUT(("NL\n")); cfg_parser->line++; } + YY_BREAK +/* Quoted strings. Strip leading and ending quotes */ +case 331: +YY_RULE_SETUP +#line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { BEGIN(quotedstring); LEXOUT(("QS ")); } YY_BREAK case YY_STATE_EOF(quotedstring): -#line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); if(--num_args == 0) { BEGIN(INITIAL); } else { BEGIN(val); } } YY_BREAK -case 326: +case 332: YY_RULE_SETUP -#line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 564 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("STR(%s) ", yytext)); yymore(); } YY_BREAK -case 327: -/* rule 327 can match eol */ +case 333: +/* rule 333 can match eol */ YY_RULE_SETUP -#line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 565 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("newline inside quoted string, no end \""); cfg_parser->line++; BEGIN(INITIAL); } YY_BREAK -case 328: +case 334: YY_RULE_SETUP -#line 561 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 567 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("QE ")); if(--num_args == 0) { BEGIN(INITIAL); } @@ -5265,34 +5349,34 @@ YY_RULE_SETUP } YY_BREAK /* Single Quoted strings. Strip leading and ending quotes */ -case 329: +case 335: YY_RULE_SETUP -#line 573 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 579 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { BEGIN(singlequotedstr); LEXOUT(("SQS ")); } YY_BREAK case YY_STATE_EOF(singlequotedstr): -#line 574 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 580 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); if(--num_args == 0) { BEGIN(INITIAL); } else { BEGIN(val); } } YY_BREAK -case 330: +case 336: YY_RULE_SETUP -#line 579 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 585 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("STR(%s) ", yytext)); yymore(); } YY_BREAK -case 331: -/* rule 331 can match eol */ +case 337: +/* rule 337 can match eol */ YY_RULE_SETUP -#line 580 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 586 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("newline inside quoted string, no end '"); cfg_parser->line++; BEGIN(INITIAL); } YY_BREAK -case 332: +case 338: YY_RULE_SETUP -#line 582 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 588 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("SQE ")); if(--num_args == 0) { BEGIN(INITIAL); } @@ -5305,38 +5389,38 @@ YY_RULE_SETUP } YY_BREAK /* include: directive */ -case 333: +case 339: YY_RULE_SETUP -#line 594 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 600 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); } YY_BREAK case YY_STATE_EOF(include): -#line 596 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside include directive"); BEGIN(inc_prev); } YY_BREAK -case 334: +case 340: YY_RULE_SETUP -#line 600 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 606 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ISP ")); /* ignore */ } YY_BREAK -case 335: -/* rule 335 can match eol */ +case 341: +/* rule 341 can match eol */ YY_RULE_SETUP -#line 601 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 607 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++;} YY_BREAK -case 336: +case 342: YY_RULE_SETUP -#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("IQS ")); BEGIN(include_quoted); } YY_BREAK -case 337: +case 343: YY_RULE_SETUP -#line 603 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 609 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("Iunquotedstr(%s) ", yytext)); config_start_include_glob(yytext, 0); @@ -5344,27 +5428,27 @@ YY_RULE_SETUP } YY_BREAK case YY_STATE_EOF(include_quoted): -#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 614 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(inc_prev); } YY_BREAK -case 338: +case 344: YY_RULE_SETUP -#line 612 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 618 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ISTR(%s) ", yytext)); yymore(); } YY_BREAK -case 339: -/* rule 339 can match eol */ +case 345: +/* rule 345 can match eol */ YY_RULE_SETUP -#line 613 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 619 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("newline before \" in include name"); cfg_parser->line++; BEGIN(inc_prev); } YY_BREAK -case 340: +case 346: YY_RULE_SETUP -#line 615 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 621 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("IQE ")); yytext[yyleng - 1] = '\0'; @@ -5374,7 +5458,7 @@ YY_RULE_SETUP YY_BREAK case YY_STATE_EOF(INITIAL): case YY_STATE_EOF(val): -#line 621 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 627 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("LEXEOF ")); yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ @@ -5389,39 +5473,39 @@ case YY_STATE_EOF(val): } YY_BREAK /* include-toplevel: directive */ -case 341: +case 347: YY_RULE_SETUP -#line 635 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 641 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel); } YY_BREAK case YY_STATE_EOF(include_toplevel): -#line 638 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside include_toplevel directive"); BEGIN(inc_prev); } YY_BREAK -case 342: +case 348: YY_RULE_SETUP -#line 642 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 648 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITSP ")); /* ignore */ } YY_BREAK -case 343: -/* rule 343 can match eol */ +case 349: +/* rule 349 can match eol */ YY_RULE_SETUP -#line 643 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 649 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++; } YY_BREAK -case 344: +case 350: YY_RULE_SETUP -#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 650 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); } YY_BREAK -case 345: +case 351: YY_RULE_SETUP -#line 645 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 651 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITunquotedstr(%s) ", yytext)); config_start_include_glob(yytext, 1); @@ -5430,29 +5514,29 @@ YY_RULE_SETUP } YY_BREAK case YY_STATE_EOF(include_toplevel_quoted): -#line 651 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 657 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(inc_prev); } YY_BREAK -case 346: +case 352: YY_RULE_SETUP -#line 655 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 661 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITSTR(%s) ", yytext)); yymore(); } YY_BREAK -case 347: -/* rule 347 can match eol */ +case 353: +/* rule 353 can match eol */ YY_RULE_SETUP -#line 656 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 662 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("newline before \" in include name"); cfg_parser->line++; BEGIN(inc_prev); } YY_BREAK -case 348: +case 354: YY_RULE_SETUP -#line 660 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 666 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITQE ")); yytext[yyleng - 1] = '\0'; @@ -5461,33 +5545,33 @@ YY_RULE_SETUP return (VAR_FORCE_TOPLEVEL); } YY_BREAK -case 349: +case 355: YY_RULE_SETUP -#line 668 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 674 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("unquotedstr(%s) ", yytext)); if(--num_args == 0) { BEGIN(INITIAL); } yylval.str = strdup(yytext); return STRING_ARG; } YY_BREAK -case 350: +case 356: YY_RULE_SETUP -#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 678 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { ub_c_error_msg("unknown keyword '%s'", yytext); } YY_BREAK -case 351: +case 357: YY_RULE_SETUP -#line 676 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 682 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { ub_c_error_msg("stray '%s'", yytext); } YY_BREAK -case 352: +case 358: YY_RULE_SETUP -#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 686 "/usr/src/usr.sbin/unbound/util/configlexer.lex" ECHO; YY_BREAK -#line 5489 "" +#line 5573 "" case YY_END_OF_BUFFER: { @@ -5780,7 +5864,7 @@ static int yy_get_next_buffer (void) while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3484 ) + if ( yy_current_state >= 3558 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; @@ -5808,13 +5892,13 @@ static int yy_get_next_buffer (void) while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3484 ) + if ( yy_current_state >= 3558 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; - yy_is_jam = (yy_current_state == 3483); + yy_is_jam = (yy_current_state == 3557); - return yy_is_jam ? 0 : yy_current_state; + return yy_is_jam ? 0 : yy_current_state; } #ifndef YY_NO_INPUT @@ -6445,7 +6529,7 @@ void yyfree (void * ptr ) #define YYTABLES_NAME "yytables" -#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 686 "/usr/src/usr.sbin/unbound/util/configlexer.lex" diff --git a/sbin/unwind/libunbound/util/configlexer.lex b/sbin/unwind/libunbound/util/configlexer.lex index dbfc17d499f..34a0e5dd9cb 100644 --- a/sbin/unwind/libunbound/util/configlexer.lex +++ b/sbin/unwind/libunbound/util/configlexer.lex @@ -331,6 +331,7 @@ stub-first{COLON} { YDVAR(1, VAR_STUB_FIRST) } stub-no-cache{COLON} { YDVAR(1, VAR_STUB_NO_CACHE) } stub-ssl-upstream{COLON} { YDVAR(1, VAR_STUB_SSL_UPSTREAM) } stub-tls-upstream{COLON} { YDVAR(1, VAR_STUB_SSL_UPSTREAM) } +stub-tcp-upstream{COLON} { YDVAR(1, VAR_STUB_TCP_UPSTREAM) } forward-zone{COLON} { YDVAR(0, VAR_FORWARD_ZONE) } forward-addr{COLON} { YDVAR(1, VAR_FORWARD_ADDR) } forward-host{COLON} { YDVAR(1, VAR_FORWARD_HOST) } @@ -338,6 +339,7 @@ forward-first{COLON} { YDVAR(1, VAR_FORWARD_FIRST) } forward-no-cache{COLON} { YDVAR(1, VAR_FORWARD_NO_CACHE) } forward-ssl-upstream{COLON} { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } forward-tls-upstream{COLON} { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } +forward-tcp-upstream{COLON} { YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) } auth-zone{COLON} { YDVAR(0, VAR_AUTH_ZONE) } rpz{COLON} { YDVAR(0, VAR_RPZ) } tags{COLON} { YDVAR(1, VAR_TAGS) } @@ -345,6 +347,7 @@ rpz-action-override{COLON} { YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) } rpz-cname-override{COLON} { YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) } rpz-log{COLON} { YDVAR(1, VAR_RPZ_LOG) } rpz-log-name{COLON} { YDVAR(1, VAR_RPZ_LOG_NAME) } +rpz-signal-nxdomain-ra{COLON} { YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) } zonefile{COLON} { YDVAR(1, VAR_ZONEFILE) } master{COLON} { YDVAR(1, VAR_MASTER) } primary{COLON} { YDVAR(1, VAR_MASTER) } @@ -499,6 +502,9 @@ ratelimit-for-domain{COLON} { YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) } ratelimit-below-domain{COLON} { YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) } ip-ratelimit-factor{COLON} { YDVAR(1, VAR_IP_RATELIMIT_FACTOR) } ratelimit-factor{COLON} { YDVAR(1, VAR_RATELIMIT_FACTOR) } +ip-ratelimit-backoff{COLON} { YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } +ratelimit-backoff{COLON} { YDVAR(1, VAR_RATELIMIT_BACKOFF) } +outbound-msg-retry{COLON} { YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } low-rtt{COLON} { YDVAR(1, VAR_LOW_RTT) } fast-server-num{COLON} { YDVAR(1, VAR_FAST_SERVER_NUM) } low-rtt-pct{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) } diff --git a/sbin/unwind/libunbound/util/configparser.h b/sbin/unwind/libunbound/util/configparser.h index 57603343d51..ec40866200b 100644 --- a/sbin/unwind/libunbound/util/configparser.h +++ b/sbin/unwind/libunbound/util/configparser.h @@ -141,178 +141,184 @@ #define VAR_STUB_SSL_UPSTREAM 397 #define VAR_FORWARD_SSL_UPSTREAM 398 #define VAR_TLS_CERT_BUNDLE 399 -#define VAR_HTTPS_PORT 400 -#define VAR_HTTP_ENDPOINT 401 -#define VAR_HTTP_MAX_STREAMS 402 -#define VAR_HTTP_QUERY_BUFFER_SIZE 403 -#define VAR_HTTP_RESPONSE_BUFFER_SIZE 404 -#define VAR_HTTP_NODELAY 405 -#define VAR_HTTP_NOTLS_DOWNSTREAM 406 -#define VAR_STUB_FIRST 407 -#define VAR_MINIMAL_RESPONSES 408 -#define VAR_RRSET_ROUNDROBIN 409 -#define VAR_MAX_UDP_SIZE 410 -#define VAR_DELAY_CLOSE 411 -#define VAR_UDP_CONNECT 412 -#define VAR_UNBLOCK_LAN_ZONES 413 -#define VAR_INSECURE_LAN_ZONES 414 -#define VAR_INFRA_CACHE_MIN_RTT 415 -#define VAR_INFRA_KEEP_PROBING 416 -#define VAR_DNS64_PREFIX 417 -#define VAR_DNS64_SYNTHALL 418 -#define VAR_DNS64_IGNORE_AAAA 419 -#define VAR_DNSTAP 420 -#define VAR_DNSTAP_ENABLE 421 -#define VAR_DNSTAP_SOCKET_PATH 422 -#define VAR_DNSTAP_IP 423 -#define VAR_DNSTAP_TLS 424 -#define VAR_DNSTAP_TLS_SERVER_NAME 425 -#define VAR_DNSTAP_TLS_CERT_BUNDLE 426 -#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 427 -#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 428 -#define VAR_DNSTAP_SEND_IDENTITY 429 -#define VAR_DNSTAP_SEND_VERSION 430 -#define VAR_DNSTAP_BIDIRECTIONAL 431 -#define VAR_DNSTAP_IDENTITY 432 -#define VAR_DNSTAP_VERSION 433 -#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 434 -#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 435 -#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 436 -#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 437 -#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 438 -#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 439 -#define VAR_RESPONSE_IP_TAG 440 -#define VAR_RESPONSE_IP 441 -#define VAR_RESPONSE_IP_DATA 442 -#define VAR_HARDEN_ALGO_DOWNGRADE 443 -#define VAR_IP_TRANSPARENT 444 -#define VAR_IP_DSCP 445 -#define VAR_DISABLE_DNSSEC_LAME_CHECK 446 -#define VAR_IP_RATELIMIT 447 -#define VAR_IP_RATELIMIT_SLABS 448 -#define VAR_IP_RATELIMIT_SIZE 449 -#define VAR_RATELIMIT 450 -#define VAR_RATELIMIT_SLABS 451 -#define VAR_RATELIMIT_SIZE 452 -#define VAR_RATELIMIT_FOR_DOMAIN 453 -#define VAR_RATELIMIT_BELOW_DOMAIN 454 -#define VAR_IP_RATELIMIT_FACTOR 455 -#define VAR_RATELIMIT_FACTOR 456 -#define VAR_SEND_CLIENT_SUBNET 457 -#define VAR_CLIENT_SUBNET_ZONE 458 -#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 459 -#define VAR_CLIENT_SUBNET_OPCODE 460 -#define VAR_MAX_CLIENT_SUBNET_IPV4 461 -#define VAR_MAX_CLIENT_SUBNET_IPV6 462 -#define VAR_MIN_CLIENT_SUBNET_IPV4 463 -#define VAR_MIN_CLIENT_SUBNET_IPV6 464 -#define VAR_MAX_ECS_TREE_SIZE_IPV4 465 -#define VAR_MAX_ECS_TREE_SIZE_IPV6 466 -#define VAR_CAPS_WHITELIST 467 -#define VAR_CACHE_MAX_NEGATIVE_TTL 468 -#define VAR_PERMIT_SMALL_HOLDDOWN 469 -#define VAR_QNAME_MINIMISATION 470 -#define VAR_QNAME_MINIMISATION_STRICT 471 -#define VAR_IP_FREEBIND 472 -#define VAR_DEFINE_TAG 473 -#define VAR_LOCAL_ZONE_TAG 474 -#define VAR_ACCESS_CONTROL_TAG 475 -#define VAR_LOCAL_ZONE_OVERRIDE 476 -#define VAR_ACCESS_CONTROL_TAG_ACTION 477 -#define VAR_ACCESS_CONTROL_TAG_DATA 478 -#define VAR_VIEW 479 -#define VAR_ACCESS_CONTROL_VIEW 480 -#define VAR_VIEW_FIRST 481 -#define VAR_SERVE_EXPIRED 482 -#define VAR_SERVE_EXPIRED_TTL 483 -#define VAR_SERVE_EXPIRED_TTL_RESET 484 -#define VAR_SERVE_EXPIRED_REPLY_TTL 485 -#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 486 -#define VAR_SERVE_ORIGINAL_TTL 487 -#define VAR_FAKE_DSA 488 -#define VAR_FAKE_SHA1 489 -#define VAR_LOG_IDENTITY 490 -#define VAR_HIDE_TRUSTANCHOR 491 -#define VAR_HIDE_HTTP_USER_AGENT 492 -#define VAR_HTTP_USER_AGENT 493 -#define VAR_TRUST_ANCHOR_SIGNALING 494 -#define VAR_AGGRESSIVE_NSEC 495 -#define VAR_USE_SYSTEMD 496 -#define VAR_SHM_ENABLE 497 -#define VAR_SHM_KEY 498 -#define VAR_ROOT_KEY_SENTINEL 499 -#define VAR_DNSCRYPT 500 -#define VAR_DNSCRYPT_ENABLE 501 -#define VAR_DNSCRYPT_PORT 502 -#define VAR_DNSCRYPT_PROVIDER 503 -#define VAR_DNSCRYPT_SECRET_KEY 504 -#define VAR_DNSCRYPT_PROVIDER_CERT 505 -#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 506 -#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 507 -#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 508 -#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 509 -#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 510 -#define VAR_PAD_RESPONSES 511 -#define VAR_PAD_RESPONSES_BLOCK_SIZE 512 -#define VAR_PAD_QUERIES 513 -#define VAR_PAD_QUERIES_BLOCK_SIZE 514 -#define VAR_IPSECMOD_ENABLED 515 -#define VAR_IPSECMOD_HOOK 516 -#define VAR_IPSECMOD_IGNORE_BOGUS 517 -#define VAR_IPSECMOD_MAX_TTL 518 -#define VAR_IPSECMOD_WHITELIST 519 -#define VAR_IPSECMOD_STRICT 520 -#define VAR_CACHEDB 521 -#define VAR_CACHEDB_BACKEND 522 -#define VAR_CACHEDB_SECRETSEED 523 -#define VAR_CACHEDB_REDISHOST 524 -#define VAR_CACHEDB_REDISPORT 525 -#define VAR_CACHEDB_REDISTIMEOUT 526 -#define VAR_CACHEDB_REDISEXPIRERECORDS 527 -#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 528 -#define VAR_FOR_UPSTREAM 529 -#define VAR_AUTH_ZONE 530 -#define VAR_ZONEFILE 531 -#define VAR_MASTER 532 -#define VAR_URL 533 -#define VAR_FOR_DOWNSTREAM 534 -#define VAR_FALLBACK_ENABLED 535 -#define VAR_TLS_ADDITIONAL_PORT 536 -#define VAR_LOW_RTT 537 -#define VAR_LOW_RTT_PERMIL 538 -#define VAR_FAST_SERVER_PERMIL 539 -#define VAR_FAST_SERVER_NUM 540 -#define VAR_ALLOW_NOTIFY 541 -#define VAR_TLS_WIN_CERT 542 -#define VAR_TCP_CONNECTION_LIMIT 543 -#define VAR_FORWARD_NO_CACHE 544 -#define VAR_STUB_NO_CACHE 545 -#define VAR_LOG_SERVFAIL 546 -#define VAR_DENY_ANY 547 -#define VAR_UNKNOWN_SERVER_TIME_LIMIT 548 -#define VAR_LOG_TAG_QUERYREPLY 549 -#define VAR_STREAM_WAIT_SIZE 550 -#define VAR_TLS_CIPHERS 551 -#define VAR_TLS_CIPHERSUITES 552 -#define VAR_TLS_USE_SNI 553 -#define VAR_IPSET 554 -#define VAR_IPSET_NAME_V4 555 -#define VAR_IPSET_NAME_V6 556 -#define VAR_TLS_SESSION_TICKET_KEYS 557 -#define VAR_RPZ 558 -#define VAR_TAGS 559 -#define VAR_RPZ_ACTION_OVERRIDE 560 -#define VAR_RPZ_CNAME_OVERRIDE 561 -#define VAR_RPZ_LOG 562 -#define VAR_RPZ_LOG_NAME 563 -#define VAR_DYNLIB 564 -#define VAR_DYNLIB_FILE 565 -#define VAR_EDNS_CLIENT_STRING 566 -#define VAR_EDNS_CLIENT_STRING_OPCODE 567 -#define VAR_NSID 568 -#define VAR_ZONEMD_PERMISSIVE_MODE 569 -#define VAR_ZONEMD_CHECK 570 -#define VAR_ZONEMD_REJECT_ABSENCE 571 +#define VAR_STUB_TCP_UPSTREAM 400 +#define VAR_FORWARD_TCP_UPSTREAM 401 +#define VAR_HTTPS_PORT 402 +#define VAR_HTTP_ENDPOINT 403 +#define VAR_HTTP_MAX_STREAMS 404 +#define VAR_HTTP_QUERY_BUFFER_SIZE 405 +#define VAR_HTTP_RESPONSE_BUFFER_SIZE 406 +#define VAR_HTTP_NODELAY 407 +#define VAR_HTTP_NOTLS_DOWNSTREAM 408 +#define VAR_STUB_FIRST 409 +#define VAR_MINIMAL_RESPONSES 410 +#define VAR_RRSET_ROUNDROBIN 411 +#define VAR_MAX_UDP_SIZE 412 +#define VAR_DELAY_CLOSE 413 +#define VAR_UDP_CONNECT 414 +#define VAR_UNBLOCK_LAN_ZONES 415 +#define VAR_INSECURE_LAN_ZONES 416 +#define VAR_INFRA_CACHE_MIN_RTT 417 +#define VAR_INFRA_KEEP_PROBING 418 +#define VAR_DNS64_PREFIX 419 +#define VAR_DNS64_SYNTHALL 420 +#define VAR_DNS64_IGNORE_AAAA 421 +#define VAR_DNSTAP 422 +#define VAR_DNSTAP_ENABLE 423 +#define VAR_DNSTAP_SOCKET_PATH 424 +#define VAR_DNSTAP_IP 425 +#define VAR_DNSTAP_TLS 426 +#define VAR_DNSTAP_TLS_SERVER_NAME 427 +#define VAR_DNSTAP_TLS_CERT_BUNDLE 428 +#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 429 +#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 430 +#define VAR_DNSTAP_SEND_IDENTITY 431 +#define VAR_DNSTAP_SEND_VERSION 432 +#define VAR_DNSTAP_BIDIRECTIONAL 433 +#define VAR_DNSTAP_IDENTITY 434 +#define VAR_DNSTAP_VERSION 435 +#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 436 +#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 437 +#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 438 +#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 439 +#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 440 +#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 441 +#define VAR_RESPONSE_IP_TAG 442 +#define VAR_RESPONSE_IP 443 +#define VAR_RESPONSE_IP_DATA 444 +#define VAR_HARDEN_ALGO_DOWNGRADE 445 +#define VAR_IP_TRANSPARENT 446 +#define VAR_IP_DSCP 447 +#define VAR_DISABLE_DNSSEC_LAME_CHECK 448 +#define VAR_IP_RATELIMIT 449 +#define VAR_IP_RATELIMIT_SLABS 450 +#define VAR_IP_RATELIMIT_SIZE 451 +#define VAR_RATELIMIT 452 +#define VAR_RATELIMIT_SLABS 453 +#define VAR_RATELIMIT_SIZE 454 +#define VAR_OUTBOUND_MSG_RETRY 455 +#define VAR_RATELIMIT_FOR_DOMAIN 456 +#define VAR_RATELIMIT_BELOW_DOMAIN 457 +#define VAR_IP_RATELIMIT_FACTOR 458 +#define VAR_RATELIMIT_FACTOR 459 +#define VAR_IP_RATELIMIT_BACKOFF 460 +#define VAR_RATELIMIT_BACKOFF 461 +#define VAR_SEND_CLIENT_SUBNET 462 +#define VAR_CLIENT_SUBNET_ZONE 463 +#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 464 +#define VAR_CLIENT_SUBNET_OPCODE 465 +#define VAR_MAX_CLIENT_SUBNET_IPV4 466 +#define VAR_MAX_CLIENT_SUBNET_IPV6 467 +#define VAR_MIN_CLIENT_SUBNET_IPV4 468 +#define VAR_MIN_CLIENT_SUBNET_IPV6 469 +#define VAR_MAX_ECS_TREE_SIZE_IPV4 470 +#define VAR_MAX_ECS_TREE_SIZE_IPV6 471 +#define VAR_CAPS_WHITELIST 472 +#define VAR_CACHE_MAX_NEGATIVE_TTL 473 +#define VAR_PERMIT_SMALL_HOLDDOWN 474 +#define VAR_QNAME_MINIMISATION 475 +#define VAR_QNAME_MINIMISATION_STRICT 476 +#define VAR_IP_FREEBIND 477 +#define VAR_DEFINE_TAG 478 +#define VAR_LOCAL_ZONE_TAG 479 +#define VAR_ACCESS_CONTROL_TAG 480 +#define VAR_LOCAL_ZONE_OVERRIDE 481 +#define VAR_ACCESS_CONTROL_TAG_ACTION 482 +#define VAR_ACCESS_CONTROL_TAG_DATA 483 +#define VAR_VIEW 484 +#define VAR_ACCESS_CONTROL_VIEW 485 +#define VAR_VIEW_FIRST 486 +#define VAR_SERVE_EXPIRED 487 +#define VAR_SERVE_EXPIRED_TTL 488 +#define VAR_SERVE_EXPIRED_TTL_RESET 489 +#define VAR_SERVE_EXPIRED_REPLY_TTL 490 +#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 491 +#define VAR_SERVE_ORIGINAL_TTL 492 +#define VAR_FAKE_DSA 493 +#define VAR_FAKE_SHA1 494 +#define VAR_LOG_IDENTITY 495 +#define VAR_HIDE_TRUSTANCHOR 496 +#define VAR_HIDE_HTTP_USER_AGENT 497 +#define VAR_HTTP_USER_AGENT 498 +#define VAR_TRUST_ANCHOR_SIGNALING 499 +#define VAR_AGGRESSIVE_NSEC 500 +#define VAR_USE_SYSTEMD 501 +#define VAR_SHM_ENABLE 502 +#define VAR_SHM_KEY 503 +#define VAR_ROOT_KEY_SENTINEL 504 +#define VAR_DNSCRYPT 505 +#define VAR_DNSCRYPT_ENABLE 506 +#define VAR_DNSCRYPT_PORT 507 +#define VAR_DNSCRYPT_PROVIDER 508 +#define VAR_DNSCRYPT_SECRET_KEY 509 +#define VAR_DNSCRYPT_PROVIDER_CERT 510 +#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 511 +#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 512 +#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 513 +#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 514 +#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 515 +#define VAR_PAD_RESPONSES 516 +#define VAR_PAD_RESPONSES_BLOCK_SIZE 517 +#define VAR_PAD_QUERIES 518 +#define VAR_PAD_QUERIES_BLOCK_SIZE 519 +#define VAR_IPSECMOD_ENABLED 520 +#define VAR_IPSECMOD_HOOK 521 +#define VAR_IPSECMOD_IGNORE_BOGUS 522 +#define VAR_IPSECMOD_MAX_TTL 523 +#define VAR_IPSECMOD_WHITELIST 524 +#define VAR_IPSECMOD_STRICT 525 +#define VAR_CACHEDB 526 +#define VAR_CACHEDB_BACKEND 527 +#define VAR_CACHEDB_SECRETSEED 528 +#define VAR_CACHEDB_REDISHOST 529 +#define VAR_CACHEDB_REDISPORT 530 +#define VAR_CACHEDB_REDISTIMEOUT 531 +#define VAR_CACHEDB_REDISEXPIRERECORDS 532 +#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 533 +#define VAR_FOR_UPSTREAM 534 +#define VAR_AUTH_ZONE 535 +#define VAR_ZONEFILE 536 +#define VAR_MASTER 537 +#define VAR_URL 538 +#define VAR_FOR_DOWNSTREAM 539 +#define VAR_FALLBACK_ENABLED 540 +#define VAR_TLS_ADDITIONAL_PORT 541 +#define VAR_LOW_RTT 542 +#define VAR_LOW_RTT_PERMIL 543 +#define VAR_FAST_SERVER_PERMIL 544 +#define VAR_FAST_SERVER_NUM 545 +#define VAR_ALLOW_NOTIFY 546 +#define VAR_TLS_WIN_CERT 547 +#define VAR_TCP_CONNECTION_LIMIT 548 +#define VAR_FORWARD_NO_CACHE 549 +#define VAR_STUB_NO_CACHE 550 +#define VAR_LOG_SERVFAIL 551 +#define VAR_DENY_ANY 552 +#define VAR_UNKNOWN_SERVER_TIME_LIMIT 553 +#define VAR_LOG_TAG_QUERYREPLY 554 +#define VAR_STREAM_WAIT_SIZE 555 +#define VAR_TLS_CIPHERS 556 +#define VAR_TLS_CIPHERSUITES 557 +#define VAR_TLS_USE_SNI 558 +#define VAR_IPSET 559 +#define VAR_IPSET_NAME_V4 560 +#define VAR_IPSET_NAME_V6 561 +#define VAR_TLS_SESSION_TICKET_KEYS 562 +#define VAR_RPZ 563 +#define VAR_TAGS 564 +#define VAR_RPZ_ACTION_OVERRIDE 565 +#define VAR_RPZ_CNAME_OVERRIDE 566 +#define VAR_RPZ_LOG 567 +#define VAR_RPZ_LOG_NAME 568 +#define VAR_DYNLIB 569 +#define VAR_DYNLIB_FILE 570 +#define VAR_EDNS_CLIENT_STRING 571 +#define VAR_EDNS_CLIENT_STRING_OPCODE 572 +#define VAR_NSID 573 +#define VAR_ZONEMD_PERMISSIVE_MODE 574 +#define VAR_ZONEMD_CHECK 575 +#define VAR_ZONEMD_REJECT_ABSENCE 576 +#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 577 #ifndef YYSTYPE_DEFINED #define YYSTYPE_DEFINED typedef union { diff --git a/sbin/unwind/libunbound/util/configparser.y b/sbin/unwind/libunbound/util/configparser.y index e22d48d4105..d4f965f9446 100644 --- a/sbin/unwind/libunbound/util/configparser.y +++ b/sbin/unwind/libunbound/util/configparser.y @@ -4,24 +4,24 @@ * Copyright (c) 2001-2006, NLnet Labs. All rights reserved. * * Copyright (c) 2007, NLnet Labs. All rights reserved. - * + * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -88,13 +88,13 @@ extern struct config_parser_state* cfg_parser; %token VAR_TRUST_ANCHOR_FILE VAR_TRUST_ANCHOR VAR_VAL_OVERRIDE_DATE %token VAR_BOGUS_TTL VAR_VAL_CLEAN_ADDITIONAL VAR_VAL_PERMISSIVE_MODE %token VAR_INCOMING_NUM_TCP VAR_MSG_BUFFER_SIZE VAR_KEY_CACHE_SIZE -%token VAR_KEY_CACHE_SLABS VAR_TRUSTED_KEYS_FILE -%token VAR_VAL_NSEC3_KEYSIZE_ITERATIONS VAR_USE_SYSLOG +%token VAR_KEY_CACHE_SLABS VAR_TRUSTED_KEYS_FILE +%token VAR_VAL_NSEC3_KEYSIZE_ITERATIONS VAR_USE_SYSLOG %token VAR_OUTGOING_INTERFACE VAR_ROOT_HINTS VAR_DO_NOT_QUERY_LOCALHOST %token VAR_CACHE_MAX_TTL VAR_HARDEN_DNSSEC_STRIPPED VAR_ACCESS_CONTROL %token VAR_LOCAL_ZONE VAR_LOCAL_DATA VAR_INTERFACE_AUTOMATIC %token VAR_STATISTICS_INTERVAL VAR_DO_DAEMONIZE VAR_USE_CAPS_FOR_ID -%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT +%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE @@ -113,6 +113,7 @@ extern struct config_parser_state* cfg_parser; %token VAR_SSL_UPSTREAM VAR_TCP_AUTH_QUERY_TIMEOUT VAR_SSL_SERVICE_KEY %token VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST %token VAR_STUB_SSL_UPSTREAM VAR_FORWARD_SSL_UPSTREAM VAR_TLS_CERT_BUNDLE +%token VAR_STUB_TCP_UPSTREAM VAR_FORWARD_TCP_UPSTREAM %token VAR_HTTPS_PORT VAR_HTTP_ENDPOINT VAR_HTTP_MAX_STREAMS %token VAR_HTTP_QUERY_BUFFER_SIZE VAR_HTTP_RESPONSE_BUFFER_SIZE %token VAR_HTTP_NODELAY VAR_HTTP_NOTLS_DOWNSTREAM @@ -138,8 +139,10 @@ extern struct config_parser_state* cfg_parser; %token VAR_DISABLE_DNSSEC_LAME_CHECK %token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE +%token VAR_OUTBOUND_MSG_RETRY %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN %token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR +%token VAR_IP_RATELIMIT_BACKOFF VAR_RATELIMIT_BACKOFF %token VAR_SEND_CLIENT_SUBNET VAR_CLIENT_SUBNET_ZONE %token VAR_CLIENT_SUBNET_ALWAYS_FORWARD VAR_CLIENT_SUBNET_OPCODE %token VAR_MAX_CLIENT_SUBNET_IPV4 VAR_MAX_CLIENT_SUBNET_IPV6 @@ -185,11 +188,12 @@ extern struct config_parser_state* cfg_parser; %token VAR_DYNLIB VAR_DYNLIB_FILE VAR_EDNS_CLIENT_STRING %token VAR_EDNS_CLIENT_STRING_OPCODE VAR_NSID %token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_CHECK VAR_ZONEMD_REJECT_ABSENCE +%token VAR_RPZ_SIGNAL_NXDOMAIN_RA %% toplevelvars: /* empty */ | toplevelvars toplevelvar ; toplevelvar: serverstart contents_server | stubstart contents_stub | - forwardstart contents_forward | pythonstart contents_py | + forwardstart contents_forward | pythonstart contents_py | rcstart contents_rc | dtstart contents_dt | viewstart contents_view | dnscstart contents_dnsc | cachedbstart contents_cachedb | ipsetstart contents_ipset | authstart contents_auth | @@ -203,7 +207,7 @@ force_toplevel: VAR_FORCE_TOPLEVEL ; /* server: declaration */ serverstart: VAR_SERVER - { + { OUTYY(("\nP(server:)\n")); } ; @@ -215,14 +219,14 @@ content_server: server_num_threads | server_verbosity | server_port | server_do_udp | server_do_tcp | server_tcp_mss | server_outgoing_tcp_mss | server_tcp_idle_timeout | server_tcp_keepalive | server_tcp_keepalive_timeout | - server_interface | server_chroot | server_username | + server_interface | server_chroot | server_username | server_directory | server_logfile | server_pidfile | server_msg_cache_size | server_msg_cache_slabs | - server_num_queries_per_thread | server_rrset_cache_size | - server_rrset_cache_slabs | server_outgoing_num_tcp | - server_infra_host_ttl | server_infra_lame_ttl | + server_num_queries_per_thread | server_rrset_cache_size | + server_rrset_cache_slabs | server_outgoing_num_tcp | + server_infra_host_ttl | server_infra_lame_ttl | server_infra_cache_slabs | server_infra_cache_numhosts | - server_infra_cache_lame_size | server_target_fetch_policy | + server_infra_cache_lame_size | server_target_fetch_policy | server_harden_short_bufsize | server_harden_large_queries | server_do_not_query_address | server_hide_identity | server_hide_version | server_identity | server_version | @@ -230,22 +234,22 @@ content_server: server_num_threads | server_verbosity | server_port | server_harden_glue | server_module_conf | server_trust_anchor_file | server_trust_anchor | server_val_override_date | server_bogus_ttl | server_val_clean_additional | server_val_permissive_mode | - server_incoming_num_tcp | server_msg_buffer_size | - server_key_cache_size | server_key_cache_slabs | + server_incoming_num_tcp | server_msg_buffer_size | + server_key_cache_size | server_key_cache_slabs | server_trusted_keys_file | server_val_nsec3_keysize_iterations | server_use_syslog | server_outgoing_interface | server_root_hints | server_do_not_query_localhost | server_cache_max_ttl | server_harden_dnssec_stripped | server_access_control | server_local_zone | server_local_data | server_interface_automatic | - server_statistics_interval | server_do_daemonize | + server_statistics_interval | server_do_daemonize | server_use_caps_for_id | server_statistics_cumulative | server_outgoing_port_permit | server_outgoing_port_avoid | server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size | server_harden_referral_path | server_private_address | - server_private_domain | server_extended_statistics | - server_local_data_ptr | server_jostle_timeout | - server_unwanted_reply_threshold | server_log_time_ascii | - server_domain_insecure | server_val_sig_skew_min | + server_private_domain | server_extended_statistics | + server_local_data_ptr | server_jostle_timeout | + server_unwanted_reply_threshold | server_log_time_ascii | + server_domain_insecure | server_val_sig_skew_min | server_val_sig_skew_max | server_val_max_restart | server_cache_min_ttl | server_val_log_level | server_auto_trust_anchor_file | server_add_holddown | @@ -269,9 +273,10 @@ content_server: server_num_threads | server_verbosity | server_port | server_ip_ratelimit_size | server_ratelimit_size | server_ratelimit_for_domain | server_ratelimit_below_domain | server_ratelimit_factor | - server_ip_ratelimit_factor | server_send_client_subnet | - server_client_subnet_zone | server_client_subnet_always_forward | - server_client_subnet_opcode | + server_ip_ratelimit_factor | server_ratelimit_backoff | + server_ip_ratelimit_backoff | server_outbound_msg_retry | + server_send_client_subnet | server_client_subnet_zone | + server_client_subnet_always_forward | server_client_subnet_opcode | server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 | server_min_client_subnet_ipv4 | server_min_client_subnet_ipv6 | server_max_ecs_tree_size_ipv4 | server_max_ecs_tree_size_ipv6 | @@ -312,52 +317,55 @@ content_server: server_num_threads | server_verbosity | server_port | stubstart: VAR_STUB_ZONE { struct config_stub* s; - OUTYY(("\nP(stub_zone:)\n")); + OUTYY(("\nP(stub_zone:)\n")); s = (struct config_stub*)calloc(1, sizeof(struct config_stub)); if(s) { s->next = cfg_parser->cfg->stubs; cfg_parser->cfg->stubs = s; - } else + } else { yyerror("out of memory"); + } } ; -contents_stub: contents_stub content_stub +contents_stub: contents_stub content_stub | ; content_stub: stub_name | stub_host | stub_addr | stub_prime | stub_first | - stub_no_cache | stub_ssl_upstream + stub_no_cache | stub_ssl_upstream | stub_tcp_upstream ; forwardstart: VAR_FORWARD_ZONE { struct config_stub* s; - OUTYY(("\nP(forward_zone:)\n")); + OUTYY(("\nP(forward_zone:)\n")); s = (struct config_stub*)calloc(1, sizeof(struct config_stub)); if(s) { s->next = cfg_parser->cfg->forwards; cfg_parser->cfg->forwards = s; - } else + } else { yyerror("out of memory"); + } } ; -contents_forward: contents_forward content_forward +contents_forward: contents_forward content_forward | ; content_forward: forward_name | forward_host | forward_addr | forward_first | - forward_no_cache | forward_ssl_upstream + forward_no_cache | forward_ssl_upstream | forward_tcp_upstream ; viewstart: VAR_VIEW { struct config_view* s; - OUTYY(("\nP(view:)\n")); + OUTYY(("\nP(view:)\n")); s = (struct config_view*)calloc(1, sizeof(struct config_view)); if(s) { s->next = cfg_parser->cfg->views; if(s->next && !s->next->name) yyerror("view without name"); cfg_parser->cfg->views = s; - } else + } else { yyerror("out of memory"); + } } ; -contents_view: contents_view content_view +contents_view: contents_view content_view | ; content_view: view_name | view_local_zone | view_local_data | view_first | view_response_ip | view_response_ip_data | view_local_data_ptr @@ -365,7 +373,7 @@ content_view: view_name | view_local_zone | view_local_data | view_first | authstart: VAR_AUTH_ZONE { struct config_auth* s; - OUTYY(("\nP(auth_zone:)\n")); + OUTYY(("\nP(auth_zone:)\n")); s = (struct config_auth*)calloc(1, sizeof(struct config_auth)); if(s) { s->next = cfg_parser->cfg->auths; @@ -377,11 +385,12 @@ authstart: VAR_AUTH_ZONE s->zonemd_check = 0; s->zonemd_reject_absence = 0; s->isrpz = 0; - } else + } else { yyerror("out of memory"); + } } ; -contents_auth: contents_auth content_auth +contents_auth: contents_auth content_auth | ; content_auth: auth_name | auth_zonefile | auth_master | auth_url | auth_for_downstream | auth_for_upstream | auth_fallback_enabled | @@ -449,6 +458,15 @@ rpz_log_name: VAR_RPZ_LOG_NAME STRING_ARG cfg_parser->cfg->auths->rpz_log_name = $2; } ; +rpz_signal_nxdomain_ra: VAR_RPZ_SIGNAL_NXDOMAIN_RA STRING_ARG + { + OUTYY(("P(rpz_signal_nxdomain_ra:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->auths->rpz_signal_nxdomain_ra = (strcmp($2, "yes")==0); + free($2); + } + ; rpzstart: VAR_RPZ { @@ -463,37 +481,38 @@ rpzstart: VAR_RPZ s->for_upstream = 0; s->fallback_enabled = 0; s->isrpz = 1; - } else + } else { yyerror("out of memory"); + } } ; contents_rpz: contents_rpz content_rpz | ; content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url | auth_allow_notify | rpz_action_override | rpz_cname_override | - rpz_log | rpz_log_name + rpz_log | rpz_log_name | rpz_signal_nxdomain_ra | auth_for_downstream ; -server_num_threads: VAR_NUM_THREADS STRING_ARG - { - OUTYY(("P(server_num_threads:%s)\n", $2)); +server_num_threads: VAR_NUM_THREADS STRING_ARG + { + OUTYY(("P(server_num_threads:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->num_threads = atoi($2); free($2); } ; -server_verbosity: VAR_VERBOSITY STRING_ARG - { - OUTYY(("P(server_verbosity:%s)\n", $2)); +server_verbosity: VAR_VERBOSITY STRING_ARG + { + OUTYY(("P(server_verbosity:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->verbosity = atoi($2); free($2); } ; -server_statistics_interval: VAR_STATISTICS_INTERVAL STRING_ARG - { - OUTYY(("P(server_statistics_interval:%s)\n", $2)); +server_statistics_interval: VAR_STATISTICS_INTERVAL STRING_ARG + { + OUTYY(("P(server_statistics_interval:%s)\n", $2)); if(strcmp($2, "") == 0 || strcmp($2, "0") == 0) cfg_parser->cfg->stat_interval = 0; else if(atoi($2) == 0) @@ -529,9 +548,9 @@ server_shm_enable: VAR_SHM_ENABLE STRING_ARG free($2); } ; -server_shm_key: VAR_SHM_KEY STRING_ARG - { - OUTYY(("P(server_shm_key:%s)\n", $2)); +server_shm_key: VAR_SHM_KEY STRING_ARG + { + OUTYY(("P(server_shm_key:%s)\n", $2)); if(strcmp($2, "") == 0 || strcmp($2, "0") == 0) cfg_parser->cfg->shm_key = 0; else if(atoi($2) == 0) @@ -704,7 +723,7 @@ server_interface: VAR_INTERFACE STRING_ARG OUTYY(("P(server_interface:%s)\n", $2)); if(cfg_parser->cfg->num_ifs == 0) cfg_parser->cfg->ifs = calloc(1, sizeof(char*)); - else cfg_parser->cfg->ifs = realloc(cfg_parser->cfg->ifs, + else cfg_parser->cfg->ifs = realloc(cfg_parser->cfg->ifs, (cfg_parser->cfg->num_ifs+1)*sizeof(char*)); if(!cfg_parser->cfg->ifs) yyerror("out of memory"); @@ -717,8 +736,8 @@ server_outgoing_interface: VAR_OUTGOING_INTERFACE STRING_ARG OUTYY(("P(server_outgoing_interface:%s)\n", $2)); if(cfg_parser->cfg->num_out_ifs == 0) cfg_parser->cfg->out_ifs = calloc(1, sizeof(char*)); - else cfg_parser->cfg->out_ifs = realloc( - cfg_parser->cfg->out_ifs, + else cfg_parser->cfg->out_ifs = realloc( + cfg_parser->cfg->out_ifs, (cfg_parser->cfg->num_out_ifs+1)*sizeof(char*)); if(!cfg_parser->cfg->out_ifs) yyerror("out of memory"); @@ -739,7 +758,7 @@ server_outgoing_range: VAR_OUTGOING_RANGE STRING_ARG server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING_ARG { OUTYY(("P(server_outgoing_port_permit:%s)\n", $2)); - if(!cfg_mark_ports($2, 1, + if(!cfg_mark_ports($2, 1, cfg_parser->cfg->outgoing_avail_ports, 65536)) yyerror("port number or range (\"low-high\") expected"); free($2); @@ -748,7 +767,7 @@ server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING_ARG server_outgoing_port_avoid: VAR_OUTGOING_PORT_AVOID STRING_ARG { OUTYY(("P(server_outgoing_port_avoid:%s)\n", $2)); - if(!cfg_mark_ports($2, 0, + if(!cfg_mark_ports($2, 0, cfg_parser->cfg->outgoing_avail_ports, 65536)) yyerror("port number or range (\"low-high\") expected"); free($2); @@ -838,10 +857,10 @@ server_prefer_ip6: VAR_PREFER_IP6 STRING_ARG server_tcp_mss: VAR_TCP_MSS STRING_ARG { OUTYY(("P(server_tcp_mss:%s)\n", $2)); - if(atoi($2) == 0 && strcmp($2, "0") != 0) - yyerror("number expected"); - else cfg_parser->cfg->tcp_mss = atoi($2); - free($2); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->tcp_mss = atoi($2); + free($2); } ; server_outgoing_tcp_mss: VAR_OUTGOING_TCP_MSS STRING_ARG @@ -1141,23 +1160,23 @@ server_log_queries: VAR_LOG_QUERIES STRING_ARG } ; server_log_replies: VAR_LOG_REPLIES STRING_ARG - { - OUTYY(("P(server_log_replies:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->log_replies = (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_log_replies:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->log_replies = (strcmp($2, "yes")==0); + free($2); + } + ; server_log_tag_queryreply: VAR_LOG_TAG_QUERYREPLY STRING_ARG - { - OUTYY(("P(server_log_tag_queryreply:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->log_tag_queryreply = (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_log_tag_queryreply:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->log_tag_queryreply = (strcmp($2, "yes")==0); + free($2); + } + ; server_log_servfail: VAR_LOG_SERVFAIL STRING_ARG { OUTYY(("P(server_log_servfail:%s)\n", $2)); @@ -1168,14 +1187,14 @@ server_log_servfail: VAR_LOG_SERVFAIL STRING_ARG } ; server_log_local_actions: VAR_LOG_LOCAL_ACTIONS STRING_ARG - { - OUTYY(("P(server_log_local_actions:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->log_local_actions = (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_log_local_actions:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->log_local_actions = (strcmp($2, "yes")==0); + free($2); + } + ; server_chroot: VAR_CHROOT STRING_ARG { OUTYY(("P(server_chroot:%s)\n", $2)); @@ -1209,7 +1228,7 @@ server_directory: VAR_DIRECTORY STRING_ARG cfg_parser->chroot)) == 0) d += strlen(cfg_parser->chroot); if(d[0]) { - if(chdir(d)) + if(chdir(d)) log_err("cannot chdir to directory: %s (%s)", d, strerror(errno)); } @@ -1402,35 +1421,35 @@ server_so_sndbuf: VAR_SO_SNDBUF STRING_ARG } ; server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG - { - OUTYY(("P(server_so_reuseport:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->so_reuseport = - (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_so_reuseport:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->so_reuseport = + (strcmp($2, "yes")==0); + free($2); + } + ; server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG - { - OUTYY(("P(server_ip_transparent:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->ip_transparent = - (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_ip_transparent:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->ip_transparent = + (strcmp($2, "yes")==0); + free($2); + } + ; server_ip_freebind: VAR_IP_FREEBIND STRING_ARG - { - OUTYY(("P(server_ip_freebind:%s)\n", $2)); - if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) - yyerror("expected yes or no."); - else cfg_parser->cfg->ip_freebind = - (strcmp($2, "yes")==0); - free($2); - } - ; + { + OUTYY(("P(server_ip_freebind:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->ip_freebind = + (strcmp($2, "yes")==0); + free($2); + } + ; server_ip_dscp: VAR_IP_DSCP STRING_ARG { OUTYY(("P(server_ip_dscp:%s)\n", $2)); @@ -1488,9 +1507,9 @@ server_msg_cache_size: VAR_MSG_CACHE_SIZE STRING_ARG server_msg_cache_slabs: VAR_MSG_CACHE_SLABS STRING_ARG { OUTYY(("P(server_msg_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) + if(atoi($2) == 0) { yyerror("number expected"); - else { + } else { cfg_parser->cfg->msg_cache_slabs = atoi($2); if(!is_pow2(cfg_parser->cfg->msg_cache_slabs)) yyerror("must be a power of 2"); @@ -1539,7 +1558,7 @@ server_unblock_lan_zones: VAR_UNBLOCK_LAN_ZONES STRING_ARG OUTYY(("P(server_unblock_lan_zones:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->unblock_lan_zones = + else cfg_parser->cfg->unblock_lan_zones = (strcmp($2, "yes")==0); free($2); } @@ -1549,7 +1568,7 @@ server_insecure_lan_zones: VAR_INSECURE_LAN_ZONES STRING_ARG OUTYY(("P(server_insecure_lan_zones:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->insecure_lan_zones = + else cfg_parser->cfg->insecure_lan_zones = (strcmp($2, "yes")==0); free($2); } @@ -1565,9 +1584,9 @@ server_rrset_cache_size: VAR_RRSET_CACHE_SIZE STRING_ARG server_rrset_cache_slabs: VAR_RRSET_CACHE_SLABS STRING_ARG { OUTYY(("P(server_rrset_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) + if(atoi($2) == 0) { yyerror("number expected"); - else { + } else { cfg_parser->cfg->rrset_cache_slabs = atoi($2); if(!is_pow2(cfg_parser->cfg->rrset_cache_slabs)) yyerror("must be a power of 2"); @@ -1612,9 +1631,9 @@ server_infra_cache_lame_size: VAR_INFRA_CACHE_LAME_SIZE STRING_ARG server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG { OUTYY(("P(server_infra_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) + if(atoi($2) == 0) { yyerror("number expected"); - else { + } else { cfg_parser->cfg->infra_cache_slabs = atoi($2); if(!is_pow2(cfg_parser->cfg->infra_cache_slabs)) yyerror("must be a power of 2"); @@ -1653,7 +1672,7 @@ server_harden_short_bufsize: VAR_HARDEN_SHORT_BUFSIZE STRING_ARG OUTYY(("P(server_harden_short_bufsize:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_short_bufsize = + else cfg_parser->cfg->harden_short_bufsize = (strcmp($2, "yes")==0); free($2); } @@ -1663,7 +1682,7 @@ server_harden_large_queries: VAR_HARDEN_LARGE_QUERIES STRING_ARG OUTYY(("P(server_harden_large_queries:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_large_queries = + else cfg_parser->cfg->harden_large_queries = (strcmp($2, "yes")==0); free($2); } @@ -1673,7 +1692,7 @@ server_harden_glue: VAR_HARDEN_GLUE STRING_ARG OUTYY(("P(server_harden_glue:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_glue = + else cfg_parser->cfg->harden_glue = (strcmp($2, "yes")==0); free($2); } @@ -1683,7 +1702,7 @@ server_harden_dnssec_stripped: VAR_HARDEN_DNSSEC_STRIPPED STRING_ARG OUTYY(("P(server_harden_dnssec_stripped:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_dnssec_stripped = + else cfg_parser->cfg->harden_dnssec_stripped = (strcmp($2, "yes")==0); free($2); } @@ -1693,7 +1712,7 @@ server_harden_below_nxdomain: VAR_HARDEN_BELOW_NXDOMAIN STRING_ARG OUTYY(("P(server_harden_below_nxdomain:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_below_nxdomain = + else cfg_parser->cfg->harden_below_nxdomain = (strcmp($2, "yes")==0); free($2); } @@ -1703,7 +1722,7 @@ server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG OUTYY(("P(server_harden_referral_path:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_referral_path = + else cfg_parser->cfg->harden_referral_path = (strcmp($2, "yes")==0); free($2); } @@ -1713,7 +1732,7 @@ server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->harden_algo_downgrade = + else cfg_parser->cfg->harden_algo_downgrade = (strcmp($2, "yes")==0); free($2); } @@ -1723,7 +1742,7 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG OUTYY(("P(server_use_caps_for_id:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->use_caps_bits_for_id = + else cfg_parser->cfg->use_caps_bits_for_id = (strcmp($2, "yes")==0); free($2); } @@ -1797,7 +1816,7 @@ server_do_not_query_localhost: VAR_DO_NOT_QUERY_LOCALHOST STRING_ARG OUTYY(("P(server_do_not_query_localhost:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->donotquery_localhost = + else cfg_parser->cfg->donotquery_localhost = (strcmp($2, "yes")==0); free($2); } @@ -1808,8 +1827,8 @@ server_access_control: VAR_ACCESS_CONTROL STRING_ARG STRING_ARG if(strcmp($3, "deny")!=0 && strcmp($3, "refuse")!=0 && strcmp($3, "deny_non_local")!=0 && strcmp($3, "refuse_non_local")!=0 && - strcmp($3, "allow_setrd")!=0 && - strcmp($3, "allow")!=0 && + strcmp($3, "allow_setrd")!=0 && + strcmp($3, "allow")!=0 && strcmp($3, "allow_snoop")!=0) { yyerror("expected deny, refuse, deny_non_local, " "refuse_non_local, allow, allow_setrd or " @@ -1835,7 +1854,7 @@ server_val_override_date: VAR_VAL_OVERRIDE_DATE STRING_ARG if(*$2 == '\0' || strcmp($2, "0") == 0) { cfg_parser->cfg->val_date_override = 0; } else if(strlen($2) == 14) { - cfg_parser->cfg->val_date_override = + cfg_parser->cfg->val_date_override = cfg_convert_timeval($2); if(!cfg_parser->cfg->val_date_override) yyerror("bad date/time specification"); @@ -1927,7 +1946,7 @@ server_val_clean_additional: VAR_VAL_CLEAN_ADDITIONAL STRING_ARG OUTYY(("P(server_val_clean_additional:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->val_clean_additional = + else cfg_parser->cfg->val_clean_additional = (strcmp($2, "yes")==0); free($2); } @@ -1937,7 +1956,7 @@ server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG OUTYY(("P(server_val_permissive_mode:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->val_permissive_mode = + else cfg_parser->cfg->val_permissive_mode = (strcmp($2, "yes")==0); free($2); } @@ -2114,9 +2133,9 @@ server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG server_key_cache_slabs: VAR_KEY_CACHE_SLABS STRING_ARG { OUTYY(("P(server_key_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) + if(atoi($2) == 0) { yyerror("number expected"); - else { + } else { cfg_parser->cfg->key_cache_slabs = atoi($2); if(!is_pow2(cfg_parser->cfg->key_cache_slabs)) yyerror("must be a power of 2"); @@ -2171,7 +2190,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG free($3); #endif } else { - if(!cfg_str2list_insert(&cfg_parser->cfg->local_zones, + if(!cfg_str2list_insert(&cfg_parser->cfg->local_zones, $2, $3)) fatal_exit("out of memory adding local-zone"); } @@ -2379,19 +2398,18 @@ server_response_ip_tag: VAR_RESPONSE_IP_TAG STRING_ARG STRING_ARG } } ; -server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG - { - OUTYY(("P(server_ip_ratelimit:%s)\n", $2)); +server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG + { + OUTYY(("P(server_ip_ratelimit:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->ip_ratelimit = atoi($2); free($2); } ; - -server_ratelimit: VAR_RATELIMIT STRING_ARG - { - OUTYY(("P(server_ratelimit:%s)\n", $2)); +server_ratelimit: VAR_RATELIMIT STRING_ARG + { + OUTYY(("P(server_ratelimit:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->ratelimit = atoi($2); @@ -2399,13 +2417,13 @@ server_ratelimit: VAR_RATELIMIT STRING_ARG } ; server_ip_ratelimit_size: VAR_IP_RATELIMIT_SIZE STRING_ARG - { - OUTYY(("P(server_ip_ratelimit_size:%s)\n", $2)); - if(!cfg_parse_memsize($2, &cfg_parser->cfg->ip_ratelimit_size)) - yyerror("memory size expected"); - free($2); - } - ; + { + OUTYY(("P(server_ip_ratelimit_size:%s)\n", $2)); + if(!cfg_parse_memsize($2, &cfg_parser->cfg->ip_ratelimit_size)) + yyerror("memory size expected"); + free($2); + } + ; server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG { OUTYY(("P(server_ratelimit_size:%s)\n", $2)); @@ -2415,24 +2433,24 @@ server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG } ; server_ip_ratelimit_slabs: VAR_IP_RATELIMIT_SLABS STRING_ARG - { - OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", $2)); - if(atoi($2) == 0) - yyerror("number expected"); - else { - cfg_parser->cfg->ip_ratelimit_slabs = atoi($2); - if(!is_pow2(cfg_parser->cfg->ip_ratelimit_slabs)) - yyerror("must be a power of 2"); - } - free($2); - } - ; + { + OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", $2)); + if(atoi($2) == 0) { + yyerror("number expected"); + } else { + cfg_parser->cfg->ip_ratelimit_slabs = atoi($2); + if(!is_pow2(cfg_parser->cfg->ip_ratelimit_slabs)) + yyerror("must be a power of 2"); + } + free($2); + } + ; server_ratelimit_slabs: VAR_RATELIMIT_SLABS STRING_ARG { OUTYY(("P(server_ratelimit_slabs:%s)\n", $2)); - if(atoi($2) == 0) + if(atoi($2) == 0) { yyerror("number expected"); - else { + } else { cfg_parser->cfg->ratelimit_slabs = atoi($2); if(!is_pow2(cfg_parser->cfg->ratelimit_slabs)) yyerror("must be a power of 2"); @@ -2470,42 +2488,71 @@ server_ratelimit_below_domain: VAR_RATELIMIT_BELOW_DOMAIN STRING_ARG STRING_ARG } } ; -server_ip_ratelimit_factor: VAR_IP_RATELIMIT_FACTOR STRING_ARG - { - OUTYY(("P(server_ip_ratelimit_factor:%s)\n", $2)); - if(atoi($2) == 0 && strcmp($2, "0") != 0) - yyerror("number expected"); - else cfg_parser->cfg->ip_ratelimit_factor = atoi($2); - free($2); +server_ip_ratelimit_factor: VAR_IP_RATELIMIT_FACTOR STRING_ARG + { + OUTYY(("P(server_ip_ratelimit_factor:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->ip_ratelimit_factor = atoi($2); + free($2); } ; -server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG - { - OUTYY(("P(server_ratelimit_factor:%s)\n", $2)); +server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG + { + OUTYY(("P(server_ratelimit_factor:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->ratelimit_factor = atoi($2); free($2); } ; -server_low_rtt: VAR_LOW_RTT STRING_ARG - { +server_ip_ratelimit_backoff: VAR_IP_RATELIMIT_BACKOFF STRING_ARG + { + OUTYY(("P(server_ip_ratelimit_backoff:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->ip_ratelimit_backoff = + (strcmp($2, "yes")==0); + free($2); + } + ; +server_ratelimit_backoff: VAR_RATELIMIT_BACKOFF STRING_ARG + { + OUTYY(("P(server_ratelimit_backoff:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->ratelimit_backoff = + (strcmp($2, "yes")==0); + free($2); + } + ; +server_outbound_msg_retry: VAR_OUTBOUND_MSG_RETRY STRING_ARG + { + OUTYY(("P(server_outbound_msg_retry:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->outbound_msg_retry = atoi($2); + free($2); + } + ; +server_low_rtt: VAR_LOW_RTT STRING_ARG + { OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n")); free($2); } ; -server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG - { - OUTYY(("P(server_fast_server_num:%s)\n", $2)); +server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG + { + OUTYY(("P(server_fast_server_num:%s)\n", $2)); if(atoi($2) <= 0) yyerror("number expected"); else cfg_parser->cfg->fast_server_num = atoi($2); free($2); } ; -server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG - { - OUTYY(("P(server_fast_server_permil:%s)\n", $2)); +server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG + { + OUTYY(("P(server_fast_server_permil:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->cfg->fast_server_permil = atoi($2); @@ -2517,7 +2564,7 @@ server_qname_minimisation: VAR_QNAME_MINIMISATION STRING_ARG OUTYY(("P(server_qname_minimisation:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->qname_minimisation = + else cfg_parser->cfg->qname_minimisation = (strcmp($2, "yes")==0); free($2); } @@ -2527,7 +2574,7 @@ server_qname_minimisation_strict: VAR_QNAME_MINIMISATION_STRICT STRING_ARG OUTYY(("P(server_qname_minimisation_strict:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->qname_minimisation_strict = + else cfg_parser->cfg->qname_minimisation_strict = (strcmp($2, "yes")==0); free($2); } @@ -2716,17 +2763,27 @@ stub_ssl_upstream: VAR_STUB_SSL_UPSTREAM STRING_ARG OUTYY(("P(stub-ssl-upstream:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->stubs->ssl_upstream = + else cfg_parser->cfg->stubs->ssl_upstream = (strcmp($2, "yes")==0); free($2); } ; +stub_tcp_upstream: VAR_STUB_TCP_UPSTREAM STRING_ARG + { + OUTYY(("P(stub-tcp-upstream:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->stubs->tcp_upstream = + (strcmp($2, "yes")==0); + free($2); + } + ; stub_prime: VAR_STUB_PRIME STRING_ARG { OUTYY(("P(stub-prime:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->stubs->isprime = + else cfg_parser->cfg->stubs->isprime = (strcmp($2, "yes")==0); free($2); } @@ -2778,11 +2835,21 @@ forward_ssl_upstream: VAR_FORWARD_SSL_UPSTREAM STRING_ARG OUTYY(("P(forward-ssl-upstream:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->forwards->ssl_upstream = + else cfg_parser->cfg->forwards->ssl_upstream = (strcmp($2, "yes")==0); free($2); } ; +forward_tcp_upstream: VAR_FORWARD_TCP_UPSTREAM STRING_ARG + { + OUTYY(("P(forward-tcp-upstream:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->forwards->tcp_upstream = + (strcmp($2, "yes")==0); + free($2); + } + ; auth_name: VAR_NAME STRING_ARG { OUTYY(("P(name:%s)\n", $2)); @@ -2922,7 +2989,7 @@ view_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG #endif } else { if(!cfg_str2list_insert( - &cfg_parser->cfg->views->local_zones, + &cfg_parser->cfg->views->local_zones, $2, $3)) fatal_exit("out of memory adding local-zone"); } @@ -2979,11 +3046,11 @@ view_first: VAR_VIEW_FIRST STRING_ARG } ; rcstart: VAR_REMOTE_CONTROL - { - OUTYY(("\nP(remote-control:)\n")); + { + OUTYY(("\nP(remote-control:)\n")); } ; -contents_rc: contents_rc content_rc +contents_rc: contents_rc content_rc | ; content_rc: rc_control_enable | rc_control_interface | rc_control_port | rc_server_key_file | rc_server_cert_file | rc_control_key_file | @@ -2994,7 +3061,7 @@ rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG OUTYY(("P(control_enable:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->remote_control_enable = + else cfg_parser->cfg->remote_control_enable = (strcmp($2, "yes")==0); free($2); } @@ -3233,8 +3300,8 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES } ; pythonstart: VAR_PYTHON - { - OUTYY(("\nP(python:)\n")); + { + OUTYY(("\nP(python:)\n")); } ; contents_py: contents_py content_py @@ -3365,44 +3432,44 @@ dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG ; dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG { - OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2)); - if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size)) - yyerror("memory size expected"); - free($2); + OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2)); + if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size)) + yyerror("memory size expected"); + free($2); } ; dnsc_dnscrypt_shared_secret_cache_slabs: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS STRING_ARG { - OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) - yyerror("number expected"); - else { - cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2); - if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs)) - yyerror("must be a power of 2"); - } - free($2); + OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2)); + if(atoi($2) == 0) { + yyerror("number expected"); + } else { + cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2); + if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs)) + yyerror("must be a power of 2"); + } + free($2); } ; dnsc_dnscrypt_nonce_cache_size: VAR_DNSCRYPT_NONCE_CACHE_SIZE STRING_ARG { - OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", $2)); - if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_nonce_cache_size)) - yyerror("memory size expected"); - free($2); + OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", $2)); + if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_nonce_cache_size)) + yyerror("memory size expected"); + free($2); } ; dnsc_dnscrypt_nonce_cache_slabs: VAR_DNSCRYPT_NONCE_CACHE_SLABS STRING_ARG { - OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", $2)); - if(atoi($2) == 0) - yyerror("number expected"); - else { - cfg_parser->cfg->dnscrypt_nonce_cache_slabs = atoi($2); - if(!is_pow2(cfg_parser->cfg->dnscrypt_nonce_cache_slabs)) - yyerror("must be a power of 2"); - } - free($2); + OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", $2)); + if(atoi($2) == 0) { + yyerror("number expected"); + } else { + cfg_parser->cfg->dnscrypt_nonce_cache_slabs = atoi($2); + if(!is_pow2(cfg_parser->cfg->dnscrypt_nonce_cache_slabs)) + yyerror("must be a power of 2"); + } + free($2); } ; cachedbstart: VAR_CACHEDB diff --git a/sbin/unwind/libunbound/util/data/msgencode.c b/sbin/unwind/libunbound/util/data/msgencode.c index 5f297b551bf..fe21cfb86bd 100644 --- a/sbin/unwind/libunbound/util/data/msgencode.c +++ b/sbin/unwind/libunbound/util/data/msgencode.c @@ -796,7 +796,10 @@ calc_edns_field_size(struct edns_data* edns) struct edns_option* opt; if(!edns || !edns->edns_present) return 0; - for(opt = edns->opt_list; opt; opt = opt->next) { + for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { + rdatalen += 4 + opt->opt_len; + } + for(opt = edns->opt_list_out; opt; opt = opt->next) { rdatalen += 4 + opt->opt_len; } /* domain root '.' + type + class + ttl + rdatalen */ @@ -827,7 +830,17 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns, rdatapos = sldns_buffer_position(pkt); sldns_buffer_write_u16(pkt, 0); /* rdatalen */ /* write rdata */ - for(opt=edns->opt_list; opt; opt=opt->next) { + for(opt=edns->opt_list_inplace_cb_out; opt; opt=opt->next) { + if (opt->opt_code == LDNS_EDNS_PADDING) { + padding_option = opt; + continue; + } + sldns_buffer_write_u16(pkt, opt->opt_code); + sldns_buffer_write_u16(pkt, opt->opt_len); + if(opt->opt_len != 0) + sldns_buffer_write(pkt, opt->opt_data, opt->opt_len); + } + for(opt=edns->opt_list_out; opt; opt=opt->next) { if (opt->opt_code == LDNS_EDNS_PADDING) { padding_option = opt; continue; @@ -860,8 +873,7 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns, sldns_buffer_skip(pkt, pad_sz); } } - if(edns->opt_list) - sldns_buffer_write_u16_at(pkt, rdatapos, + sldns_buffer_write_u16_at(pkt, rdatapos, sldns_buffer_position(pkt)-rdatapos-2); sldns_buffer_flip(pkt); } diff --git a/sbin/unwind/libunbound/util/data/msgparse.c b/sbin/unwind/libunbound/util/data/msgparse.c index 6ee5559db07..a600a8c6015 100644 --- a/sbin/unwind/libunbound/util/data/msgparse.c +++ b/sbin/unwind/libunbound/util/data/msgparse.c @@ -37,10 +37,12 @@ * Routines for message parsing a packet buffer to a descriptive structure. */ #include "config.h" +#include "util/config_file.h" #include "util/data/msgparse.h" #include "util/data/msgreply.h" #include "util/data/dname.h" #include "util/data/packed_rrset.h" +#include "util/netevent.h" #include "util/storage/lookup3.h" #include "util/regional.h" #include "sldns/rrdef.h" @@ -938,11 +940,40 @@ parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) return 0; } +static int +edns_opt_list_append_keepalive(struct edns_option** list, int msec, + struct regional* region) +{ + uint8_t data[2]; /* For keepalive value */ + data[0] = (uint8_t)((msec >> 8) & 0xff); + data[1] = (uint8_t)(msec & 0xff); + return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data), + data, region); +} + /** parse EDNS options from EDNS wireformat rdata */ static int -parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len, - struct edns_data* edns, struct regional* region) +parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, + struct edns_data* edns, struct config_file* cfg, struct comm_point* c, + struct regional* region) { + /* To respond with a Keepalive option, the client connection must have + * received one message with a TCP Keepalive EDNS option, and that + * option must have 0 length data. Subsequent messages sent on that + * connection will have a TCP Keepalive option. + * + * In the if-statement below, the option is added unsolicited. This + * means that the client has sent an KEEPALIVE option earlier. We know + * here this is true, because c->tcp_keepalive is set. + */ + if (cfg && cfg->do_tcp_keepalive && c && c->type != comm_udp && c->tcp_keepalive) { + if(!edns_opt_list_append_keepalive(&edns->opt_list_out, + c->tcp_timeout_msec / 100, region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + } + /* while still more options, and have code+len to read */ /* ignores partial content (i.e. rdata len 3) */ while(rdata_len >= 4) { @@ -952,20 +983,81 @@ parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len, rdata_len -= 4; if(opt_len > rdata_len) break; /* option code partial */ - if(!edns_opt_append(edns, region, opt_code, opt_len, - rdata_ptr)) { + + /* handle parse time edns options here */ + switch(opt_code) { + case LDNS_EDNS_NSID: + if (!cfg || !cfg->nsid) + break; + if(!edns_opt_list_append(&edns->opt_list_out, + LDNS_EDNS_NSID, cfg->nsid_len, + cfg->nsid, region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + break; + + case LDNS_EDNS_KEEPALIVE: + /* To respond with a Keepalive option, the client + * connection must have received one message with a TCP + * Keepalive EDNS option, and that option must have 0 + * length data. Subsequent messages sent on that + * connection will have a TCP Keepalive option. + * + * This should be the first time the client sends this + * option, so c->tcp_keepalive is not set. + * Besides adding the reply KEEPALIVE option, + * c->tcp_keepalive will be set so that the + * option will be added unsolicited in subsequent + * responses (see the comment above the if-statement + * at the start of this function). + */ + if (!cfg || !cfg->do_tcp_keepalive || !c || + c->type == comm_udp || c->tcp_keepalive) + break; + if(opt_len) { + verbose(VERB_ALGO, "query with bad edns keepalive."); + return LDNS_RCODE_FORMERR; + } + if(!edns_opt_list_append_keepalive(&edns->opt_list_out, + c->tcp_timeout_msec / 100, + region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + c->tcp_keepalive = 1; + break; + + case LDNS_EDNS_PADDING: + if(!cfg || !cfg->pad_responses || + !c || c->type != comm_tcp ||!c->ssl) + break; + if(!edns_opt_list_append(&edns->opt_list_out, + LDNS_EDNS_PADDING, + 0, NULL, region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + edns->padding_block_size = cfg->pad_responses_block_size; + break; + + default: + break; + } + if(!edns_opt_list_append(&edns->opt_list_in, + opt_code, opt_len, rdata_ptr, region)) { log_err("out of memory"); - return 0; + return LDNS_RCODE_SERVFAIL; } rdata_ptr += opt_len; rdata_len -= opt_len; } - return 1; + return LDNS_RCODE_NOERROR; } int -parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, - struct regional* region) +parse_extract_edns_from_response_msg(struct msg_parse* msg, + struct edns_data* edns, struct regional* region) { struct rrset_parse* rrset = msg->rrset_first; struct rrset_parse* prev = 0; @@ -1019,18 +1111,35 @@ parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, edns->edns_version = found->rr_last->ttl_data[1]; edns->bits = sldns_read_uint16(&found->rr_last->ttl_data[2]); edns->udp_size = ntohs(found->rrset_class); - edns->opt_list = NULL; + edns->opt_list_in = NULL; + edns->opt_list_out = NULL; + edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; /* take the options */ rdata_len = found->rr_first->size-2; rdata_ptr = found->rr_first->ttl_data+6; - if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) - return 0; - /* ignore rrsigs */ + /* while still more options, and have code+len to read */ + /* ignores partial content (i.e. rdata len 3) */ + while(rdata_len >= 4) { + uint16_t opt_code = sldns_read_uint16(rdata_ptr); + uint16_t opt_len = sldns_read_uint16(rdata_ptr+2); + rdata_ptr += 4; + rdata_len -= 4; + if(opt_len > rdata_len) + break; /* option code partial */ - return 0; + if(!edns_opt_list_append(&edns->opt_list_in, + opt_code, opt_len, rdata_ptr, region)) { + log_err("out of memory"); + break; + } + rdata_ptr += opt_len; + rdata_len -= opt_len; + } + /* ignore rrsigs */ + return LDNS_RCODE_NOERROR; } /** skip RR in packet */ @@ -1060,8 +1169,8 @@ skip_pkt_rrs(sldns_buffer* pkt, int num) } int -parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns, - struct regional* region) +parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, + struct config_file* cfg, struct comm_point* c, struct regional* region) { size_t rdata_len; uint8_t* rdata_ptr; @@ -1093,7 +1202,9 @@ parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns, edns->ext_rcode = sldns_buffer_read_u8(pkt); /* ttl used for bits */ edns->edns_version = sldns_buffer_read_u8(pkt); edns->bits = sldns_buffer_read_u16(pkt); - edns->opt_list = NULL; + edns->opt_list_in = NULL; + edns->opt_list_out = NULL; + edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; /* take the options */ @@ -1101,12 +1212,9 @@ parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns, if(sldns_buffer_remaining(pkt) < rdata_len) return LDNS_RCODE_FORMERR; rdata_ptr = sldns_buffer_current(pkt); - if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) - return LDNS_RCODE_SERVFAIL; - /* ignore rrsigs */ - - return 0; + return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg, + c, region); } void diff --git a/sbin/unwind/libunbound/util/data/msgparse.h b/sbin/unwind/libunbound/util/data/msgparse.h index d2fd9c80665..4c0559a739a 100644 --- a/sbin/unwind/libunbound/util/data/msgparse.h +++ b/sbin/unwind/libunbound/util/data/msgparse.h @@ -70,6 +70,8 @@ struct rrset_parse; struct rr_parse; struct regional; struct edns_option; +struct config_file; +struct comm_point; /** number of buckets in parse rrset hash table. Must be power of 2. */ #define PARSE_TABLE_SIZE 32 @@ -225,8 +227,15 @@ struct edns_data { uint16_t bits; /** UDP reassembly size. */ uint16_t udp_size; - /** rdata element list, or NULL if none */ - struct edns_option* opt_list; + /** rdata element list of options of an incoming packet created at + * parse time, or NULL if none */ + struct edns_option* opt_list_in; + /** rdata element list of options to encode for outgoing packets, + * or NULL if none */ + struct edns_option* opt_list_out; + /** rdata element list of outgoing edns options from modules + * or NULL if none */ + struct edns_option* opt_list_inplace_cb_out; /** block size to pad */ uint16_t padding_block_size; }; @@ -281,8 +290,8 @@ int parse_packet(struct sldns_buffer* pkt, struct msg_parse* msg, * @return: 0 on success. or an RCODE on an error. * RCODE formerr if OPT in wrong section, and so on. */ -int parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, - struct regional* region); +int parse_extract_edns_from_response_msg(struct msg_parse* msg, + struct edns_data* edns, struct regional* region); /** * If EDNS data follows a query section, extract it and initialize edns struct. @@ -290,12 +299,14 @@ int parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, * section. At end, right after EDNS data or no movement if failed. * @param edns: the edns data allocated by the caller. Does not have to be * initialised. + * @param cfg: the configuration (with nsid value etc.) + * @param c: commpoint to determine transport (if needed) * @param region: region to alloc results in (edns option contents) * @return: 0 on success, or an RCODE on error. * RCODE formerr if OPT is badly formatted and so on. */ -int parse_edns_from_pkt(struct sldns_buffer* pkt, struct edns_data* edns, - struct regional* region); +int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns, + struct config_file* cfg, struct comm_point* c, struct regional* region); /** * Calculate hash value for rrset in packet. diff --git a/sbin/unwind/libunbound/util/data/msgreply.c b/sbin/unwind/libunbound/util/data/msgreply.c index 00272fd1c64..ec46e472478 100644 --- a/sbin/unwind/libunbound/util/data/msgreply.c +++ b/sbin/unwind/libunbound/util/data/msgreply.c @@ -166,6 +166,32 @@ reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc, return 1; } +struct reply_info * +make_new_reply_info(const struct reply_info* rep, struct regional* region, + size_t an_numrrsets, size_t copy_rrsets) +{ + struct reply_info* new_rep; + size_t i; + + /* create a base struct. we specify 'insecure' security status as + * the modified response won't be DNSSEC-valid. In our faked response + * the authority and additional sections will be empty (except possible + * EDNS0 OPT RR in the additional section appended on sending it out), + * so the total number of RRsets is an_numrrsets. */ + new_rep = construct_reply_info_base(region, rep->flags, + rep->qdcount, rep->ttl, rep->prefetch_ttl, + rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets, + sec_status_insecure); + if(!new_rep) + return NULL; + if(!reply_info_alloc_rrset_keys(new_rep, NULL, region)) + return NULL; + for(i=0; irrsets[i] = rep->rrsets[i]; + + return new_rep; +} + /** find the minimumttl in the rdata of SOA record */ static time_t soa_find_minttl(struct rr_parse* rr) @@ -196,13 +222,17 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to, * minimum-ttl in the rdata of the SOA record */ if(*rr_ttl > soa_find_minttl(rr)) *rr_ttl = soa_find_minttl(rr); - if(*rr_ttl > MAX_NEG_TTL) - *rr_ttl = MAX_NEG_TTL; } if(!SERVE_ORIGINAL_TTL && (*rr_ttl < MIN_TTL)) *rr_ttl = MIN_TTL; if(!SERVE_ORIGINAL_TTL && (*rr_ttl > MAX_TTL)) *rr_ttl = MAX_TTL; + if(type == LDNS_RR_TYPE_SOA && section == LDNS_SECTION_AUTHORITY) { + /* max neg ttl overrides the min and max ttl of everything + * else, it is for a more specific record */ + if(*rr_ttl > MAX_NEG_TTL) + *rr_ttl = MAX_NEG_TTL; + } if(*rr_ttl < data->ttl) data->ttl = *rr_ttl; @@ -488,14 +518,13 @@ int reply_info_parse(sldns_buffer* pkt, struct alloc_cache* alloc, if((ret = parse_packet(pkt, msg, region)) != 0) { return ret; } - if((ret = parse_extract_edns(msg, edns, region)) != 0) + if((ret = parse_extract_edns_from_response_msg(msg, edns, region)) != 0) return ret; /* parse OK, allocate return structures */ /* this also performs dname decompression */ if(!parse_create_msg(pkt, msg, alloc, qinf, rep, NULL)) { query_info_clear(qinf); - reply_info_parsedelete(*rep, alloc); *rep = NULL; return LDNS_RCODE_SERVFAIL; } @@ -960,34 +989,6 @@ parse_reply_in_temp_region(sldns_buffer* pkt, struct regional* region, return rep; } -int edns_opt_append(struct edns_data* edns, struct regional* region, - uint16_t code, size_t len, uint8_t* data) -{ - struct edns_option** prevp; - struct edns_option* opt; - - /* allocate new element */ - opt = (struct edns_option*)regional_alloc(region, sizeof(*opt)); - if(!opt) - return 0; - opt->next = NULL; - opt->opt_code = code; - opt->opt_len = len; - opt->opt_data = NULL; - if(len > 0) { - opt->opt_data = regional_alloc_init(region, data, len); - if(!opt->opt_data) - return 0; - } - - /* append at end of list */ - prevp = &edns->opt_list; - while(*prevp != NULL) - prevp = &((*prevp)->next); - *prevp = opt; - return 1; -} - int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len, uint8_t* data, struct regional* region) { @@ -1068,7 +1069,7 @@ static int inplace_cb_reply_call_generic( (void)(*(inplace_cb_reply_func_type*)cb->cb)(qinfo, qstate, rep, rcode, edns, &opt_list_out, repinfo, region, start_time, cb->id, cb->cb_arg); } - edns->opt_list = opt_list_out; + edns->opt_list_inplace_cb_out = opt_list_out; return 1; } diff --git a/sbin/unwind/libunbound/util/data/msgreply.h b/sbin/unwind/libunbound/util/data/msgreply.h index c6b220ed8d7..81c763fc7c3 100644 --- a/sbin/unwind/libunbound/util/data/msgreply.h +++ b/sbin/unwind/libunbound/util/data/msgreply.h @@ -382,6 +382,21 @@ struct reply_info* reply_info_copy(struct reply_info* rep, int reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc, struct regional* region); +/* + * Create a new reply_info based on 'rep'. The new info is based on + * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets' + * RRsets in the answer section. These answer rrsets are copied to the + * new info, up to 'copy_rrsets' rrsets (which must not be larger than + * 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array + * entries will be kept empty so the caller can fill them later. When rrsets + * are copied, they are shallow copied. The caller must ensure that the + * copied rrsets are valid throughout its lifetime and must provide appropriate + * mutex if it can be shared by multiple threads. + */ +struct reply_info * +make_new_reply_info(const struct reply_info* rep, struct regional* region, + size_t an_numrrsets, size_t copy_rrsets); + /** * Copy a parsed rrset into given key, decompressing and allocating rdata. * @param pkt: packet for decompression @@ -503,18 +518,6 @@ void log_reply_info(enum verbosity_value v, struct query_info *qinf, void log_query_info(enum verbosity_value v, const char* str, struct query_info* qinf); -/** - * Append edns option to edns data structure - * @param edns: the edns data structure to append the edns option to. - * @param region: region to allocate the new edns option. - * @param code: the edns option's code. - * @param len: the edns option's length. - * @param data: the edns option's data. - * @return false on failure. - */ -int edns_opt_append(struct edns_data* edns, struct regional* region, - uint16_t code, size_t len, uint8_t* data); - /** * Append edns option to edns option list * @param list: the edns option list to append the edns option to. diff --git a/sbin/unwind/libunbound/util/data/packed_rrset.h b/sbin/unwind/libunbound/util/data/packed_rrset.h index ff95c0af0e8..e1feb22bb7f 100644 --- a/sbin/unwind/libunbound/util/data/packed_rrset.h +++ b/sbin/unwind/libunbound/util/data/packed_rrset.h @@ -61,6 +61,13 @@ typedef uint64_t rrset_id_type; * updated on encoding in a reply. This flag is not expected to be set in * cached data. */ #define PACKED_RRSET_FIXEDTTL 0x80000000 +/** This rrset is from RPZ. It is not real, it is synthesized data to block + * access. The flag makes lookups, from cache in iterator, ignore the fake + * items and only use actual data. Eg. when the iterator looksup NS, CNAME, + * A and AAAA types, it then gets items without this flag that are the + * actual network. But messages with these records in it can be stored in + * the cache and retrieved for a reply. */ +#define PACKED_RRSET_RPZ 0x8 /** number of rrs and rrsets for integer overflow protection. More than * this is not really possible (64K packet has much less RRs and RRsets) in @@ -88,6 +95,7 @@ struct packed_rrset_key { * o PACKED_RRSET_PARENT_SIDE * o PACKED_RRSET_SOA_NEG * o PACKED_RRSET_FIXEDTTL (not supposed to be cached) + * o PACKED_RRSET_RPZ */ uint32_t flags; /** the rrset type in network format */ diff --git a/sbin/unwind/libunbound/util/edns.c b/sbin/unwind/libunbound/util/edns.c index 84308449c7f..f55dcb97e75 100644 --- a/sbin/unwind/libunbound/util/edns.c +++ b/sbin/unwind/libunbound/util/edns.c @@ -128,53 +128,3 @@ edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen); } -static int edns_keepalive(struct edns_data* edns_out, struct edns_data* edns_in, - struct comm_point* c, struct regional* region) -{ - if(c->type == comm_udp) - return 1; - - /* To respond with a Keepalive option, the client connection - * must have received one message with a TCP Keepalive EDNS option, - * and that option must have 0 length data. Subsequent messages - * sent on that connection will have a TCP Keepalive option. - */ - if(c->tcp_keepalive || - edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_KEEPALIVE)) { - int keepalive = c->tcp_timeout_msec / 100; - uint8_t data[2]; - data[0] = (uint8_t)((keepalive >> 8) & 0xff); - data[1] = (uint8_t)(keepalive & 0xff); - if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_KEEPALIVE, - sizeof(data), data, region)) - return 0; - c->tcp_keepalive = 1; - } - return 1; -} - -int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in, - struct config_file* cfg, struct comm_point* c, struct regional* region) -{ - if(cfg->do_tcp_keepalive && - !edns_keepalive(edns_out, edns_in, c, region)) - return 0; - - if (cfg->nsid && edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_NSID) - && !edns_opt_list_append(&edns_out->opt_list, - LDNS_EDNS_NSID, cfg->nsid_len, cfg->nsid, region)) - return 0; - - if(!cfg->pad_responses || c->type != comm_tcp || !c->ssl - || !edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_PADDING)) { - ; /* pass */ - } - - else if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_PADDING - , 0, NULL, region)) - return 0; - else - edns_out->padding_block_size = cfg->pad_responses_block_size; - - return 1; -} diff --git a/sbin/unwind/libunbound/util/edns.h b/sbin/unwind/libunbound/util/edns.h index 11742eb5b72..d9ded0b84dc 100644 --- a/sbin/unwind/libunbound/util/edns.h +++ b/sbin/unwind/libunbound/util/edns.h @@ -106,16 +106,4 @@ struct edns_string_addr* edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, socklen_t addrlen); -/** - * Apply common EDNS options. - * - * @param edns_out: initialised edns information with outbound edns. - * @param edns_in: initialised edns information with received edns. - * @param cfg: configuration. - * @param c: comm channel. - * @param region: the region to allocate the edns options in. - */ -int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in, - struct config_file* cfg, struct comm_point* c, struct regional* region); - #endif diff --git a/sbin/unwind/libunbound/util/fptr_wlist.c b/sbin/unwind/libunbound/util/fptr_wlist.c index de6dbd02a37..05a22d402ee 100644 --- a/sbin/unwind/libunbound/util/fptr_wlist.c +++ b/sbin/unwind/libunbound/util/fptr_wlist.c @@ -138,6 +138,7 @@ fptr_whitelist_comm_timer(void (*fptr)(void*)) else if(fptr == &auth_xfer_probe_timer_callback) return 1; else if(fptr == &auth_xfer_transfer_timer_callback) return 1; else if(fptr == &mesh_serve_expired_callback) return 1; + else if(fptr == &serviced_timer_cb) return 1; #ifdef USE_DNSTAP else if(fptr == &mq_wakeup_cb) return 1; #endif @@ -334,9 +335,10 @@ fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr) int fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)( struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, - int nocaps, struct sockaddr_storage* addr, socklen_t addrlen, - uint8_t* zone, size_t zonelen, int ssl_upstream, char* tls_auth_name, - struct module_qstate* q)) + int nocaps, int check_ratelimit, struct sockaddr_storage* addr, + socklen_t addrlen, uint8_t* zone, size_t zonelen, int tcp_upstream, + int ssl_upstream, char* tls_auth_name, struct module_qstate* q, + int* was_ratelimited)) { if(fptr == &worker_send_query) return 1; else if(fptr == &libworker_send_query) return 1; diff --git a/sbin/unwind/libunbound/util/fptr_wlist.h b/sbin/unwind/libunbound/util/fptr_wlist.h index cd331febb07..a0d9867554b 100644 --- a/sbin/unwind/libunbound/util/fptr_wlist.h +++ b/sbin/unwind/libunbound/util/fptr_wlist.h @@ -211,9 +211,10 @@ int fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr); */ int fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)( struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, - int nocaps, struct sockaddr_storage* addr, socklen_t addrlen, - uint8_t* zone, size_t zonelen, int ssl_upstream, char* tls_auth_name, - struct module_qstate* q)); + int nocaps, int check_ratelimit, struct sockaddr_storage* addr, + socklen_t addrlen, uint8_t* zone, size_t zonelen, int tcp_upstream, + int ssl_upstream, char* tls_auth_name, struct module_qstate* q, + int* was_ratelimited)); /** * Check function pointer whitelist for module_env detach_subs callback values. diff --git a/sbin/unwind/libunbound/util/iana_ports.inc b/sbin/unwind/libunbound/util/iana_ports.inc index b93af015da6..c7662dc62fe 100644 --- a/sbin/unwind/libunbound/util/iana_ports.inc +++ b/sbin/unwind/libunbound/util/iana_ports.inc @@ -2499,6 +2499,7 @@ 2870, 2871, 2872, +2873, 2874, 2875, 2876, @@ -3783,6 +3784,7 @@ 4308, 4309, 4310, +4319, 4320, 4321, 4322, @@ -4053,7 +4055,6 @@ 5026, 5027, 5029, -5030, 5031, 5042, 5043, diff --git a/sbin/unwind/libunbound/util/mini_event.c b/sbin/unwind/libunbound/util/mini_event.c index 661d88d2e6f..c05dc668c67 100644 --- a/sbin/unwind/libunbound/util/mini_event.c +++ b/sbin/unwind/libunbound/util/mini_event.c @@ -337,6 +337,15 @@ int event_del(struct event* ev) FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->writes); FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->ready); FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->content); + if(ev->ev_fd == ev->ev_base->maxfd) { + int i = ev->ev_base->maxfd - 1; + for (; i > 3; i--) { + if (NULL != ev->ev_base->fds[i]) { + break; + } + } + ev->ev_base->maxfd = i; + } } ev->added = 0; return 0; diff --git a/sbin/unwind/libunbound/util/module.h b/sbin/unwind/libunbound/util/module.h index 81a31a9cca4..7a548003397 100644 --- a/sbin/unwind/libunbound/util/module.h +++ b/sbin/unwind/libunbound/util/module.h @@ -350,14 +350,18 @@ struct module_env { * EDNS, the answer is likely to be useless for this domain. * @param nocaps: do not use caps_for_id, use the qname as given. * (ignored if caps_for_id is disabled). + * @param check_ratelimit: if set, will check ratelimit before sending out. * @param addr: where to. * @param addrlen: length of addr. * @param zone: delegation point name. * @param zonelen: length of zone name. + * @param tcp_upstream: use TCP for upstream queries. * @param ssl_upstream: use SSL for upstream queries. * @param tls_auth_name: if ssl_upstream, use this name with TLS * authentication. - * @param q: wich query state to reactivate upon return. + * @param q: which query state to reactivate upon return. + * @param was_ratelimited: it will signal back if the query failed to pass the + * ratelimit check. * @return: false on failure (memory or socket related). no query was * sent. Or returns an outbound entry with qsent and qstate set. * This outbound_entry will be used on later module invocations @@ -365,9 +369,10 @@ struct module_env { */ struct outbound_entry* (*send_query)(struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec, int nocaps, + int check_ratelimit, struct sockaddr_storage* addr, socklen_t addrlen, - uint8_t* zone, size_t zonelen, int ssl_upstream, - char* tls_auth_name, struct module_qstate* q); + uint8_t* zone, size_t zonelen, int tcp_upstream, int ssl_upstream, + char* tls_auth_name, struct module_qstate* q, int* was_ratelimited); /** * Detach-subqueries. diff --git a/sbin/unwind/libunbound/util/net_help.c b/sbin/unwind/libunbound/util/net_help.c index f8b60908fa7..8bef5689050 100644 --- a/sbin/unwind/libunbound/util/net_help.c +++ b/sbin/unwind/libunbound/util/net_help.c @@ -44,6 +44,9 @@ #ifdef HAVE_NET_IF_H #include #endif +#ifdef HAVE_NETIOAPI_H +#include +#endif #include "util/net_help.h" #include "util/log.h" #include "util/data/dname.h" @@ -52,6 +55,7 @@ #include "util/config_file.h" #include "sldns/parseutil.h" #include "sldns/wire2str.h" +#include "sldns/str2wire.h" #include #ifdef HAVE_OPENSSL_SSL_H #include @@ -476,6 +480,42 @@ int authextstrtoaddr(char* str, struct sockaddr_storage* addr, return ipstrtoaddr(str, port, addr, addrlen); } +uint8_t* authextstrtodname(char* str, int* port, char** auth_name) +{ + char* s; + uint8_t* dname; + size_t dname_len; + *port = UNBOUND_DNS_PORT; + *auth_name = NULL; + if((s=strchr(str, '@'))) { + char* hash = strchr(s+1, '#'); + if(hash) { + *auth_name = hash+1; + } else { + *auth_name = NULL; + } + *port = atoi(s+1); + if(*port == 0) { + if(!hash && strcmp(s+1,"0")!=0) + return 0; + if(hash && strncmp(s+1,"0#",2)!=0) + return 0; + } + *s = 0; + dname = sldns_str2wire_dname(str, &dname_len); + *s = '@'; + } else if((s=strchr(str, '#'))) { + *port = UNBOUND_DNS_OVER_TLS_PORT; + *auth_name = s+1; + *s = 0; + dname = sldns_str2wire_dname(str, &dname_len); + *s = '#'; + } else { + dname = sldns_str2wire_dname(str, &dname_len); + } + return dname; +} + /** store port number into sockaddr structure */ void sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen, int port) @@ -890,6 +930,12 @@ log_cert(unsigned level, const char* str, void* cert) BIO_write(bio, &nul, (int)sizeof(nul)); len = BIO_get_mem_data(bio, &pp); if(len != 0 && pp) { + /* reduce size of cert printout */ + char* s; + while((s=strstr(pp, " "))!=NULL) + memmove(s, s+1, strlen(s+1)+1); + while((s=strstr(pp, "\t\t"))!=NULL) + memmove(s, s+1, strlen(s+1)+1); verbose(level, "%s: \n%s", str, pp); } BIO_free(bio); @@ -954,9 +1000,12 @@ listen_sslctx_setup(void* ctxt) } #endif #if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA) + /* if we detect system-wide crypto policies, use those */ + if (access( "/etc/crypto-policies/config", F_OK ) != 0 ) { /* if we have sha256, set the cipher list to have no known vulns */ - if(!SSL_CTX_set_cipher_list(ctx, "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256")) - log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list"); + if(!SSL_CTX_set_cipher_list(ctx, "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256")) + log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list"); + } #endif if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) & @@ -1181,6 +1230,7 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert) if((SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION) & SSL_OP_NO_RENEGOTIATION) != SSL_OP_NO_RENEGOTIATION) { log_crypto_err("could not set SSL_OP_NO_RENEGOTIATION"); + SSL_CTX_free(ctx); return 0; } #endif diff --git a/sbin/unwind/libunbound/util/net_help.h b/sbin/unwind/libunbound/util/net_help.h index 79835270c47..4dd39846029 100644 --- a/sbin/unwind/libunbound/util/net_help.h +++ b/sbin/unwind/libunbound/util/net_help.h @@ -210,17 +210,30 @@ int netblockstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr, /** * Convert address string, with "@port" appendix, to sockaddr. * It can also have an "#tls-auth-name" appendix (after the port). - * The returned tls-auth-name string is a pointer into the input string. - * Uses DNS port by default. + * The returned auth_name string is a pointer into the input string. + * Uses DNS port by default; TLS port when a "#tls-auth-name" is configured. * @param str: the string * @param addr: where to store sockaddr. * @param addrlen: length of stored sockaddr is returned. * @param auth_name: returned pointer to tls_auth_name, or NULL if none. * @return 0 on error. */ -int authextstrtoaddr(char* str, struct sockaddr_storage* addr, +int authextstrtoaddr(char* str, struct sockaddr_storage* addr, socklen_t* addrlen, char** auth_name); +/** + * Convert domain string, with "@port" appendix, to dname. + * It can also have an "#tls-auth-name" appendix (after the port). + * The return port is the parsed port. + * Uses DNS port by default; TLS port when a "#tls-auth-name" is configured. + * The returned auth_name string is a pointer into the input string. + * @param str: the string + * @param port: pointer to be assigned the parsed port value. + * @param auth_name: returned pointer to tls_auth_name, or NULL if none. + * @return pointer to the dname. + */ +uint8_t* authextstrtodname(char* str, int* port, char** auth_name); + /** * Store port number into sockaddr structure * @param addr: sockaddr structure, ip4 or ip6. diff --git a/sbin/unwind/libunbound/util/netevent.c b/sbin/unwind/libunbound/util/netevent.c index 11c642a2bc3..b9b7230e41a 100644 --- a/sbin/unwind/libunbound/util/netevent.c +++ b/sbin/unwind/libunbound/util/netevent.c @@ -300,6 +300,7 @@ udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen) case ENETDOWN: # endif case EPERM: + case EACCES: if(verbosity < VERB_ALGO) return 0; default: @@ -817,6 +818,7 @@ setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) #endif c->tcp_is_reading = 1; c->tcp_byte_count = 0; + c->tcp_keepalive = 0; /* if more than half the tcp handlers are in use, use a shorter * timeout for this TCP connection, we need to make space for * other connections to be able to get attention */ @@ -942,7 +944,16 @@ int comm_point_perform_accept(struct comm_point* c, #ifdef USE_WINSOCK static long win_bio_cb(BIO *b, int oper, const char* ATTR_UNUSED(argp), - int ATTR_UNUSED(argi), long argl, long retvalue) +#ifdef HAVE_BIO_SET_CALLBACK_EX + size_t ATTR_UNUSED(len), +#endif + int ATTR_UNUSED(argi), long argl, +#ifndef HAVE_BIO_SET_CALLBACK_EX + long retvalue +#else + int retvalue, size_t* ATTR_UNUSED(processed) +#endif + ) { int wsa_err = WSAGetLastError(); /* store errcode before it is gone */ verbose(VERB_ALGO, "bio_cb %d, %s %s %s", oper, @@ -972,9 +983,17 @@ comm_point_tcp_win_bio_cb(struct comm_point* c, void* thessl) { SSL* ssl = (SSL*)thessl; /* set them both just in case, but usually they are the same BIO */ +#ifdef HAVE_BIO_SET_CALLBACK_EX + BIO_set_callback_ex(SSL_get_rbio(ssl), &win_bio_cb); +#else BIO_set_callback(SSL_get_rbio(ssl), &win_bio_cb); +#endif BIO_set_callback_arg(SSL_get_rbio(ssl), (char*)c->ev->ev); +#ifdef HAVE_BIO_SET_CALLBACK_EX + BIO_set_callback_ex(SSL_get_wbio(ssl), &win_bio_cb); +#else BIO_set_callback(SSL_get_wbio(ssl), &win_bio_cb); +#endif BIO_set_callback_arg(SSL_get_wbio(ssl), (char*)c->ev->ev); } #endif @@ -1036,6 +1055,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg) /* clear leftover flags from previous use, and then set the * correct event base for the event structure for libevent */ ub_event_free(c_hdl->ev->ev); + c_hdl->ev->ev = NULL; if((c_hdl->type == comm_tcp && c_hdl->tcp_req_info) || c_hdl->type == comm_local || c_hdl->type == comm_raw) c_hdl->tcp_do_toggle_rw = 0; @@ -1092,6 +1112,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg) /* grab the tcp handler buffers */ c->cur_tcp_count++; c->tcp_free = c_hdl->tcp_free; + c_hdl->tcp_free = NULL; if(!c->tcp_free) { /* stop accepting incoming queries for now. */ comm_point_stop_listening(c); @@ -1113,9 +1134,11 @@ reclaim_tcp_handler(struct comm_point* c) } comm_point_close(c); if(c->tcp_parent) { - c->tcp_parent->cur_tcp_count--; - c->tcp_free = c->tcp_parent->tcp_free; - c->tcp_parent->tcp_free = c; + if(c != c->tcp_parent->tcp_free) { + c->tcp_parent->cur_tcp_count--; + c->tcp_free = c->tcp_parent->tcp_free; + c->tcp_parent->tcp_free = c; + } if(!c->tcp_free) { /* re-enable listening on accept socket */ comm_point_start_listening(c->tcp_parent, -1, -1); @@ -1123,6 +1146,8 @@ reclaim_tcp_handler(struct comm_point* c) } c->tcp_more_read_again = NULL; c->tcp_more_write_again = NULL; + c->tcp_byte_count = 0; + sldns_buffer_clear(c->buffer); } /** do the callback when writing is done */ @@ -1862,13 +1887,22 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) if(errno == EINTR || errno == EAGAIN) return 1; /* Not handling EISCONN here as shouldn't ever hit that case.*/ - if(errno != EPIPE && errno != 0 && verbosity < 2) - return 0; /* silence lots of chatter in the logs */ - if(errno != EPIPE && errno != 0) { + if(errno != EPIPE +#ifdef EOPNOTSUPP + /* if /proc/sys/net/ipv4/tcp_fastopen is + * disabled on Linux, sendmsg may return + * 'Operation not supported', if so + * fallthrough to ordinary connect. */ + && errno != EOPNOTSUPP +#endif + && errno != 0) { + if(verbosity < 2) + return 0; /* silence lots of chatter in the logs */ log_err_addr("tcp sendmsg", strerror(errno), &c->repinfo.addr, c->repinfo.addrlen); return 0; } + verbose(VERB_ALGO, "tcp sendmsg for fastopen failed (with %s), try normal connect", strerror(errno)); /* fallthrough to nonFASTOPEN * (MSG_FASTOPEN on Linux 3 produces EPIPE) * we need to perform connect() */ @@ -2201,9 +2235,11 @@ reclaim_http_handler(struct comm_point* c) } comm_point_close(c); if(c->tcp_parent) { - c->tcp_parent->cur_tcp_count--; - c->tcp_free = c->tcp_parent->tcp_free; - c->tcp_parent->tcp_free = c; + if(c != c->tcp_parent->tcp_free) { + c->tcp_parent->cur_tcp_count--; + c->tcp_free = c->tcp_parent->tcp_free; + c->tcp_parent->tcp_free = c; + } if(!c->tcp_free) { /* re-enable listening on accept socket */ comm_point_start_listening(c->tcp_parent, -1, -1); @@ -4140,6 +4176,10 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec) c->timeout->tv_sec = msec/1000; c->timeout->tv_usec = (msec%1000)*1000; #endif /* S_SPLINT_S */ + } else { + if(msec == 0 || !c->timeout) { + ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); + } } if(c->type == comm_tcp || c->type == comm_http) { ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); @@ -4164,6 +4204,7 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec) } if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) { log_err("event_add failed. in cpsl."); + return; } c->event_added = 1; } @@ -4177,11 +4218,15 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr) } c->event_added = 0; } + if(!c->timeout) { + ub_event_del_bits(c->ev->ev, UB_EV_TIMEOUT); + } ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE); if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ); if(wr) ub_event_add_bits(c->ev->ev, UB_EV_WRITE); if(ub_event_add(c->ev->ev, c->timeout) != 0) { log_err("event_add failed. in cplf."); + return; } c->event_added = 1; } diff --git a/sbin/unwind/libunbound/util/netevent.h b/sbin/unwind/libunbound/util/netevent.h index c79f99b3eb6..9f4d28ba9f8 100644 --- a/sbin/unwind/libunbound/util/netevent.h +++ b/sbin/unwind/libunbound/util/netevent.h @@ -743,7 +743,7 @@ struct comm_signal* comm_signal_create(struct comm_base* base, void (*callback)(int, void*), void* cb_arg); /** - * Bind signal struct to catch a signal. A signle comm_signal can be bound + * Bind signal struct to catch a signal. A single comm_signal can be bound * to multiple signals, calling comm_signal_bind multiple times. * @param comsig: the communication point, with callback information. * @param sig: signal number. diff --git a/sbin/unwind/libunbound/util/regional.c b/sbin/unwind/libunbound/util/regional.c index bd67ecf50af..93e911c5ec1 100644 --- a/sbin/unwind/libunbound/util/regional.c +++ b/sbin/unwind/libunbound/util/regional.c @@ -103,6 +103,8 @@ regional_create_custom_large_object(size_t size, size_t large_object_size) struct regional* regional_create_custom(size_t size) { + if(size < sizeof(struct regional)) + size = sizeof(struct regional); return regional_create_custom_large_object(size, REGIONAL_LARGE_OBJECT_SIZE); } diff --git a/sbin/unwind/libunbound/util/shm_side/shm_main.c b/sbin/unwind/libunbound/util/shm_side/shm_main.c index 51039abf3ed..6fd1f5ea638 100644 --- a/sbin/unwind/libunbound/util/shm_side/shm_main.c +++ b/sbin/unwind/libunbound/util/shm_side/shm_main.c @@ -281,7 +281,7 @@ void shm_main_run(struct worker *worker) shm_stat->mem.subnet = 0; #ifdef CLIENT_SUBNET shm_stat->mem.subnet = (long long)mod_get_mem(&worker->env, - "subnet"); + "subnetcache"); #endif /* ipsecmod mem value is available in shm, also when not enabled, * to make the struct easier to memmap by other applications, diff --git a/sbin/unwind/libunbound/util/tube.c b/sbin/unwind/libunbound/util/tube.c index dc6e3c2e7f7..40556e72020 100644 --- a/sbin/unwind/libunbound/util/tube.c +++ b/sbin/unwind/libunbound/util/tube.c @@ -363,7 +363,11 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, } d += r; } - log_assert(*len < 65536*2); + if (*len >= 65536*2) { + log_err("tube msg length %u is too big", (unsigned)*len); + (void)fd_set_nonblock(fd); + return 0; + } *buf = (uint8_t*)malloc(*len); if(!*buf) { log_err("tube read out of memory"); diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c index 9643a3ddb38..55e82c176da 100644 --- a/sbin/unwind/libunbound/validator/autotrust.c +++ b/sbin/unwind/libunbound/validator/autotrust.c @@ -2377,7 +2377,9 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp) edns.ext_rcode = 0; edns.edns_version = 0; edns.bits = EDNS_DO; - edns.opt_list = NULL; + edns.opt_list_in = NULL; + edns.opt_list_out = NULL; + edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); diff --git a/sbin/unwind/libunbound/validator/val_utils.c b/sbin/unwind/libunbound/validator/val_utils.c index dd8d320e515..bb366d33940 100644 --- a/sbin/unwind/libunbound/validator/val_utils.c +++ b/sbin/unwind/libunbound/validator/val_utils.c @@ -767,15 +767,15 @@ val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset) sldns_lookup_table *lt; char herr[64], aerr[64]; lt = sldns_lookup_by_id(sldns_hashes, - (int)ds_get_digest_algo(ds_rrset, i)); + (int)ds_get_digest_algo(ds_rrset, 0)); if(lt) snprintf(herr, sizeof(herr), "%s", lt->name); else snprintf(herr, sizeof(herr), "%d", - (int)ds_get_digest_algo(ds_rrset, i)); + (int)ds_get_digest_algo(ds_rrset, 0)); lt = sldns_lookup_by_id(sldns_algorithms, - (int)ds_get_key_algo(ds_rrset, i)); + (int)ds_get_key_algo(ds_rrset, 0)); if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name); else snprintf(aerr, sizeof(aerr), "%d", - (int)ds_get_key_algo(ds_rrset, i)); + (int)ds_get_key_algo(ds_rrset, 0)); verbose(VERB_ALGO, "DS unsupported, hash %s %s, " "key algorithm %s %s", herr, (ds_digest_algo_is_supported(ds_rrset, 0)? diff --git a/sbin/unwind/libunbound/validator/validator.c b/sbin/unwind/libunbound/validator/validator.c index d4d48d95689..e6307284fb0 100644 --- a/sbin/unwind/libunbound/validator/validator.c +++ b/sbin/unwind/libunbound/validator/validator.c @@ -140,7 +140,7 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env, val_env->max_restart = cfg->val_max_restart; c = cfg_count_numbers(cfg->val_nsec3_key_iterations); if(c < 1 || (c&1)) { - log_err("validator: unparseable or odd nsec3 key " + log_err("validator: unparsable or odd nsec3 key " "iterations: %s", cfg->val_nsec3_key_iterations); return 0; } @@ -484,7 +484,7 @@ generate_keytag_query(struct module_qstate* qstate, int id, return 0; } - /* Not interrested in subquery response. Restore the ext_state, + /* Not interested in subquery response. Restore the ext_state, * that might be changed by generate_request() */ qstate->ext_state[id] = ext_state; diff --git a/sbin/unwind/libunbound/validator/validator.h b/sbin/unwind/libunbound/validator/validator.h index a928e10a65d..a97eab25bc4 100644 --- a/sbin/unwind/libunbound/validator/validator.h +++ b/sbin/unwind/libunbound/validator/validator.h @@ -68,7 +68,7 @@ struct config_strlist; #define SENTINEL_IS "root-key-sentinel-is-ta-" /** Root key sentinel is not ta preamble */ #define SENTINEL_NOT "root-key-sentinel-not-ta-" -/** Root key sentinal keytag length */ +/** Root key sentinel keytag length */ #define SENTINEL_KEYTAG_LEN 5 /** -- 2.20.1