diff --git a/contrib/ldns/Changelog b/contrib/ldns/Changelog
index 0bd3658e767dc7..aba41c88c5c86b 100644
--- a/contrib/ldns/Changelog
+++ b/contrib/ldns/Changelog
@@ -1,3 +1,166 @@
+1.8.3	2022-08-15
+	* bugfix #183: Assertion failure with OPT record without rdata.
+	  This caused packet creation with only a DO bit (for DNSSEC OK)
+	  to crash. Thanks Anand Buddhdev and others for reporting this
+	  so quickly.
+	* Fix for syntax error in pyldns
+
+1.8.2	2022-08-12
+	* bugfix #147: Allow for tabs in whitespace before quoted rdata
+	  fields. Thanks Felipe Gasper
+	* bugfix #149: Add some missing [out] annotations to doxygen
+	  parameters. Thanks aldot.
+	* Fix build error on Solaris 10 with inet_ntop redeclaration error.
+	* Fix -U flag with ldns-signzone. Thanks Ulrich and Jonathan
+	* Enable compile of SVCB and HTTPS support by default.
+	* bugfix #179: Free line memory even if zone file parsing fails
+	  Thanks Claudius Zingerli
+	* bugfix #166: Grow buffer when writing chars and fixed size
+	  strings when converting to presentation format, preventing
+	  potential assersion errors.
+	* bugfix #46: Print network errors when secure tracing.
+	  Thanks reedjc
+	* EDNS0 Option handling and conversion into presentation format.
+	* bugfix #145: ldns-verify-zone should not call occluded records
+	  glue. Thanks Habbie
+
+1.8.1	2021-12-03
+	* bugfix #146: ldns-1.7.1 had soname 3.0, so ldns-1.8.x soname
+	  needs to larger. Thanks Leah Neukirchen & Felipe Gasper
+	* Undo PR#123 fix ldns.pc installation when building out-of-source
+	  Thanks Axel Xu
+
+1.8.0	2021-11-26
+	* bugfix #38: Print "line" before line number when printing
+	  zone parse errors. Thanks Petr Špaček.
+	* bugfix: Revert unused variables in ldns-config removal patch.
+	* bugfix #50: heap Out-of-bound Read vulnerability in
+	  rr_frm_str_internal reported by pokerfacett.
+	* bugfix #51: Heap Out-of-bound Read vulnerability in
+	  ldns_nsec3_salt_data reported by pokerfacett.
+	* Fix memory leak in examples/ldns-testns handle_tcp routine.
+	* Detect fixed time memory compare for openssl 0.9.8.
+	* Fix compile warning by variable initialisation for older gcc.
+	* Fix #92: ldns-testns.c:429:15: error: 'fork' is unavailable: not
+	  available on tvOS.
+	* Fix for #93: fix packaging/libldns.pc Makefile rule.
+	* ZONEMD support in ldns-signzone and ldns-verify-zone
+	* ldns-testns can answer several queries over one tcp connection,
+	  if they arrive within 100msec of each other.
+	* Fix so that ldns-testns does not leak sockets if the read fails.
+	* SVCB and HTTPS draft rrtypes.
+	  Enable with --enable-rrtype-svcb-https.
+	* bugfix #117: Assertion failure with DNSSEC validating of 
+	  non existence of RR types at the root.  Thanks ZjYwMj
+	* Set NSEC(3) ttls to the minimum of the MINIMUM field of the SOA
+	  record and the TTL of the SOA itself. draft-ietf-dnsop-nsec-ttl
+	* bugfix #119: Let example tools read longer RR's than
+	  LDNS_MAX_LINELEN
+	* Add SVCPARAMS to python ldns_rdf_type2str function.
+	* PR #134 Miscellaneous spelling fixes. Thanks jsoref!
+	* Fix that ldns-read-zone and ldns_zone_new_frm_fp_l properly return
+	  the $INCLUDE not implemented error.
+	* Fix that ldns-read-zone and ldns_zone_new_frm_fp_l count the line
+	  number for an empty line after a comment.
+	* Fix #135: Fix compile with OpenSSL-3.0.0-beta2.
+	* PR #107: Added ldns_pkt2buffer_wire_compress() to make dname 
+	  compression optional when converting packets to wire format.
+	  Thanks Eli Lindsey
+	* Option to ldns-keygen to create symlinks with known names 
+	  (i.e. without the key id) to the created files.
+	  Thanks Andreas Schulze
+	* Fix #121: Correct handling of centimetres by LOC parser.
+	  Thanks Felipe Gasper
+	* PR #126: Link with libldns.la in Makefile.in.
+	  Thanks orbea
+	* PR #127: Added option -Q to drill to give short answer.
+	  Thanks niknah
+	* PR #133: Update m4 files for python modules.
+	  Thanks Petr Menšík
+	* Bufix CAA value fields may be empty: Thanks Robert Mortimer
+	* PR #108: Fix for ldns-compare-zones net detecting when first zone
+	  has a RRset that shrinks from two to one RRs, or grows from one
+	  to two RRs. Thanks Emilio Caballero
+	* Fix #131: Drill sig chasing breaks with gcc-11 and
+	  strict-aliasing. Thanks Stanislav Levin
+	* Fix #130: Unless $TLL is defined, ttl defaults to the last
+	  explicitly stated value. Thanks Benno
+	* Fix #48: Missing UNSIGNED legend with drill. Thanks reedjc
+	* Fix #143: EVP_PKEY_base_id became a macro with OpenSSL > 3.0
+	  Thanks Daniel J. Luke
+	* Let ldns-signzone warn for high NSEC3 iteration counts.
+	  Thanks Andreas Schulze
+
+1.7.1	2019-07-26
+	* bugfix: Manage verification paths for OpenSSL >= 1.1.0
+	  Thanks Marco Davids
+	* bugfix #4106: find the SDK on MacOS X <= 10.6
+	  Thanks Bill Cole
+	* bugfix #4155: ldns-config contains never used variables
+	  Thanks Petr Menšík
+	* bugfix #4221: drill -x crashes with malformed IPv4 address 
+	  Thanks Oleksandr Tymoshenko
+	* bugfix #3437: CDS & CDNSKEY RRsets should be signed with the KSK
+	  Thanks Tony Finch
+	* bugfix #1566, #1568, #1569, #1570: Potential NULL Dereferences
+	  Thanks Bill Parker
+	* bugfix #1260: Anticipate strchr returning NULL on unfound char
+	  Thanks Stephan Zeisberg
+	* bugfix #1257: Free after reallocing to 0 size (CVE-2017-1000232)
+	  Thanks Stephan Zeisberg
+	* bugfix #1256: Check parse limit before t increment (CVE-2017-1000231)
+	  Thanks Stephan Zeisberg
+	* bugfix #1245: Only one signature per RRset needs to be valid with
+	  ldns-verify-zone.  Thanks Emil Natan.
+	* ldns-notify can use all supported hash algorithms with -y.
+	* bugfix #1209: make install ldns.pc file
+	  Thanks Oleksandr Natalenko
+	* bugfix #1218: Only chase DS if signer is parent of owner.
+	  Thanks Emil Natan
+	* bugfix #617: Retry WKS service and protocol names lower case.
+	  Thanks Siali Yan
+	* Spelling errors in binaries and man pages
+	  Thanks Andreas Schulze
+	* removed duplicate condition in ldns_udp_send_query.
+	* ldns_wire2pkt: fix null pointer dereference if pkt allocation fails
+	  and fix memory leak with more EDNS sections
+	  Thanks Jan Vcelak
+	* bugfix #1399: ldns_pkt2wire() Python binding is broken.
+	  Thanks James Raftery
+	* ED25519 and ED448 support. Default is to autodetect support in
+	  OpenSSL.  Disable with --disable-ed25519 and --disable-ed448.
+	* ldns-notify: can have IPv6 address as argument.
+	* Fix time sensitive TSIG compare vulnerability.
+	* Fix that ldns-testns ignores sigpipe.
+	* Fix that ldns-notify sets the query RR as question RR, this
+	  removes the wrong TTL and 0 rdata from the packet printout.
+	* Allow -T flag to be used together with drill -x
+	* Python bindings compile with swig 4.0
+	  Thanks Jitka Plesníková
+	* bugfix #4248: drill -DT fails for CNAME domain
+	  Thanks Thom Wiggers
+	* bugfix #4214: Various fixes and leaks found by coverity.
+	  Thanks Petr Menšík 
+	* Feature #3394: An -I option to ldns-notify to specify a source
+	  IP address to send to notify from.  Thanks Geert Hendrickx
+	* Bugfix #279: New API functions ldns_udp_connect2,
+	  ldns_tcp_connect2, ldns_udp_bgsend2 and ldns_tcp_bgsend2,
+	  that return -1 on failure and allow socket number 0
+	  to be returned too.  Thanks Joerg Sonnenberger
+	* Bugfix #1447: More verbose reporting of chasing problems with
+	  ldns-verify-zone.  Thanks Stephane Guedon
+	* OpenSSL engine support with ldns-signzone.
+	  See also https://penzin.net/ldns-signzone/
+	  Many thanks Vadim Penzin.
+	* Various improvements found with shellcheck.
+	  Thanks Jeffrey Walton
+	* PR #36 Update manpage of ldns-notify to mention algorithm
+	  support with TSIG.  Thanks Anand Buddhdev
+	* Compile warnings with signed char input to to_lower()
+	  and is_digit() with NetBSD.  Thanks Håvard Eidnes
+	* Missing Makefile.PL in DNS-LDNS perl module contribution.
+	  Thanks Jaap Akkerhuis
+
 1.7.0	2016-12-20
 	* Fix lookup of relative names in ldns_resolver_search.
 	* bugfix #548: Double free for answers > 4096 in ldns_resolver_send_pkt
@@ -98,7 +261,7 @@
 	  Thanks William King
 	* Use OpenSSL DANE functions for verification (unless explicitly
 	  disabled with --disable-dane-ta-usage).
-	* Bumb .so version
+	* Bump .so version
 	* Include OPENPGPKEY RR type by default
 	* rdata processing for SMIMEA RR type
 	* Fix crash in displaying TLSA RR's.
@@ -168,7 +331,7 @@
 	* bugfix #505: Manpage and usage output fixes (Thanks Tomas Hozza)
 	* Adjust ldns_sha1() so that the input data is not modified (Thanks
 	  Marc Buijsman)
-	* Messages to stderr are now off by default and can be reenabled with
+	* Messages to stderr are now off by default and can be re-enabled with
 	  the --enable-stderr-msgs configure option.
 
 1.6.16	2012-11-13
@@ -197,7 +360,7 @@
 	  in sync.
 	* Let ldns_pkt_push_rr now return false on (memory) errors.
 	* Make buffer_export comply to documentation and fix buffer2str
-	* Various improvements and fixes of pyldns from Katel Slany
+	* Various improvements and fixes of pyldns from Karel Slany
 	  now documented in their own Changelog.
 	* bugfix: Make ldns_resolver_pop_nameserver clear the array when
 	  there was only one.
@@ -236,7 +399,7 @@
 	* bugfix #433: Allocate rdf using ldns_rdf_new in ldns_dname_label
 	* bugfix #432: Use LDNS_MALLOC & LDNS_FREE i.s.o. malloc & free
 	* bugfix #431: Added error message for LDNS_STATUS_INVALID_B32_EXT
-	* bugfix #427: Explicitely link ssl with the programs that use it.
+	* bugfix #427: Explicitly link ssl with the programs that use it.
 	* Fix reading \DDD: Error on values that are outside range (>255).
 	* bugfix #429: fix doxyparse.pl fails on NetBSD because specified
 	  path to perl.
@@ -300,7 +463,7 @@
 	* Update of libdns.vim (thanks Miek Gieben)
 	* Added the ldnsx Python module to our contrib section, which adds even
 	  more pythonisticism to the usage of ldns with  Python. (Many thanks
-	  to Christpher Olah and Paul Wouters)
+	  to Christopher Olah and Paul Wouters)
 	  The ldnsx module is automatically installed when --with-pyldns is
 	  used with configuring, but may explicitly be excluded with the
 	  --without-pyldnsx option to configure.
@@ -328,7 +491,7 @@
 	* bugfix #380: Minimizing effect of discrepancies in sizeof(bool) at
 	  build time and when used.
 	* bugfix #383: Fix detection of empty nonterminals of multiple labels.
-	* Fixed the ommission of rrsets in nsec(3)s and rrsigs to all occluded
+	* Fixed the omission of rrsets in nsec(3)s and rrsigs to all occluded
 	  names (in stead of just the ones that contain glue only) and all
 	  occluded records on the delegation points (in stead of just the glue).
 	* Clarify the operation of ldns_dnssec_mark_glue and the usage of
@@ -511,7 +674,7 @@
 	* --enable-gost : use the GOST algorithm (experimental).
 	* Added some missing options to drill manpage
 	* Some fixes to --without-ssl option
-	* Fixed quote parsing withing strings
+	* Fixed quote parsing within strings
 	* Bitmask fix in EDNS handling
 	* Fixed non-fqdn domain name completion for rdata field domain
 	  names of length 1
@@ -618,7 +781,7 @@
 	  from Shane Kerr, bug id 188)
 	* zone.c memory leaks on error and allocation checks fixed (patch
 	from Shane Kerr, bug id 189)
-	* ldns-zplit output and error messages fixed (patch from Shane Kerr,
+	* ldns-zsplit output and error messages fixed (patch from Shane Kerr,
 	  bug id 190)
 	* Fixed potential buffer overflow in ldns_str2rdf_dname
 	* Signing code no longer signs delegation NS rrsets
@@ -647,7 +810,7 @@
 	* DLV RR type added
 	* TCP fallback system has been improved
 	* HMAC-SHA256 TSIG support has been added.
-	* TTLS are now correcly set in NSEC(3) records when signing zones
+	* TTLS are now correctly set in NSEC(3) records when signing zones
 
 	EXAMPLE TOOLS:
 	* New example: ldns-revoke to revoke DNSKEYs according to RFC5011
@@ -722,7 +885,7 @@
 28 Nov 2007 1.2.2:
 	* Added support for HMAC-MD5 keys in generator
 	* Added a new example tool (written by Ondrej Sury): ldns-compare-zones
-	* ldns-keygen now checks key sizes for rfc conformancy
+	* ldns-keygen now checks key sizes for rfc conformance
 	* ldns-signzone outputs SSL error if present
 	* Fixed manpages (thanks to Ondrej Sury)
 	* Fixed Makefile for -j <x>
@@ -800,7 +963,7 @@
 	* -r was killed in favor of -o <header bit mnemonic> which
 	  allows for a header bits setting (and maybe more in the
 	  future)
-	* DNSSEC is never automaticaly set, even when you query
+	* DNSSEC is never automatically set, even when you query
 	  for DNSKEY/RRSIG or DS.
 	* Implement a crude RTT check, it now distinguishes between
 	  reachable and unreachable.
@@ -812,7 +975,7 @@
 	* ldns-dpa was added to the examples - this is the Dns Packet
 	  Analyzer tool.
 	* ldnsd - as very, very simple nameserver impl.
-	* ldns-zsplit - split zones for parrallel signing
+	* ldns-zsplit - split zones for parallel signing
 	* ldns-zcat - cat split zones back together
 	* ldns-keyfetcher - Fetches DNSKEY records with a few (non-strong,
 	  non-DNSSEC) anti-spoofing techniques.
@@ -831,7 +994,7 @@
 	API:
 	Changed:
 	* renamed ldns/dns.h to ldns/ldns.h
-	* ldns_rr_new_frm_str() is extented with an extra variable which
+	* ldns_rr_new_frm_str() is extended with an extra variable which
 	  in common use may be NULL. This trickles through to:
 	  o ldns_rr_new_frm_fp
 	  o ldns_rr_new_frm_fp_l
@@ -872,7 +1035,7 @@
 	* char *_when was removed from the ldns_pkt structure
 
 18 Oct 2005: 1.0.0: ldns-team
-	* Commited a patch from Håkan Olsson
+	* Committed a patch from Håkan Olsson
 	* Added UPDATE support (Jakob Schlyter and Håkan Olsson)
 	* License change: ldns is now BSD licensed
 	* ldns now depends on SSL
@@ -905,7 +1068,7 @@
 13 Jun 2005: 0.65: ldns-team
 	* Repository is online at:
 	  http://www.nlnetlabs.nl/ldns/svn/
-	* Apply reference copying throuhgout ldns, except in 2
+	* Apply reference copying throughout ldns, except in 2
 	  places in the ldns_resolver structure (._domain and
 	 ._nameservers)
 	* Usual array of bugfixes
@@ -914,7 +1077,7 @@
 
 23 May 2005: 0.60: ldns-team
 	* Removed config.h from the header installed files
-	  (you're not supposed to include that in a libary)
+	  (you're not supposed to include that in a library)
 	* Further tweaking
 	  - DNSSEC signing/verification works
 	  - Assorted bug fixes and tweaks (memory management)
diff --git a/contrib/ldns/Makefile.in b/contrib/ldns/Makefile.in
index 04f683bf11974a..57957d0844d356 100644
--- a/contrib/ldns/Makefile.in
+++ b/contrib/ldns/Makefile.in
@@ -40,15 +40,29 @@ edit = sed \
 # override $U variable which is used by autotools for deansification (for
 # K&R C compilers), but causes problems if $U is defined in the env).
 U=
+
+# set all of the tools due to cross-compiles. libtool uses most of them.
+# https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
 CC 		= @CC@
+CXX		= @CXX@
+CPP		= @CPP@
+LD 		= @LD@
+AS 		= @AS@
+AR 		= @AR@
+RANLIB	= @RANLIB@
+STRIP	= @STRIP@
+
+# Unbound project specific flags
 CFLAGS		= @CFLAGS@
 CPPFLAGS	= -I. -I$(srcdir) @CPPFLAGS@ @DEFS@ -DLDNS_TRUST_ANCHOR_FILE="\"$(LDNS_TRUST_ANCHOR_FILE)\""
+ARFLAGS		= @ARFLAGS@
 LDFLAGS		= @LDFLAGS@
+
 LIBS 		= @LIBS@
 LIBOBJDIR	= compat/
 LIBOBJS		= @LIBOBJS@
 PYTHON_CPPFLAGS	= @PYTHON_CPPFLAGS@
-PYTHON_LDFLAGS	= @PYTHON_LDFLAGS@
+PYTHON_LIBS	= @PYTHON_LIBS@
 PYTHON_X_CFLAGS = @PYTHON_X_CFLAGS@
 LIBSSL_CPPFLAGS = @LIBSSL_CPPFLAGS@
 LIBSSL_LDFLAGS  = @LIBSSL_LDFLAGS@
@@ -72,15 +86,15 @@ LINTFLAGS       += -D"__BEGIN_DECLS=" -D"__ssize_t=ssize_t" -D"__intptr_t=intptr
 LINTFLAGS       += -D"_RuneLocale=int"
 DEPFLAG		= @DEPFLAG@
 
-INSTALL		= $(srcdir)/install-sh 
+INSTALL		= $(srcdir)/install-sh
 
 LIBLOBJS	= $(LIBOBJS:.o=.lo)
-LDNS_LOBJS	= buffer.lo dane.lo dname.lo dnssec.lo dnssec_sign.lo dnssec_verify.lo dnssec_zone.lo duration.lo error.lo higher.lo host2str.lo host2wire.lo keys.lo net.lo packet.lo parse.lo radix.lo rbtree.lo rdata.lo resolver.lo rr.lo rr_functions.lo sha1.lo sha2.lo str2host.lo tsig.lo update.lo util.lo wire2host.lo zone.lo 
+LDNS_LOBJS	= buffer.lo dane.lo dname.lo dnssec.lo dnssec_sign.lo dnssec_verify.lo dnssec_zone.lo duration.lo error.lo higher.lo host2str.lo host2wire.lo keys.lo net.lo packet.lo parse.lo radix.lo rbtree.lo rdata.lo resolver.lo rr.lo rr_functions.lo sha1.lo sha2.lo str2host.lo tsig.lo update.lo util.lo wire2host.lo zone.lo edns.lo
 LDNS_LOBJS_EX	= ^linktest\.c$$
 LDNS_ALL_LOBJS	= $(LDNS_LOBJS) $(LIBLOBJS)
 LIB		= libldns.la
 
-LDNS_HEADERS	= buffer.h dane.h dname.h dnssec.h dnssec_sign.h dnssec_verify.h dnssec_zone.h duration.h error.h higher.h host2str.h host2wire.h keys.h ldns.h packet.h parse.h radix.h rbtree.h rdata.h resolver.h rr_functions.h rr.h sha1.h sha2.h str2host.h tsig.h update.h wire2host.h zone.h 
+LDNS_HEADERS	= buffer.h dane.h dname.h dnssec.h dnssec_sign.h dnssec_verify.h dnssec_zone.h duration.h error.h higher.h host2str.h host2wire.h keys.h ldns.h packet.h parse.h radix.h rbtree.h rdata.h resolver.h rr_functions.h rr.h sha1.h sha2.h str2host.h tsig.h update.h wire2host.h zone.h edns.h
 LDNS_HEADERS_EX	= ^config\.h|common\.h|util\.h|net\.h$$
 LDNS_HEADERS_GEN= common.h util.h net.h
 
@@ -89,8 +103,8 @@ PYLDNS_I_FILES	= $(pywrapdir)/file_py3.i $(pywrapdir)/ldns_buffer.i $(pywrapdir)
 DRILL_LOBJS	= drill/chasetrace.lo drill/dnssec.lo drill/drill.lo drill/drill_util.lo drill/error.lo drill/root.lo drill/securetrace.lo drill/work.lo
 
 EXAMPLE_LOBJS	= examples/ldns-chaos.lo examples/ldns-compare-zones.lo examples/ldns-dane.lo examples/ldnsd.lo examples/ldns-dpa.lo examples/ldns-gen-zone.lo examples/ldns-key2ds.lo examples/ldns-keyfetcher.lo examples/ldns-keygen.lo examples/ldns-mx.lo examples/ldns-notify.lo examples/ldns-nsec3-hash.lo examples/ldns-read-zone.lo examples/ldns-resolver.lo examples/ldns-revoke.lo examples/ldns-rrsig.lo examples/ldns-signzone.lo examples/ldns-test-edns.lo examples/ldns-testns.lo examples/ldns-testpkts.lo examples/ldns-update.lo examples/ldns-verify-zone.lo examples/ldns-version.lo examples/ldns-walk.lo examples/ldns-zcat.lo examples/ldns-zsplit.lo
-EXAMPLE_PROGS	= examples/ldns-chaos examples/ldns-compare-zones examples/ldnsd examples/ldns-gen-zone examples/ldns-key2ds examples/ldns-keyfetcher examples/ldns-keygen examples/ldns-mx examples/ldns-notify examples/ldns-read-zone examples/ldns-resolver examples/ldns-rrsig examples/ldns-test-edns examples/ldns-update examples/ldns-version examples/ldns-walk examples/ldns-zcat examples/ldns-zsplit 
-EX_PROGS_BASENM	= ldns-chaos ldns-compare-zones ldns-dane ldnsd ldns-dpa ldns-gen-zone ldns-key2ds ldns-keyfetcher ldns-keygen ldns-mx ldns-notify ldns-nsec3-hash ldns-read-zone ldns-resolver ldns-revoke ldns-rrsig ldns-signzone ldns-test-edns ldns-testns ldns-testpkts ldns-update ldns-verify-zone ldns-version ldns-walk ldns-zcat ldns-zsplit 
+EXAMPLE_PROGS	= examples/ldns-chaos examples/ldns-compare-zones examples/ldnsd examples/ldns-gen-zone examples/ldns-key2ds examples/ldns-keyfetcher examples/ldns-keygen examples/ldns-mx examples/ldns-notify examples/ldns-read-zone examples/ldns-resolver examples/ldns-rrsig examples/ldns-test-edns examples/ldns-update examples/ldns-version examples/ldns-walk examples/ldns-zcat examples/ldns-zsplit
+EX_PROGS_BASENM	= ldns-chaos ldns-compare-zones ldns-dane ldnsd ldns-dpa ldns-gen-zone ldns-key2ds ldns-keyfetcher ldns-keygen ldns-mx ldns-notify ldns-nsec3-hash ldns-read-zone ldns-resolver ldns-revoke ldns-rrsig ldns-signzone ldns-test-edns ldns-testns ldns-testpkts ldns-update ldns-verify-zone ldns-version ldns-walk ldns-zcat ldns-zsplit
 EXAMPLE_PROGS_EX= ^examples/ldns-testpkts\.c|examples/ldns-testns\.c|examples/ldns-dane\.c|examples/ldns-dpa\.c|examples/ldns-nsec3-hash\.c|examples/ldns-revoke\.c|examples/ldns-signzone\.c|examples/ldns-verify-zone\.c$$
 TESTNS		= examples/ldns-testns
 TESTNS_LOBJS	= examples/ldns-testns.lo examples/ldns-testpkts.lo
@@ -118,6 +132,10 @@ all:	setup-builddir lib linktest manpages @P5_DNS_LDNS@ @PYLDNS@ @DRILL@ @EXAMPL
 .c.lo:
 	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $< -o $@
 
+# Need libtool compile
+.c.o:
+	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $< -o $@
+
 $(LDNS_LOBJS) $(LIBLOBJS) $(DRILL_LOBJS) $(EXAMPLE_LOBJS):
 	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $(srcdir)/$(@:.lo=.c) -o $@
 
@@ -130,14 +148,16 @@ setup-builddir:
 	@if test ! -d include ; then $(INSTALL) -d include; fi
 	@if test ! -h include/ldns ; then ln -s ../ldns include/ldns || echo "include/ldns exists"; fi
 
+# builddir/ is used by 60-compile-builddir
 putdown-builddir:
 	rm -f include/ldns lib config.h
 	test ! -d include  || rmdir include  || :
 	if test -d examples -a ! -f examples/README; then rmdir examples || : ; fi
 	if test -d drill    -a ! -f drill/README   ; then rmdir drill    || : ; fi
 	if test -d compat   -a ! -f compat/malloc.c; then rmdir compat   || : ; fi
+	rm -rf builddir/
 
-drill: no-drill-config-h drill/drill drill/drill.1
+drill: setup-builddir no-drill-config-h drill/drill drill/drill.1
 no-drill-config-h:
 	@if test -e $(srcdir)/drill/config.h -o -e drill/config.h ; \
 	then echo "A config.h was detected in the drill subdirectory." ; \
@@ -147,8 +167,8 @@ no-drill-config-h:
 	     exit -1 ; \
 	fi
 
-drill/drill: $(DRILL_LOBJS) $(LIB)
-	$(LINK_EXE) $(DRILL_LOBJS) $(LIBS) $(LIBSSL_LIBS) -lldns -o drill/drill
+drill/drill: $(DRILL_LOBJS) $(LIB) $(LIBLOBJS)
+	$(LINK_EXE) $(DRILL_LOBJS) $(LIBLOBJS) $(LIB) $(LIBSSL_LIBS) $(LIBS) -o drill/drill
 
 drill/drill.1: $(srcdir)/drill/drill.1.in
 	$(edit) $(srcdir)/drill/drill.1.in > drill/drill.1
@@ -168,7 +188,7 @@ uninstall-drill:
 clean-drill:
 	$(LIBTOOL) --mode clean rm -f $(DRILL_LOBJS) drill/drill drill/drill.1
 
-examples: no-examples-config-h $(EXAMPLE_PROGS) $(TESTNS) $(LDNS_DPA) $(LDNS_DANE) $(EX_SSL_PROGS) examples/ldns-dane.1 examples/ldns-verify-zone.1
+examples: setup-builddir no-examples-config-h $(LIB) $(EXAMPLE_PROGS) $(TESTNS) $(LDNS_DPA) $(LDNS_DANE) $(EX_SSL_PROGS) examples/ldns-dane.1 examples/ldns-verify-zone.1
 no-examples-config-h:
 	@if test -e $(srcdir)/examples/config.h -o -e examples/config.h ; \
 	then echo "A config.h was detected in the examples subdirectory." ; \
@@ -178,22 +198,25 @@ no-examples-config-h:
 	     exit -1 ; \
 	fi
 
+# Need LIBSSL_LIBS
 $(EXAMPLE_PROGS):
-	$(LINK_EXE) $@.lo $(LIBS) -lldns -o $@
+	$(LINK_EXE) $@.lo $(LIBLOBJS) $(LIB) $(LIBSSL_LIBS) $(LIBS) -o $@
 
+# Need LIBSSL_LIBS
 $(TESTNS):
-	$(LINK_EXE) $(TESTNS_LOBJS) $(LIBS) -lldns -o $(TESTNS)
+	$(LINK_EXE) $(TESTNS_LOBJS) $(LIBLOBJS) $(LIB) $(LIBSSL_LIBS) $(LIBS) -o $(TESTNS)
 
+# Need LIBSSL_LIBS
 $(LDNS_DPA):
-	$(LINK_EXE) $(LDNS_DPA_LOBJS) $(LIBS) $(LIBPCAP_LIBS) -lldns \
+	$(LINK_EXE) $(LDNS_DPA_LOBJS) $(LIBLOBJS) $(LIB) $(LIBPCAP_LIBS) $(LIBSSL_LIBS) $(LIBS) \
 		 -o $(LDNS_DPA)
 
 $(LDNS_DANE):
-	$(LINK_EXE) $(LDNS_DANE_LOBJS) $(LIBS) $(LIBSSL_SSL_LIBS) -lldns \
+	$(LINK_EXE) $(LDNS_DANE_LOBJS) $(LIBLOBJS) $(LIB) $(LIBSSL_SSL_LIBS) $(LIBS) \
 		 -o $(LDNS_DANE)
 
 $(EX_SSL_PROGS):
-	$(LINK_EXE) $@.lo $(LIBS) $(LIBSSL_LIBS) -lldns -o $@
+	$(LINK_EXE) $@.lo $(LIBLOBJS) $(LIB) $(LIBSSL_LIBS) $(LIBS) -o $@
 
 examples/ldns-dane.1: $(srcdir)/examples/ldns-dane.1.in
 	$(edit) $(srcdir)/examples/ldns-dane.1.in > examples/ldns-dane.1
@@ -221,14 +244,14 @@ uninstall-examples:
 	test ! -d $(DESTDIR)$(bindir) || rmdir -p $(DESTDIR)$(bindir) || : ;
 
 clean-examples:
-	$(LIBTOOL) --mode clean rm -f $(EXAMPLE_PROGS) 
+	$(LIBTOOL) --mode clean rm -f $(EXAMPLE_PROGS)
 	$(LIBTOOL) --mode clean rm -f $(TESTNS) $(LDNS_DPA) $(LDNS_DANE) $(EX_SSL_PROGS)
 	$(LIBTOOL) --mode clean rm -f $(EXAMPLE_LOBJS)
 	$(LIBTOOL) --mode clean rm -f examples/ldns-dane.1 examples/ldns-verify-zone.1
 
 linktest: $(srcdir)/linktest.c libldns.la
 	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $(srcdir)/linktest.c -o linktest.lo
-	$(LINK_EXE) linktest.lo $(LIBS) $(LIBSSL_LIBS) -lldns -o linktest
+	$(LINK_EXE) linktest.lo $(LIB) $(LIBSSL_LIBS) $(LIBS) -o linktest
 
 lib: libldns.la
 
@@ -243,7 +266,7 @@ libldns.la-export-all: $(LDNS_ALL_LOBJS)
 mancheck:
 	sh -c 'find . -name \*.\[13\] -exec troff -z {} \;' 2>&1 | sed "s/^\.\///" | sed "s/\(:[0\-9]\+:\)/\1 warning:/g"
 
-doxygen: manpages
+doxygen:
 	@if test ! -e doc/header.html ; then \
 		$(INSTALL) -c -m 644 $(srcdir)/doc/header.html doc/ ; \
 	fi ;
@@ -252,14 +275,29 @@ doxygen: manpages
 doc: manpages $(doxygen)
 	@$(INSTALL) -d doc
 
-manpages: $(srcdir)/doc/function_manpages 
-	@$(INSTALL) -d doc
-	@cat $(srcdir)/ldns/*.h \
-	| $(srcdir)/doc/doxyparse.pl \
-		-m $(srcdir)/doc/function_manpages \
-	| grep -v ^doxygen | grep -v ^cat  > doc/ldns_manpages
+manpages: $(srcdir)/doc/function_manpages
+	@$(INSTALL) -d doc/man/man3
+	@if [ -f $(srcdir)/doc/man/man3/ldns_rr.3 ] ; \
+	then \
+		if test -d ldns ; then \
+			echo "is builddir srcdir" > ldns/YES ; \
+			if [ ! -f $(srcdir)/ldns/YES ]; then \
+				echo "Copying manpages..."; \
+				for m in $(srcdir)/doc/man/man3/*.3 ; \
+				do \
+					$(INSTALL) -c -C -m 444 $${m} doc/man/man3/ ; \
+				done; \
+			fi ;\
+			rm -f ldns/YES; \
+		fi; \
+	else \
+		echo "Generating manpages..."; \
+		cat $(srcdir)/ldns/*.h \
+			| $(srcdir)/doc/doxyparse.pl -m $(srcdir)/doc/function_manpages \
+			| grep -v ^doxygen | grep -v ^cat  > doc/ldns_manpages; \
+	fi
 
-manpage-create-errors: $(srcdir)/doc/function_manpages 
+manpage-create-errors: $(srcdir)/doc/function_manpages
 	@$(INSTALL) -d doc
 	@cat $(srcdir)/ldns/*.h \
 	| $(srcdir)/doc/doxyparse.pl -e \
@@ -276,7 +314,7 @@ manpage-errors:
 			echo doc/man/man3/$${m}.3: manpage-has-bad-whatis-entry; \
 		fi; \
 	done || echo "WARNING!: Cannot detect manpage errors on `uname`"
-	
+
 pyldns: _ldns.la
 
 $(pywrapdir)/ldns_wrapper.c: $(PYLDNS_I_FILES) ldns/config.h
@@ -285,8 +323,8 @@ $(pywrapdir)/ldns_wrapper.c: $(PYLDNS_I_FILES) ldns/config.h
 ldns_wrapper.lo: $(pywrapdir)/ldns_wrapper.c ldns/config.h
 	$(COMP_LIB) -I./include/ldns $(LIBSSL_CPPFLAGS) $(PYTHON_CPPFLAGS) $(PYTHON_X_CFLAGS) -c $(pywrapdir)/ldns_wrapper.c -o $@
 
-_ldns.la: ldns_wrapper.lo libldns.la 
-	$(LIBTOOL) --tag=CC --mode=link $(CC) $(CFLAGS) $(PYTHON_CFLAGS) $(LDFLAGS) $(PYTHON_LDFLAGS) -module -version-info $(version_info) -no-undefined -o $@ ldns_wrapper.lo -rpath $(python_site) -L. -L.libs -lldns $(LIBS)
+_ldns.la: ldns_wrapper.lo libldns.la
+	$(LIBTOOL) --tag=CC --mode=link $(CC) $(CFLAGS) $(PYTHON_CFLAGS) $(LDFLAGS) -module -version-info $(version_info) -no-undefined -o $@ ldns_wrapper.lo -rpath $(python_site) -L. -L.libs $(LIB) $(PYTHON_LIBS) $(LIBS)
 
 $(p5_dns_ldns_dir)/Makefile: $(p5_dns_ldns_dir)/Makefile.PL
 	BUILDDIR=`pwd`; cd $(p5_dns_ldns_dir); LD_LIBRARY_PATH="$$BUILDDIR/.libs:$$LD_LIBRARY_PATH" DYLD_LIBRARY_PATH="$$BUILDDIR/.libs:$$DYLD_LIBRARY_PATH" $(PERL) Makefile.PL LIBS="-L$$BUILDDIR/.libs -lldns" INC="-I$$BUILDDIR"
@@ -308,9 +346,9 @@ clean-p5-dns-ldns: $(p5_dns_ldns_dir)/Makefile
 test-p5-dns-ldns: $(p5_dns_ldns_dir)/Makefile
 	cd $(p5_dns_ldns_dir); $(MAKE) test
 
-install: install-h install-lib @INSTALL_CONFIG@ install-manpages $(pyldns_inst) $(pyldnsx_inst) @INSTALL_P5_DNS_LDNS@ @INSTALL_DRILL@ @INSTALL_EXAMPLES@
+install: install-h install-lib install-pc @INSTALL_CONFIG@ install-manpages $(pyldns_inst) $(pyldnsx_inst) @INSTALL_P5_DNS_LDNS@ @INSTALL_DRILL@ @INSTALL_EXAMPLES@
 
-uninstall: uninstall-manpages @UNINSTALL_CONFIG@ uninstall-h uninstall-lib $(pyldns_uninst) $(pyldnsx_uninst) @UNINSTALL_P5_DNS_LDNS@ @UNINSTALL_DRILL@ @UNINSTALL_EXAMPLES@
+uninstall: uninstall-manpages @UNINSTALL_CONFIG@ uninstall-h uninstall-lib uninstall-pc $(pyldns_uninst) $(pyldnsx_uninst) @UNINSTALL_P5_DNS_LDNS@ @UNINSTALL_DRILL@ @UNINSTALL_EXAMPLES@
 
 destclean: uninstall
 
@@ -355,12 +393,22 @@ uninstall-h:
 	test ! -d $(DESTDIR)$(includedir)/ldns || rmdir -p $(DESTDIR)$(includedir)/ldns || echo "ok, dir already gone"
 	exit 0
 
+packaging/libldns.pc: $(srcdir)/packaging/libldns.pc.in
+	./config.status --file=$@
+
+install-pc: packaging/libldns.pc
+	$(INSTALL) -m 644 packaging/libldns.pc $(DESTDIR)$(libdir)/pkgconfig/ldns.pc
+
+uninstall-pc:
+	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/pkgconfig/ldns.pc
+	test ! -d $(DESTDIR)$(libdir)/pkgconfig || rmdir -p $(DESTDIR)$(libdir)/pkgconfig || echo "ok, dir already gone"
+
 install-lib: lib
 	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
 	$(LIBTOOL) --mode=install cp libldns.la $(DESTDIR)$(libdir)
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)
 
-uninstall-lib:	
+uninstall-lib:
 	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libldns.la
 	test ! -d $(DESTDIR)$(libdir) || rmdir -p $(DESTDIR)$(libdir) || echo "ok, dir already gone"
 
@@ -370,7 +418,7 @@ install-pyldns: @PYLDNS@
 	$(LIBTOOL) --mode=install cp _ldns.la $(DESTDIR)$(python_site)
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(python_site)
 
-uninstall-pyldns:	
+uninstall-pyldns:
 	rm -f $(DESTDIR)$(python_site)/ldns/*
 	test ! -d $(DESTDIR)$(python_site)/ldns || rmdir $(DESTDIR)$(python_site)/ldns || echo "ok, dir already gone"
 
@@ -425,7 +473,7 @@ docclean:
 	rm -f doc/ldns_manpages
 
 distclean: realclean
-	rm -fr autom4te.cache 
+	rm -fr autom4te.cache
 	rm -f config.guess config.sub configure ltmain.sh ldns/config.h.in
 
 ## No need for changes here
@@ -457,8 +505,8 @@ allclean: test-clean clean
 test-clean:
 	tpkg -b test clean
 
-test: @TEST_P5_DNS_LDNS@
-	if test -x "`which bash`"; then bash test/test_all.sh; else sh test/test_all.sh; fi
+test: examples drill @TEST_P5_DNS_LDNS@
+	./test/test_all.sh
 
 
 # Recreate symbols file, only needed when API changes
@@ -538,129 +586,137 @@ depend:
 
 buffer.lo buffer.o: $(srcdir)/buffer.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dane.lo dane.o: $(srcdir)/dane.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dname.lo dname.o: $(srcdir)/dname.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dnssec.lo dnssec.o: $(srcdir)/dnssec.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dnssec_sign.lo dnssec_sign.o: $(srcdir)/dnssec_sign.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dnssec_verify.lo dnssec_verify.o: $(srcdir)/dnssec_verify.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 dnssec_zone.lo dnssec_zone.o: $(srcdir)/dnssec_zone.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+duration.lo duration.o: $(srcdir)/duration.c ldns/config.h $(srcdir)/ldns/duration.h
+edns.lo edns.o: $(srcdir)/edns.c $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
+ $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
+ $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
+ $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-duration.lo duration.o: $(srcdir)/duration.c ldns/config.h $(srcdir)/ldns/duration.h
 error.lo error.o: $(srcdir)/error.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 higher.lo higher.o: $(srcdir)/higher.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 host2str.lo host2str.o: $(srcdir)/host2str.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 host2wire.lo host2wire.o: $(srcdir)/host2wire.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 keys.lo keys.o: $(srcdir)/keys.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 linktest.lo linktest.o: $(srcdir)/linktest.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 net.lo net.o: $(srcdir)/net.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 packet.lo packet.o: $(srcdir)/packet.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 parse.lo parse.o: $(srcdir)/parse.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
@@ -670,40 +726,40 @@ radix.lo radix.o: $(srcdir)/radix.c ldns/config.h $(srcdir)/ldns/radix.h $(srcdi
 rbtree.lo rbtree.o: $(srcdir)/rbtree.c ldns/config.h $(srcdir)/ldns/rbtree.h ldns/util.h ldns/common.h
 rdata.lo rdata.o: $(srcdir)/rdata.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 resolver.lo resolver.o: $(srcdir)/resolver.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 rr.lo rr.o: $(srcdir)/rr.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 rr_functions.lo rr_functions.o: $(srcdir)/rr_functions.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 sha1.lo sha1.o: $(srcdir)/sha1.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
@@ -711,24 +767,24 @@ sha1.lo sha1.o: $(srcdir)/sha1.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h
 sha2.lo sha2.o: $(srcdir)/sha2.c ldns/config.h $(srcdir)/ldns/sha2.h
 str2host.lo str2host.o: $(srcdir)/str2host.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 tsig.lo tsig.o: $(srcdir)/tsig.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 update.lo update.o: $(srcdir)/update.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
@@ -737,16 +793,16 @@ util.lo util.o: $(srcdir)/util.c ldns/config.h $(srcdir)/ldns/rdata.h ldns/commo
  ldns/util.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/buffer.h
 wire2host.lo wire2host.o: $(srcdir)/wire2host.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 zone.lo zone.o: $(srcdir)/zone.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
@@ -772,280 +828,286 @@ compat/strlcpy.lo compat/strlcpy.o: $(srcdir)/compat/strlcpy.c ldns/config.h
 compat/timegm.lo compat/timegm.o: $(srcdir)/compat/timegm.c ldns/config.h
 examples/ldns-chaos.lo examples/ldns-chaos.o: $(srcdir)/examples/ldns-chaos.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-compare-zones.lo examples/ldns-compare-zones.o: $(srcdir)/examples/ldns-compare-zones.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-dane.lo examples/ldns-dane.o: $(srcdir)/examples/ldns-dane.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-dane.lo examples/ldns-dane.o: $(srcdir)/examples/ldns-dane.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldnsd.lo examples/ldnsd.o: $(srcdir)/examples/ldnsd.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h \
  $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h \
- $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
- $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h \
+ $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-dpa.lo examples/ldns-dpa.o: $(srcdir)/examples/ldns-dpa.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h $(srcdir)/examples/ldns-dpa.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h $(srcdir)/examples/ldns-dpa.h
 examples/ldns-gen-zone.lo examples/ldns-gen-zone.o: $(srcdir)/examples/ldns-gen-zone.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-key2ds.lo examples/ldns-key2ds.o: $(srcdir)/examples/ldns-key2ds.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-key2ds.lo examples/ldns-key2ds.o: $(srcdir)/examples/ldns-key2ds.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-keyfetcher.lo examples/ldns-keyfetcher.o: $(srcdir)/examples/ldns-keyfetcher.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-keygen.lo examples/ldns-keygen.o: $(srcdir)/examples/ldns-keygen.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-keygen.lo examples/ldns-keygen.o: $(srcdir)/examples/ldns-keygen.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-mx.lo examples/ldns-mx.o: $(srcdir)/examples/ldns-mx.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-notify.lo examples/ldns-notify.o: $(srcdir)/examples/ldns-notify.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-nsec3-hash.lo examples/ldns-nsec3-hash.o: $(srcdir)/examples/ldns-nsec3-hash.c ldns/config.h $(srcdir)/ldns/ldns.h \
- ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
- $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-read-zone.lo examples/ldns-read-zone.o: $(srcdir)/examples/ldns-read-zone.c ldns/config.h $(srcdir)/ldns/ldns.h \
- ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
- $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+examples/ldns-notify.lo examples/ldns-notify.o: $(srcdir)/examples/ldns-notify.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-nsec3-hash.lo examples/ldns-nsec3-hash.o: $(srcdir)/examples/ldns-nsec3-hash.c ldns/config.h $(srcdir)/ldns/ldns.h \
+ ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
+ $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-read-zone.lo examples/ldns-read-zone.o: $(srcdir)/examples/ldns-read-zone.c ldns/config.h $(srcdir)/ldns/ldns.h \
+ ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
+ $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-resolver.lo examples/ldns-resolver.o: $(srcdir)/examples/ldns-resolver.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-revoke.lo examples/ldns-revoke.o: $(srcdir)/examples/ldns-revoke.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-revoke.lo examples/ldns-revoke.o: $(srcdir)/examples/ldns-revoke.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-rrsig.lo examples/ldns-rrsig.o: $(srcdir)/examples/ldns-rrsig.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-signzone.lo examples/ldns-signzone.o: $(srcdir)/examples/ldns-signzone.c ldns/config.h $(srcdir)/ldns/ldns.h \
- ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
- $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-signzone.lo examples/ldns-signzone.o: $(srcdir)/examples/ldns-signzone.c ldns/config.h $(srcdir)/ldns/ldns.h \
+ ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
+ $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-test-edns.lo examples/ldns-test-edns.o: $(srcdir)/examples/ldns-test-edns.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-testns.lo examples/ldns-testns.o: $(srcdir)/examples/ldns-testns.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
- $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-testns.lo examples/ldns-testns.o: $(srcdir)/examples/ldns-testns.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h $(srcdir)/examples/ldns-testpkts.h
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h \
+ $(srcdir)/examples/ldns-testpkts.h
 examples/ldns-testpkts.lo examples/ldns-testpkts.o: $(srcdir)/examples/ldns-testpkts.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h \
+ $(srcdir)/examples/ldns-testpkts.h
+examples/ldns-update.lo examples/ldns-update.o: $(srcdir)/examples/ldns-update.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
- $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h \
- $(srcdir)/examples/ldns-testpkts.h
-examples/ldns-update.lo examples/ldns-update.o: $(srcdir)/examples/ldns-update.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-verify-zone.lo examples/ldns-verify-zone.o: $(srcdir)/examples/ldns-verify-zone.c ldns/config.h $(srcdir)/ldns/ldns.h \
  ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h \
  $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h \
+ $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
+ $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
+ $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
+ ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
+ $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+examples/ldns-version.lo examples/ldns-version.o: $(srcdir)/examples/ldns-version.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
+ ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
  $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
  $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
  $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
  $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
  $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-version.lo examples/ldns-version.o: $(srcdir)/examples/ldns-version.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
- ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-walk.lo examples/ldns-walk.o: $(srcdir)/examples/ldns-walk.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-zcat.lo examples/ldns-zcat.o: $(srcdir)/examples/ldns-zcat.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
- $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
- $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
- $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
- $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-zsplit.lo examples/ldns-zsplit.o: $(srcdir)/examples/ldns-zsplit.c ldns/config.h $(srcdir)/ldns/ldns.h ldns/util.h \
  ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h \
- $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h \
- $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h \
+ $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h \
+ $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h \
+ $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h \
+ $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h \
+ $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+drill/chasetrace.lo drill/chasetrace.o: $(srcdir)/drill/chasetrace.c $(srcdir)/drill/drill.h ldns/config.h \
+ $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
+ $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
+ $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
+ $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
  $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
  $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-drill/chasetrace.lo drill/chasetrace.o: $(srcdir)/drill/chasetrace.c $(srcdir)/drill/drill.h ldns/config.h \
- $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
- $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
- $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
+drill/dnssec.lo drill/dnssec.o: $(srcdir)/drill/dnssec.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
+ $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
+ $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
+ $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
  $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h \
  $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h \
  $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-drill/dnssec.lo drill/dnssec.o: $(srcdir)/drill/dnssec.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
- $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
- $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
- $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
- $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
- $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
- ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
- $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 drill/drill.lo drill/drill.o: $(srcdir)/drill/drill.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
  $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
  $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
- $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
- $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
- $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
- ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
- $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-drill/drill_util.lo drill/drill_util.o: $(srcdir)/drill/drill_util.c $(srcdir)/drill/drill.h ldns/config.h \
- $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
- $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
- $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
+ $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
  $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h \
  $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h \
  $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+drill/drill_util.lo drill/drill_util.o: $(srcdir)/drill/drill_util.c $(srcdir)/drill/drill.h ldns/config.h \
+ $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
+ $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
+ $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
+ $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
+ $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
+ $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
+ $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 drill/error.lo drill/error.o: $(srcdir)/drill/error.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
  $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
  $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
- $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
- $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
- $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
- ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
- $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
+ $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h \
+ $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h \
+ $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
+ $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
+ $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 drill/root.lo drill/root.o: $(srcdir)/drill/root.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
  $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
  $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
- $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
- $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
- $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
- ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
- $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-drill/securetrace.lo drill/securetrace.o: $(srcdir)/drill/securetrace.c $(srcdir)/drill/drill.h ldns/config.h \
- $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
- $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
- $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
+ $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
  $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h \
  $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h \
  $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+drill/securetrace.lo drill/securetrace.o: $(srcdir)/drill/securetrace.c $(srcdir)/drill/drill.h ldns/config.h \
+ $(srcdir)/drill/drill_util.h $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h \
+ $(srcdir)/ldns/error.h $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h \
+ $(srcdir)/ldns/dnssec.h $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h \
+ $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h \
+ $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h \
+ $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
+ $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
+ $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 drill/work.lo drill/work.o: $(srcdir)/drill/work.c $(srcdir)/drill/drill.h ldns/config.h $(srcdir)/drill/drill_util.h \
  $(srcdir)/ldns/ldns.h ldns/util.h ldns/common.h $(srcdir)/ldns/buffer.h $(srcdir)/ldns/error.h \
  $(srcdir)/ldns/dane.h $(srcdir)/ldns/rdata.h $(srcdir)/ldns/rr.h $(srcdir)/ldns/dname.h $(srcdir)/ldns/dnssec.h \
- $(srcdir)/ldns/packet.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h $(srcdir)/ldns/tsig.h \
- $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h $(srcdir)/ldns/dnssec_verify.h \
- $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h $(srcdir)/ldns/host2wire.h \
- ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h $(srcdir)/ldns/wire2host.h \
- $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
+ $(srcdir)/ldns/packet.h $(srcdir)/ldns/edns.h $(srcdir)/ldns/keys.h $(srcdir)/ldns/zone.h $(srcdir)/ldns/resolver.h \
+ $(srcdir)/ldns/tsig.h $(srcdir)/ldns/dnssec_zone.h $(srcdir)/ldns/rbtree.h $(srcdir)/ldns/host2str.h \
+ $(srcdir)/ldns/dnssec_verify.h $(srcdir)/ldns/dnssec_sign.h $(srcdir)/ldns/duration.h $(srcdir)/ldns/higher.h \
+ $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
+ $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
+ $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
 examples/ldns-chaos: examples/ldns-chaos.lo examples/ldns-chaos.o $(LIB)
 examples/ldns-compare-zones: examples/ldns-compare-zones.lo examples/ldns-compare-zones.o $(LIB)
 examples/ldnsd: examples/ldnsd.lo examples/ldnsd.o $(LIB)
diff --git a/contrib/ldns/README b/contrib/ldns/README
index 455f1d560ef2a8..98575917b44843 100644
--- a/contrib/ldns/README
+++ b/contrib/ldns/README
@@ -51,11 +51,11 @@ ldns is developed by the ldns team at NLnet Labs. This team currently
 consists of:
   o Willem Toorop
   o Wouter Wijngaards
-  o Matthijs Mekking
 
 Former main developers:
   o Jelte Jansen
   o Miek Gieben
+  o Matthijs Mekking
 
 * Credits
 We have received patches from the following people, thanks!
@@ -70,6 +70,7 @@ We have received patches from the following people, thanks!
   o Havard Eidnes
   o Leo Baltus
   o Dag-Erling Smørgrav
+  o Felipe Gasper
 
 
 INFORMATION FOR SPECIFIC OPERATING SYSTEMS
@@ -96,7 +97,7 @@ contrib/build-solaris.sh
 KNOWN ISSUES
 
 A complete list of currently known open issues can be found here:
-http://www.nlnetlabs.nl/projects/ldns/bugs
+https://github.com/NLnetLabs/ldns/issues
 
 * pyldns
 Compiling pyldns produces many ``unused parameter'' warnings.  Those are
diff --git a/contrib/ldns/README-Travis.md b/contrib/ldns/README-Travis.md
new file mode 100644
index 00000000000000..faa53435311947
--- /dev/null
+++ b/contrib/ldns/README-Travis.md
@@ -0,0 +1,274 @@
+# Travis Testing
+
+LDNS 1.7.1 and above leverage Travis CI to increase coverage of compilers and platforms. Compilers include Clang and GCC; while platforms include Android, iOS, Linux, and OS X on AMD64, Aarch64, PowerPC and s390x hardware.
+
+Android is tested on armv7a, aarch64, x86 and x86_64. The Android recipes build and install OpenSSL, and then builds LDNS. The testing is tailored for Android NDK-r19 and above, and includes NDK-r20 and NDK-r21. Mips and Mips64 are not tested because they are no longer supported under current NDKs.
+
+iOS is tested for iPhoneOS, WatchOS, AppleTVOS, iPhoneSimulator, AppleTVSimulator and WatchSimulator. The testing uses Xcode 10 on OS X 10.13.
+
+The LDNS Travis configuration file `.travis.yml` does not use top-level keys like `os:` and `compiler:` so there is no matrix expansion. Instead LDNS specifies the exact job to run under the `jobs:` and `include:` keys.
+
+## Typical recipe
+
+A typical recipe tests Clang and GCC on various hardware. The hardware includes AMD64, Aarch64, PowerPC and s390x. PowerPC is a little-endian platform, and s390x is a big-endian platform. There are pairs of recipes that are similar to the following.
+
+```
+- os: linux
+  name: GCC on Linux, Aarch64
+  compiler: gcc
+  arch: arm64
+  dist: bionic
+- os: linux
+  name: Clang on Linux, Aarch64
+  compiler: clang
+  arch: arm64
+  dist: bionic
+```
+
+OS X provides a single recipe to test Clang. GCC is not tested because GCC is an alias for Clang.
+
+## Sanitizer builds
+
+Two sanitizer builds are tested using Clang and GCC, for a total of four builds. The first sanitizer is Undefined Behavior sanitizer (UBsan), and the second is Address sanitizer (Asan). The sanitizers are only run on AMD64 hardware. Note the environment includes `UBSAN=yes` or `ASAN=yes` for the sanitizer builds.
+
+The recipes are similar to the following.
+
+```
+- os: linux
+  name: UBsan, GCC on Linux, Amd64
+  compiler: gcc
+  arch: amd64
+  dist: bionic
+  env: UBSAN=yes
+- os: linux
+  name: UBsan, Clang on Linux, Amd64
+  compiler: clang
+  arch: amd64
+  dist: bionic
+  env: UBSAN=yes
+```
+
+When the Travis script encounters a sanitizer it uses different `CFLAGS` and configuration string.
+
+```
+if [ "$UBSAN" = "yes" ]; then
+  export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined -fno-sanitize-recover"
+  bash test/test_ci.sh
+elif [ "$ASAN" = "yes" ]; then
+  export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
+  bash test/test_ci.sh
+...
+```
+
+## Android builds
+
+Travis tests Android builds for the armv7a, aarch64, x86 and x86_64 architectures. The builds are trickier than other builds for several reasons. The testing requires installation of the Android NDK and SDK, it requires a cross-compile, and requires OpenSSL prerequisites. The Android cross-compiles also require care to set the Autotools triplet, the OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The discussion below detail the steps of the Android recipes.
+
+### Android job
+
+The first step sets environmental variables for the cross-compile using the Travis job. A typical job with variables is shown below.
+
+```
+- os: linux
+  name: Android armv7a, Linux, Amd64
+  compiler: clang
+  arch: amd64
+  dist: bionic
+  env:
+    - ANDROID=yes
+    - AUTOTOOLS_HOST=armv7a-linux-androideabi
+    - OPENSSL_HOST=android-arm
+    - ANDROID_CPU=armv7a
+    - ANDROID_API=23
+    - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
+    - ANDROID_SDK_ROOT="$HOME/android-sdk"
+    - ANDROID_NDK_ROOT="$HOME/android-ndk"
+```
+
+### ANDROID_NDK_ROOT
+
+The second step for Android is to set the environmental variables `ANDROID_NDK_ROOT` and `ANDROID_SDK_ROOT`. This is an important step because the NDK and SDK use the variables internally to locate their own tools. Also see [Recommended NDK Directory?](https://groups.google.com/forum/#!topic/android-ndk/qZjhOaynHXc) on the android-ndk mailing list. (Many folks miss this step, or use incorrect variables like `ANDROID_NDK_HOME` or `ANDROID_SDK_HOME`).
+
+If you are working from a developer machine you probably already have the necessary tools installed. You should ensure `ANDROID_NDK_ROOT` and `ANDROID_SDK_ROOT` are set properly.
+
+### Tool installation
+
+The second step installs tools needed for OpenSSL, Expat and LDNS. This step is handled in by the script `contrib/android/install_tools.sh`. The tools include curl, tar, zip, unzip and java.
+
+```
+before_script:
+  - |
+    if [ "$ANDROID" = "yes" ]; then
+      ./contrib/android/install_tools.sh
+    elif [ "$IOS" = "yes" ]; then
+      ./contrib/ios/install_tools.sh
+    fi
+```
+
+### NDK installation
+
+The third step installs the NDK and SDK. This step is handled in by the script `contrib/android/install_ndk.sh`. The script uses `ANDROID_NDK_ROOT` and `ANDROID_SDK_ROOT` to place the NDK and SDK in the `$HOME` directory.
+
+If you are working from a developer machine you probably already have a NDK and SDK installed.
+
+### Android environment
+
+The fourth step sets the Android cross-compile environment using the script `contrib/android/setenv_android.sh`. The script is `sourced` so the variables in the script are available to the calling shell. The script sets variables like `CC`, `CXX`, `AS` and `AR`; sets `CFLAGS` and `CXXFLAGS`; sets a `sysroot` so Android headers and libraries are found; and adds the path to the toolchain to `PATH`.
+
+`contrib/android/setenv_android.sh` knows which toolchain and architecture to select by inspecting environmental variables set by Travis for the job. In particular, the variables `ANDROID_CPU` and `ANDROID_API` tell `contrib/android/setenv_android.sh` which tools and libraries to select.
+
+The `contrib/android/setenv_android.sh` script specifies the tools in a `case` statement like the following. There is a case for each of the architectures armv7a, aarch64, x86 and x86_64.
+
+```
+armv8a|aarch64|arm64|arm64-v8a)
+  CC="aarch64-linux-android$ANDROID_API-clang"
+  CXX="aarch64-linux-android$ANDROID_API-clang++"
+  LD="aarch64-linux-android-ld"
+  AS="aarch64-linux-android-as"
+  AR="aarch64-linux-android-ar"
+  RANLIB="aarch64-linux-android-ranlib"
+  STRIP="aarch64-linux-android-strip"
+
+  CFLAGS="-funwind-tables -fexceptions"
+  CXXFLAGS="-funwind-tables -fexceptions -frtti"
+```
+
+### OpenSSL
+
+The fifth step builds OpenSSL. OpenSSL is built for iOS using the scripts `contrib/android/install_openssl.sh`. The script downloads, configures and installs the latest release version of the OpenSSL libraries. OpenSSL is configured with `--prefix="$ANDROID_PREFIX"` so the headers are placed in `$ANDROID_PREFIX/include` directory, and the libraries are placed in the `$ANDROID_PREFIX/lib` directory.
+
+`ANDROID_PREFIX` is the value `$HOME/android$ANDROID_API-$ANDROID_CPU`. The libraries will be installed in `$HOME/android23-armv7a`, `$HOME/android23-aarch64`, etc. For Autotools projects, the appropriate `PKG_CONFIG_PATH` is exported.
+
+`PKG_CONFIG_PATH` is an important variable. It is the userland equivalent to sysroot, and allows Autotools to find non-system headers and libraries for an architecture. Typical `PKG_CONFIG_PATH` are `$HOME/android23-armv7a/lib/pkgconfig` and `$HOME/android23-aarch64/lib/pkgconfig`.
+
+OpenSSL also uses a custom configuration file called `15-android.conf`. It is a copy of the OpenSSL's project file and located at `contrib/android/15-android.conf`. The LDNS version is copied to the OpenSSL source files after unpacking the OpenSSL distribution. The LDNS version has legacy NDK support removed and some other fixes, like `ANDROID_NDK_ROOT` awareness. The changes mean LDNS's `15-android.conf` will only work with LDNS, with NDK-r19 and above, and a properly set environment.
+
+OpenSSL is configured with `no-engine`. If you want to include OpenSSL engines then edit `contrib/android/install_openssl.sh` and remove the config option.
+
+### Android build
+
+Finally, once OpenSSL are built, then the Travis script configures and builds LDNS. The recipe looks as follows.
+
+```
+elif [ "$ANDROID" = "yes" ]; then
+  export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
+  ./contrib/android/install_ndk.sh
+  source ./contrib/android/setenv_android.sh
+  ./contrib/android/install_openssl.sh
+  ./contrib/android/bootstrap_ldns.sh
+  ./configure \
+    --build="$AUTOTOOLS_BUILD" \
+    --host="$AUTOTOOLS_HOST" \
+    --prefix="$ANDROID_PREFIX" \
+    --with-ssl="$ANDROID_PREFIX" \
+    --disable-gost \
+    --with-drill --with-examples
+  make -j 2
+  make install
+```
+
+Travis only smoke tests an Android build using a compile, link and install. The self tests are not run. TODO: figure out how to fire up an emulator, push the tests to the device and run them.
+
+### Android flags
+
+`contrib/android/setenv_android.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. They are taken from `ndk-build`, so we consider them the official flag set. It is important to use the same flags across projects to avoid subtle problems due to mixing and matching different flags.
+
+`CXXFLAGS` includes `-fexceptions` and `-frtti` because exceptions and runtime type info are disabled by default. `CFLAGS` include `-funwind-tables` and `-fexceptions` to ensure C++ exceptions pass through C code, if needed. Also see `docs/CPLUSPLUS-SUPPORT.html` in the NDK docs.
+
+To inspect the flags used by `ndk-build` for a platform clone ASOP's [ndk-samples](https://github.com/android/ndk-samples/tree/master/hello-jni) and build the `hello-jni` project. Use the `V=1` flag to see the full compiler output from `ndk-build`.
+
+## iOS builds
+
+Travis tests iOS builds for the armv7a, armv7s and aarch64 architectures for iPhoneOS, AppleTVOS and WatchOS. iPhoneOS is tested using both 32-bit builds (iPhones) and 64-bit builds (iPads). Travis also tests compiles against the simulators. The builds are trickier than other builds for several reasons. The testing requires a cross-compile, and requires OpenSSL prerequisites. The iOS cross-compiles also require care to set the Autotools triplet, the OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The discussion below detail the steps of the iOS recipes.
+
+### iOS job
+
+The first step sets environmental variables for the cross-compile using the Travis job. A typical job with variables is shown below.
+
+```
+- os: osx
+  osx_image: xcode10
+  name: Apple iPhone on iOS, armv7
+  compiler: clang
+  env:
+    - IOS=yes
+    - AUTOTOOLS_HOST=armv7-apple-ios
+    - OPENSSL_HOST=ios-cross
+    - IOS_SDK=iPhoneOS
+    - IOS_CPU=armv7s
+    - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
+```
+
+### Tool installation
+
+The second step installs tools needed for OpenSSL, Expat and LDNS. This step is handled in by the script `contrib/ios/install_tools.sh`. The tools include autotools, curl and perl. The installation happens at the `before_script:` stage of Travis.
+
+```
+before_script:
+  - |
+    if [ "$ANDROID" = "yes" ]; then
+      ./contrib/android/install_tools.sh
+    elif [ "$IOS" = "yes" ]; then
+      ./contrib/ios/install_tools.sh
+    fi
+```
+
+### iOS environment
+
+The third step sets the iOS cross-compile environment using the script `contrib/ios/setenv_ios.sh`. The script is `sourced` so the variables in the script are available to the calling shell. The script sets variables like `CC`, `CXX`, `AS` and `AR`; sets `CFLAGS` and `CXXFLAGS`; sets a `sysroot` so iOS headers and libraries are found; and adds the path to the toolchain to `PATH`.
+
+`contrib/ios/setenv_ios.sh` knows which toolchain and architecture to select by inspecting environmental variables set by Travis for the job. In particular, the variables `IOS_SDK` and `IOS_CPU` tell `contrib/ios/setenv_ios.sh` which tools and libraries to select.
+
+The `contrib/ios/setenv_ios.sh` script specifies the tools to use during the cross-compile. For Apple SDKs, the tool names are the same as a desktop. There are no special prefixes for the mobile tools.
+
+```
+CPP=cpp
+CC=clang
+CXX=clang++
+LD=ld
+AS=as
+AR=ar
+RANLIB=ranlib
+STRIP=strip
+```
+
+If you are working from a developer machine you probably already have the necessary tools installed.
+
+### OpenSSL
+
+The fourth step builds OpenSSL. OpenSSL is built for iOS using the scripts `contrib/ios/install_openssl.sh`. The script downloads, configures and installs the latest release version of the OpenSSL libraries. OpenSSL is configured with `--prefix="$IOS_PREFIX"` so the headers are placed in `$IOS_PREFIX/include` directory, and the libraries are placed in the `$IOS_PREFIX/lib` directory.
+
+`IOS_PREFIX` is the value `$HOME/$IOS_SDK-$IOS_CPU`. The scheme handles both iOS SDKs and cpu architectures so the pair receives a unique installation directory. The libraries will be installed in `$HOME/iPhoneOS-armv7s`, `$HOME/iPhoneOS-arm64`, `$HOME/iPhoneSimulator-i386`, etc. For Autotools projects, the appropriate `PKG_CONFIG_PATH` is exported.
+
+`PKG_CONFIG_PATH` is an important variable. It is the userland equivalent to sysroot, and allows Autotools to find non-system headers and libraries for an architecture. Typical `PKG_CONFIG_PATH` are `$HOME/iPhoneOS-armv7s/lib/pkgconfig` and `$HOME/iPhoneOS-arm64/lib/pkgconfig`.
+
+OpenSSL also uses a custom configuration file called `15-ios.conf`. It is a copy of the OpenSSL's project file and located at `contrib/ios/15-ios.conf`. The LDNS version is copied to the OpenSSL source files after unpacking the OpenSSL distribution. The changes mean LDNS's `15-ios.conf` will only work with LDNS and a properly set environment.
+
+OpenSSL is configured with `no-engine`. Engines require dynamic loading so engines are disabled permanently in `15-ios.conf`.
+
+### iOS build
+
+Finally, once OpenSSL are built, then the Travis script configures and builds LDNS. The full recipe looks as follows.
+
+```
+elif [ "$IOS" = "yes" ]; then
+  export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
+  source ./contrib/ios/setenv_ios.sh
+  ./contrib/ios/install_openssl.sh
+  ./contrib/ios/bootstrap_ldns.sh
+  ./configure \
+    --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+    --prefix="$IOS_PREFIX" \
+    --with-ssl="$IOS_PREFIX" --disable-gost \
+    --with-drill --with-examples
+  make -j 2
+  make install
+```
+
+Travis only smoke tests an iOS build using a compile, link and install. The self tests are not run. TODO: figure out how to fire up an simulator, push the tests to the device and run them.
+
+### iOS flags
+
+`contrib/ios/setenv_ios.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. They are taken from Xcode, so we consider them the official flag set. It is important to use the same flags across projects to avoid subtle problems due to mixing and matching different flags.
diff --git a/contrib/ldns/aclocal.m4 b/contrib/ldns/aclocal.m4
index c0685c4acb5788..a18e85956579ce 100644
--- a/contrib/ldns/aclocal.m4
+++ b/contrib/ldns/aclocal.m4
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
diff --git a/contrib/ldns/acx_nlnetlabs.m4 b/contrib/ldns/acx_nlnetlabs.m4
index a6c174f1c4210f..39e92d875331b2 100644
--- a/contrib/ldns/acx_nlnetlabs.m4
+++ b/contrib/ldns/acx_nlnetlabs.m4
@@ -2,7 +2,15 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 34
+# Version 41
+# 2021-07-30 fix for openssl use of lib64 directory.
+# 2021-06-14 fix nonblocking test to use host instead of target for mingw test.
+# 2021-05-17 fix nonblocking socket test from grep on mingw32 to mingw for
+# 	     64bit compatibility.
+# 2021-03-24 fix ACX_FUNC_DEPRECATED to use CPPFLAGS and CFLAGS.
+# 2021-01-05 fix defun for aclocal
+# 2021-01-05 autoconf 2.70 autoupdate and fixes, no AC_TRY_COMPILE
+# 2020-08-24 Use EVP_sha256 instead of HMAC_Update (for openssl-3.0.0).
 # 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
 # 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
 # 2016-01-04 -D_DEFAULT_SOURCE defined with -D_BSD_SOURCE for Linux glibc 2.20
@@ -446,15 +454,12 @@ AC_DEFUN([ACX_CHECK_FORMAT_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" attribute)
 AC_CACHE_VAL(ac_cv_c_format_attribute,
 [ac_cv_c_format_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2)));
-], [
+]], [[
    f ("%s", "str");
-],
-[ac_cv_c_format_attribute="yes"],
-[ac_cv_c_format_attribute="no"])
+]])],[ac_cv_c_format_attribute="yes"],[ac_cv_c_format_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_format_attribute)
@@ -483,14 +488,11 @@ AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" attribute)
 AC_CACHE_VAL(ac_cv_c_unused_attribute,
 [ac_cv_c_unused_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *u __attribute__((unused)));
-], [
+]], [[
    f ("x");
-],
-[ac_cv_c_unused_attribute="yes"],
-[ac_cv_c_unused_attribute="no"])
+]])],[ac_cv_c_unused_attribute="yes"],[ac_cv_c_unused_attribute="no"])
 ])
 
 dnl Setup ATTR_UNUSED config.h parts.
@@ -547,7 +549,7 @@ dnl as a requirement so that is gets called before LIBTOOL
 dnl because libtools 'AC_REQUIRE' names are right after this one, before
 dnl this function contents.
 AC_REQUIRE([ACX_LIBTOOL_C_PRE])
-AC_PROG_LIBTOOL
+LT_INIT
 ])
 
 dnl Detect if u_char type is defined, otherwise define it.
@@ -668,35 +670,41 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             HAVE_SSL=yes
             dnl assume /usr is already in the lib and dynlib paths.
             if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
-                ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+		if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+			LDFLAGS="$LDFLAGS -L$ssldir/lib64"
+			LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib64"
+			ACX_RUNTIME_PATH_ADD([$ssldir/lib64])
+		else
+			LDFLAGS="$LDFLAGS -L$ssldir/lib"
+			LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
+			ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+		fi
             fi
         
-            AC_MSG_CHECKING([for HMAC_Update in -lcrypto])
+            AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
-            AC_TRY_LINK(, [
-                int HMAC_Update(void);
-                (void)HMAC_Update();
-              ], [
+            AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                int EVP_sha256(void);
+                (void)EVP_sha256();
+              ]])],[
                 AC_MSG_RESULT(yes)
-                AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                          [If you have HMAC_Update])
-              ], [
+                AC_DEFINE([HAVE_EVP_SHA256], 1,
+                          [If you have EVP_sha256])
+              ],[
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
                 BAKLIBS="$LIBS"
                 BAKSSLLIBS="$LIBSSL_LIBS"
-                LIBS="$LIBS -lgdi32"
-                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
+		LIBS="$LIBS -lgdi32 -lws2_32"
+		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
-                AC_TRY_LINK([], [
-                    int HMAC_Update(void);
-                    (void)HMAC_Update();
-                  ],[
-                    AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                        [If you have HMAC_Update])
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                    int EVP_sha256(void);
+                    (void)EVP_sha256();
+                  ]])],[
+                    AC_DEFINE([HAVE_EVP_SHA256], 1,
+                        [If you have EVP_sha256])
                     AC_MSG_RESULT(yes) 
                   ],[
                     AC_MSG_RESULT(no)
@@ -705,12 +713,12 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBS="$LIBS -ldl"
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
-                    AC_TRY_LINK([], [
-                        int HMAC_Update(void);
-                        (void)HMAC_Update();
-                      ],[
-                        AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                            [If you have HMAC_Update])
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
+                      ]])],[
+                        AC_DEFINE([HAVE_EVP_SHA256], 1,
+                            [If you have EVP_sha256])
                         AC_MSG_RESULT(yes) 
                       ],[
                         AC_MSG_RESULT(no)
@@ -719,12 +727,12 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                         LIBS="$LIBS -ldl -pthread"
                         LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
                         AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
-                        AC_TRY_LINK([], [
-                            int HMAC_Update(void);
-                            (void)HMAC_Update();
-                          ],[
-                            AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                                [If you have HMAC_Update])
+                        AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
+                          ]])],[
+                            AC_DEFINE([HAVE_EVP_SHA256], 1,
+                                [If you have EVP_sha256])
                             AC_MSG_RESULT(yes) 
                           ],[
                             AC_MSG_RESULT(no)
@@ -749,8 +757,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                    [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check /usr/local/ssl
                             /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -768,8 +775,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check /usr/local/ssl
                                 /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -839,7 +845,11 @@ dnl see if on windows
 if test "$ac_cv_header_windows_h" = "yes"; then
 	AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
 	USE_WINSOCK="1"
-	LIBS="$LIBS -lws2_32"
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
+		:
+	else
+		LIBS="$LIBS -lws2_32"
+	fi
 fi
 ],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
@@ -889,7 +899,7 @@ AC_CACHE_VAL(cv_cc_deprecated_$cache,
 [
 echo '$3' >conftest.c
 echo 'void f(){ $2 }' >>conftest.c
-if test -z "`$CC -c conftest.c 2>&1 | grep deprecated`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then
 eval "cv_cc_deprecated_$cache=no"
 else
 eval "cv_cc_deprecated_$cache=yes"
@@ -915,7 +925,7 @@ dnl a nonblocking socket do not work, a new call to select is necessary.
 AC_DEFUN([ACX_CHECK_NONBLOCKING_BROKEN],
 [
 AC_MSG_CHECKING([if nonblocking sockets work])
-if echo $target | grep mingw32 >/dev/null; then 
+if echo $host | grep mingw >/dev/null; then
 	AC_MSG_RESULT([no (windows)])
 	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
 else
@@ -1057,7 +1067,7 @@ dnl defines MKDIR_HAS_ONE_ARG
 AC_DEFUN([ACX_MKDIR_ONE_ARG],
 [
 AC_MSG_CHECKING([whether mkdir has one arg])
-AC_TRY_COMPILE([
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 #include <stdio.h>
 #include <unistd.h>
 #ifdef HAVE_WINSOCK2_H
@@ -1066,14 +1076,12 @@ AC_TRY_COMPILE([
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
-], [
+]], [[
 	(void)mkdir("directory");
-],
-AC_MSG_RESULT(yes)
+]])],[AC_MSG_RESULT(yes)
 AC_DEFINE(MKDIR_HAS_ONE_ARG, 1, [Define if mkdir has one argument.])
-,
-AC_MSG_RESULT(no)
-)
+],[AC_MSG_RESULT(no)
+])
 ])dnl end of ACX_MKDIR_ONE_ARG
 
 dnl Check for ioctlsocket function. works on mingw32 too.
diff --git a/contrib/ldns/ax_pkg_swig.m4 b/contrib/ldns/ax_pkg_swig.m4
index a1a58dc1e5b9a0..1d467de3d51f5f 100644
--- a/contrib/ldns/ax_pkg_swig.m4
+++ b/contrib/ldns/ax_pkg_swig.m4
@@ -1,5 +1,5 @@
 # ===========================================================================
-#        http://www.gnu.org/software/autoconf-archive/ax_pkg_swig.html
+#       https://www.gnu.org/software/autoconf-archive/ax_pkg_swig.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -32,9 +32,9 @@
 # LICENSE
 #
 #   Copyright (c) 2008 Sebastian Huber <sebastian-huber@web.de>
-#   Copyright (c) 2008 Alan W. Irwin <irwin@beluga.phys.uvic.ca>
+#   Copyright (c) 2008 Alan W. Irwin
 #   Copyright (c) 2008 Rafael Laboissiere <rafael@laboissiere.net>
-#   Copyright (c) 2008 Andrew Collier <colliera@ukzn.ac.za>
+#   Copyright (c) 2008 Andrew Collier
 #   Copyright (c) 2011 Murray Cumming <murrayc@openismus.com>
 #
 #   This program is free software; you can redistribute it and/or modify it
@@ -48,7 +48,7 @@
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -63,11 +63,11 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 8
+#serial 13
 
 AC_DEFUN([AX_PKG_SWIG],[
-        # Ubuntu has swig 2.0 as /usr/bin/swig2.0
-        AC_PATH_PROGS([SWIG],[swig2.0 swig])
+        # Find path to the "swig" executable.
+        AC_PATH_PROGS([SWIG],[swig swig3.0 swig2.0])
         if test -z "$SWIG" ; then
                 m4_ifval([$3],[$3],[:])
         elif test -n "$1" ; then
diff --git a/contrib/ldns/ax_python_devel.m4 b/contrib/ldns/ax_python_devel.m4
index 87e7c8c253bb09..aff04f68ecc470 100644
--- a/contrib/ldns/ax_python_devel.m4
+++ b/contrib/ldns/ax_python_devel.m4
@@ -1,5 +1,5 @@
 # ===========================================================================
-#      http://www.gnu.org/software/autoconf-archive/ax_python_devel.html
+#     https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -12,8 +12,8 @@
 #   in your configure.ac.
 #
 #   This macro checks for Python and tries to get the include path to
-#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LDFLAGS)
-#   output variables. It also exports $(PYTHON_EXTRA_LIBS) and
+#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LIBS) output
+#   variables. It also exports $(PYTHON_EXTRA_LIBS) and
 #   $(PYTHON_EXTRA_LDFLAGS) for embedding Python in your code.
 #
 #   You can search for some particular version of Python by passing a
@@ -52,7 +52,7 @@
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -67,7 +67,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 16
+#serial 21
 
 AU_ALIAS([AC_PYTHON_DEVEL], [AX_PYTHON_DEVEL])
 AC_DEFUN([AX_PYTHON_DEVEL],[
@@ -99,7 +99,7 @@ AC_DEFUN([AX_PYTHON_DEVEL],[
 This version of the AC@&t@_PYTHON_DEVEL macro
 doesn't work properly with versions of Python before
 2.1.0. You may need to re-run configure, setting the
-variables PYTHON_CPPFLAGS, PYTHON_LDFLAGS, PYTHON_SITE_PKG,
+variables PYTHON_CPPFLAGS, PYTHON_LIBS, PYTHON_SITE_PKG,
 PYTHON_EXTRA_LIBS and PYTHON_EXTRA_LDFLAGS by hand.
 Moreover, to disable this check, set PYTHON_NOVERSIONCHECK
 to something else than an empty string.
@@ -137,7 +137,7 @@ variable to configure. See ``configure --help'' for reference.
 	#
 	AC_MSG_CHECKING([for the distutils Python package])
 	ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
-	if test -z "$ac_distutils_result"; then
+	if test $? -eq 0; then
 		AC_MSG_RESULT([yes])
 	else
 		AC_MSG_RESULT([no])
@@ -172,7 +172,7 @@ $ac_distutils_result])
 	# Check for Python library path
 	#
 	AC_MSG_CHECKING([for Python library path])
-	if test -z "$PYTHON_LDFLAGS"; then
+	if test -z "$PYTHON_LIBS"; then
 		# (makes two attempts to ensure we've got a version number
 		# from the interpreter)
 		ac_python_version=`cat<<EOD | $PYTHON -
@@ -227,25 +227,25 @@ EOD`
 		then
 			# use the official shared library
 			ac_python_library=`echo "$ac_python_library" | sed "s/^lib//"`
-			PYTHON_LDFLAGS="-L$ac_python_libdir -l$ac_python_library"
+			PYTHON_LIBS="-L$ac_python_libdir -l$ac_python_library"
 		else
 			# old way: use libpython from python_configdir
 			ac_python_libdir=`$PYTHON -c \
 			  "from distutils.sysconfig import get_python_lib as f; \
 			  import os; \
 			  print (os.path.join(f(plat_specific=1, standard_lib=1), 'config'));"`
-			PYTHON_LDFLAGS="-L$ac_python_libdir -lpython$ac_python_version"
+			PYTHON_LIBS="-L$ac_python_libdir -lpython$ac_python_version"
 		fi
 
-		if test -z "PYTHON_LDFLAGS"; then
+		if test -z "PYTHON_LIBS"; then
 			AC_MSG_ERROR([
   Cannot determine location of your Python DSO. Please check it was installed with
-  dynamic libraries enabled, or try setting PYTHON_LDFLAGS by hand.
+  dynamic libraries enabled, or try setting PYTHON_LIBS by hand.
 			])
 		fi
 	fi
-	AC_MSG_RESULT([$PYTHON_LDFLAGS])
-	AC_SUBST([PYTHON_LDFLAGS])
+	AC_MSG_RESULT([$PYTHON_LIBS])
+	AC_SUBST([PYTHON_LIBS])
 
 	#
 	# Check for site packages
@@ -265,7 +265,7 @@ EOD`
 	if test -z "$PYTHON_EXTRA_LIBS"; then
 	   PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
                 conf = distutils.sysconfig.get_config_var; \
-                print (conf('LIBS'))"`
+                print (conf('LIBS') + ' ' + conf('SYSLIBS'))"`
 	fi
 	AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
 	AC_SUBST(PYTHON_EXTRA_LIBS)
@@ -288,8 +288,10 @@ EOD`
 	AC_MSG_CHECKING([consistency of all components of python development environment])
 	# save current global flags
 	ac_save_LIBS="$LIBS"
+	ac_save_LDFLAGS="$LDFLAGS"
 	ac_save_CPPFLAGS="$CPPFLAGS"
-	LIBS="$ac_save_LIBS $PYTHON_LDFLAGS $PYTHON_EXTRA_LDFLAGS $PYTHON_EXTRA_LIBS"
+	LIBS="$ac_save_LIBS $PYTHON_LIBS $PYTHON_EXTRA_LIBS $PYTHON_EXTRA_LIBS"
+	LDFLAGS="$ac_save_LDFLAGS $PYTHON_EXTRA_LDFLAGS"
 	CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
 	AC_LANG_PUSH([C])
 	AC_LINK_IFELSE([
@@ -300,6 +302,7 @@ EOD`
 	# turn back to default flags
 	CPPFLAGS="$ac_save_CPPFLAGS"
 	LIBS="$ac_save_LIBS"
+	LDFLAGS="$ac_save_LDFLAGS"
 
 	AC_MSG_RESULT([$pythonexists])
 
@@ -307,8 +310,8 @@ EOD`
 	   AC_MSG_FAILURE([
   Could not link test program to Python. Maybe the main Python library has been
   installed in some non-standard library path. If so, pass it to configure,
-  via the LDFLAGS environment variable.
-  Example: ./configure LDFLAGS="-L/usr/non-standard-path/python/lib"
+  via the LIBS environment variable.
+  Example: ./configure LIBS="-L/usr/non-standard-path/python/lib"
   ============================================================================
    ERROR!
    You probably have to install the development version of the Python package
diff --git a/contrib/ldns/buffer.c b/contrib/ldns/buffer.c
index e008831fcc3717..8f6aab59eaac82 100644
--- a/contrib/ldns/buffer.c
+++ b/contrib/ldns/buffer.c
@@ -63,6 +63,7 @@ ldns_buffer_set_capacity(ldns_buffer *buffer, size_t capacity)
 	
 	ldns_buffer_invariant(buffer);
 	assert(buffer->_position <= capacity);
+	assert(!buffer->_fixed);
 
 	data = (uint8_t *) LDNS_XREALLOC(buffer->_data, uint8_t, capacity);
 	if (!data) {
@@ -79,7 +80,6 @@ bool
 ldns_buffer_reserve(ldns_buffer *buffer, size_t amount)
 {
 	ldns_buffer_invariant(buffer);
-	assert(!buffer->_fixed);
 	if (buffer->_capacity < buffer->_position + amount) {
 		size_t new_capacity = buffer->_capacity * 3 / 2;
 
diff --git a/contrib/ldns/config.guess b/contrib/ldns/config.guess
index 0967f2afa92a80..1817bdce90dc4d 100755
--- a/contrib/ldns/config.guess
+++ b/contrib/ldns/config.guess
@@ -1,12 +1,14 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2016 Free Software Foundation, Inc.
+#   Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2016-04-02'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-05-25'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -15,7 +17,7 @@ timestamp='2016-04-02'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -27,11 +29,19 @@ timestamp='2016-04-02'
 # Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
 #
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+# https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
 #
 # Please send patches to <config-patches@gnu.org>.
 
 
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX.  However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
+
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
@@ -39,7 +49,7 @@ Usage: $0 [OPTION]
 
 Output the configuration name of the system \`$me' is run on.
 
-Operation modes:
+Options:
   -h, --help         print this help, then exit
   -t, --time-stamp   print date of last modification, then exit
   -v, --version      print version number, then exit
@@ -50,7 +60,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2016 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -84,7 +94,8 @@ if test $# != 0; then
   exit 1
 fi
 
-trap 'exit 1' 1 2 15
+# Just in case it came from the environment.
+GUESS=
 
 # CC_FOR_BUILD -- compiler used by this script. Note that the use of a
 # compiler to aid in system detection is discouraged as it requires
@@ -96,66 +107,90 @@ trap 'exit 1' 1 2 15
 
 # Portable tmp directory creation inspired by the Autoconf team.
 
-set_cc_for_build='
-trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
-trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
-: ${TMPDIR=/tmp} ;
- { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
- { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
- { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
- { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
-dummy=$tmp/dummy ;
-tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
-case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int x;" > $dummy.c ;
-	for c in cc gcc c89 c99 ; do
-	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
-	     CC_FOR_BUILD="$c"; break ;
-	  fi ;
-	done ;
-	if test x"$CC_FOR_BUILD" = x ; then
-	  CC_FOR_BUILD=no_compiler_found ;
-	fi
-	;;
- ,,*)   CC_FOR_BUILD=$CC ;;
- ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
-esac ; set_cc_for_build= ;'
+tmp=
+# shellcheck disable=SC2172
+trap 'test -z "$tmp" || rm -fr "$tmp"' 0 1 2 13 15
+
+set_cc_for_build() {
+    # prevent multiple calls if $tmp is already set
+    test "$tmp" && return 0
+    : "${TMPDIR=/tmp}"
+    # shellcheck disable=SC2039,SC3028
+    { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
+	{ test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir "$tmp" 2>/dev/null) ; } ||
+	{ tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir "$tmp" 2>/dev/null) && echo "Warning: creating insecure temp directory" >&2 ; } ||
+	{ echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; }
+    dummy=$tmp/dummy
+    case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in
+	,,)    echo "int x;" > "$dummy.c"
+	       for driver in cc gcc c89 c99 ; do
+		   if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
+		       CC_FOR_BUILD=$driver
+		       break
+		   fi
+	       done
+	       if test x"$CC_FOR_BUILD" = x ; then
+		   CC_FOR_BUILD=no_compiler_found
+	       fi
+	       ;;
+	,,*)   CC_FOR_BUILD=$CC ;;
+	,*,*)  CC_FOR_BUILD=$HOST_CC ;;
+    esac
+}
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 1994-08-24)
-if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
+if test -f /.attbin/uname ; then
 	PATH=$PATH:/.attbin ; export PATH
 fi
 
 UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
 UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
-UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
+UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
-case "${UNAME_SYSTEM}" in
+case $UNAME_SYSTEM in
 Linux|GNU|GNU/*)
-	# If the system lacks a compiler, then just pick glibc.
-	# We could probably try harder.
-	LIBC=gnu
+	LIBC=unknown
 
-	eval $set_cc_for_build
-	cat <<-EOF > $dummy.c
+	set_cc_for_build
+	cat <<-EOF > "$dummy.c"
 	#include <features.h>
 	#if defined(__UCLIBC__)
 	LIBC=uclibc
 	#elif defined(__dietlibc__)
 	LIBC=dietlibc
-	#else
+	#elif defined(__GLIBC__)
 	LIBC=gnu
+	#else
+	#include <stdarg.h>
+	/* First heuristic to detect musl libc.  */
+	#ifdef __DEFINED_va_list
+	LIBC=musl
+	#endif
 	#endif
 	EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+	cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+	eval "$cc_set_libc"
+
+	# Second heuristic to detect musl libc.
+	if [ "$LIBC" = unknown ] &&
+	   command -v ldd >/dev/null &&
+	   ldd --version 2>&1 | grep -q ^musl; then
+		LIBC=musl
+	fi
+
+	# If the system lacks a compiler, then just pick glibc.
+	# We could probably try harder.
+	if [ "$LIBC" = unknown ]; then
+		LIBC=gnu
+	fi
 	;;
 esac
 
 # Note: order is significant - the case branches are not exclusive.
 
-case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
+case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in
     *:NetBSD:*:*)
 	# NetBSD (nbsd) targets should (where applicable) match one or
 	# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
@@ -167,29 +202,32 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	#
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name.  We always set it to "unknown".
-	sysctl="sysctl -n hw.machine_arch"
 	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
-	    /sbin/$sysctl 2>/dev/null || \
-	    /usr/sbin/$sysctl 2>/dev/null || \
+	    /sbin/sysctl -n hw.machine_arch 2>/dev/null || \
+	    /usr/sbin/sysctl -n hw.machine_arch 2>/dev/null || \
 	    echo unknown)`
-	case "${UNAME_MACHINE_ARCH}" in
+	case $UNAME_MACHINE_ARCH in
+	    aarch64eb) machine=aarch64_be-unknown ;;
 	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
 	    sh5el) machine=sh5le-unknown ;;
 	    earmv*)
-		arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
-		endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'`
+		arch=`echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
+		endian=`echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*\(eb\)$,\1,p'`
 		machine=${arch}${endian}-unknown
 		;;
-	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
+	    *) machine=$UNAME_MACHINE_ARCH-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
-	# to ELF recently, or will in the future.
-	case "${UNAME_MACHINE_ARCH}" in
-	    arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax)
-		eval $set_cc_for_build
+	# to ELF recently (or will in the future) and ABI.
+	case $UNAME_MACHINE_ARCH in
+	    earm*)
+		os=netbsdelf
+		;;
+	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
+		set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
 			| grep -q __ELF__
 		then
@@ -205,10 +243,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		;;
 	esac
 	# Determine ABI tags.
-	case "${UNAME_MACHINE_ARCH}" in
+	case $UNAME_MACHINE_ARCH in
 	    earm*)
 		expr='s/^earmv[0-9]/-eabi/;s/eb$//'
-		abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"`
+		abi=`echo "$UNAME_MACHINE_ARCH" | sed -e "$expr"`
 		;;
 	esac
 	# The OS release
@@ -216,47 +254,68 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# thus, need a distinct triplet. However, they do not need
 	# kernel version information, so it can be replaced with a
 	# suitable tag, in the style of linux-gnu.
-	case "${UNAME_VERSION}" in
+	case $UNAME_VERSION in
 	    Debian*)
 		release='-gnu'
 		;;
 	    *)
-		release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
+		release=`echo "$UNAME_RELEASE" | sed -e 's/[-_].*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "${machine}-${os}${release}${abi}"
-	exit ;;
+	GUESS=$machine-${os}${release}${abi-}
+	;;
     *:Bitrig:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-bitrig$UNAME_RELEASE
+	;;
     *:OpenBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-openbsd$UNAME_RELEASE
+	;;
+    *:SecBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/SecBSD.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-secbsd$UNAME_RELEASE
+	;;
     *:LibertyBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-libertybsd$UNAME_RELEASE
+	;;
+    *:MidnightBSD:*:*)
+	GUESS=$UNAME_MACHINE-unknown-midnightbsd$UNAME_RELEASE
+	;;
     *:ekkoBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-ekkobsd$UNAME_RELEASE
+	;;
     *:SolidBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-solidbsd$UNAME_RELEASE
+	;;
+    *:OS108:*:*)
+	GUESS=$UNAME_MACHINE-unknown-os108_$UNAME_RELEASE
+	;;
     macppc:MirBSD:*:*)
-	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-unknown-mirbsd$UNAME_RELEASE
+	;;
     *:MirBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-mirbsd$UNAME_RELEASE
+	;;
     *:Sortix:*:*)
-	echo ${UNAME_MACHINE}-unknown-sortix
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sortix
+	;;
+    *:Twizzler:*:*)
+	GUESS=$UNAME_MACHINE-unknown-twizzler
+	;;
+    *:Redox:*:*)
+	GUESS=$UNAME_MACHINE-unknown-redox
+	;;
+    mips:OSF1:*.*)
+	GUESS=mips-dec-osf1
+	;;
     alpha:OSF1:*:*)
+	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
+	trap '' 0
 	case $UNAME_RELEASE in
 	*4.0)
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
@@ -270,7 +329,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# covers most systems running today.  This code pipes the CPU
 	# types through head -n 1, so we only detect the type of CPU 0.
 	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
-	case "$ALPHA_CPU_TYPE" in
+	case $ALPHA_CPU_TYPE in
 	    "EV4 (21064)")
 		UNAME_MACHINE=alpha ;;
 	    "EV4.5 (21064)")
@@ -307,126 +366,121 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
-	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
-	exitcode=$?
-	trap '' 0
-	exit $exitcode ;;
-    Alpha\ *:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# Should we change UNAME_MACHINE based on the output of uname instead
-	# of the specific Alpha model?
-	echo alpha-pc-interix
-	exit ;;
-    21064:Windows_NT:50:3)
-	echo alpha-dec-winnt3.5
-	exit ;;
+	OSF_REL=`echo "$UNAME_RELEASE" | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
+	GUESS=$UNAME_MACHINE-dec-osf$OSF_REL
+	;;
     Amiga*:UNIX_System_V:4.0:*)
-	echo m68k-unknown-sysv4
-	exit ;;
+	GUESS=m68k-unknown-sysv4
+	;;
     *:[Aa]miga[Oo][Ss]:*:*)
-	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-amigaos
+	;;
     *:[Mm]orph[Oo][Ss]:*:*)
-	echo ${UNAME_MACHINE}-unknown-morphos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-morphos
+	;;
     *:OS/390:*:*)
-	echo i370-ibm-openedition
-	exit ;;
+	GUESS=i370-ibm-openedition
+	;;
     *:z/VM:*:*)
-	echo s390-ibm-zvmoe
-	exit ;;
+	GUESS=s390-ibm-zvmoe
+	;;
     *:OS400:*:*)
-	echo powerpc-ibm-os400
-	exit ;;
+	GUESS=powerpc-ibm-os400
+	;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
-	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit ;;
+	GUESS=arm-acorn-riscix$UNAME_RELEASE
+	;;
     arm*:riscos:*:*|arm*:RISCOS:*:*)
-	echo arm-unknown-riscos
-	exit ;;
+	GUESS=arm-unknown-riscos
+	;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
-	echo hppa1.1-hitachi-hiuxmpp
-	exit ;;
+	GUESS=hppa1.1-hitachi-hiuxmpp
+	;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
-	if test "`(/bin/universe) 2>/dev/null`" = att ; then
-		echo pyramid-pyramid-sysv3
-	else
-		echo pyramid-pyramid-bsd
-	fi
-	exit ;;
+	case `(/bin/universe) 2>/dev/null` in
+	    att) GUESS=pyramid-pyramid-sysv3 ;;
+	    *)   GUESS=pyramid-pyramid-bsd   ;;
+	esac
+	;;
     NILE*:*:*:dcosx)
-	echo pyramid-pyramid-svr4
-	exit ;;
+	GUESS=pyramid-pyramid-svr4
+	;;
     DRS?6000:unix:4.0:6*)
-	echo sparc-icl-nx6
-	exit ;;
+	GUESS=sparc-icl-nx6
+	;;
     DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
 	case `/usr/bin/uname -p` in
-	    sparc) echo sparc-icl-nx7; exit ;;
-	esac ;;
+	    sparc) GUESS=sparc-icl-nx7 ;;
+	esac
+	;;
     s390x:SunOS:*:*)
-	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=$UNAME_MACHINE-ibm-solaris2$SUN_REL
+	;;
     sun4H:SunOS:5.*:*)
-	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=sparc-hal-solaris2$SUN_REL
+	;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
-	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=sparc-sun-solaris2$SUN_REL
+	;;
     i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
-	echo i386-pc-auroraux${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-pc-auroraux$UNAME_RELEASE
+	;;
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
-	eval $set_cc_for_build
+	set_cc_for_build
 	SUN_ARCH=i386
 	# If there is a compiler, see if it is configured for 64-bit objects.
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
 	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
 	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		(CCOPTS="" $CC_FOR_BUILD -m64 -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
 		SUN_ARCH=x86_64
 	    fi
 	fi
-	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=$SUN_ARCH-pc-solaris2$SUN_REL
+	;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
-	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=sparc-sun-solaris3$SUN_REL
+	;;
     sun4*:SunOS:*:*)
-	case "`/usr/bin/arch -k`" in
+	case `/usr/bin/arch -k` in
 	    Series*|S4*)
 		UNAME_RELEASE=`uname -v`
 		;;
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
-	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'`
+	GUESS=sparc-sun-sunos$SUN_REL
+	;;
     sun3*:SunOS:*:*)
-	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-sun-sunos$UNAME_RELEASE
+	;;
     sun*:*:4.2BSD:*)
 	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
-	case "`/bin/arch`" in
+	test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3
+	case `/bin/arch` in
 	    sun3)
-		echo m68k-sun-sunos${UNAME_RELEASE}
+		GUESS=m68k-sun-sunos$UNAME_RELEASE
 		;;
 	    sun4)
-		echo sparc-sun-sunos${UNAME_RELEASE}
+		GUESS=sparc-sun-sunos$UNAME_RELEASE
 		;;
 	esac
-	exit ;;
+	;;
     aushp:SunOS:*:*)
-	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-auspex-sunos$UNAME_RELEASE
+	;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -436,44 +490,44 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     # MiNT.  But MiNT is downward compatible to TOS, so this should
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-	echo m68k-milan-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-milan-mint$UNAME_RELEASE
+	;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-	echo m68k-hades-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-hades-mint$UNAME_RELEASE
+	;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-	echo m68k-unknown-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-unknown-mint$UNAME_RELEASE
+	;;
     m68k:machten:*:*)
-	echo m68k-apple-machten${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-apple-machten$UNAME_RELEASE
+	;;
     powerpc:machten:*:*)
-	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-apple-machten$UNAME_RELEASE
+	;;
     RISC*:Mach:*:*)
-	echo mips-dec-mach_bsd4.3
-	exit ;;
+	GUESS=mips-dec-mach_bsd4.3
+	;;
     RISC*:ULTRIX:*:*)
-	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-dec-ultrix$UNAME_RELEASE
+	;;
     VAX*:ULTRIX*:*:*)
-	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit ;;
+	GUESS=vax-dec-ultrix$UNAME_RELEASE
+	;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
-	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit ;;
+	GUESS=clipper-intergraph-clix$UNAME_RELEASE
+	;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	sed 's/^	//' << EOF > "$dummy.c"
 #ifdef __cplusplus
 #include <stdio.h>  /* for printf() prototype */
 	int main (int argc, char *argv[]) {
@@ -482,95 +536,96 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 #endif
 	#if defined (host_mips) && defined (MIPSEB)
 	#if defined (SYSTYPE_SYSV)
-	  printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%ssysv\\n", argv[1]); exit (0);
 	#endif
 	#if defined (SYSTYPE_SVR4)
-	  printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%ssvr4\\n", argv[1]); exit (0);
 	#endif
 	#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
-	  printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
+	  printf ("mips-mips-riscos%sbsd\\n", argv[1]); exit (0);
 	#endif
 	#endif
 	  exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD -o $dummy $dummy.c &&
-	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
-	  SYSTEM_NAME=`$dummy $dummyarg` &&
+	$CC_FOR_BUILD -o "$dummy" "$dummy.c" &&
+	  dummyarg=`echo "$UNAME_RELEASE" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+	  SYSTEM_NAME=`"$dummy" "$dummyarg"` &&
 	    { echo "$SYSTEM_NAME"; exit; }
-	echo mips-mips-riscos${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-mips-riscos$UNAME_RELEASE
+	;;
     Motorola:PowerMAX_OS:*:*)
-	echo powerpc-motorola-powermax
-	exit ;;
+	GUESS=powerpc-motorola-powermax
+	;;
     Motorola:*:4.3:PL8-*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
     Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
     Night_Hawk:Power_UNIX:*:*)
-	echo powerpc-harris-powerunix
-	exit ;;
+	GUESS=powerpc-harris-powerunix
+	;;
     m88k:CX/UX:7*:*)
-	echo m88k-harris-cxux7
-	exit ;;
+	GUESS=m88k-harris-cxux7
+	;;
     m88k:*:4*:R4*)
-	echo m88k-motorola-sysv4
-	exit ;;
+	GUESS=m88k-motorola-sysv4
+	;;
     m88k:*:3*:R3*)
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
     AViiON:dgux:*:*)
 	# DG/UX returns AViiON for all architectures
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
+	if test "$UNAME_PROCESSOR" = mc88100 || test "$UNAME_PROCESSOR" = mc88110
 	then
-	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
-	       [ ${TARGET_BINARY_INTERFACE}x = x ]
+	    if test "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx || \
+	       test "$TARGET_BINARY_INTERFACE"x = x
 	    then
-		echo m88k-dg-dgux${UNAME_RELEASE}
+		GUESS=m88k-dg-dgux$UNAME_RELEASE
 	    else
-		echo m88k-dg-dguxbcs${UNAME_RELEASE}
+		GUESS=m88k-dg-dguxbcs$UNAME_RELEASE
 	    fi
 	else
-	    echo i586-dg-dgux${UNAME_RELEASE}
+	    GUESS=i586-dg-dgux$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
-	echo m88k-dolphin-sysv3
-	exit ;;
+	GUESS=m88k-dolphin-sysv3
+	;;
     M88*:*:R3*:*)
 	# Delta 88k system running SVR3
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
-	echo m88k-tektronix-sysv3
-	exit ;;
+	GUESS=m88k-tektronix-sysv3
+	;;
     Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
-	echo m68k-tektronix-bsd
-	exit ;;
+	GUESS=m68k-tektronix-bsd
+	;;
     *:IRIX*:*:*)
-	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit ;;
+	IRIX_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/g'`
+	GUESS=mips-sgi-irix$IRIX_REL
+	;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
-	exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
+	GUESS=romp-ibm-aix    # uname -m gives an 8 hex-code CPU id
+	;;                    # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
-	echo i386-ibm-aix
-	exit ;;
+	GUESS=i386-ibm-aix
+	;;
     ia64:AIX:*:*)
-	if [ -x /usr/bin/oslevel ] ; then
+	if test -x /usr/bin/oslevel ; then
 		IBM_REV=`/usr/bin/oslevel`
 	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-aix$IBM_REV
+	;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
-		eval $set_cc_for_build
-		sed 's/^		//' << EOF >$dummy.c
+		set_cc_for_build
+		sed 's/^		//' << EOF > "$dummy.c"
 		#include <sys/systemcfg.h>
 
 		main()
@@ -581,77 +636,77 @@ EOF
 			exit(0);
 			}
 EOF
-		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+		if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"`
 		then
-			echo "$SYSTEM_NAME"
+			GUESS=$SYSTEM_NAME
 		else
-			echo rs6000-ibm-aix3.2.5
+			GUESS=rs6000-ibm-aix3.2.5
 		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
-		echo rs6000-ibm-aix3.2.4
+		GUESS=rs6000-ibm-aix3.2.4
 	else
-		echo rs6000-ibm-aix3.2
+		GUESS=rs6000-ibm-aix3.2
 	fi
-	exit ;;
+	;;
     *:AIX:*:[4567])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
-	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
+	if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
 		IBM_ARCH=powerpc
 	fi
-	if [ -x /usr/bin/lslpp ] ; then
-		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc |
+	if test -x /usr/bin/lslpp ; then
+		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | \
 			   awk -F: '{ print $3 }' | sed s/[0-9]*$/0/`
 	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit ;;
+	GUESS=$IBM_ARCH-ibm-aix$IBM_REV
+	;;
     *:AIX:*:*)
-	echo rs6000-ibm-aix
-	exit ;;
-    ibmrt:4.4BSD:*|romp-ibm:BSD:*)
-	echo romp-ibm-bsd4.4
-	exit ;;
+	GUESS=rs6000-ibm-aix
+	;;
+    ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*)
+	GUESS=romp-ibm-bsd4.4
+	;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
-	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-	exit ;;                             # report: romp-ibm BSD 4.3
+	GUESS=romp-ibm-bsd$UNAME_RELEASE    # 4.3 with uname added to
+	;;                                  # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
-	echo rs6000-bull-bosx
-	exit ;;
+	GUESS=rs6000-bull-bosx
+	;;
     DPX/2?00:B.O.S.:*:*)
-	echo m68k-bull-sysv3
-	exit ;;
+	GUESS=m68k-bull-sysv3
+	;;
     9000/[34]??:4.3bsd:1.*:*)
-	echo m68k-hp-bsd
-	exit ;;
+	GUESS=m68k-hp-bsd
+	;;
     hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
-	echo m68k-hp-bsd4.4
-	exit ;;
+	GUESS=m68k-hp-bsd4.4
+	;;
     9000/[34678]??:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
-	case "${UNAME_MACHINE}" in
-	    9000/31? )            HP_ARCH=m68000 ;;
-	    9000/[34]?? )         HP_ARCH=m68k ;;
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*.[0B]*//'`
+	case $UNAME_MACHINE in
+	    9000/31?)            HP_ARCH=m68000 ;;
+	    9000/[34]??)         HP_ARCH=m68k ;;
 	    9000/[678][0-9][0-9])
-		if [ -x /usr/bin/getconf ]; then
+		if test -x /usr/bin/getconf; then
 		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
 		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-		    case "${sc_cpu_version}" in
+		    case $sc_cpu_version in
 		      523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
 		      528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		      532)                      # CPU_PA_RISC2_0
-			case "${sc_kernel_bits}" in
+			case $sc_kernel_bits in
 			  32) HP_ARCH=hppa2.0n ;;
 			  64) HP_ARCH=hppa2.0w ;;
 			  '') HP_ARCH=hppa2.0 ;;   # HP-UX 10.20
 			esac ;;
 		    esac
 		fi
-		if [ "${HP_ARCH}" = "" ]; then
-		    eval $set_cc_for_build
-		    sed 's/^		//' << EOF >$dummy.c
+		if test "$HP_ARCH" = ""; then
+		    set_cc_for_build
+		    sed 's/^		//' << EOF > "$dummy.c"
 
 		#define _HPUX_SOURCE
 		#include <stdlib.h>
@@ -684,13 +739,13 @@ EOF
 		    exit (0);
 		}
 EOF
-		    (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=`"$dummy"`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
-	if [ ${HP_ARCH} = hppa2.0w ]
+	if test "$HP_ARCH" = hppa2.0w
 	then
-	    eval $set_cc_for_build
+	    set_cc_for_build
 
 	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
 	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
@@ -709,15 +764,15 @@ EOF
 		HP_ARCH=hppa64
 	    fi
 	fi
-	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit ;;
+	GUESS=$HP_ARCH-hp-hpux$HPUX_REV
+	;;
     ia64:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
-	echo ia64-hp-hpux${HPUX_REV}
-	exit ;;
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*.[0B]*//'`
+	GUESS=ia64-hp-hpux$HPUX_REV
+	;;
     3050*:HI-UX:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	sed 's/^	//' << EOF > "$dummy.c"
 	#include <unistd.h>
 	int
 	main ()
@@ -742,38 +797,38 @@ EOF
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+	$CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` &&
 		{ echo "$SYSTEM_NAME"; exit; }
-	echo unknown-hitachi-hiuxwe2
-	exit ;;
-    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
-	echo hppa1.1-hp-bsd
-	exit ;;
+	GUESS=unknown-hitachi-hiuxwe2
+	;;
+    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:*)
+	GUESS=hppa1.1-hp-bsd
+	;;
     9000/8??:4.3bsd:*:*)
-	echo hppa1.0-hp-bsd
-	exit ;;
+	GUESS=hppa1.0-hp-bsd
+	;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
-	echo hppa1.0-hp-mpeix
-	exit ;;
-    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
-	echo hppa1.1-hp-osf
-	exit ;;
+	GUESS=hppa1.0-hp-mpeix
+	;;
+    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:*)
+	GUESS=hppa1.1-hp-osf
+	;;
     hp8??:OSF1:*:*)
-	echo hppa1.0-hp-osf
-	exit ;;
+	GUESS=hppa1.0-hp-osf
+	;;
     i*86:OSF1:*:*)
-	if [ -x /usr/sbin/sysversion ] ; then
-	    echo ${UNAME_MACHINE}-unknown-osf1mk
+	if test -x /usr/sbin/sysversion ; then
+	    GUESS=$UNAME_MACHINE-unknown-osf1mk
 	else
-	    echo ${UNAME_MACHINE}-unknown-osf1
+	    GUESS=$UNAME_MACHINE-unknown-osf1
 	fi
-	exit ;;
+	;;
     parisc*:Lites*:*:*)
-	echo hppa1.1-hp-lites
-	exit ;;
+	GUESS=hppa1.1-hp-lites
+	;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
-	echo c1-convex-bsd
-	exit ;;
+	GUESS=c1-convex-bsd
+	;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
@@ -781,139 +836,148 @@ EOF
 	fi
 	exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
-	echo c34-convex-bsd
-	exit ;;
+	GUESS=c34-convex-bsd
+	;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
-	echo c38-convex-bsd
-	exit ;;
+	GUESS=c38-convex-bsd
+	;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
-	echo c4-convex-bsd
-	exit ;;
+	GUESS=c4-convex-bsd
+	;;
     CRAY*Y-MP:*:*:*)
-	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'`
+	GUESS=ymp-cray-unicos$CRAY_REL
+	;;
     CRAY*[A-Z]90:*:*:*)
-	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
+	echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \
 	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
 	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	      -e 's/\.[^.]*$/.X/'
 	exit ;;
     CRAY*TS:*:*:*)
-	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'`
+	GUESS=t90-cray-unicos$CRAY_REL
+	;;
     CRAY*T3E:*:*:*)
-	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'`
+	GUESS=alphaev5-cray-unicosmk$CRAY_REL
+	;;
     CRAY*SV1:*:*:*)
-	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'`
+	GUESS=sv1-cray-unicos$CRAY_REL
+	;;
     *:UNICOS/mp:*:*)
-	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'`
+	GUESS=craynv-cray-unicosmp$CRAY_REL
+	;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | sed -e 's/ /_/'`
+	GUESS=${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
     5000:UNIX_System_V:4.*:*)
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
-	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
+	GUESS=sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
-	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-bsdi$UNAME_RELEASE
+	;;
     sparc*:BSD/OS:*:*)
-	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-unknown-bsdi$UNAME_RELEASE
+	;;
     *:BSD/OS:*:*)
-	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-bsdi$UNAME_RELEASE
+	;;
+    arm:FreeBSD:*:*)
+	UNAME_PROCESSOR=`uname -p`
+	set_cc_for_build
+	if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
+	    | grep -q __ARM_PCS_VFP
+	then
+	    FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
+	    GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabi
+	else
+	    FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
+	    GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabihf
+	fi
+	;;
     *:FreeBSD:*:*)
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	case ${UNAME_PROCESSOR} in
+	case $UNAME_PROCESSOR in
 	    amd64)
-		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
-	    *)
-		echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+		UNAME_PROCESSOR=x86_64 ;;
+	    i386)
+		UNAME_PROCESSOR=i586 ;;
 	esac
-	exit ;;
+	FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
+	GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL
+	;;
     i*:CYGWIN*:*)
-	echo ${UNAME_MACHINE}-pc-cygwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-cygwin
+	;;
     *:MINGW64*:*)
-	echo ${UNAME_MACHINE}-pc-mingw64
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw64
+	;;
     *:MINGW*:*)
-	echo ${UNAME_MACHINE}-pc-mingw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw32
+	;;
     *:MSYS*:*)
-	echo ${UNAME_MACHINE}-pc-msys
-	exit ;;
-    i*:windows32*:*)
-	# uname -m includes "-pc" on this system.
-	echo ${UNAME_MACHINE}-mingw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-msys
+	;;
     i*:PW*:*)
-	echo ${UNAME_MACHINE}-pc-pw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-pw32
+	;;
+    *:SerenityOS:*:*)
+        GUESS=$UNAME_MACHINE-pc-serenity
+        ;;
     *:Interix*:*)
-	case ${UNAME_MACHINE} in
+	case $UNAME_MACHINE in
 	    x86)
-		echo i586-pc-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=i586-pc-interix$UNAME_RELEASE
+		;;
 	    authenticamd | genuineintel | EM64T)
-		echo x86_64-unknown-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=x86_64-unknown-interix$UNAME_RELEASE
+		;;
 	    IA64)
-		echo ia64-unknown-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=ia64-unknown-interix$UNAME_RELEASE
+		;;
 	esac ;;
-    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
-	echo i${UNAME_MACHINE}-pc-mks
-	exit ;;
-    8664:Windows_NT:*)
-	echo x86_64-pc-mks
-	exit ;;
-    i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
-	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i586-pc-interix
-	exit ;;
     i*:UWIN*:*)
-	echo ${UNAME_MACHINE}-pc-uwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-uwin
+	;;
     amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
-	echo x86_64-unknown-cygwin
-	exit ;;
-    p*:CYGWIN*:*)
-	echo powerpcle-unknown-cygwin
-	exit ;;
+	GUESS=x86_64-pc-cygwin
+	;;
     prep*:SunOS:5.*:*)
-	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'`
+	GUESS=powerpcle-unknown-solaris2$SUN_REL
+	;;
     *:GNU:*:*)
 	# the GNU system
-	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit ;;
+	GNU_ARCH=`echo "$UNAME_MACHINE" | sed -e 's,[-/].*$,,'`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's,/.*$,,'`
+	GUESS=$GNU_ARCH-unknown-$LIBC$GNU_REL
+	;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
-	exit ;;
-    i*86:Minix:*:*)
-	echo ${UNAME_MACHINE}-pc-minix
-	exit ;;
+	GNU_SYS=`echo "$UNAME_SYSTEM" | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
+	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
+	;;
+    *:Minix:*:*)
+	GUESS=$UNAME_MACHINE-unknown-minix
+	;;
     aarch64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
+	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' /proc/cpuinfo 2>/dev/null` in
 	  EV5)   UNAME_MACHINE=alphaev5 ;;
 	  EV56)  UNAME_MACHINE=alphaev56 ;;
 	  PCA56) UNAME_MACHINE=alphapca56 ;;
@@ -924,177 +988,236 @@ EOF
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
 	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
-    arc:Linux:*:* | arceb:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+    arc:Linux:*:* | arceb:Linux:*:* | arc32:Linux:*:* | arc64:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     arm*:Linux:*:*)
-	eval $set_cc_for_build
+	set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_EABI__
 	then
-	    echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	    GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	else
 	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	    then
-		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabi
 	    else
-		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabihf
 	    fi
 	fi
-	exit ;;
+	;;
     avr32*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     cris:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
     crisv32:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
     e2k:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     frv:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     hexagon:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     i*86:Linux:*:*)
-	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBC
+	;;
     ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     k1om:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     m32r*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     mips:Linux:*:* | mips64:Linux:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	IS_GLIBC=0
+	test x"${LIBC}" = xgnu && IS_GLIBC=1
+	sed 's/^	//' << EOF > "$dummy.c"
 	#undef CPU
-	#undef ${UNAME_MACHINE}
-	#undef ${UNAME_MACHINE}el
+	#undef mips
+	#undef mipsel
+	#undef mips64
+	#undef mips64el
+	#if ${IS_GLIBC} && defined(_ABI64)
+	LIBCABI=gnuabi64
+	#else
+	#if ${IS_GLIBC} && defined(_ABIN32)
+	LIBCABI=gnuabin32
+	#else
+	LIBCABI=${LIBC}
+	#endif
+	#endif
+
+	#if ${IS_GLIBC} && defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6
+	CPU=mipsisa64r6
+	#else
+	#if ${IS_GLIBC} && !defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6
+	CPU=mipsisa32r6
+	#else
+	#if defined(__mips64)
+	CPU=mips64
+	#else
+	CPU=mips
+	#endif
+	#endif
+	#endif
+
 	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=${UNAME_MACHINE}el
+	MIPS_ENDIAN=el
 	#else
 	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=${UNAME_MACHINE}
+	MIPS_ENDIAN=
 	#else
-	CPU=
+	MIPS_ENDIAN=
 	#endif
 	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
+	cc_set_vars=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI'`
+	eval "$cc_set_vars"
+	test "x$CPU" != x && { echo "$CPU${MIPS_ENDIAN}-unknown-linux-$LIBCABI"; exit; }
+	;;
+    mips64el:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
     openrisc*:Linux:*:*)
-	echo or1k-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=or1k-unknown-linux-$LIBC
+	;;
     or32:Linux:*:* | or1k*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     padre:Linux:*:*)
-	echo sparc-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=sparc-unknown-linux-$LIBC
+	;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=hppa64-unknown-linux-$LIBC
+	;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
-	  PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
-	  *)    echo hppa-unknown-linux-${LIBC} ;;
+	  PA7*) GUESS=hppa1.1-unknown-linux-$LIBC ;;
+	  PA8*) GUESS=hppa2.0-unknown-linux-$LIBC ;;
+	  *)    GUESS=hppa-unknown-linux-$LIBC ;;
 	esac
-	exit ;;
+	;;
     ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc64-unknown-linux-$LIBC
+	;;
     ppc:Linux:*:*)
-	echo powerpc-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc-unknown-linux-$LIBC
+	;;
     ppc64le:Linux:*:*)
-	echo powerpc64le-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc64le-unknown-linux-$LIBC
+	;;
     ppcle:Linux:*:*)
-	echo powerpcle-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpcle-unknown-linux-$LIBC
+	;;
+    riscv32:Linux:*:* | riscv32be:Linux:*:* | riscv64:Linux:*:* | riscv64be:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-linux-$LIBC
+	;;
     sh64*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     tile*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     vax:Linux:*:*)
-	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-dec-linux-$LIBC
+	;;
     x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
-	exit ;;
+	set_cc_for_build
+	CPU=$UNAME_MACHINE
+	LIBCABI=$LIBC
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
+	    ABI=64
+	    sed 's/^	    //' << EOF > "$dummy.c"
+	    #ifdef __i386__
+	    ABI=x86
+	    #else
+	    #ifdef __ILP32__
+	    ABI=x32
+	    #endif
+	    #endif
+EOF
+	    cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'`
+	    eval "$cc_set_abi"
+	    case $ABI in
+		x86) CPU=i686 ;;
+		x32) LIBCABI=${LIBC}x32 ;;
+	    esac
+	fi
+	GUESS=$CPU-pc-linux-$LIBCABI
+	;;
     xtensa*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
-	echo i386-sequent-sysv4
-	exit ;;
+	GUESS=i386-sequent-sysv4
+	;;
     i*86:UNIX_SV:4.2MP:2.*)
 	# Unixware is an offshoot of SVR4, but it has its own version
 	# number series starting with 2...
 	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope.  -- rms.
 	# Use sysv4.2uw... so that sysv4* matches it.
-	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION
+	;;
     i*86:OS/2:*:*)
 	# If we were able to find `uname', then EMX Unix compatibility
 	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-os2-emx
+	;;
     i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-stop
+	;;
     i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-atheos
+	;;
     i*86:syllable:*:*)
-	echo ${UNAME_MACHINE}-pc-syllable
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-syllable
+	;;
     i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-unknown-lynxos$UNAME_RELEASE
+	;;
     i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit ;;
-    i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
-	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
+	GUESS=$UNAME_MACHINE-pc-msdosdjgpp
+	;;
+    i*86:*:4.*:*)
+	UNAME_REL=`echo "$UNAME_RELEASE" | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
-		echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
+		GUESS=$UNAME_MACHINE-univel-sysv$UNAME_REL
 	else
-		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
+		GUESS=$UNAME_MACHINE-pc-sysv$UNAME_REL
 	fi
-	exit ;;
+	;;
     i*86:*:5:[678]*)
 	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
@@ -1102,12 +1225,12 @@ EOF
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
-	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
+	;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
-		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
+		GUESS=$UNAME_MACHINE-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
 		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
 		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
@@ -1117,11 +1240,11 @@ EOF
 			&& UNAME_MACHINE=i686
 		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
+		GUESS=$UNAME_MACHINE-pc-sco$UNAME_REL
 	else
-		echo ${UNAME_MACHINE}-pc-sysv32
+		GUESS=$UNAME_MACHINE-pc-sysv32
 	fi
-	exit ;;
+	;;
     pc:*:*:*)
 	# Left here for compatibility:
 	# uname -m prints for DJGPP always 'pc', but it prints nothing about
@@ -1129,31 +1252,31 @@ EOF
 	# Note: whatever this is, it MUST be the same as what config.sub
 	# prints for the "djgpp" host, or else GDB configure will decide that
 	# this is a cross-build.
-	echo i586-pc-msdosdjgpp
-	exit ;;
+	GUESS=i586-pc-msdosdjgpp
+	;;
     Intel:Mach:3*:*)
-	echo i386-pc-mach3
-	exit ;;
+	GUESS=i386-pc-mach3
+	;;
     paragon:*:*:*)
-	echo i860-intel-osf1
-	exit ;;
+	GUESS=i860-intel-osf1
+	;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
-	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
+	  GUESS=i860-stardent-sysv$UNAME_RELEASE    # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
-	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
+	  GUESS=i860-unknown-sysv$UNAME_RELEASE     # Unknown i860-SVR4
 	fi
-	exit ;;
+	;;
     mini*:CTIX:SYS*5:*)
 	# "miniframe"
-	echo m68010-convergent-sysv
-	exit ;;
+	GUESS=m68010-convergent-sysv
+	;;
     mc68k:UNIX:SYSTEM5:3.51m)
-	echo m68k-convergent-sysv
-	exit ;;
+	GUESS=m68k-convergent-sysv
+	;;
     M680?0:D-NIX:5.3:*)
-	echo m68k-diab-dnix
-	exit ;;
+	GUESS=m68k-diab-dnix
+	;;
     M68*:*:R3V[5678]*:*)
 	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
     3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
@@ -1161,9 +1284,9 @@ EOF
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	  && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
+	  && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
 	  && { echo i486-ncr-sysv4; exit; } ;;
@@ -1172,254 +1295,444 @@ EOF
 	test -r /etc/.relid \
 	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	    && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
+	    && { echo i586-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
-	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
+	    && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
-	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-unknown-lynxos$UNAME_RELEASE
+	;;
     mc68030:UNIX_System_V:4.*:*)
-	echo m68k-atari-sysv4
-	exit ;;
+	GUESS=m68k-atari-sysv4
+	;;
     TSUNAMI:LynxOS:2.*:*)
-	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-unknown-lynxos$UNAME_RELEASE
+	;;
     rs6000:LynxOS:2.*:*)
-	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=rs6000-unknown-lynxos$UNAME_RELEASE
+	;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
-	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-unknown-lynxos$UNAME_RELEASE
+	;;
     SM[BE]S:UNIX_SV:*:*)
-	echo mips-dde-sysv${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-dde-sysv$UNAME_RELEASE
+	;;
     RM*:ReliantUNIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
     RM*:SINIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
-		echo ${UNAME_MACHINE}-sni-sysv4
+		GUESS=$UNAME_MACHINE-sni-sysv4
 	else
-		echo ns32k-sni-sysv
+		GUESS=ns32k-sni-sysv
 	fi
-	exit ;;
+	;;
     PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
 			# says <Richard.M.Bartel@ccMail.Census.GOV>
-	echo i586-unisys-sysv4
-	exit ;;
+	GUESS=i586-unisys-sysv4
+	;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
-	echo hppa1.1-stratus-sysv4
-	exit ;;
+	GUESS=hppa1.1-stratus-sysv4
+	;;
     *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
-	echo i860-stratus-sysv4
-	exit ;;
+	GUESS=i860-stratus-sysv4
+	;;
     i*86:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo ${UNAME_MACHINE}-stratus-vos
-	exit ;;
+	GUESS=$UNAME_MACHINE-stratus-vos
+	;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo hppa1.1-stratus-vos
-	exit ;;
+	GUESS=hppa1.1-stratus-vos
+	;;
     mc68*:A/UX:*:*)
-	echo m68k-apple-aux${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-apple-aux$UNAME_RELEASE
+	;;
     news*:NEWS-OS:6*:*)
-	echo mips-sony-newsos6
-	exit ;;
+	GUESS=mips-sony-newsos6
+	;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
-	if [ -d /usr/nec ]; then
-		echo mips-nec-sysv${UNAME_RELEASE}
+	if test -d /usr/nec; then
+		GUESS=mips-nec-sysv$UNAME_RELEASE
 	else
-		echo mips-unknown-sysv${UNAME_RELEASE}
+		GUESS=mips-unknown-sysv$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
-	echo powerpc-be-beos
-	exit ;;
+	GUESS=powerpc-be-beos
+	;;
     BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
-	echo powerpc-apple-beos
-	exit ;;
+	GUESS=powerpc-apple-beos
+	;;
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
-	echo i586-pc-beos
-	exit ;;
+	GUESS=i586-pc-beos
+	;;
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
-	echo i586-pc-haiku
-	exit ;;
-    x86_64:Haiku:*:*)
-	echo x86_64-unknown-haiku
-	exit ;;
+	GUESS=i586-pc-haiku
+	;;
+    ppc:Haiku:*:*)	# Haiku running on Apple PowerPC
+	GUESS=powerpc-apple-haiku
+	;;
+    *:Haiku:*:*)	# Haiku modern gcc (not bound by BeOS compat)
+	GUESS=$UNAME_MACHINE-unknown-haiku
+	;;
     SX-4:SUPER-UX:*:*)
-	echo sx4-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx4-nec-superux$UNAME_RELEASE
+	;;
     SX-5:SUPER-UX:*:*)
-	echo sx5-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx5-nec-superux$UNAME_RELEASE
+	;;
     SX-6:SUPER-UX:*:*)
-	echo sx6-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx6-nec-superux$UNAME_RELEASE
+	;;
     SX-7:SUPER-UX:*:*)
-	echo sx7-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx7-nec-superux$UNAME_RELEASE
+	;;
     SX-8:SUPER-UX:*:*)
-	echo sx8-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx8-nec-superux$UNAME_RELEASE
+	;;
     SX-8R:SUPER-UX:*:*)
-	echo sx8r-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx8r-nec-superux$UNAME_RELEASE
+	;;
     SX-ACE:SUPER-UX:*:*)
-	echo sxace-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sxace-nec-superux$UNAME_RELEASE
+	;;
     Power*:Rhapsody:*:*)
-	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-apple-rhapsody$UNAME_RELEASE
+	;;
     *:Rhapsody:*:*)
-	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-apple-rhapsody$UNAME_RELEASE
+	;;
+    arm64:Darwin:*:*)
+	GUESS=aarch64-apple-darwin$UNAME_RELEASE
+	;;
     *:Darwin:*:*)
-	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
-	eval $set_cc_for_build
-	if test "$UNAME_PROCESSOR" = unknown ; then
-	    UNAME_PROCESSOR=powerpc
+	UNAME_PROCESSOR=`uname -p`
+	case $UNAME_PROCESSOR in
+	    unknown) UNAME_PROCESSOR=powerpc ;;
+	esac
+	if command -v xcode-select > /dev/null 2> /dev/null && \
+		! xcode-select --print-path > /dev/null 2> /dev/null ; then
+	    # Avoid executing cc if there is no toolchain installed as
+	    # cc will be a stub that puts up a graphical alert
+	    # prompting the user to install developer tools.
+	    CC_FOR_BUILD=no_compiler_found
+	else
+	    set_cc_for_build
 	fi
-	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
-	    if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
-		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		    (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-		    grep IS_64BIT_ARCH >/dev/null
-		then
-		    case $UNAME_PROCESSOR in
-			i386) UNAME_PROCESSOR=x86_64 ;;
-			powerpc) UNAME_PROCESSOR=powerpc64 ;;
-		    esac
-		fi
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
+	    if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		   (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		   grep IS_64BIT_ARCH >/dev/null
+	    then
+		case $UNAME_PROCESSOR in
+		    i386) UNAME_PROCESSOR=x86_64 ;;
+		    powerpc) UNAME_PROCESSOR=powerpc64 ;;
+		esac
+	    fi
+	    # On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc
+	    if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \
+		   (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		   grep IS_PPC >/dev/null
+	    then
+		UNAME_PROCESSOR=powerpc
 	    fi
 	elif test "$UNAME_PROCESSOR" = i386 ; then
-	    # Avoid executing cc on OS X 10.9, as it ships with a stub
-	    # that puts up a graphical alert prompting to install
-	    # developer tools.  Any system running Mac OS X 10.7 or
-	    # later (Darwin 11 and later) is required to have a 64-bit
-	    # processor. This is not true of the ARM version of Darwin
-	    # that Apple uses in portable devices.
-	    UNAME_PROCESSOR=x86_64
+	    # uname -m returns i386 or x86_64
+	    UNAME_PROCESSOR=$UNAME_MACHINE
 	fi
-	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-apple-darwin$UNAME_RELEASE
+	;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
 	UNAME_PROCESSOR=`uname -p`
 	if test "$UNAME_PROCESSOR" = x86; then
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-$UNAME_MACHINE-nto-qnx$UNAME_RELEASE
+	;;
     *:QNX:*:4*)
-	echo i386-pc-qnx
-	exit ;;
-    NEO-?:NONSTOP_KERNEL:*:*)
-	echo neo-tandem-nsk${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-pc-qnx
+	;;
+    NEO-*:NONSTOP_KERNEL:*:*)
+	GUESS=neo-tandem-nsk$UNAME_RELEASE
+	;;
     NSE-*:NONSTOP_KERNEL:*:*)
-	echo nse-tandem-nsk${UNAME_RELEASE}
-	exit ;;
-    NSR-?:NONSTOP_KERNEL:*:*)
-	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit ;;
+	GUESS=nse-tandem-nsk$UNAME_RELEASE
+	;;
+    NSR-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsr-tandem-nsk$UNAME_RELEASE
+	;;
+    NSV-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsv-tandem-nsk$UNAME_RELEASE
+	;;
+    NSX-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsx-tandem-nsk$UNAME_RELEASE
+	;;
     *:NonStop-UX:*:*)
-	echo mips-compaq-nonstopux
-	exit ;;
+	GUESS=mips-compaq-nonstopux
+	;;
     BS2000:POSIX*:*:*)
-	echo bs2000-siemens-sysv
-	exit ;;
+	GUESS=bs2000-siemens-sysv
+	;;
     DS/*:UNIX_System_V:*:*)
-	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-$UNAME_SYSTEM-$UNAME_RELEASE
+	;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
 	# operating systems.
-	if test "$cputype" = 386; then
+	if test "${cputype-}" = 386; then
 	    UNAME_MACHINE=i386
-	else
-	    UNAME_MACHINE="$cputype"
+	elif test "x${cputype-}" != x; then
+	    UNAME_MACHINE=$cputype
 	fi
-	echo ${UNAME_MACHINE}-unknown-plan9
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-plan9
+	;;
     *:TOPS-10:*:*)
-	echo pdp10-unknown-tops10
-	exit ;;
+	GUESS=pdp10-unknown-tops10
+	;;
     *:TENEX:*:*)
-	echo pdp10-unknown-tenex
-	exit ;;
+	GUESS=pdp10-unknown-tenex
+	;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
-	echo pdp10-dec-tops20
-	exit ;;
+	GUESS=pdp10-dec-tops20
+	;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
-	echo pdp10-xkl-tops20
-	exit ;;
+	GUESS=pdp10-xkl-tops20
+	;;
     *:TOPS-20:*:*)
-	echo pdp10-unknown-tops20
-	exit ;;
+	GUESS=pdp10-unknown-tops20
+	;;
     *:ITS:*:*)
-	echo pdp10-unknown-its
-	exit ;;
+	GUESS=pdp10-unknown-its
+	;;
     SEI:*:*:SEIUX)
-	echo mips-sei-seiux${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-sei-seiux$UNAME_RELEASE
+	;;
     *:DragonFly:*:*)
-	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
-	exit ;;
+	DRAGONFLY_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
+	GUESS=$UNAME_MACHINE-unknown-dragonfly$DRAGONFLY_REL
+	;;
     *:*VMS:*:*)
 	UNAME_MACHINE=`(uname -p) 2>/dev/null`
-	case "${UNAME_MACHINE}" in
-	    A*) echo alpha-dec-vms ; exit ;;
-	    I*) echo ia64-dec-vms ; exit ;;
-	    V*) echo vax-dec-vms ; exit ;;
+	case $UNAME_MACHINE in
+	    A*) GUESS=alpha-dec-vms ;;
+	    I*) GUESS=ia64-dec-vms ;;
+	    V*) GUESS=vax-dec-vms ;;
 	esac ;;
     *:XENIX:*:SysV)
-	echo i386-pc-xenix
-	exit ;;
+	GUESS=i386-pc-xenix
+	;;
     i*86:skyos:*:*)
-	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
-	exit ;;
+	SKYOS_REL=`echo "$UNAME_RELEASE" | sed -e 's/ .*$//'`
+	GUESS=$UNAME_MACHINE-pc-skyos$SKYOS_REL
+	;;
     i*86:rdos:*:*)
-	echo ${UNAME_MACHINE}-pc-rdos
-	exit ;;
-    i*86:AROS:*:*)
-	echo ${UNAME_MACHINE}-pc-aros
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-rdos
+	;;
+    i*86:Fiwix:*:*)
+	GUESS=$UNAME_MACHINE-pc-fiwix
+	;;
+    *:AROS:*:*)
+	GUESS=$UNAME_MACHINE-unknown-aros
+	;;
     x86_64:VMkernel:*:*)
-	echo ${UNAME_MACHINE}-unknown-esx
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-esx
+	;;
     amd64:Isilon\ OneFS:*:*)
-	echo x86_64-unknown-onefs
-	exit ;;
+	GUESS=x86_64-unknown-onefs
+	;;
+    *:Unleashed:*:*)
+	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
+	;;
+esac
+
+# Do we have a guess based on uname results?
+if test "x$GUESS" != x; then
+    echo "$GUESS"
+    exit
+fi
+
+# No uname command or uname output not recognized.
+set_cc_for_build
+cat > "$dummy.c" <<EOF
+#ifdef _SEQUENT_
+#include <sys/types.h>
+#include <sys/utsname.h>
+#endif
+#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__)
+#if defined (vax) || defined (__vax) || defined (__vax__) || defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__)
+#include <signal.h>
+#if defined(_SIZE_T_) || defined(SIGLOST)
+#include <sys/utsname.h>
+#endif
+#endif
+#endif
+main ()
+{
+#if defined (sony)
+#if defined (MIPSEB)
+  /* BFD wants "bsd" instead of "newsos".  Perhaps BFD should be changed,
+     I don't know....  */
+  printf ("mips-sony-bsd\n"); exit (0);
+#else
+#include <sys/param.h>
+  printf ("m68k-sony-newsos%s\n",
+#ifdef NEWSOS4
+  "4"
+#else
+  ""
+#endif
+  ); exit (0);
+#endif
+#endif
+
+#if defined (NeXT)
+#if !defined (__ARCHITECTURE__)
+#define __ARCHITECTURE__ "m68k"
+#endif
+  int version;
+  version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
+  if (version < 4)
+    printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
+  else
+    printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
+  exit (0);
+#endif
+
+#if defined (MULTIMAX) || defined (n16)
+#if defined (UMAXV)
+  printf ("ns32k-encore-sysv\n"); exit (0);
+#else
+#if defined (CMU)
+  printf ("ns32k-encore-mach\n"); exit (0);
+#else
+  printf ("ns32k-encore-bsd\n"); exit (0);
+#endif
+#endif
+#endif
+
+#if defined (__386BSD__)
+  printf ("i386-pc-bsd\n"); exit (0);
+#endif
+
+#if defined (sequent)
+#if defined (i386)
+  printf ("i386-sequent-dynix\n"); exit (0);
+#endif
+#if defined (ns32000)
+  printf ("ns32k-sequent-dynix\n"); exit (0);
+#endif
+#endif
+
+#if defined (_SEQUENT_)
+  struct utsname un;
+
+  uname(&un);
+  if (strncmp(un.version, "V2", 2) == 0) {
+    printf ("i386-sequent-ptx2\n"); exit (0);
+  }
+  if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
+    printf ("i386-sequent-ptx1\n"); exit (0);
+  }
+  printf ("i386-sequent-ptx\n"); exit (0);
+#endif
+
+#if defined (vax)
+#if !defined (ultrix)
+#include <sys/param.h>
+#if defined (BSD)
+#if BSD == 43
+  printf ("vax-dec-bsd4.3\n"); exit (0);
+#else
+#if BSD == 199006
+  printf ("vax-dec-bsd4.3reno\n"); exit (0);
+#else
+  printf ("vax-dec-bsd\n"); exit (0);
+#endif
+#endif
+#else
+  printf ("vax-dec-bsd\n"); exit (0);
+#endif
+#else
+#if defined(_SIZE_T_) || defined(SIGLOST)
+  struct utsname un;
+  uname (&un);
+  printf ("vax-dec-ultrix%s\n", un.release); exit (0);
+#else
+  printf ("vax-dec-ultrix\n"); exit (0);
+#endif
+#endif
+#endif
+#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__)
+#if defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__)
+#if defined(_SIZE_T_) || defined(SIGLOST)
+  struct utsname *un;
+  uname (&un);
+  printf ("mips-dec-ultrix%s\n", un.release); exit (0);
+#else
+  printf ("mips-dec-ultrix\n"); exit (0);
+#endif
+#endif
+#endif
+
+#if defined (alliant) && defined (i860)
+  printf ("i860-alliant-bsd\n"); exit (0);
+#endif
+
+  exit (1);
+}
+EOF
+
+$CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=`"$dummy"` &&
+	{ echo "$SYSTEM_NAME"; exit; }
+
+# Apollos put the system type in the environment.
+test -d /usr/apollo && { echo "$ISP-apollo-$SYSTYPE"; exit; }
+
+echo "$0: unable to guess system type" >&2
+
+case $UNAME_MACHINE:$UNAME_SYSTEM in
+    mips:Linux | mips64:Linux)
+	# If we got here on MIPS GNU/Linux, output extra information.
+	cat >&2 <<EOF
+
+NOTE: MIPS GNU/Linux systems require a C compiler to fully recognize
+the system type. Please install a C compiler and try again.
+EOF
+	;;
 esac
 
 cat >&2 <<EOF
-$0: unable to guess system type
 
-This script, last modified $timestamp, has failed to recognize
-the operating system you are using. It is advised that you
-download the most up to date version of the config scripts from
+This script (version $timestamp), has failed to recognize the
+operating system you are using. If your script is old, overwrite *all*
+copies of config.guess and config.sub with the latest versions from:
 
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+  https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
 and
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+  https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
+EOF
 
-If the version you run ($0) is already up to date, please
-send the following data and any information you think might be
-pertinent to <config-patches@gnu.org> in order to provide the needed
-information to handle your system.
+our_year=`echo $timestamp | sed 's,-.*,,'`
+thisyear=`date +%Y`
+# shellcheck disable=SC2003
+script_age=`expr "$thisyear" - "$our_year"`
+if test "$script_age" -lt 3 ; then
+   cat >&2 <<EOF
+
+If $0 has already been updated, send the following data and any
+information you think might be pertinent to config-patches@gnu.org to
+provide the necessary information to handle your system.
 
 config.guess timestamp = $timestamp
 
@@ -1438,16 +1751,17 @@ hostinfo               = `(hostinfo) 2>/dev/null`
 /usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null`
 /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
 
-UNAME_MACHINE = ${UNAME_MACHINE}
-UNAME_RELEASE = ${UNAME_RELEASE}
-UNAME_SYSTEM  = ${UNAME_SYSTEM}
-UNAME_VERSION = ${UNAME_VERSION}
+UNAME_MACHINE = "$UNAME_MACHINE"
+UNAME_RELEASE = "$UNAME_RELEASE"
+UNAME_SYSTEM  = "$UNAME_SYSTEM"
+UNAME_VERSION = "$UNAME_VERSION"
 EOF
+fi
 
 exit 1
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
diff --git a/contrib/ldns/config.sub b/contrib/ldns/config.sub
index 8d39c4ba39fe35..dba16e84c77c7d 100755
--- a/contrib/ldns/config.sub
+++ b/contrib/ldns/config.sub
@@ -1,12 +1,14 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2016 Free Software Foundation, Inc.
+#   Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2016-03-30'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-01-03'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -15,7 +17,7 @@ timestamp='2016-03-30'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -33,7 +35,7 @@ timestamp='2016-03-30'
 # Otherwise, we print the canonical config type on stdout and succeed.
 
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+# https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
 
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -50,6 +52,13 @@ timestamp='2016-03-30'
 #	CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
 # It is wrong to echo any other type of specification.
 
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX.  However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
@@ -57,7 +66,7 @@ Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
 
 Canonicalize a configuration name.
 
-Operation modes:
+Options:
   -h, --help         print this help, then exit
   -t, --time-stamp   print date of last modification, then exit
   -v, --version      print version number, then exit
@@ -67,7 +76,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2016 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -89,12 +98,12 @@ while test $# -gt 0 ; do
     - )	# Use stdin as input.
        break ;;
     -* )
-       echo "$me: invalid option $1$help"
+       echo "$me: invalid option $1$help" >&2
        exit 1 ;;
 
     *local*)
        # First pass through any local machine types.
-       echo $1
+       echo "$1"
        exit ;;
 
     * )
@@ -110,1234 +119,1186 @@ case $# in
     exit 1;;
 esac
 
-# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
-# Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
-case $maybe_os in
-  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
-  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
-  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
-  kopensolaris*-gnu* | \
-  storm-chaos* | os2-emx* | rtmk-nova*)
-    os=-$maybe_os
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
-    ;;
-  android-linux)
-    os=-linux-android
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
-    ;;
-  *)
-    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
-    if [ $basic_machine != $1 ]
-    then os=`echo $1 | sed 's/.*-/-/'`
-    else os=; fi
-    ;;
-esac
+# Split fields of configuration type
+# shellcheck disable=SC2162
+saved_IFS=$IFS
+IFS="-" read field1 field2 field3 field4 <<EOF
+$1
+EOF
+IFS=$saved_IFS
 
-### Let's recognize common machines as not being operating systems so
-### that things like config.sub decstation-3100 work.  We also
-### recognize some manufacturers as not being operating systems, so we
-### can provide default operating systems below.
-case $os in
-	-sun*os*)
-		# Prevent following clause from handling this invalid input.
-		;;
-	-dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \
-	-att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \
-	-unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \
-	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
-	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
-	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze*)
-		os=
-		basic_machine=$1
-		;;
-	-bluegene*)
-		os=-cnk
-		;;
-	-sim | -cisco | -oki | -wec | -winbond)
-		os=
-		basic_machine=$1
-		;;
-	-scout)
-		;;
-	-wrs)
-		os=-vxworks
-		basic_machine=$1
-		;;
-	-chorusos*)
-		os=-chorusos
-		basic_machine=$1
-		;;
-	-chorusrdb)
-		os=-chorusrdb
-		basic_machine=$1
-		;;
-	-hiux*)
-		os=-hiuxwe2
-		;;
-	-sco6)
-		os=-sco5v6
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco5)
-		os=-sco3.2v5
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco4)
-		os=-sco3.2v4
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2.[4-9]*)
-		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2v[4-9]*)
-		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco5v6*)
-		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco*)
-		os=-sco3.2v2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-udk*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-isc)
-		os=-isc2.2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-clix*)
-		basic_machine=clipper-intergraph
-		;;
-	-isc*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-lynx*178)
-		os=-lynxos178
-		;;
-	-lynx*5)
-		os=-lynxos5
-		;;
-	-lynx*)
-		os=-lynxos
+# Separate into logical components for further validation
+case $1 in
+	*-*-*-*-*)
+		echo Invalid configuration \`"$1"\': more than four components >&2
+		exit 1
 		;;
-	-ptx*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
+	*-*-*-*)
+		basic_machine=$field1-$field2
+		basic_os=$field3-$field4
 		;;
-	-windowsnt*)
-		os=`echo $os | sed -e 's/windowsnt/winnt/'`
+	*-*-*)
+		# Ambiguous whether COMPANY is present, or skipped and KERNEL-OS is two
+		# parts
+		maybe_os=$field2-$field3
+		case $maybe_os in
+			nto-qnx* | linux-* | uclinux-uclibc* \
+			| uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \
+			| netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \
+			| storm-chaos* | os2-emx* | rtmk-nova*)
+				basic_machine=$field1
+				basic_os=$maybe_os
+				;;
+			android-linux)
+				basic_machine=$field1-unknown
+				basic_os=linux-android
+				;;
+			*)
+				basic_machine=$field1-$field2
+				basic_os=$field3
+				;;
+		esac
 		;;
-	-psos*)
-		os=-psos
+	*-*)
+		# A lone config we happen to match not fitting any pattern
+		case $field1-$field2 in
+			decstation-3100)
+				basic_machine=mips-dec
+				basic_os=
+				;;
+			*-*)
+				# Second component is usually, but not always the OS
+				case $field2 in
+					# Prevent following clause from handling this valid os
+					sun*os*)
+						basic_machine=$field1
+						basic_os=$field2
+						;;
+					zephyr*)
+						basic_machine=$field1-unknown
+						basic_os=$field2
+						;;
+					# Manufacturers
+					dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \
+					| att* | 7300* | 3300* | delta* | motorola* | sun[234]* \
+					| unicom* | ibm* | next | hp | isi* | apollo | altos* \
+					| convergent* | ncr* | news | 32* | 3600* | 3100* \
+					| hitachi* | c[123]* | convex* | sun | crds | omron* | dg \
+					| ultra | tti* | harris | dolphin | highlevel | gould \
+					| cbm | ns | masscomp | apple | axis | knuth | cray \
+					| microblaze* | sim | cisco \
+					| oki | wec | wrs | winbond)
+						basic_machine=$field1-$field2
+						basic_os=
+						;;
+					*)
+						basic_machine=$field1
+						basic_os=$field2
+						;;
+				esac
+			;;
+		esac
 		;;
-	-mint | -mint[0-9]*)
-		basic_machine=m68k-atari
-		os=-mint
+	*)
+		# Convert single-component short-hands not valid as part of
+		# multi-component configurations.
+		case $field1 in
+			386bsd)
+				basic_machine=i386-pc
+				basic_os=bsd
+				;;
+			a29khif)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			adobe68k)
+				basic_machine=m68010-adobe
+				basic_os=scout
+				;;
+			alliant)
+				basic_machine=fx80-alliant
+				basic_os=
+				;;
+			altos | altos3068)
+				basic_machine=m68k-altos
+				basic_os=
+				;;
+			am29k)
+				basic_machine=a29k-none
+				basic_os=bsd
+				;;
+			amdahl)
+				basic_machine=580-amdahl
+				basic_os=sysv
+				;;
+			amiga)
+				basic_machine=m68k-unknown
+				basic_os=
+				;;
+			amigaos | amigados)
+				basic_machine=m68k-unknown
+				basic_os=amigaos
+				;;
+			amigaunix | amix)
+				basic_machine=m68k-unknown
+				basic_os=sysv4
+				;;
+			apollo68)
+				basic_machine=m68k-apollo
+				basic_os=sysv
+				;;
+			apollo68bsd)
+				basic_machine=m68k-apollo
+				basic_os=bsd
+				;;
+			aros)
+				basic_machine=i386-pc
+				basic_os=aros
+				;;
+			aux)
+				basic_machine=m68k-apple
+				basic_os=aux
+				;;
+			balance)
+				basic_machine=ns32k-sequent
+				basic_os=dynix
+				;;
+			blackfin)
+				basic_machine=bfin-unknown
+				basic_os=linux
+				;;
+			cegcc)
+				basic_machine=arm-unknown
+				basic_os=cegcc
+				;;
+			convex-c1)
+				basic_machine=c1-convex
+				basic_os=bsd
+				;;
+			convex-c2)
+				basic_machine=c2-convex
+				basic_os=bsd
+				;;
+			convex-c32)
+				basic_machine=c32-convex
+				basic_os=bsd
+				;;
+			convex-c34)
+				basic_machine=c34-convex
+				basic_os=bsd
+				;;
+			convex-c38)
+				basic_machine=c38-convex
+				basic_os=bsd
+				;;
+			cray)
+				basic_machine=j90-cray
+				basic_os=unicos
+				;;
+			crds | unos)
+				basic_machine=m68k-crds
+				basic_os=
+				;;
+			da30)
+				basic_machine=m68k-da30
+				basic_os=
+				;;
+			decstation | pmax | pmin | dec3100 | decstatn)
+				basic_machine=mips-dec
+				basic_os=
+				;;
+			delta88)
+				basic_machine=m88k-motorola
+				basic_os=sysv3
+				;;
+			dicos)
+				basic_machine=i686-pc
+				basic_os=dicos
+				;;
+			djgpp)
+				basic_machine=i586-pc
+				basic_os=msdosdjgpp
+				;;
+			ebmon29k)
+				basic_machine=a29k-amd
+				basic_os=ebmon
+				;;
+			es1800 | OSE68k | ose68k | ose | OSE)
+				basic_machine=m68k-ericsson
+				basic_os=ose
+				;;
+			gmicro)
+				basic_machine=tron-gmicro
+				basic_os=sysv
+				;;
+			go32)
+				basic_machine=i386-pc
+				basic_os=go32
+				;;
+			h8300hms)
+				basic_machine=h8300-hitachi
+				basic_os=hms
+				;;
+			h8300xray)
+				basic_machine=h8300-hitachi
+				basic_os=xray
+				;;
+			h8500hms)
+				basic_machine=h8500-hitachi
+				basic_os=hms
+				;;
+			harris)
+				basic_machine=m88k-harris
+				basic_os=sysv3
+				;;
+			hp300 | hp300hpux)
+				basic_machine=m68k-hp
+				basic_os=hpux
+				;;
+			hp300bsd)
+				basic_machine=m68k-hp
+				basic_os=bsd
+				;;
+			hppaosf)
+				basic_machine=hppa1.1-hp
+				basic_os=osf
+				;;
+			hppro)
+				basic_machine=hppa1.1-hp
+				basic_os=proelf
+				;;
+			i386mach)
+				basic_machine=i386-mach
+				basic_os=mach
+				;;
+			isi68 | isi)
+				basic_machine=m68k-isi
+				basic_os=sysv
+				;;
+			m68knommu)
+				basic_machine=m68k-unknown
+				basic_os=linux
+				;;
+			magnum | m3230)
+				basic_machine=mips-mips
+				basic_os=sysv
+				;;
+			merlin)
+				basic_machine=ns32k-utek
+				basic_os=sysv
+				;;
+			mingw64)
+				basic_machine=x86_64-pc
+				basic_os=mingw64
+				;;
+			mingw32)
+				basic_machine=i686-pc
+				basic_os=mingw32
+				;;
+			mingw32ce)
+				basic_machine=arm-unknown
+				basic_os=mingw32ce
+				;;
+			monitor)
+				basic_machine=m68k-rom68k
+				basic_os=coff
+				;;
+			morphos)
+				basic_machine=powerpc-unknown
+				basic_os=morphos
+				;;
+			moxiebox)
+				basic_machine=moxie-unknown
+				basic_os=moxiebox
+				;;
+			msdos)
+				basic_machine=i386-pc
+				basic_os=msdos
+				;;
+			msys)
+				basic_machine=i686-pc
+				basic_os=msys
+				;;
+			mvs)
+				basic_machine=i370-ibm
+				basic_os=mvs
+				;;
+			nacl)
+				basic_machine=le32-unknown
+				basic_os=nacl
+				;;
+			ncr3000)
+				basic_machine=i486-ncr
+				basic_os=sysv4
+				;;
+			netbsd386)
+				basic_machine=i386-pc
+				basic_os=netbsd
+				;;
+			netwinder)
+				basic_machine=armv4l-rebel
+				basic_os=linux
+				;;
+			news | news700 | news800 | news900)
+				basic_machine=m68k-sony
+				basic_os=newsos
+				;;
+			news1000)
+				basic_machine=m68030-sony
+				basic_os=newsos
+				;;
+			necv70)
+				basic_machine=v70-nec
+				basic_os=sysv
+				;;
+			nh3000)
+				basic_machine=m68k-harris
+				basic_os=cxux
+				;;
+			nh[45]000)
+				basic_machine=m88k-harris
+				basic_os=cxux
+				;;
+			nindy960)
+				basic_machine=i960-intel
+				basic_os=nindy
+				;;
+			mon960)
+				basic_machine=i960-intel
+				basic_os=mon960
+				;;
+			nonstopux)
+				basic_machine=mips-compaq
+				basic_os=nonstopux
+				;;
+			os400)
+				basic_machine=powerpc-ibm
+				basic_os=os400
+				;;
+			OSE68000 | ose68000)
+				basic_machine=m68000-ericsson
+				basic_os=ose
+				;;
+			os68k)
+				basic_machine=m68k-none
+				basic_os=os68k
+				;;
+			paragon)
+				basic_machine=i860-intel
+				basic_os=osf
+				;;
+			parisc)
+				basic_machine=hppa-unknown
+				basic_os=linux
+				;;
+			psp)
+				basic_machine=mipsallegrexel-sony
+				basic_os=psp
+				;;
+			pw32)
+				basic_machine=i586-unknown
+				basic_os=pw32
+				;;
+			rdos | rdos64)
+				basic_machine=x86_64-pc
+				basic_os=rdos
+				;;
+			rdos32)
+				basic_machine=i386-pc
+				basic_os=rdos
+				;;
+			rom68k)
+				basic_machine=m68k-rom68k
+				basic_os=coff
+				;;
+			sa29200)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			sei)
+				basic_machine=mips-sei
+				basic_os=seiux
+				;;
+			sequent)
+				basic_machine=i386-sequent
+				basic_os=
+				;;
+			sps7)
+				basic_machine=m68k-bull
+				basic_os=sysv2
+				;;
+			st2000)
+				basic_machine=m68k-tandem
+				basic_os=
+				;;
+			stratus)
+				basic_machine=i860-stratus
+				basic_os=sysv4
+				;;
+			sun2)
+				basic_machine=m68000-sun
+				basic_os=
+				;;
+			sun2os3)
+				basic_machine=m68000-sun
+				basic_os=sunos3
+				;;
+			sun2os4)
+				basic_machine=m68000-sun
+				basic_os=sunos4
+				;;
+			sun3)
+				basic_machine=m68k-sun
+				basic_os=
+				;;
+			sun3os3)
+				basic_machine=m68k-sun
+				basic_os=sunos3
+				;;
+			sun3os4)
+				basic_machine=m68k-sun
+				basic_os=sunos4
+				;;
+			sun4)
+				basic_machine=sparc-sun
+				basic_os=
+				;;
+			sun4os3)
+				basic_machine=sparc-sun
+				basic_os=sunos3
+				;;
+			sun4os4)
+				basic_machine=sparc-sun
+				basic_os=sunos4
+				;;
+			sun4sol2)
+				basic_machine=sparc-sun
+				basic_os=solaris2
+				;;
+			sun386 | sun386i | roadrunner)
+				basic_machine=i386-sun
+				basic_os=
+				;;
+			sv1)
+				basic_machine=sv1-cray
+				basic_os=unicos
+				;;
+			symmetry)
+				basic_machine=i386-sequent
+				basic_os=dynix
+				;;
+			t3e)
+				basic_machine=alphaev5-cray
+				basic_os=unicos
+				;;
+			t90)
+				basic_machine=t90-cray
+				basic_os=unicos
+				;;
+			toad1)
+				basic_machine=pdp10-xkl
+				basic_os=tops20
+				;;
+			tpf)
+				basic_machine=s390x-ibm
+				basic_os=tpf
+				;;
+			udi29k)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			ultra3)
+				basic_machine=a29k-nyu
+				basic_os=sym1
+				;;
+			v810 | necv810)
+				basic_machine=v810-nec
+				basic_os=none
+				;;
+			vaxv)
+				basic_machine=vax-dec
+				basic_os=sysv
+				;;
+			vms)
+				basic_machine=vax-dec
+				basic_os=vms
+				;;
+			vsta)
+				basic_machine=i386-pc
+				basic_os=vsta
+				;;
+			vxworks960)
+				basic_machine=i960-wrs
+				basic_os=vxworks
+				;;
+			vxworks68)
+				basic_machine=m68k-wrs
+				basic_os=vxworks
+				;;
+			vxworks29k)
+				basic_machine=a29k-wrs
+				basic_os=vxworks
+				;;
+			xbox)
+				basic_machine=i686-pc
+				basic_os=mingw32
+				;;
+			ymp)
+				basic_machine=ymp-cray
+				basic_os=unicos
+				;;
+			*)
+				basic_machine=$1
+				basic_os=
+				;;
+		esac
 		;;
 esac
 
-# Decode aliases for certain CPU-COMPANY combinations.
+# Decode 1-component or ad-hoc basic machines
 case $basic_machine in
-	# Recognize the basic CPU types without company name.
-	# Some are omitted here because they have special meanings below.
-	1750a | 580 \
-	| a29k \
-	| aarch64 | aarch64_be \
-	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
-	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
-	| am33_2.0 \
-	| arc | arceb \
-	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
-	| avr | avr32 \
-	| ba \
-	| be32 | be64 \
-	| bfin \
-	| c4x | c8051 | clipper \
-	| d10v | d30v | dlx | dsp16xx \
-	| e2k | epiphany \
-	| fido | fr30 | frv | ft32 \
-	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
-	| hexagon \
-	| i370 | i860 | i960 | ia64 \
-	| ip2k | iq2000 \
-	| k1om \
-	| le32 | le64 \
-	| lm32 \
-	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
-	| mips | mipsbe | mipseb | mipsel | mipsle \
-	| mips16 \
-	| mips64 | mips64el \
-	| mips64octeon | mips64octeonel \
-	| mips64orion | mips64orionel \
-	| mips64r5900 | mips64r5900el \
-	| mips64vr | mips64vrel \
-	| mips64vr4100 | mips64vr4100el \
-	| mips64vr4300 | mips64vr4300el \
-	| mips64vr5000 | mips64vr5000el \
-	| mips64vr5900 | mips64vr5900el \
-	| mipsisa32 | mipsisa32el \
-	| mipsisa32r2 | mipsisa32r2el \
-	| mipsisa32r6 | mipsisa32r6el \
-	| mipsisa64 | mipsisa64el \
-	| mipsisa64r2 | mipsisa64r2el \
-	| mipsisa64r6 | mipsisa64r6el \
-	| mipsisa64sb1 | mipsisa64sb1el \
-	| mipsisa64sr71k | mipsisa64sr71kel \
-	| mipsr5900 | mipsr5900el \
-	| mipstx39 | mipstx39el \
-	| mn10200 | mn10300 \
-	| moxie \
-	| mt \
-	| msp430 \
-	| nds32 | nds32le | nds32be \
-	| nios | nios2 | nios2eb | nios2el \
-	| ns16k | ns32k \
-	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle \
-	| pyramid \
-	| riscv32 | riscv64 \
-	| rl78 | rx \
-	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
-	| sh64 | sh64le \
-	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
-	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
-	| spu \
-	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
-	| ubicom32 \
-	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
-	| visium \
-	| we32k \
-	| x86 | xc16x | xstormy16 | xtensa \
-	| z8k | z80)
-		basic_machine=$basic_machine-unknown
-		;;
-	c54x)
-		basic_machine=tic54x-unknown
-		;;
-	c55x)
-		basic_machine=tic55x-unknown
-		;;
-	c6x)
-		basic_machine=tic6x-unknown
-		;;
-	leon|leon[3-9])
-		basic_machine=sparc-$basic_machine
+	# Here we handle the default manufacturer of certain CPU types.  It is in
+	# some cases the only manufacturer, in others, it is the most popular.
+	w89k)
+		cpu=hppa1.1
+		vendor=winbond
 		;;
-	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
-		basic_machine=$basic_machine-unknown
-		os=-none
+	op50n)
+		cpu=hppa1.1
+		vendor=oki
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
+	op60c)
+		cpu=hppa1.1
+		vendor=oki
 		;;
-	ms1)
-		basic_machine=mt-unknown
+	ibm*)
+		cpu=i370
+		vendor=ibm
 		;;
-
-	strongarm | thumb | xscale)
-		basic_machine=arm-unknown
-		;;
-	xgate)
-		basic_machine=$basic_machine-unknown
-		os=-none
+	orion105)
+		cpu=clipper
+		vendor=highlevel
 		;;
-	xscaleeb)
-		basic_machine=armeb-unknown
+	mac | mpw | mac-mpw)
+		cpu=m68k
+		vendor=apple
 		;;
-
-	xscaleel)
-		basic_machine=armel-unknown
+	pmac | pmac-mpw)
+		cpu=powerpc
+		vendor=apple
 		;;
 
-	# We use `pc' rather than `unknown'
-	# because (1) that's what they normally are, and
-	# (2) the word "unknown" tends to confuse beginning users.
-	i*86 | x86_64)
-	  basic_machine=$basic_machine-pc
-	  ;;
-	# Object if more than one company name word.
-	*-*-*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
-		;;
-	# Recognize the basic CPU types with company name.
-	580-* \
-	| a29k-* \
-	| aarch64-* | aarch64_be-* \
-	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
-	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
-	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
-	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
-	| avr-* | avr32-* \
-	| ba-* \
-	| be32-* | be64-* \
-	| bfin-* | bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c4x-* \
-	| c8051-* | clipper-* | craynv-* | cydra-* \
-	| d10v-* | d30v-* | dlx-* \
-	| e2k-* | elxsi-* \
-	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
-	| h8300-* | h8500-* \
-	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
-	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia64-* \
-	| ip2k-* | iq2000-* \
-	| k1om-* \
-	| le32-* | le64-* \
-	| lm32-* \
-	| m32c-* | m32r-* | m32rle-* \
-	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
-	| microblaze-* | microblazeel-* \
-	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
-	| mips16-* \
-	| mips64-* | mips64el-* \
-	| mips64octeon-* | mips64octeonel-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64r5900-* | mips64r5900el-* \
-	| mips64vr-* | mips64vrel-* \
-	| mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* \
-	| mips64vr5000-* | mips64vr5000el-* \
-	| mips64vr5900-* | mips64vr5900el-* \
-	| mipsisa32-* | mipsisa32el-* \
-	| mipsisa32r2-* | mipsisa32r2el-* \
-	| mipsisa32r6-* | mipsisa32r6el-* \
-	| mipsisa64-* | mipsisa64el-* \
-	| mipsisa64r2-* | mipsisa64r2el-* \
-	| mipsisa64r6-* | mipsisa64r6el-* \
-	| mipsisa64sb1-* | mipsisa64sb1el-* \
-	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
-	| mipsr5900-* | mipsr5900el-* \
-	| mipstx39-* | mipstx39el-* \
-	| mmix-* \
-	| mt-* \
-	| msp430-* \
-	| nds32-* | nds32le-* | nds32be-* \
-	| nios-* | nios2-* | nios2eb-* | nios2el-* \
-	| none-* | np1-* | ns16k-* | ns32k-* \
-	| open8-* \
-	| or1k*-* \
-	| orion-* \
-	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
-	| pyramid-* \
-	| riscv32-* | riscv64-* \
-	| rl78-* | romp-* | rs6000-* | rx-* \
-	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
-	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
-	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
-	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
-	| tahoe-* \
-	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
-	| tile*-* \
-	| tron-* \
-	| ubicom32-* \
-	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
-	| vax-* \
-	| visium-* \
-	| we32k-* \
-	| x86-* | x86_64-* | xc16x-* | xps100-* \
-	| xstormy16-* | xtensa*-* \
-	| ymp-* \
-	| z8k-* | z80-*)
-		;;
-	# Recognize the basic CPU types without company name, with glob match.
-	xtensa*)
-		basic_machine=$basic_machine-unknown
-		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
-	386bsd)
-		basic_machine=i386-unknown
-		os=-bsd
-		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
-		basic_machine=m68000-att
+		cpu=m68000
+		vendor=att
 		;;
 	3b*)
-		basic_machine=we32k-att
-		;;
-	a29khif)
-		basic_machine=a29k-amd
-		os=-udi
-		;;
-	abacus)
-		basic_machine=abacus-unknown
-		;;
-	adobe68k)
-		basic_machine=m68010-adobe
-		os=-scout
-		;;
-	alliant | fx80)
-		basic_machine=fx80-alliant
-		;;
-	altos | altos3068)
-		basic_machine=m68k-altos
-		;;
-	am29k)
-		basic_machine=a29k-none
-		os=-bsd
-		;;
-	amd64)
-		basic_machine=x86_64-pc
-		;;
-	amd64-*)
-		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	amdahl)
-		basic_machine=580-amdahl
-		os=-sysv
-		;;
-	amiga | amiga-*)
-		basic_machine=m68k-unknown
-		;;
-	amigaos | amigados)
-		basic_machine=m68k-unknown
-		os=-amigaos
-		;;
-	amigaunix | amix)
-		basic_machine=m68k-unknown
-		os=-sysv4
-		;;
-	apollo68)
-		basic_machine=m68k-apollo
-		os=-sysv
-		;;
-	apollo68bsd)
-		basic_machine=m68k-apollo
-		os=-bsd
-		;;
-	aros)
-		basic_machine=i386-pc
-		os=-aros
-		;;
-	asmjs)
-		basic_machine=asmjs-unknown
-		;;
-	aux)
-		basic_machine=m68k-apple
-		os=-aux
-		;;
-	balance)
-		basic_machine=ns32k-sequent
-		os=-dynix
-		;;
-	blackfin)
-		basic_machine=bfin-unknown
-		os=-linux
-		;;
-	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
+		cpu=we32k
+		vendor=att
 		;;
 	bluegene*)
-		basic_machine=powerpc-ibm
-		os=-cnk
-		;;
-	c54x-*)
-		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	c55x-*)
-		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	c6x-*)
-		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	c90)
-		basic_machine=c90-cray
-		os=-unicos
-		;;
-	cegcc)
-		basic_machine=arm-unknown
-		os=-cegcc
-		;;
-	convex-c1)
-		basic_machine=c1-convex
-		os=-bsd
-		;;
-	convex-c2)
-		basic_machine=c2-convex
-		os=-bsd
-		;;
-	convex-c32)
-		basic_machine=c32-convex
-		os=-bsd
-		;;
-	convex-c34)
-		basic_machine=c34-convex
-		os=-bsd
-		;;
-	convex-c38)
-		basic_machine=c38-convex
-		os=-bsd
-		;;
-	cray | j90)
-		basic_machine=j90-cray
-		os=-unicos
-		;;
-	craynv)
-		basic_machine=craynv-cray
-		os=-unicosmp
-		;;
-	cr16 | cr16-*)
-		basic_machine=cr16-unknown
-		os=-elf
-		;;
-	crds | unos)
-		basic_machine=m68k-crds
-		;;
-	crisv32 | crisv32-* | etraxfs*)
-		basic_machine=crisv32-axis
-		;;
-	cris | cris-* | etrax*)
-		basic_machine=cris-axis
-		;;
-	crx)
-		basic_machine=crx-unknown
-		os=-elf
-		;;
-	da30 | da30-*)
-		basic_machine=m68k-da30
-		;;
-	decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn)
-		basic_machine=mips-dec
+		cpu=powerpc
+		vendor=ibm
+		basic_os=cnk
 		;;
 	decsystem10* | dec10*)
-		basic_machine=pdp10-dec
-		os=-tops10
+		cpu=pdp10
+		vendor=dec
+		basic_os=tops10
 		;;
 	decsystem20* | dec20*)
-		basic_machine=pdp10-dec
-		os=-tops20
+		cpu=pdp10
+		vendor=dec
+		basic_os=tops20
 		;;
 	delta | 3300 | motorola-3300 | motorola-delta \
 	      | 3300-motorola | delta-motorola)
-		basic_machine=m68k-motorola
+		cpu=m68k
+		vendor=motorola
 		;;
-	delta88)
-		basic_machine=m88k-motorola
-		os=-sysv3
-		;;
-	dicos)
-		basic_machine=i686-pc
-		os=-dicos
-		;;
-	djgpp)
-		basic_machine=i586-pc
-		os=-msdosdjgpp
-		;;
-	dpx20 | dpx20-*)
-		basic_machine=rs6000-bull
-		os=-bosx
-		;;
-	dpx2* | dpx2*-bull)
-		basic_machine=m68k-bull
-		os=-sysv3
-		;;
-	ebmon29k)
-		basic_machine=a29k-amd
-		os=-ebmon
-		;;
-	elxsi)
-		basic_machine=elxsi-elxsi
-		os=-bsd
+	dpx2*)
+		cpu=m68k
+		vendor=bull
+		basic_os=sysv3
 		;;
 	encore | umax | mmax)
-		basic_machine=ns32k-encore
+		cpu=ns32k
+		vendor=encore
 		;;
-	es1800 | OSE68k | ose68k | ose | OSE)
-		basic_machine=m68k-ericsson
-		os=-ose
+	elxsi)
+		cpu=elxsi
+		vendor=elxsi
+		basic_os=${basic_os:-bsd}
 		;;
 	fx2800)
-		basic_machine=i860-alliant
+		cpu=i860
+		vendor=alliant
 		;;
 	genix)
-		basic_machine=ns32k-ns
-		;;
-	gmicro)
-		basic_machine=tron-gmicro
-		os=-sysv
-		;;
-	go32)
-		basic_machine=i386-pc
-		os=-go32
+		cpu=ns32k
+		vendor=ns
 		;;
 	h3050r* | hiux*)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	h8300hms)
-		basic_machine=h8300-hitachi
-		os=-hms
-		;;
-	h8300xray)
-		basic_machine=h8300-hitachi
-		os=-xray
-		;;
-	h8500hms)
-		basic_machine=h8500-hitachi
-		os=-hms
-		;;
-	harris)
-		basic_machine=m88k-harris
-		os=-sysv3
-		;;
-	hp300-*)
-		basic_machine=m68k-hp
-		;;
-	hp300bsd)
-		basic_machine=m68k-hp
-		os=-bsd
-		;;
-	hp300hpux)
-		basic_machine=m68k-hp
-		os=-hpux
+		cpu=hppa1.1
+		vendor=hitachi
+		basic_os=hiuxwe2
 		;;
 	hp3k9[0-9][0-9] | hp9[0-9][0-9])
-		basic_machine=hppa1.0-hp
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	hp9k2[0-9][0-9] | hp9k31[0-9])
-		basic_machine=m68000-hp
+		cpu=m68000
+		vendor=hp
 		;;
 	hp9k3[2-9][0-9])
-		basic_machine=m68k-hp
+		cpu=m68k
+		vendor=hp
 		;;
 	hp9k6[0-9][0-9] | hp6[0-9][0-9])
-		basic_machine=hppa1.0-hp
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	hp9k7[0-79][0-9] | hp7[0-79][0-9])
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k78[0-9] | hp78[0-9])
 		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893)
 		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k8[0-9][13679] | hp8[0-9][13679])
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k8[0-9][0-9] | hp8[0-9][0-9])
-		basic_machine=hppa1.0-hp
-		;;
-	hppa-next)
-		os=-nextstep3
-		;;
-	hppaosf)
-		basic_machine=hppa1.1-hp
-		os=-osf
-		;;
-	hppro)
-		basic_machine=hppa1.1-hp
-		os=-proelf
-		;;
-	i370-ibm* | ibm*)
-		basic_machine=i370-ibm
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	i*86v32)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv32
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv4
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv4
 		;;
 	i*86v)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-solaris2
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=solaris2
 		;;
-	i386mach)
-		basic_machine=i386-mach
-		os=-mach
-		;;
-	i386-vsta | vsta)
-		basic_machine=i386-unknown
-		os=-vsta
+	j90 | j90-cray)
+		cpu=j90
+		vendor=cray
+		basic_os=${basic_os:-unicos}
 		;;
 	iris | iris4d)
-		basic_machine=mips-sgi
-		case $os in
-		    -irix*)
+		cpu=mips
+		vendor=sgi
+		case $basic_os in
+		    irix*)
 			;;
 		    *)
-			os=-irix4
+			basic_os=irix4
 			;;
 		esac
 		;;
-	isi68 | isi)
-		basic_machine=m68k-isi
-		os=-sysv
-		;;
-	leon-*|leon[3-9]-*)
-		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
-		;;
-	m68knommu)
-		basic_machine=m68k-unknown
-		os=-linux
-		;;
-	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
-	m88k-omron*)
-		basic_machine=m88k-omron
-		;;
-	magnum | m3230)
-		basic_machine=mips-mips
-		os=-sysv
-		;;
-	merlin)
-		basic_machine=ns32k-utek
-		os=-sysv
-		;;
-	microblaze*)
-		basic_machine=microblaze-xilinx
-		;;
-	mingw64)
-		basic_machine=x86_64-pc
-		os=-mingw64
-		;;
-	mingw32)
-		basic_machine=i686-pc
-		os=-mingw32
-		;;
-	mingw32ce)
-		basic_machine=arm-unknown
-		os=-mingw32ce
-		;;
 	miniframe)
-		basic_machine=m68000-convergent
-		;;
-	*mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*)
-		basic_machine=m68k-atari
-		os=-mint
-		;;
-	mips3*-*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
-		;;
-	mips3*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
-		;;
-	monitor)
-		basic_machine=m68k-rom68k
-		os=-coff
-		;;
-	morphos)
-		basic_machine=powerpc-unknown
-		os=-morphos
-		;;
-	moxiebox)
-		basic_machine=moxie-unknown
-		os=-moxiebox
-		;;
-	msdos)
-		basic_machine=i386-pc
-		os=-msdos
-		;;
-	ms1-*)
-		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
-		;;
-	msys)
-		basic_machine=i686-pc
-		os=-msys
-		;;
-	mvs)
-		basic_machine=i370-ibm
-		os=-mvs
-		;;
-	nacl)
-		basic_machine=le32-unknown
-		os=-nacl
+		cpu=m68000
+		vendor=convergent
 		;;
-	ncr3000)
-		basic_machine=i486-ncr
-		os=-sysv4
-		;;
-	netbsd386)
-		basic_machine=i386-unknown
-		os=-netbsd
-		;;
-	netwinder)
-		basic_machine=armv4l-rebel
-		os=-linux
-		;;
-	news | news700 | news800 | news900)
-		basic_machine=m68k-sony
-		os=-newsos
-		;;
-	news1000)
-		basic_machine=m68030-sony
-		os=-newsos
+	*mint | mint[0-9]* | *MiNT | *MiNT[0-9]*)
+		cpu=m68k
+		vendor=atari
+		basic_os=mint
 		;;
 	news-3600 | risc-news)
-		basic_machine=mips-sony
-		os=-newsos
-		;;
-	necv70)
-		basic_machine=v70-nec
-		os=-sysv
-		;;
-	next | m*-next )
-		basic_machine=m68k-next
-		case $os in
-		    -nextstep* )
+		cpu=mips
+		vendor=sony
+		basic_os=newsos
+		;;
+	next | m*-next)
+		cpu=m68k
+		vendor=next
+		case $basic_os in
+		    openstep*)
+		        ;;
+		    nextstep*)
 			;;
-		    -ns2*)
-		      os=-nextstep2
+		    ns2*)
+		      basic_os=nextstep2
 			;;
 		    *)
-		      os=-nextstep3
+		      basic_os=nextstep3
 			;;
 		esac
 		;;
-	nh3000)
-		basic_machine=m68k-harris
-		os=-cxux
-		;;
-	nh[45]000)
-		basic_machine=m88k-harris
-		os=-cxux
-		;;
-	nindy960)
-		basic_machine=i960-intel
-		os=-nindy
-		;;
-	mon960)
-		basic_machine=i960-intel
-		os=-mon960
-		;;
-	nonstopux)
-		basic_machine=mips-compaq
-		os=-nonstopux
-		;;
 	np1)
-		basic_machine=np1-gould
-		;;
-	neo-tandem)
-		basic_machine=neo-tandem
-		;;
-	nse-tandem)
-		basic_machine=nse-tandem
-		;;
-	nsr-tandem)
-		basic_machine=nsr-tandem
+		cpu=np1
+		vendor=gould
 		;;
 	op50n-* | op60c-*)
-		basic_machine=hppa1.1-oki
-		os=-proelf
-		;;
-	openrisc | openrisc-*)
-		basic_machine=or32-unknown
-		;;
-	os400)
-		basic_machine=powerpc-ibm
-		os=-os400
-		;;
-	OSE68000 | ose68000)
-		basic_machine=m68000-ericsson
-		os=-ose
-		;;
-	os68k)
-		basic_machine=m68k-none
-		os=-os68k
+		cpu=hppa1.1
+		vendor=oki
+		basic_os=proelf
 		;;
 	pa-hitachi)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	paragon)
-		basic_machine=i860-intel
-		os=-osf
-		;;
-	parisc)
-		basic_machine=hppa-unknown
-		os=-linux
-		;;
-	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
+		cpu=hppa1.1
+		vendor=hitachi
+		basic_os=hiuxwe2
 		;;
 	pbd)
-		basic_machine=sparc-tti
+		cpu=sparc
+		vendor=tti
 		;;
 	pbb)
-		basic_machine=m68k-tti
-		;;
-	pc532 | pc532-*)
-		basic_machine=ns32k-pc532
-		;;
-	pc98)
-		basic_machine=i386-pc
+		cpu=m68k
+		vendor=tti
 		;;
-	pc98-*)
-		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentium | p5 | k5 | k6 | nexgen | viac3)
-		basic_machine=i586-pc
-		;;
-	pentiumpro | p6 | 6x86 | athlon | athlon_*)
-		basic_machine=i686-pc
-		;;
-	pentiumii | pentium2 | pentiumiii | pentium3)
-		basic_machine=i686-pc
-		;;
-	pentium4)
-		basic_machine=i786-pc
-		;;
-	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentium4-*)
-		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+	pc532)
+		cpu=ns32k
+		vendor=pc532
 		;;
 	pn)
-		basic_machine=pn-gould
-		;;
-	power)	basic_machine=power-ibm
-		;;
-	ppc | ppcbe)	basic_machine=powerpc-unknown
+		cpu=pn
+		vendor=gould
 		;;
-	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppcle | powerpclittle | ppc-le | powerpc-little)
-		basic_machine=powerpcle-unknown
-		;;
-	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppc64)	basic_machine=powerpc64-unknown
-		;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
-		basic_machine=powerpc64le-unknown
-		;;
-	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
+	power)
+		cpu=power
+		vendor=ibm
 		;;
 	ps2)
-		basic_machine=i386-ibm
-		;;
-	pw32)
-		basic_machine=i586-unknown
-		os=-pw32
-		;;
-	rdos | rdos64)
-		basic_machine=x86_64-pc
-		os=-rdos
-		;;
-	rdos32)
-		basic_machine=i386-pc
-		os=-rdos
-		;;
-	rom68k)
-		basic_machine=m68k-rom68k
-		os=-coff
+		cpu=i386
+		vendor=ibm
 		;;
 	rm[46]00)
-		basic_machine=mips-siemens
+		cpu=mips
+		vendor=siemens
 		;;
 	rtpc | rtpc-*)
-		basic_machine=romp-ibm
-		;;
-	s390 | s390-*)
-		basic_machine=s390-ibm
+		cpu=romp
+		vendor=ibm
 		;;
-	s390x | s390x-*)
-		basic_machine=s390x-ibm
-		;;
-	sa29200)
-		basic_machine=a29k-amd
-		os=-udi
+	sde)
+		cpu=mipsisa32
+		vendor=sde
+		basic_os=${basic_os:-elf}
 		;;
-	sb1)
-		basic_machine=mipsisa64sb1-unknown
+	simso-wrs)
+		cpu=sparclite
+		vendor=wrs
+		basic_os=vxworks
 		;;
-	sb1el)
-		basic_machine=mipsisa64sb1el-unknown
+	tower | tower-32)
+		cpu=m68k
+		vendor=ncr
 		;;
-	sde)
-		basic_machine=mipsisa32-sde
-		os=-elf
+	vpp*|vx|vx-*)
+		cpu=f301
+		vendor=fujitsu
 		;;
-	sei)
-		basic_machine=mips-sei
-		os=-seiux
+	w65)
+		cpu=w65
+		vendor=wdc
 		;;
-	sequent)
-		basic_machine=i386-sequent
+	w89k-*)
+		cpu=hppa1.1
+		vendor=winbond
+		basic_os=proelf
 		;;
-	sh)
-		basic_machine=sh-hitachi
-		os=-hms
+	none)
+		cpu=none
+		vendor=none
 		;;
-	sh5el)
-		basic_machine=sh5le-unknown
+	leon|leon[3-9])
+		cpu=sparc
+		vendor=$basic_machine
 		;;
-	sh64)
-		basic_machine=sh64-unknown
+	leon-*|leon[3-9]-*)
+		cpu=sparc
+		vendor=`echo "$basic_machine" | sed 's/-.*//'`
 		;;
-	sparclite-wrs | simso-wrs)
-		basic_machine=sparclite-wrs
-		os=-vxworks
+
+	*-*)
+		# shellcheck disable=SC2162
+		saved_IFS=$IFS
+		IFS="-" read cpu vendor <<EOF
+$basic_machine
+EOF
+		IFS=$saved_IFS
 		;;
-	sps7)
-		basic_machine=m68k-bull
-		os=-sysv2
+	# We use `pc' rather than `unknown'
+	# because (1) that's what they normally are, and
+	# (2) the word "unknown" tends to confuse beginning users.
+	i*86 | x86_64)
+		cpu=$basic_machine
+		vendor=pc
 		;;
-	spur)
-		basic_machine=spur-unknown
+	# These rules are duplicated from below for sake of the special case above;
+	# i.e. things that normalized to x86 arches should also default to "pc"
+	pc98)
+		cpu=i386
+		vendor=pc
 		;;
-	st2000)
-		basic_machine=m68k-tandem
+	x64 | amd64)
+		cpu=x86_64
+		vendor=pc
 		;;
-	stratus)
-		basic_machine=i860-stratus
-		os=-sysv4
+	# Recognize the basic CPU types without company name.
+	*)
+		cpu=$basic_machine
+		vendor=unknown
 		;;
-	strongarm-* | thumb-*)
-		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
+esac
+
+unset -v basic_machine
+
+# Decode basic machines in the full and proper CPU-Company form.
+case $cpu-$vendor in
+	# Here we handle the default manufacturer of certain CPU types in canonical form. It is in
+	# some cases the only manufacturer, in others, it is the most popular.
+	craynv-unknown)
+		vendor=cray
+		basic_os=${basic_os:-unicosmp}
 		;;
-	sun2)
-		basic_machine=m68000-sun
+	c90-unknown | c90-cray)
+		vendor=cray
+		basic_os=${Basic_os:-unicos}
 		;;
-	sun2os3)
-		basic_machine=m68000-sun
-		os=-sunos3
+	fx80-unknown)
+		vendor=alliant
 		;;
-	sun2os4)
-		basic_machine=m68000-sun
-		os=-sunos4
+	romp-unknown)
+		vendor=ibm
 		;;
-	sun3os3)
-		basic_machine=m68k-sun
-		os=-sunos3
+	mmix-unknown)
+		vendor=knuth
 		;;
-	sun3os4)
-		basic_machine=m68k-sun
-		os=-sunos4
+	microblaze-unknown | microblazeel-unknown)
+		vendor=xilinx
 		;;
-	sun4os3)
-		basic_machine=sparc-sun
-		os=-sunos3
+	rs6000-unknown)
+		vendor=ibm
 		;;
-	sun4os4)
-		basic_machine=sparc-sun
-		os=-sunos4
+	vax-unknown)
+		vendor=dec
 		;;
-	sun4sol2)
-		basic_machine=sparc-sun
-		os=-solaris2
+	pdp11-unknown)
+		vendor=dec
 		;;
-	sun3 | sun3-*)
-		basic_machine=m68k-sun
+	we32k-unknown)
+		vendor=att
 		;;
-	sun4)
-		basic_machine=sparc-sun
+	cydra-unknown)
+		vendor=cydrome
 		;;
-	sun386 | sun386i | roadrunner)
-		basic_machine=i386-sun
+	i370-ibm*)
+		vendor=ibm
 		;;
-	sv1)
-		basic_machine=sv1-cray
-		os=-unicos
+	orion-unknown)
+		vendor=highlevel
 		;;
-	symmetry)
-		basic_machine=i386-sequent
-		os=-dynix
+	xps-unknown | xps100-unknown)
+		cpu=xps100
+		vendor=honeywell
 		;;
-	t3e)
-		basic_machine=alphaev5-cray
-		os=-unicos
+
+	# Here we normalize CPU types with a missing or matching vendor
+	armh-unknown | armh-alt)
+		cpu=armv7l
+		vendor=alt
+		basic_os=${basic_os:-linux-gnueabihf}
 		;;
-	t90)
-		basic_machine=t90-cray
-		os=-unicos
+	dpx20-unknown | dpx20-bull)
+		cpu=rs6000
+		vendor=bull
+		basic_os=${basic_os:-bosx}
 		;;
-	tile*)
-		basic_machine=$basic_machine-unknown
-		os=-linux-gnu
+
+	# Here we normalize CPU types irrespective of the vendor
+	amd64-*)
+		cpu=x86_64
 		;;
-	tx39)
-		basic_machine=mipstx39-unknown
+	blackfin-*)
+		cpu=bfin
+		basic_os=linux
 		;;
-	tx39el)
-		basic_machine=mipstx39el-unknown
+	c54x-*)
+		cpu=tic54x
 		;;
-	toad1)
-		basic_machine=pdp10-xkl
-		os=-tops20
+	c55x-*)
+		cpu=tic55x
 		;;
-	tower | tower-32)
-		basic_machine=m68k-ncr
+	c6x-*)
+		cpu=tic6x
 		;;
-	tpf)
-		basic_machine=s390x-ibm
-		os=-tpf
+	e500v[12]-*)
+		cpu=powerpc
+		basic_os=${basic_os}"spe"
 		;;
-	udi29k)
-		basic_machine=a29k-amd
-		os=-udi
+	mips3*-*)
+		cpu=mips64
 		;;
-	ultra3)
-		basic_machine=a29k-nyu
-		os=-sym1
+	ms1-*)
+		cpu=mt
 		;;
-	v810 | necv810)
-		basic_machine=v810-nec
-		os=-none
+	m68knommu-*)
+		cpu=m68k
+		basic_os=linux
 		;;
-	vaxv)
-		basic_machine=vax-dec
-		os=-sysv
+	m9s12z-* | m68hcs12z-* | hcs12z-* | s12z-*)
+		cpu=s12z
 		;;
-	vms)
-		basic_machine=vax-dec
-		os=-vms
+	openrisc-*)
+		cpu=or32
 		;;
-	vpp*|vx|vx-*)
-		basic_machine=f301-fujitsu
+	parisc-*)
+		cpu=hppa
+		basic_os=linux
 		;;
-	vxworks960)
-		basic_machine=i960-wrs
-		os=-vxworks
+	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
+		cpu=i586
 		;;
-	vxworks68)
-		basic_machine=m68k-wrs
-		os=-vxworks
+	pentiumpro-* | p6-* | 6x86-* | athlon-* | athalon_*-*)
+		cpu=i686
 		;;
-	vxworks29k)
-		basic_machine=a29k-wrs
-		os=-vxworks
+	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
+		cpu=i686
 		;;
-	w65*)
-		basic_machine=w65-wdc
-		os=-none
+	pentium4-*)
+		cpu=i786
 		;;
-	w89k-*)
-		basic_machine=hppa1.1-winbond
-		os=-proelf
+	pc98-*)
+		cpu=i386
 		;;
-	xbox)
-		basic_machine=i686-pc
-		os=-mingw32
+	ppc-* | ppcbe-*)
+		cpu=powerpc
 		;;
-	xps | xps100)
-		basic_machine=xps100-honeywell
+	ppcle-* | powerpclittle-*)
+		cpu=powerpcle
 		;;
-	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
+	ppc64-*)
+		cpu=powerpc64
 		;;
-	ymp)
-		basic_machine=ymp-cray
-		os=-unicos
+	ppc64le-* | powerpc64little-*)
+		cpu=powerpc64le
 		;;
-	z8k-*-coff)
-		basic_machine=z8k-unknown
-		os=-sim
+	sb1-*)
+		cpu=mipsisa64sb1
 		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
+	sb1el-*)
+		cpu=mipsisa64sb1el
 		;;
-	none)
-		basic_machine=none-none
-		os=-none
+	sh5e[lb]-*)
+		cpu=`echo "$cpu" | sed 's/^\(sh.\)e\(.\)$/\1\2e/'`
 		;;
-
-# Here we handle the default manufacturer of certain CPU types.  It is in
-# some cases the only manufacturer, in others, it is the most popular.
-	w89k)
-		basic_machine=hppa1.1-winbond
+	spur-*)
+		cpu=spur
 		;;
-	op50n)
-		basic_machine=hppa1.1-oki
+	strongarm-* | thumb-*)
+		cpu=arm
 		;;
-	op60c)
-		basic_machine=hppa1.1-oki
+	tx39-*)
+		cpu=mipstx39
 		;;
-	romp)
-		basic_machine=romp-ibm
+	tx39el-*)
+		cpu=mipstx39el
 		;;
-	mmix)
-		basic_machine=mmix-knuth
+	x64-*)
+		cpu=x86_64
 		;;
-	rs6000)
-		basic_machine=rs6000-ibm
+	xscale-* | xscalee[bl]-*)
+		cpu=`echo "$cpu" | sed 's/^xscale/arm/'`
 		;;
-	vax)
-		basic_machine=vax-dec
+	arm64-* | aarch64le-*)
+		cpu=aarch64
 		;;
-	pdp10)
-		# there are many clones, so DEC is not a safe bet
-		basic_machine=pdp10-unknown
+
+	# Recognize the canonical CPU Types that limit and/or modify the
+	# company names they are paired with.
+	cr16-*)
+		basic_os=${basic_os:-elf}
 		;;
-	pdp11)
-		basic_machine=pdp11-dec
+	crisv32-* | etraxfs*-*)
+		cpu=crisv32
+		vendor=axis
 		;;
-	we32k)
-		basic_machine=we32k-att
+	cris-* | etrax*-*)
+		cpu=cris
+		vendor=axis
 		;;
-	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
-		basic_machine=sh-unknown
+	crx-*)
+		basic_os=${basic_os:-elf}
 		;;
-	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
-		basic_machine=sparc-sun
+	neo-tandem)
+		cpu=neo
+		vendor=tandem
 		;;
-	cydra)
-		basic_machine=cydra-cydrome
+	nse-tandem)
+		cpu=nse
+		vendor=tandem
 		;;
-	orion)
-		basic_machine=orion-highlevel
+	nsr-tandem)
+		cpu=nsr
+		vendor=tandem
 		;;
-	orion105)
-		basic_machine=clipper-highlevel
+	nsv-tandem)
+		cpu=nsv
+		vendor=tandem
 		;;
-	mac | mpw | mac-mpw)
-		basic_machine=m68k-apple
+	nsx-tandem)
+		cpu=nsx
+		vendor=tandem
 		;;
-	pmac | pmac-mpw)
-		basic_machine=powerpc-apple
+	mipsallegrexel-sony)
+		cpu=mipsallegrexel
+		vendor=sony
 		;;
-	*-unknown)
-		# Make sure to match an already-canonicalized machine name.
+	tile*-*)
+		basic_os=${basic_os:-linux-gnu}
 		;;
+
 	*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
+		# Recognize the canonical CPU types that are allowed with any
+		# company name.
+		case $cpu in
+			1750a | 580 \
+			| a29k \
+			| aarch64 | aarch64_be \
+			| abacus \
+			| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \
+			| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \
+			| alphapca5[67] | alpha64pca5[67] \
+			| am33_2.0 \
+			| amdgcn \
+			| arc | arceb | arc32 | arc64 \
+			| arm | arm[lb]e | arme[lb] | armv* \
+			| avr | avr32 \
+			| asmjs \
+			| ba \
+			| be32 | be64 \
+			| bfin | bpf | bs2000 \
+			| c[123]* | c30 | [cjt]90 | c4x \
+			| c8051 | clipper | craynv | csky | cydra \
+			| d10v | d30v | dlx | dsp16xx \
+			| e2k | elxsi | epiphany \
+			| f30[01] | f700 | fido | fr30 | frv | ft32 | fx80 \
+			| h8300 | h8500 \
+			| hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
+			| hexagon \
+			| i370 | i*86 | i860 | i960 | ia16 | ia64 \
+			| ip2k | iq2000 \
+			| k1om \
+			| le32 | le64 \
+			| lm32 \
+			| loongarch32 | loongarch64 | loongarchx32 \
+			| m32c | m32r | m32rle \
+			| m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | m68k \
+			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
+			| m88110 | m88k | maxq | mb | mcore | mep | metag \
+			| microblaze | microblazeel \
+			| mips | mipsbe | mipseb | mipsel | mipsle \
+			| mips16 \
+			| mips64 | mips64eb | mips64el \
+			| mips64octeon | mips64octeonel \
+			| mips64orion | mips64orionel \
+			| mips64r5900 | mips64r5900el \
+			| mips64vr | mips64vrel \
+			| mips64vr4100 | mips64vr4100el \
+			| mips64vr4300 | mips64vr4300el \
+			| mips64vr5000 | mips64vr5000el \
+			| mips64vr5900 | mips64vr5900el \
+			| mipsisa32 | mipsisa32el \
+			| mipsisa32r2 | mipsisa32r2el \
+			| mipsisa32r3 | mipsisa32r3el \
+			| mipsisa32r5 | mipsisa32r5el \
+			| mipsisa32r6 | mipsisa32r6el \
+			| mipsisa64 | mipsisa64el \
+			| mipsisa64r2 | mipsisa64r2el \
+			| mipsisa64r3 | mipsisa64r3el \
+			| mipsisa64r5 | mipsisa64r5el \
+			| mipsisa64r6 | mipsisa64r6el \
+			| mipsisa64sb1 | mipsisa64sb1el \
+			| mipsisa64sr71k | mipsisa64sr71kel \
+			| mipsr5900 | mipsr5900el \
+			| mipstx39 | mipstx39el \
+			| mmix \
+			| mn10200 | mn10300 \
+			| moxie \
+			| mt \
+			| msp430 \
+			| nds32 | nds32le | nds32be \
+			| nfp \
+			| nios | nios2 | nios2eb | nios2el \
+			| none | np1 | ns16k | ns32k | nvptx \
+			| open8 \
+			| or1k* \
+			| or32 \
+			| orion \
+			| picochip \
+			| pdp10 | pdp11 | pj | pjl | pn | power \
+			| powerpc | powerpc64 | powerpc64le | powerpcle | powerpcspe \
+			| pru \
+			| pyramid \
+			| riscv | riscv32 | riscv32be | riscv64 | riscv64be \
+			| rl78 | romp | rs6000 | rx \
+			| s390 | s390x \
+			| score \
+			| sh | shl \
+			| sh[1234] | sh[24]a | sh[24]ae[lb] | sh[23]e | she[lb] | sh[lb]e \
+			| sh[1234]e[lb] |  sh[12345][lb]e | sh[23]ele | sh64 | sh64le \
+			| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet \
+			| sparclite \
+			| sparcv8 | sparcv9 | sparcv9b | sparcv9v | sv1 | sx* \
+			| spu \
+			| tahoe \
+			| thumbv7* \
+			| tic30 | tic4x | tic54x | tic55x | tic6x | tic80 \
+			| tron \
+			| ubicom32 \
+			| v70 | v850 | v850e | v850e1 | v850es | v850e2 | v850e2v3 \
+			| vax \
+			| visium \
+			| w65 \
+			| wasm32 | wasm64 \
+			| we32k \
+			| x86 | x86_64 | xc16x | xgate | xps100 \
+			| xstormy16 | xtensa* \
+			| ymp \
+			| z8k | z80)
+				;;
+
+			*)
+				echo Invalid configuration \`"$1"\': machine \`"$cpu-$vendor"\' not recognized 1>&2
+				exit 1
+				;;
+		esac
 		;;
 esac
 
 # Here we canonicalize certain aliases for manufacturers.
-case $basic_machine in
-	*-digital*)
-		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
+case $vendor in
+	digital*)
+		vendor=dec
 		;;
-	*-commodore*)
-		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
+	commodore*)
+		vendor=cbm
 		;;
 	*)
 		;;
@@ -1345,203 +1306,215 @@ esac
 
 # Decode manufacturer-specific aliases for certain operating systems.
 
-if [ x"$os" != x"" ]
+if test x$basic_os != x
 then
-case $os in
-	# First match some system type aliases
-	# that might get confused with valid system types.
-	# -solaris* is a basic system type, with this one exception.
-	-auroraux)
-		os=-auroraux
+
+# First recognize some ad-hoc cases, or perhaps split kernel-os, or else just
+# set os.
+case $basic_os in
+	gnu/linux*)
+		kernel=linux
+		os=`echo "$basic_os" | sed -e 's|gnu/linux|gnu|'`
+		;;
+	os2-emx)
+		kernel=os2
+		os=`echo "$basic_os" | sed -e 's|os2-emx|emx|'`
+		;;
+	nto-qnx*)
+		kernel=nto
+		os=`echo "$basic_os" | sed -e 's|nto-qnx|qnx|'`
+		;;
+	*-*)
+		# shellcheck disable=SC2162
+		saved_IFS=$IFS
+		IFS="-" read kernel os <<EOF
+$basic_os
+EOF
+		IFS=$saved_IFS
+		;;
+	# Default OS when just kernel was specified
+	nto*)
+		kernel=nto
+		os=`echo "$basic_os" | sed -e 's|nto|qnx|'`
+		;;
+	linux*)
+		kernel=linux
+		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
 		;;
-	-solaris1 | -solaris1.*)
-		os=`echo $os | sed -e 's|solaris1|sunos4|'`
+	*)
+		kernel=
+		os=$basic_os
 		;;
-	-solaris)
-		os=-solaris2
+esac
+
+# Now, normalize the OS (knowing we just have one component, it's not a kernel,
+# etc.)
+case $os in
+	# First match some system type aliases that might get confused
+	# with valid system types.
+	# solaris* is a basic system type, with this one exception.
+	auroraux)
+		os=auroraux
 		;;
-	-svr4*)
-		os=-sysv4
+	bluegene*)
+		os=cnk
 		;;
-	-unixware*)
-		os=-sysv4.2uw
+	solaris1 | solaris1.*)
+		os=`echo "$os" | sed -e 's|solaris1|sunos4|'`
 		;;
-	-gnu/linux*)
-		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
+	solaris)
+		os=solaris2
 		;;
-	# First accept the basic system types.
-	# The portable systems comes first.
-	# Each alternative MUST END IN A *, to match a version number.
-	# -sysv* is not here because it comes later, after sysvr4.
-	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	      | -sym* | -kopensolaris* | -plan9* \
-	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* | -cloudabi* | -sortix* \
-	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
-	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
-	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
-	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
-	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
-	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
-	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
-	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
-	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
-	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
-	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
-	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
-	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
-	      | -onefs* | -tirtos*)
-	# Remember, each alternative MUST END IN *, to match a version number.
-		;;
-	-qnx*)
-		case $basic_machine in
-		    x86-* | i*86-*)
-			;;
-		    *)
-			os=-nto$os
-			;;
-		esac
+	unixware*)
+		os=sysv4.2uw
 		;;
-	-nto-qnx*)
+	# es1800 is here to avoid being matched by es* (a different OS)
+	es1800*)
+		os=ose
 		;;
-	-nto*)
-		os=`echo $os | sed -e 's|nto|nto-qnx|'`
+	# Some version numbers need modification
+	chorusos*)
+		os=chorusos
 		;;
-	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
-	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
+	isc)
+		os=isc2.2
 		;;
-	-mac*)
-		os=`echo $os | sed -e 's|mac|macos|'`
+	sco6)
+		os=sco5v6
 		;;
-	-linux-dietlibc)
-		os=-linux-dietlibc
+	sco5)
+		os=sco3.2v5
 		;;
-	-linux*)
-		os=`echo $os | sed -e 's|linux|linux-gnu|'`
+	sco4)
+		os=sco3.2v4
 		;;
-	-sunos5*)
-		os=`echo $os | sed -e 's|sunos5|solaris2|'`
+	sco3.2.[4-9]*)
+		os=`echo "$os" | sed -e 's/sco3.2./sco3.2v/'`
 		;;
-	-sunos6*)
-		os=`echo $os | sed -e 's|sunos6|solaris3|'`
+	sco*v* | scout)
+		# Don't match below
 		;;
-	-opened*)
-		os=-openedition
+	sco*)
+		os=sco3.2v2
 		;;
-	-os400*)
-		os=-os400
+	psos*)
+		os=psos
 		;;
-	-wince*)
-		os=-wince
+	qnx*)
+		os=qnx
 		;;
-	-osfrose*)
-		os=-osfrose
+	hiux*)
+		os=hiuxwe2
 		;;
-	-osf*)
-		os=-osf
+	lynx*178)
+		os=lynxos178
 		;;
-	-utek*)
-		os=-bsd
+	lynx*5)
+		os=lynxos5
 		;;
-	-dynix*)
-		os=-bsd
+	lynxos*)
+		# don't get caught up in next wildcard
 		;;
-	-acis*)
-		os=-aos
+	lynx*)
+		os=lynxos
 		;;
-	-atheos*)
-		os=-atheos
+	mac[0-9]*)
+		os=`echo "$os" | sed -e 's|mac|macos|'`
 		;;
-	-syllable*)
-		os=-syllable
+	opened*)
+		os=openedition
 		;;
-	-386bsd)
-		os=-bsd
+	os400*)
+		os=os400
 		;;
-	-ctix* | -uts*)
-		os=-sysv
+	sunos5*)
+		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
 		;;
-	-nova*)
-		os=-rtmk-nova
+	sunos6*)
+		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
 		;;
-	-ns2 )
-		os=-nextstep2
+	wince*)
+		os=wince
 		;;
-	-nsk*)
-		os=-nsk
+	utek*)
+		os=bsd
 		;;
-	# Preserve the version number of sinix5.
-	-sinix5.*)
-		os=`echo $os | sed -e 's|sinix|sysv|'`
+	dynix*)
+		os=bsd
 		;;
-	-sinix*)
-		os=-sysv4
+	acis*)
+		os=aos
 		;;
-	-tpf*)
-		os=-tpf
+	atheos*)
+		os=atheos
 		;;
-	-triton*)
-		os=-sysv3
+	syllable*)
+		os=syllable
 		;;
-	-oss*)
-		os=-sysv3
+	386bsd)
+		os=bsd
+		;;
+	ctix* | uts*)
+		os=sysv
 		;;
-	-svr4)
-		os=-sysv4
+	nova*)
+		os=rtmk-nova
 		;;
-	-svr3)
-		os=-sysv3
+	ns2)
+		os=nextstep2
 		;;
-	-sysvr4)
-		os=-sysv4
+	# Preserve the version number of sinix5.
+	sinix5.*)
+		os=`echo "$os" | sed -e 's|sinix|sysv|'`
 		;;
-	# This must come after -sysvr4.
-	-sysv*)
+	sinix*)
+		os=sysv4
 		;;
-	-ose*)
-		os=-ose
+	tpf*)
+		os=tpf
 		;;
-	-es1800*)
-		os=-ose
+	triton*)
+		os=sysv3
 		;;
-	-xenix)
-		os=-xenix
+	oss*)
+		os=sysv3
 		;;
-	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-		os=-mint
+	svr4*)
+		os=sysv4
 		;;
-	-aros*)
-		os=-aros
+	svr3)
+		os=sysv3
 		;;
-	-zvmoe)
-		os=-zvmoe
+	sysvr4)
+		os=sysv4
 		;;
-	-dicos*)
-		os=-dicos
+	ose*)
+		os=ose
 		;;
-	-nacl*)
+	*mint | mint[0-9]* | *MiNT | MiNT[0-9]*)
+		os=mint
 		;;
-	-ios)
+	dicos*)
+		os=dicos
 		;;
-	-none)
+	pikeos*)
+		# Until real need of OS specific support for
+		# particular features comes up, bare metal
+		# configurations are quite functional.
+		case $cpu in
+		    arm*)
+			os=eabi
+			;;
+		    *)
+			os=elf
+			;;
+		esac
 		;;
 	*)
-		# Get rid of the `-' at the beginning of $os.
-		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
-		exit 1
+		# No normalization, but not necessarily accepted, that comes below.
 		;;
 esac
+
 else
 
 # Here we handle the default operating systems that come with various machines.
@@ -1554,261 +1527,363 @@ else
 # will signal an error saying that MANUFACTURER isn't an operating
 # system, and we'll never get to this point.
 
-case $basic_machine in
+kernel=
+case $cpu-$vendor in
 	score-*)
-		os=-elf
+		os=elf
 		;;
 	spu-*)
-		os=-elf
+		os=elf
 		;;
 	*-acorn)
-		os=-riscix1.2
+		os=riscix1.2
 		;;
 	arm*-rebel)
-		os=-linux
+		kernel=linux
+		os=gnu
 		;;
 	arm*-semi)
-		os=-aout
+		os=aout
 		;;
 	c4x-* | tic4x-*)
-		os=-coff
+		os=coff
 		;;
 	c8051-*)
-		os=-elf
+		os=elf
+		;;
+	clipper-intergraph)
+		os=clix
 		;;
 	hexagon-*)
-		os=-elf
+		os=elf
 		;;
 	tic54x-*)
-		os=-coff
+		os=coff
 		;;
 	tic55x-*)
-		os=-coff
+		os=coff
 		;;
 	tic6x-*)
-		os=-coff
+		os=coff
 		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
-		os=-tops20
+		os=tops20
 		;;
 	pdp11-*)
-		os=-none
+		os=none
 		;;
 	*-dec | vax-*)
-		os=-ultrix4.2
+		os=ultrix4.2
 		;;
 	m68*-apollo)
-		os=-domain
+		os=domain
 		;;
 	i386-sun)
-		os=-sunos4.0.2
+		os=sunos4.0.2
 		;;
 	m68000-sun)
-		os=-sunos3
+		os=sunos3
 		;;
 	m68*-cisco)
-		os=-aout
+		os=aout
 		;;
 	mep-*)
-		os=-elf
+		os=elf
 		;;
 	mips*-cisco)
-		os=-elf
+		os=elf
 		;;
 	mips*-*)
-		os=-elf
+		os=elf
 		;;
 	or32-*)
-		os=-coff
+		os=coff
 		;;
 	*-tti)	# must be before sparc entry or we get the wrong os.
-		os=-sysv3
+		os=sysv3
 		;;
 	sparc-* | *-sun)
-		os=-sunos4.1.1
+		os=sunos4.1.1
 		;;
-	*-be)
-		os=-beos
+	pru-*)
+		os=elf
 		;;
-	*-haiku)
-		os=-haiku
+	*-be)
+		os=beos
 		;;
 	*-ibm)
-		os=-aix
+		os=aix
 		;;
 	*-knuth)
-		os=-mmixware
+		os=mmixware
 		;;
 	*-wec)
-		os=-proelf
+		os=proelf
 		;;
 	*-winbond)
-		os=-proelf
+		os=proelf
 		;;
 	*-oki)
-		os=-proelf
+		os=proelf
 		;;
 	*-hp)
-		os=-hpux
+		os=hpux
 		;;
 	*-hitachi)
-		os=-hiux
+		os=hiux
 		;;
 	i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent)
-		os=-sysv
+		os=sysv
 		;;
 	*-cbm)
-		os=-amigaos
+		os=amigaos
 		;;
 	*-dg)
-		os=-dgux
+		os=dgux
 		;;
 	*-dolphin)
-		os=-sysv3
+		os=sysv3
 		;;
 	m68k-ccur)
-		os=-rtu
+		os=rtu
 		;;
 	m88k-omron*)
-		os=-luna
+		os=luna
 		;;
-	*-next )
-		os=-nextstep
+	*-next)
+		os=nextstep
 		;;
 	*-sequent)
-		os=-ptx
+		os=ptx
 		;;
 	*-crds)
-		os=-unos
+		os=unos
 		;;
 	*-ns)
-		os=-genix
+		os=genix
 		;;
 	i370-*)
-		os=-mvs
-		;;
-	*-next)
-		os=-nextstep3
+		os=mvs
 		;;
 	*-gould)
-		os=-sysv
+		os=sysv
 		;;
 	*-highlevel)
-		os=-bsd
+		os=bsd
 		;;
 	*-encore)
-		os=-bsd
+		os=bsd
 		;;
 	*-sgi)
-		os=-irix
+		os=irix
 		;;
 	*-siemens)
-		os=-sysv4
+		os=sysv4
 		;;
 	*-masscomp)
-		os=-rtu
+		os=rtu
 		;;
 	f30[01]-fujitsu | f700-fujitsu)
-		os=-uxpv
+		os=uxpv
 		;;
 	*-rom68k)
-		os=-coff
+		os=coff
 		;;
 	*-*bug)
-		os=-coff
+		os=coff
 		;;
 	*-apple)
-		os=-macos
+		os=macos
 		;;
 	*-atari*)
-		os=-mint
+		os=mint
+		;;
+	*-wrs)
+		os=vxworks
 		;;
 	*)
-		os=-none
+		os=none
 		;;
 esac
+
 fi
 
+# Now, validate our (potentially fixed-up) OS.
+case $os in
+	# Sometimes we do "kernel-libc", so those need to count as OSes.
+	musl* | newlib* | relibc* | uclibc*)
+		;;
+	# Likewise for "kernel-abi"
+	eabi* | gnueabi*)
+		;;
+	# VxWorks passes extra cpu info in the 4th filed.
+	simlinux | simwindows | spe)
+		;;
+	# Now accept the basic system types.
+	# The portable systems comes first.
+	# Each alternative MUST end in a * to match a version number.
+	gnu* | android* | bsd* | mach* | minix* | genix* | ultrix* | irix* \
+	     | *vms* | esix* | aix* | cnk* | sunos | sunos[34]* \
+	     | hpux* | unos* | osf* | luna* | dgux* | auroraux* | solaris* \
+	     | sym* |  plan9* | psp* | sim* | xray* | os68k* | v88r* \
+	     | hiux* | abug | nacl* | netware* | windows* \
+	     | os9* | macos* | osx* | ios* \
+	     | mpw* | magic* | mmixware* | mon960* | lnews* \
+	     | amigaos* | amigados* | msdos* | newsos* | unicos* | aof* \
+	     | aos* | aros* | cloudabi* | sortix* | twizzler* \
+	     | nindy* | vxsim* | vxworks* | ebmon* | hms* | mvs* \
+	     | clix* | riscos* | uniplus* | iris* | isc* | rtu* | xenix* \
+	     | mirbsd* | netbsd* | dicos* | openedition* | ose* \
+	     | bitrig* | openbsd* | secbsd* | solidbsd* | libertybsd* | os108* \
+	     | ekkobsd* | freebsd* | riscix* | lynxos* | os400* \
+	     | bosx* | nextstep* | cxux* | aout* | elf* | oabi* \
+	     | ptx* | coff* | ecoff* | winnt* | domain* | vsta* \
+	     | udi* | lites* | ieee* | go32* | aux* | hcos* \
+	     | chorusrdb* | cegcc* | glidix* | serenity* \
+	     | cygwin* | msys* | pe* | moss* | proelf* | rtems* \
+	     | midipix* | mingw32* | mingw64* | mint* \
+	     | uxpv* | beos* | mpeix* | udk* | moxiebox* \
+	     | interix* | uwin* | mks* | rhapsody* | darwin* \
+	     | openstep* | oskit* | conix* | pw32* | nonstopux* \
+	     | storm-chaos* | tops10* | tenex* | tops20* | its* \
+	     | os2* | vos* | palmos* | uclinux* | nucleus* | morphos* \
+	     | scout* | superux* | sysv* | rtmk* | tpf* | windiss* \
+	     | powermax* | dnix* | nx6 | nx7 | sei* | dragonfly* \
+	     | skyos* | haiku* | rdos* | toppers* | drops* | es* \
+	     | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
+	     | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
+	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
+	     | fiwix* )
+		;;
+	# This one is extra strict with allowed versions
+	sco3.2v2 | sco3.2v[4-9]* | sco5v6*)
+		# Don't forget version if it is 3.2v4 or newer.
+		;;
+	none)
+		;;
+	*)
+		echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2
+		exit 1
+		;;
+esac
+
+# As a final step for OS-related things, validate the OS-kernel combination
+# (given a valid OS), if there is a kernel.
+case $kernel-$os in
+	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \
+		   | linux-musl* | linux-relibc* | linux-uclibc* )
+		;;
+	uclinux-uclibc* )
+		;;
+	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* )
+		# These are just libc implementations, not actual OSes, and thus
+		# require a kernel.
+		echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2
+		exit 1
+		;;
+	kfreebsd*-gnu* | kopensolaris*-gnu*)
+		;;
+	vxworks-simlinux | vxworks-simwindows | vxworks-spe)
+		;;
+	nto-qnx*)
+		;;
+	os2-emx)
+		;;
+	*-eabi* | *-gnueabi*)
+		;;
+	-*)
+		# Blank kernel with real OS is always fine.
+		;;
+	*-*)
+		echo "Invalid configuration \`$1': Kernel \`$kernel' not known to work with OS \`$os'." 1>&2
+		exit 1
+		;;
+esac
+
 # Here we handle the case where we know the os, and the CPU type, but not the
 # manufacturer.  We pick the logical manufacturer.
-vendor=unknown
-case $basic_machine in
-	*-unknown)
-		case $os in
-			-riscix*)
+case $vendor in
+	unknown)
+		case $cpu-$os in
+			*-riscix*)
 				vendor=acorn
 				;;
-			-sunos*)
+			*-sunos*)
 				vendor=sun
 				;;
-			-cnk*|-aix*)
+			*-cnk* | *-aix*)
 				vendor=ibm
 				;;
-			-beos*)
+			*-beos*)
 				vendor=be
 				;;
-			-hpux*)
+			*-hpux*)
 				vendor=hp
 				;;
-			-mpeix*)
+			*-mpeix*)
 				vendor=hp
 				;;
-			-hiux*)
+			*-hiux*)
 				vendor=hitachi
 				;;
-			-unos*)
+			*-unos*)
 				vendor=crds
 				;;
-			-dgux*)
+			*-dgux*)
 				vendor=dg
 				;;
-			-luna*)
+			*-luna*)
 				vendor=omron
 				;;
-			-genix*)
+			*-genix*)
 				vendor=ns
 				;;
-			-mvs* | -opened*)
+			*-clix*)
+				vendor=intergraph
+				;;
+			*-mvs* | *-opened*)
+				vendor=ibm
+				;;
+			*-os400*)
 				vendor=ibm
 				;;
-			-os400*)
+			s390-* | s390x-*)
 				vendor=ibm
 				;;
-			-ptx*)
+			*-ptx*)
 				vendor=sequent
 				;;
-			-tpf*)
+			*-tpf*)
 				vendor=ibm
 				;;
-			-vxsim* | -vxworks* | -windiss*)
+			*-vxsim* | *-vxworks* | *-windiss*)
 				vendor=wrs
 				;;
-			-aux*)
+			*-aux*)
 				vendor=apple
 				;;
-			-hms*)
+			*-hms*)
 				vendor=hitachi
 				;;
-			-mpw* | -macos*)
+			*-mpw* | *-macos*)
 				vendor=apple
 				;;
-			-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
+			*-*mint | *-mint[0-9]* | *-*MiNT | *-MiNT[0-9]*)
 				vendor=atari
 				;;
-			-vos*)
+			*-vos*)
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
 		;;
 esac
 
-echo $basic_machine$os
+echo "$cpu-$vendor-${kernel:+$kernel-}$os"
 exit
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
diff --git a/contrib/ldns/configure b/contrib/ldns/configure
index f085a9e36e1df1..425ac0e02268fb 100755
--- a/contrib/ldns/configure
+++ b/contrib/ldns/configure
@@ -1,11 +1,12 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for ldns 1.7.0.
+# Generated by GNU Autoconf 2.71 for ldns 1.8.3.
 #
 # Report bugs to <libdns@nlnetlabs.nl>.
 #
 #
-# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+# Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
+# Inc.
 #
 #
 # This configure script is free software; the Free Software Foundation
@@ -16,14 +17,16 @@
 
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+as_nop=:
+if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
   emulate sh
   NULLCMD=:
   # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
   # is contrary to our usage.  Disable this feature.
   alias -g '${1+"$@"}'='"$@"'
   setopt NO_GLOB_SUBST
-else
+else $as_nop
   case `(set -o) 2>/dev/null` in #(
   *posix*) :
     set -o posix ;; #(
@@ -33,46 +36,46 @@ esac
 fi
 
 
+
+# Reset variables that may have inherited troublesome values from
+# the environment.
+
+# IFS needs to be set, to space, tab, and newline, in precisely that order.
+# (If _AS_PATH_WALK were called with IFS unset, it would have the
+# side effect of setting IFS to empty, thus disabling word splitting.)
+# Quoting is to prevent editors from complaining about space-tab.
 as_nl='
 '
 export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
-    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='print -r --'
-  as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='printf %s\n'
-  as_echo_n='printf %s'
-else
-  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
-    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
-    as_echo_n='/usr/ucb/echo -n'
-  else
-    as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
-    as_echo_n_body='eval
-      arg=$1;
-      case $arg in #(
-      *"$as_nl"*)
-	expr "X$arg" : "X\\(.*\\)$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
-      esac;
-      expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
-    '
-    export as_echo_n_body
-    as_echo_n='sh -c $as_echo_n_body as_echo'
-  fi
-  export as_echo_body
-  as_echo='sh -c $as_echo_body as_echo'
-fi
+IFS=" ""	$as_nl"
+
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# Ensure predictable behavior from utilities with locale-dependent output.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# We cannot yet rely on "unset" to work, but we need these variables
+# to be unset--not just set to an empty or harmless value--now, to
+# avoid bugs in old shells (e.g. pre-3.0 UWIN ksh).  This construct
+# also avoids known problems related to "unset" and subshell syntax
+# in other old shells (e.g. bash 2.01 and pdksh 5.2.14).
+for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH
+do eval test \${$as_var+y} \
+  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+
+# Ensure that fds 0, 1, and 2 are open.
+if (exec 3>&0) 2>/dev/null; then :; else exec 0</dev/null; fi
+if (exec 3>&1) 2>/dev/null; then :; else exec 1>/dev/null; fi
+if (exec 3>&2)            ; then :; else exec 2>/dev/null; fi
 
 # The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
+if ${PATH_SEPARATOR+false} :; then
   PATH_SEPARATOR=:
   (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
     (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
@@ -81,13 +84,6 @@ if test "${PATH_SEPARATOR+set}" != set; then
 fi
 
 
-# IFS
-# We need space, tab and new line, in precisely that order.  Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
 # Find who we are.  Look in the path if we contain no directory separator.
 as_myself=
 case $0 in #((
@@ -96,8 +92,12 @@ case $0 in #((
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    test -r "$as_dir$0" && as_myself=$as_dir$0 && break
   done
 IFS=$as_save_IFS
 
@@ -109,30 +109,10 @@ if test "x$as_myself" = x; then
   as_myself=$0
 fi
 if test ! -f "$as_myself"; then
-  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+  printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
   exit 1
 fi
 
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there.  '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
-  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
 
 # Use a proper internal environment variable to ensure we don't fall
   # into an infinite loop, continuously re-executing ourselves.
@@ -154,20 +134,22 @@ esac
 exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
 # Admittedly, this is quite paranoid, since all the known shells bail
 # out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
-as_fn_exit 255
+printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2
+exit 255
   fi
   # We don't want this to propagate to other subprocesses.
           { _as_can_reexec=; unset _as_can_reexec;}
 if test "x$CONFIG_SHELL" = x; then
-  as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
+  as_bourne_compatible="as_nop=:
+if test \${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
   emulate sh
   NULLCMD=:
   # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
   # is contrary to our usage.  Disable this feature.
   alias -g '\${1+\"\$@\"}'='\"\$@\"'
   setopt NO_GLOB_SUBST
-else
+else \$as_nop
   case \`(set -o) 2>/dev/null\` in #(
   *posix*) :
     set -o posix ;; #(
@@ -187,18 +169,20 @@ as_fn_success || { exitcode=1; echo as_fn_success failed.; }
 as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
 as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
 as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
-if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
+if ( set x; as_fn_ret_success y && test x = \"\$1\" )
+then :
 
-else
+else \$as_nop
   exitcode=1; echo positional parameters were not saved.
 fi
 test x\$exitcode = x0 || exit 1
+blah=\$(echo \$(echo blah))
+test x\"\$blah\" = xblah || exit 1
 test -x / || exit 1"
   as_suggested="  as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
   as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
   eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
   test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1
-test \$(( 1 + 1 )) = 2 || exit 1
 
   test -n \"\${ZSH_VERSION+set}\${BASH_VERSION+set}\" || (
     ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
@@ -206,31 +190,40 @@ test \$(( 1 + 1 )) = 2 || exit 1
     ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO
     PATH=/empty FPATH=/empty; export PATH FPATH
     test \"X\`printf %s \$ECHO\`\" = \"X\$ECHO\" \\
-      || test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) || exit 1"
-  if (eval "$as_required") 2>/dev/null; then :
+      || test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) || exit 1
+test \$(( 1 + 1 )) = 2 || exit 1"
+  if (eval "$as_required") 2>/dev/null
+then :
   as_have_required=yes
-else
+else $as_nop
   as_have_required=no
 fi
-  if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :
+  if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null
+then :
 
-else
+else $as_nop
   as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 as_found=false
 for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
   as_found=:
   case $as_dir in #(
 	 /*)
 	   for as_base in sh bash ksh sh5; do
 	     # Try only shells that exist, to save several forks.
-	     as_shell=$as_dir/$as_base
+	     as_shell=$as_dir$as_base
 	     if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
-		    { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then :
+		    as_run=a "$as_shell" -c "$as_bourne_compatible""$as_required" 2>/dev/null
+then :
   CONFIG_SHELL=$as_shell as_have_required=yes
-		   if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then :
+		   if as_run=a "$as_shell" -c "$as_bourne_compatible""$as_suggested" 2>/dev/null
+then :
   break 2
 fi
 fi
@@ -238,14 +231,21 @@ fi
        esac
   as_found=false
 done
-$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
-	      { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then :
-  CONFIG_SHELL=$SHELL as_have_required=yes
-fi; }
 IFS=$as_save_IFS
+if $as_found
+then :
+
+else $as_nop
+  if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
+	      as_run=a "$SHELL" -c "$as_bourne_compatible""$as_required" 2>/dev/null
+then :
+  CONFIG_SHELL=$SHELL as_have_required=yes
+fi
+fi
 
 
-      if test "x$CONFIG_SHELL" != x; then :
+      if test "x$CONFIG_SHELL" != x
+then :
   export CONFIG_SHELL
              # We cannot yet assume a decent shell, so we have to provide a
 # neutralization value for shells without unset; and this also
@@ -263,18 +263,19 @@ esac
 exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
 # Admittedly, this is quite paranoid, since all the known shells bail
 # out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
+printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2
 exit 255
 fi
 
-    if test x$as_have_required = xno; then :
-  $as_echo "$0: This script requires a shell more modern than all"
-  $as_echo "$0: the shells that I found on your system."
-  if test x${ZSH_VERSION+set} = xset ; then
-    $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
-    $as_echo "$0: be upgraded to zsh 4.3.4 or later."
+    if test x$as_have_required = xno
+then :
+  printf "%s\n" "$0: This script requires a shell more modern than all"
+  printf "%s\n" "$0: the shells that I found on your system."
+  if test ${ZSH_VERSION+y} ; then
+    printf "%s\n" "$0: In particular, zsh $ZSH_VERSION has bugs and should"
+    printf "%s\n" "$0: be upgraded to zsh 4.3.4 or later."
   else
-    $as_echo "$0: Please tell bug-autoconf@gnu.org and
+    printf "%s\n" "$0: Please tell bug-autoconf@gnu.org and
 $0: libdns@nlnetlabs.nl about your system, including any
 $0: error possibly output before this message. Then install
 $0: a modern shell, or manually run the script under such a
@@ -302,6 +303,7 @@ as_fn_unset ()
 }
 as_unset=as_fn_unset
 
+
 # as_fn_set_status STATUS
 # -----------------------
 # Set $? to STATUS, without forking.
@@ -319,6 +321,14 @@ as_fn_exit ()
   as_fn_set_status $1
   exit $1
 } # as_fn_exit
+# as_fn_nop
+# ---------
+# Do nothing but, unlike ":", preserve the value of $?.
+as_fn_nop ()
+{
+  return $?
+}
+as_nop=as_fn_nop
 
 # as_fn_mkdir_p
 # -------------
@@ -333,7 +343,7 @@ as_fn_mkdir_p ()
     as_dirs=
     while :; do
       case $as_dir in #(
-      *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+      *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
       *) as_qdir=$as_dir;;
       esac
       as_dirs="'$as_qdir' $as_dirs"
@@ -342,7 +352,7 @@ $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
 	 X"$as_dir" : 'X\(//\)[^/]' \| \
 	 X"$as_dir" : 'X\(//\)$' \| \
 	 X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
+printf "%s\n" X"$as_dir" |
     sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
 	    s//\1/
 	    q
@@ -381,12 +391,13 @@ as_fn_executable_p ()
 # advantage of any shell optimizations that allow amortized linear growth over
 # repeated appends, instead of the typical quadratic growth present in naive
 # implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null
+then :
   eval 'as_fn_append ()
   {
     eval $1+=\$2
   }'
-else
+else $as_nop
   as_fn_append ()
   {
     eval $1=\$$1\$2
@@ -398,18 +409,27 @@ fi # as_fn_append
 # Perform arithmetic evaluation on the ARGs, and store the result in the
 # global $as_val. Take advantage of shells that can avoid forks. The arguments
 # must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null
+then :
   eval 'as_fn_arith ()
   {
     as_val=$(( $* ))
   }'
-else
+else $as_nop
   as_fn_arith ()
   {
     as_val=`expr "$@" || test $? -eq 1`
   }
 fi # as_fn_arith
 
+# as_fn_nop
+# ---------
+# Do nothing but, unlike ":", preserve the value of $?.
+as_fn_nop ()
+{
+  return $?
+}
+as_nop=as_fn_nop
 
 # as_fn_error STATUS ERROR [LINENO LOG_FD]
 # ----------------------------------------
@@ -421,9 +441,9 @@ as_fn_error ()
   as_status=$1; test $as_status -eq 0 && as_status=1
   if test "$4"; then
     as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-    $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
   fi
-  $as_echo "$as_me: error: $2" >&2
+  printf "%s\n" "$as_me: error: $2" >&2
   as_fn_exit $as_status
 } # as_fn_error
 
@@ -450,7 +470,7 @@ as_me=`$as_basename -- "$0" ||
 $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
 	 X"$0" : 'X\(//\)$' \| \
 	 X"$0" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X/"$0" |
+printf "%s\n" X/"$0" |
     sed '/^.*\/\([^/][^/]*\)\/*$/{
 	    s//\1/
 	    q
@@ -494,7 +514,7 @@ as_cr_alnum=$as_cr_Letters$as_cr_digits
       s/-\n.*//
     ' >$as_me.lineno &&
   chmod +x "$as_me.lineno" ||
-    { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
+    { printf "%s\n" "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
 
   # If we had to re-execute with $CONFIG_SHELL, we're ensured to have
   # already done that, so ensure we don't try to do so again and fall
@@ -508,6 +528,10 @@ as_cr_alnum=$as_cr_Letters$as_cr_digits
   exit
 }
 
+
+# Determine whether it's possible to make 'echo' print without a newline.
+# These variables are no longer used directly by Autoconf, but are AC_SUBSTed
+# for compatibility with existing Makefiles.
 ECHO_C= ECHO_N= ECHO_T=
 case `echo -n x` in #(((((
 -n*)
@@ -521,6 +545,13 @@ case `echo -n x` in #(((((
   ECHO_N='-n';;
 esac
 
+# For backward compatibility with old third-party macros, we provide
+# the shell variables $as_echo and $as_echo_n.  New code should use
+# AS_ECHO(["message"]) and AS_ECHO_N(["message"]), respectively.
+as_echo='printf %s\n'
+as_echo_n='printf %s'
+
+
 rm -f conf$$ conf$$.exe conf$$.file
 if test -d conf$$.dir; then
   rm -f conf$$.dir/conf$$.file
@@ -590,48 +621,45 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='ldns'
 PACKAGE_TARNAME='libdns'
-PACKAGE_VERSION='1.7.0'
-PACKAGE_STRING='ldns 1.7.0'
+PACKAGE_VERSION='1.8.3'
+PACKAGE_STRING='ldns 1.8.3'
 PACKAGE_BUGREPORT='libdns@nlnetlabs.nl'
 PACKAGE_URL=''
 
 ac_unique_file="packet.c"
 # Factoring default headers for most tests.
 ac_includes_default="\
-#include <stdio.h>
-#ifdef HAVE_SYS_TYPES_H
-# include <sys/types.h>
+#include <stddef.h>
+#ifdef HAVE_STDIO_H
+# include <stdio.h>
 #endif
-#ifdef HAVE_SYS_STAT_H
-# include <sys/stat.h>
-#endif
-#ifdef STDC_HEADERS
+#ifdef HAVE_STDLIB_H
 # include <stdlib.h>
-# include <stddef.h>
-#else
-# ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-# endif
 #endif
 #ifdef HAVE_STRING_H
-# if !defined STDC_HEADERS && defined HAVE_MEMORY_H
-#  include <memory.h>
-# endif
 # include <string.h>
 #endif
-#ifdef HAVE_STRINGS_H
-# include <strings.h>
-#endif
 #ifdef HAVE_INTTYPES_H
 # include <inttypes.h>
 #endif
 #ifdef HAVE_STDINT_H
 # include <stdint.h>
 #endif
+#ifdef HAVE_STRINGS_H
+# include <strings.h>
+#endif
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif"
 
+ac_header_c_list=
+ac_func_c_list=
 ac_subst_vars='LTLIBOBJS
 CONFIG_FILES
 ldns_build_config_have_attr_unused
@@ -658,6 +686,9 @@ LIBSSL_CPPFLAGS
 ldns_build_config_use_dane_ta_usage
 ldns_build_config_use_dane_verify
 ldns_build_config_use_dane
+ldns_build_config_use_ed448
+ldns_build_config_use_ed25519
+ldns_build_config_use_dsa
 RUNTIME_PATH
 HAVE_SSL
 libtool
@@ -681,7 +712,7 @@ SWIGPY3
 PYTHON_EXTRA_LDFLAGS
 PYTHON_EXTRA_LIBS
 PYTHON_SITE_PKG
-PYTHON_LDFLAGS
+PYTHON_LIBS
 PYTHON_CPPFLAGS
 PYTHON
 PYTHON_VERSION
@@ -723,6 +754,8 @@ ac_ct_DUMPBIN
 DUMPBIN
 LD
 FGREP
+EGREP
+GREP
 SED
 host_os
 host_vendor
@@ -733,9 +766,6 @@ build_vendor
 build_cpu
 build
 LIBTOOL
-EGREP
-GREP
-CPP
 OBJEXT
 EXEEXT
 ac_ct_CC
@@ -823,7 +853,11 @@ enable_rrtype_rkey
 enable_rrtype_openpgpkey
 enable_rrtype_ta
 enable_rrtype_avc
+enable_rrtype_doa
+enable_rrtype_amtrelay
+enable_rrtype_svcb_https
 enable_rpath
+with_xcode_sdk
 with_trust_anchor
 with_ca_file
 with_ca_path
@@ -836,7 +870,6 @@ CFLAGS
 LDFLAGS
 LIBS
 CPPFLAGS
-CPP
 LT_SYS_LIBRARY_PATH
 PYTHON_VERSION'
 
@@ -906,8 +939,6 @@ do
   *)    ac_optarg=yes ;;
   esac
 
-  # Accept the important Cygnus configure options, so we can diagnose typos.
-
   case $ac_dashdash$ac_option in
   --)
     ac_dashdash=yes ;;
@@ -948,9 +979,9 @@ do
     ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
     # Reject names that are not valid shell variable names.
     expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
-      as_fn_error $? "invalid feature name: $ac_useropt"
+      as_fn_error $? "invalid feature name: \`$ac_useropt'"
     ac_useropt_orig=$ac_useropt
-    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'`
     case $ac_user_opts in
       *"
 "enable_$ac_useropt"
@@ -974,9 +1005,9 @@ do
     ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
     # Reject names that are not valid shell variable names.
     expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
-      as_fn_error $? "invalid feature name: $ac_useropt"
+      as_fn_error $? "invalid feature name: \`$ac_useropt'"
     ac_useropt_orig=$ac_useropt
-    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'`
     case $ac_user_opts in
       *"
 "enable_$ac_useropt"
@@ -1178,9 +1209,9 @@ do
     ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
     # Reject names that are not valid shell variable names.
     expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
-      as_fn_error $? "invalid package name: $ac_useropt"
+      as_fn_error $? "invalid package name: \`$ac_useropt'"
     ac_useropt_orig=$ac_useropt
-    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'`
     case $ac_user_opts in
       *"
 "with_$ac_useropt"
@@ -1194,9 +1225,9 @@ do
     ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'`
     # Reject names that are not valid shell variable names.
     expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
-      as_fn_error $? "invalid package name: $ac_useropt"
+      as_fn_error $? "invalid package name: \`$ac_useropt'"
     ac_useropt_orig=$ac_useropt
-    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/[-+.]/_/g'`
     case $ac_user_opts in
       *"
 "with_$ac_useropt"
@@ -1240,9 +1271,9 @@ Try \`$0 --help' for more information"
 
   *)
     # FIXME: should be removed in autoconf 3.0.
-    $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
+    printf "%s\n" "$as_me: WARNING: you should use --build, --host, --target" >&2
     expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null &&
-      $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
+      printf "%s\n" "$as_me: WARNING: invalid host type: $ac_option" >&2
     : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}"
     ;;
 
@@ -1258,7 +1289,7 @@ if test -n "$ac_unrecognized_opts"; then
   case $enable_option_checking in
     no) ;;
     fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
-    *)     $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
+    *)     printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
   esac
 fi
 
@@ -1322,7 +1353,7 @@ $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
 	 X"$as_myself" : 'X\(//\)[^/]' \| \
 	 X"$as_myself" : 'X\(//\)$' \| \
 	 X"$as_myself" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_myself" |
+printf "%s\n" X"$as_myself" |
     sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
 	    s//\1/
 	    q
@@ -1379,7 +1410,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ldns 1.7.0 to adapt to many kinds of systems.
+\`configure' configures ldns 1.8.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1444,7 +1475,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ldns 1.7.0:";;
+     short | recursive ) echo "Configuration of ldns 1.8.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1463,11 +1494,13 @@ Optional Features:
   --enable-poll           This platform supports poll(7)
   --disable-sha2          Disable SHA256 and SHA512 RRSIG support
   --disable-gost          Disable GOST support
-  --enable-gost-anyway    Enable GOST even whithout a GOST engine installed
+  --enable-gost-anyway    Enable GOST even without a GOST engine installed
   --disable-ecdsa         Disable ECDSA support
   --disable-dsa           Disable DSA support
-  --enable-ed25519        Enable ED25519 support (experimental)
-  --enable-ed448          Enable ED448 support (experimental)
+  --disable-ed25519       Disable (experimental) ED25519 support. Default is
+                          detect
+  --disable-ed448         Disable (experimental) ED448 support. Default is
+                          detect
   --disable-dane          Disable DANE support
   --disable-dane-verify   Disable DANE verify support
   --disable-dane-ta-usage Disable DANE-TA usage type support
@@ -1478,6 +1511,11 @@ Optional Features:
                           Disable openpgpkey RR type.
   --enable-rrtype-ta      Enable draft RR type ta.
   --enable-rrtype-avc     Enable draft RR type avc.
+  --enable-rrtype-doa     Enable draft RR type DOA.
+  --enable-rrtype-amtrelay
+                          Enable draft RR type AMTRELAY.
+  --disable-rrtype-svcb-https
+                          Disable RR types SVCB and HTTPS.
   --disable-rpath         disable hardcoded rpath (default=enabled)
 
 Optional Packages:
@@ -1501,6 +1539,7 @@ Optional Packages:
   --with-ssl=pathname     enable SSL (will check /usr/local/ssl /usr/lib/ssl
                           /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw
                           /usr)
+  --with-xcode-sdk        Set xcode SDK version. Default is autodetect
   --with-trust-anchor=KEYFILE
                           Default location of the trust anchor file for drill
                           and ldns-dane. [default=SYSCONFDIR/unbound/root.key]
@@ -1516,7 +1555,6 @@ Some influential environment variables:
   LIBS        libraries to pass to the linker, e.g. -l<library>
   CPPFLAGS    (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
               you have headers in a nonstandard directory <include dir>
-  CPP         C preprocessor
   LT_SYS_LIBRARY_PATH
               User-defined run-time library search path.
   PYTHON_VERSION
@@ -1543,9 +1581,9 @@ if test "$ac_init_help" = "recursive"; then
 case "$ac_dir" in
 .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *)
-  ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+  ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.[\\/]||'`
   # A ".." for each directory in $ac_dir_suffix.
-  ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+  ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
   case $ac_top_builddir_sub in
   "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
   *)  ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -1573,7 +1611,8 @@ esac
 ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
 
     cd "$ac_dir" || { ac_status=$?; continue; }
-    # Check for guested configure.
+    # Check for configure.gnu first; this name is used for a wrapper for
+    # Metaconfig's "Configure" on case-insensitive file systems.
     if test -f "$ac_srcdir/configure.gnu"; then
       echo &&
       $SHELL "$ac_srcdir/configure.gnu" --help=recursive
@@ -1581,7 +1620,7 @@ ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
       echo &&
       $SHELL "$ac_srcdir/configure" --help=recursive
     else
-      $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
+      printf "%s\n" "$as_me: WARNING: no configuration information is in $ac_dir" >&2
     fi || ac_status=$?
     cd "$ac_pwd" || { ac_status=$?; break; }
   done
@@ -1590,10 +1629,10 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ldns configure 1.7.0
-generated by GNU Autoconf 2.69
+ldns configure 1.8.3
+generated by GNU Autoconf 2.71
 
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 2021 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
 _ACEOF
@@ -1610,14 +1649,14 @@ fi
 ac_fn_c_try_compile ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  rm -f conftest.$ac_objext
+  rm -f conftest.$ac_objext conftest.beam
   if { { ac_try="$ac_compile"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_compile") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
@@ -1625,14 +1664,15 @@ $as_echo "$ac_try_echo"; } >&5
     cat conftest.er1 >&5
     mv -f conftest.er1 conftest.err
   fi
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } && {
 	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then :
+       } && test -s conftest.$ac_objext
+then :
   ac_retval=0
-else
-  $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+  printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 	ac_retval=1
@@ -1642,176 +1682,6 @@ fi
 
 } # ac_fn_c_try_compile
 
-# ac_fn_c_try_cpp LINENO
-# ----------------------
-# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_cpp ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if { { ac_try="$ac_cpp conftest.$ac_ext"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
-  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
-  ac_status=$?
-  if test -s conftest.err; then
-    grep -v '^ *+' conftest.err >conftest.er1
-    cat conftest.er1 >&5
-    mv -f conftest.er1 conftest.err
-  fi
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } > conftest.i && {
-	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       }; then :
-  ac_retval=0
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-    ac_retval=1
-fi
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-  as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_cpp
-
-# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
-# -------------------------------------------------------
-# Tests whether HEADER exists, giving a warning if it cannot be compiled using
-# the include files in INCLUDES and setting the cache variable VAR
-# accordingly.
-ac_fn_c_check_header_mongrel ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if eval \${$3+:} false; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-fi
-eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-else
-  # Is the header compilable?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
-$as_echo_n "checking $2 usability... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-$4
-#include <$2>
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_header_compiler=yes
-else
-  ac_header_compiler=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
-$as_echo "$ac_header_compiler" >&6; }
-
-# Is the header present?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
-$as_echo_n "checking $2 presence... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <$2>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
-  ac_header_preproc=yes
-else
-  ac_header_preproc=no
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
-$as_echo "$ac_header_preproc" >&6; }
-
-# So?  What about this header?
-case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
-  yes:no: )
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
-$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
-    ;;
-  no:yes:* )
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
-$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2:     check for missing prerequisite headers?" >&5
-$as_echo "$as_me: WARNING: $2:     check for missing prerequisite headers?" >&2;}
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
-$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2:     section \"Present But Cannot Be Compiled\"" >&5
-$as_echo "$as_me: WARNING: $2:     section \"Present But Cannot Be Compiled\"" >&2;}
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
-( $as_echo "## ---------------------------------- ##
-## Report this to libdns@nlnetlabs.nl ##
-## ---------------------------------- ##"
-     ) | sed "s/^/$as_me: WARNING:     /" >&2
-    ;;
-esac
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  eval "$3=\$ac_header_compiler"
-fi
-eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-fi
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_header_mongrel
-
-# ac_fn_c_try_run LINENO
-# ----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
-# that executables *can* be run.
-ac_fn_c_try_run ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if { { ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
-  (eval "$ac_link") 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
-  { { case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
-  (eval "$ac_try") 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; }; }; then :
-  ac_retval=0
-else
-  $as_echo "$as_me: program exited with status $ac_status" >&5
-       $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-       ac_retval=$ac_status
-fi
-  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-  as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_run
-
 # ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES
 # -------------------------------------------------------
 # Tests whether HEADER exists and can be compiled using the include files in
@@ -1819,26 +1689,28 @@ fi
 ac_fn_c_check_header_compile ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 #include <$2>
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   eval "$3=yes"
-else
+else $as_nop
   eval "$3=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_header_compile
@@ -1849,14 +1721,14 @@ $as_echo "$ac_res" >&6; }
 ac_fn_c_try_link ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  rm -f conftest.$ac_objext conftest$ac_exeext
+  rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext
   if { { ac_try="$ac_link"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_link") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
@@ -1864,17 +1736,18 @@ $as_echo "$ac_try_echo"; } >&5
     cat conftest.er1 >&5
     mv -f conftest.er1 conftest.err
   fi
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } && {
 	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
        } && test -s conftest$ac_exeext && {
 	 test "$cross_compiling" = yes ||
 	 test -x conftest$ac_exeext
-       }; then :
+       }
+then :
   ac_retval=0
-else
-  $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+  printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 	ac_retval=1
@@ -1895,11 +1768,12 @@ fi
 ac_fn_c_check_func ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 /* Define $2 to an innocuous variant, in case <limits.h> declares $2.
@@ -1907,16 +1781,9 @@ else
 #define $2 innocuous_$2
 
 /* System header to define __stub macros and hopefully few prototypes,
-    which can conflict with char $2 (); below.
-    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
-    <limits.h> exists even on freestanding compilers.  */
-
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
+   which can conflict with char $2 (); below.  */
 
+#include <limits.h>
 #undef $2
 
 /* Override any GCC internal prototype to avoid an error.
@@ -1934,24 +1801,25 @@ choke me
 #endif
 
 int
-main ()
+main (void)
 {
 return $2 ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   eval "$3=yes"
-else
+else $as_nop
   eval "$3=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_func
@@ -1963,17 +1831,18 @@ $as_echo "$ac_res" >&6; }
 ac_fn_c_check_type ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   eval "$3=no"
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 if (sizeof ($2))
 	 return 0;
@@ -1981,12 +1850,13 @@ if (sizeof ($2))
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 if (sizeof (($2)))
 	    return 0;
@@ -1994,41 +1864,45 @@ if (sizeof (($2)))
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
   eval "$3=yes"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_type
 
-# ac_fn_c_check_decl LINENO SYMBOL VAR INCLUDES
-# ---------------------------------------------
+# ac_fn_check_decl LINENO SYMBOL VAR INCLUDES EXTRA-OPTIONS FLAG-VAR
+# ------------------------------------------------------------------
 # Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
-# accordingly.
-ac_fn_c_check_decl ()
+# accordingly. Pass EXTRA-OPTIONS to the compiler, using FLAG-VAR.
+ac_fn_check_decl ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
   as_decl_name=`echo $2|sed 's/ *(.*//'`
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
+printf %s "checking whether $as_decl_name is declared... " >&6; }
+if eval test \${$3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
-$as_echo_n "checking whether $as_decl_name is declared... " >&6; }
-if eval \${$3+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  eval ac_save_FLAGS=\$$6
+  as_fn_append $6 " $5"
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 #ifndef $as_decl_name
 #ifdef __cplusplus
@@ -2042,19 +1916,65 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   eval "$3=yes"
-else
+else $as_nop
   eval "$3=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+  eval $6=\$ac_save_FLAGS
+
 fi
 eval ac_res=\$$3
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+
+} # ac_fn_check_decl
+
+# ac_fn_c_try_run LINENO
+# ----------------------
+# Try to run conftest.$ac_ext, and return whether this succeeded. Assumes that
+# executables *can* be run.
+ac_fn_c_try_run ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+printf "%s\n" "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
+  { { case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+printf "%s\n" "$ac_try_echo"; } >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; }
+then :
+  ac_retval=0
+else $as_nop
+  printf "%s\n" "$as_me: program exited with status $ac_status" >&5
+       printf "%s\n" "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+       ac_retval=$ac_status
+fi
+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
 
-} # ac_fn_c_check_decl
+} # ac_fn_c_try_run
 
 # ac_fn_c_compute_int LINENO EXPR VAR INCLUDES
 # --------------------------------------------
@@ -2070,7 +1990,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 static int test_array [1 - 2 * !(($2) >= 0)];
 test_array [0] = 0;
@@ -2080,14 +2000,15 @@ return test_array [0];
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_lo=0 ac_mid=0
   while :; do
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 static int test_array [1 - 2 * !(($2) <= $ac_mid)];
 test_array [0] = 0;
@@ -2097,9 +2018,10 @@ return test_array [0];
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_hi=$ac_mid; break
-else
+else $as_nop
   as_fn_arith $ac_mid + 1 && ac_lo=$as_val
 			if test $ac_lo -le $ac_mid; then
 			  ac_lo= ac_hi=
@@ -2107,14 +2029,14 @@ else
 			fi
 			as_fn_arith 2 '*' $ac_mid + 1 && ac_mid=$as_val
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
   done
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 static int test_array [1 - 2 * !(($2) < 0)];
 test_array [0] = 0;
@@ -2124,14 +2046,15 @@ return test_array [0];
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_hi=-1 ac_mid=-1
   while :; do
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 static int test_array [1 - 2 * !(($2) >= $ac_mid)];
 test_array [0] = 0;
@@ -2141,9 +2064,10 @@ return test_array [0];
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_lo=$ac_mid; break
-else
+else $as_nop
   as_fn_arith '(' $ac_mid ')' - 1 && ac_hi=$as_val
 			if test $ac_mid -le $ac_hi; then
 			  ac_lo= ac_hi=
@@ -2151,14 +2075,14 @@ else
 			fi
 			as_fn_arith 2 '*' $ac_mid && ac_mid=$as_val
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
   done
-else
+else $as_nop
   ac_lo= ac_hi=
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 # Binary search between lo and hi bounds.
 while test "x$ac_lo" != "x$ac_hi"; do
   as_fn_arith '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo && ac_mid=$as_val
@@ -2166,7 +2090,7 @@ while test "x$ac_lo" != "x$ac_hi"; do
 /* end confdefs.h.  */
 $4
 int
-main ()
+main (void)
 {
 static int test_array [1 - 2 * !(($2) <= $ac_mid)];
 test_array [0] = 0;
@@ -2176,12 +2100,13 @@ return test_array [0];
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_hi=$ac_mid
-else
+else $as_nop
   as_fn_arith '(' $ac_mid ')' + 1 && ac_lo=$as_val
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 done
 case $ac_lo in #((
 ?*) eval "$3=\$ac_lo"; ac_retval=0 ;;
@@ -2191,12 +2116,12 @@ esac
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $4
-static long int longval () { return $2; }
-static unsigned long int ulongval () { return $2; }
+static long int longval (void) { return $2; }
+static unsigned long int ulongval (void) { return $2; }
 #include <stdio.h>
 #include <stdlib.h>
 int
-main ()
+main (void)
 {
 
   FILE *f = fopen ("conftest.val", "w");
@@ -2224,9 +2149,10 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+if ac_fn_c_try_run "$LINENO"
+then :
   echo >>conftest.val; read $3 <conftest.val; ac_retval=0
-else
+else $as_nop
   ac_retval=1
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -2246,16 +2172,17 @@ rm -f conftest.val
 ac_fn_c_check_member ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
-$as_echo_n "checking for $2.$3... " >&6; }
-if eval \${$4+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
+printf %s "checking for $2.$3... " >&6; }
+if eval test \${$4+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $5
 int
-main ()
+main (void)
 {
 static $2 ac_aggr;
 if (ac_aggr.$3)
@@ -2264,14 +2191,15 @@ return 0;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   eval "$4=yes"
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $5
 int
-main ()
+main (void)
 {
 static $2 ac_aggr;
 if (sizeof ac_aggr.$3)
@@ -2280,29 +2208,50 @@ return 0;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   eval "$4=yes"
-else
+else $as_nop
   eval "$4=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$4
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_member
+ac_configure_args_raw=
+for ac_arg
+do
+  case $ac_arg in
+  *\'*)
+    ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+  esac
+  as_fn_append ac_configure_args_raw " '$ac_arg'"
+done
+
+case $ac_configure_args_raw in
+  *$as_nl*)
+    ac_safe_unquote= ;;
+  *)
+    ac_unsafe_z='|&;<>()$`\\"*?[ ''	' # This string ends in space, tab.
+    ac_unsafe_a="$ac_unsafe_z#~"
+    ac_safe_unquote="s/ '\\([^$ac_unsafe_a][^$ac_unsafe_z]*\\)'/ \\1/g"
+    ac_configure_args_raw=`      printf "%s\n" "$ac_configure_args_raw" | sed "$ac_safe_unquote"`;;
+esac
+
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ldns $as_me 1.7.0, which was
-generated by GNU Autoconf 2.69.  Invocation command line was
+It was created by ldns $as_me 1.8.3, which was
+generated by GNU Autoconf 2.71.  Invocation command line was
 
-  $ $0 $@
+  $ $0$ac_configure_args_raw
 
 _ACEOF
 exec 5>>config.log
@@ -2335,8 +2284,12 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    $as_echo "PATH: $as_dir"
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    printf "%s\n" "PATH: $as_dir"
   done
 IFS=$as_save_IFS
 
@@ -2371,7 +2324,7 @@ do
     | -silent | --silent | --silen | --sile | --sil)
       continue ;;
     *\'*)
-      ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+      ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
     esac
     case $ac_pass in
     1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
@@ -2406,11 +2359,13 @@ done
 # WARNING: Use '\'' to represent an apostrophe within the trap.
 # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug.
 trap 'exit_status=$?
+  # Sanitize IFS.
+  IFS=" ""	$as_nl"
   # Save into config.log some information that might help in debugging.
   {
     echo
 
-    $as_echo "## ---------------- ##
+    printf "%s\n" "## ---------------- ##
 ## Cache variables. ##
 ## ---------------- ##"
     echo
@@ -2421,8 +2376,8 @@ trap 'exit_status=$?
     case $ac_val in #(
     *${as_nl}*)
       case $ac_var in #(
-      *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+      *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
       esac
       case $ac_var in #(
       _ | IFS | as_nl) ;; #(
@@ -2446,7 +2401,7 @@ $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
 )
     echo
 
-    $as_echo "## ----------------- ##
+    printf "%s\n" "## ----------------- ##
 ## Output variables. ##
 ## ----------------- ##"
     echo
@@ -2454,14 +2409,14 @@ $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
     do
       eval ac_val=\$$ac_var
       case $ac_val in
-      *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+      *\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
       esac
-      $as_echo "$ac_var='\''$ac_val'\''"
+      printf "%s\n" "$ac_var='\''$ac_val'\''"
     done | sort
     echo
 
     if test -n "$ac_subst_files"; then
-      $as_echo "## ------------------- ##
+      printf "%s\n" "## ------------------- ##
 ## File substitutions. ##
 ## ------------------- ##"
       echo
@@ -2469,15 +2424,15 @@ $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
       do
 	eval ac_val=\$$ac_var
 	case $ac_val in
-	*\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+	*\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
 	esac
-	$as_echo "$ac_var='\''$ac_val'\''"
+	printf "%s\n" "$ac_var='\''$ac_val'\''"
       done | sort
       echo
     fi
 
     if test -s confdefs.h; then
-      $as_echo "## ----------- ##
+      printf "%s\n" "## ----------- ##
 ## confdefs.h. ##
 ## ----------- ##"
       echo
@@ -2485,8 +2440,8 @@ $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
       echo
     fi
     test "$ac_signal" != 0 &&
-      $as_echo "$as_me: caught signal $ac_signal"
-    $as_echo "$as_me: exit $exit_status"
+      printf "%s\n" "$as_me: caught signal $ac_signal"
+    printf "%s\n" "$as_me: exit $exit_status"
   } >&5
   rm -f core *.core core.conftest.* &&
     rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
@@ -2500,63 +2455,48 @@ ac_signal=0
 # confdefs.h avoids OS command line length limits that DEFS can exceed.
 rm -f -r conftest* confdefs.h
 
-$as_echo "/* confdefs.h */" > confdefs.h
+printf "%s\n" "/* confdefs.h */" > confdefs.h
 
 # Predefined preprocessor variables.
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_NAME "$PACKAGE_NAME"
-_ACEOF
+printf "%s\n" "#define PACKAGE_NAME \"$PACKAGE_NAME\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_TARNAME "$PACKAGE_TARNAME"
-_ACEOF
+printf "%s\n" "#define PACKAGE_TARNAME \"$PACKAGE_TARNAME\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_VERSION "$PACKAGE_VERSION"
-_ACEOF
+printf "%s\n" "#define PACKAGE_VERSION \"$PACKAGE_VERSION\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_STRING "$PACKAGE_STRING"
-_ACEOF
+printf "%s\n" "#define PACKAGE_STRING \"$PACKAGE_STRING\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
-_ACEOF
+printf "%s\n" "#define PACKAGE_BUGREPORT \"$PACKAGE_BUGREPORT\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_URL "$PACKAGE_URL"
-_ACEOF
+printf "%s\n" "#define PACKAGE_URL \"$PACKAGE_URL\"" >>confdefs.h
 
 
 # Let the site file select an alternate cache file if it wants to.
 # Prefer an explicitly selected file to automatically selected ones.
-ac_site_file1=NONE
-ac_site_file2=NONE
 if test -n "$CONFIG_SITE"; then
-  # We do not want a PATH search for config.site.
-  case $CONFIG_SITE in #((
-    -*)  ac_site_file1=./$CONFIG_SITE;;
-    */*) ac_site_file1=$CONFIG_SITE;;
-    *)   ac_site_file1=./$CONFIG_SITE;;
-  esac
+  ac_site_files="$CONFIG_SITE"
 elif test "x$prefix" != xNONE; then
-  ac_site_file1=$prefix/share/config.site
-  ac_site_file2=$prefix/etc/config.site
+  ac_site_files="$prefix/share/config.site $prefix/etc/config.site"
 else
-  ac_site_file1=$ac_default_prefix/share/config.site
-  ac_site_file2=$ac_default_prefix/etc/config.site
+  ac_site_files="$ac_default_prefix/share/config.site $ac_default_prefix/etc/config.site"
 fi
-for ac_site_file in "$ac_site_file1" "$ac_site_file2"
+
+for ac_site_file in $ac_site_files
 do
-  test "x$ac_site_file" = xNONE && continue
-  if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
-    { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
-$as_echo "$as_me: loading site script $ac_site_file" >&6;}
+  case $ac_site_file in #(
+  */*) :
+     ;; #(
+  *) :
+    ac_site_file=./$ac_site_file ;;
+esac
+  if test -f "$ac_site_file" && test -r "$ac_site_file"; then
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
+printf "%s\n" "$as_me: loading site script $ac_site_file" >&6;}
     sed 's/^/| /' "$ac_site_file" >&5
     . "$ac_site_file" \
-      || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+      || { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "failed to load site script $ac_site_file
 See \`config.log' for more details" "$LINENO" 5; }
   fi
@@ -2566,35 +2506,455 @@ if test -r "$cache_file"; then
   # Some versions of bash will fail to source /dev/null (special files
   # actually), so we avoid doing that.  DJGPP emulates it as a regular file.
   if test /dev/null != "$cache_file" && test -f "$cache_file"; then
-    { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
-$as_echo "$as_me: loading cache $cache_file" >&6;}
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
+printf "%s\n" "$as_me: loading cache $cache_file" >&6;}
     case $cache_file in
       [\\/]* | ?:[\\/]* ) . "$cache_file";;
       *)                      . "./$cache_file";;
     esac
   fi
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
-$as_echo "$as_me: creating cache $cache_file" >&6;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
+printf "%s\n" "$as_me: creating cache $cache_file" >&6;}
   >$cache_file
 fi
 
-# Check that the precious variables saved in the cache have kept the same
-# value.
-ac_cache_corrupted=false
-for ac_var in $ac_precious_vars; do
-  eval ac_old_set=\$ac_cv_env_${ac_var}_set
-  eval ac_new_set=\$ac_env_${ac_var}_set
-  eval ac_old_val=\$ac_cv_env_${ac_var}_value
-  eval ac_new_val=\$ac_env_${ac_var}_value
-  case $ac_old_set,$ac_new_set in
-    set,)
-      { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
-      ac_cache_corrupted=: ;;
+as_fn_append ac_header_c_list " stdio.h stdio_h HAVE_STDIO_H"
+# Test code for whether the C compiler supports C89 (global declarations)
+ac_c_conftest_c89_globals='
+/* Does the compiler advertise C89 conformance?
+   Do not test the value of __STDC__, because some compilers set it to 0
+   while being otherwise adequately conformant. */
+#if !defined __STDC__
+# error "Compiler does not advertise C89 conformance"
+#endif
+
+#include <stddef.h>
+#include <stdarg.h>
+struct stat;
+/* Most of the following tests are stolen from RCS 5.7 src/conf.sh.  */
+struct buf { int x; };
+struct buf * (*rcsopen) (struct buf *, struct stat *, int);
+static char *e (p, i)
+     char **p;
+     int i;
+{
+  return p[i];
+}
+static char *f (char * (*g) (char **, int), char **p, ...)
+{
+  char *s;
+  va_list v;
+  va_start (v,p);
+  s = g (p, va_arg (v,int));
+  va_end (v);
+  return s;
+}
+
+/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default.  It has
+   function prototypes and stuff, but not \xHH hex character constants.
+   These do not provoke an error unfortunately, instead are silently treated
+   as an "x".  The following induces an error, until -std is added to get
+   proper ANSI mode.  Curiously \x00 != x always comes out true, for an
+   array size at least.  It is necessary to write \x00 == 0 to get something
+   that is true only with -std.  */
+int osf4_cc_array ['\''\x00'\'' == 0 ? 1 : -1];
+
+/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
+   inside strings and character constants.  */
+#define FOO(x) '\''x'\''
+int xlc6_cc_array[FOO(a) == '\''x'\'' ? 1 : -1];
+
+int test (int i, double x);
+struct s1 {int (*f) (int a);};
+struct s2 {int (*f) (double a);};
+int pairnames (int, char **, int *(*)(struct buf *, struct stat *, int),
+               int, int);'
+
+# Test code for whether the C compiler supports C89 (body of main).
+ac_c_conftest_c89_main='
+ok |= (argc == 0 || f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]);
+'
+
+# Test code for whether the C compiler supports C99 (global declarations)
+ac_c_conftest_c99_globals='
+// Does the compiler advertise C99 conformance?
+#if !defined __STDC_VERSION__ || __STDC_VERSION__ < 199901L
+# error "Compiler does not advertise C99 conformance"
+#endif
+
+#include <stdbool.h>
+extern int puts (const char *);
+extern int printf (const char *, ...);
+extern int dprintf (int, const char *, ...);
+extern void *malloc (size_t);
+
+// Check varargs macros.  These examples are taken from C99 6.10.3.5.
+// dprintf is used instead of fprintf to avoid needing to declare
+// FILE and stderr.
+#define debug(...) dprintf (2, __VA_ARGS__)
+#define showlist(...) puts (#__VA_ARGS__)
+#define report(test,...) ((test) ? puts (#test) : printf (__VA_ARGS__))
+static void
+test_varargs_macros (void)
+{
+  int x = 1234;
+  int y = 5678;
+  debug ("Flag");
+  debug ("X = %d\n", x);
+  showlist (The first, second, and third items.);
+  report (x>y, "x is %d but y is %d", x, y);
+}
+
+// Check long long types.
+#define BIG64 18446744073709551615ull
+#define BIG32 4294967295ul
+#define BIG_OK (BIG64 / BIG32 == 4294967297ull && BIG64 % BIG32 == 0)
+#if !BIG_OK
+  #error "your preprocessor is broken"
+#endif
+#if BIG_OK
+#else
+  #error "your preprocessor is broken"
+#endif
+static long long int bignum = -9223372036854775807LL;
+static unsigned long long int ubignum = BIG64;
+
+struct incomplete_array
+{
+  int datasize;
+  double data[];
+};
+
+struct named_init {
+  int number;
+  const wchar_t *name;
+  double average;
+};
+
+typedef const char *ccp;
+
+static inline int
+test_restrict (ccp restrict text)
+{
+  // See if C++-style comments work.
+  // Iterate through items via the restricted pointer.
+  // Also check for declarations in for loops.
+  for (unsigned int i = 0; *(text+i) != '\''\0'\''; ++i)
+    continue;
+  return 0;
+}
+
+// Check varargs and va_copy.
+static bool
+test_varargs (const char *format, ...)
+{
+  va_list args;
+  va_start (args, format);
+  va_list args_copy;
+  va_copy (args_copy, args);
+
+  const char *str = "";
+  int number = 0;
+  float fnumber = 0;
+
+  while (*format)
+    {
+      switch (*format++)
+	{
+	case '\''s'\'': // string
+	  str = va_arg (args_copy, const char *);
+	  break;
+	case '\''d'\'': // int
+	  number = va_arg (args_copy, int);
+	  break;
+	case '\''f'\'': // float
+	  fnumber = va_arg (args_copy, double);
+	  break;
+	default:
+	  break;
+	}
+    }
+  va_end (args_copy);
+  va_end (args);
+
+  return *str && number && fnumber;
+}
+'
+
+# Test code for whether the C compiler supports C99 (body of main).
+ac_c_conftest_c99_main='
+  // Check bool.
+  _Bool success = false;
+  success |= (argc != 0);
+
+  // Check restrict.
+  if (test_restrict ("String literal") == 0)
+    success = true;
+  char *restrict newvar = "Another string";
+
+  // Check varargs.
+  success &= test_varargs ("s, d'\'' f .", "string", 65, 34.234);
+  test_varargs_macros ();
+
+  // Check flexible array members.
+  struct incomplete_array *ia =
+    malloc (sizeof (struct incomplete_array) + (sizeof (double) * 10));
+  ia->datasize = 10;
+  for (int i = 0; i < ia->datasize; ++i)
+    ia->data[i] = i * 1.234;
+
+  // Check named initializers.
+  struct named_init ni = {
+    .number = 34,
+    .name = L"Test wide string",
+    .average = 543.34343,
+  };
+
+  ni.number = 58;
+
+  int dynamic_array[ni.number];
+  dynamic_array[0] = argv[0][0];
+  dynamic_array[ni.number - 1] = 543;
+
+  // work around unused variable warnings
+  ok |= (!success || bignum == 0LL || ubignum == 0uLL || newvar[0] == '\''x'\''
+	 || dynamic_array[ni.number - 1] != 543);
+'
+
+# Test code for whether the C compiler supports C11 (global declarations)
+ac_c_conftest_c11_globals='
+// Does the compiler advertise C11 conformance?
+#if !defined __STDC_VERSION__ || __STDC_VERSION__ < 201112L
+# error "Compiler does not advertise C11 conformance"
+#endif
+
+// Check _Alignas.
+char _Alignas (double) aligned_as_double;
+char _Alignas (0) no_special_alignment;
+extern char aligned_as_int;
+char _Alignas (0) _Alignas (int) aligned_as_int;
+
+// Check _Alignof.
+enum
+{
+  int_alignment = _Alignof (int),
+  int_array_alignment = _Alignof (int[100]),
+  char_alignment = _Alignof (char)
+};
+_Static_assert (0 < -_Alignof (int), "_Alignof is signed");
+
+// Check _Noreturn.
+int _Noreturn does_not_return (void) { for (;;) continue; }
+
+// Check _Static_assert.
+struct test_static_assert
+{
+  int x;
+  _Static_assert (sizeof (int) <= sizeof (long int),
+                  "_Static_assert does not work in struct");
+  long int y;
+};
+
+// Check UTF-8 literals.
+#define u8 syntax error!
+char const utf8_literal[] = u8"happens to be ASCII" "another string";
+
+// Check duplicate typedefs.
+typedef long *long_ptr;
+typedef long int *long_ptr;
+typedef long_ptr long_ptr;
+
+// Anonymous structures and unions -- taken from C11 6.7.2.1 Example 1.
+struct anonymous
+{
+  union {
+    struct { int i; int j; };
+    struct { int k; long int l; } w;
+  };
+  int m;
+} v1;
+'
+
+# Test code for whether the C compiler supports C11 (body of main).
+ac_c_conftest_c11_main='
+  _Static_assert ((offsetof (struct anonymous, i)
+		   == offsetof (struct anonymous, w.k)),
+		  "Anonymous union alignment botch");
+  v1.i = 2;
+  v1.w.k = 5;
+  ok |= v1.i != 5;
+'
+
+# Test code for whether the C compiler supports C11 (complete).
+ac_c_conftest_c11_program="${ac_c_conftest_c89_globals}
+${ac_c_conftest_c99_globals}
+${ac_c_conftest_c11_globals}
+
+int
+main (int argc, char **argv)
+{
+  int ok = 0;
+  ${ac_c_conftest_c89_main}
+  ${ac_c_conftest_c99_main}
+  ${ac_c_conftest_c11_main}
+  return ok;
+}
+"
+
+# Test code for whether the C compiler supports C99 (complete).
+ac_c_conftest_c99_program="${ac_c_conftest_c89_globals}
+${ac_c_conftest_c99_globals}
+
+int
+main (int argc, char **argv)
+{
+  int ok = 0;
+  ${ac_c_conftest_c89_main}
+  ${ac_c_conftest_c99_main}
+  return ok;
+}
+"
+
+# Test code for whether the C compiler supports C89 (complete).
+ac_c_conftest_c89_program="${ac_c_conftest_c89_globals}
+
+int
+main (int argc, char **argv)
+{
+  int ok = 0;
+  ${ac_c_conftest_c89_main}
+  return ok;
+}
+"
+
+as_fn_append ac_header_c_list " stdlib.h stdlib_h HAVE_STDLIB_H"
+as_fn_append ac_header_c_list " string.h string_h HAVE_STRING_H"
+as_fn_append ac_header_c_list " inttypes.h inttypes_h HAVE_INTTYPES_H"
+as_fn_append ac_header_c_list " stdint.h stdint_h HAVE_STDINT_H"
+as_fn_append ac_header_c_list " strings.h strings_h HAVE_STRINGS_H"
+as_fn_append ac_header_c_list " sys/stat.h sys_stat_h HAVE_SYS_STAT_H"
+as_fn_append ac_header_c_list " sys/types.h sys_types_h HAVE_SYS_TYPES_H"
+as_fn_append ac_header_c_list " unistd.h unistd_h HAVE_UNISTD_H"
+as_fn_append ac_header_c_list " wchar.h wchar_h HAVE_WCHAR_H"
+as_fn_append ac_header_c_list " minix/config.h minix_config_h HAVE_MINIX_CONFIG_H"
+as_fn_append ac_header_c_list " vfork.h vfork_h HAVE_VFORK_H"
+as_fn_append ac_func_c_list " fork HAVE_FORK"
+as_fn_append ac_func_c_list " vfork HAVE_VFORK"
+
+# Auxiliary files required by this configure script.
+ac_aux_files="config.guess config.sub ltmain.sh"
+
+# Locations in which to look for auxiliary files.
+ac_aux_dir_candidates="${srcdir}${PATH_SEPARATOR}${srcdir}/..${PATH_SEPARATOR}${srcdir}/../.."
+
+# Search for a directory containing all of the required auxiliary files,
+# $ac_aux_files, from the $PATH-style list $ac_aux_dir_candidates.
+# If we don't find one directory that contains all the files we need,
+# we report the set of missing files from the *first* directory in
+# $ac_aux_dir_candidates and give up.
+ac_missing_aux_files=""
+ac_first_candidate=:
+printf "%s\n" "$as_me:${as_lineno-$LINENO}: looking for aux files: $ac_aux_files" >&5
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+as_found=false
+for as_dir in $ac_aux_dir_candidates
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+  as_found=:
+
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}:  trying $as_dir" >&5
+  ac_aux_dir_found=yes
+  ac_install_sh=
+  for ac_aux in $ac_aux_files
+  do
+    # As a special case, if "install-sh" is required, that requirement
+    # can be satisfied by any of "install-sh", "install.sh", or "shtool",
+    # and $ac_install_sh is set appropriately for whichever one is found.
+    if test x"$ac_aux" = x"install-sh"
+    then
+      if test -f "${as_dir}install-sh"; then
+        printf "%s\n" "$as_me:${as_lineno-$LINENO}:   ${as_dir}install-sh found" >&5
+        ac_install_sh="${as_dir}install-sh -c"
+      elif test -f "${as_dir}install.sh"; then
+        printf "%s\n" "$as_me:${as_lineno-$LINENO}:   ${as_dir}install.sh found" >&5
+        ac_install_sh="${as_dir}install.sh -c"
+      elif test -f "${as_dir}shtool"; then
+        printf "%s\n" "$as_me:${as_lineno-$LINENO}:   ${as_dir}shtool found" >&5
+        ac_install_sh="${as_dir}shtool install -c"
+      else
+        ac_aux_dir_found=no
+        if $ac_first_candidate; then
+          ac_missing_aux_files="${ac_missing_aux_files} install-sh"
+        else
+          break
+        fi
+      fi
+    else
+      if test -f "${as_dir}${ac_aux}"; then
+        printf "%s\n" "$as_me:${as_lineno-$LINENO}:   ${as_dir}${ac_aux} found" >&5
+      else
+        ac_aux_dir_found=no
+        if $ac_first_candidate; then
+          ac_missing_aux_files="${ac_missing_aux_files} ${ac_aux}"
+        else
+          break
+        fi
+      fi
+    fi
+  done
+  if test "$ac_aux_dir_found" = yes; then
+    ac_aux_dir="$as_dir"
+    break
+  fi
+  ac_first_candidate=false
+
+  as_found=false
+done
+IFS=$as_save_IFS
+if $as_found
+then :
+
+else $as_nop
+  as_fn_error $? "cannot find required auxiliary files:$ac_missing_aux_files" "$LINENO" 5
+fi
+
+
+# These three variables are undocumented and unsupported,
+# and are intended to be withdrawn in a future Autoconf release.
+# They can cause serious problems if a builder's source tree is in a directory
+# whose full name contains unusual characters.
+if test -f "${ac_aux_dir}config.guess"; then
+  ac_config_guess="$SHELL ${ac_aux_dir}config.guess"
+fi
+if test -f "${ac_aux_dir}config.sub"; then
+  ac_config_sub="$SHELL ${ac_aux_dir}config.sub"
+fi
+if test -f "$ac_aux_dir/configure"; then
+  ac_configure="$SHELL ${ac_aux_dir}configure"
+fi
+
+# Check that the precious variables saved in the cache have kept the same
+# value.
+ac_cache_corrupted=false
+for ac_var in $ac_precious_vars; do
+  eval ac_old_set=\$ac_cv_env_${ac_var}_set
+  eval ac_new_set=\$ac_env_${ac_var}_set
+  eval ac_old_val=\$ac_cv_env_${ac_var}_value
+  eval ac_new_val=\$ac_env_${ac_var}_value
+  case $ac_old_set,$ac_new_set in
+    set,)
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
+      ac_cache_corrupted=: ;;
     ,set)
-      { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
       ac_cache_corrupted=: ;;
     ,);;
     *)
@@ -2603,24 +2963,24 @@ $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
 	ac_old_val_w=`echo x $ac_old_val`
 	ac_new_val_w=`echo x $ac_new_val`
 	if test "$ac_old_val_w" != "$ac_new_val_w"; then
-	  { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
-$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
+	  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
 	  ac_cache_corrupted=:
 	else
-	  { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
-$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
+	  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
+printf "%s\n" "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
 	  eval $ac_var=\$ac_old_val
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}:   former value:  \`$ac_old_val'" >&5
-$as_echo "$as_me:   former value:  \`$ac_old_val'" >&2;}
-	{ $as_echo "$as_me:${as_lineno-$LINENO}:   current value: \`$ac_new_val'" >&5
-$as_echo "$as_me:   current value: \`$ac_new_val'" >&2;}
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}:   former value:  \`$ac_old_val'" >&5
+printf "%s\n" "$as_me:   former value:  \`$ac_old_val'" >&2;}
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}:   current value: \`$ac_new_val'" >&5
+printf "%s\n" "$as_me:   current value: \`$ac_new_val'" >&2;}
       fi;;
   esac
   # Pass precious variables to config.status.
   if test "$ac_new_set" = set; then
     case $ac_new_val in
-    *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
+    *\'*) ac_arg=$ac_var=`printf "%s\n" "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
     *) ac_arg=$ac_var=$ac_new_val ;;
     esac
     case " $ac_configure_args " in
@@ -2630,11 +2990,12 @@ $as_echo "$as_me:   current value: \`$ac_new_val'" >&2;}
   fi
 done
 if $ac_cache_corrupted; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-  { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
-$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
-  as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
+printf "%s\n" "$as_me: error: changes in the environment can compromise the build" >&2;}
+  as_fn_error $? "run \`${MAKE-make} distclean' and/or \`rm $cache_file'
+	    and start over" "$LINENO" 5
 fi
 ## -------------------- ##
 ## Main body of script. ##
@@ -2651,9 +3012,9 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 # needed to build correct soname
 LDNS_VERSION_MAJOR=1
 
-LDNS_VERSION_MINOR=7
+LDNS_VERSION_MINOR=8
 
-LDNS_VERSION_MICRO=0
+LDNS_VERSION_MICRO=3
 
 
 # Library version
@@ -2668,9 +3029,24 @@ LDNS_VERSION_MICRO=0
 #   set age to 0
 #
 # ldns-1.6.17 and before had a .so with version same as VERSION_INFO
-# ldns-1.7.0 will have libversion 2:0:0
+# ldns-1.7.0 had libversion 2:0:0
+# ldns-1.7.1 had libversion 3:0:0 (though it should have had 3:0:1)
+# ldns-1.8.0 had libversion 4:0:2 (though it should have had 4:0:1)
+# ldns-1.8.1 had libversion 5:0:2
+# ldns-1.8.1 had libversion 6:0:3
+# ldns-1.8.2 had libversion 7:0:4
+# ldns-1.8.3 has libversion 8:0:5
 #
-VERSION_INFO=2:0:0
+VERSION_INFO=8:0:5
+
+
+
+
+
+
+
+
+
 
 
 ac_ext=c
@@ -2681,11 +3057,12 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
 set dummy ${ac_tool_prefix}gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -2693,11 +3070,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="${ac_tool_prefix}gcc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2708,11 +3089,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2721,11 +3102,12 @@ if test -z "$ac_cv_prog_CC"; then
   ac_ct_CC=$CC
   # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_CC"; then
   ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
 else
@@ -2733,11 +3115,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_CC="gcc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2748,11 +3134,11 @@ fi
 fi
 ac_ct_CC=$ac_cv_prog_ac_ct_CC
 if test -n "$ac_ct_CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_CC" = x; then
@@ -2760,8 +3146,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     CC=$ac_ct_CC
@@ -2774,11 +3160,12 @@ if test -z "$CC"; then
           if test -n "$ac_tool_prefix"; then
     # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
 set dummy ${ac_tool_prefix}cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -2786,11 +3173,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="${ac_tool_prefix}cc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2801,11 +3192,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2814,11 +3205,12 @@ fi
 if test -z "$CC"; then
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -2827,15 +3219,19 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    if test "$as_dir$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
        ac_prog_rejected=yes
        continue
      fi
     ac_cv_prog_CC="cc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2851,18 +3247,18 @@ if test $ac_prog_rejected = yes; then
     # However, it has the same basename, so the bogon will be chosen
     # first if we set CC to just the basename; use the full file name.
     shift
-    ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
+    ac_cv_prog_CC="$as_dir$ac_word${1+' '}$@"
   fi
 fi
 fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2873,11 +3269,12 @@ if test -z "$CC"; then
   do
     # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -2885,11 +3282,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2900,11 +3301,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2917,11 +3318,12 @@ if test -z "$CC"; then
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_CC"; then
   ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
 else
@@ -2929,11 +3331,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_CC="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -2944,11 +3350,11 @@ fi
 fi
 ac_ct_CC=$ac_cv_prog_ac_ct_CC
 if test -n "$ac_ct_CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2960,34 +3366,138 @@ done
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    CC=$ac_ct_CC
+  fi
+fi
+
+fi
+if test -z "$CC"; then
+  if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}clang", so it can be a program name with args.
+set dummy ${ac_tool_prefix}clang; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_CC="${ac_tool_prefix}clang"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_CC"; then
+  ac_ct_CC=$CC
+  # Extract the first word of "clang", so it can be a program name with args.
+set dummy clang; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$ac_ct_CC"; then
+  ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_ac_ct_CC="clang"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_CC=$ac_cv_prog_ac_ct_CC
+if test -n "$ac_ct_CC"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+  if test "x$ac_ct_CC" = x; then
+    CC=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     CC=$ac_ct_CC
   fi
+else
+  CC="$ac_cv_prog_CC"
 fi
 
 fi
 
 
-test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+test -z "$CC" && { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "no acceptable C compiler found in \$PATH
 See \`config.log' for more details" "$LINENO" 5; }
 
 # Provide some information about the compiler.
-$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
+printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
 set X $ac_compile
 ac_compiler=$2
-for ac_option in --version -v -V -qversion; do
+for ac_option in --version -v -V -qversion -version; do
   { { ac_try="$ac_compiler $ac_option >&5"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_compiler $ac_option >&5") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
@@ -2997,7 +3507,7 @@ $as_echo "$ac_try_echo"; } >&5
     cat conftest.er1 >&5
   fi
   rm -f conftest.er1 conftest.err
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
 done
 
@@ -3005,7 +3515,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
@@ -3017,9 +3527,9 @@ ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out"
 # Try to create an executable without -o first, disregard a.out.
 # It will help us diagnose broken compilers, and finding out an intuition
 # of exeext.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
-$as_echo_n "checking whether the C compiler works... " >&6; }
-ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
+printf %s "checking whether the C compiler works... " >&6; }
+ac_link_default=`printf "%s\n" "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
 
 # The possible output files:
 ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"
@@ -3040,11 +3550,12 @@ case "(($ac_try" in
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_link_default") 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; }; then :
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+then :
   # Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
 # So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
 # in a Makefile.  We should not override ac_cv_exeext if it was cached,
@@ -3061,7 +3572,7 @@ do
 	# certainly right.
 	break;;
     *.* )
-	if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
+	if test ${ac_cv_exeext+y} && test "$ac_cv_exeext" != no;
 	then :; else
 	   ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
 	fi
@@ -3077,44 +3588,46 @@ do
 done
 test "$ac_cv_exeext" = no && ac_cv_exeext=
 
-else
+else $as_nop
   ac_file=''
 fi
-if test -z "$ac_file"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-$as_echo "$as_me: failed program was:" >&5
+if test -z "$ac_file"
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error 77 "C compiler cannot create executables
 See \`config.log' for more details" "$LINENO" 5; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
-$as_echo_n "checking for C compiler default output file name... " >&6; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
-$as_echo "$ac_file" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
+printf %s "checking for C compiler default output file name... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
+printf "%s\n" "$ac_file" >&6; }
 ac_exeext=$ac_cv_exeext
 
 rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
 ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
-$as_echo_n "checking for suffix of executables... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
+printf %s "checking for suffix of executables... " >&6; }
 if { { ac_try="$ac_link"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_link") 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; }; then :
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+then :
   # If both `conftest.exe' and `conftest' are `present' (well, observable)
 # catch `conftest.exe'.  For instance with Cygwin, `ls conftest' will
 # work properly (i.e., refer to `conftest.exe'), while it won't with
@@ -3128,15 +3641,15 @@ for ac_file in conftest.exe conftest conftest.*; do
     * ) break;;
   esac
 done
-else
-  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+else $as_nop
+  { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "cannot compute suffix of executables: cannot compile and link
 See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f conftest conftest$ac_cv_exeext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
-$as_echo "$ac_cv_exeext" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
+printf "%s\n" "$ac_cv_exeext" >&6; }
 
 rm -f conftest.$ac_ext
 EXEEXT=$ac_cv_exeext
@@ -3145,7 +3658,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <stdio.h>
 int
-main ()
+main (void)
 {
 FILE *f = fopen ("conftest.out", "w");
  return ferror (f) || fclose (f) != 0;
@@ -3157,8 +3670,8 @@ _ACEOF
 ac_clean_files="$ac_clean_files conftest.out"
 # Check that the compiler produces executables we can run.  If not, either
 # the compiler is broken, or we cross compile.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
-$as_echo_n "checking whether we are cross compiling... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
+printf %s "checking whether we are cross compiling... " >&6; }
 if test "$cross_compiling" != yes; then
   { { ac_try="$ac_link"
 case "(($ac_try" in
@@ -3166,10 +3679,10 @@ case "(($ac_try" in
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_link") 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
   if { ac_try='./conftest$ac_cv_exeext'
   { { case "(($ac_try" in
@@ -3177,39 +3690,40 @@ $as_echo "$ac_try_echo"; } >&5
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_try") 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; }; then
     cross_compiling=no
   else
     if test "$cross_compiling" = maybe; then
 	cross_compiling=yes
     else
-	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot run C compiled programs.
+	{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error 77 "cannot run C compiled programs.
 If you meant to cross compile, use \`--host'.
 See \`config.log' for more details" "$LINENO" 5; }
     fi
   fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
-$as_echo "$cross_compiling" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
+printf "%s\n" "$cross_compiling" >&6; }
 
 rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
 ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
-$as_echo_n "checking for suffix of object files... " >&6; }
-if ${ac_cv_objext+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
+printf %s "checking for suffix of object files... " >&6; }
+if test ${ac_cv_objext+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
@@ -3223,11 +3737,12 @@ case "(($ac_try" in
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_compile") 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; }; then :
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+then :
   for ac_file in conftest.o conftest.obj conftest.*; do
   test -f "$ac_file" || continue;
   case $ac_file in
@@ -3236,31 +3751,32 @@ $as_echo "$ac_try_echo"; } >&5
        break;;
   esac
 done
-else
-  $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+  printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "cannot compute suffix of object files: cannot compile
 See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f conftest.$ac_cv_objext conftest.$ac_ext
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
-$as_echo "$ac_cv_objext" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
+printf "%s\n" "$ac_cv_objext" >&6; }
 OBJEXT=$ac_cv_objext
 ac_objext=$OBJEXT
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
-$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
-if ${ac_cv_c_compiler_gnu+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports GNU C" >&5
+printf %s "checking whether the compiler supports GNU C... " >&6; }
+if test ${ac_cv_c_compiler_gnu+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 #ifndef __GNUC__
        choke me
@@ -3270,29 +3786,33 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_compiler_gnu=yes
-else
+else $as_nop
   ac_compiler_gnu=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_cv_c_compiler_gnu=$ac_compiler_gnu
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
-$as_echo "$ac_cv_c_compiler_gnu" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
+printf "%s\n" "$ac_cv_c_compiler_gnu" >&6; }
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
 if test $ac_compiler_gnu = yes; then
   GCC=yes
 else
   GCC=
 fi
-ac_test_CFLAGS=${CFLAGS+set}
+ac_test_CFLAGS=${CFLAGS+y}
 ac_save_CFLAGS=$CFLAGS
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
-$as_echo_n "checking whether $CC accepts -g... " >&6; }
-if ${ac_cv_prog_cc_g+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
+printf %s "checking whether $CC accepts -g... " >&6; }
+if test ${ac_cv_prog_cc_g+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_save_c_werror_flag=$ac_c_werror_flag
    ac_c_werror_flag=yes
    ac_cv_prog_cc_g=no
@@ -3301,57 +3821,60 @@ else
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_prog_cc_g=yes
-else
+else $as_nop
   CFLAGS=""
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
   ac_c_werror_flag=$ac_save_c_werror_flag
 	 CFLAGS="-g"
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_prog_cc_g=yes
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
    ac_c_werror_flag=$ac_save_c_werror_flag
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
-$as_echo "$ac_cv_prog_cc_g" >&6; }
-if test "$ac_test_CFLAGS" = set; then
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
+printf "%s\n" "$ac_cv_prog_cc_g" >&6; }
+if test $ac_test_CFLAGS; then
   CFLAGS=$ac_save_CFLAGS
 elif test $ac_cv_prog_cc_g = yes; then
   if test "$GCC" = yes; then
@@ -3366,232 +3889,144 @@ else
     CFLAGS=
   fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
-$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
-if ${ac_cv_prog_cc_c89+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_cv_prog_cc_c89=no
+ac_prog_cc_stdc=no
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C11 features" >&5
+printf %s "checking for $CC option to enable C11 features... " >&6; }
+if test ${ac_cv_prog_cc_c11+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c11=no
 ac_save_CC=$CC
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <stdarg.h>
-#include <stdio.h>
-struct stat;
-/* Most of the following tests are stolen from RCS 5.7's src/conf.sh.  */
-struct buf { int x; };
-FILE * (*rcsopen) (struct buf *, struct stat *, int);
-static char *e (p, i)
-     char **p;
-     int i;
-{
-  return p[i];
-}
-static char *f (char * (*g) (char **, int), char **p, ...)
-{
-  char *s;
-  va_list v;
-  va_start (v,p);
-  s = g (p, va_arg (v,int));
-  va_end (v);
-  return s;
-}
-
-/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default.  It has
-   function prototypes and stuff, but not '\xHH' hex character constants.
-   These don't provoke an error unfortunately, instead are silently treated
-   as 'x'.  The following induces an error, until -std is added to get
-   proper ANSI mode.  Curiously '\x00'!='x' always comes out true, for an
-   array size at least.  It's necessary to write '\x00'==0 to get something
-   that's true only with -std.  */
-int osf4_cc_array ['\x00' == 0 ? 1 : -1];
-
-/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
-   inside strings and character constants.  */
-#define FOO(x) 'x'
-int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];
-
-int test (int i, double x);
-struct s1 {int (*f) (int a);};
-struct s2 {int (*f) (double a);};
-int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int);
-int argc;
-char **argv;
-int
-main ()
-{
-return f (e, argv, 0) != argv[0]  ||  f (e, argv, 1) != argv[1];
-  ;
-  return 0;
-}
+$ac_c_conftest_c11_program
 _ACEOF
-for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
-	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+for ac_arg in '' -std=gnu11
 do
   CC="$ac_save_CC $ac_arg"
-  if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_prog_cc_c89=$ac_arg
+  if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_prog_cc_c11=$ac_arg
 fi
-rm -f core conftest.err conftest.$ac_objext
-  test "x$ac_cv_prog_cc_c89" != "xno" && break
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+  test "x$ac_cv_prog_cc_c11" != "xno" && break
 done
 rm -f conftest.$ac_ext
 CC=$ac_save_CC
-
-fi
-# AC_CACHE_VAL
-case "x$ac_cv_prog_cc_c89" in
-  x)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
-$as_echo "none needed" >&6; } ;;
-  xno)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
-$as_echo "unsupported" >&6; } ;;
-  *)
-    CC="$CC $ac_cv_prog_cc_c89"
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
-$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
-esac
-if test "x$ac_cv_prog_cc_c89" != xno; then :
-
 fi
 
-ac_ext=c
-ac_cpp='$CPP $CPPFLAGS'
-ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
-ac_compiler_gnu=$ac_cv_c_compiler_gnu
-
-
-ac_ext=c
-ac_cpp='$CPP $CPPFLAGS'
-ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
-ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
-$as_echo_n "checking how to run the C preprocessor... " >&6; }
-# On Suns, sometimes $CPP names a directory.
-if test -n "$CPP" && test -d "$CPP"; then
-  CPP=
-fi
-if test -z "$CPP"; then
-  if ${ac_cv_prog_CPP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-      # Double quotes because CPP needs to be expanded
-    for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
-    do
-      ac_preproc_ok=false
-for ac_c_preproc_warn_flag in '' yes
-do
-  # Use a header file that comes with gcc, so configuring glibc
-  # with a fresh cross-compiler works.
-  # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
-  # <limits.h> exists even on freestanding compilers.
-  # On the NeXT, cc -E runs the code through the compiler's parser,
-  # not just through cpp. "Syntax error" is here to catch this case.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+if test "x$ac_cv_prog_cc_c11" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c11" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c11" >&5
+printf "%s\n" "$ac_cv_prog_cc_c11" >&6; }
+     CC="$CC $ac_cv_prog_cc_c11"
+fi
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c11
+  ac_prog_cc_stdc=c11
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C99 features" >&5
+printf %s "checking for $CC option to enable C99 features... " >&6; }
+if test ${ac_cv_prog_cc_c99+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c99=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
-		     Syntax error
+$ac_c_conftest_c99_program
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
-
-else
-  # Broken: fails on valid input.
-continue
+for ac_arg in '' -std=gnu99 -std=c99 -c99 -qlanglvl=extc1x -qlanglvl=extc99 -AC99 -D_STDC_C99=
+do
+  CC="$ac_save_CC $ac_arg"
+  if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_prog_cc_c99=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+  test "x$ac_cv_prog_cc_c99" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
 fi
-rm -f conftest.err conftest.i conftest.$ac_ext
 
-  # OK, works on sane cases.  Now check whether nonexistent headers
-  # can be detected and how.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+if test "x$ac_cv_prog_cc_c99" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c99" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5
+printf "%s\n" "$ac_cv_prog_cc_c99" >&6; }
+     CC="$CC $ac_cv_prog_cc_c99"
+fi
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c99
+  ac_prog_cc_stdc=c99
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C89 features" >&5
+printf %s "checking for $CC option to enable C89 features... " >&6; }
+if test ${ac_cv_prog_cc_c89+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c89=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <ac_nonexistent.h>
+$ac_c_conftest_c89_program
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
-  # Broken: success on invalid input.
-continue
-else
-  # Passes both tests.
-ac_preproc_ok=:
-break
+for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+do
+  CC="$ac_save_CC $ac_arg"
+  if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_prog_cc_c89=$ac_arg
 fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+  test "x$ac_cv_prog_cc_c89" != "xno" && break
 done
-# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
-  break
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
 fi
 
-    done
-    ac_cv_prog_CPP=$CPP
-
+if test "x$ac_cv_prog_cc_c89" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c89" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
+printf "%s\n" "$ac_cv_prog_cc_c89" >&6; }
+     CC="$CC $ac_cv_prog_cc_c89"
 fi
-  CPP=$ac_cv_prog_CPP
-else
-  ac_cv_prog_CPP=$CPP
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c89
+  ac_prog_cc_stdc=c89
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
-$as_echo "$CPP" >&6; }
-ac_preproc_ok=false
-for ac_c_preproc_warn_flag in '' yes
-do
-  # Use a header file that comes with gcc, so configuring glibc
-  # with a fresh cross-compiler works.
-  # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
-  # <limits.h> exists even on freestanding compilers.
-  # On the NeXT, cc -E runs the code through the compiler's parser,
-  # not just through cpp. "Syntax error" is here to catch this case.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
-		     Syntax error
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
-
-else
-  # Broken: fails on valid input.
-continue
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-  # OK, works on sane cases.  Now check whether nonexistent headers
-  # can be detected and how.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <ac_nonexistent.h>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
-  # Broken: success on invalid input.
-continue
-else
-  # Passes both tests.
-ac_preproc_ok=:
-break
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-done
-# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
-
-else
-  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
-See \`config.log' for more details" "$LINENO" 5; }
 fi
 
 ac_ext=c
@@ -3601,365 +4036,188 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
-$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
-if ${ac_cv_path_GREP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test -z "$GREP"; then
-  ac_path_GREP_found=false
-  # Loop through the user's path and test for each of PROGNAME-LIST
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+ac_header= ac_cache=
+for ac_item in $ac_header_c_list
 do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_prog in grep ggrep; do
-    for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
-      as_fn_executable_p "$ac_path_GREP" || continue
-# Check for GNU ac_path_GREP and select it if it is found.
-  # Check for GNU $ac_path_GREP
-case `"$ac_path_GREP" --version 2>&1` in
-*GNU*)
-  ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
-*)
-  ac_count=0
-  $as_echo_n 0123456789 >"conftest.in"
-  while :
-  do
-    cat "conftest.in" "conftest.in" >"conftest.tmp"
-    mv "conftest.tmp" "conftest.in"
-    cp "conftest.in" "conftest.nl"
-    $as_echo 'GREP' >> "conftest.nl"
-    "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
-    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
-    as_fn_arith $ac_count + 1 && ac_count=$as_val
-    if test $ac_count -gt ${ac_path_GREP_max-0}; then
-      # Best one so far, save it but keep looking for a better one
-      ac_cv_path_GREP="$ac_path_GREP"
-      ac_path_GREP_max=$ac_count
+  if test $ac_cache; then
+    ac_fn_c_check_header_compile "$LINENO" $ac_header ac_cv_header_$ac_cache "$ac_includes_default"
+    if eval test \"x\$ac_cv_header_$ac_cache\" = xyes; then
+      printf "%s\n" "#define $ac_item 1" >> confdefs.h
     fi
-    # 10*(2^10) chars as input seems more than enough
-    test $ac_count -gt 10 && break
-  done
-  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
-esac
-
-      $ac_path_GREP_found && break 3
-    done
-  done
-  done
-IFS=$as_save_IFS
-  if test -z "$ac_cv_path_GREP"; then
-    as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+    ac_header= ac_cache=
+  elif test $ac_header; then
+    ac_cache=$ac_item
+  else
+    ac_header=$ac_item
   fi
-else
-  ac_cv_path_GREP=$GREP
-fi
+done
 
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
-$as_echo "$ac_cv_path_GREP" >&6; }
- GREP="$ac_cv_path_GREP"
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
-$as_echo_n "checking for egrep... " >&6; }
-if ${ac_cv_path_EGREP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
-   then ac_cv_path_EGREP="$GREP -E"
-   else
-     if test -z "$EGREP"; then
-  ac_path_EGREP_found=false
-  # Loop through the user's path and test for each of PROGNAME-LIST
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_prog in egrep; do
-    for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
-      as_fn_executable_p "$ac_path_EGREP" || continue
-# Check for GNU ac_path_EGREP and select it if it is found.
-  # Check for GNU $ac_path_EGREP
-case `"$ac_path_EGREP" --version 2>&1` in
-*GNU*)
-  ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
-*)
-  ac_count=0
-  $as_echo_n 0123456789 >"conftest.in"
-  while :
-  do
-    cat "conftest.in" "conftest.in" >"conftest.tmp"
-    mv "conftest.tmp" "conftest.in"
-    cp "conftest.in" "conftest.nl"
-    $as_echo 'EGREP' >> "conftest.nl"
-    "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
-    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
-    as_fn_arith $ac_count + 1 && ac_count=$as_val
-    if test $ac_count -gt ${ac_path_EGREP_max-0}; then
-      # Best one so far, save it but keep looking for a better one
-      ac_cv_path_EGREP="$ac_path_EGREP"
-      ac_path_EGREP_max=$ac_count
-    fi
-    # 10*(2^10) chars as input seems more than enough
-    test $ac_count -gt 10 && break
-  done
-  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
-esac
 
-      $ac_path_EGREP_found && break 3
-    done
-  done
-  done
-IFS=$as_save_IFS
-  if test -z "$ac_cv_path_EGREP"; then
-    as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
-  fi
-else
-  ac_cv_path_EGREP=$EGREP
-fi
 
-   fi
+
+
+
+if test $ac_cv_header_stdlib_h = yes && test $ac_cv_header_string_h = yes
+then :
+
+printf "%s\n" "#define STDC_HEADERS 1" >>confdefs.h
+
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
-$as_echo "$ac_cv_path_EGREP" >&6; }
- EGREP="$ac_cv_path_EGREP"
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
-$as_echo_n "checking for ANSI C header files... " >&6; }
-if ${ac_cv_header_stdc+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+
+
+
+
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether it is safe to define __EXTENSIONS__" >&5
+printf %s "checking whether it is safe to define __EXTENSIONS__... " >&6; }
+if test ${ac_cv_safe_to_define___extensions__+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <float.h>
 
+#         define __EXTENSIONS__ 1
+          $ac_includes_default
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_header_stdc=yes
-else
-  ac_cv_header_stdc=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
-if test $ac_cv_header_stdc = yes; then
-  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <string.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "memchr" >/dev/null 2>&1; then :
-
-else
-  ac_cv_header_stdc=no
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_safe_to_define___extensions__=yes
+else $as_nop
+  ac_cv_safe_to_define___extensions__=no
 fi
-rm -f conftest*
-
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_safe_to_define___extensions__" >&5
+printf "%s\n" "$ac_cv_safe_to_define___extensions__" >&6; }
 
-if test $ac_cv_header_stdc = yes; then
-  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether _XOPEN_SOURCE should be defined" >&5
+printf %s "checking whether _XOPEN_SOURCE should be defined... " >&6; }
+if test ${ac_cv_should_define__xopen_source+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_should_define__xopen_source=no
+    if test $ac_cv_header_wchar_h = yes
+then :
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <stdlib.h>
 
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "free" >/dev/null 2>&1; then :
-
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
+          #include <wchar.h>
+          mbstate_t x;
+int
+main (void)
+{
 
-fi
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-if test $ac_cv_header_stdc = yes; then
-  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
-  if test "$cross_compiling" = yes; then :
-  :
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <ctype.h>
-#include <stdlib.h>
-#if ((' ' & 0x0FF) == 0x020)
-# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
-# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
-#else
-# define ISLOWER(c) \
-		   (('a' <= (c) && (c) <= 'i') \
-		     || ('j' <= (c) && (c) <= 'r') \
-		     || ('s' <= (c) && (c) <= 'z'))
-# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
-#endif
 
-#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
+            #define _XOPEN_SOURCE 500
+            #include <wchar.h>
+            mbstate_t x;
 int
-main ()
+main (void)
 {
-  int i;
-  for (i = 0; i < 256; i++)
-    if (XOR (islower (i), ISLOWER (i))
-	|| toupper (i) != TOUPPER (i))
-      return 2;
+
+  ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-
-else
-  ac_cv_header_stdc=no
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_should_define__xopen_source=yes
 fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
-$as_echo "$ac_cv_header_stdc" >&6; }
-if test $ac_cv_header_stdc = yes; then
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_should_define__xopen_source" >&5
+printf "%s\n" "$ac_cv_should_define__xopen_source" >&6; }
 
-$as_echo "#define STDC_HEADERS 1" >>confdefs.h
+  printf "%s\n" "#define _ALL_SOURCE 1" >>confdefs.h
 
-fi
+  printf "%s\n" "#define _DARWIN_C_SOURCE 1" >>confdefs.h
 
-# On IRIX 5.3, sys/types and inttypes.h are conflicting.
-for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
-		  inttypes.h stdint.h unistd.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
-"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+  printf "%s\n" "#define _GNU_SOURCE 1" >>confdefs.h
 
-fi
+  printf "%s\n" "#define _HPUX_ALT_XOPEN_SOCKET_API 1" >>confdefs.h
 
-done
+  printf "%s\n" "#define _NETBSD_SOURCE 1" >>confdefs.h
 
+  printf "%s\n" "#define _OPENBSD_SOURCE 1" >>confdefs.h
 
+  printf "%s\n" "#define _POSIX_PTHREAD_SEMANTICS 1" >>confdefs.h
 
-  ac_fn_c_check_header_mongrel "$LINENO" "minix/config.h" "ac_cv_header_minix_config_h" "$ac_includes_default"
-if test "x$ac_cv_header_minix_config_h" = xyes; then :
-  MINIX=yes
-else
-  MINIX=
-fi
+  printf "%s\n" "#define __STDC_WANT_IEC_60559_ATTRIBS_EXT__ 1" >>confdefs.h
 
+  printf "%s\n" "#define __STDC_WANT_IEC_60559_BFP_EXT__ 1" >>confdefs.h
 
-  if test "$MINIX" = yes; then
+  printf "%s\n" "#define __STDC_WANT_IEC_60559_DFP_EXT__ 1" >>confdefs.h
 
-$as_echo "#define _POSIX_SOURCE 1" >>confdefs.h
+  printf "%s\n" "#define __STDC_WANT_IEC_60559_FUNCS_EXT__ 1" >>confdefs.h
 
+  printf "%s\n" "#define __STDC_WANT_IEC_60559_TYPES_EXT__ 1" >>confdefs.h
 
-$as_echo "#define _POSIX_1_SOURCE 2" >>confdefs.h
+  printf "%s\n" "#define __STDC_WANT_LIB_EXT2__ 1" >>confdefs.h
 
+  printf "%s\n" "#define __STDC_WANT_MATH_SPEC_FUNCS__ 1" >>confdefs.h
 
-$as_echo "#define _MINIX 1" >>confdefs.h
+  printf "%s\n" "#define _TANDEM_SOURCE 1" >>confdefs.h
 
-  fi
+  if test $ac_cv_header_minix_config_h = yes
+then :
+  MINIX=yes
+    printf "%s\n" "#define _MINIX 1" >>confdefs.h
 
+    printf "%s\n" "#define _POSIX_SOURCE 1" >>confdefs.h
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether it is safe to define __EXTENSIONS__" >&5
-$as_echo_n "checking whether it is safe to define __EXTENSIONS__... " >&6; }
-if ${ac_cv_safe_to_define___extensions__+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
+    printf "%s\n" "#define _POSIX_1_SOURCE 2" >>confdefs.h
 
-#         define __EXTENSIONS__ 1
-          $ac_includes_default
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_safe_to_define___extensions__=yes
-else
-  ac_cv_safe_to_define___extensions__=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+else $as_nop
+  MINIX=
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_safe_to_define___extensions__" >&5
-$as_echo "$ac_cv_safe_to_define___extensions__" >&6; }
-  test $ac_cv_safe_to_define___extensions__ = yes &&
-    $as_echo "#define __EXTENSIONS__ 1" >>confdefs.h
-
-  $as_echo "#define _ALL_SOURCE 1" >>confdefs.h
+  if test $ac_cv_safe_to_define___extensions__ = yes
+then :
+  printf "%s\n" "#define __EXTENSIONS__ 1" >>confdefs.h
 
-  $as_echo "#define _GNU_SOURCE 1" >>confdefs.h
-
-  $as_echo "#define _POSIX_PTHREAD_SEMANTICS 1" >>confdefs.h
-
-  $as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h
+fi
+  if test $ac_cv_should_define__xopen_source = yes
+then :
+  printf "%s\n" "#define _XOPEN_SOURCE 500" >>confdefs.h
 
+fi
 
 
 if test "$ac_cv_header_minix_config_h" = "yes"; then
 
-$as_echo "#define _NETBSD_SOURCE 1" >>confdefs.h
+printf "%s\n" "#define _NETBSD_SOURCE 1" >>confdefs.h
 
 fi
-ac_aux_dir=
-for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
-  if test -f "$ac_dir/install-sh"; then
-    ac_aux_dir=$ac_dir
-    ac_install_sh="$ac_aux_dir/install-sh -c"
-    break
-  elif test -f "$ac_dir/install.sh"; then
-    ac_aux_dir=$ac_dir
-    ac_install_sh="$ac_aux_dir/install.sh -c"
-    break
-  elif test -f "$ac_dir/shtool"; then
-    ac_aux_dir=$ac_dir
-    ac_install_sh="$ac_aux_dir/shtool install -c"
-    break
-  fi
-done
-if test -z "$ac_aux_dir"; then
-  as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5
-fi
-
-# These three variables are undocumented and unsupported,
-# and are intended to be withdrawn in a future Autoconf release.
-# They can cause serious problems if a builder's source tree is in a directory
-# whose full name contains unusual characters.
-ac_config_guess="$SHELL $ac_aux_dir/config.guess"  # Please don't use this var.
-ac_config_sub="$SHELL $ac_aux_dir/config.sub"  # Please don't use this var.
-ac_configure="$SHELL $ac_aux_dir/configure"  # Please don't use this var.
 
 
 case `pwd` in
   *\ * | *\	*)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5
-$as_echo "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;;
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5
+printf "%s\n" "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;;
 esac
 
 
@@ -3979,28 +4237,32 @@ macro_revision='2.4.6'
 
 
 
+
 ltmain=$ac_aux_dir/ltmain.sh
 
-# Make sure we can run config.sub.
-$SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 ||
-  as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
-$as_echo_n "checking build system type... " >&6; }
-if ${ac_cv_build+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+
+  # Make sure we can run config.sub.
+$SHELL "${ac_aux_dir}config.sub" sun4 >/dev/null 2>&1 ||
+  as_fn_error $? "cannot run $SHELL ${ac_aux_dir}config.sub" "$LINENO" 5
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
+printf %s "checking build system type... " >&6; }
+if test ${ac_cv_build+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_build_alias=$build_alias
 test "x$ac_build_alias" = x &&
-  ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"`
+  ac_build_alias=`$SHELL "${ac_aux_dir}config.guess"`
 test "x$ac_build_alias" = x &&
   as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5
-ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` ||
-  as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5
+ac_cv_build=`$SHELL "${ac_aux_dir}config.sub" $ac_build_alias` ||
+  as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $ac_build_alias failed" "$LINENO" 5
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
-$as_echo "$ac_cv_build" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
+printf "%s\n" "$ac_cv_build" >&6; }
 case $ac_cv_build in
 *-*-*) ;;
 *) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;;
@@ -4019,21 +4281,22 @@ IFS=$ac_save_IFS
 case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
-$as_echo_n "checking host system type... " >&6; }
-if ${ac_cv_host+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
+printf %s "checking host system type... " >&6; }
+if test ${ac_cv_host+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test "x$host_alias" = x; then
   ac_cv_host=$ac_cv_build
 else
-  ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` ||
-    as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5
+  ac_cv_host=`$SHELL "${ac_aux_dir}config.sub" $host_alias` ||
+    as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $host_alias failed" "$LINENO" 5
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
-$as_echo "$ac_cv_host" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
+printf "%s\n" "$ac_cv_host" >&6; }
 case $ac_cv_host in
 *-*-*) ;;
 *) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;;
@@ -4073,8 +4336,8 @@ ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
 ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO
 ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5
-$as_echo_n "checking how to print strings... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5
+printf %s "checking how to print strings... " >&6; }
 # Test print first, because it will be a builtin if present.
 if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \
    test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then
@@ -4100,12 +4363,12 @@ func_echo_all ()
 }
 
 case $ECHO in
-  printf*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: printf" >&5
-$as_echo "printf" >&6; } ;;
-  print*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: print -r" >&5
-$as_echo "print -r" >&6; } ;;
-  *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: cat" >&5
-$as_echo "cat" >&6; } ;;
+  printf*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: printf" >&5
+printf "%s\n" "printf" >&6; } ;;
+  print*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: print -r" >&5
+printf "%s\n" "print -r" >&6; } ;;
+  *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: cat" >&5
+printf "%s\n" "cat" >&6; } ;;
 esac
 
 
@@ -4121,11 +4384,12 @@ esac
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
-$as_echo_n "checking for a sed that does not truncate output... " >&6; }
-if ${ac_cv_path_SED+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
+printf %s "checking for a sed that does not truncate output... " >&6; }
+if test ${ac_cv_path_SED+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
             ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/
      for ac_i in 1 2 3 4 5 6 7; do
        ac_script="$ac_script$as_nl$ac_script"
@@ -4139,10 +4403,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_prog in sed gsed; do
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in sed gsed
+   do
     for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_SED="$as_dir/$ac_prog$ac_exec_ext"
+      ac_path_SED="$as_dir$ac_prog$ac_exec_ext"
       as_fn_executable_p "$ac_path_SED" || continue
 # Check for GNU ac_path_SED and select it if it is found.
   # Check for GNU $ac_path_SED
@@ -4151,13 +4420,13 @@ case `"$ac_path_SED" --version 2>&1` in
   ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;;
 *)
   ac_count=0
-  $as_echo_n 0123456789 >"conftest.in"
+  printf %s 0123456789 >"conftest.in"
   while :
   do
     cat "conftest.in" "conftest.in" >"conftest.tmp"
     mv "conftest.tmp" "conftest.in"
     cp "conftest.in" "conftest.nl"
-    $as_echo '' >> "conftest.nl"
+    printf "%s\n" '' >> "conftest.nl"
     "$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null || break
     diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
     as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -4185,8 +4454,8 @@ else
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
-$as_echo "$ac_cv_path_SED" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
+printf "%s\n" "$ac_cv_path_SED" >&6; }
  SED="$ac_cv_path_SED"
   rm -f conftest.sed
 
@@ -4203,11 +4472,154 @@ Xsed="$SED -e 1s/^X//"
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5
-$as_echo_n "checking for fgrep... " >&6; }
-if ${ac_cv_path_FGREP+:} false; then :
-  $as_echo_n "(cached) " >&6
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
+printf %s "checking for grep that handles long lines and -e... " >&6; }
+if test ${ac_cv_path_GREP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -z "$GREP"; then
+  ac_path_GREP_found=false
+  # Loop through the user's path and test for each of PROGNAME-LIST
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in grep ggrep
+   do
+    for ac_exec_ext in '' $ac_executable_extensions; do
+      ac_path_GREP="$as_dir$ac_prog$ac_exec_ext"
+      as_fn_executable_p "$ac_path_GREP" || continue
+# Check for GNU ac_path_GREP and select it if it is found.
+  # Check for GNU $ac_path_GREP
+case `"$ac_path_GREP" --version 2>&1` in
+*GNU*)
+  ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
+*)
+  ac_count=0
+  printf %s 0123456789 >"conftest.in"
+  while :
+  do
+    cat "conftest.in" "conftest.in" >"conftest.tmp"
+    mv "conftest.tmp" "conftest.in"
+    cp "conftest.in" "conftest.nl"
+    printf "%s\n" 'GREP' >> "conftest.nl"
+    "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
+    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
+    as_fn_arith $ac_count + 1 && ac_count=$as_val
+    if test $ac_count -gt ${ac_path_GREP_max-0}; then
+      # Best one so far, save it but keep looking for a better one
+      ac_cv_path_GREP="$ac_path_GREP"
+      ac_path_GREP_max=$ac_count
+    fi
+    # 10*(2^10) chars as input seems more than enough
+    test $ac_count -gt 10 && break
+  done
+  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
+esac
+
+      $ac_path_GREP_found && break 3
+    done
+  done
+  done
+IFS=$as_save_IFS
+  if test -z "$ac_cv_path_GREP"; then
+    as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+  fi
 else
+  ac_cv_path_GREP=$GREP
+fi
+
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
+printf "%s\n" "$ac_cv_path_GREP" >&6; }
+ GREP="$ac_cv_path_GREP"
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
+printf %s "checking for egrep... " >&6; }
+if test ${ac_cv_path_EGREP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
+   then ac_cv_path_EGREP="$GREP -E"
+   else
+     if test -z "$EGREP"; then
+  ac_path_EGREP_found=false
+  # Loop through the user's path and test for each of PROGNAME-LIST
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in egrep
+   do
+    for ac_exec_ext in '' $ac_executable_extensions; do
+      ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext"
+      as_fn_executable_p "$ac_path_EGREP" || continue
+# Check for GNU ac_path_EGREP and select it if it is found.
+  # Check for GNU $ac_path_EGREP
+case `"$ac_path_EGREP" --version 2>&1` in
+*GNU*)
+  ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
+*)
+  ac_count=0
+  printf %s 0123456789 >"conftest.in"
+  while :
+  do
+    cat "conftest.in" "conftest.in" >"conftest.tmp"
+    mv "conftest.tmp" "conftest.in"
+    cp "conftest.in" "conftest.nl"
+    printf "%s\n" 'EGREP' >> "conftest.nl"
+    "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
+    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
+    as_fn_arith $ac_count + 1 && ac_count=$as_val
+    if test $ac_count -gt ${ac_path_EGREP_max-0}; then
+      # Best one so far, save it but keep looking for a better one
+      ac_cv_path_EGREP="$ac_path_EGREP"
+      ac_path_EGREP_max=$ac_count
+    fi
+    # 10*(2^10) chars as input seems more than enough
+    test $ac_count -gt 10 && break
+  done
+  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
+esac
+
+      $ac_path_EGREP_found && break 3
+    done
+  done
+  done
+IFS=$as_save_IFS
+  if test -z "$ac_cv_path_EGREP"; then
+    as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+  fi
+else
+  ac_cv_path_EGREP=$EGREP
+fi
+
+   fi
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
+printf "%s\n" "$ac_cv_path_EGREP" >&6; }
+ EGREP="$ac_cv_path_EGREP"
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5
+printf %s "checking for fgrep... " >&6; }
+if test ${ac_cv_path_FGREP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if echo 'ab*c' | $GREP -F 'ab*c' >/dev/null 2>&1
    then ac_cv_path_FGREP="$GREP -F"
    else
@@ -4218,10 +4630,15 @@ else
 for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_prog in fgrep; do
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in fgrep
+   do
     for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_FGREP="$as_dir/$ac_prog$ac_exec_ext"
+      ac_path_FGREP="$as_dir$ac_prog$ac_exec_ext"
       as_fn_executable_p "$ac_path_FGREP" || continue
 # Check for GNU ac_path_FGREP and select it if it is found.
   # Check for GNU $ac_path_FGREP
@@ -4230,13 +4647,13 @@ case `"$ac_path_FGREP" --version 2>&1` in
   ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_found=:;;
 *)
   ac_count=0
-  $as_echo_n 0123456789 >"conftest.in"
+  printf %s 0123456789 >"conftest.in"
   while :
   do
     cat "conftest.in" "conftest.in" >"conftest.tmp"
     mv "conftest.tmp" "conftest.in"
     cp "conftest.in" "conftest.nl"
-    $as_echo 'FGREP' >> "conftest.nl"
+    printf "%s\n" 'FGREP' >> "conftest.nl"
     "$ac_path_FGREP" FGREP < "conftest.nl" >"conftest.out" 2>/dev/null || break
     diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
     as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -4265,8 +4682,8 @@ fi
 
    fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5
-$as_echo "$ac_cv_path_FGREP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5
+printf "%s\n" "$ac_cv_path_FGREP" >&6; }
  FGREP="$ac_cv_path_FGREP"
 
 
@@ -4291,17 +4708,18 @@ test -z "$GREP" && GREP=grep
 
 
 # Check whether --with-gnu-ld was given.
-if test "${with_gnu_ld+set}" = set; then :
+if test ${with_gnu_ld+y}
+then :
   withval=$with_gnu_ld; test no = "$withval" || with_gnu_ld=yes
-else
+else $as_nop
   with_gnu_ld=no
 fi
 
 ac_prog=ld
 if test yes = "$GCC"; then
   # Check if gcc -print-prog-name=ld gives a path.
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5
-$as_echo_n "checking for ld used by $CC... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5
+printf %s "checking for ld used by $CC... " >&6; }
   case $host in
   *-*-mingw*)
     # gcc leaves a trailing carriage return, which upsets mingw
@@ -4330,15 +4748,16 @@ $as_echo_n "checking for ld used by $CC... " >&6; }
     ;;
   esac
 elif test yes = "$with_gnu_ld"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5
-$as_echo_n "checking for GNU ld... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5
+printf %s "checking for GNU ld... " >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5
-$as_echo_n "checking for non-GNU ld... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5
+printf %s "checking for non-GNU ld... " >&6; }
 fi
-if ${lt_cv_path_LD+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if test ${lt_cv_path_LD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -z "$LD"; then
   lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
   for ac_dir in $PATH; do
@@ -4367,18 +4786,19 @@ fi
 
 LD=$lt_cv_path_LD
 if test -n "$LD"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LD" >&5
-$as_echo "$LD" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LD" >&5
+printf "%s\n" "$LD" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5
-$as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; }
-if ${lt_cv_prog_gnu_ld+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5
+printf %s "checking if the linker ($LD) is GNU ld... " >&6; }
+if test ${lt_cv_prog_gnu_ld+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   # I'd rather use --version here, but apparently some GNU lds only accept -v.
 case `$LD -v 2>&1 </dev/null` in
 *GNU* | *'with BFD'*)
@@ -4389,8 +4809,8 @@ case `$LD -v 2>&1 </dev/null` in
   ;;
 esac
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_gnu_ld" >&5
-$as_echo "$lt_cv_prog_gnu_ld" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_gnu_ld" >&5
+printf "%s\n" "$lt_cv_prog_gnu_ld" >&6; }
 with_gnu_ld=$lt_cv_prog_gnu_ld
 
 
@@ -4401,11 +4821,12 @@ with_gnu_ld=$lt_cv_prog_gnu_ld
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5
-$as_echo_n "checking for BSD- or MS-compatible name lister (nm)... " >&6; }
-if ${lt_cv_path_NM+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5
+printf %s "checking for BSD- or MS-compatible name lister (nm)... " >&6; }
+if test ${lt_cv_path_NM+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$NM"; then
   # Let the user override the test.
   lt_cv_path_NM=$NM
@@ -4455,8 +4876,8 @@ else
   : ${lt_cv_path_NM=no}
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5
-$as_echo "$lt_cv_path_NM" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5
+printf "%s\n" "$lt_cv_path_NM" >&6; }
 if test no != "$lt_cv_path_NM"; then
   NM=$lt_cv_path_NM
 else
@@ -4469,11 +4890,12 @@ else
   do
     # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DUMPBIN+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DUMPBIN+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$DUMPBIN"; then
   ac_cv_prog_DUMPBIN="$DUMPBIN" # Let the user override the test.
 else
@@ -4481,11 +4903,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_DUMPBIN="$ac_tool_prefix$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -4496,11 +4922,11 @@ fi
 fi
 DUMPBIN=$ac_cv_prog_DUMPBIN
 if test -n "$DUMPBIN"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5
-$as_echo "$DUMPBIN" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5
+printf "%s\n" "$DUMPBIN" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -4513,11 +4939,12 @@ if test -z "$DUMPBIN"; then
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DUMPBIN+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DUMPBIN+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_DUMPBIN"; then
   ac_cv_prog_ac_ct_DUMPBIN="$ac_ct_DUMPBIN" # Let the user override the test.
 else
@@ -4525,11 +4952,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_DUMPBIN="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -4540,11 +4971,11 @@ fi
 fi
 ac_ct_DUMPBIN=$ac_cv_prog_ac_ct_DUMPBIN
 if test -n "$ac_ct_DUMPBIN"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5
-$as_echo "$ac_ct_DUMPBIN" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5
+printf "%s\n" "$ac_ct_DUMPBIN" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -4556,8 +4987,8 @@ done
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     DUMPBIN=$ac_ct_DUMPBIN
@@ -4585,11 +5016,12 @@ test -z "$NM" && NM=nm
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5
-$as_echo_n "checking the name lister ($NM) interface... " >&6; }
-if ${lt_cv_nm_interface+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5
+printf %s "checking the name lister ($NM) interface... " >&6; }
+if test ${lt_cv_nm_interface+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
   (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&5)
@@ -4605,26 +5037,27 @@ else
   fi
   rm -f conftest*
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5
-$as_echo "$lt_cv_nm_interface" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5
+printf "%s\n" "$lt_cv_nm_interface" >&6; }
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5
-$as_echo_n "checking whether ln -s works... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5
+printf %s "checking whether ln -s works... " >&6; }
 LN_S=$as_ln_s
 if test "$LN_S" = "ln -s"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5
-$as_echo "no, using $LN_S" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5
+printf "%s\n" "no, using $LN_S" >&6; }
 fi
 
 # find the maximum length of command line arguments
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5
-$as_echo_n "checking the maximum length of command line arguments... " >&6; }
-if ${lt_cv_sys_max_cmd_len+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5
+printf %s "checking the maximum length of command line arguments... " >&6; }
+if test ${lt_cv_sys_max_cmd_len+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
     i=0
   teststring=ABCD
 
@@ -4751,11 +5184,11 @@ else
 fi
 
 if test -n "$lt_cv_sys_max_cmd_len"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5
-$as_echo "$lt_cv_sys_max_cmd_len" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5
+printf "%s\n" "$lt_cv_sys_max_cmd_len" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5
-$as_echo "none" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none" >&5
+printf "%s\n" "none" >&6; }
 fi
 max_cmd_len=$lt_cv_sys_max_cmd_len
 
@@ -4799,11 +5232,12 @@ esac
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5
-$as_echo_n "checking how to convert $build file names to $host format... " >&6; }
-if ${lt_cv_to_host_file_cmd+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5
+printf %s "checking how to convert $build file names to $host format... " >&6; }
+if test ${lt_cv_to_host_file_cmd+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $host in
   *-*-mingw* )
     case $build in
@@ -4839,18 +5273,19 @@ esac
 fi
 
 to_host_file_cmd=$lt_cv_to_host_file_cmd
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5
-$as_echo "$lt_cv_to_host_file_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5
+printf "%s\n" "$lt_cv_to_host_file_cmd" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5
-$as_echo_n "checking how to convert $build file names to toolchain format... " >&6; }
-if ${lt_cv_to_tool_file_cmd+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5
+printf %s "checking how to convert $build file names to toolchain format... " >&6; }
+if test ${lt_cv_to_tool_file_cmd+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   #assume ordinary cross tools, or native build.
 lt_cv_to_tool_file_cmd=func_convert_file_noop
 case $host in
@@ -4866,22 +5301,23 @@ esac
 fi
 
 to_tool_file_cmd=$lt_cv_to_tool_file_cmd
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5
-$as_echo "$lt_cv_to_tool_file_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5
+printf "%s\n" "$lt_cv_to_tool_file_cmd" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5
-$as_echo_n "checking for $LD option to reload object files... " >&6; }
-if ${lt_cv_ld_reload_flag+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5
+printf %s "checking for $LD option to reload object files... " >&6; }
+if test ${lt_cv_ld_reload_flag+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_ld_reload_flag='-r'
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5
-$as_echo "$lt_cv_ld_reload_flag" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5
+printf "%s\n" "$lt_cv_ld_reload_flag" >&6; }
 reload_flag=$lt_cv_ld_reload_flag
 case $reload_flag in
 "" | " "*) ;;
@@ -4914,11 +5350,12 @@ esac
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args.
 set dummy ${ac_tool_prefix}objdump; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OBJDUMP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OBJDUMP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$OBJDUMP"; then
   ac_cv_prog_OBJDUMP="$OBJDUMP" # Let the user override the test.
 else
@@ -4926,11 +5363,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_OBJDUMP="${ac_tool_prefix}objdump"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -4941,11 +5382,11 @@ fi
 fi
 OBJDUMP=$ac_cv_prog_OBJDUMP
 if test -n "$OBJDUMP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5
-$as_echo "$OBJDUMP" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5
+printf "%s\n" "$OBJDUMP" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -4954,11 +5395,12 @@ if test -z "$ac_cv_prog_OBJDUMP"; then
   ac_ct_OBJDUMP=$OBJDUMP
   # Extract the first word of "objdump", so it can be a program name with args.
 set dummy objdump; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OBJDUMP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OBJDUMP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_OBJDUMP"; then
   ac_cv_prog_ac_ct_OBJDUMP="$ac_ct_OBJDUMP" # Let the user override the test.
 else
@@ -4966,11 +5408,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_OBJDUMP="objdump"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -4981,11 +5427,11 @@ fi
 fi
 ac_ct_OBJDUMP=$ac_cv_prog_ac_ct_OBJDUMP
 if test -n "$ac_ct_OBJDUMP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5
-$as_echo "$ac_ct_OBJDUMP" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5
+printf "%s\n" "$ac_ct_OBJDUMP" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_OBJDUMP" = x; then
@@ -4993,8 +5439,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     OBJDUMP=$ac_ct_OBJDUMP
@@ -5013,11 +5459,12 @@ test -z "$OBJDUMP" && OBJDUMP=objdump
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5
-$as_echo_n "checking how to recognize dependent libraries... " >&6; }
-if ${lt_cv_deplibs_check_method+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5
+printf %s "checking how to recognize dependent libraries... " >&6; }
+if test ${lt_cv_deplibs_check_method+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_file_magic_cmd='$MAGIC_CMD'
 lt_cv_file_magic_test_file=
 lt_cv_deplibs_check_method='unknown'
@@ -5213,8 +5660,8 @@ os2*)
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5
-$as_echo "$lt_cv_deplibs_check_method" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5
+printf "%s\n" "$lt_cv_deplibs_check_method" >&6; }
 
 file_magic_glob=
 want_nocaseglob=no
@@ -5258,11 +5705,12 @@ test -z "$deplibs_check_method" && deplibs_check_method=unknown
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}dlltool", so it can be a program name with args.
 set dummy ${ac_tool_prefix}dlltool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DLLTOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DLLTOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$DLLTOOL"; then
   ac_cv_prog_DLLTOOL="$DLLTOOL" # Let the user override the test.
 else
@@ -5270,11 +5718,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_DLLTOOL="${ac_tool_prefix}dlltool"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5285,11 +5737,11 @@ fi
 fi
 DLLTOOL=$ac_cv_prog_DLLTOOL
 if test -n "$DLLTOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5
-$as_echo "$DLLTOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5
+printf "%s\n" "$DLLTOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5298,11 +5750,12 @@ if test -z "$ac_cv_prog_DLLTOOL"; then
   ac_ct_DLLTOOL=$DLLTOOL
   # Extract the first word of "dlltool", so it can be a program name with args.
 set dummy dlltool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DLLTOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DLLTOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_DLLTOOL"; then
   ac_cv_prog_ac_ct_DLLTOOL="$ac_ct_DLLTOOL" # Let the user override the test.
 else
@@ -5310,11 +5763,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_DLLTOOL="dlltool"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5325,11 +5782,11 @@ fi
 fi
 ac_ct_DLLTOOL=$ac_cv_prog_ac_ct_DLLTOOL
 if test -n "$ac_ct_DLLTOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5
-$as_echo "$ac_ct_DLLTOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5
+printf "%s\n" "$ac_ct_DLLTOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_DLLTOOL" = x; then
@@ -5337,8 +5794,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     DLLTOOL=$ac_ct_DLLTOOL
@@ -5358,11 +5815,12 @@ test -z "$DLLTOOL" && DLLTOOL=dlltool
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5
-$as_echo_n "checking how to associate runtime and link libraries... " >&6; }
-if ${lt_cv_sharedlib_from_linklib_cmd+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5
+printf %s "checking how to associate runtime and link libraries... " >&6; }
+if test ${lt_cv_sharedlib_from_linklib_cmd+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_sharedlib_from_linklib_cmd='unknown'
 
 case $host_os in
@@ -5385,8 +5843,8 @@ cygwin* | mingw* | pw32* | cegcc*)
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5
-$as_echo "$lt_cv_sharedlib_from_linklib_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5
+printf "%s\n" "$lt_cv_sharedlib_from_linklib_cmd" >&6; }
 sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd
 test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO
 
@@ -5401,11 +5859,12 @@ if test -n "$ac_tool_prefix"; then
   do
     # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_AR+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_AR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$AR"; then
   ac_cv_prog_AR="$AR" # Let the user override the test.
 else
@@ -5413,11 +5872,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_AR="$ac_tool_prefix$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5428,11 +5891,11 @@ fi
 fi
 AR=$ac_cv_prog_AR
 if test -n "$AR"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
-$as_echo "$AR" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
+printf "%s\n" "$AR" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5445,11 +5908,12 @@ if test -z "$AR"; then
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_AR+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_AR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_AR"; then
   ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test.
 else
@@ -5457,11 +5921,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_AR="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5472,11 +5940,11 @@ fi
 fi
 ac_ct_AR=$ac_cv_prog_ac_ct_AR
 if test -n "$ac_ct_AR"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5
-$as_echo "$ac_ct_AR" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5
+printf "%s\n" "$ac_ct_AR" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5488,8 +5956,8 @@ done
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     AR=$ac_ct_AR
@@ -5497,7 +5965,7 @@ esac
 fi
 
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 
 
 
@@ -5509,30 +5977,32 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5
-$as_echo_n "checking for archiver @FILE support... " >&6; }
-if ${lt_cv_ar_at_file+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5
+printf %s "checking for archiver @FILE support... " >&6; }
+if test ${lt_cv_ar_at_file+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_ar_at_file=no
    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   echo conftest.$ac_objext > conftest.lst
       lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&5'
       { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
   (eval $lt_ar_try) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
       if test 0 -eq "$ac_status"; then
 	# Ensure the archiver fails upon bogus file names.
@@ -5540,7 +6010,7 @@ if ac_fn_c_try_compile "$LINENO"; then :
 	{ { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
   (eval $lt_ar_try) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
 	if test 0 -ne "$ac_status"; then
           lt_cv_ar_at_file=@
@@ -5549,11 +6019,11 @@ if ac_fn_c_try_compile "$LINENO"; then :
       rm -f conftest.* libconftest.a
 
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5
-$as_echo "$lt_cv_ar_at_file" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5
+printf "%s\n" "$lt_cv_ar_at_file" >&6; }
 
 if test no = "$lt_cv_ar_at_file"; then
   archiver_list_spec=
@@ -5570,11 +6040,12 @@ fi
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
 set dummy ${ac_tool_prefix}strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_STRIP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_STRIP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$STRIP"; then
   ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
 else
@@ -5582,11 +6053,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_STRIP="${ac_tool_prefix}strip"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5597,11 +6072,11 @@ fi
 fi
 STRIP=$ac_cv_prog_STRIP
 if test -n "$STRIP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
-$as_echo "$STRIP" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
+printf "%s\n" "$STRIP" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5610,11 +6085,12 @@ if test -z "$ac_cv_prog_STRIP"; then
   ac_ct_STRIP=$STRIP
   # Extract the first word of "strip", so it can be a program name with args.
 set dummy strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_STRIP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_STRIP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_STRIP"; then
   ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
 else
@@ -5622,11 +6098,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_STRIP="strip"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5637,11 +6117,11 @@ fi
 fi
 ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
 if test -n "$ac_ct_STRIP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
-$as_echo "$ac_ct_STRIP" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
+printf "%s\n" "$ac_ct_STRIP" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_STRIP" = x; then
@@ -5649,8 +6129,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     STRIP=$ac_ct_STRIP
@@ -5669,11 +6149,12 @@ test -z "$STRIP" && STRIP=:
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args.
 set dummy ${ac_tool_prefix}ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_RANLIB+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_RANLIB+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$RANLIB"; then
   ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test.
 else
@@ -5681,11 +6162,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5696,11 +6181,11 @@ fi
 fi
 RANLIB=$ac_cv_prog_RANLIB
 if test -n "$RANLIB"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
-$as_echo "$RANLIB" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
+printf "%s\n" "$RANLIB" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5709,11 +6194,12 @@ if test -z "$ac_cv_prog_RANLIB"; then
   ac_ct_RANLIB=$RANLIB
   # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_RANLIB+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_RANLIB+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_RANLIB"; then
   ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test.
 else
@@ -5721,11 +6207,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_RANLIB="ranlib"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5736,11 +6226,11 @@ fi
 fi
 ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB
 if test -n "$ac_ct_RANLIB"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
-$as_echo "$ac_ct_RANLIB" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
+printf "%s\n" "$ac_ct_RANLIB" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_RANLIB" = x; then
@@ -5748,8 +6238,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     RANLIB=$ac_ct_RANLIB
@@ -5813,11 +6303,12 @@ for ac_prog in gawk mawk nawk awk
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_AWK+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_AWK+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$AWK"; then
   ac_cv_prog_AWK="$AWK" # Let the user override the test.
 else
@@ -5825,11 +6316,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_AWK="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -5840,11 +6335,11 @@ fi
 fi
 AWK=$ac_cv_prog_AWK
 if test -n "$AWK"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
-$as_echo "$AWK" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
+printf "%s\n" "$AWK" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -5880,11 +6375,12 @@ compiler=$CC
 
 
 # Check for command to grab the raw symbol name followed by C symbol from nm.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5
-$as_echo_n "checking command to parse $NM output from $compiler object... " >&6; }
-if ${lt_cv_sys_global_symbol_pipe+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5
+printf %s "checking command to parse $NM output from $compiler object... " >&6; }
+if test ${lt_cv_sys_global_symbol_pipe+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 # These are sane defaults that work on at least a few old systems.
 # [They come from Ultrix.  What could be older than Ultrix?!! ;)]
@@ -6036,15 +6532,12 @@ _LT_EOF
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
-  (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&5
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&5 && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -6112,7 +6605,7 @@ _LT_EOF
 	  if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } && test -s conftest$ac_exeext; then
 	    pipe_works=yes
 	  fi
@@ -6147,11 +6640,11 @@ if test -z "$lt_cv_sys_global_symbol_pipe"; then
   lt_cv_sys_global_symbol_to_cdecl=
 fi
 if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5
-$as_echo "ok" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok" >&5
+printf "%s\n" "ok" >&6; }
 fi
 
 # Response file support.
@@ -6197,13 +6690,14 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5
-$as_echo_n "checking for sysroot... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5
+printf %s "checking for sysroot... " >&6; }
 
 # Check whether --with-sysroot was given.
-if test "${with_sysroot+set}" = set; then :
+if test ${with_sysroot+y}
+then :
   withval=$with_sysroot;
-else
+else $as_nop
   with_sysroot=no
 fi
 
@@ -6221,24 +6715,25 @@ case $with_sysroot in #(
  no|'')
    ;; #(
  *)
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5
-$as_echo "$with_sysroot" >&6; }
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5
+printf "%s\n" "$with_sysroot" >&6; }
    as_fn_error $? "The sysroot must be an absolute path." "$LINENO" 5
    ;;
 esac
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5
-$as_echo "${lt_sysroot:-no}" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5
+printf "%s\n" "${lt_sysroot:-no}" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5
-$as_echo_n "checking for a working dd... " >&6; }
-if ${ac_cv_path_lt_DD+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5
+printf %s "checking for a working dd... " >&6; }
+if test ${ac_cv_path_lt_DD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   printf 0123456789abcdef0123456789abcdef >conftest.i
 cat conftest.i conftest.i >conftest2.i
 : ${lt_DD:=$DD}
@@ -6249,10 +6744,15 @@ if test -z "$lt_DD"; then
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_prog in dd; do
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in dd
+   do
     for ac_exec_ext in '' $ac_executable_extensions; do
-      ac_path_lt_DD="$as_dir/$ac_prog$ac_exec_ext"
+      ac_path_lt_DD="$as_dir$ac_prog$ac_exec_ext"
       as_fn_executable_p "$ac_path_lt_DD" || continue
 if "$ac_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
   cmp -s conftest.i conftest.out \
@@ -6272,15 +6772,16 @@ fi
 
 rm -f conftest.i conftest2.i conftest.out
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5
-$as_echo "$ac_cv_path_lt_DD" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5
+printf "%s\n" "$ac_cv_path_lt_DD" >&6; }
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5
-$as_echo_n "checking how to truncate binary pipes... " >&6; }
-if ${lt_cv_truncate_bin+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5
+printf %s "checking how to truncate binary pipes... " >&6; }
+if test ${lt_cv_truncate_bin+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   printf 0123456789abcdef0123456789abcdef >conftest.i
 cat conftest.i conftest.i >conftest2.i
 lt_cv_truncate_bin=
@@ -6291,8 +6792,8 @@ fi
 rm -f conftest.i conftest2.i conftest.out
 test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5
-$as_echo "$lt_cv_truncate_bin" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5
+printf "%s\n" "$lt_cv_truncate_bin" >&6; }
 
 
 
@@ -6315,7 +6816,8 @@ func_cc_basename ()
 }
 
 # Check whether --enable-libtool-lock was given.
-if test "${enable_libtool_lock+set}" = set; then :
+if test ${enable_libtool_lock+y}
+then :
   enableval=$enable_libtool_lock;
 fi
 
@@ -6331,7 +6833,7 @@ ia64-*-hpux*)
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     case `/usr/bin/file conftest.$ac_objext` in
       *ELF-32*)
@@ -6351,7 +6853,7 @@ ia64-*-hpux*)
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     if test yes = "$lt_cv_prog_gnu_ld"; then
       case `/usr/bin/file conftest.$ac_objext` in
@@ -6389,7 +6891,7 @@ mips64*-*linux*)
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     emul=elf
     case `/usr/bin/file conftest.$ac_objext` in
@@ -6430,7 +6932,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     case `/usr/bin/file conftest.o` in
       *32-bit*)
@@ -6493,11 +6995,12 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   # On SCO OpenServer 5, we need -belf to get full-featured binaries.
   SAVE_CFLAGS=$CFLAGS
   CFLAGS="$CFLAGS -belf"
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5
-$as_echo_n "checking whether the C compiler needs -belf... " >&6; }
-if ${lt_cv_cc_needs_belf+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5
+printf %s "checking whether the C compiler needs -belf... " >&6; }
+if test ${lt_cv_cc_needs_belf+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -6508,19 +7011,20 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   lt_cv_cc_needs_belf=yes
-else
+else $as_nop
   lt_cv_cc_needs_belf=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
      ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -6529,8 +7033,8 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5
-$as_echo "$lt_cv_cc_needs_belf" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5
+printf "%s\n" "$lt_cv_cc_needs_belf" >&6; }
   if test yes != "$lt_cv_cc_needs_belf"; then
     # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf
     CFLAGS=$SAVE_CFLAGS
@@ -6543,7 +7047,7 @@ $as_echo "$lt_cv_cc_needs_belf" >&6; }
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     case `/usr/bin/file conftest.o` in
     *64-bit*)
@@ -6580,11 +7084,12 @@ need_locks=$enable_libtool_lock
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}mt", so it can be a program name with args.
 set dummy ${ac_tool_prefix}mt; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_MANIFEST_TOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_MANIFEST_TOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$MANIFEST_TOOL"; then
   ac_cv_prog_MANIFEST_TOOL="$MANIFEST_TOOL" # Let the user override the test.
 else
@@ -6592,11 +7097,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_MANIFEST_TOOL="${ac_tool_prefix}mt"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6607,11 +7116,11 @@ fi
 fi
 MANIFEST_TOOL=$ac_cv_prog_MANIFEST_TOOL
 if test -n "$MANIFEST_TOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5
-$as_echo "$MANIFEST_TOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5
+printf "%s\n" "$MANIFEST_TOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -6620,11 +7129,12 @@ if test -z "$ac_cv_prog_MANIFEST_TOOL"; then
   ac_ct_MANIFEST_TOOL=$MANIFEST_TOOL
   # Extract the first word of "mt", so it can be a program name with args.
 set dummy mt; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_MANIFEST_TOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_MANIFEST_TOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_MANIFEST_TOOL"; then
   ac_cv_prog_ac_ct_MANIFEST_TOOL="$ac_ct_MANIFEST_TOOL" # Let the user override the test.
 else
@@ -6632,11 +7142,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_MANIFEST_TOOL="mt"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6647,11 +7161,11 @@ fi
 fi
 ac_ct_MANIFEST_TOOL=$ac_cv_prog_ac_ct_MANIFEST_TOOL
 if test -n "$ac_ct_MANIFEST_TOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5
-$as_echo "$ac_ct_MANIFEST_TOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5
+printf "%s\n" "$ac_ct_MANIFEST_TOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_MANIFEST_TOOL" = x; then
@@ -6659,8 +7173,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     MANIFEST_TOOL=$ac_ct_MANIFEST_TOOL
@@ -6670,11 +7184,12 @@ else
 fi
 
 test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5
-$as_echo_n "checking if $MANIFEST_TOOL is a manifest tool... " >&6; }
-if ${lt_cv_path_mainfest_tool+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5
+printf %s "checking if $MANIFEST_TOOL is a manifest tool... " >&6; }
+if test ${lt_cv_path_mainfest_tool+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_path_mainfest_tool=no
   echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&5
   $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out
@@ -6684,8 +7199,8 @@ else
   fi
   rm -f conftest*
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5
-$as_echo "$lt_cv_path_mainfest_tool" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5
+printf "%s\n" "$lt_cv_path_mainfest_tool" >&6; }
 if test yes != "$lt_cv_path_mainfest_tool"; then
   MANIFEST_TOOL=:
 fi
@@ -6700,11 +7215,12 @@ fi
     if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}dsymutil", so it can be a program name with args.
 set dummy ${ac_tool_prefix}dsymutil; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DSYMUTIL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DSYMUTIL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$DSYMUTIL"; then
   ac_cv_prog_DSYMUTIL="$DSYMUTIL" # Let the user override the test.
 else
@@ -6712,11 +7228,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_DSYMUTIL="${ac_tool_prefix}dsymutil"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6727,11 +7247,11 @@ fi
 fi
 DSYMUTIL=$ac_cv_prog_DSYMUTIL
 if test -n "$DSYMUTIL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5
-$as_echo "$DSYMUTIL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5
+printf "%s\n" "$DSYMUTIL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -6740,11 +7260,12 @@ if test -z "$ac_cv_prog_DSYMUTIL"; then
   ac_ct_DSYMUTIL=$DSYMUTIL
   # Extract the first word of "dsymutil", so it can be a program name with args.
 set dummy dsymutil; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DSYMUTIL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DSYMUTIL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_DSYMUTIL"; then
   ac_cv_prog_ac_ct_DSYMUTIL="$ac_ct_DSYMUTIL" # Let the user override the test.
 else
@@ -6752,11 +7273,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_DSYMUTIL="dsymutil"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6767,11 +7292,11 @@ fi
 fi
 ac_ct_DSYMUTIL=$ac_cv_prog_ac_ct_DSYMUTIL
 if test -n "$ac_ct_DSYMUTIL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5
-$as_echo "$ac_ct_DSYMUTIL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5
+printf "%s\n" "$ac_ct_DSYMUTIL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_DSYMUTIL" = x; then
@@ -6779,8 +7304,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     DSYMUTIL=$ac_ct_DSYMUTIL
@@ -6792,11 +7317,12 @@ fi
     if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}nmedit", so it can be a program name with args.
 set dummy ${ac_tool_prefix}nmedit; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_NMEDIT+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_NMEDIT+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$NMEDIT"; then
   ac_cv_prog_NMEDIT="$NMEDIT" # Let the user override the test.
 else
@@ -6804,11 +7330,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_NMEDIT="${ac_tool_prefix}nmedit"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6819,11 +7349,11 @@ fi
 fi
 NMEDIT=$ac_cv_prog_NMEDIT
 if test -n "$NMEDIT"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5
-$as_echo "$NMEDIT" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5
+printf "%s\n" "$NMEDIT" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -6832,11 +7362,12 @@ if test -z "$ac_cv_prog_NMEDIT"; then
   ac_ct_NMEDIT=$NMEDIT
   # Extract the first word of "nmedit", so it can be a program name with args.
 set dummy nmedit; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_NMEDIT+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_NMEDIT+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_NMEDIT"; then
   ac_cv_prog_ac_ct_NMEDIT="$ac_ct_NMEDIT" # Let the user override the test.
 else
@@ -6844,11 +7375,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_NMEDIT="nmedit"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6859,11 +7394,11 @@ fi
 fi
 ac_ct_NMEDIT=$ac_cv_prog_ac_ct_NMEDIT
 if test -n "$ac_ct_NMEDIT"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5
-$as_echo "$ac_ct_NMEDIT" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5
+printf "%s\n" "$ac_ct_NMEDIT" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_NMEDIT" = x; then
@@ -6871,8 +7406,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     NMEDIT=$ac_ct_NMEDIT
@@ -6884,11 +7419,12 @@ fi
     if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}lipo", so it can be a program name with args.
 set dummy ${ac_tool_prefix}lipo; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_LIPO+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_LIPO+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$LIPO"; then
   ac_cv_prog_LIPO="$LIPO" # Let the user override the test.
 else
@@ -6896,11 +7432,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_LIPO="${ac_tool_prefix}lipo"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6911,11 +7451,11 @@ fi
 fi
 LIPO=$ac_cv_prog_LIPO
 if test -n "$LIPO"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5
-$as_echo "$LIPO" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5
+printf "%s\n" "$LIPO" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -6924,11 +7464,12 @@ if test -z "$ac_cv_prog_LIPO"; then
   ac_ct_LIPO=$LIPO
   # Extract the first word of "lipo", so it can be a program name with args.
 set dummy lipo; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_LIPO+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_LIPO+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_LIPO"; then
   ac_cv_prog_ac_ct_LIPO="$ac_ct_LIPO" # Let the user override the test.
 else
@@ -6936,11 +7477,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_LIPO="lipo"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -6951,11 +7496,11 @@ fi
 fi
 ac_ct_LIPO=$ac_cv_prog_ac_ct_LIPO
 if test -n "$ac_ct_LIPO"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5
-$as_echo "$ac_ct_LIPO" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5
+printf "%s\n" "$ac_ct_LIPO" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_LIPO" = x; then
@@ -6963,8 +7508,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     LIPO=$ac_ct_LIPO
@@ -6976,11 +7521,12 @@ fi
     if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}otool", so it can be a program name with args.
 set dummy ${ac_tool_prefix}otool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OTOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OTOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$OTOOL"; then
   ac_cv_prog_OTOOL="$OTOOL" # Let the user override the test.
 else
@@ -6988,11 +7534,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_OTOOL="${ac_tool_prefix}otool"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -7003,11 +7553,11 @@ fi
 fi
 OTOOL=$ac_cv_prog_OTOOL
 if test -n "$OTOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5
-$as_echo "$OTOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5
+printf "%s\n" "$OTOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7016,11 +7566,12 @@ if test -z "$ac_cv_prog_OTOOL"; then
   ac_ct_OTOOL=$OTOOL
   # Extract the first word of "otool", so it can be a program name with args.
 set dummy otool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OTOOL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OTOOL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_OTOOL"; then
   ac_cv_prog_ac_ct_OTOOL="$ac_ct_OTOOL" # Let the user override the test.
 else
@@ -7028,11 +7579,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_OTOOL="otool"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -7043,11 +7598,11 @@ fi
 fi
 ac_ct_OTOOL=$ac_cv_prog_ac_ct_OTOOL
 if test -n "$ac_ct_OTOOL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5
-$as_echo "$ac_ct_OTOOL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5
+printf "%s\n" "$ac_ct_OTOOL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_OTOOL" = x; then
@@ -7055,8 +7610,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     OTOOL=$ac_ct_OTOOL
@@ -7068,11 +7623,12 @@ fi
     if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}otool64", so it can be a program name with args.
 set dummy ${ac_tool_prefix}otool64; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OTOOL64+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OTOOL64+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$OTOOL64"; then
   ac_cv_prog_OTOOL64="$OTOOL64" # Let the user override the test.
 else
@@ -7080,11 +7636,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_OTOOL64="${ac_tool_prefix}otool64"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -7095,11 +7655,11 @@ fi
 fi
 OTOOL64=$ac_cv_prog_OTOOL64
 if test -n "$OTOOL64"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5
-$as_echo "$OTOOL64" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5
+printf "%s\n" "$OTOOL64" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7108,11 +7668,12 @@ if test -z "$ac_cv_prog_OTOOL64"; then
   ac_ct_OTOOL64=$OTOOL64
   # Extract the first word of "otool64", so it can be a program name with args.
 set dummy otool64; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OTOOL64+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OTOOL64+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_OTOOL64"; then
   ac_cv_prog_ac_ct_OTOOL64="$ac_ct_OTOOL64" # Let the user override the test.
 else
@@ -7120,11 +7681,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_OTOOL64="otool64"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -7135,11 +7700,11 @@ fi
 fi
 ac_ct_OTOOL64=$ac_cv_prog_ac_ct_OTOOL64
 if test -n "$ac_ct_OTOOL64"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5
-$as_echo "$ac_ct_OTOOL64" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5
+printf "%s\n" "$ac_ct_OTOOL64" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_OTOOL64" = x; then
@@ -7147,8 +7712,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     OTOOL64=$ac_ct_OTOOL64
@@ -7183,11 +7748,12 @@ fi
 
 
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5
-$as_echo_n "checking for -single_module linker flag... " >&6; }
-if ${lt_cv_apple_cc_single_mod+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5
+printf %s "checking for -single_module linker flag... " >&6; }
+if test ${lt_cv_apple_cc_single_mod+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_apple_cc_single_mod=no
       if test -z "$LT_MULTI_MODULE"; then
 	# By default we will add the -single_module flag. You can override
@@ -7216,14 +7782,15 @@ else
 	rm -f conftest.*
       fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5
-$as_echo "$lt_cv_apple_cc_single_mod" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5
+printf "%s\n" "$lt_cv_apple_cc_single_mod" >&6; }
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5
-$as_echo_n "checking for -exported_symbols_list linker flag... " >&6; }
-if ${lt_cv_ld_exported_symbols_list+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5
+printf %s "checking for -exported_symbols_list linker flag... " >&6; }
+if test ${lt_cv_ld_exported_symbols_list+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_ld_exported_symbols_list=no
       save_LDFLAGS=$LDFLAGS
       echo "_main" > conftest.sym
@@ -7232,39 +7799,41 @@ else
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   lt_cv_ld_exported_symbols_list=yes
-else
+else $as_nop
   lt_cv_ld_exported_symbols_list=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 	LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5
-$as_echo "$lt_cv_ld_exported_symbols_list" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5
+printf "%s\n" "$lt_cv_ld_exported_symbols_list" >&6; }
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5
-$as_echo_n "checking for -force_load linker flag... " >&6; }
-if ${lt_cv_ld_force_load+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5
+printf %s "checking for -force_load linker flag... " >&6; }
+if test ${lt_cv_ld_force_load+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_ld_force_load=no
       cat > conftest.c << _LT_EOF
 int forced_loaded() { return 2;}
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
-      echo "$AR cru libconftest.a conftest.o" >&5
-      $AR cru libconftest.a conftest.o 2>&5
+      echo "$AR cr libconftest.a conftest.o" >&5
+      $AR cr libconftest.a conftest.o 2>&5
       echo "$RANLIB libconftest.a" >&5
       $RANLIB libconftest.a 2>&5
       cat > conftest.c << _LT_EOF
@@ -7284,8 +7853,8 @@ _LT_EOF
         rm -rf conftest.dSYM
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5
-$as_echo "$lt_cv_ld_force_load" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5
+printf "%s\n" "$lt_cv_ld_force_load" >&6; }
     case $host_os in
     rhapsody* | darwin1.[012])
       _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
@@ -7296,11 +7865,11 @@ $as_echo "$lt_cv_ld_force_load" >&6; }
       # to the OS version, if on x86, and 10.4, the deployment
       # target defaults to 10.4. Don't you love it?
       case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[91]*)
+	10.0,*86*-darwin8*|10.0,*-darwin[912]*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 	10.[012][,.]*)
 	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
+	10.*|11.*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
@@ -7356,19 +7925,14 @@ func_munge_path_list ()
     esac
 }
 
-for ac_header in dlfcn.h
-do :
-  ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default
 "
-if test "x$ac_cv_header_dlfcn_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_DLFCN_H 1
-_ACEOF
+if test "x$ac_cv_header_dlfcn_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_DLFCN_H 1" >>confdefs.h
 
 fi
 
-done
-
 
 
 
@@ -7384,7 +7948,8 @@ done
 
 
             # Check whether --enable-shared was given.
-if test "${enable_shared+set}" = set; then :
+if test ${enable_shared+y}
+then :
   enableval=$enable_shared; p=${PACKAGE-default}
     case $enableval in
     yes) enable_shared=yes ;;
@@ -7402,7 +7967,7 @@ if test "${enable_shared+set}" = set; then :
       IFS=$lt_save_ifs
       ;;
     esac
-else
+else $as_nop
   enable_shared=yes
 fi
 
@@ -7415,7 +7980,8 @@ fi
 
 
   # Check whether --enable-static was given.
-if test "${enable_static+set}" = set; then :
+if test ${enable_static+y}
+then :
   enableval=$enable_static; p=${PACKAGE-default}
     case $enableval in
     yes) enable_static=yes ;;
@@ -7433,7 +7999,7 @@ if test "${enable_static+set}" = set; then :
       IFS=$lt_save_ifs
       ;;
     esac
-else
+else $as_nop
   enable_static=yes
 fi
 
@@ -7447,7 +8013,8 @@ fi
 
 
 # Check whether --with-pic was given.
-if test "${with_pic+set}" = set; then :
+if test ${with_pic+y}
+then :
   withval=$with_pic; lt_p=${PACKAGE-default}
     case $withval in
     yes|no) pic_mode=$withval ;;
@@ -7464,7 +8031,7 @@ if test "${with_pic+set}" = set; then :
       IFS=$lt_save_ifs
       ;;
     esac
-else
+else $as_nop
   pic_mode=default
 fi
 
@@ -7476,7 +8043,8 @@ fi
 
 
   # Check whether --enable-fast-install was given.
-if test "${enable_fast_install+set}" = set; then :
+if test ${enable_fast_install+y}
+then :
   enableval=$enable_fast_install; p=${PACKAGE-default}
     case $enableval in
     yes) enable_fast_install=yes ;;
@@ -7494,7 +8062,7 @@ if test "${enable_fast_install+set}" = set; then :
       IFS=$lt_save_ifs
       ;;
     esac
-else
+else $as_nop
   enable_fast_install=yes
 fi
 
@@ -7508,11 +8076,12 @@ fi
   shared_archive_member_spec=
 case $host,$enable_shared in
 power*-*-aix[5-9]*,yes)
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5
-$as_echo_n "checking which variant of shared library versioning to provide... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5
+printf %s "checking which variant of shared library versioning to provide... " >&6; }
 
 # Check whether --with-aix-soname was given.
-if test "${with_aix_soname+set}" = set; then :
+if test ${with_aix_soname+y}
+then :
   withval=$with_aix_soname; case $withval in
     aix|svr4|both)
       ;;
@@ -7521,18 +8090,19 @@ if test "${with_aix_soname+set}" = set; then :
       ;;
     esac
     lt_cv_with_aix_soname=$with_aix_soname
-else
-  if ${lt_cv_with_aix_soname+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+else $as_nop
+  if test ${lt_cv_with_aix_soname+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_with_aix_soname=aix
 fi
 
     with_aix_soname=$lt_cv_with_aix_soname
 fi
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5
-$as_echo "$with_aix_soname" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5
+printf "%s\n" "$with_aix_soname" >&6; }
   if test aix != "$with_aix_soname"; then
     # For the AIX way of multilib, we name the shared archive member
     # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o',
@@ -7614,11 +8184,12 @@ if test -n "${ZSH_VERSION+set}"; then
    setopt NO_GLOB_SUBST
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5
-$as_echo_n "checking for objdir... " >&6; }
-if ${lt_cv_objdir+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5
+printf %s "checking for objdir... " >&6; }
+if test ${lt_cv_objdir+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   rm -f .libs 2>/dev/null
 mkdir .libs 2>/dev/null
 if test -d .libs; then
@@ -7629,17 +8200,15 @@ else
 fi
 rmdir .libs 2>/dev/null
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5
-$as_echo "$lt_cv_objdir" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5
+printf "%s\n" "$lt_cv_objdir" >&6; }
 objdir=$lt_cv_objdir
 
 
 
 
 
-cat >>confdefs.h <<_ACEOF
-#define LT_OBJDIR "$lt_cv_objdir/"
-_ACEOF
+printf "%s\n" "#define LT_OBJDIR \"$lt_cv_objdir/\"" >>confdefs.h
 
 
 
@@ -7685,11 +8254,12 @@ test -z "$MAGIC_CMD" && MAGIC_CMD=file
 case $deplibs_check_method in
 file_magic*)
   if test "$file_magic_cmd" = '$MAGIC_CMD'; then
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5
-$as_echo_n "checking for ${ac_tool_prefix}file... " >&6; }
-if ${lt_cv_path_MAGIC_CMD+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5
+printf %s "checking for ${ac_tool_prefix}file... " >&6; }
+if test ${lt_cv_path_MAGIC_CMD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $MAGIC_CMD in
 [\\/*] |  ?:[\\/]*)
   lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
@@ -7738,11 +8308,11 @@ fi
 
 MAGIC_CMD=$lt_cv_path_MAGIC_CMD
 if test -n "$MAGIC_CMD"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
-$as_echo "$MAGIC_CMD" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
+printf "%s\n" "$MAGIC_CMD" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7751,11 +8321,12 @@ fi
 
 if test -z "$lt_cv_path_MAGIC_CMD"; then
   if test -n "$ac_tool_prefix"; then
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for file" >&5
-$as_echo_n "checking for file... " >&6; }
-if ${lt_cv_path_MAGIC_CMD+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for file" >&5
+printf %s "checking for file... " >&6; }
+if test ${lt_cv_path_MAGIC_CMD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $MAGIC_CMD in
 [\\/*] |  ?:[\\/]*)
   lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
@@ -7804,11 +8375,11 @@ fi
 
 MAGIC_CMD=$lt_cv_path_MAGIC_CMD
 if test -n "$MAGIC_CMD"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
-$as_echo "$MAGIC_CMD" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
+printf "%s\n" "$MAGIC_CMD" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7893,11 +8464,12 @@ if test yes = "$GCC"; then
     lt_prog_compiler_no_builtin_flag=' -fno-builtin' ;;
   esac
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
-$as_echo_n "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; }
-if ${lt_cv_prog_compiler_rtti_exceptions+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
+printf %s "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; }
+if test ${lt_cv_prog_compiler_rtti_exceptions+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_rtti_exceptions=no
    ac_outfile=conftest.$ac_objext
    echo "$lt_simple_compile_test_code" > conftest.$ac_ext
@@ -7928,8 +8500,8 @@ else
    $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5
-$as_echo "$lt_cv_prog_compiler_rtti_exceptions" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5
+printf "%s\n" "$lt_cv_prog_compiler_rtti_exceptions" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_rtti_exceptions"; then
     lt_prog_compiler_no_builtin_flag="$lt_prog_compiler_no_builtin_flag -fno-rtti -fno-exceptions"
@@ -8126,6 +8698,12 @@ lt_prog_compiler_static=
 	lt_prog_compiler_pic='-KPIC'
 	lt_prog_compiler_static='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	lt_prog_compiler_wl='-Wl,'
+	lt_prog_compiler_pic='-fPIC'
+	lt_prog_compiler_static='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -8286,26 +8864,28 @@ case $host_os in
     ;;
 esac
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5
-$as_echo_n "checking for $compiler option to produce PIC... " >&6; }
-if ${lt_cv_prog_compiler_pic+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5
+printf %s "checking for $compiler option to produce PIC... " >&6; }
+if test ${lt_cv_prog_compiler_pic+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_pic=$lt_prog_compiler_pic
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5
-$as_echo "$lt_cv_prog_compiler_pic" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5
+printf "%s\n" "$lt_cv_prog_compiler_pic" >&6; }
 lt_prog_compiler_pic=$lt_cv_prog_compiler_pic
 
 #
 # Check to make sure the PIC flag actually works.
 #
 if test -n "$lt_prog_compiler_pic"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5
-$as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; }
-if ${lt_cv_prog_compiler_pic_works+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5
+printf %s "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; }
+if test ${lt_cv_prog_compiler_pic_works+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_pic_works=no
    ac_outfile=conftest.$ac_objext
    echo "$lt_simple_compile_test_code" > conftest.$ac_ext
@@ -8336,8 +8916,8 @@ else
    $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5
-$as_echo "$lt_cv_prog_compiler_pic_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5
+printf "%s\n" "$lt_cv_prog_compiler_pic_works" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_pic_works"; then
     case $lt_prog_compiler_pic in
@@ -8365,11 +8945,12 @@ fi
 # Check to make sure the static flag actually works.
 #
 wl=$lt_prog_compiler_wl eval lt_tmp_static_flag=\"$lt_prog_compiler_static\"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5
-$as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; }
-if ${lt_cv_prog_compiler_static_works+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5
+printf %s "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; }
+if test ${lt_cv_prog_compiler_static_works+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_static_works=no
    save_LDFLAGS=$LDFLAGS
    LDFLAGS="$LDFLAGS $lt_tmp_static_flag"
@@ -8393,8 +8974,8 @@ else
    LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5
-$as_echo "$lt_cv_prog_compiler_static_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5
+printf "%s\n" "$lt_cv_prog_compiler_static_works" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_static_works"; then
     :
@@ -8408,11 +8989,12 @@ fi
 
 
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
-$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
-if ${lt_cv_prog_compiler_c_o+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
+printf %s "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
+if test ${lt_cv_prog_compiler_c_o+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_c_o=no
    $RM -r conftest 2>/dev/null
    mkdir conftest
@@ -8455,19 +9037,20 @@ else
    $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
-$as_echo "$lt_cv_prog_compiler_c_o" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
+printf "%s\n" "$lt_cv_prog_compiler_c_o" >&6; }
 
 
 
 
 
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
-$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
-if ${lt_cv_prog_compiler_c_o+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
+printf %s "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
+if test ${lt_cv_prog_compiler_c_o+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler_c_o=no
    $RM -r conftest 2>/dev/null
    mkdir conftest
@@ -8510,8 +9093,8 @@ else
    $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
-$as_echo "$lt_cv_prog_compiler_c_o" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
+printf "%s\n" "$lt_cv_prog_compiler_c_o" >&6; }
 
 
 
@@ -8519,19 +9102,19 @@ $as_echo "$lt_cv_prog_compiler_c_o" >&6; }
 hard_links=nottested
 if test no = "$lt_cv_prog_compiler_c_o" && test no != "$need_locks"; then
   # do not overwrite the value of need_locks provided by the user
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5
-$as_echo_n "checking if we can lock with hard links... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5
+printf %s "checking if we can lock with hard links... " >&6; }
   hard_links=yes
   $RM conftest*
   ln conftest.a conftest.b 2>/dev/null && hard_links=no
   touch conftest.a
   ln conftest.a conftest.b 2>&5 || hard_links=no
   ln conftest.a conftest.b 2>/dev/null && hard_links=no
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5
-$as_echo "$hard_links" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5
+printf "%s\n" "$hard_links" >&6; }
   if test no = "$hard_links"; then
-    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5
-$as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;}
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5
+printf "%s\n" "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;}
     need_locks=warn
   fi
 else
@@ -8543,8 +9126,8 @@ fi
 
 
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5
-$as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5
+printf %s "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; }
 
   runpath_var=
   allow_undefined_flag=
@@ -9102,21 +9685,23 @@ _LT_EOF
         if test set = "${lt_cv_aix_libpath+set}"; then
   aix_libpath=$lt_cv_aix_libpath
 else
-  if ${lt_cv_aix_libpath_+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  if test ${lt_cv_aix_libpath_+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
   lt_aix_libpath_sed='
       /Import File Strings/,/^$/ {
@@ -9131,7 +9716,7 @@ if ac_fn_c_try_link "$LINENO"; then :
     lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"`
   fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
   if test -z "$lt_cv_aix_libpath_"; then
     lt_cv_aix_libpath_=/usr/lib:/lib
@@ -9155,21 +9740,23 @@ fi
 	 if test set = "${lt_cv_aix_libpath+set}"; then
   aix_libpath=$lt_cv_aix_libpath
 else
-  if ${lt_cv_aix_libpath_+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  if test ${lt_cv_aix_libpath_+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
   lt_aix_libpath_sed='
       /Import File Strings/,/^$/ {
@@ -9184,7 +9771,7 @@ if ac_fn_c_try_link "$LINENO"; then :
     lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"`
   fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
   if test -z "$lt_cv_aix_libpath_"; then
     lt_cv_aix_libpath_=/usr/lib:/lib
@@ -9435,11 +10022,12 @@ fi
 
 	  # Older versions of the 11.00 compiler do not understand -b yet
 	  # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does)
-	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5
-$as_echo_n "checking if $CC understands -b... " >&6; }
-if ${lt_cv_prog_compiler__b+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+	  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5
+printf %s "checking if $CC understands -b... " >&6; }
+if test ${lt_cv_prog_compiler__b+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_prog_compiler__b=no
    save_LDFLAGS=$LDFLAGS
    LDFLAGS="$LDFLAGS -b"
@@ -9463,8 +10051,8 @@ else
    LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5
-$as_echo "$lt_cv_prog_compiler__b" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5
+printf "%s\n" "$lt_cv_prog_compiler__b" >&6; }
 
 if test yes = "$lt_cv_prog_compiler__b"; then
     archive_cmds='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
@@ -9504,28 +10092,30 @@ fi
 	# work, assume that -exports_file does not work either and
 	# implicitly export all symbols.
 	# This should be the same for all languages, so no per-tag cache variable.
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5
-$as_echo_n "checking whether the $host_os linker accepts -exported_symbol... " >&6; }
-if ${lt_cv_irix_exported_symbol+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5
+printf %s "checking whether the $host_os linker accepts -exported_symbol... " >&6; }
+if test ${lt_cv_irix_exported_symbol+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   save_LDFLAGS=$LDFLAGS
 	   LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null"
 	   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 int foo (void) { return 0; }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   lt_cv_irix_exported_symbol=yes
-else
+else $as_nop
   lt_cv_irix_exported_symbol=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
            LDFLAGS=$save_LDFLAGS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5
-$as_echo "$lt_cv_irix_exported_symbol" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5
+printf "%s\n" "$lt_cv_irix_exported_symbol" >&6; }
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
@@ -9806,8 +10396,8 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
     fi
   fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5
-$as_echo "$ld_shlibs" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5
+printf "%s\n" "$ld_shlibs" >&6; }
 test no = "$ld_shlibs" && can_build_shared=no
 
 with_gnu_ld=$with_gnu_ld
@@ -9843,18 +10433,19 @@ x|xyes)
       # Test whether the compiler implicitly links with -lc since on some
       # systems, -lgcc has to come before -lc. If gcc already passes -lc
       # to ld, don't add -lc before -lgcc.
-      { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5
-$as_echo_n "checking whether -lc should be explicitly linked in... " >&6; }
-if ${lt_cv_archive_cmds_need_lc+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5
+printf %s "checking whether -lc should be explicitly linked in... " >&6; }
+if test ${lt_cv_archive_cmds_need_lc+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   $RM conftest*
 	echo "$lt_simple_compile_test_code" > conftest.$ac_ext
 
 	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } 2>conftest.err; then
 	  soname=conftest
 	  lib=conftest
@@ -9872,7 +10463,7 @@ else
 	  if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5
   (eval $archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
 	  then
 	    lt_cv_archive_cmds_need_lc=no
@@ -9886,8 +10477,8 @@ else
 	$RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5
-$as_echo "$lt_cv_archive_cmds_need_lc" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5
+printf "%s\n" "$lt_cv_archive_cmds_need_lc" >&6; }
       archive_cmds_need_lc=$lt_cv_archive_cmds_need_lc
       ;;
     esac
@@ -10046,8 +10637,8 @@ esac
 
 
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5
-$as_echo_n "checking dynamic linker characteristics... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5
+printf %s "checking dynamic linker characteristics... " >&6; }
 
 if test yes = "$GCC"; then
   case $host_os in
@@ -10608,9 +11199,10 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   shlibpath_overrides_runpath=no
 
   # Some binutils ld are patched to set DT_RUNPATH
-  if ${lt_cv_shlibpath_overrides_runpath+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  if test ${lt_cv_shlibpath_overrides_runpath+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   lt_cv_shlibpath_overrides_runpath=no
     save_LDFLAGS=$LDFLAGS
     save_libdir=$libdir
@@ -10620,19 +11212,21 @@ else
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  if  ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null; then :
+if ac_fn_c_try_link "$LINENO"
+then :
+  if  ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null
+then :
   lt_cv_shlibpath_overrides_runpath=yes
 fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
     LDFLAGS=$save_LDFLAGS
     libdir=$save_libdir
@@ -10876,8 +11470,8 @@ uts4*)
   dynamic_linker=no
   ;;
 esac
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5
-$as_echo "$dynamic_linker" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5
+printf "%s\n" "$dynamic_linker" >&6; }
 test no = "$dynamic_linker" && can_build_shared=no
 
 variables_saved_for_relink="PATH $shlibpath_var $runpath_var"
@@ -10998,8 +11592,8 @@ configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH
 
 
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5
-$as_echo_n "checking how to hardcode library paths into programs... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5
+printf %s "checking how to hardcode library paths into programs... " >&6; }
 hardcode_action=
 if test -n "$hardcode_libdir_flag_spec" ||
    test -n "$runpath_var" ||
@@ -11023,8 +11617,8 @@ else
   # directories.
   hardcode_action=unsupported
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5
-$as_echo "$hardcode_action" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5
+printf "%s\n" "$hardcode_action" >&6; }
 
 if test relink = "$hardcode_action" ||
    test yes = "$inherit_rpath"; then
@@ -11068,11 +11662,12 @@ else
 
   darwin*)
     # if libdl is installed we need to link against it
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
+printf %s "checking for dlopen in -ldl... " >&6; }
+if test ${ac_cv_lib_dl_dlopen+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldl  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11081,32 +11676,31 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_dl_dlopen=yes
-else
+else $as_nop
   ac_cv_lib_dl_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_dl_dlopen" >&6; }
+if test "x$ac_cv_lib_dl_dlopen" = xyes
+then :
   lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
-else
+else $as_nop
 
     lt_cv_dlopen=dyld
     lt_cv_dlopen_libs=
@@ -11126,14 +11720,16 @@ fi
 
   *)
     ac_fn_c_check_func "$LINENO" "shl_load" "ac_cv_func_shl_load"
-if test "x$ac_cv_func_shl_load" = xyes; then :
+if test "x$ac_cv_func_shl_load" = xyes
+then :
   lt_cv_dlopen=shl_load
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5
-$as_echo_n "checking for shl_load in -ldld... " >&6; }
-if ${ac_cv_lib_dld_shl_load+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5
+printf %s "checking for shl_load in -ldld... " >&6; }
+if test ${ac_cv_lib_dld_shl_load+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldld  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11142,41 +11738,42 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char shl_load ();
 int
-main ()
+main (void)
 {
 return shl_load ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_dld_shl_load=yes
-else
+else $as_nop
   ac_cv_lib_dld_shl_load=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5
-$as_echo "$ac_cv_lib_dld_shl_load" >&6; }
-if test "x$ac_cv_lib_dld_shl_load" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5
+printf "%s\n" "$ac_cv_lib_dld_shl_load" >&6; }
+if test "x$ac_cv_lib_dld_shl_load" = xyes
+then :
   lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld
-else
+else $as_nop
   ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen"
-if test "x$ac_cv_func_dlopen" = xyes; then :
+if test "x$ac_cv_func_dlopen" = xyes
+then :
   lt_cv_dlopen=dlopen
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
+printf %s "checking for dlopen in -ldl... " >&6; }
+if test ${ac_cv_lib_dl_dlopen+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldl  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11185,37 +11782,37 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_dl_dlopen=yes
-else
+else $as_nop
   ac_cv_lib_dl_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_dl_dlopen" >&6; }
+if test "x$ac_cv_lib_dl_dlopen" = xyes
+then :
   lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5
-$as_echo_n "checking for dlopen in -lsvld... " >&6; }
-if ${ac_cv_lib_svld_dlopen+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5
+printf %s "checking for dlopen in -lsvld... " >&6; }
+if test ${ac_cv_lib_svld_dlopen+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lsvld  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11224,37 +11821,37 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_svld_dlopen=yes
-else
+else $as_nop
   ac_cv_lib_svld_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5
-$as_echo "$ac_cv_lib_svld_dlopen" >&6; }
-if test "x$ac_cv_lib_svld_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_svld_dlopen" >&6; }
+if test "x$ac_cv_lib_svld_dlopen" = xyes
+then :
   lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5
-$as_echo_n "checking for dld_link in -ldld... " >&6; }
-if ${ac_cv_lib_dld_dld_link+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5
+printf %s "checking for dld_link in -ldld... " >&6; }
+if test ${ac_cv_lib_dld_dld_link+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldld  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11263,30 +11860,29 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dld_link ();
 int
-main ()
+main (void)
 {
 return dld_link ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_dld_dld_link=yes
-else
+else $as_nop
   ac_cv_lib_dld_dld_link=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5
-$as_echo "$ac_cv_lib_dld_dld_link" >&6; }
-if test "x$ac_cv_lib_dld_dld_link" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5
+printf "%s\n" "$ac_cv_lib_dld_dld_link" >&6; }
+if test "x$ac_cv_lib_dld_dld_link" = xyes
+then :
   lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld
 fi
 
@@ -11325,11 +11921,12 @@ fi
     save_LIBS=$LIBS
     LIBS="$lt_cv_dlopen_libs $LIBS"
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5
-$as_echo_n "checking whether a program can dlopen itself... " >&6; }
-if ${lt_cv_dlopen_self+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5
+printf %s "checking whether a program can dlopen itself... " >&6; }
+if test ${lt_cv_dlopen_self+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   	  if test yes = "$cross_compiling"; then :
   lt_cv_dlopen_self=cross
 else
@@ -11408,7 +12005,7 @@ _LT_EOF
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
     (./conftest; exit; ) >&5 2>/dev/null
     lt_status=$?
@@ -11426,16 +12023,17 @@ rm -fr conftest*
 
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5
-$as_echo "$lt_cv_dlopen_self" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5
+printf "%s\n" "$lt_cv_dlopen_self" >&6; }
 
     if test yes = "$lt_cv_dlopen_self"; then
       wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\"
-      { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5
-$as_echo_n "checking whether a statically linked program can dlopen itself... " >&6; }
-if ${lt_cv_dlopen_self_static+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5
+printf %s "checking whether a statically linked program can dlopen itself... " >&6; }
+if test ${lt_cv_dlopen_self_static+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   	  if test yes = "$cross_compiling"; then :
   lt_cv_dlopen_self_static=cross
 else
@@ -11514,7 +12112,7 @@ _LT_EOF
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
     (./conftest; exit; ) >&5 2>/dev/null
     lt_status=$?
@@ -11532,8 +12130,8 @@ rm -fr conftest*
 
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5
-$as_echo "$lt_cv_dlopen_self_static" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5
+printf "%s\n" "$lt_cv_dlopen_self_static" >&6; }
     fi
 
     CPPFLAGS=$save_CPPFLAGS
@@ -11571,13 +12169,13 @@ fi
 
 striplib=
 old_striplib=
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
-$as_echo_n "checking whether stripping libraries is possible... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
+printf %s "checking whether stripping libraries is possible... " >&6; }
 if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
   test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
   test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 else
 # FIXME - insert some real tests, host_os isn't really good enough
   case $host_os in
@@ -11585,16 +12183,16 @@ else
     if test -n "$STRIP"; then
       striplib="$STRIP -x"
       old_striplib="$STRIP -S"
-      { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
     else
-      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
     fi
     ;;
   *)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
     ;;
   esac
 fi
@@ -11611,13 +12209,13 @@ fi
 
 
   # Report what library types will actually be built
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5
-$as_echo_n "checking if libtool supports shared libraries... " >&6; }
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5
-$as_echo "$can_build_shared" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5
+printf %s "checking if libtool supports shared libraries... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5
+printf "%s\n" "$can_build_shared" >&6; }
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5
-$as_echo_n "checking whether to build shared libraries... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5
+printf %s "checking whether to build shared libraries... " >&6; }
   test no = "$can_build_shared" && enable_shared=no
 
   # On AIX, shared libraries and static libraries use the same namespace, and
@@ -11641,15 +12239,15 @@ $as_echo_n "checking whether to build shared libraries... " >&6; }
     fi
     ;;
   esac
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5
-$as_echo "$enable_shared" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5
+printf "%s\n" "$enable_shared" >&6; }
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5
-$as_echo_n "checking whether to build static libraries... " >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5
+printf %s "checking whether to build static libraries... " >&6; }
   # Make sure either enable_shared or enable_static is yes.
   test yes = "$enable_shared" || enable_static=yes
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5
-$as_echo "$enable_static" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5
+printf "%s\n" "$enable_static" >&6; }
 
 
 
@@ -11700,11 +12298,12 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
 set dummy ${ac_tool_prefix}gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -11712,11 +12311,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="${ac_tool_prefix}gcc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11727,11 +12330,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11740,11 +12343,12 @@ if test -z "$ac_cv_prog_CC"; then
   ac_ct_CC=$CC
   # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_CC"; then
   ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
 else
@@ -11752,11 +12356,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_CC="gcc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11767,11 +12375,11 @@ fi
 fi
 ac_ct_CC=$ac_cv_prog_ac_ct_CC
 if test -n "$ac_ct_CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_CC" = x; then
@@ -11779,8 +12387,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     CC=$ac_ct_CC
@@ -11793,11 +12401,12 @@ if test -z "$CC"; then
           if test -n "$ac_tool_prefix"; then
     # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
 set dummy ${ac_tool_prefix}cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -11805,11 +12414,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="${ac_tool_prefix}cc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11820,11 +12433,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11833,11 +12446,12 @@ fi
 if test -z "$CC"; then
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -11846,15 +12460,19 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    if test "$as_dir$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
        ac_prog_rejected=yes
        continue
      fi
     ac_cv_prog_CC="cc"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11870,18 +12488,18 @@ if test $ac_prog_rejected = yes; then
     # However, it has the same basename, so the bogon will be chosen
     # first if we set CC to just the basename; use the full file name.
     shift
-    ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
+    ac_cv_prog_CC="$as_dir$ac_word${1+' '}$@"
   fi
 fi
 fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11892,11 +12510,12 @@ if test -z "$CC"; then
   do
     # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$CC"; then
   ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -11904,11 +12523,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11919,11 +12542,11 @@ fi
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11936,11 +12559,12 @@ if test -z "$CC"; then
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_CC"; then
   ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
 else
@@ -11948,11 +12572,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_CC="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -11963,11 +12591,11 @@ fi
 fi
 ac_ct_CC=$ac_cv_prog_ac_ct_CC
 if test -n "$ac_ct_CC"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11979,34 +12607,138 @@ done
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    CC=$ac_ct_CC
+  fi
+fi
+
+fi
+if test -z "$CC"; then
+  if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}clang", so it can be a program name with args.
+set dummy ${ac_tool_prefix}clang; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_CC="${ac_tool_prefix}clang"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_CC"; then
+  ac_ct_CC=$CC
+  # Extract the first word of "clang", so it can be a program name with args.
+set dummy clang; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$ac_ct_CC"; then
+  ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_ac_ct_CC="clang"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_CC=$ac_cv_prog_ac_ct_CC
+if test -n "$ac_ct_CC"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+  if test "x$ac_ct_CC" = x; then
+    CC=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     CC=$ac_ct_CC
   fi
+else
+  CC="$ac_cv_prog_CC"
 fi
 
 fi
 
 
-test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+test -z "$CC" && { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "no acceptable C compiler found in \$PATH
 See \`config.log' for more details" "$LINENO" 5; }
 
 # Provide some information about the compiler.
-$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
+printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
 set X $ac_compile
 ac_compiler=$2
-for ac_option in --version -v -V -qversion; do
+for ac_option in --version -v -V -qversion -version; do
   { { ac_try="$ac_compiler $ac_option >&5"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
   (eval "$ac_compiler $ac_option >&5") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
@@ -12016,20 +12748,21 @@ $as_echo "$ac_try_echo"; } >&5
     cat conftest.er1 >&5
   fi
   rm -f conftest.er1 conftest.err
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }
 done
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
-$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
-if ${ac_cv_c_compiler_gnu+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports GNU C" >&5
+printf %s "checking whether the compiler supports GNU C... " >&6; }
+if test ${ac_cv_c_compiler_gnu+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 #ifndef __GNUC__
        choke me
@@ -12039,29 +12772,33 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_compiler_gnu=yes
-else
+else $as_nop
   ac_compiler_gnu=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_cv_c_compiler_gnu=$ac_compiler_gnu
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
-$as_echo "$ac_cv_c_compiler_gnu" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
+printf "%s\n" "$ac_cv_c_compiler_gnu" >&6; }
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
 if test $ac_compiler_gnu = yes; then
   GCC=yes
 else
   GCC=
 fi
-ac_test_CFLAGS=${CFLAGS+set}
+ac_test_CFLAGS=${CFLAGS+y}
 ac_save_CFLAGS=$CFLAGS
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
-$as_echo_n "checking whether $CC accepts -g... " >&6; }
-if ${ac_cv_prog_cc_g+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
+printf %s "checking whether $CC accepts -g... " >&6; }
+if test ${ac_cv_prog_cc_g+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_save_c_werror_flag=$ac_c_werror_flag
    ac_c_werror_flag=yes
    ac_cv_prog_cc_g=no
@@ -12070,57 +12807,60 @@ else
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_prog_cc_g=yes
-else
+else $as_nop
   CFLAGS=""
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
   ac_c_werror_flag=$ac_save_c_werror_flag
 	 CFLAGS="-g"
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_prog_cc_g=yes
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
    ac_c_werror_flag=$ac_save_c_werror_flag
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
-$as_echo "$ac_cv_prog_cc_g" >&6; }
-if test "$ac_test_CFLAGS" = set; then
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
+printf "%s\n" "$ac_cv_prog_cc_g" >&6; }
+if test $ac_test_CFLAGS; then
   CFLAGS=$ac_save_CFLAGS
 elif test $ac_cv_prog_cc_g = yes; then
   if test "$GCC" = yes; then
@@ -12135,94 +12875,144 @@ else
     CFLAGS=
   fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
-$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
-if ${ac_cv_prog_cc_c89+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_cv_prog_cc_c89=no
+ac_prog_cc_stdc=no
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C11 features" >&5
+printf %s "checking for $CC option to enable C11 features... " >&6; }
+if test ${ac_cv_prog_cc_c11+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c11=no
 ac_save_CC=$CC
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <stdarg.h>
-#include <stdio.h>
-struct stat;
-/* Most of the following tests are stolen from RCS 5.7's src/conf.sh.  */
-struct buf { int x; };
-FILE * (*rcsopen) (struct buf *, struct stat *, int);
-static char *e (p, i)
-     char **p;
-     int i;
-{
-  return p[i];
-}
-static char *f (char * (*g) (char **, int), char **p, ...)
-{
-  char *s;
-  va_list v;
-  va_start (v,p);
-  s = g (p, va_arg (v,int));
-  va_end (v);
-  return s;
-}
-
-/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default.  It has
-   function prototypes and stuff, but not '\xHH' hex character constants.
-   These don't provoke an error unfortunately, instead are silently treated
-   as 'x'.  The following induces an error, until -std is added to get
-   proper ANSI mode.  Curiously '\x00'!='x' always comes out true, for an
-   array size at least.  It's necessary to write '\x00'==0 to get something
-   that's true only with -std.  */
-int osf4_cc_array ['\x00' == 0 ? 1 : -1];
+$ac_c_conftest_c11_program
+_ACEOF
+for ac_arg in '' -std=gnu11
+do
+  CC="$ac_save_CC $ac_arg"
+  if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_prog_cc_c11=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+  test "x$ac_cv_prog_cc_c11" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
+fi
 
-/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
-   inside strings and character constants.  */
-#define FOO(x) 'x'
-int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];
+if test "x$ac_cv_prog_cc_c11" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c11" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c11" >&5
+printf "%s\n" "$ac_cv_prog_cc_c11" >&6; }
+     CC="$CC $ac_cv_prog_cc_c11"
+fi
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c11
+  ac_prog_cc_stdc=c11
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C99 features" >&5
+printf %s "checking for $CC option to enable C99 features... " >&6; }
+if test ${ac_cv_prog_cc_c99+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c99=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+$ac_c_conftest_c99_program
+_ACEOF
+for ac_arg in '' -std=gnu99 -std=c99 -c99 -qlanglvl=extc1x -qlanglvl=extc99 -AC99 -D_STDC_C99=
+do
+  CC="$ac_save_CC $ac_arg"
+  if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_prog_cc_c99=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+  test "x$ac_cv_prog_cc_c99" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
+fi
 
-int test (int i, double x);
-struct s1 {int (*f) (int a);};
-struct s2 {int (*f) (double a);};
-int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int);
-int argc;
-char **argv;
-int
-main ()
-{
-return f (e, argv, 0) != argv[0]  ||  f (e, argv, 1) != argv[1];
-  ;
-  return 0;
-}
+if test "x$ac_cv_prog_cc_c99" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c99" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5
+printf "%s\n" "$ac_cv_prog_cc_c99" >&6; }
+     CC="$CC $ac_cv_prog_cc_c99"
+fi
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c99
+  ac_prog_cc_stdc=c99
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C89 features" >&5
+printf %s "checking for $CC option to enable C89 features... " >&6; }
+if test ${ac_cv_prog_cc_c89+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_prog_cc_c89=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+$ac_c_conftest_c89_program
 _ACEOF
-for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
-	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
 do
   CC="$ac_save_CC $ac_arg"
-  if ac_fn_c_try_compile "$LINENO"; then :
+  if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_prog_cc_c89=$ac_arg
 fi
-rm -f core conftest.err conftest.$ac_objext
+rm -f core conftest.err conftest.$ac_objext conftest.beam
   test "x$ac_cv_prog_cc_c89" != "xno" && break
 done
 rm -f conftest.$ac_ext
 CC=$ac_save_CC
-
 fi
-# AC_CACHE_VAL
-case "x$ac_cv_prog_cc_c89" in
-  x)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
-$as_echo "none needed" >&6; } ;;
-  xno)
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
-$as_echo "unsupported" >&6; } ;;
-  *)
-    CC="$CC $ac_cv_prog_cc_c89"
-    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
-$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
-esac
-if test "x$ac_cv_prog_cc_c89" != xno; then :
 
+if test "x$ac_cv_prog_cc_c89" = xno
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+  if test "x$ac_cv_prog_cc_c89" = x
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
+printf "%s\n" "$ac_cv_prog_cc_c89" >&6; }
+     CC="$CC $ac_cv_prog_cc_c89"
+fi
+  ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c89
+  ac_prog_cc_stdc=c89
+fi
 fi
 
 ac_ext=c
@@ -12232,8 +13022,8 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $CC dependency flag" >&5
-$as_echo_n "checking $CC dependency flag... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking $CC dependency flag" >&5
+printf %s "checking $CC dependency flag... " >&6; }
 echo 'void f(){}' >conftest.c
 if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
 	DEPFLAG="-MM"
@@ -12244,18 +13034,19 @@ else
 	DEPFLAG="-MM"  # dunno do something
   fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DEPFLAG" >&5
-$as_echo "$DEPFLAG" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DEPFLAG" >&5
+printf "%s\n" "$DEPFLAG" >&6; }
 rm -f conftest.c
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
-$as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
+printf %s "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
 set x ${MAKE-make}
-ac_make=`$as_echo "$2" | sed 's/+/p/g; s/[^a-zA-Z0-9_]/_/g'`
-if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+ac_make=`printf "%s\n" "$2" | sed 's/+/p/g; s/[^a-zA-Z0-9_]/_/g'`
+if eval test \${ac_cv_prog_make_${ac_make}_set+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat >conftest.make <<\_ACEOF
 SHELL = /bin/sh
 all:
@@ -12271,12 +13062,12 @@ esac
 rm -f conftest.make
 fi
 if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
   SET_MAKE=
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
   SET_MAKE="MAKE=${MAKE-make}"
 fi
 
@@ -12292,17 +13083,18 @@ esac
 
 
 
-$as_echo "#define WINVER 0x0502" >>confdefs.h
+printf "%s\n" "#define WINVER 0x0502" >>confdefs.h
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -std=c99" >&5
-$as_echo_n "checking whether $CC supports -std=c99... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -std=c99" >&5
+printf %s "checking whether $CC supports -std=c99... " >&6; }
 cache=`echo std=c99 | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -std=c99 -c conftest.c 2>&1`"; then
@@ -12315,25 +13107,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 C99FLAG="-std=c99"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xc99" >&5
-$as_echo_n "checking whether $CC supports -xc99... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xc99" >&5
+printf %s "checking whether $CC supports -xc99... " >&6; }
 cache=`echo xc99 | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -xc99 -c conftest.c 2>&1`"; then
@@ -12346,13 +13139,13 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 C99FLAG="-xc99"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
@@ -12370,16 +13163,17 @@ fi
 
 
 # Checks for typedefs, structures, and compiler characteristics.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5
-$as_echo_n "checking for an ANSI C-conforming const... " >&6; }
-if ${ac_cv_c_const+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5
+printf %s "checking for an ANSI C-conforming const... " >&6; }
+if test ${ac_cv_c_const+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
 #ifndef __cplusplus
@@ -12392,7 +13186,7 @@ main ()
   /* NEC SVR4.0.2 mips cc rejects this.  */
   struct point {int x, y;};
   static struct point const zero = {0,0};
-  /* AIX XL C 1.02.0.0 rejects this.
+  /* IBM XL C 1.02.0.0 rejects this.
      It does not let you subtract one const X* pointer from another in
      an arm of an if-expression whose if-part is not a constant
      expression */
@@ -12420,7 +13214,7 @@ main ()
     iptr p = 0;
     ++p;
   }
-  { /* AIX XL C 1.02.0.0 rejects this sort of thing, saying
+  { /* IBM XL C 1.02.0.0 rejects this sort of thing, saying
        "k.c", line 2.27: 1506-025 (S) Operand must be a modifiable lvalue. */
     struct s { int j; const int *ap[3]; } bx;
     struct s *b = &bx; b->j = 5;
@@ -12436,18 +13230,19 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_const=yes
-else
+else $as_nop
   ac_cv_c_const=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_const" >&5
-$as_echo "$ac_cv_c_const" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_const" >&5
+printf "%s\n" "$ac_cv_c_const" >&6; }
 if test $ac_cv_c_const = no; then
 
-$as_echo "#define const /**/" >>confdefs.h
+printf "%s\n" "#define const /**/" >>confdefs.h
 
 fi
 
@@ -12460,12 +13255,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 if test "x$CFLAGS" = "x" ; then
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -g" >&5
-$as_echo_n "checking whether $CC supports -g... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -g" >&5
+printf %s "checking whether $CC supports -g... " >&6; }
 cache=`echo g | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -g -c conftest.c 2>&1`"; then
@@ -12478,25 +13274,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="-g"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -O2" >&5
-$as_echo_n "checking whether $CC supports -O2... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -O2" >&5
+printf %s "checking whether $CC supports -O2... " >&6; }
 cache=`echo O2 | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -O2 -c conftest.c 2>&1`"; then
@@ -12509,13 +13306,13 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="-O2 $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
@@ -12523,12 +13320,13 @@ fi
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
-$as_echo_n "checking whether $CC supports -Wall... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
+printf %s "checking whether $CC supports -Wall... " >&6; }
 cache=`echo Wall | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wall -c conftest.c 2>&1`"; then
@@ -12541,25 +13339,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="-Wall $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -W" >&5
-$as_echo_n "checking whether $CC supports -W... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -W" >&5
+printf %s "checking whether $CC supports -W... " >&6; }
 cache=`echo W | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -W -c conftest.c 2>&1`"; then
@@ -12572,25 +13371,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="-W $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wwrite-strings" >&5
-$as_echo_n "checking whether $CC supports -Wwrite-strings... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wwrite-strings" >&5
+printf %s "checking whether $CC supports -Wwrite-strings... " >&6; }
 cache=`echo Wwrite-strings | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wwrite-strings -c conftest.c 2>&1`"; then
@@ -12603,25 +13403,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="-Wwrite-strings $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wstrict-prototypes" >&5
-$as_echo_n "checking whether $CC supports -Wstrict-prototypes... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wstrict-prototypes" >&5
+printf %s "checking whether $CC supports -Wstrict-prototypes... " >&6; }
 cache=`echo Wstrict-prototypes | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wstrict-prototypes -c conftest.c 2>&1`"; then
@@ -12634,29 +13435,62 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+:
+CFLAGS="-Wstrict-prototypes $CFLAGS"
+else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+:
+
+fi
+
+#ACX_CHECK_COMPILER_FLAG(Wshadow, [CFLAGS="-Wshadow $CFLAGS"])
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wunused-function" >&5
+printf %s "checking whether $CC supports -Wunused-function... " >&6; }
+cache=`echo Wunused-function | sed 'y%.=/+-%___p_%'`
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+echo 'void f(void){}' >conftest.c
+if test -z "`$CC $CPPFLAGS $CFLAGS -Wunused-function -c conftest.c 2>&1`"; then
+eval "cv_prog_cc_flag_$cache=yes"
+else
+eval "cv_prog_cc_flag_$cache=no"
+fi
+rm -f conftest conftest.o conftest.c
+
+fi
+
+if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
-CFLAGS="-Wstrict-prototypes $CFLAGS"
+CFLAGS="-Wunused-function $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
-#ACX_CHECK_COMPILER_FLAG(Wshadow, [CFLAGS="-Wshadow $CFLAGS"])
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wunused-function" >&5
-$as_echo_n "checking whether $CC supports -Wunused-function... " >&6; }
-cache=`echo Wunused-function | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wmissing-prototypes" >&5
+printf %s "checking whether $CC supports -Wmissing-prototypes... " >&6; }
+cache=`echo Wmissing-prototypes | sed 'y%.=/+-%___p_%'`
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
-if test -z "`$CC $CPPFLAGS $CFLAGS -Wunused-function -c conftest.c 2>&1`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS -Wmissing-prototypes -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_$cache=yes"
 else
 eval "cv_prog_cc_flag_$cache=no"
@@ -12666,28 +13500,29 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
-CFLAGS="-Wunused-function $CFLAGS"
+CFLAGS="-Wmissing-prototypes $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wmissing-prototypes" >&5
-$as_echo_n "checking whether $CC supports -Wmissing-prototypes... " >&6; }
-cache=`echo Wmissing-prototypes | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -fno-strict-aliasing" >&5
+printf %s "checking whether $CC supports -fno-strict-aliasing... " >&6; }
+cache=`echo fno-strict-aliasing | sed 'y%.=/+-%___p_%'`
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
-if test -z "`$CC $CPPFLAGS $CFLAGS -Wmissing-prototypes -c conftest.c 2>&1`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS -fno-strict-aliasing -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_$cache=yes"
 else
 eval "cv_prog_cc_flag_$cache=no"
@@ -12697,59 +13532,71 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
-CFLAGS="-Wmissing-prototypes $CFLAGS"
+CFLAGS="-fno-strict-aliasing $CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
-for ac_header in getopt.h time.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "getopt.h" "ac_cv_header_getopt_h" "$ac_includes_default
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_getopt_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_GETOPT_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "time.h" "ac_cv_header_time_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_time_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_TIME_H 1" >>confdefs.h
 
-done
+fi
 
 
 # MinGW32 tests
-for ac_header in winsock2.h ws2tcpip.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "winsock2.h" "ac_cv_header_winsock2_h" "$ac_includes_default
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_winsock2_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_WINSOCK2_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "ws2tcpip.h" "ac_cv_header_ws2tcpip_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_ws2tcpip_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_WS2TCPIP_H 1" >>confdefs.h
 
-done
+fi
 
 # end mingw32 tests
 
+# Check for Apple header. This uncovers TARGET_OS_IPHONE, TARGET_OS_TV or TARGET_OS_WATCH
+ac_fn_c_check_header_compile "$LINENO" "TargetConditionals.h" "ac_cv_header_TargetConditionals_h" "$ac_includes_default"
+if test "x$ac_cv_header_TargetConditionals_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_TARGETCONDITIONALS_H 1" >>confdefs.h
+
+fi
+
+
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Werror" >&5
-$as_echo_n "checking whether $CC supports -Werror... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Werror" >&5
+printf %s "checking whether $CC supports -Werror... " >&6; }
 cache=`echo Werror | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Werror -c conftest.c 2>&1`"; then
@@ -12762,25 +13609,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 ERRFLAG="-Werror"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 ERRFLAG="-errwarn"
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
-$as_echo_n "checking whether $CC supports -Wall... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
+printf %s "checking whether $CC supports -Wall... " >&6; }
 cache=`echo Wall | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wall -c conftest.c 2>&1`"; then
@@ -12793,13 +13641,13 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 ERRFLAG="$ERRFLAG -Wall"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 ERRFLAG="$ERRFLAG -errfmt"
 fi
@@ -12808,12 +13656,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -std=c99" >&5
-$as_echo_n "checking whether $CC supports -std=c99... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -std=c99" >&5
+printf %s "checking whether $CC supports -std=c99... " >&6; }
 cache=`echo std=c99 | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -std=c99 -c conftest.c 2>&1`"; then
@@ -12826,25 +13675,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 C99FLAG="-std=c99"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xc99" >&5
-$as_echo_n "checking whether $CC supports -xc99... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xc99" >&5
+printf %s "checking whether $CC supports -xc99... " >&6; }
 cache=`echo xc99 | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -xc99 -c conftest.c 2>&1`"; then
@@ -12857,42 +13707,44 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 C99FLAG="-xc99"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
-for ac_header in getopt.h time.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "getopt.h" "ac_cv_header_getopt_h" "$ac_includes_default
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_getopt_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_GETOPT_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "time.h" "ac_cv_header_time_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_time_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_TIME_H 1" >>confdefs.h
 
-done
+fi
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC" >&5
-$as_echo_n "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC... " >&6; }
-cache=`$as_echo "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE" | $as_tr_sh`
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC" >&5
+printf %s "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC... " >&6; }
+cache=`printf "%s\n" "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE" | $as_tr_sh`
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include "confdefs.h"
@@ -12951,14 +13803,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
@@ -12967,8 +13819,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -12978,12 +13830,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC" >&5
-$as_echo_n "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC... " >&6; }
-cache=`$as_echo "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE" | $as_tr_sh`
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC" >&5
+printf %s "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC... " >&6; }
+cache=`printf "%s\n" "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE" | $as_tr_sh`
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include "confdefs.h"
@@ -13042,14 +13895,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
@@ -13058,8 +13911,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13069,12 +13922,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG as a flag for $CC" >&5
-$as_echo_n "checking whether we need $C99FLAG as a flag for $CC... " >&6; }
-cache=`$as_echo "$C99FLAG" | $as_tr_sh`
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG as a flag for $CC" >&5
+printf %s "checking whether we need $C99FLAG as a flag for $CC... " >&6; }
+cache=`printf "%s\n" "$C99FLAG" | $as_tr_sh`
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include <stdbool.h>
@@ -13106,14 +13960,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS $C99FLAG"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1"
@@ -13122,8 +13976,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13133,12 +13987,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC" >&5
-$as_echo_n "checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC" >&5
+printf %s "checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC... " >&6; }
 cache=_D_BSD_SOURCE__D_DEFAULT_SOURCE
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include <ctype.h>
@@ -13171,14 +14026,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1"
@@ -13187,8 +14042,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13198,12 +14053,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE as a flag for $CC" >&5
-$as_echo_n "checking whether we need -D_GNU_SOURCE as a flag for $CC... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE as a flag for $CC" >&5
+printf %s "checking whether we need -D_GNU_SOURCE as a flag for $CC... " >&6; }
 cache=_D_GNU_SOURCE
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include <netinet/in.h>
@@ -13236,14 +14092,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS -D_GNU_SOURCE"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1"
@@ -13252,8 +14108,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13266,12 +14122,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC" >&5
-$as_echo_n "checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC" >&5
+printf %s "checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC... " >&6; }
 cache=_D_GNU_SOURCE__D_FRSRESGID
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include <unistd.h>
@@ -13304,14 +14161,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS -D_GNU_SOURCE"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1"
@@ -13320,8 +14177,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13331,12 +14188,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC" >&5
-$as_echo_n "checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC" >&5
+printf %s "checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC... " >&6; }
 cache=_D_POSIX_C_SOURCE_200112
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include "confdefs.h"
@@ -13380,14 +14238,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS -D_POSIX_C_SOURCE=200112"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1"
@@ -13396,8 +14254,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13407,12 +14265,13 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D__EXTENSIONS__ as a flag for $CC" >&5
-$as_echo_n "checking whether we need -D__EXTENSIONS__ as a flag for $CC... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we need -D__EXTENSIONS__ as a flag for $CC" >&5
+printf %s "checking whether we need -D__EXTENSIONS__ as a flag for $CC... " >&6; }
 cache=_D__EXTENSIONS__
-if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_needed_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo '
 #include "confdefs.h"
@@ -13462,14 +14321,14 @@ rm -f conftest conftest.c conftest.o
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 CFLAGS="$CFLAGS -D__EXTENSIONS__"
 else
 if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 #echo 'Test with flag is no!'
 #cat conftest.c
 #echo "$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1"
@@ -13478,8 +14337,8 @@ $as_echo "no" >&6; }
 :
 
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 :
 
 fi
@@ -13488,32 +14347,34 @@ fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for inline" >&5
-$as_echo_n "checking for inline... " >&6; }
-if ${ac_cv_c_inline+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for inline" >&5
+printf %s "checking for inline... " >&6; }
+if test ${ac_cv_c_inline+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_cv_c_inline=no
 for ac_kw in inline __inline__ __inline; do
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #ifndef __cplusplus
 typedef int foo_t;
-static $ac_kw foo_t static_foo () {return 0; }
-$ac_kw foo_t foo () {return 0; }
+static $ac_kw foo_t static_foo (void) {return 0; }
+$ac_kw foo_t foo (void) {return 0; }
 #endif
 
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_inline=$ac_kw
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
   test "$ac_cv_c_inline" != no && break
 done
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5
-$as_echo "$ac_cv_c_inline" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5
+printf "%s\n" "$ac_cv_c_inline" >&6; }
 
 case $ac_cv_c_inline in
   inline | yes) ;;
@@ -13531,90 +14392,82 @@ _ACEOF
 esac
 
 ac_fn_c_check_type "$LINENO" "int8_t" "ac_cv_type_int8_t" "$ac_includes_default"
-if test "x$ac_cv_type_int8_t" = xyes; then :
+if test "x$ac_cv_type_int8_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define int8_t char
-_ACEOF
+printf "%s\n" "#define int8_t char" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "int16_t" "ac_cv_type_int16_t" "$ac_includes_default"
-if test "x$ac_cv_type_int16_t" = xyes; then :
+if test "x$ac_cv_type_int16_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define int16_t short
-_ACEOF
+printf "%s\n" "#define int16_t short" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "int32_t" "ac_cv_type_int32_t" "$ac_includes_default"
-if test "x$ac_cv_type_int32_t" = xyes; then :
+if test "x$ac_cv_type_int32_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define int32_t int
-_ACEOF
+printf "%s\n" "#define int32_t int" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "int64_t" "ac_cv_type_int64_t" "$ac_includes_default"
-if test "x$ac_cv_type_int64_t" = xyes; then :
+if test "x$ac_cv_type_int64_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define int64_t long long
-_ACEOF
+printf "%s\n" "#define int64_t long long" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "uint8_t" "ac_cv_type_uint8_t" "$ac_includes_default"
-if test "x$ac_cv_type_uint8_t" = xyes; then :
+if test "x$ac_cv_type_uint8_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define uint8_t unsigned char
-_ACEOF
+printf "%s\n" "#define uint8_t unsigned char" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "uint16_t" "ac_cv_type_uint16_t" "$ac_includes_default"
-if test "x$ac_cv_type_uint16_t" = xyes; then :
+if test "x$ac_cv_type_uint16_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define uint16_t unsigned short
-_ACEOF
+printf "%s\n" "#define uint16_t unsigned short" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "uint32_t" "ac_cv_type_uint32_t" "$ac_includes_default"
-if test "x$ac_cv_type_uint32_t" = xyes; then :
+if test "x$ac_cv_type_uint32_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define uint32_t unsigned int
-_ACEOF
+printf "%s\n" "#define uint32_t unsigned int" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "uint64_t" "ac_cv_type_uint64_t" "$ac_includes_default"
-if test "x$ac_cv_type_uint64_t" = xyes; then :
+if test "x$ac_cv_type_uint64_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define uint64_t unsigned long long
-_ACEOF
+printf "%s\n" "#define uint64_t unsigned long long" >>confdefs.h
 
 fi
 
@@ -13622,11 +14475,12 @@ fi
 # my own checks
 # Extract the first word of "doxygen", so it can be a program name with args.
 set dummy doxygen; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_doxygen+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_doxygen+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$doxygen"; then
   ac_cv_prog_doxygen="$doxygen" # Let the user override the test.
 else
@@ -13634,11 +14488,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_doxygen="doxygen"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -13649,21 +14507,27 @@ fi
 fi
 doxygen=$ac_cv_prog_doxygen
 if test -n "$doxygen"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $doxygen" >&5
-$as_echo "$doxygen" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $doxygen" >&5
+printf "%s\n" "$doxygen" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
 
 # check to see if libraries are needed for these functions.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
-$as_echo_n "checking for library containing socket... " >&6; }
-if ${ac_cv_search_socket+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+ac_fn_c_check_func "$LINENO" "socket" "ac_cv_func_socket"
+if test "x$ac_cv_func_socket" = xyes
+then :
+
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
+printf %s "checking for library containing socket... " >&6; }
+if test ${ac_cv_search_socket+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -13671,55 +14535,143 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char socket ();
 int
-main ()
+main (void)
 {
 return socket ();
   ;
   return 0;
 }
 _ACEOF
-for ac_lib in '' socket; do
+for ac_lib in '' socket
+do
   if test -z "$ac_lib"; then
     ac_res="none required"
   else
     ac_res=-l$ac_lib
     LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
   fi
-  if ac_fn_c_try_link "$LINENO"; then :
+  if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_search_socket=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext
-  if ${ac_cv_search_socket+:} false; then :
+  if test ${ac_cv_search_socket+y}
+then :
   break
 fi
 done
-if ${ac_cv_search_socket+:} false; then :
+if test ${ac_cv_search_socket+y}
+then :
 
-else
+else $as_nop
   ac_cv_search_socket=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
-$as_echo "$ac_cv_search_socket" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
+printf "%s\n" "$ac_cv_search_socket" >&6; }
 ac_res=$ac_cv_search_socket
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
   test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_pton" >&5
-$as_echo_n "checking for library containing inet_pton... " >&6; }
-if ${ac_cv_search_inet_pton+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+
+fi
+
+
+# modern Linux provides inet_ntop in -lsocket.
+# modern OS X provides inet_ntop in -lc.
+# modern Solaris provides inet_ntop in -lsocket -lnsl.
+# older Solaris provides inet_ntop in -lresolv.
+ac_fn_c_check_func "$LINENO" "inet_ntop" "ac_cv_func_inet_ntop"
+if test "x$ac_cv_func_inet_ntop" = xyes
+then :
+
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing inet_ntop" >&5
+printf %s "checking for library containing inet_ntop... " >&6; }
+if test ${ac_cv_search_inet_ntop+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+char inet_ntop ();
+int
+main (void)
+{
+return inet_ntop ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' socket c nsl resolv
+do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"
+then :
+  ac_cv_search_inet_ntop=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext
+  if test ${ac_cv_search_inet_ntop+y}
+then :
+  break
+fi
+done
+if test ${ac_cv_search_inet_ntop+y}
+then :
+
+else $as_nop
+  ac_cv_search_inet_ntop=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_ntop" >&5
+printf "%s\n" "$ac_cv_search_inet_ntop" >&6; }
+ac_res=$ac_cv_search_inet_ntop
+if test "$ac_res" != no
+then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+  ac_cv_func_inet_ntop=yes
+fi
+
+
+fi
+
+
+# modern Linux provides inet_pton in -lsocket.
+# modern OS X provides inet_pton in -lc.
+# modern Solaris provides inet_pton in -lsocket -lnsl.
+# older Solaris provides inet_pton in -lresolv.
+ac_fn_c_check_func "$LINENO" "inet_pton" "ac_cv_func_inet_pton"
+if test "x$ac_cv_func_inet_pton" = xyes
+then :
+
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing inet_pton" >&5
+printf %s "checking for library containing inet_pton... " >&6; }
+if test ${ac_cv_search_inet_pton+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -13727,47 +14679,52 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char inet_pton ();
 int
-main ()
+main (void)
 {
 return inet_pton ();
   ;
   return 0;
 }
 _ACEOF
-for ac_lib in '' nsl; do
+for ac_lib in '' socket c nsl resolv
+do
   if test -z "$ac_lib"; then
     ac_res="none required"
   else
     ac_res=-l$ac_lib
     LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
   fi
-  if ac_fn_c_try_link "$LINENO"; then :
+  if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_search_inet_pton=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext
-  if ${ac_cv_search_inet_pton+:} false; then :
+  if test ${ac_cv_search_inet_pton+y}
+then :
   break
 fi
 done
-if ${ac_cv_search_inet_pton+:} false; then :
+if test ${ac_cv_search_inet_pton+y}
+then :
 
-else
+else $as_nop
   ac_cv_search_inet_pton=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_pton" >&5
-$as_echo "$ac_cv_search_inet_pton" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_pton" >&5
+printf "%s\n" "$ac_cv_search_inet_pton" >&6; }
 ac_res=$ac_cv_search_inet_pton
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
   test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+  ac_cv_func_inet_pton=yes
+fi
+
 
 fi
 
@@ -13775,9 +14732,10 @@ fi
 
 
 # Check whether --with-drill was given.
-if test "${with_drill+set}" = set; then :
+if test ${with_drill+y}
+then :
   withval=$with_drill;
-else
+else $as_nop
   with_drill="no"
 fi
 
@@ -13815,9 +14773,10 @@ fi
 
 
 # Check whether --with-examples was given.
-if test "${with_examples+set}" = set; then :
+if test ${with_examples+y}
+then :
   withval=$with_examples;
-else
+else $as_nop
   with_examples="no"
 fi
 
@@ -13854,9 +14813,10 @@ fi
 
 # add option to disable installation of ldns-config script
 # Check whether --enable-ldns-config was given.
-if test "${enable_ldns_config+set}" = set; then :
+if test ${enable_ldns_config+y}
+then :
   enableval=$enable_ldns_config; enable_ldns_config=$enableval
-else
+else $as_nop
   enable_ldns_config=yes
 fi
 
@@ -13882,9 +14842,10 @@ fi
 
 # add option to disable library printing to stderr
 # Check whether --enable-stderr-msgs was given.
-if test "${enable_stderr_msgs+set}" = set; then :
+if test ${enable_stderr_msgs+y}
+then :
   enableval=$enable_stderr_msgs; enable_stderr_msgs=$enableval
-else
+else $as_nop
   enable_stderr_msgs=no
 fi
 
@@ -13892,53 +14853,55 @@ case "$enable_stderr_msgs" in
     no)         ;;
     *)
 
-cat >>confdefs.h <<_ACEOF
-#define STDERR_MSGS 1
-_ACEOF
+printf "%s\n" "#define STDERR_MSGS 1" >>confdefs.h
 
         ;;
 esac
 
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for poll(2)" >&5
-$as_echo_n "checking for poll(2)... " >&6; }
-  if ${ax_cv_have_poll+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for poll(2)" >&5
+printf %s "checking for poll(2)... " >&6; }
+  if test ${ax_cv_have_poll+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
       #include <poll.h>
 int
-main ()
+main (void)
 {
 int rc; rc = poll((struct pollfd *)(0), 0, 0);
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ax_cv_have_poll=yes
-else
+else $as_nop
   ax_cv_have_poll=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 fi
 
-  if test "${ax_cv_have_poll}" = "yes"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+  if test "${ax_cv_have_poll}" = "yes"
+then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
    ax_config_feature_poll=yes
 
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
    ax_config_feature_poll=no
 
 fi
 
 
 # Check whether --enable-poll was given.
-if test "${enable_poll+set}" = set; then :
+if test ${enable_poll+y}
+then :
   enableval=$enable_poll;
 case "${enableval}" in
    yes)
@@ -13955,21 +14918,24 @@ esac
 fi
 
 
-if test "$ax_config_feature_poll" = yes; then :
-     $as_echo "#define HAVE_POLL 1" >>confdefs.h
+if test "$ax_config_feature_poll" = yes
+then :
+     printf "%s\n" "#define HAVE_POLL 1" >>confdefs.h
 
 
-  if test "$ax_config_feature_verbose" = yes; then :
-       { $as_echo "$as_me:${as_lineno-$LINENO}: Feature poll is enabled" >&5
-$as_echo "$as_me: Feature poll is enabled" >&6;}
+  if test "$ax_config_feature_verbose" = yes
+then :
+       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Feature poll is enabled" >&5
+printf "%s\n" "$as_me: Feature poll is enabled" >&6;}
 
 fi
 
-else
+else $as_nop
 
-  if test "$ax_config_feature_verbose" = yes; then :
-       { $as_echo "$as_me:${as_lineno-$LINENO}: Feature poll is disabled" >&5
-$as_echo "$as_me: Feature poll is disabled" >&6;}
+  if test "$ax_config_feature_verbose" = yes
+then :
+       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Feature poll is disabled" >&5
+printf "%s\n" "$as_me: Feature poll is disabled" >&6;}
 
 fi
 
@@ -13985,16 +14951,17 @@ ldns_with_pyldns=no
 ldns_with_pyldnsx=no
 
 # Check whether --with-pyldns was given.
-if test "${with_pyldns+set}" = set; then :
+if test ${with_pyldns+y}
+then :
   withval=$with_pyldns;
-else
+else $as_nop
    withval="no"
 fi
 
 ldns_have_python=no
 if test x_$withval != x_no; then
    # ===========================================================================
-#      http://www.gnu.org/software/autoconf-archive/ax_python_devel.html
+#     https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -14007,8 +14974,8 @@ if test x_$withval != x_no; then
 #   in your configure.ac.
 #
 #   This macro checks for Python and tries to get the include path to
-#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LDFLAGS)
-#   output variables. It also exports $(PYTHON_EXTRA_LIBS) and
+#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LIBS) output
+#   variables. It also exports $(PYTHON_EXTRA_LIBS) and
 #   $(PYTHON_EXTRA_LDFLAGS) for embedding Python in your code.
 #
 #   You can search for some particular version of Python by passing a
@@ -14047,7 +15014,7 @@ if test x_$withval != x_no; then
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -14062,12 +15029,13 @@ if test x_$withval != x_no; then
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 16
+#serial 21
 
-# This is what autoupdate's m4 run will expand.  It fires
-# the warning (with _au_warn_XXX), outputs it into the
-# updated configure.ac (with AC_DIAGNOSE), and then outputs
-# the replacement expansion.
+# This is what autoupdate's m4 run will expand.  It fires the warning
+# (with _au_warn_XXX), outputs it into the updated configure.ac (with
+# m4_warn), and then outputs the replacement expansion.  We need extra
+# quotation around the m4_warn and dnl so they will be written
+# unexpanded into the updated configure.ac.
 
 
 # This is an auxiliary macro that is also run when
@@ -14078,10 +15046,11 @@ if test x_$withval != x_no; then
 
 
 # Finally, this is the expansion that is picked up by
-# autoconf.  It tells the user to run autoupdate, and
-# then outputs the replacement expansion.  We do not care
-# about autoupdate's warning because that contains
-# information on what to do *after* running autoupdate.
+# autoconf, causing NAME to expand to NEW-CODE, plus
+# (if SILENT is not "silent") a m4_warning telling the
+# maintainer to run autoupdate.  We don't issue MESSAGE
+# from autoconf, because that's instructions for what
+# to do *after* running autoupdate.
 
 
 
@@ -14094,11 +15063,12 @@ if test x_$withval != x_no; then
 
 	# Extract the first word of "python[$PYTHON_VERSION]", so it can be a program name with args.
 set dummy python$PYTHON_VERSION; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PYTHON+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_PYTHON+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $PYTHON in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_PYTHON="$PYTHON" # Let the user override the test with a path.
@@ -14108,11 +15078,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_PYTHON="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_PYTHON="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -14124,11 +15098,11 @@ esac
 fi
 PYTHON=$ac_cv_path_PYTHON
 if test -n "$PYTHON"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5
-$as_echo "$PYTHON" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5
+printf "%s\n" "$PYTHON" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -14140,51 +15114,51 @@ fi
 	#
 	# Check for a version of Python >= 2.1.0
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a version of Python >= '2.1.0'" >&5
-$as_echo_n "checking for a version of Python >= '2.1.0'... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a version of Python >= '2.1.0'" >&5
+printf %s "checking for a version of Python >= '2.1.0'... " >&6; }
 	ac_supports_python_ver=`$PYTHON -c "import sys; \
 		ver = sys.version.split ()[0]; \
 		print (ver >= '2.1.0')"`
 	if test "$ac_supports_python_ver" != "True"; then
 		if test -z "$PYTHON_NOVERSIONCHECK"; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-			{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+			{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "
 This version of the AC_PYTHON_DEVEL macro
 doesn't work properly with versions of Python before
 2.1.0. You may need to re-run configure, setting the
-variables PYTHON_CPPFLAGS, PYTHON_LDFLAGS, PYTHON_SITE_PKG,
+variables PYTHON_CPPFLAGS, PYTHON_LIBS, PYTHON_SITE_PKG,
 PYTHON_EXTRA_LIBS and PYTHON_EXTRA_LDFLAGS by hand.
 Moreover, to disable this check, set PYTHON_NOVERSIONCHECK
 to something else than an empty string.
 
 See \`config.log' for more details" "$LINENO" 5; }
 		else
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: skip at user request" >&5
-$as_echo "skip at user request" >&6; }
+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: skip at user request" >&5
+printf "%s\n" "skip at user request" >&6; }
 		fi
 	else
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 	fi
 
 	#
 	# if the macro parameter ``version'' is set, honour it
 	#
 	if test -n ">= '2.4.0'"; then
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a version of Python >= '2.4.0'" >&5
-$as_echo_n "checking for a version of Python >= '2.4.0'... " >&6; }
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a version of Python >= '2.4.0'" >&5
+printf %s "checking for a version of Python >= '2.4.0'... " >&6; }
 		ac_supports_python_ver=`$PYTHON -c "import sys; \
 			ver = sys.version.split ()[0]; \
 			print (ver >= '2.4.0')"`
 		if test "$ac_supports_python_ver" = "True"; then
-		   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+		   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 		else
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 			as_fn_error $? "this package requires Python >= '2.4.0'.
 If you have it installed, but it isn't the default Python
 interpreter in your system path, please pass the PYTHON_VERSION
@@ -14197,15 +15171,15 @@ variable to configure. See \`\`configure --help'' for reference.
 	#
 	# Check if you have distutils, else fail
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5
-$as_echo_n "checking for the distutils Python package... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5
+printf %s "checking for the distutils Python package... " >&6; }
 	ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
-	if test -z "$ac_distutils_result"; then
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+	if test $? -eq 0; then
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 	else
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 		as_fn_error $? "cannot import Python module \"distutils\".
 Please check your Python installation. The error was:
 $ac_distutils_result" "$LINENO" 5
@@ -14215,8 +15189,8 @@ $ac_distutils_result" "$LINENO" 5
 	#
 	# Check for Python include path
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python include path" >&5
-$as_echo_n "checking for Python include path... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for Python include path" >&5
+printf %s "checking for Python include path... " >&6; }
 	if test -z "$PYTHON_CPPFLAGS"; then
 		python_path=`$PYTHON -c "import distutils.sysconfig; \
 			print (distutils.sysconfig.get_python_inc ());"`
@@ -14231,16 +15205,16 @@ $as_echo_n "checking for Python include path... " >&6; }
 		fi
 		PYTHON_CPPFLAGS=$python_path
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_CPPFLAGS" >&5
-$as_echo "$PYTHON_CPPFLAGS" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON_CPPFLAGS" >&5
+printf "%s\n" "$PYTHON_CPPFLAGS" >&6; }
 
 
 	#
 	# Check for Python library path
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python library path" >&5
-$as_echo_n "checking for Python library path... " >&6; }
-	if test -z "$PYTHON_LDFLAGS"; then
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for Python library path" >&5
+printf %s "checking for Python library path... " >&6; }
+	if test -z "$PYTHON_LIBS"; then
 		# (makes two attempts to ensure we've got a version number
 		# from the interpreter)
 		ac_python_version=`cat<<EOD | $PYTHON -
@@ -14264,9 +15238,7 @@ EOD`
 
 		# Make the versioning information available to the compiler
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_PYTHON "$ac_python_version"
-_ACEOF
+printf "%s\n" "#define HAVE_PYTHON \"$ac_python_version\"" >>confdefs.h
 
 
 		# First, the library directory:
@@ -14298,77 +15270,79 @@ EOD`
 		then
 			# use the official shared library
 			ac_python_library=`echo "$ac_python_library" | sed "s/^lib//"`
-			PYTHON_LDFLAGS="-L$ac_python_libdir -l$ac_python_library"
+			PYTHON_LIBS="-L$ac_python_libdir -l$ac_python_library"
 		else
 			# old way: use libpython from python_configdir
 			ac_python_libdir=`$PYTHON -c \
 			  "from distutils.sysconfig import get_python_lib as f; \
 			  import os; \
 			  print (os.path.join(f(plat_specific=1, standard_lib=1), 'config'));"`
-			PYTHON_LDFLAGS="-L$ac_python_libdir -lpython$ac_python_version"
+			PYTHON_LIBS="-L$ac_python_libdir -lpython$ac_python_version"
 		fi
 
-		if test -z "PYTHON_LDFLAGS"; then
+		if test -z "PYTHON_LIBS"; then
 			as_fn_error $? "
   Cannot determine location of your Python DSO. Please check it was installed with
-  dynamic libraries enabled, or try setting PYTHON_LDFLAGS by hand.
+  dynamic libraries enabled, or try setting PYTHON_LIBS by hand.
 			" "$LINENO" 5
 		fi
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_LDFLAGS" >&5
-$as_echo "$PYTHON_LDFLAGS" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON_LIBS" >&5
+printf "%s\n" "$PYTHON_LIBS" >&6; }
 
 
 	#
 	# Check for site packages
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python site-packages path" >&5
-$as_echo_n "checking for Python site-packages path... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for Python site-packages path" >&5
+printf %s "checking for Python site-packages path... " >&6; }
 	if test -z "$PYTHON_SITE_PKG"; then
 		PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
 			print (distutils.sysconfig.get_python_lib(1,0));"`
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_SITE_PKG" >&5
-$as_echo "$PYTHON_SITE_PKG" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON_SITE_PKG" >&5
+printf "%s\n" "$PYTHON_SITE_PKG" >&6; }
 
 
 	#
 	# libraries which must be linked in when embedding
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python extra libraries" >&5
-$as_echo_n "checking python extra libraries... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking python extra libraries" >&5
+printf %s "checking python extra libraries... " >&6; }
 	if test -z "$PYTHON_EXTRA_LIBS"; then
 	   PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
                 conf = distutils.sysconfig.get_config_var; \
-                print (conf('LIBS'))"`
+                print (conf('LIBS') + ' ' + conf('SYSLIBS'))"`
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_EXTRA_LIBS" >&5
-$as_echo "$PYTHON_EXTRA_LIBS" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON_EXTRA_LIBS" >&5
+printf "%s\n" "$PYTHON_EXTRA_LIBS" >&6; }
 
 
 	#
 	# linking flags needed when embedding
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python extra linking flags" >&5
-$as_echo_n "checking python extra linking flags... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking python extra linking flags" >&5
+printf %s "checking python extra linking flags... " >&6; }
 	if test -z "$PYTHON_EXTRA_LDFLAGS"; then
 		PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import distutils.sysconfig; \
 			conf = distutils.sysconfig.get_config_var; \
 			print (conf('LINKFORSHARED'))"`
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_EXTRA_LDFLAGS" >&5
-$as_echo "$PYTHON_EXTRA_LDFLAGS" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PYTHON_EXTRA_LDFLAGS" >&5
+printf "%s\n" "$PYTHON_EXTRA_LDFLAGS" >&6; }
 
 
 	#
 	# final check to see if everything compiles alright
 	#
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking consistency of all components of python development environment" >&5
-$as_echo_n "checking consistency of all components of python development environment... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking consistency of all components of python development environment" >&5
+printf %s "checking consistency of all components of python development environment... " >&6; }
 	# save current global flags
 	ac_save_LIBS="$LIBS"
+	ac_save_LDFLAGS="$LDFLAGS"
 	ac_save_CPPFLAGS="$CPPFLAGS"
-	LIBS="$ac_save_LIBS $PYTHON_LDFLAGS $PYTHON_EXTRA_LDFLAGS $PYTHON_EXTRA_LIBS"
+	LIBS="$ac_save_LIBS $PYTHON_LIBS $PYTHON_EXTRA_LIBS $PYTHON_EXTRA_LIBS"
+	LDFLAGS="$ac_save_LDFLAGS $PYTHON_EXTRA_LDFLAGS"
 	CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
 	ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -14381,7 +15355,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 		#include <Python.h>
 int
-main ()
+main (void)
 {
 Py_Initialize();
   ;
@@ -14389,12 +15363,13 @@ Py_Initialize();
 }
 
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   pythonexists=yes
-else
+else $as_nop
   pythonexists=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 	ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -14405,18 +15380,19 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 	# turn back to default flags
 	CPPFLAGS="$ac_save_CPPFLAGS"
 	LIBS="$ac_save_LIBS"
+	LDFLAGS="$ac_save_LDFLAGS"
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $pythonexists" >&5
-$as_echo "$pythonexists" >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $pythonexists" >&5
+printf "%s\n" "$pythonexists" >&6; }
 
         if test ! "x$pythonexists" = "xyes"; then
-	   { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+	   { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "
   Could not link test program to Python. Maybe the main Python library has been
   installed in some non-standard library path. If so, pass it to configure,
-  via the LDFLAGS environment variable.
-  Example: ./configure LDFLAGS=\"-L/usr/non-standard-path/python/lib\"
+  via the LIBS environment variable.
+  Example: ./configure LIBS=\"-L/usr/non-standard-path/python/lib\"
   ============================================================================
    ERROR!
    You probably have to install the development version of the Python package
@@ -14446,7 +15422,7 @@ See \`config.log' for more details" "$LINENO" 5; }
    # check for SWIG
    if test x_$ldns_have_python != x_no; then
         # ===========================================================================
-#        http://www.gnu.org/software/autoconf-archive/ax_pkg_swig.html
+#       https://www.gnu.org/software/autoconf-archive/ax_pkg_swig.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -14479,9 +15455,9 @@ See \`config.log' for more details" "$LINENO" 5; }
 # LICENSE
 #
 #   Copyright (c) 2008 Sebastian Huber <sebastian-huber@web.de>
-#   Copyright (c) 2008 Alan W. Irwin <irwin@beluga.phys.uvic.ca>
+#   Copyright (c) 2008 Alan W. Irwin
 #   Copyright (c) 2008 Rafael Laboissiere <rafael@laboissiere.net>
-#   Copyright (c) 2008 Andrew Collier <colliera@ukzn.ac.za>
+#   Copyright (c) 2008 Andrew Collier
 #   Copyright (c) 2011 Murray Cumming <murrayc@openismus.com>
 #
 #   This program is free software; you can redistribute it and/or modify it
@@ -14495,7 +15471,7 @@ See \`config.log' for more details" "$LINENO" 5; }
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -14510,7 +15486,7 @@ See \`config.log' for more details" "$LINENO" 5; }
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 8
+#serial 13
 
 
 
@@ -14520,16 +15496,17 @@ See \`config.log' for more details" "$LINENO" 5; }
             ver = sys.version.split()[0]; \
             print(ver >= '3.2')"` = "True"; then
 
-        # Ubuntu has swig 2.0 as /usr/bin/swig2.0
-        for ac_prog in swig2.0 swig
+        # Find path to the "swig" executable.
+        for ac_prog in swig swig3.0 swig2.0
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_SWIG+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_SWIG+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $SWIG in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_SWIG="$SWIG" # Let the user override the test with a path.
@@ -14539,11 +15516,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_SWIG="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_SWIG="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -14555,11 +15536,11 @@ esac
 fi
 SWIG=$ac_cv_path_SWIG
 if test -n "$SWIG"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
-$as_echo "$SWIG" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
+printf "%s\n" "$SWIG" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -14569,11 +15550,11 @@ done
         if test -z "$SWIG" ; then
                 as_fn_error $? "SWIG-2.0.4 is required to build pyldns for Python 3.2 and greater." "$LINENO" 5
         elif test -n "2.0.4" ; then
-                { $as_echo "$as_me:${as_lineno-$LINENO}: checking SWIG version" >&5
-$as_echo_n "checking SWIG version... " >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking SWIG version" >&5
+printf %s "checking SWIG version... " >&6; }
                 swig_version=`$SWIG -version 2>&1 | grep 'SWIG Version' | sed 's/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/g'`
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
-$as_echo "$swig_version" >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
+printf "%s\n" "$swig_version" >&6; }
                 if test -n "$swig_version" ; then
                         # Calculate the required version number components
                         required=2.0.4
@@ -14616,21 +15597,21 @@ $as_echo "$swig_version" >&6; }
                             \+ $available_minor \* 100 \+ $available_patch`
 
                         if test $available_swig_vernum -lt $required_swig_vernum; then
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >= 2.0.4 is required.  You have $swig_version." >&5
-$as_echo "$as_me: WARNING: SWIG version >= 2.0.4 is required.  You have $swig_version." >&2;}
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >= 2.0.4 is required.  You have $swig_version." >&5
+printf "%s\n" "$as_me: WARNING: SWIG version >= 2.0.4 is required.  You have $swig_version." >&2;}
                                 SWIG=''
                                 as_fn_error $? "SWIG-2.0.4 is required to build pyldns for Python 3.2 and greater." "$LINENO" 5
                         else
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SWIG library" >&5
-$as_echo_n "checking for SWIG library... " >&6; }
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SWIG library" >&5
+printf %s "checking for SWIG library... " >&6; }
                                 SWIG_LIB=`$SWIG -swiglib`
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG_LIB" >&5
-$as_echo "$SWIG_LIB" >&6; }
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SWIG_LIB" >&5
+printf "%s\n" "$SWIG_LIB" >&6; }
 
                         fi
                 else
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
-$as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
+                        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
+printf "%s\n" "$as_me: WARNING: cannot determine SWIG version" >&2;}
                         SWIG=''
                         as_fn_error $? "SWIG-2.0.4 is required to build pyldns for Python 3.2 and greater." "$LINENO" 5
                 fi
@@ -14639,16 +15620,17 @@ $as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
 
         else
 
-        # Ubuntu has swig 2.0 as /usr/bin/swig2.0
-        for ac_prog in swig2.0 swig
+        # Find path to the "swig" executable.
+        for ac_prog in swig swig3.0 swig2.0
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_SWIG+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_SWIG+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $SWIG in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_SWIG="$SWIG" # Let the user override the test with a path.
@@ -14658,11 +15640,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_SWIG="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_SWIG="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -14674,11 +15660,11 @@ esac
 fi
 SWIG=$ac_cv_path_SWIG
 if test -n "$SWIG"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
-$as_echo "$SWIG" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
+printf "%s\n" "$SWIG" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -14688,11 +15674,11 @@ done
         if test -z "$SWIG" ; then
                 :
         elif test -n "" ; then
-                { $as_echo "$as_me:${as_lineno-$LINENO}: checking SWIG version" >&5
-$as_echo_n "checking SWIG version... " >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking SWIG version" >&5
+printf %s "checking SWIG version... " >&6; }
                 swig_version=`$SWIG -version 2>&1 | grep 'SWIG Version' | sed 's/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/g'`
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
-$as_echo "$swig_version" >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
+printf "%s\n" "$swig_version" >&6; }
                 if test -n "$swig_version" ; then
                         # Calculate the required version number components
                         required=
@@ -14735,21 +15721,21 @@ $as_echo "$swig_version" >&6; }
                             \+ $available_minor \* 100 \+ $available_patch`
 
                         if test $available_swig_vernum -lt $required_swig_vernum; then
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >=  is required.  You have $swig_version." >&5
-$as_echo "$as_me: WARNING: SWIG version >=  is required.  You have $swig_version." >&2;}
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >=  is required.  You have $swig_version." >&5
+printf "%s\n" "$as_me: WARNING: SWIG version >=  is required.  You have $swig_version." >&2;}
                                 SWIG=''
 
                         else
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SWIG library" >&5
-$as_echo_n "checking for SWIG library... " >&6; }
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SWIG library" >&5
+printf %s "checking for SWIG library... " >&6; }
                                 SWIG_LIB=`$SWIG -swiglib`
-                                { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG_LIB" >&5
-$as_echo "$SWIG_LIB" >&6; }
+                                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SWIG_LIB" >&5
+printf "%s\n" "$SWIG_LIB" >&6; }
 
                         fi
                 else
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
-$as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
+                        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
+printf "%s\n" "$as_me: WARNING: cannot determine SWIG version" >&2;}
                         SWIG=''
 
                 fi
@@ -14762,7 +15748,7 @@ $as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
 		as_fn_error $? "failed to find SWIG tool, install it, or do not build pyldns" "$LINENO" 5
 	else
 
-$as_echo "#define HAVE_SWIG 1" >>confdefs.h
+printf "%s\n" "#define HAVE_SWIG 1" >>confdefs.h
 
 		PYLDNS="pyldns"
 
@@ -14771,20 +15757,21 @@ $as_echo "#define HAVE_SWIG 1" >>confdefs.h
 		ldns_with_pyldns=yes
 	fi
    else
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: *** don't have Python, skipping SWIG, no pyldns ***" >&5
-$as_echo "*** don't have Python, skipping SWIG, no pyldns ***" >&6; } # '
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: *** don't have Python, skipping SWIG, no pyldns ***" >&5
+printf "%s\n" "*** don't have Python, skipping SWIG, no pyldns ***" >&6; } # '
    fi
 
    # xtra cflags for pyldns
    if test x_$ldns_have_python != x_no; then
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -fno-strict-aliasing" >&5
-$as_echo_n "checking whether $CC supports -fno-strict-aliasing... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -fno-strict-aliasing" >&5
+printf %s "checking whether $CC supports -fno-strict-aliasing... " >&6; }
 cache=`echo fno-strict-aliasing | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -fno-strict-aliasing -c conftest.c 2>&1`"; then
@@ -14797,25 +15784,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 PYTHON_X_CFLAGS="-fno-strict-aliasing"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-missing-field-initializers" >&5
-$as_echo_n "checking whether $CC supports -Wno-missing-field-initializers... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-missing-field-initializers" >&5
+printf %s "checking whether $CC supports -Wno-missing-field-initializers... " >&6; }
 cache=`echo Wno-missing-field-initializers | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wno-missing-field-initializers -c conftest.c 2>&1`"; then
@@ -14828,25 +15816,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 PYTHON_X_CFLAGS="-Wno-missing-field-initializers $PYTHON_X_CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-unused-parameter" >&5
-$as_echo_n "checking whether $CC supports -Wno-unused-parameter... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-unused-parameter" >&5
+printf %s "checking whether $CC supports -Wno-unused-parameter... " >&6; }
 cache=`echo Wno-unused-parameter | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wno-unused-parameter -c conftest.c 2>&1`"; then
@@ -14859,25 +15848,26 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 PYTHON_X_CFLAGS="-Wno-unused-parameter $PYTHON_X_CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-unused-variable" >&5
-$as_echo_n "checking whether $CC supports -Wno-unused-variable... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wno-unused-variable" >&5
+printf %s "checking whether $CC supports -Wno-unused-variable... " >&6; }
 cache=`echo Wno-unused-variable | sed 'y%.=/+-%___p_%'`
-if eval \${cv_prog_cc_flag_$cache+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+if eval test \${cv_prog_cc_flag_$cache+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
 
 echo 'void f(void){}' >conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -Wno-unused-variable -c conftest.c 2>&1`"; then
@@ -14890,13 +15880,13 @@ rm -f conftest conftest.o conftest.c
 fi
 
 if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 :
 PYTHON_X_CFLAGS="-Wno-unused-variable $PYTHON_X_CFLAGS"
 else
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 :
 
 fi
@@ -14908,9 +15898,10 @@ fi
 # Check for pyldnsx
 
 # Check whether --with-pyldnsx was given.
-if test "${with_pyldnsx+set}" = set; then :
+if test ${with_pyldnsx+y}
+then :
   withval=$with_pyldnsx;
-else
+else $as_nop
    withval="with_pyldns"
 fi
 
@@ -14949,9 +15940,10 @@ fi
 ldns_with_p5_dns_ldns=no
 
 # Check whether --with-p5-dns-ldns was given.
-if test "${with_p5_dns_ldns+set}" = set; then :
+if test ${with_p5_dns_ldns+y}
+then :
   withval=$with_p5_dns_ldns;
-else
+else $as_nop
    withval="no"
 fi
 
@@ -14959,11 +15951,12 @@ ldns_have_perl=no
 if test x_$withval != x_no; then
    # Extract the first word of "perl", so it can be a program name with args.
 set dummy perl; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PERL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_PERL+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $PERL in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_PERL="$PERL" # Let the user override the test with a path.
@@ -14973,11 +15966,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_PERL="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_PERL="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -14989,11 +15986,11 @@ esac
 fi
 PERL=$ac_cv_path_PERL
 if test -n "$PERL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PERL" >&5
-$as_echo "$PERL" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PERL" >&5
+printf "%s\n" "$PERL" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -15039,11 +16036,12 @@ fi
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}ar", so it can be a program name with args.
 set dummy ${ac_tool_prefix}ar; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_AR+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_AR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $AR in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_AR="$AR" # Let the user override the test with a path.
@@ -15053,11 +16051,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_AR="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_AR="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -15069,11 +16071,11 @@ esac
 fi
 AR=$ac_cv_path_AR
 if test -n "$AR"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
-$as_echo "$AR" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
+printf "%s\n" "$AR" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -15082,11 +16084,12 @@ if test -z "$ac_cv_path_AR"; then
   ac_pt_AR=$AR
   # Extract the first word of "ar", so it can be a program name with args.
 set dummy ar; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_ac_pt_AR+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_path_ac_pt_AR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   case $ac_pt_AR in
   [\\/]* | ?:[\\/]*)
   ac_cv_path_ac_pt_AR="$ac_pt_AR" # Let the user override the test with a path.
@@ -15096,11 +16099,15 @@ else
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_ac_pt_AR="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_path_ac_pt_AR="$as_dir$ac_word$ac_exec_ext"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -15112,11 +16119,11 @@ esac
 fi
 ac_pt_AR=$ac_cv_path_ac_pt_AR
 if test -n "$ac_pt_AR"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_AR" >&5
-$as_echo "$ac_pt_AR" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_pt_AR" >&5
+printf "%s\n" "$ac_pt_AR" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_pt_AR" = x; then
@@ -15124,8 +16131,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     AR=$ac_pt_AR
@@ -15150,10 +16157,11 @@ tmp_LIBS=$LIBS
 
 
 # Check whether --with-ssl was given.
-if test "${with_ssl+set}" = set; then :
+if test ${with_ssl+y}
+then :
   withval=$with_ssl;
 
-else
+else $as_nop
 
             withval="yes"
 
@@ -15162,8 +16170,8 @@ fi
 
     withval=$withval
     if test x_$withval != x_no; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL" >&5
-$as_echo_n "checking for SSL... " >&6; }
+        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SSL" >&5
+printf %s "checking for SSL... " >&6; }
         if test x_$withval = x_ -o x_$withval = x_yes; then
             withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
         fi
@@ -15172,9 +16180,7 @@ $as_echo_n "checking for SSL... " >&6; }
             if test -f "$dir/include/openssl/ssl.h"; then
                 found_ssl="yes"
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_SSL /**/
-_ACEOF
+printf "%s\n" "#define HAVE_SSL /**/" >>confdefs.h
 
                                 if test "$ssldir" != "/usr"; then
                         CPPFLAGS="$CPPFLAGS -I$ssldir/include"
@@ -15186,12 +16192,23 @@ _ACEOF
         if test x_$found_ssl != x_yes; then
             as_fn_error $? "Cannot find the SSL libraries in $withval" "$LINENO" 5
         else
-            { $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $ssldir" >&5
-$as_echo "found in $ssldir" >&6; }
+            { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: found in $ssldir" >&5
+printf "%s\n" "found in $ssldir" >&6; }
             HAVE_SSL=yes
                         if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
+		if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+			LDFLAGS="$LDFLAGS -L$ssldir/lib64"
+			LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib64"
+
+	if test "x$enable_rpath" = xyes; then
+		if echo "$ssldir/lib64" | grep "^/" >/dev/null; then
+			RUNTIME_PATH="$RUNTIME_PATH -R$ssldir/lib64"
+		fi
+	fi
+
+		else
+			LDFLAGS="$LDFLAGS -L$ssldir/lib"
+			LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
 
 	if test "x$enable_rpath" = xyes; then
 		if echo "$ssldir/lib" | grep "^/" >/dev/null; then
@@ -15199,220 +16216,492 @@ $as_echo "found in $ssldir" >&6; }
 		fi
 	fi
 
+		fi
             fi
 
-            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for HMAC_Update in -lcrypto" >&5
-$as_echo_n "checking for HMAC_Update in -lcrypto... " >&6; }
+            { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for EVP_sha256 in -lcrypto" >&5
+printf %s "checking for EVP_sha256 in -lcrypto... " >&6; }
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
-                int HMAC_Update(void);
-                (void)HMAC_Update();
+                int EVP_sha256(void);
+                (void)EVP_sha256();
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+printf "%s\n" "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
 
-else
+else $as_nop
 
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
                 # check if -lwsock32 or -lgdi32 are needed.
                 BAKLIBS="$LIBS"
                 BAKSSLLIBS="$LIBSSL_LIBS"
-                LIBS="$LIBS -lgdi32"
-                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
-                { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -lgdi32" >&5
-$as_echo_n "checking if -lcrypto needs -lgdi32... " >&6; }
+		LIBS="$LIBS -lgdi32 -lws2_32"
+		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
+                { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -lgdi32" >&5
+printf %s "checking if -lcrypto needs -lgdi32... " >&6; }
                 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
-                    int HMAC_Update(void);
-                    (void)HMAC_Update();
+                    int EVP_sha256(void);
+                    (void)EVP_sha256();
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+printf "%s\n" "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
-                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+                    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-else
+else $as_nop
 
-                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+                    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
                     LIBS="$BAKLIBS"
                     LIBSSL_LIBS="$BAKSSLLIBS"
                     LIBS="$LIBS -ldl"
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
-                    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl" >&5
-$as_echo_n "checking if -lcrypto needs -ldl... " >&6; }
+                    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl" >&5
+printf %s "checking if -lcrypto needs -ldl... " >&6; }
                     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
-                        int HMAC_Update(void);
-                        (void)HMAC_Update();
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+printf "%s\n" "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+                        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-else
+else $as_nop
 
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+                        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
                         LIBS="$BAKLIBS"
                         LIBSSL_LIBS="$BAKSSLLIBS"
                         LIBS="$LIBS -ldl -pthread"
                         LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl -pthread" >&5
-$as_echo_n "checking if -lcrypto needs -ldl -pthread... " >&6; }
+                        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl -pthread" >&5
+printf %s "checking if -lcrypto needs -ldl -pthread... " >&6; }
                         cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
-main ()
+main (void)
 {
 
-                            int HMAC_Update(void);
-                            (void)HMAC_Update();
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+printf "%s\n" "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
-                            { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+                            { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-else
+else $as_nop
 
-                            { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+                            { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
                             as_fn_error $? "OpenSSL found in $ssldir, but version 0.9.7 or higher is required" "$LINENO" 5
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
         fi
 
 
     fi
-for ac_header in openssl/ssl.h
-do :
-  ac_fn_c_check_header_compile "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_openssl_ssl_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+
+fi
+
+ac_fn_c_check_header_compile "$LINENO" "openssl/err.h" "ac_cv_header_openssl_err_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_openssl_err_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_ERR_H 1" >>confdefs.h
+
+fi
+
+ac_fn_c_check_header_compile "$LINENO" "openssl/rand.h" "ac_cv_header_openssl_rand_h" "$ac_includes_default
 "
-if test "x$ac_cv_header_openssl_ssl_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_OPENSSL_SSL_H 1
+if test "x$ac_cv_header_openssl_rand_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_RAND_H 1" >>confdefs.h
+
+fi
+
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for LibreSSL" >&5
+printf %s "checking for LibreSSL... " >&6; }
+if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+
+printf "%s\n" "#define HAVE_LIBRESSL 1" >>confdefs.h
+
+else
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+ac_fn_c_check_header_compile "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default"
+if test "x$ac_cv_header_openssl_ssl_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "openssl/evp.h" "ac_cv_header_openssl_evp_h" "$ac_includes_default"
+if test "x$ac_cv_header_openssl_evp_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_EVP_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "openssl/engine.h" "ac_cv_header_openssl_engine_h" "$ac_includes_default"
+if test "x$ac_cv_header_openssl_engine_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_ENGINE_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "openssl/conf.h" "ac_cv_header_openssl_conf_h" "$ac_includes_default"
+if test "x$ac_cv_header_openssl_conf_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_CONF_H 1" >>confdefs.h
+
+fi
+
+ac_fn_c_check_func "$LINENO" "EVP_sha256" "ac_cv_func_EVP_sha256"
+if test "x$ac_cv_func_EVP_sha256" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_SHA256 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_sha384" "ac_cv_func_EVP_sha384"
+if test "x$ac_cv_func_EVP_sha384" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_SHA384 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_sha512" "ac_cv_func_EVP_sha512"
+if test "x$ac_cv_func_EVP_sha512" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_SHA512 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_PKEY_keygen" "ac_cv_func_EVP_PKEY_keygen"
+if test "x$ac_cv_func_EVP_PKEY_keygen" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_PKEY_KEYGEN 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "ECDSA_SIG_get0" "ac_cv_func_ECDSA_SIG_get0"
+if test "x$ac_cv_func_ECDSA_SIG_get0" = xyes
+then :
+  printf "%s\n" "#define HAVE_ECDSA_SIG_GET0 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_MD_CTX_new" "ac_cv_func_EVP_MD_CTX_new"
+if test "x$ac_cv_func_EVP_MD_CTX_new" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_MD_CTX_NEW 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "DSA_SIG_set0" "ac_cv_func_DSA_SIG_set0"
+if test "x$ac_cv_func_DSA_SIG_set0" = xyes
+then :
+  printf "%s\n" "#define HAVE_DSA_SIG_SET0 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "DSA_SIG_get0" "ac_cv_func_DSA_SIG_get0"
+if test "x$ac_cv_func_DSA_SIG_get0" = xyes
+then :
+  printf "%s\n" "#define HAVE_DSA_SIG_GET0 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_dss1" "ac_cv_func_EVP_dss1"
+if test "x$ac_cv_func_EVP_dss1" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_DSS1 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "DSA_get0_pqg" "ac_cv_func_DSA_get0_pqg"
+if test "x$ac_cv_func_DSA_get0_pqg" = xyes
+then :
+  printf "%s\n" "#define HAVE_DSA_GET0_PQG 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "DSA_get0_key" "ac_cv_func_DSA_get0_key"
+if test "x$ac_cv_func_DSA_get0_key" = xyes
+then :
+  printf "%s\n" "#define HAVE_DSA_GET0_KEY 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_cleanup" "ac_cv_func_EVP_cleanup"
+if test "x$ac_cv_func_EVP_cleanup" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_CLEANUP 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "ENGINE_cleanup" "ac_cv_func_ENGINE_cleanup"
+if test "x$ac_cv_func_ENGINE_cleanup" = xyes
+then :
+  printf "%s\n" "#define HAVE_ENGINE_CLEANUP 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "ENGINE_free" "ac_cv_func_ENGINE_free"
+if test "x$ac_cv_func_ENGINE_free" = xyes
+then :
+  printf "%s\n" "#define HAVE_ENGINE_FREE 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "CRYPTO_cleanup_all_ex_data" "ac_cv_func_CRYPTO_cleanup_all_ex_data"
+if test "x$ac_cv_func_CRYPTO_cleanup_all_ex_data" = xyes
+then :
+  printf "%s\n" "#define HAVE_CRYPTO_CLEANUP_ALL_EX_DATA 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "ERR_free_strings" "ac_cv_func_ERR_free_strings"
+if test "x$ac_cv_func_ERR_free_strings" = xyes
+then :
+  printf "%s\n" "#define HAVE_ERR_FREE_STRINGS 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "CONF_modules_unload" "ac_cv_func_CONF_modules_unload"
+if test "x$ac_cv_func_CONF_modules_unload" = xyes
+then :
+  printf "%s\n" "#define HAVE_CONF_MODULES_UNLOAD 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "OPENSSL_init_ssl" "ac_cv_func_OPENSSL_init_ssl"
+if test "x$ac_cv_func_OPENSSL_init_ssl" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_INIT_SSL 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "OPENSSL_init_crypto" "ac_cv_func_OPENSSL_init_crypto"
+if test "x$ac_cv_func_OPENSSL_init_crypto" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_INIT_CRYPTO 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "ERR_load_crypto_strings" "ac_cv_func_ERR_load_crypto_strings"
+if test "x$ac_cv_func_ERR_load_crypto_strings" = xyes
+then :
+  printf "%s\n" "#define HAVE_ERR_LOAD_CRYPTO_STRINGS 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "CRYPTO_memcmp" "ac_cv_func_CRYPTO_memcmp"
+if test "x$ac_cv_func_CRYPTO_memcmp" = xyes
+then :
+  printf "%s\n" "#define HAVE_CRYPTO_MEMCMP 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "EVP_PKEY_get_base_id" "ac_cv_func_EVP_PKEY_get_base_id"
+if test "x$ac_cv_func_EVP_PKEY_get_base_id" = xyes
+then :
+  printf "%s\n" "#define HAVE_EVP_PKEY_GET_BASE_ID 1" >>confdefs.h
+
+fi
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC options needed to detect all undeclared functions" >&5
+printf %s "checking for $CC options needed to detect all undeclared functions... " >&6; }
+if test ${ac_cv_c_undeclared_builtin_options+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_save_CFLAGS=$CFLAGS
+   ac_cv_c_undeclared_builtin_options='cannot detect'
+   for ac_arg in '' -fno-builtin; do
+     CFLAGS="$ac_save_CFLAGS $ac_arg"
+     # This test program should *not* compile successfully.
+     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main (void)
+{
+(void) strchr;
+  ;
+  return 0;
+}
 _ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+
+else $as_nop
+  # This test program should compile successfully.
+        # No library function is consistently available on
+        # freestanding implementations, so test against a dummy
+        # declaration.  Include always-available headers on the
+        # off chance that they somehow elicit warnings.
+        cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <float.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stddef.h>
+extern void ac_decl (int, char *);
+
+int
+main (void)
+{
+(void) ac_decl (0, (char *) 0);
+  (void) ac_decl;
 
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  if test x"$ac_arg" = x
+then :
+  ac_cv_c_undeclared_builtin_options='none needed'
+else $as_nop
+  ac_cv_c_undeclared_builtin_options=$ac_arg
+fi
+          break
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+    done
+    CFLAGS=$ac_save_CFLAGS
+
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_undeclared_builtin_options" >&5
+printf "%s\n" "$ac_cv_c_undeclared_builtin_options" >&6; }
+  case $ac_cv_c_undeclared_builtin_options in #(
+  'cannot detect') :
+    { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot make $CC report undeclared builtins
+See \`config.log' for more details" "$LINENO" 5; } ;; #(
+  'none needed') :
+    ac_c_undeclared_builtin_options='' ;; #(
+  *) :
+    ac_c_undeclared_builtin_options=$ac_cv_c_undeclared_builtin_options ;;
+esac
 
-done
-
-for ac_header in openssl/err.h
-do :
-  ac_fn_c_check_header_compile "$LINENO" "openssl/err.h" "ac_cv_header_openssl_err_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_openssl_err_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_OPENSSL_ERR_H 1
-_ACEOF
+ac_fn_check_decl "$LINENO" "EVP_PKEY_base_id" "ac_cv_have_decl_EVP_PKEY_base_id" "$ac_includes_default
+#include <openssl/evp.h>
 
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_EVP_PKEY_base_id" = xyes
+then :
+  ac_have_decl=1
+else $as_nop
+  ac_have_decl=0
 fi
+printf "%s\n" "#define HAVE_DECL_EVP_PKEY_BASE_ID $ac_have_decl" >>confdefs.h
+if test $ac_have_decl = 1
+then :
 
-done
 
-for ac_header in openssl/rand.h
-do :
-  ac_fn_c_check_header_compile "$LINENO" "openssl/rand.h" "ac_cv_header_openssl_rand_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_openssl_rand_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_OPENSSL_RAND_H 1
-_ACEOF
+printf "%s\n" "#define HAVE_EVP_PKEY_BASE_ID 1" >>confdefs.h
 
-fi
 
-done
+fi
 
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking Checking for OpenSSL >= 3.0.0" >&5
+printf %s "checking Checking for OpenSSL >= 3.0.0... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
 
+#include <openssl/ssl.h>
+#if OPENSSL_VERSION_MAJOR >= 3
+#define SOMETHING
+#else
+This fails compiling.
+So either no OpenSSL at all (the include already failed), or the version < 3.0.0
+#endif
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LibreSSL" >&5
-$as_echo_n "checking for LibreSSL... " >&6; }
-if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/null; then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+int
+main (void)
+{
 
-$as_echo "#define HAVE_LIBRESSL 1" >>confdefs.h
 
-else
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-for ac_func in EVP_sha256 EVP_sha384 EVP_sha512 ENGINE_load_cryptodev EVP_PKEY_keygen ECDSA_SIG_get0 EVP_MD_CTX_new EVP_PKEY_base_id DSA_SIG_set0 DSA_SIG_get0 EVP_dss1 DSA_get0_pqg DSA_get0_key
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+  ;
+  return 0;
+}
 _ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+	CFLAGS="-DOPENSSL_API_COMPAT=10100 $CFLAGS"
+
+else $as_nop
+  	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 
 fi
-done
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
 
 # for macosx, see if glibtool exists and use that
@@ -15421,7 +16710,8 @@ done
 #AC_CHECK_PROGS(libtool, [libtool15 libtool], [./libtool])
 
 # Check whether --enable-sha2 was given.
-if test "${enable_sha2+set}" = set; then :
+if test ${enable_sha2+y}
+then :
   enableval=$enable_sha2;
 fi
 
@@ -15432,29 +16722,29 @@ case "$enable_sha2" in
         if test "x$HAVE_SSL" != "xyes"; then
             as_fn_error $? "SHA2 enabled, but no SSL support" "$LINENO" 5
         fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SHA256 and SHA512" >&5
-$as_echo_n "checking for SHA256 and SHA512... " >&6; }
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SHA256 and SHA512" >&5
+printf %s "checking for SHA256 and SHA512... " >&6; }
 	ac_fn_c_check_func "$LINENO" "SHA256_Init" "ac_cv_func_SHA256_Init"
-if test "x$ac_cv_func_SHA256_Init" = xyes; then :
+if test "x$ac_cv_func_SHA256_Init" = xyes
+then :
 
-else
+else $as_nop
 
 		as_fn_error $? "No SHA2 functions found in OpenSSL: please upgrade OpenSSL or rerun with --disable-sha2" "$LINENO" 5
 
 fi
 
 
-cat >>confdefs.h <<_ACEOF
-#define USE_SHA2 1
-_ACEOF
+printf "%s\n" "#define USE_SHA2 1" >>confdefs.h
 
         ;;
 esac
 
-# check wether gost also works
+# check whether gost also works
 
 # Check whether --enable-gost was given.
-if test "${enable_gost+set}" = set; then :
+if test ${enable_gost+y}
+then :
   enableval=$enable_gost;
 fi
 
@@ -15464,44 +16754,59 @@ case "$enable_gost" in
     *)          if test "x$HAVE_SSL" != "xyes"; then
             as_fn_error $? "GOST enabled, but no SSL support" "$LINENO" 5
         fi
-        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GOST" >&5
-$as_echo_n "checking for GOST... " >&6; }
+        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GOST" >&5
+printf %s "checking for GOST... " >&6; }
         ac_fn_c_check_func "$LINENO" "EVP_PKEY_set_type_str" "ac_cv_func_EVP_PKEY_set_type_str"
-if test "x$ac_cv_func_EVP_PKEY_set_type_str" = xyes; then :
+if test "x$ac_cv_func_EVP_PKEY_set_type_str" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "OpenSSL >= 1.0.0 is needed for GOST support or rerun with --disable-gost" "$LINENO" 5
 fi
 
         ac_fn_c_check_func "$LINENO" "EC_KEY_new" "ac_cv_func_EC_KEY_new"
-if test "x$ac_cv_func_EC_KEY_new" = xyes; then :
+if test "x$ac_cv_func_EC_KEY_new" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "No ECC functions found in OpenSSL: please upgrade OpenSSL or rerun with --disable-gost" "$LINENO" 5
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if GOST works" >&5
-$as_echo_n "checking if GOST works... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if GOST works" >&5
+printf %s "checking if GOST works... " >&6; }
 if test c${cross_compiling} = cno; then
 BAKCFLAGS="$CFLAGS"
 if test -n "$ssldir"; then
+    if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib64"
+    else
 	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib"
+    fi
 fi
-if test "$cross_compiling" = yes; then :
-  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+if test "$cross_compiling" = yes
+then :
+  { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "cannot run test program while cross compiling
 See \`config.log' for more details" "$LINENO" 5; }
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 #include <string.h>
+#ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_EVP_H
 #include <openssl/evp.h>
+#endif
+#ifdef HAVE_OPENSSL_ENGINE_H
 #include <openssl/engine.h>
+#endif
+#ifdef HAVE_OPENSSL_CONF_H
 #include <openssl/conf.h>
+#endif
 /* routine to load gost (from sldns) */
 int load_gost_id(void)
 {
@@ -15579,9 +16884,10 @@ int main(void) {
 }
 
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+if ac_fn_c_try_run "$LINENO"
+then :
   eval "ac_cv_c_gost_works=yes"
-else
+else $as_nop
   eval "ac_cv_c_gost_works=no"
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -15594,37 +16900,39 @@ eval "ac_cv_c_gost_works=maybe"
 fi
 
 	# Check whether --enable-gost-anyway was given.
-if test "${enable_gost_anyway+set}" = set; then :
+if test ${enable_gost_anyway+y}
+then :
   enableval=$enable_gost_anyway;
 fi
 
 	if test "$ac_cv_c_gost_works" != "no" -o "$enable_gost_anyway" = "yes"; then
 		if test "$ac_cv_c_gost_works" = "no"; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no, but compiling with GOST support anyway" >&5
-$as_echo "no, but compiling with GOST support anyway" >&6; }
+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no, but compiling with GOST support anyway" >&5
+printf "%s\n" "no, but compiling with GOST support anyway" >&6; }
 		else
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 		fi
 		use_gost="yes"
 
-$as_echo "#define USE_GOST 1" >>confdefs.h
+printf "%s\n" "#define USE_GOST 1" >>confdefs.h
 
 	else
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Gost support does not work because the engine is missing." >&5
-$as_echo "$as_me: WARNING: Gost support does not work because the engine is missing." >&2;}
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&5
-$as_echo "$as_me: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&2;}
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&5
-$as_echo "$as_me: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&2;}
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Gost support does not work because the engine is missing." >&5
+printf "%s\n" "$as_me: WARNING: Gost support does not work because the engine is missing." >&2;}
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&5
+printf "%s\n" "$as_me: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&2;}
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&5
+printf "%s\n" "$as_me: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&2;}
 	fi
         ;;
 esac
 
 # Check whether --enable-ecdsa was given.
-if test "${enable_ecdsa+set}" = set; then :
+if test ${enable_ecdsa+y}
+then :
   enableval=$enable_ecdsa;
 fi
 
@@ -15635,185 +16943,199 @@ case "$enable_ecdsa" in
         as_fn_error $? "ECDSA enabled, but no SSL support" "$LINENO" 5
       fi
       ac_fn_c_check_func "$LINENO" "ECDSA_sign" "ac_cv_func_ECDSA_sign"
-if test "x$ac_cv_func_ECDSA_sign" = xyes; then :
+if test "x$ac_cv_func_ECDSA_sign" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support ECDSA: please upgrade OpenSSL or rerun with --disable-ecdsa" "$LINENO" 5
 fi
 
       ac_fn_c_check_func "$LINENO" "SHA384_Init" "ac_cv_func_SHA384_Init"
-if test "x$ac_cv_func_SHA384_Init" = xyes; then :
+if test "x$ac_cv_func_SHA384_Init" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support SHA384: please upgrade OpenSSL or rerun with --disable-ecdsa" "$LINENO" 5
 fi
 
-      ac_fn_c_check_decl "$LINENO" "NID_X9_62_prime256v1" "ac_cv_have_decl_NID_X9_62_prime256v1" "$ac_includes_default
+      ac_fn_check_decl "$LINENO" "NID_X9_62_prime256v1" "ac_cv_have_decl_NID_X9_62_prime256v1" "$ac_includes_default
 #include <openssl/evp.h>
 
-"
-if test "x$ac_cv_have_decl_NID_X9_62_prime256v1" = xyes; then :
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_NID_X9_62_prime256v1" = xyes
+then :
   ac_have_decl=1
-else
+else $as_nop
   ac_have_decl=0
 fi
+printf "%s\n" "#define HAVE_DECL_NID_X9_62_PRIME256V1 $ac_have_decl" >>confdefs.h
+if test $ac_have_decl = 1
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_NID_X9_62_PRIME256V1 $ac_have_decl
-_ACEOF
-if test $ac_have_decl = 1; then :
-
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support the ECDSA curves: please upgrade OpenSSL or rerun with --disable-ecdsa" "$LINENO" 5
 fi
-ac_fn_c_check_decl "$LINENO" "NID_secp384r1" "ac_cv_have_decl_NID_secp384r1" "$ac_includes_default
+ac_fn_check_decl "$LINENO" "NID_secp384r1" "ac_cv_have_decl_NID_secp384r1" "$ac_includes_default
 #include <openssl/evp.h>
 
-"
-if test "x$ac_cv_have_decl_NID_secp384r1" = xyes; then :
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_NID_secp384r1" = xyes
+then :
   ac_have_decl=1
-else
+else $as_nop
   ac_have_decl=0
 fi
+printf "%s\n" "#define HAVE_DECL_NID_SECP384R1 $ac_have_decl" >>confdefs.h
+if test $ac_have_decl = 1
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_NID_SECP384R1 $ac_have_decl
-_ACEOF
-if test $ac_have_decl = 1; then :
-
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support the ECDSA curves: please upgrade OpenSSL or rerun with --disable-ecdsa" "$LINENO" 5
 fi
 
       # we now know we have ECDSA and the required curves.
 
-cat >>confdefs.h <<_ACEOF
-#define USE_ECDSA 1
-_ACEOF
+printf "%s\n" "#define USE_ECDSA 1" >>confdefs.h
 
       ;;
 esac
 
 # Check whether --enable-dsa was given.
-if test "${enable_dsa+set}" = set; then :
+if test ${enable_dsa+y}
+then :
   enableval=$enable_dsa;
 fi
 
 case "$enable_dsa" in
     no)
+      ldns_build_config_use_dsa=0
+
       ;;
     *)       # detect if DSA is supported, and turn it off if not.
       ac_fn_c_check_func "$LINENO" "DSA_SIG_new" "ac_cv_func_DSA_SIG_new"
-if test "x$ac_cv_func_DSA_SIG_new" = xyes; then :
+if test "x$ac_cv_func_DSA_SIG_new" = xyes
+then :
 
 
-cat >>confdefs.h <<_ACEOF
-#define USE_DSA 1
-_ACEOF
+printf "%s\n" "#define USE_DSA 1" >>confdefs.h
 
+	ldns_build_config_use_dsa=1
 
-else
+
+else $as_nop
   if test "x$enable_dsa" = "xyes"; then as_fn_error $? "OpenSSL does not support DSA and you used --enable-dsa." "$LINENO" 5
 	  fi
+	  ldns_build_config_use_dsa=0
+
 fi
 
       ;;
 esac
 
 # Check whether --enable-ed25519 was given.
-if test "${enable_ed25519+set}" = set; then :
+if test ${enable_ed25519+y}
+then :
   enableval=$enable_ed25519;
 fi
 
 case "$enable_ed25519" in
-    yes)
-      if test "x$HAVE_SSL" != "xyes"; then
-        as_fn_error $? "ED25519 enabled, but no SSL support" "$LINENO" 5
-      fi
-      ac_fn_c_check_decl "$LINENO" "NID_X25519" "ac_cv_have_decl_NID_X25519" "$ac_includes_default
+    no)
+      ldns_build_config_use_ed25519=0
+
+      ;;
+    *)       ac_fn_check_decl "$LINENO" "NID_ED25519" "ac_cv_have_decl_NID_ED25519" "$ac_includes_default
 #include <openssl/evp.h>
 
-"
-if test "x$ac_cv_have_decl_NID_X25519" = xyes; then :
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_NID_ED25519" = xyes
+then :
   ac_have_decl=1
-else
+else $as_nop
   ac_have_decl=0
 fi
+printf "%s\n" "#define HAVE_DECL_NID_ED25519 $ac_have_decl" >>confdefs.h
+if test $ac_have_decl = 1
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_NID_X25519 $ac_have_decl
-_ACEOF
-if test $ac_have_decl = 1; then :
 
-else
-  as_fn_error $? "OpenSSL does not support the EDDSA curve: please upgrade OpenSSL or rerun with --disable-ed25519" "$LINENO" 5
-fi
+printf "%s\n" "#define USE_ED25519 1" >>confdefs.h
 
+        ldns_build_config_use_ed25519=1
 
-cat >>confdefs.h <<_ACEOF
-#define USE_ED25519 1
-_ACEOF
+
+else $as_nop
+  if test "x$enable_ed25519" = "xyes"; then as_fn_error $? "OpenSSL does not support ED25519 and you used --enable-ed25519." "$LINENO" 5
+          fi
+	  ldns_build_config_use_ed25519=0
+
+fi
 
       ;;
-    *|no)       ;;
 esac
 
 # Check whether --enable-ed448 was given.
-if test "${enable_ed448+set}" = set; then :
+if test ${enable_ed448+y}
+then :
   enableval=$enable_ed448;
 fi
 
 case "$enable_ed448" in
-    yes)
-      if test "x$HAVE_SSL" != "xyes"; then
-        as_fn_error $? "ED448 enabled, but no SSL support" "$LINENO" 5
-      fi
-      ac_fn_c_check_decl "$LINENO" "NID_X448" "ac_cv_have_decl_NID_X448" "$ac_includes_default
+    no)
+      ldns_build_config_use_ed448=0
+
+      ;;
+    *)       ac_fn_check_decl "$LINENO" "NID_ED448" "ac_cv_have_decl_NID_ED448" "$ac_includes_default
 #include <openssl/evp.h>
 
-"
-if test "x$ac_cv_have_decl_NID_X448" = xyes; then :
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_NID_ED448" = xyes
+then :
   ac_have_decl=1
-else
+else $as_nop
   ac_have_decl=0
 fi
+printf "%s\n" "#define HAVE_DECL_NID_ED448 $ac_have_decl" >>confdefs.h
+if test $ac_have_decl = 1
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_NID_X448 $ac_have_decl
-_ACEOF
-if test $ac_have_decl = 1; then :
 
-else
-  as_fn_error $? "OpenSSL does not support the EDDSA curve: please upgrade OpenSSL or rerun with --disable-ed448" "$LINENO" 5
-fi
+printf "%s\n" "#define USE_ED448 1" >>confdefs.h
 
+        ldns_build_config_use_ed448=1
 
-cat >>confdefs.h <<_ACEOF
-#define USE_ED448 1
-_ACEOF
+
+else $as_nop
+  if test "x$enable_ed448" = "xyes"; then as_fn_error $? "OpenSSL does not support ED448 and you used --enable-ed448." "$LINENO" 5
+          fi
+          ldns_build_config_use_ed448=0
+
+fi
 
       ;;
-    *|no)       ;;
 esac
 
 # Check whether --enable-dane was given.
-if test "${enable_dane+set}" = set; then :
+if test ${enable_dane+y}
+then :
   enableval=$enable_dane;
 fi
 
 # Check whether --enable-dane-verify was given.
-if test "${enable_dane_verify+set}" = set; then :
+if test ${enable_dane_verify+y}
+then :
   enableval=$enable_dane_verify;
 fi
 
 # Check whether --enable-dane-ta-usage was given.
-if test "${enable_dane_ta_usage+set}" = set; then :
+if test ${enable_dane_ta_usage+y}
+then :
   enableval=$enable_dane_ta_usage;
 fi
 
 
 # Check whether --enable-full-dane was given.
-if test "${enable_full_dane+set}" = set; then :
+if test ${enable_full_dane+y}
+then :
   enableval=$enable_full_dane;
 	enable_dane_ta_usage=yes
 	enable_dane_verify=yes
@@ -15822,7 +17144,8 @@ if test "${enable_full_dane+set}" = set; then :
 fi
 
 # Check whether --enable-no-dane-ta-usage was given.
-if test "${enable_no_dane_ta_usage+set}" = set; then :
+if test ${enable_no_dane_ta_usage+y}
+then :
   enableval=$enable_no_dane_ta_usage;
 	enable_dane_ta_usage=no
 	enable_dane_verify=yes
@@ -15831,7 +17154,8 @@ if test "${enable_no_dane_ta_usage+set}" = set; then :
 fi
 
 # Check whether --enable-no-dane-verify was given.
-if test "${enable_no_dane_verify+set}" = set; then :
+if test ${enable_no_dane_verify+y}
+then :
   enableval=$enable_no_dane_verify;
 	enable_dane_ta_usage=no
 	enable_dane_verify=no
@@ -15852,18 +17176,17 @@ case "$enable_dane" in
         as_fn_error $? "DANE enabled, but no SSL support" "$LINENO" 5
       fi
       ac_fn_c_check_func "$LINENO" "X509_check_ca" "ac_cv_func_X509_check_ca"
-if test "x$ac_cv_func_X509_check_ca" = xyes; then :
+if test "x$ac_cv_func_X509_check_ca" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support DANE: please upgrade OpenSSL or rerun with --disable-dane" "$LINENO" 5
 fi
 
       ldns_build_config_use_dane=1
 
 
-cat >>confdefs.h <<_ACEOF
-#define USE_DANE 1
-_ACEOF
+printf "%s\n" "#define USE_DANE 1" >>confdefs.h
 
       case "$enable_dane_verify" in
           no)
@@ -15876,30 +17199,29 @@ _ACEOF
 	    ldns_build_config_use_dane_verify=1
 
 
-cat >>confdefs.h <<_ACEOF
-#define USE_DANE_VERIFY 1
-_ACEOF
+printf "%s\n" "#define USE_DANE_VERIFY 1" >>confdefs.h
 
             case "$enable_dane_ta_usage" in
                 no)
                   ldns_build_config_use_dane_ta_usage=0
 
                   ;;
-                *)       	    LIBS="-lssl $LIBS"
+                *) 		  danetmpLIBS="$LIBS"
+                  LIBS="-lssl -lcrypto $LIBS"
                   ac_fn_c_check_func "$LINENO" "SSL_get0_dane" "ac_cv_func_SSL_get0_dane"
-if test "x$ac_cv_func_SSL_get0_dane" = xyes; then :
+if test "x$ac_cv_func_SSL_get0_dane" = xyes
+then :
 
-else
+else $as_nop
   as_fn_error $? "OpenSSL does not support offline DANE verification (Needed for the DANE-TA usage type).  Please upgrade OpenSSL to version >= 1.1.0 or rerun with --disable-dane-verify or --disable-dane-ta-usage" "$LINENO" 5
 fi
 
-                  LIBSSL_LIBS="$LIBSSL_LIBS -lssl"
+                  LIBSSL_LIBS="-lssl $LIBSSL_LIBS"
+		  LIBS="$danetmpLIBS"
                   ldns_build_config_use_dane_ta_usage=1
 
 
-cat >>confdefs.h <<_ACEOF
-#define USE_DANE_TA_USAGE 1
-_ACEOF
+printf "%s\n" "#define USE_DANE_TA_USAGE 1" >>confdefs.h
 
                   ;;
             esac
@@ -15908,39 +17230,38 @@ _ACEOF
 esac
 
 # Check whether --enable-rrtype-ninfo was given.
-if test "${enable_rrtype_ninfo+set}" = set; then :
+if test ${enable_rrtype_ninfo+y}
+then :
   enableval=$enable_rrtype_ninfo;
 fi
 
 case "$enable_rrtype_ninfo" in
 	yes)
 
-cat >>confdefs.h <<_ACEOF
-#define RRTYPE_NINFO /**/
-_ACEOF
+printf "%s\n" "#define RRTYPE_NINFO /**/" >>confdefs.h
 
 		;;
 	no|*)
 		;;
 esac
 # Check whether --enable-rrtype-rkey was given.
-if test "${enable_rrtype_rkey+set}" = set; then :
+if test ${enable_rrtype_rkey+y}
+then :
   enableval=$enable_rrtype_rkey;
 fi
 
 case "$enable_rrtype_rkey" in
 	yes)
 
-cat >>confdefs.h <<_ACEOF
-#define RRTYPE_RKEY /**/
-_ACEOF
+printf "%s\n" "#define RRTYPE_RKEY /**/" >>confdefs.h
 
 		;;
 	no|*)
 		;;
 esac
 # Check whether --enable-rrtype-openpgpkey was given.
-if test "${enable_rrtype_openpgpkey+set}" = set; then :
+if test ${enable_rrtype_openpgpkey+y}
+then :
   enableval=$enable_rrtype_openpgpkey;
 fi
 
@@ -15949,50 +17270,98 @@ case "$enable_rrtype_openpgpkey" in
 		;;
 	yes|*)
 
-cat >>confdefs.h <<_ACEOF
-#define RRTYPE_OPENPGPKEY /**/
-_ACEOF
+printf "%s\n" "#define RRTYPE_OPENPGPKEY /**/" >>confdefs.h
 
 		;;
 esac
 # Check whether --enable-rrtype-ta was given.
-if test "${enable_rrtype_ta+set}" = set; then :
+if test ${enable_rrtype_ta+y}
+then :
   enableval=$enable_rrtype_ta;
 fi
 
 case "$enable_rrtype_ta" in
 	yes)
 
-cat >>confdefs.h <<_ACEOF
-#define RRTYPE_TA /**/
-_ACEOF
+printf "%s\n" "#define RRTYPE_TA /**/" >>confdefs.h
 
 		;;
 	no|*)
 		;;
 esac
 # Check whether --enable-rrtype-avc was given.
-if test "${enable_rrtype_avc+set}" = set; then :
+if test ${enable_rrtype_avc+y}
+then :
   enableval=$enable_rrtype_avc;
 fi
 
 case "$enable_rrtype_avc" in
 	yes)
 
-cat >>confdefs.h <<_ACEOF
-#define RRTYPE_AVC /**/
-_ACEOF
+printf "%s\n" "#define RRTYPE_AVC /**/" >>confdefs.h
+
+		;;
+	no|*)
+		;;
+esac
+# Check whether --enable-rrtype-doa was given.
+if test ${enable_rrtype_doa+y}
+then :
+  enableval=$enable_rrtype_doa;
+fi
+
+case "$enable_rrtype_doa" in
+	yes)
+
+printf "%s\n" "#define RRTYPE_DOA /**/" >>confdefs.h
+
+		;;
+	no|*)
+		;;
+esac
+# Check whether --enable-rrtype-amtrelay was given.
+if test ${enable_rrtype_amtrelay+y}
+then :
+  enableval=$enable_rrtype_amtrelay;
+fi
+
+case "$enable_rrtype_amtrelay" in
+	yes)
+
+printf "%s\n" "#define RRTYPE_AMTRELAY /**/" >>confdefs.h
 
 		;;
 	no|*)
 		;;
 esac
+# Check whether --enable-rrtype-svcb-https was given.
+if test ${enable_rrtype_svcb_https+y}
+then :
+  enableval=$enable_rrtype_svcb_https;
+fi
+
+case "$enable_rrtype_svcb_https" in
+	no)
+		;;
+	yes|*)
+
+printf "%s\n" "#define RRTYPE_SVCB_HTTPS /**/" >>confdefs.h
+
+		;;
+esac
+
+
 
 
 
 
 if test "x$HAVE_SSL" = "xyes"; then
-LIBSSL_SSL_LIBS="-lssl $LIBSSL_LIBS"
+    if echo "$LIBSSL_LIBS" | grep -- "-lssl" >/dev/null 2>&1; then
+	LIBSSL_SSL_LIBS="$LIBSSL_LIBS"
+    else
+	LIBSSL_SSL_LIBS="-lssl $LIBSSL_LIBS"
+    fi
+    LIBSSL_SSL_LIBS="$LIBSSL_SSL_LIBS"
 
 fi
 CPPFLAGS=$tmp_CPPFLAGS
@@ -16003,9 +17372,10 @@ LIBS=$tmp_LIBS
 # add option to disable the evil rpath
 
 # Check whether --enable-rpath was given.
-if test "${enable_rpath+set}" = set; then :
+if test ${enable_rpath+y}
+then :
   enableval=$enable_rpath; enable_rpath=$enableval
-else
+else $as_nop
   enable_rpath=yes
 fi
 
@@ -16031,11 +17401,12 @@ fi
 #],[])
 
 # should define WORDS_BIGENDIAN if the system is big-endian
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether byte ordering is bigendian" >&5
-$as_echo_n "checking whether byte ordering is bigendian... " >&6; }
-if ${ac_cv_c_bigendian+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether byte ordering is bigendian" >&5
+printf %s "checking whether byte ordering is bigendian... " >&6; }
+if test ${ac_cv_c_bigendian+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_cv_c_bigendian=unknown
     # See if we're dealing with a universal compiler.
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -16046,7 +17417,8 @@ else
 	     typedef int dummy;
 
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
 	# Check for potential -arch flags.  It is not universal unless
 	# there are at least two -arch flags with different values.
@@ -16070,7 +17442,7 @@ if ac_fn_c_try_compile "$LINENO"; then :
 	 fi
        done
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
     if test $ac_cv_c_bigendian = unknown; then
       # See if sys/param.h defines the BYTE_ORDER macro.
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -16079,7 +17451,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 	     #include <sys/param.h>
 
 int
-main ()
+main (void)
 {
 #if ! (defined BYTE_ORDER && defined BIG_ENDIAN \
 		     && defined LITTLE_ENDIAN && BYTE_ORDER && BIG_ENDIAN \
@@ -16091,7 +17463,8 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   # It does; now see whether it defined to BIG_ENDIAN or not.
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -16099,7 +17472,7 @@ if ac_fn_c_try_compile "$LINENO"; then :
 		#include <sys/param.h>
 
 int
-main ()
+main (void)
 {
 #if BYTE_ORDER != BIG_ENDIAN
 		 not big endian
@@ -16109,14 +17482,15 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_bigendian=yes
-else
+else $as_nop
   ac_cv_c_bigendian=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
     fi
     if test $ac_cv_c_bigendian = unknown; then
       # See if <limits.h> defines _LITTLE_ENDIAN or _BIG_ENDIAN (e.g., Solaris).
@@ -16125,7 +17499,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 #include <limits.h>
 
 int
-main ()
+main (void)
 {
 #if ! (defined _LITTLE_ENDIAN || defined _BIG_ENDIAN)
 	      bogus endian macros
@@ -16135,14 +17509,15 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   # It does; now see whether it defined to _BIG_ENDIAN or not.
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <limits.h>
 
 int
-main ()
+main (void)
 {
 #ifndef _BIG_ENDIAN
 		 not big endian
@@ -16152,31 +17527,33 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_bigendian=yes
-else
+else $as_nop
   ac_cv_c_bigendian=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
     fi
     if test $ac_cv_c_bigendian = unknown; then
       # Compile a test program.
-      if test "$cross_compiling" = yes; then :
+      if test "$cross_compiling" = yes
+then :
   # Try to guess by grepping values from an object file.
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-short int ascii_mm[] =
+unsigned short int ascii_mm[] =
 		  { 0x4249, 0x4765, 0x6E44, 0x6961, 0x6E53, 0x7953, 0 };
-		short int ascii_ii[] =
+		unsigned short int ascii_ii[] =
 		  { 0x694C, 0x5454, 0x656C, 0x6E45, 0x6944, 0x6E61, 0 };
 		int use_ascii (int i) {
 		  return ascii_mm[i] + ascii_ii[i];
 		}
-		short int ebcdic_ii[] =
+		unsigned short int ebcdic_ii[] =
 		  { 0x89D3, 0xE3E3, 0x8593, 0x95C5, 0x89C4, 0x9581, 0 };
-		short int ebcdic_mm[] =
+		unsigned short int ebcdic_mm[] =
 		  { 0xC2C9, 0xC785, 0x95C4, 0x8981, 0x95E2, 0xA8E2, 0 };
 		int use_ebcdic (int i) {
 		  return ebcdic_mm[i] + ebcdic_ii[i];
@@ -16184,14 +17561,15 @@ short int ascii_mm[] =
 		extern int foo;
 
 int
-main ()
+main (void)
 {
 return use_ascii (foo) == use_ebcdic (foo);
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   if grep BIGenDianSyS conftest.$ac_objext >/dev/null; then
 	      ac_cv_c_bigendian=yes
 	    fi
@@ -16204,13 +17582,13 @@ if ac_fn_c_try_compile "$LINENO"; then :
 	      fi
 	    fi
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-else
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $ac_includes_default
 int
-main ()
+main (void)
 {
 
 	     /* Are we little or big endian?  From Harbison&Steele.  */
@@ -16226,9 +17604,10 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+if ac_fn_c_try_run "$LINENO"
+then :
   ac_cv_c_bigendian=no
-else
+else $as_nop
   ac_cv_c_bigendian=yes
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -16237,17 +17616,17 @@ fi
 
     fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_bigendian" >&5
-$as_echo "$ac_cv_c_bigendian" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_bigendian" >&5
+printf "%s\n" "$ac_cv_c_bigendian" >&6; }
  case $ac_cv_c_bigendian in #(
    yes)
-     $as_echo "#define WORDS_BIGENDIAN 1" >>confdefs.h
+     printf "%s\n" "#define WORDS_BIGENDIAN 1" >>confdefs.h
 ;; #(
    no)
       ;; #(
    universal)
 
-$as_echo "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h
+printf "%s\n" "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h
 
      ;; #(
    *)
@@ -16257,232 +17636,279 @@ $as_echo "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h
 
 
 # Checks for header files.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
-$as_echo_n "checking for ANSI C header files... " >&6; }
-if ${ac_cv_header_stdc+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <float.h>
-
-int
-main ()
-{
+# Autoupdate added the next two lines to ensure that your configure
+# script's behavior did not change.  They are probably safe to remove.
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
+printf %s "checking for egrep... " >&6; }
+if test ${ac_cv_path_EGREP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
+   then ac_cv_path_EGREP="$GREP -E"
+   else
+     if test -z "$EGREP"; then
+  ac_path_EGREP_found=false
+  # Loop through the user's path and test for each of PROGNAME-LIST
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_prog in egrep
+   do
+    for ac_exec_ext in '' $ac_executable_extensions; do
+      ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext"
+      as_fn_executable_p "$ac_path_EGREP" || continue
+# Check for GNU ac_path_EGREP and select it if it is found.
+  # Check for GNU $ac_path_EGREP
+case `"$ac_path_EGREP" --version 2>&1` in
+*GNU*)
+  ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
+*)
+  ac_count=0
+  printf %s 0123456789 >"conftest.in"
+  while :
+  do
+    cat "conftest.in" "conftest.in" >"conftest.tmp"
+    mv "conftest.tmp" "conftest.in"
+    cp "conftest.in" "conftest.nl"
+    printf "%s\n" 'EGREP' >> "conftest.nl"
+    "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
+    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
+    as_fn_arith $ac_count + 1 && ac_count=$as_val
+    if test $ac_count -gt ${ac_path_EGREP_max-0}; then
+      # Best one so far, save it but keep looking for a better one
+      ac_cv_path_EGREP="$ac_path_EGREP"
+      ac_path_EGREP_max=$ac_count
+    fi
+    # 10*(2^10) chars as input seems more than enough
+    test $ac_count -gt 10 && break
+  done
+  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
+esac
 
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_header_stdc=yes
+      $ac_path_EGREP_found && break 3
+    done
+  done
+  done
+IFS=$as_save_IFS
+  if test -z "$ac_cv_path_EGREP"; then
+    as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+  fi
 else
-  ac_cv_header_stdc=no
+  ac_cv_path_EGREP=$EGREP
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
-if test $ac_cv_header_stdc = yes; then
-  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <string.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "memchr" >/dev/null 2>&1; then :
 
-else
-  ac_cv_header_stdc=no
+   fi
 fi
-rm -f conftest*
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
+printf "%s\n" "$ac_cv_path_EGREP" >&6; }
+ EGREP="$ac_cv_path_EGREP"
 
-fi
 
-if test $ac_cv_header_stdc = yes; then
-  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdlib.h>
 
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "free" >/dev/null 2>&1; then :
+ac_fn_c_check_type "$LINENO" "_Bool" "ac_cv_type__Bool" "$ac_includes_default"
+if test "x$ac_cv_type__Bool" = xyes
+then :
+
+printf "%s\n" "#define HAVE__BOOL 1" >>confdefs.h
 
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
 
 fi
 
-if test $ac_cv_header_stdc = yes; then
-  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
-  if test "$cross_compiling" = yes; then :
-  :
-else
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for stdbool.h that conforms to C99" >&5
+printf %s "checking for stdbool.h that conforms to C99... " >&6; }
+if test ${ac_cv_header_stdbool_h+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <ctype.h>
-#include <stdlib.h>
-#if ((' ' & 0x0FF) == 0x020)
-# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
-# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
-#else
-# define ISLOWER(c) \
-		   (('a' <= (c) && (c) <= 'i') \
-		     || ('j' <= (c) && (c) <= 'r') \
-		     || ('s' <= (c) && (c) <= 'z'))
-# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
-#endif
-
-#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
-int
-main ()
-{
-  int i;
-  for (i = 0; i < 256; i++)
-    if (XOR (islower (i), ISLOWER (i))
-	|| toupper (i) != TOUPPER (i))
-      return 2;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-
-else
-  ac_cv_header_stdc=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-fi
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
-$as_echo "$ac_cv_header_stdc" >&6; }
-if test $ac_cv_header_stdc = yes; then
-
-$as_echo "#define STDC_HEADERS 1" >>confdefs.h
+#include <stdbool.h>
 
-fi
+             #ifndef __bool_true_false_are_defined
+               #error "__bool_true_false_are_defined is not defined"
+             #endif
+             char a[__bool_true_false_are_defined == 1 ? 1 : -1];
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdbool.h that conforms to C99" >&5
-$as_echo_n "checking for stdbool.h that conforms to C99... " >&6; }
-if ${ac_cv_header_stdbool_h+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
+             /* Regardless of whether this is C++ or "_Bool" is a
+                valid type name, "true" and "false" should be usable
+                in #if expressions and integer constant expressions,
+                and "bool" should be a valid type name.  */
 
-             #include <stdbool.h>
-             #ifndef bool
-              "error: bool is not defined"
+             #if !true
+               #error "'true' is not true"
              #endif
-             #ifndef false
-              "error: false is not defined"
+             #if true != 1
+               #error "'true' is not equal to 1"
              #endif
+             char b[true == 1 ? 1 : -1];
+             char c[true];
+
              #if false
-              "error: false is not 0"
-             #endif
-             #ifndef true
-              "error: true is not defined"
-             #endif
-             #if true != 1
-              "error: true is not 1"
+               #error "'false' is not false"
              #endif
-             #ifndef __bool_true_false_are_defined
-              "error: __bool_true_false_are_defined is not defined"
+             #if false != 0
+               #error "'false' is not equal to 0"
              #endif
+             char d[false == 0 ? 1 : -1];
+
+             enum { e = false, f = true, g = false * true, h = true * 256 };
+
+             char i[(bool) 0.5 == true ? 1 : -1];
+             char j[(bool) 0.0 == false ? 1 : -1];
+             char k[sizeof (bool) > 0 ? 1 : -1];
+
+             struct sb { bool s: 1; bool t; } s;
+             char l[sizeof s.t > 0 ? 1 : -1];
 
-             struct s { _Bool s: 1; _Bool t; } s;
-
-             char a[true == 1 ? 1 : -1];
-             char b[false == 0 ? 1 : -1];
-             char c[__bool_true_false_are_defined == 1 ? 1 : -1];
-             char d[(bool) 0.5 == true ? 1 : -1];
-             /* See body of main program for 'e'.  */
-             char f[(_Bool) 0.0 == false ? 1 : -1];
-             char g[true];
-             char h[sizeof (_Bool)];
-             char i[sizeof s.t];
-             enum { j = false, k = true, l = false * true, m = true * 256 };
              /* The following fails for
                 HP aC++/ANSI C B3910B A.05.55 [Dec 04 2003]. */
-             _Bool n[m];
-             char o[sizeof n == m * sizeof n[0] ? 1 : -1];
-             char p[-1 - (_Bool) 0 < 0 && -1 - (bool) 0 < 0 ? 1 : -1];
+             bool m[h];
+             char n[sizeof m == h * sizeof m[0] ? 1 : -1];
+             char o[-1 - (bool) 0 < 0 ? 1 : -1];
              /* Catch a bug in an HP-UX C compiler.  See
-                http://gcc.gnu.org/ml/gcc-patches/2003-12/msg02303.html
-                http://lists.gnu.org/archive/html/bug-coreutils/2005-11/msg00161.html
+         https://gcc.gnu.org/ml/gcc-patches/2003-12/msg02303.html
+         https://lists.gnu.org/archive/html/bug-coreutils/2005-11/msg00161.html
               */
-             _Bool q = true;
-             _Bool *pq = &q;
+             bool p = true;
+             bool *pp = &p;
+
+             /* C 1999 specifies that bool, true, and false are to be
+                macros, but C++ 2011 and later overrule this.  */
+             #if __cplusplus < 201103
+              #ifndef bool
+               #error "bool is not defined"
+              #endif
+              #ifndef false
+               #error "false is not defined"
+              #endif
+              #ifndef true
+               #error "true is not defined"
+              #endif
+             #endif
+
+             /* If _Bool is available, repeat with it all the tests
+                above that used bool.  */
+             #ifdef HAVE__BOOL
+               struct sB { _Bool s: 1; _Bool t; } t;
+
+               char q[(_Bool) 0.5 == true ? 1 : -1];
+               char r[(_Bool) 0.0 == false ? 1 : -1];
+               char u[sizeof (_Bool) > 0 ? 1 : -1];
+               char v[sizeof t.t > 0 ? 1 : -1];
+
+               _Bool w[h];
+               char x[sizeof m == h * sizeof m[0] ? 1 : -1];
+               char y[-1 - (_Bool) 0 < 0 ? 1 : -1];
+               _Bool z = true;
+               _Bool *pz = &p;
+             #endif
 
 int
-main ()
+main (void)
 {
 
-             bool e = &s;
-             *pq |= q;
-             *pq |= ! q;
-             /* Refer to every declared value, to avoid compiler optimizations.  */
-             return (!a + !b + !c + !d + !e + !f + !g + !h + !i + !!j + !k + !!l
-                     + !m + !n + !o + !p + !q + !pq);
+             bool ps = &s;
+             *pp |= p;
+             *pp |= ! p;
+
+             #ifdef HAVE__BOOL
+               _Bool pt = &t;
+               *pz |= z;
+               *pz |= ! z;
+             #endif
+
+             /* Refer to every declared value, so they cannot be
+                discarded as unused.  */
+             return (!a + !b + !c + !d + !e + !f + !g + !h + !i + !j + !k
+                     + !l + !m + !n + !o + !p + !pp + !ps
+             #ifdef HAVE__BOOL
+                     + !q + !r + !u + !v + !w + !x + !y + !z + !pt
+             #endif
+                    );
 
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_header_stdbool_h=yes
-else
+else $as_nop
   ac_cv_header_stdbool_h=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdbool_h" >&5
-$as_echo "$ac_cv_header_stdbool_h" >&6; }
-   ac_fn_c_check_type "$LINENO" "_Bool" "ac_cv_type__Bool" "$ac_includes_default"
-if test "x$ac_cv_type__Bool" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdbool_h" >&5
+printf "%s\n" "$ac_cv_header_stdbool_h" >&6; }
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE__BOOL 1
-_ACEOF
+if test $ac_cv_header_stdbool_h = yes; then
 
+printf "%s\n" "#define HAVE_STDBOOL_H 1" >>confdefs.h
 
 fi
 
+#AC_HEADER_SYS_WAIT
+#AC_CHECK_HEADERS([getopt.h fcntl.h stdlib.h string.h strings.h unistd.h])
+# do the very minimum - we can always extend this
+ac_fn_c_check_header_compile "$LINENO" "getopt.h" "ac_cv_header_getopt_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_getopt_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_GETOPT_H 1" >>confdefs.h
 
-if test $ac_cv_header_stdbool_h = yes; then
+fi
+ac_fn_c_check_header_compile "$LINENO" "stdarg.h" "ac_cv_header_stdarg_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_stdarg_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_STDARG_H 1" >>confdefs.h
 
-$as_echo "#define HAVE_STDBOOL_H 1" >>confdefs.h
+fi
+ac_fn_c_check_header_compile "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_openssl_ssl_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "netinet/in.h" "ac_cv_header_netinet_in_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_netinet_in_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IN_H 1" >>confdefs.h
 
-#AC_HEADER_SYS_WAIT
-#AC_CHECK_HEADERS([getopt.h fcntl.h stdlib.h string.h strings.h unistd.h])
-# do the very minimum - we can always extend this
-for ac_header in getopt.h stdarg.h openssl/ssl.h netinet/in.h time.h arpa/inet.h netdb.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+fi
+ac_fn_c_check_header_compile "$LINENO" "time.h" "ac_cv_header_time_h" "$ac_includes_default
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_time_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_TIME_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "arpa/inet.h" "ac_cv_header_arpa_inet_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_arpa_inet_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_ARPA_INET_H 1" >>confdefs.h
 
-done
+fi
+ac_fn_c_check_header_compile "$LINENO" "netdb.h" "ac_cv_header_netdb_h" "$ac_includes_default
+"
+if test "x$ac_cv_header_netdb_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETDB_H 1" >>confdefs.h
+
+fi
 
-for ac_header in sys/param.h sys/mount.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "sys/param.h" "ac_cv_header_sys_param_h" "$ac_includes_default
 
    #if HAVE_SYS_PARAM_H
    # include <sys/param.h>
@@ -16490,14 +17916,24 @@ ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_include
 
 
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_sys_param_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_SYS_PARAM_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "sys/mount.h" "ac_cv_header_sys_mount_h" "$ac_includes_default
 
-done
+   #if HAVE_SYS_PARAM_H
+   # include <sys/param.h>
+   #endif
+
+
+"
+if test "x$ac_cv_header_sys_mount_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_SYS_MOUNT_H 1" >>confdefs.h
+
+fi
 
 ac_fn_c_check_header_compile "$LINENO" "sys/socket.h" "ac_cv_header_sys_socket_h" "$ac_includes_default
 
@@ -16507,34 +17943,35 @@ ac_fn_c_check_header_compile "$LINENO" "sys/socket.h" "ac_cv_header_sys_socket_h
 
 
 "
-if test "x$ac_cv_header_sys_socket_h" = xyes; then :
+if test "x$ac_cv_header_sys_socket_h" = xyes
+then :
 
 include_sys_socket_h='#include <sys/socket.h>'
 
-$as_echo "#define HAVE_SYS_SOCKET_H 1" >>confdefs.h
+printf "%s\n" "#define HAVE_SYS_SOCKET_H 1" >>confdefs.h
 
 
-else
+else $as_nop
 
 include_sys_socket_h=''
 
 fi
 
 
-
 ac_fn_c_check_header_compile "$LINENO" "inttypes.h" "ac_cv_header_inttypes_h" "$ac_includes_default
 
 "
-if test "x$ac_cv_header_inttypes_h" = xyes; then :
+if test "x$ac_cv_header_inttypes_h" = xyes
+then :
 
 include_inttypes_h='#include <inttypes.h>'
 
-$as_echo "#define HAVE_INTTYPES_H 1" >>confdefs.h
+printf "%s\n" "#define HAVE_INTTYPES_H 1" >>confdefs.h
 
 ldns_build_config_have_inttypes_h=1
 
 
-else
+else $as_nop
 
 include_inttypes_h=''
 ldns_build_config_have_inttypes_h=0
@@ -16543,36 +17980,36 @@ ldns_build_config_have_inttypes_h=0
 fi
 
 
-
 ac_fn_c_check_header_compile "$LINENO" "sys/types.h" "ac_cv_header_sys_types_h" "$ac_includes_default
 
 "
-if test "x$ac_cv_header_sys_types_h" = xyes; then :
+if test "x$ac_cv_header_sys_types_h" = xyes
+then :
 
 include_systypes_h='#include <sys/types.h>'
 
-$as_echo "#define HAVE_SYS_TYPES_H 1" >>confdefs.h
+printf "%s\n" "#define HAVE_SYS_TYPES_H 1" >>confdefs.h
 
 
-else
+else $as_nop
 
 include_systypes_h=''
 
 fi
 
 
-
 ac_fn_c_check_header_compile "$LINENO" "unistd.h" "ac_cv_header_unistd_h" "$ac_includes_default
 
 "
-if test "x$ac_cv_header_unistd_h" = xyes; then :
+if test "x$ac_cv_header_unistd_h" = xyes
+then :
 
 include_unistd_h='#include <unistd.h>'
 
-$as_echo "#define HAVE_UNISTD_H 1" >>confdefs.h
+printf "%s\n" "#define HAVE_UNISTD_H 1" >>confdefs.h
 
 
-else
+else $as_nop
 
 include_unistd_h=''
 
@@ -16580,16 +18017,16 @@ fi
 
 
 
-
 # The cast to long int works around a bug in the HP C Compiler
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
 # This bug is HP SR number 8606223364.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of time_t" >&5
-$as_echo_n "checking size of time_t... " >&6; }
-if ${ac_cv_sizeof_time_t+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking size of time_t" >&5
+printf %s "checking size of time_t... " >&6; }
+if test ${ac_cv_sizeof_time_t+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (time_t))" "ac_cv_sizeof_time_t"        "
 $ac_includes_default
 #ifdef TIME_WITH_SYS_TIME
@@ -16603,12 +18040,13 @@ $ac_includes_default
 # endif
 #endif
 
-"; then :
+"
+then :
 
-else
+else $as_nop
   if test "$ac_cv_type_time_t" = yes; then
-     { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+     { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error 77 "cannot compute sizeof (time_t)
 See \`config.log' for more details" "$LINENO" 5; }
    else
@@ -16617,36 +18055,30 @@ See \`config.log' for more details" "$LINENO" 5; }
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_time_t" >&5
-$as_echo "$ac_cv_sizeof_time_t" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_time_t" >&5
+printf "%s\n" "$ac_cv_sizeof_time_t" >&6; }
 
 
 
-cat >>confdefs.h <<_ACEOF
-#define SIZEOF_TIME_T $ac_cv_sizeof_time_t
-_ACEOF
+printf "%s\n" "#define SIZEOF_TIME_T $ac_cv_sizeof_time_t" >>confdefs.h
 
 
 
 if test x_$with_examples != x_no; then
-for ac_header in pcap.h
-do :
-  ac_fn_c_check_header_compile "$LINENO" "pcap.h" "ac_cv_header_pcap_h" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "pcap.h" "ac_cv_header_pcap_h" "$ac_includes_default
 "
-if test "x$ac_cv_header_pcap_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_PCAP_H 1
-_ACEOF
+if test "x$ac_cv_header_pcap_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_PCAP_H 1" >>confdefs.h
 
 fi
 
-done
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcap_open_offline in -lpcap" >&5
-$as_echo_n "checking for pcap_open_offline in -lpcap... " >&6; }
-if ${ac_cv_lib_pcap_pcap_open_offline+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pcap_open_offline in -lpcap" >&5
+printf %s "checking for pcap_open_offline in -lpcap... " >&6; }
+if test ${ac_cv_lib_pcap_pcap_open_offline+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpcap  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -16655,48 +18087,44 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
    builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
 char pcap_open_offline ();
 int
-main ()
+main (void)
 {
 return pcap_open_offline ();
   ;
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_lib_pcap_pcap_open_offline=yes
-else
+else $as_nop
   ac_cv_lib_pcap_pcap_open_offline=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcap_pcap_open_offline" >&5
-$as_echo "$ac_cv_lib_pcap_pcap_open_offline" >&6; }
-if test "x$ac_cv_lib_pcap_pcap_open_offline" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcap_pcap_open_offline" >&5
+printf "%s\n" "$ac_cv_lib_pcap_pcap_open_offline" >&6; }
+if test "x$ac_cv_lib_pcap_pcap_open_offline" = xyes
+then :
 
 
-$as_echo "#define HAVE_LIBPCAP 1" >>confdefs.h
+printf "%s\n" "#define HAVE_LIBPCAP 1" >>confdefs.h
 	LIBPCAP_LIBS=-lpcap
 
 
-else
+else $as_nop
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Can't find pcap library (needed for ldns-dpa, will not build dpa now.)" >&5
-$as_echo "$as_me: WARNING: Can't find pcap library (needed for ldns-dpa, will not build dpa now.)" >&2;}
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Can't find pcap library (needed for ldns-dpa, will not build dpa now.)" >&5
+printf "%s\n" "$as_me: WARNING: Can't find pcap library (needed for ldns-dpa, will not build dpa now.)" >&2;}
 
 
 fi
 
-for ac_header in netinet/in_systm.h net/if.h netinet/ip.h netinet/udp.h netinet/igmp.h netinet/if_ether.h netinet/ip6.h net/ethernet.h netinet/ip_compat.h
-do :
-  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "
+ac_fn_c_check_header_compile "$LINENO" "netinet/in_systm.h" "ac_cv_header_netinet_in_systm_h" "
 $ac_includes_default
 #ifdef HAVE_NETINET_IN_SYSTM_H
 #include <netinet/in_systm.h>
@@ -16711,294 +18139,323 @@ $ac_includes_default
 #include <net/if.h>
 #endif
 "
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+if test "x$ac_cv_header_netinet_in_systm_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IN_SYSTM_H 1" >>confdefs.h
 
 fi
-
-done
-
-fi
-
-
-ac_fn_c_check_type "$LINENO" "socklen_t" "ac_cv_type_socklen_t" "
+ac_fn_c_check_header_compile "$LINENO" "net/if.h" "ac_cv_header_net_if_h" "
 $ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
 #ifdef HAVE_SYS_SOCKET_H
-#  include <sys/socket.h>
+#include <sys/socket.h>
 #endif
-#ifdef HAVE_WS2TCPIP_H
-#  include <ws2tcpip.h>
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
 #endif
-
 "
-if test "x$ac_cv_type_socklen_t" = xyes; then :
-
-else
-
-$as_echo "#define socklen_t int" >>confdefs.h
-
-fi
-
-if test "x$ac_cv_type_socklen_t" = xyes; then
-  ldns_build_config_have_socklen_t=1
-
-else
-  ldns_build_config_have_socklen_t=0
+if test "x$ac_cv_header_net_if_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NET_IF_H 1" >>confdefs.h
 
 fi
-ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default"
-if test "x$ac_cv_type_size_t" = xyes; then :
-
-else
-
-cat >>confdefs.h <<_ACEOF
-#define size_t unsigned int
-_ACEOF
+ac_fn_c_check_header_compile "$LINENO" "netinet/ip.h" "ac_cv_header_netinet_ip_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
+"
+if test "x$ac_cv_header_netinet_ip_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IP_H 1" >>confdefs.h
 
 fi
-
-ac_fn_c_check_type "$LINENO" "ssize_t" "ac_cv_type_ssize_t" "$ac_includes_default"
-if test "x$ac_cv_type_ssize_t" = xyes; then :
-
-else
-
-cat >>confdefs.h <<_ACEOF
-#define ssize_t int
-_ACEOF
+ac_fn_c_check_header_compile "$LINENO" "netinet/udp.h" "ac_cv_header_netinet_udp_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
+"
+if test "x$ac_cv_header_netinet_udp_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_UDP_H 1" >>confdefs.h
 
 fi
-
-ac_fn_c_check_type "$LINENO" "intptr_t" "ac_cv_type_intptr_t" "$ac_includes_default"
-if test "x$ac_cv_type_intptr_t" = xyes; then :
-
-else
-
-cat >>confdefs.h <<_ACEOF
-#define intptr_t size_t
-_ACEOF
+ac_fn_c_check_header_compile "$LINENO" "netinet/igmp.h" "ac_cv_header_netinet_igmp_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
+"
+if test "x$ac_cv_header_netinet_igmp_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IGMP_H 1" >>confdefs.h
 
 fi
-
-ac_fn_c_check_type "$LINENO" "in_addr_t" "ac_cv_type_in_addr_t" "
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
+ac_fn_c_check_header_compile "$LINENO" "netinet/if_ether.h" "ac_cv_header_netinet_if_ether_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
 #endif
-#if HAVE_NETINET_IN_H
-# include <netinet/in.h>
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
 #endif
 "
-if test "x$ac_cv_type_in_addr_t" = xyes; then :
-
-else
-
-$as_echo "#define in_addr_t uint32_t" >>confdefs.h
+if test "x$ac_cv_header_netinet_if_ether_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IF_ETHER_H 1" >>confdefs.h
 
 fi
-
-ac_fn_c_check_type "$LINENO" "in_port_t" "ac_cv_type_in_port_t" "
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
+ac_fn_c_check_header_compile "$LINENO" "netinet/ip6.h" "ac_cv_header_netinet_ip6_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
 #endif
-#if HAVE_NETINET_IN_H
-# include <netinet/in.h>
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
 #endif
 "
-if test "x$ac_cv_type_in_port_t" = xyes; then :
-
-else
-
-$as_echo "#define in_port_t uint16_t" >>confdefs.h
+if test "x$ac_cv_header_netinet_ip6_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IP6_H 1" >>confdefs.h
 
 fi
-
-ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "ss_family" "ac_cv_member_struct_sockaddr_storage_ss_family" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "net/ethernet.h" "ac_cv_header_net_ethernet_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
 #endif
-
 "
-if test "x$ac_cv_member_struct_sockaddr_storage_ss_family" = xyes; then :
+if test "x$ac_cv_header_net_ethernet_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NET_ETHERNET_H 1" >>confdefs.h
 
-else
-
-        ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "__ss_family" "ac_cv_member_struct_sockaddr_storage___ss_family" "$ac_includes_default
+fi
+ac_fn_c_check_header_compile "$LINENO" "netinet/ip_compat.h" "ac_cv_header_netinet_ip_compat_h" "
+$ac_includes_default
+#ifdef HAVE_NETINET_IN_SYSTM_H
+#include <netinet/in_systm.h>
+#endif
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
 #endif
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
 #endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
+"
+if test "x$ac_cv_header_netinet_ip_compat_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NETINET_IP_COMPAT_H 1" >>confdefs.h
+
+fi
+
+fi
+
+
+ac_fn_c_check_type "$LINENO" "socklen_t" "ac_cv_type_socklen_t" "
+$ac_includes_default
+#ifdef HAVE_SYS_SOCKET_H
+#  include <sys/socket.h>
+#endif
+#ifdef HAVE_WS2TCPIP_H
+#  include <ws2tcpip.h>
 #endif
 
 "
-if test "x$ac_cv_member_struct_sockaddr_storage___ss_family" = xyes; then :
+if test "x$ac_cv_type_socklen_t" = xyes
+then :
 
+else $as_nop
 
-$as_echo "#define ss_family __ss_family" >>confdefs.h
-
+printf "%s\n" "#define socklen_t int" >>confdefs.h
 
 fi
 
+if test "x$ac_cv_type_socklen_t" = xyes; then
+  ldns_build_config_have_socklen_t=1
+
+else
+  ldns_build_config_have_socklen_t=0
 
 fi
+ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default"
+if test "x$ac_cv_type_size_t" = xyes
+then :
 
+else $as_nop
 
-for ac_header in stdlib.h
-do :
-  ac_fn_c_check_header_mongrel "$LINENO" "stdlib.h" "ac_cv_header_stdlib_h" "$ac_includes_default"
-if test "x$ac_cv_header_stdlib_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_STDLIB_H 1
-_ACEOF
+printf "%s\n" "#define size_t unsigned int" >>confdefs.h
 
 fi
 
-done
+ac_fn_c_check_type "$LINENO" "ssize_t" "ac_cv_type_ssize_t" "$ac_includes_default"
+if test "x$ac_cv_type_ssize_t" = xyes
+then :
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible malloc" >&5
-$as_echo_n "checking for GNU libc compatible malloc... " >&6; }
-if ${ac_cv_func_malloc_0_nonnull+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test "$cross_compiling" = yes; then :
-  ac_cv_func_malloc_0_nonnull=no
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#if defined STDC_HEADERS || defined HAVE_STDLIB_H
-# include <stdlib.h>
-#else
-char *malloc ();
-#endif
+else $as_nop
 
-int
-main ()
-{
-return ! malloc (0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-  ac_cv_func_malloc_0_nonnull=yes
-else
-  ac_cv_func_malloc_0_nonnull=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
+printf "%s\n" "#define ssize_t int" >>confdefs.h
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_malloc_0_nonnull" >&5
-$as_echo "$ac_cv_func_malloc_0_nonnull" >&6; }
-if test $ac_cv_func_malloc_0_nonnull = yes; then :
 
-$as_echo "#define HAVE_MALLOC 1" >>confdefs.h
+ac_fn_c_check_type "$LINENO" "intptr_t" "ac_cv_type_intptr_t" "$ac_includes_default"
+if test "x$ac_cv_type_intptr_t" = xyes
+then :
 
-else
-  $as_echo "#define HAVE_MALLOC 0" >>confdefs.h
+else $as_nop
 
-   case " $LIBOBJS " in
-  *" malloc.$ac_objext "* ) ;;
-  *) LIBOBJS="$LIBOBJS malloc.$ac_objext"
- ;;
-esac
+printf "%s\n" "#define intptr_t size_t" >>confdefs.h
+
+fi
+
+ac_fn_c_check_type "$LINENO" "in_addr_t" "ac_cv_type_in_addr_t" "
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#if HAVE_NETINET_IN_H
+# include <netinet/in.h>
+#endif
+"
+if test "x$ac_cv_type_in_addr_t" = xyes
+then :
 
+else $as_nop
 
-$as_echo "#define malloc rpl_malloc" >>confdefs.h
+printf "%s\n" "#define in_addr_t uint32_t" >>confdefs.h
 
 fi
 
+ac_fn_c_check_type "$LINENO" "in_port_t" "ac_cv_type_in_port_t" "
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#if HAVE_NETINET_IN_H
+# include <netinet/in.h>
+#endif
+"
+if test "x$ac_cv_type_in_port_t" = xyes
+then :
+
+else $as_nop
 
-for ac_header in stdlib.h
-do :
-  ac_fn_c_check_header_mongrel "$LINENO" "stdlib.h" "ac_cv_header_stdlib_h" "$ac_includes_default"
-if test "x$ac_cv_header_stdlib_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_STDLIB_H 1
-_ACEOF
+printf "%s\n" "#define in_port_t uint16_t" >>confdefs.h
 
 fi
 
-done
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible realloc" >&5
-$as_echo_n "checking for GNU libc compatible realloc... " >&6; }
-if ${ac_cv_func_realloc_0_nonnull+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test "$cross_compiling" = yes; then :
-  ac_cv_func_realloc_0_nonnull=no
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#if defined STDC_HEADERS || defined HAVE_STDLIB_H
-# include <stdlib.h>
-#else
-char *realloc ();
+ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "ss_family" "ac_cv_member_struct_sockaddr_storage_ss_family" "$ac_includes_default
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
 #endif
 
-int
-main ()
-{
-return ! realloc (0, 0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-  ac_cv_func_realloc_0_nonnull=yes
-else
-  ac_cv_func_realloc_0_nonnull=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
+"
+if test "x$ac_cv_member_struct_sockaddr_storage_ss_family" = xyes
+then :
 
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_realloc_0_nonnull" >&5
-$as_echo "$ac_cv_func_realloc_0_nonnull" >&6; }
-if test $ac_cv_func_realloc_0_nonnull = yes; then :
+else $as_nop
+
+        ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "__ss_family" "ac_cv_member_struct_sockaddr_storage___ss_family" "$ac_includes_default
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
 
-$as_echo "#define HAVE_REALLOC 1" >>confdefs.h
+"
+if test "x$ac_cv_member_struct_sockaddr_storage___ss_family" = xyes
+then :
 
-else
-  $as_echo "#define HAVE_REALLOC 0" >>confdefs.h
 
-   case " $LIBOBJS " in
-  *" realloc.$ac_objext "* ) ;;
-  *) LIBOBJS="$LIBOBJS realloc.$ac_objext"
- ;;
-esac
+printf "%s\n" "#define ss_family __ss_family" >>confdefs.h
 
 
-$as_echo "#define realloc rpl_realloc" >>confdefs.h
+fi
+
 
 fi
 
 
+# AC_FUNC_MALLOC suffers false failures and causes Asan failures.
+# AC_FUNC_MALLOC
+# AC_FUNC_REALLOC
 
 ac_fn_c_check_func "$LINENO" "b64_pton" "ac_cv_func_b64_pton"
-if test "x$ac_cv_func_b64_pton" = xyes; then :
-  $as_echo "#define HAVE_B64_PTON 1" >>confdefs.h
+if test "x$ac_cv_func_b64_pton" = xyes
+then :
+  printf "%s\n" "#define HAVE_B64_PTON 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" b64_pton.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS b64_pton.$ac_objext"
@@ -17007,12 +18464,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "b64_ntop" "ac_cv_func_b64_ntop"
-if test "x$ac_cv_func_b64_ntop" = xyes; then :
-  $as_echo "#define HAVE_B64_NTOP 1" >>confdefs.h
+if test "x$ac_cv_func_b64_ntop" = xyes
+then :
+  printf "%s\n" "#define HAVE_B64_NTOP 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" b64_ntop.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS b64_ntop.$ac_objext"
@@ -17021,12 +18478,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "calloc" "ac_cv_func_calloc"
-if test "x$ac_cv_func_calloc" = xyes; then :
-  $as_echo "#define HAVE_CALLOC 1" >>confdefs.h
+if test "x$ac_cv_func_calloc" = xyes
+then :
+  printf "%s\n" "#define HAVE_CALLOC 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" calloc.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS calloc.$ac_objext"
@@ -17035,12 +18492,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "timegm" "ac_cv_func_timegm"
-if test "x$ac_cv_func_timegm" = xyes; then :
-  $as_echo "#define HAVE_TIMEGM 1" >>confdefs.h
+if test "x$ac_cv_func_timegm" = xyes
+then :
+  printf "%s\n" "#define HAVE_TIMEGM 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" timegm.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS timegm.$ac_objext"
@@ -17049,12 +18506,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "gmtime_r" "ac_cv_func_gmtime_r"
-if test "x$ac_cv_func_gmtime_r" = xyes; then :
-  $as_echo "#define HAVE_GMTIME_R 1" >>confdefs.h
+if test "x$ac_cv_func_gmtime_r" = xyes
+then :
+  printf "%s\n" "#define HAVE_GMTIME_R 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" gmtime_r.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS gmtime_r.$ac_objext"
@@ -17063,12 +18520,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "ctime_r" "ac_cv_func_ctime_r"
-if test "x$ac_cv_func_ctime_r" = xyes; then :
-  $as_echo "#define HAVE_CTIME_R 1" >>confdefs.h
+if test "x$ac_cv_func_ctime_r" = xyes
+then :
+  printf "%s\n" "#define HAVE_CTIME_R 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" ctime_r.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS ctime_r.$ac_objext"
@@ -17077,12 +18534,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "localtime_r" "ac_cv_func_localtime_r"
-if test "x$ac_cv_func_localtime_r" = xyes; then :
-  $as_echo "#define HAVE_LOCALTIME_R 1" >>confdefs.h
+if test "x$ac_cv_func_localtime_r" = xyes
+then :
+  printf "%s\n" "#define HAVE_LOCALTIME_R 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" localtime_r.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS localtime_r.$ac_objext"
@@ -17091,12 +18548,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "isblank" "ac_cv_func_isblank"
-if test "x$ac_cv_func_isblank" = xyes; then :
-  $as_echo "#define HAVE_ISBLANK 1" >>confdefs.h
+if test "x$ac_cv_func_isblank" = xyes
+then :
+  printf "%s\n" "#define HAVE_ISBLANK 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" isblank.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS isblank.$ac_objext"
@@ -17105,12 +18562,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "isascii" "ac_cv_func_isascii"
-if test "x$ac_cv_func_isascii" = xyes; then :
-  $as_echo "#define HAVE_ISASCII 1" >>confdefs.h
+if test "x$ac_cv_func_isascii" = xyes
+then :
+  printf "%s\n" "#define HAVE_ISASCII 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" isascii.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS isascii.$ac_objext"
@@ -17119,12 +18576,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "inet_aton" "ac_cv_func_inet_aton"
-if test "x$ac_cv_func_inet_aton" = xyes; then :
-  $as_echo "#define HAVE_INET_ATON 1" >>confdefs.h
+if test "x$ac_cv_func_inet_aton" = xyes
+then :
+  printf "%s\n" "#define HAVE_INET_ATON 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" inet_aton.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS inet_aton.$ac_objext"
@@ -17133,12 +18590,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "inet_pton" "ac_cv_func_inet_pton"
-if test "x$ac_cv_func_inet_pton" = xyes; then :
-  $as_echo "#define HAVE_INET_PTON 1" >>confdefs.h
+if test "x$ac_cv_func_inet_pton" = xyes
+then :
+  printf "%s\n" "#define HAVE_INET_PTON 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" inet_pton.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS inet_pton.$ac_objext"
@@ -17147,12 +18604,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "inet_ntop" "ac_cv_func_inet_ntop"
-if test "x$ac_cv_func_inet_ntop" = xyes; then :
-  $as_echo "#define HAVE_INET_NTOP 1" >>confdefs.h
+if test "x$ac_cv_func_inet_ntop" = xyes
+then :
+  printf "%s\n" "#define HAVE_INET_NTOP 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" inet_ntop.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS inet_ntop.$ac_objext"
@@ -17161,12 +18618,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf"
-if test "x$ac_cv_func_snprintf" = xyes; then :
-  $as_echo "#define HAVE_SNPRINTF 1" >>confdefs.h
+if test "x$ac_cv_func_snprintf" = xyes
+then :
+  printf "%s\n" "#define HAVE_SNPRINTF 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" snprintf.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS snprintf.$ac_objext"
@@ -17175,12 +18632,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "strlcpy" "ac_cv_func_strlcpy"
-if test "x$ac_cv_func_strlcpy" = xyes; then :
-  $as_echo "#define HAVE_STRLCPY 1" >>confdefs.h
+if test "x$ac_cv_func_strlcpy" = xyes
+then :
+  printf "%s\n" "#define HAVE_STRLCPY 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" strlcpy.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS strlcpy.$ac_objext"
@@ -17189,12 +18646,12 @@ esac
 
 fi
 
-
 ac_fn_c_check_func "$LINENO" "memmove" "ac_cv_func_memmove"
-if test "x$ac_cv_func_memmove" = xyes; then :
-  $as_echo "#define HAVE_MEMMOVE 1" >>confdefs.h
+if test "x$ac_cv_func_memmove" = xyes
+then :
+  printf "%s\n" "#define HAVE_MEMMOVE 1" >>confdefs.h
 
-else
+else $as_nop
   case " $LIBOBJS " in
   *" memmove.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS memmove.$ac_objext"
@@ -17204,55 +18661,75 @@ esac
 fi
 
 
-ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default"
-if test "x$ac_cv_type_pid_t" = xyes; then :
+  ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default
+"
+if test "x$ac_cv_type_pid_t" = xyes
+then :
 
-else
+else $as_nop
+                                          cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
 
-cat >>confdefs.h <<_ACEOF
-#define pid_t int
-_ACEOF
+          #if defined _WIN64 && !defined __CYGWIN__
+          LLP64
+          #endif
 
-fi
+int
+main (void)
+{
 
-for ac_header in vfork.h
-do :
-  ac_fn_c_check_header_mongrel "$LINENO" "vfork.h" "ac_cv_header_vfork_h" "$ac_includes_default"
-if test "x$ac_cv_header_vfork_h" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_VFORK_H 1
-_ACEOF
+  ;
+  return 0;
+}
 
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_pid_type='int'
+else $as_nop
+  ac_pid_type='__int64'
 fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
-done
+printf "%s\n" "#define pid_t $ac_pid_type" >>confdefs.h
 
-for ac_func in fork vfork
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
 
 fi
+
+
+
+ac_func=
+for ac_item in $ac_func_c_list
+do
+  if test $ac_func; then
+    ac_fn_c_check_func "$LINENO" $ac_func ac_cv_func_$ac_func
+    if eval test \"x\$ac_cv_func_$ac_func\" = xyes; then
+      echo "#define $ac_item 1" >> confdefs.h
+    fi
+    ac_func=
+  else
+    ac_func=$ac_item
+  fi
 done
 
+
+
 if test "x$ac_cv_func_fork" = xyes; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working fork" >&5
-$as_echo_n "checking for working fork... " >&6; }
-if ${ac_cv_func_fork_works+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test "$cross_compiling" = yes; then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for working fork" >&5
+printf %s "checking for working fork... " >&6; }
+if test ${ac_cv_func_fork_works+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test "$cross_compiling" = yes
+then :
   ac_cv_func_fork_works=cross
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 $ac_includes_default
 int
-main ()
+main (void)
 {
 
 	  /* By Ruediger Kuhlmann. */
@@ -17262,9 +18739,10 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+if ac_fn_c_try_run "$LINENO"
+then :
   ac_cv_func_fork_works=yes
-else
+else $as_nop
   ac_cv_func_fork_works=no
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -17272,8 +18750,8 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_fork_works" >&5
-$as_echo "$ac_cv_func_fork_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_fork_works" >&5
+printf "%s\n" "$ac_cv_func_fork_works" >&6; }
 
 else
   ac_cv_func_fork_works=$ac_cv_func_fork
@@ -17288,27 +18766,37 @@ if test "x$ac_cv_func_fork_works" = xcross; then
       ac_cv_func_fork_works=yes
       ;;
   esac
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&5
-$as_echo "$as_me: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&2;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&5
+printf "%s\n" "$as_me: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&2;}
 fi
 ac_cv_func_vfork_works=$ac_cv_func_vfork
 if test "x$ac_cv_func_vfork" = xyes; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working vfork" >&5
-$as_echo_n "checking for working vfork... " >&6; }
-if ${ac_cv_func_vfork_works+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test "$cross_compiling" = yes; then :
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for working vfork" >&5
+printf %s "checking for working vfork... " >&6; }
+if test ${ac_cv_func_vfork_works+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test "$cross_compiling" = yes
+then :
   ac_cv_func_vfork_works=cross
-else
+else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 /* Thanks to Paul Eggert for this test.  */
 $ac_includes_default
+#include <signal.h>
 #include <sys/wait.h>
 #ifdef HAVE_VFORK_H
 # include <vfork.h>
 #endif
+
+static void
+do_nothing (int sig)
+{
+  (void) sig;
+}
+
 /* On some sparc systems, changes by the child to local and incoming
    argument registers are propagated back to the parent.  The compiler
    is told about this with #include <vfork.h>, but some compilers
@@ -17316,11 +18804,7 @@ $ac_includes_default
    static variable whose address is put into a register that is
    clobbered by the vfork.  */
 static void
-#ifdef __cplusplus
 sparc_address_test (int arg)
-# else
-sparc_address_test (arg) int arg;
-#endif
 {
   static pid_t child;
   if (!child) {
@@ -17338,13 +18822,18 @@ sparc_address_test (arg) int arg;
 }
 
 int
-main ()
+main (void)
 {
   pid_t parent = getpid ();
   pid_t child;
 
   sparc_address_test (0);
 
+  /* On Solaris 2.4, changes by the child to the signal handler
+     also munge signal handlers in the parent.  To detect this,
+     start by putting the parent's handler in a known state.  */
+  signal (SIGTERM, SIG_DFL);
+
   child = vfork ();
 
   if (child == 0) {
@@ -17366,6 +18855,10 @@ main ()
 	|| p != p5 || p != p6 || p != p7)
       _exit(1);
 
+    /* Alter the child's signal handler.  */
+    if (signal (SIGTERM, do_nothing) != SIG_DFL)
+      _exit(1);
+
     /* On some systems (e.g. IRIX 3.3), vfork doesn't separate parent
        from child file descriptors.  If the child closes a descriptor
        before it execs or exits, this munges the parent's descriptor
@@ -17381,6 +18874,9 @@ main ()
 	 /* Was there some problem with vforking?  */
 	 child < 0
 
+	 /* Did the child munge the parent's signal handler?  */
+	 || signal (SIGTERM, SIG_DFL) != SIG_DFL
+
 	 /* Did the child fail?  (This shouldn't happen.)  */
 	 || status
 
@@ -17393,9 +18889,10 @@ main ()
   }
 }
 _ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+if ac_fn_c_try_run "$LINENO"
+then :
   ac_cv_func_vfork_works=yes
-else
+else $as_nop
   ac_cv_func_vfork_works=no
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -17403,42 +18900,123 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_vfork_works" >&5
-$as_echo "$ac_cv_func_vfork_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_vfork_works" >&5
+printf "%s\n" "$ac_cv_func_vfork_works" >&6; }
 
 fi;
 if test "x$ac_cv_func_fork_works" = xcross; then
   ac_cv_func_vfork_works=$ac_cv_func_vfork
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&5
-$as_echo "$as_me: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&2;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&5
+printf "%s\n" "$as_me: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&2;}
 fi
 
 if test "x$ac_cv_func_vfork_works" = xyes; then
 
-$as_echo "#define HAVE_WORKING_VFORK 1" >>confdefs.h
+printf "%s\n" "#define HAVE_WORKING_VFORK 1" >>confdefs.h
 
 else
 
-$as_echo "#define vfork fork" >>confdefs.h
+printf "%s\n" "#define vfork fork" >>confdefs.h
 
 fi
 if test "x$ac_cv_func_fork_works" = xyes; then
 
-$as_echo "#define HAVE_WORKING_FORK 1" >>confdefs.h
+printf "%s\n" "#define HAVE_WORKING_FORK 1" >>confdefs.h
 
 fi
 
-for ac_func in endprotoent endservent sleep random fcntl strtoul bzero memset b32_ntop b32_pton
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking compile of fork" >&5
+printf %s "checking compile of fork... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <unistd.h>
+
+int
+main (void)
+{
+
+	(void)fork();
+
+  ;
+  return 0;
+}
 _ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+
+printf "%s\n" "#define HAVE_FORK_AVAILABLE 1" >>confdefs.h
+
+
+else $as_nop
+  	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ac_fn_c_check_func "$LINENO" "endprotoent" "ac_cv_func_endprotoent"
+if test "x$ac_cv_func_endprotoent" = xyes
+then :
+  printf "%s\n" "#define HAVE_ENDPROTOENT 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "endservent" "ac_cv_func_endservent"
+if test "x$ac_cv_func_endservent" = xyes
+then :
+  printf "%s\n" "#define HAVE_ENDSERVENT 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "sleep" "ac_cv_func_sleep"
+if test "x$ac_cv_func_sleep" = xyes
+then :
+  printf "%s\n" "#define HAVE_SLEEP 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "random" "ac_cv_func_random"
+if test "x$ac_cv_func_random" = xyes
+then :
+  printf "%s\n" "#define HAVE_RANDOM 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "fcntl" "ac_cv_func_fcntl"
+if test "x$ac_cv_func_fcntl" = xyes
+then :
+  printf "%s\n" "#define HAVE_FCNTL 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "strtoul" "ac_cv_func_strtoul"
+if test "x$ac_cv_func_strtoul" = xyes
+then :
+  printf "%s\n" "#define HAVE_STRTOUL 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "bzero" "ac_cv_func_bzero"
+if test "x$ac_cv_func_bzero" = xyes
+then :
+  printf "%s\n" "#define HAVE_BZERO 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "memset" "ac_cv_func_memset"
+if test "x$ac_cv_func_memset" = xyes
+then :
+  printf "%s\n" "#define HAVE_MEMSET 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "b32_ntop" "ac_cv_func_b32_ntop"
+if test "x$ac_cv_func_b32_ntop" = xyes
+then :
+  printf "%s\n" "#define HAVE_B32_NTOP 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "b32_pton" "ac_cv_func_b32_pton"
+if test "x$ac_cv_func_b32_pton" = xyes
+then :
+  printf "%s\n" "#define HAVE_B32_PTON 1" >>confdefs.h
 
 fi
-done
 
 if test "x$HAVE_B32_NTOP" = "xyes"; then
 	ldns_build_config_have_b32_ntop=1
@@ -17456,8 +19034,8 @@ else
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for getaddrinfo" >&5
-$as_echo_n "checking for getaddrinfo... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for getaddrinfo" >&5
+printf %s "checking for getaddrinfo... " >&6; }
 ac_cv_func_getaddrinfo=no
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -17477,17 +19055,22 @@ int main() {
 }
 
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
   ac_cv_func_getaddrinfo="yes"
 if test "$ac_cv_header_windows_h" = "yes"; then
 
-$as_echo "#define USE_WINSOCK 1" >>confdefs.h
+printf "%s\n" "#define USE_WINSOCK 1" >>confdefs.h
 
 	USE_WINSOCK="1"
-	LIBS="$LIBS -lws2_32"
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
+		:
+	else
+		LIBS="$LIBS -lws2_32"
+	fi
 fi
 
-else
+else $as_nop
   ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -17498,7 +19081,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #endif
 
 int
-main ()
+main (void)
 {
 
         (void)getaddrinfo(NULL, NULL, NULL, NULL);
@@ -17508,32 +19091,33 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 ac_cv_func_getaddrinfo="yes"
 
-$as_echo "#define USE_WINSOCK 1" >>confdefs.h
+printf "%s\n" "#define USE_WINSOCK 1" >>confdefs.h
 
 USE_WINSOCK="1"
 
-else
+else $as_nop
 
 ac_cv_func_getaddrinfo="no"
 LIBS="$ORIGLIBS"
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_getaddrinfo" >&5
-$as_echo "$ac_cv_func_getaddrinfo" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_getaddrinfo" >&5
+printf "%s\n" "$ac_cv_func_getaddrinfo" >&6; }
 if test $ac_cv_func_getaddrinfo = yes; then
 
-$as_echo "#define HAVE_GETADDRINFO 1" >>confdefs.h
+printf "%s\n" "#define HAVE_GETADDRINFO 1" >>confdefs.h
 
 fi
 
@@ -17549,11 +19133,12 @@ if test "$USE_WINSOCK" = 1; then
 	if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}windres", so it can be a program name with args.
 set dummy ${ac_tool_prefix}windres; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_WINDRES+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_WINDRES+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$WINDRES"; then
   ac_cv_prog_WINDRES="$WINDRES" # Let the user override the test.
 else
@@ -17561,11 +19146,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_WINDRES="${ac_tool_prefix}windres"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -17576,11 +19165,11 @@ fi
 fi
 WINDRES=$ac_cv_prog_WINDRES
 if test -n "$WINDRES"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WINDRES" >&5
-$as_echo "$WINDRES" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $WINDRES" >&5
+printf "%s\n" "$WINDRES" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -17589,11 +19178,12 @@ if test -z "$ac_cv_prog_WINDRES"; then
   ac_ct_WINDRES=$WINDRES
   # Extract the first word of "windres", so it can be a program name with args.
 set dummy windres; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_WINDRES+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_WINDRES+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   if test -n "$ac_ct_WINDRES"; then
   ac_cv_prog_ac_ct_WINDRES="$ac_ct_WINDRES" # Let the user override the test.
 else
@@ -17601,11 +19191,15 @@ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
     for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
     ac_cv_prog_ac_ct_WINDRES="windres"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
     break 2
   fi
 done
@@ -17616,11 +19210,11 @@ fi
 fi
 ac_ct_WINDRES=$ac_cv_prog_ac_ct_WINDRES
 if test -n "$ac_ct_WINDRES"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_WINDRES" >&5
-$as_echo "$ac_ct_WINDRES" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_WINDRES" >&5
+printf "%s\n" "$ac_ct_WINDRES" >&6; }
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
   if test "x$ac_ct_WINDRES" = x; then
@@ -17628,8 +19222,8 @@ fi
   else
     case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
     WINDRES=$ac_ct_WINDRES
@@ -17641,8 +19235,8 @@ fi
 fi
 
 # check ioctlsocket
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ioctlsocket" >&5
-$as_echo_n "checking for ioctlsocket... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ioctlsocket" >&5
+printf %s "checking for ioctlsocket... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -17651,7 +19245,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #endif
 
 int
-main ()
+main (void)
 {
 
 	(void)ioctlsocket(0, 0, NULL);
@@ -17660,30 +19254,32 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-$as_echo "#define HAVE_IOCTLSOCKET 1" >>confdefs.h
+printf "%s\n" "#define HAVE_IOCTLSOCKET 1" >>confdefs.h
 
 
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 
 
 #AC_SEARCH_LIBS(RSA_new, [crypto])
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute" >&5
-$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute... " >&6; }
-if ${ac_cv_c_format_attribute+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute" >&5
+printf %s "checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute... " >&6; }
+if test ${ac_cv_c_format_attribute+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_cv_c_format_attribute=no
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -17692,7 +19288,7 @@ void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 
 int
-main ()
+main (void)
 {
 
    f ("%s", "str");
@@ -17701,30 +19297,32 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_format_attribute="yes"
-else
+else $as_nop
   ac_cv_c_format_attribute="no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_format_attribute" >&5
-$as_echo "$ac_cv_c_format_attribute" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_format_attribute" >&5
+printf "%s\n" "$ac_cv_c_format_attribute" >&6; }
 if test $ac_cv_c_format_attribute = yes; then
 
-$as_echo "#define HAVE_ATTR_FORMAT 1" >>confdefs.h
+printf "%s\n" "#define HAVE_ATTR_FORMAT 1" >>confdefs.h
 
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute" >&5
-$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute... " >&6; }
-if ${ac_cv_c_unused_attribute+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute" >&5
+printf %s "checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute... " >&6; }
+if test ${ac_cv_c_unused_attribute+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
   ac_cv_c_unused_attribute=no
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -17732,7 +19330,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 void f (char *u __attribute__((unused)));
 
 int
-main ()
+main (void)
 {
 
    f ("x");
@@ -17741,53 +19339,76 @@ main ()
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
   ac_cv_c_unused_attribute="yes"
-else
+else $as_nop
   ac_cv_c_unused_attribute="no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
 fi
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_unused_attribute" >&5
-$as_echo "$ac_cv_c_unused_attribute" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_unused_attribute" >&5
+printf "%s\n" "$ac_cv_c_unused_attribute" >&6; }
 if test $ac_cv_c_unused_attribute = yes; then
 
-$as_echo "#define HAVE_ATTR_UNUSED 1" >>confdefs.h
+printf "%s\n" "#define HAVE_ATTR_UNUSED 1" >>confdefs.h
 
 fi
 
 
-# check OSX deployment target, if needed
-if echo $build_os | grep darwin > /dev/null; then
-  sdk_p=`xcode-select -print-path`;
-  sdk_v="$( /usr/bin/xcrun --show-sdk-version )";
-  case $sdk_v in
-       10.9|10.8)   sdk_c="10.7";;
-       10.11|10.10|*) sdk_c="10.10";;
-  esac
-  export MACOSX_DEPLOYMENT_TARGET="${sdk_c}";
-  export CFLAGS="$CFLAGS -mmacosx-version-min=${sdk_c} -isysroot ${sdk_p}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX${sdk_v}.sdk";
+
+# Check whether --with-xcode-sdk was given.
+if test ${with_xcode_sdk+y}
+then :
+  withval=$with_xcode_sdk;
+else $as_nop
+  with_xcode_sdk="yes"
 fi
 
+if test "x_$with_xcode_sdk" != "x_no" ; then
+   # check OSX deployment target, if needed
+   if echo $target_os | grep darwin > /dev/null; then
+     sdk_p=`xcode-select -print-path`;
+     if test "x_$with_xcode_sdk" = "x_yes" ; then
+        sdk_v="$( /usr/bin/xcrun --show-sdk-version 2>/dev/null )"
+     else
+        sdk_v="$with_xcode_sdk"
+     fi
+     # xcrun only got that option in 10.7
+     if test -z "$sdk_v" ; then
+        sdk_c="10.6"
+        sdk_v="10.6"
+     fi
+     SYSROOT="$( find ${sdk_p} -name MacOSX${sdk_v}.sdk )"
+     case $sdk_v in
+          10.9|10.8)   sdk_c="10.7";;
+          10.11|10.10|*) sdk_c="10.10";;
+     esac
+     export MACOSX_DEPLOYMENT_TARGET="${sdk_c}";
+     export CFLAGS="$CFLAGS -mmacosx-version-min=${sdk_c} -isysroot ${SYSROOT}"
+   fi
+fi
 
-$as_echo "#define SYSCONFDIR sysconfdir" >>confdefs.h
+
+printf "%s\n" "#define SYSCONFDIR sysconfdir" >>confdefs.h
 
 
 
 # Check whether --with-trust-anchor was given.
-if test "${with_trust_anchor+set}" = set; then :
+if test ${with_trust_anchor+y}
+then :
   withval=$with_trust_anchor;
  LDNS_TRUST_ANCHOR_FILE="$withval"
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: Default trust anchor: $withval" >&5
-$as_echo "$as_me: Default trust anchor: $withval" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Default trust anchor: $withval" >&5
+printf "%s\n" "$as_me: Default trust anchor: $withval" >&6;}
 
-else
+else $as_nop
 
  LDNS_TRUST_ANCHOR_FILE="\$(sysconfdir)/unbound/root.key"
 
@@ -17797,25 +19418,24 @@ fi
 
 
 # Check whether --with-ca-file was given.
-if test "${with_ca_file+set}" = set; then :
+if test ${with_ca_file+y}
+then :
   withval=$with_ca_file;
 
-$as_echo "#define HAVE_DANE_CA_FILE 1" >>confdefs.h
+printf "%s\n" "#define HAVE_DANE_CA_FILE 1" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define LDNS_DANE_CA_FILE "$withval"
-_ACEOF
+printf "%s\n" "#define LDNS_DANE_CA_FILE \"$withval\"" >>confdefs.h
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: Using CAfile: $withval" >&5
-$as_echo "$as_me: Using CAfile: $withval" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Using CAfile: $withval" >&5
+printf "%s\n" "$as_me: Using CAfile: $withval" >&6;}
  DEFAULT_CAFILE="Default is $withval"
 
 
-else
+else $as_nop
 
 
-$as_echo "#define HAVE_DANE_CA_FILE 0" >>confdefs.h
+printf "%s\n" "#define HAVE_DANE_CA_FILE 0" >>confdefs.h
 
 
 
@@ -17824,25 +19444,24 @@ fi
 
 
 # Check whether --with-ca-path was given.
-if test "${with_ca_path+set}" = set; then :
+if test ${with_ca_path+y}
+then :
   withval=$with_ca_path;
 
-$as_echo "#define HAVE_DANE_CA_PATH 1" >>confdefs.h
+printf "%s\n" "#define HAVE_DANE_CA_PATH 1" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define LDNS_DANE_CA_PATH "$withval"
-_ACEOF
+printf "%s\n" "#define LDNS_DANE_CA_PATH \"$withval\"" >>confdefs.h
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: Using CApath: $withval" >&5
-$as_echo "$as_me: Using CApath: $withval" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Using CApath: $withval" >&5
+printf "%s\n" "$as_me: Using CApath: $withval" >&6;}
  DEFAULT_CAPATH="Default is $withval"
 
 
-else
+else $as_nop
 
 
-$as_echo "#define HAVE_DANE_CA_PATH 0" >>confdefs.h
+printf "%s\n" "#define HAVE_DANE_CA_PATH 0" >>confdefs.h
 
 
 
@@ -17875,7 +19494,7 @@ else
 
 fi
 
-CONFIG_FILES="Makefile ldns/common.h ldns/net.h ldns/util.h packaging/libldns.pc packaging/ldns-config"
+CONFIG_FILES="Makefile libdns.doxygen ldns/common.h ldns/net.h ldns/util.h packaging/libldns.pc packaging/ldns-config"
 
 ac_config_files="$ac_config_files $CONFIG_FILES"
 
@@ -17909,8 +19528,8 @@ _ACEOF
     case $ac_val in #(
     *${as_nl}*)
       case $ac_var in #(
-      *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+      *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
       esac
       case $ac_var in #(
       _ | IFS | as_nl) ;; #(
@@ -17940,15 +19559,15 @@ $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
      /^ac_cv_env_/b end
      t clear
      :clear
-     s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/
+     s/^\([^=]*\)=\(.*[{}].*\)$/test ${\1+y} || &/
      t end
      s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/
      :end' >>confcache
 if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
   if test -w "$cache_file"; then
     if test "x$cache_file" != "x/dev/null"; then
-      { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
-$as_echo "$as_me: updating cache $cache_file" >&6;}
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
+printf "%s\n" "$as_me: updating cache $cache_file" >&6;}
       if test ! -f "$cache_file" || test -h "$cache_file"; then
 	cat confcache >"$cache_file"
       else
@@ -17962,8 +19581,8 @@ $as_echo "$as_me: updating cache $cache_file" >&6;}
       fi
     fi
   else
-    { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
-$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
+printf "%s\n" "$as_me: not updating unwritable cache $cache_file" >&6;}
   fi
 fi
 rm -f confcache
@@ -17980,7 +19599,7 @@ U=
 for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
   # 1. Remove the extension, and $U if already installed.
   ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
-  ac_i=`$as_echo "$ac_i" | sed "$ac_script"`
+  ac_i=`printf "%s\n" "$ac_i" | sed "$ac_script"`
   # 2. Prepend LIBOBJDIR.  When used with automake>=1.10 LIBOBJDIR
   #    will be set to the directory where LIBOBJS objects are built.
   as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
@@ -17997,8 +19616,8 @@ LTLIBOBJS=$ac_ltlibobjs
 ac_write_fail=0
 ac_clean_files_save=$ac_clean_files
 ac_clean_files="$ac_clean_files $CONFIG_STATUS"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
-$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
+printf "%s\n" "$as_me: creating $CONFIG_STATUS" >&6;}
 as_write_fail=0
 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1
 #! $SHELL
@@ -18021,14 +19640,16 @@ cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1
 
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+as_nop=:
+if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
   emulate sh
   NULLCMD=:
   # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
   # is contrary to our usage.  Disable this feature.
   alias -g '${1+"$@"}'='"$@"'
   setopt NO_GLOB_SUBST
-else
+else $as_nop
   case `(set -o) 2>/dev/null` in #(
   *posix*) :
     set -o posix ;; #(
@@ -18038,46 +19659,46 @@ esac
 fi
 
 
+
+# Reset variables that may have inherited troublesome values from
+# the environment.
+
+# IFS needs to be set, to space, tab, and newline, in precisely that order.
+# (If _AS_PATH_WALK were called with IFS unset, it would have the
+# side effect of setting IFS to empty, thus disabling word splitting.)
+# Quoting is to prevent editors from complaining about space-tab.
 as_nl='
 '
 export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
-    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='print -r --'
-  as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='printf %s\n'
-  as_echo_n='printf %s'
-else
-  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
-    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
-    as_echo_n='/usr/ucb/echo -n'
-  else
-    as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
-    as_echo_n_body='eval
-      arg=$1;
-      case $arg in #(
-      *"$as_nl"*)
-	expr "X$arg" : "X\\(.*\\)$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
-      esac;
-      expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
-    '
-    export as_echo_n_body
-    as_echo_n='sh -c $as_echo_n_body as_echo'
-  fi
-  export as_echo_body
-  as_echo='sh -c $as_echo_body as_echo'
-fi
+IFS=" ""	$as_nl"
+
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# Ensure predictable behavior from utilities with locale-dependent output.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# We cannot yet rely on "unset" to work, but we need these variables
+# to be unset--not just set to an empty or harmless value--now, to
+# avoid bugs in old shells (e.g. pre-3.0 UWIN ksh).  This construct
+# also avoids known problems related to "unset" and subshell syntax
+# in other old shells (e.g. bash 2.01 and pdksh 5.2.14).
+for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH
+do eval test \${$as_var+y} \
+  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+
+# Ensure that fds 0, 1, and 2 are open.
+if (exec 3>&0) 2>/dev/null; then :; else exec 0</dev/null; fi
+if (exec 3>&1) 2>/dev/null; then :; else exec 1>/dev/null; fi
+if (exec 3>&2)            ; then :; else exec 2>/dev/null; fi
 
 # The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
+if ${PATH_SEPARATOR+false} :; then
   PATH_SEPARATOR=:
   (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
     (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
@@ -18086,13 +19707,6 @@ if test "${PATH_SEPARATOR+set}" != set; then
 fi
 
 
-# IFS
-# We need space, tab and new line, in precisely that order.  Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
 # Find who we are.  Look in the path if we contain no directory separator.
 as_myself=
 case $0 in #((
@@ -18101,8 +19715,12 @@ case $0 in #((
 for as_dir in $PATH
 do
   IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    test -r "$as_dir$0" && as_myself=$as_dir$0 && break
   done
 IFS=$as_save_IFS
 
@@ -18114,30 +19732,10 @@ if test "x$as_myself" = x; then
   as_myself=$0
 fi
 if test ! -f "$as_myself"; then
-  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+  printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
   exit 1
 fi
 
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there.  '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
-  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
 
 
 # as_fn_error STATUS ERROR [LINENO LOG_FD]
@@ -18150,13 +19748,14 @@ as_fn_error ()
   as_status=$1; test $as_status -eq 0 && as_status=1
   if test "$4"; then
     as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-    $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
   fi
-  $as_echo "$as_me: error: $2" >&2
+  printf "%s\n" "$as_me: error: $2" >&2
   as_fn_exit $as_status
 } # as_fn_error
 
 
+
 # as_fn_set_status STATUS
 # -----------------------
 # Set $? to STATUS, without forking.
@@ -18183,18 +19782,20 @@ as_fn_unset ()
   { eval $1=; unset $1;}
 }
 as_unset=as_fn_unset
+
 # as_fn_append VAR VALUE
 # ----------------------
 # Append the text in VALUE to the end of the definition contained in VAR. Take
 # advantage of any shell optimizations that allow amortized linear growth over
 # repeated appends, instead of the typical quadratic growth present in naive
 # implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null
+then :
   eval 'as_fn_append ()
   {
     eval $1+=\$2
   }'
-else
+else $as_nop
   as_fn_append ()
   {
     eval $1=\$$1\$2
@@ -18206,12 +19807,13 @@ fi # as_fn_append
 # Perform arithmetic evaluation on the ARGs, and store the result in the
 # global $as_val. Take advantage of shells that can avoid forks. The arguments
 # must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null
+then :
   eval 'as_fn_arith ()
   {
     as_val=$(( $* ))
   }'
-else
+else $as_nop
   as_fn_arith ()
   {
     as_val=`expr "$@" || test $? -eq 1`
@@ -18242,7 +19844,7 @@ as_me=`$as_basename -- "$0" ||
 $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
 	 X"$0" : 'X\(//\)$' \| \
 	 X"$0" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X/"$0" |
+printf "%s\n" X/"$0" |
     sed '/^.*\/\([^/][^/]*\)\/*$/{
 	    s//\1/
 	    q
@@ -18264,6 +19866,10 @@ as_cr_Letters=$as_cr_letters$as_cr_LETTERS
 as_cr_digits='0123456789'
 as_cr_alnum=$as_cr_Letters$as_cr_digits
 
+
+# Determine whether it's possible to make 'echo' print without a newline.
+# These variables are no longer used directly by Autoconf, but are AC_SUBSTed
+# for compatibility with existing Makefiles.
 ECHO_C= ECHO_N= ECHO_T=
 case `echo -n x` in #(((((
 -n*)
@@ -18277,6 +19883,12 @@ case `echo -n x` in #(((((
   ECHO_N='-n';;
 esac
 
+# For backward compatibility with old third-party macros, we provide
+# the shell variables $as_echo and $as_echo_n.  New code should use
+# AS_ECHO(["message"]) and AS_ECHO_N(["message"]), respectively.
+as_echo='printf %s\n'
+as_echo_n='printf %s'
+
 rm -f conf$$ conf$$.exe conf$$.file
 if test -d conf$$.dir; then
   rm -f conf$$.dir/conf$$.file
@@ -18318,7 +19930,7 @@ as_fn_mkdir_p ()
     as_dirs=
     while :; do
       case $as_dir in #(
-      *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+      *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
       *) as_qdir=$as_dir;;
       esac
       as_dirs="'$as_qdir' $as_dirs"
@@ -18327,7 +19939,7 @@ $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
 	 X"$as_dir" : 'X\(//\)[^/]' \| \
 	 X"$as_dir" : 'X\(//\)$' \| \
 	 X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
+printf "%s\n" X"$as_dir" |
     sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
 	    s//\1/
 	    q
@@ -18389,8 +20001,8 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ldns $as_me 1.7.0, which was
-generated by GNU Autoconf 2.69.  Invocation command line was
+This file was extended by ldns $as_me 1.8.3, which was
+generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
@@ -18452,14 +20064,16 @@ $config_commands
 Report bugs to <libdns@nlnetlabs.nl>."
 
 _ACEOF
+ac_cs_config=`printf "%s\n" "$ac_configure_args" | sed "$ac_safe_unquote"`
+ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\''/g"`
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-ldns config.status 1.7.0
-configured by $0, generated by GNU Autoconf 2.69,
+ldns config.status 1.8.3
+configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 2021 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it."
 
@@ -18497,15 +20111,15 @@ do
   -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r)
     ac_cs_recheck=: ;;
   --version | --versio | --versi | --vers | --ver | --ve | --v | -V )
-    $as_echo "$ac_cs_version"; exit ;;
+    printf "%s\n" "$ac_cs_version"; exit ;;
   --config | --confi | --conf | --con | --co | --c )
-    $as_echo "$ac_cs_config"; exit ;;
+    printf "%s\n" "$ac_cs_config"; exit ;;
   --debug | --debu | --deb | --de | --d | -d )
     debug=: ;;
   --file | --fil | --fi | --f )
     $ac_shift
     case $ac_optarg in
-    *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
+    *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
     '') as_fn_error $? "missing file argument" ;;
     esac
     as_fn_append CONFIG_FILES " '$ac_optarg'"
@@ -18513,7 +20127,7 @@ do
   --header | --heade | --head | --hea )
     $ac_shift
     case $ac_optarg in
-    *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
+    *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
     esac
     as_fn_append CONFIG_HEADERS " '$ac_optarg'"
     ac_need_defaults=false;;
@@ -18522,7 +20136,7 @@ do
     as_fn_error $? "ambiguous option: \`$1'
 Try \`$0 --help' for more information.";;
   --help | --hel | -h )
-    $as_echo "$ac_cs_usage"; exit ;;
+    printf "%s\n" "$ac_cs_usage"; exit ;;
   -q | -quiet | --quiet | --quie | --qui | --qu | --q \
   | -silent | --silent | --silen | --sile | --sil | --si | --s)
     ac_cs_silent=: ;;
@@ -18550,7 +20164,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 if \$ac_cs_recheck; then
   set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
   shift
-  \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
+  \printf "%s\n" "running CONFIG_SHELL=$SHELL \$*" >&6
   CONFIG_SHELL='$SHELL'
   export CONFIG_SHELL
   exec "\$@"
@@ -18564,7 +20178,7 @@ exec 5>>config.log
   sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
 ## Running $as_me. ##
 _ASBOX
-  $as_echo "$ac_log"
+  printf "%s\n" "$ac_log"
 } >&5
 
 _ACEOF
@@ -18879,9 +20493,9 @@ done
 # We use the long form for the default assignment because of an extremely
 # bizarre bug on SunOS 4.1.3.
 if $ac_need_defaults; then
-  test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files
-  test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers
-  test "${CONFIG_COMMANDS+set}" = set || CONFIG_COMMANDS=$config_commands
+  test ${CONFIG_FILES+y} || CONFIG_FILES=$config_files
+  test ${CONFIG_HEADERS+y} || CONFIG_HEADERS=$config_headers
+  test ${CONFIG_COMMANDS+y} || CONFIG_COMMANDS=$config_commands
 fi
 
 # Have a temporary directory for convenience.  Make it in the build tree
@@ -19217,7 +20831,7 @@ do
 	   esac ||
 	   as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;;
       esac
-      case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
+      case $ac_f in *\'*) ac_f=`printf "%s\n" "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
       as_fn_append ac_file_inputs " '$ac_f'"
     done
 
@@ -19225,17 +20839,17 @@ do
     # use $as_me), people would be surprised to read:
     #    /* config.h.  Generated by config.status.  */
     configure_input='Generated from '`
-	  $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g'
+	  printf "%s\n" "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g'
 	`' by configure.'
     if test x"$ac_file" != x-; then
       configure_input="$ac_file.  $configure_input"
-      { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
-$as_echo "$as_me: creating $ac_file" >&6;}
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
+printf "%s\n" "$as_me: creating $ac_file" >&6;}
     fi
     # Neutralize special characters interpreted by sed in replacement strings.
     case $configure_input in #(
     *\&* | *\|* | *\\* )
-       ac_sed_conf_input=`$as_echo "$configure_input" |
+       ac_sed_conf_input=`printf "%s\n" "$configure_input" |
        sed 's/[\\\\&|]/\\\\&/g'`;; #(
     *) ac_sed_conf_input=$configure_input;;
     esac
@@ -19252,7 +20866,7 @@ $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
 	 X"$ac_file" : 'X\(//\)[^/]' \| \
 	 X"$ac_file" : 'X\(//\)$' \| \
 	 X"$ac_file" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$ac_file" |
+printf "%s\n" X"$ac_file" |
     sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
 	    s//\1/
 	    q
@@ -19276,9 +20890,9 @@ $as_echo X"$ac_file" |
 case "$ac_dir" in
 .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *)
-  ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+  ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.[\\/]||'`
   # A ".." for each directory in $ac_dir_suffix.
-  ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+  ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
   case $ac_top_builddir_sub in
   "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
   *)  ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -19331,8 +20945,8 @@ ac_sed_dataroot='
 case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
 *datarootdir*) ac_datarootdir_seen=yes;;
 *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*)
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
-$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
+printf "%s\n" "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
   ac_datarootdir_hack='
@@ -19374,9 +20988,9 @@ test -z "$ac_datarootdir_hack$ac_datarootdir_seen" &&
   { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } &&
   { ac_out=`sed -n '/^[	 ]*datarootdir[	 ]*:*=/p' \
       "$ac_tmp/out"`; test -z "$ac_out"; } &&
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
 which seems to be undefined.  Please make sure it is defined" >&5
-$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+printf "%s\n" "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
 which seems to be undefined.  Please make sure it is defined" >&2;}
 
   rm -f "$ac_tmp/stdin"
@@ -19392,27 +21006,27 @@ which seems to be undefined.  Please make sure it is defined" >&2;}
   #
   if test x"$ac_file" != x-; then
     {
-      $as_echo "/* $configure_input  */" \
+      printf "%s\n" "/* $configure_input  */" >&1 \
       && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs"
     } >"$ac_tmp/config.h" \
       || as_fn_error $? "could not create $ac_file" "$LINENO" 5
     if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then
-      { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
-$as_echo "$as_me: $ac_file is unchanged" >&6;}
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
+printf "%s\n" "$as_me: $ac_file is unchanged" >&6;}
     else
       rm -f "$ac_file"
       mv "$ac_tmp/config.h" "$ac_file" \
 	|| as_fn_error $? "could not create $ac_file" "$LINENO" 5
     fi
   else
-    $as_echo "/* $configure_input  */" \
+    printf "%s\n" "/* $configure_input  */" >&1 \
       && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \
       || as_fn_error $? "could not create -" "$LINENO" 5
   fi
  ;;
 
-  :C)  { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
-$as_echo "$as_me: executing $ac_file commands" >&6;}
+  :C)  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
+printf "%s\n" "$as_me: executing $ac_file commands" >&6;}
  ;;
   esac
 
@@ -19945,6 +21559,7 @@ _LT_EOF
   esac
 
 
+
 ltmain=$ac_aux_dir/ltmain.sh
 
 
@@ -20001,8 +21616,8 @@ if test "$no_create" != yes; then
   $ac_cs_success || as_fn_exit 1
 fi
 if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
-$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
+printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
 fi
 
 
@@ -20015,4 +21630,3 @@ done
 
 
 
-
diff --git a/contrib/ldns/configure.ac b/contrib/ldns/configure.ac
index b7c6c811be404f..20b7aba19e86cb 100644
--- a/contrib/ldns/configure.ac
+++ b/contrib/ldns/configure.ac
@@ -5,8 +5,8 @@ sinclude(acx_nlnetlabs.m4)
 
 # must be numbers. ac_defun because of later processing.
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[7])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[8])
+m4_define([VERSION_MICRO],[3])
 AC_INIT(ldns, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), libdns@nlnetlabs.nl, libdns)
 AC_CONFIG_SRCDIR([packet.c])
 # needed to build correct soname
@@ -26,9 +26,15 @@ AC_SUBST(LDNS_VERSION_MICRO, [VERSION_MICRO])
 #   set age to 0
 #
 # ldns-1.6.17 and before had a .so with version same as VERSION_INFO
-# ldns-1.7.0 will have libversion 2:0:0
+# ldns-1.7.0 had libversion 2:0:0
+# ldns-1.7.1 had libversion 3:0:0 (though it should have had 3:0:1)
+# ldns-1.8.0 had libversion 4:0:2 (though it should have had 4:0:1)
+# ldns-1.8.1 had libversion 5:0:2
+# ldns-1.8.1 had libversion 6:0:3
+# ldns-1.8.2 had libversion 7:0:4
+# ldns-1.8.3 has libversion 8:0:5
 #
-AC_SUBST(VERSION_INFO, [2:0:0])
+AC_SUBST(VERSION_INFO, [8:0:5])
 
 AC_AIX
 if test "$ac_cv_header_minix_config_h" = "yes"; then
@@ -49,7 +55,7 @@ AC_PROG_MAKE_SET
 # Extra (sp)lint flags for NetBSD
 AC_CANONICAL_HOST
 case "$host_os" in
-	netbsd*) LINTFLAGS="'-D__RENAME(x)=' -D_NETINET_IN_H_ $LINTFLAGS" 
+	netbsd*) LINTFLAGS="'-D__RENAME(x)=' -D_NETINET_IN_H_ $LINTFLAGS"
 		 ;;
 	*)       LINTFLAGS="$LINTFLAGS"
 		 ;;
@@ -95,6 +101,7 @@ ACX_CHECK_COMPILER_FLAG(Wstrict-prototypes, [CFLAGS="-Wstrict-prototypes $CFLAGS
 #ACX_CHECK_COMPILER_FLAG(Wshadow, [CFLAGS="-Wshadow $CFLAGS"])
 ACX_CHECK_COMPILER_FLAG(Wunused-function, [CFLAGS="-Wunused-function $CFLAGS"])
 ACX_CHECK_COMPILER_FLAG(Wmissing-prototypes, [CFLAGS="-Wmissing-prototypes $CFLAGS"])
+ACX_CHECK_COMPILER_FLAG(fno-strict-aliasing, [CFLAGS="-fno-strict-aliasing $CFLAGS"])
 
 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 
@@ -102,6 +109,9 @@ AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([winsock2.h ws2tcpip.h],,, [AC_INCLUDES_DEFAULT])
 # end mingw32 tests
 
+# Check for Apple header. This uncovers TARGET_OS_IPHONE, TARGET_OS_TV or TARGET_OS_WATCH
+AC_CHECK_HEADERS([TargetConditionals.h])
+
 ACX_DETERMINE_EXT_FLAGS_UNBOUND
 
 AC_C_INLINE
@@ -118,12 +128,32 @@ AC_CHECK_TYPE(uint64_t, unsigned long long)
 AC_CHECK_PROG(doxygen, doxygen, doxygen)
 
 # check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS([socket], [socket])
-AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_CHECK_FUNC([socket],
+    [],
+    [AC_SEARCH_LIBS([socket], [socket])
+])
 
+# modern Linux provides inet_ntop in -lsocket.
+# modern OS X provides inet_ntop in -lc.
+# modern Solaris provides inet_ntop in -lsocket -lnsl.
+# older Solaris provides inet_ntop in -lresolv.
+AC_CHECK_FUNC([inet_ntop],
+    [],
+    [AC_SEARCH_LIBS([inet_ntop], [socket c nsl resolv], [ac_cv_func_inet_ntop=yes])
+])
 
-AC_ARG_WITH(drill, AC_HELP_STRING([--with-drill], 
- [Also build drill.]), 
+# modern Linux provides inet_pton in -lsocket.
+# modern OS X provides inet_pton in -lc.
+# modern Solaris provides inet_pton in -lsocket -lnsl.
+# older Solaris provides inet_pton in -lresolv.
+AC_CHECK_FUNC([inet_pton],
+    [],
+    [AC_SEARCH_LIBS([inet_pton], [socket c nsl resolv], [ac_cv_func_inet_pton=yes])
+])
+
+
+AC_ARG_WITH(drill, AC_HELP_STRING([--with-drill],
+ [Also build drill.]),
  [],[with_drill="no"])
 if test x_$with_drill != x_no ; then
 	AC_SUBST(DRILL,[drill])
@@ -135,7 +165,7 @@ if test x_$with_drill != x_no ; then
 		AC_MSG_ERROR([
 A config.h was detected in the drill subdirectory.
 This does not work with the --with-drill option.
-Please remove the config.h from the drill subdirectory 
+Please remove the config.h from the drill subdirectory
 or do not use the --with-drill option.])
 	fi
 else
@@ -147,8 +177,8 @@ else
 fi
 
 
-AC_ARG_WITH(examples, AC_HELP_STRING([--with-examples], 
- [Also build examples.]), 
+AC_ARG_WITH(examples, AC_HELP_STRING([--with-examples],
+ [Also build examples.]),
  [],[with_examples="no"])
 if test x_$with_examples != x_no ; then
 	AC_SUBST(EXAMPLES,[examples])
@@ -160,7 +190,7 @@ if test x_$with_examples != x_no ; then
 		AC_MSG_ERROR([
 A config.h was detected in the examples subdirectory.
 This does not work with the --with-examples option.
-Please remove the config.h from the examples subdirectory 
+Please remove the config.h from the examples subdirectory
 or do not use the --with-examples option.])
 	fi
 else
@@ -191,7 +221,7 @@ AC_ARG_ENABLE(stderr-msgs, AC_HELP_STRING([--enable-stderr-msgs], [Enable printi
 case "$enable_stderr_msgs" in
     no) dnl default
         ;;
-    *)  
+    *)
         AC_DEFINE_UNQUOTED([STDERR_MSGS], [1], [Define this to enable messages to stderr.])
         ;;
 esac
@@ -207,8 +237,8 @@ AX_CONFIG_FEATURE(
 PYTHON_X_CFLAGS=""
 ldns_with_pyldns=no
 ldns_with_pyldnsx=no
-AC_ARG_WITH(pyldns, AC_HELP_STRING([--with-pyldns], 
- [generate python library, or --without-pyldns to disable Python support.]), 
+AC_ARG_WITH(pyldns, AC_HELP_STRING([--with-pyldns],
+ [generate python library, or --without-pyldns to disable Python support.]),
  [],[ withval="no" ])
 ldns_have_python=no
 if test x_$withval != x_no; then
@@ -263,8 +293,8 @@ fi
 AC_SUBST(PYTHON_X_CFLAGS)
 
 # Check for pyldnsx
-AC_ARG_WITH(pyldnsx, AC_HELP_STRING([--without-pyldnsx], 
-  [Do not install the ldnsx python module, or --with-pyldnsx to install it.]), 
+AC_ARG_WITH(pyldnsx, AC_HELP_STRING([--without-pyldnsx],
+  [Do not install the ldnsx python module, or --with-pyldnsx to install it.]),
   [],[ withval="with_pyldns" ])
 if test x_$withval != x_no; then
   if test x_$ldns_with_pyldns != x_no; then
@@ -294,8 +324,8 @@ fi
 
 # check for perl
 ldns_with_p5_dns_ldns=no
-AC_ARG_WITH(p5-dns-ldns, AC_HELP_STRING([--with-p5-dns-ldns], 
- [generate DNS::LDNS perl bindings]), 
+AC_ARG_WITH(p5-dns-ldns, AC_HELP_STRING([--with-p5-dns-ldns],
+ [generate DNS::LDNS perl bindings]),
  [],[ withval="no" ])
 ldns_have_perl=no
 if test x_$withval != x_no; then
@@ -331,7 +361,29 @@ if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/
 else
 	AC_MSG_RESULT([no])
 fi
-AC_CHECK_FUNCS([EVP_sha256 EVP_sha384 EVP_sha512 ENGINE_load_cryptodev EVP_PKEY_keygen ECDSA_SIG_get0 EVP_MD_CTX_new EVP_PKEY_base_id DSA_SIG_set0 DSA_SIG_get0 EVP_dss1 DSA_get0_pqg DSA_get0_key])
+AC_CHECK_HEADERS([openssl/ssl.h openssl/evp.h openssl/engine.h openssl/conf.h])
+AC_CHECK_FUNCS([EVP_sha256 EVP_sha384 EVP_sha512 EVP_PKEY_keygen ECDSA_SIG_get0 EVP_MD_CTX_new DSA_SIG_set0 DSA_SIG_get0 EVP_dss1 DSA_get0_pqg DSA_get0_key EVP_cleanup ENGINE_cleanup ENGINE_free CRYPTO_cleanup_all_ex_data ERR_free_strings CONF_modules_unload OPENSSL_init_ssl OPENSSL_init_crypto ERR_load_crypto_strings CRYPTO_memcmp EVP_PKEY_get_base_id])
+AC_CHECK_DECLS([EVP_PKEY_base_id], [
+	AC_DEFINE_UNQUOTED([HAVE_EVP_PKEY_BASE_ID], [1], [Define to 1 if you have the EVP_PKEY_base_id function or macro.])
+], [], [AC_INCLUDES_DEFAULT
+#include <openssl/evp.h>
+])
+AC_MSG_CHECKING([Checking for OpenSSL >= 3.0.0])
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
+#include <openssl/ssl.h>
+#if OPENSSL_VERSION_MAJOR >= 3
+#define SOMETHING
+#else
+This fails compiling.
+So either no OpenSSL at all (the include already failed), or the version < 3.0.0
+#endif
+], [
+])], [
+	AC_MSG_RESULT(yes)
+	CFLAGS="-DOPENSSL_API_COMPAT=10100 $CFLAGS"
+], [	AC_MSG_RESULT(no)
+])
+
 
 # for macosx, see if glibtool exists and use that
 # BSD's need to know the version...
@@ -354,21 +406,33 @@ case "$enable_sha2" in
         ;;
 esac
 
-# check wether gost also works
+# check whether gost also works
 AC_DEFUN([AC_CHECK_GOST_WORKS],
 [AC_REQUIRE([AC_PROG_CC])
 AC_MSG_CHECKING([if GOST works])
 if test c${cross_compiling} = cno; then
 BAKCFLAGS="$CFLAGS"
 if test -n "$ssldir"; then
+    if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib64"
+    else
 	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib"
+    fi
 fi
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <string.h>
+#ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_EVP_H
 #include <openssl/evp.h>
+#endif
+#ifdef HAVE_OPENSSL_ENGINE_H
 #include <openssl/engine.h>
+#endif
+#ifdef HAVE_OPENSSL_CONF_H
 #include <openssl/conf.h>
+#endif
 /* routine to load gost (from sldns) */
 int load_gost_id(void)
 {
@@ -413,7 +477,7 @@ int load_gost_id(void)
 	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
 	return gost_id;
 }
-int main(void) { 
+int main(void) {
 	EVP_MD_CTX* ctx;
 	const EVP_MD* md;
 	unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */
@@ -463,7 +527,7 @@ case "$enable_gost" in
         AC_CHECK_FUNC(EVP_PKEY_set_type_str, [],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support or rerun with --disable-gost])])
         AC_CHECK_FUNC(EC_KEY_new, [], [AC_MSG_ERROR([No ECC functions found in OpenSSL: please upgrade OpenSSL or rerun with --disable-gost])])
 	AC_CHECK_GOST_WORKS
-	AC_ARG_ENABLE(gost-anyway, AC_HELP_STRING([--enable-gost-anyway], [Enable GOST even whithout a GOST engine installed]))
+	AC_ARG_ENABLE(gost-anyway, AC_HELP_STRING([--enable-gost-anyway], [Enable GOST even without a GOST engine installed]))
 	if test "$ac_cv_c_gost_works" != "no" -o "$enable_gost_anyway" = "yes"; then
 		if test "$ac_cv_c_gost_works" = "no"; then
 			AC_MSG_RESULT([no, but compiling with GOST support anyway])
@@ -502,43 +566,50 @@ esac
 AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
 case "$enable_dsa" in
     no)
+      AC_SUBST(ldns_build_config_use_dsa, 0)
       ;;
     *) dnl default
       # detect if DSA is supported, and turn it off if not.
       AC_CHECK_FUNC(DSA_SIG_new, [
 	AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
+	AC_SUBST(ldns_build_config_use_dsa, 1)
       ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
-	  fi ])
+	  fi
+	  AC_SUBST(ldns_build_config_use_dsa, 0)])
       ;;
 esac
 
-AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--enable-ed25519], [Enable ED25519 support (experimental)]))
+AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--disable-ed25519], [Disable (experimental) ED25519 support. Default is detect]))
 case "$enable_ed25519" in
-    yes)
-      if test "x$HAVE_SSL" != "xyes"; then
-        AC_MSG_ERROR([ED25519 enabled, but no SSL support])
-      fi
-      AC_CHECK_DECLS([NID_X25519], [], [AC_MSG_ERROR([OpenSSL does not support the EDDSA curve: please upgrade OpenSSL or rerun with --disable-ed25519])], [AC_INCLUDES_DEFAULT
+    no)
+      AC_SUBST(ldns_build_config_use_ed25519, 0)
+      ;;
+    *) dnl default
+      AC_CHECK_DECLS([NID_ED25519], [
+      	AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
+        AC_SUBST(ldns_build_config_use_ed25519, 1)
+      ], [if test "x$enable_ed25519" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support ED25519 and you used --enable-ed25519.])
+          fi
+	  AC_SUBST(ldns_build_config_use_ed25519, 0)], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
       ])
-      AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
-      ;;
-    *|no) dnl default
       ;;
 esac
 
-AC_ARG_ENABLE(ed448, AC_HELP_STRING([--enable-ed448], [Enable ED448 support (experimental)]))
+AC_ARG_ENABLE(ed448, AC_HELP_STRING([--disable-ed448], [Disable (experimental) ED448 support. Default is detect]))
 case "$enable_ed448" in
-    yes)
-      if test "x$HAVE_SSL" != "xyes"; then
-        AC_MSG_ERROR([ED448 enabled, but no SSL support])
-      fi
-      AC_CHECK_DECLS([NID_X448], [], [AC_MSG_ERROR([OpenSSL does not support the EDDSA curve: please upgrade OpenSSL or rerun with --disable-ed448])], [AC_INCLUDES_DEFAULT
+    no)
+      AC_SUBST(ldns_build_config_use_ed448, 0)
+      ;;
+    *) dnl default
+      AC_CHECK_DECLS([NID_ED448], [
+      	AC_DEFINE_UNQUOTED([USE_ED448], [1], [Define this to enable ED448 support.])
+        AC_SUBST(ldns_build_config_use_ed448, 1)
+      ], [if test "x$enable_ed448" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support ED448 and you used --enable-ed448.])
+          fi
+          AC_SUBST(ldns_build_config_use_ed448, 0)], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
       ])
-      AC_DEFINE_UNQUOTED([USE_ED448], [1], [Define this to enable ED448 support.])
-      ;;
-    *|no) dnl default
       ;;
 esac
 
@@ -587,9 +658,11 @@ case "$enable_dane" in
                   AC_SUBST(ldns_build_config_use_dane_ta_usage, 0)
                   ;;
                 *) dnl default
-      	    LIBS="-lssl $LIBS"
+		  danetmpLIBS="$LIBS"
+                  LIBS="-lssl -lcrypto $LIBS"
                   AC_CHECK_FUNC(SSL_get0_dane, [], [AC_MSG_ERROR([OpenSSL does not support offline DANE verification (Needed for the DANE-TA usage type).  Please upgrade OpenSSL to version >= 1.1.0 or rerun with --disable-dane-verify or --disable-dane-ta-usage])])
-                  LIBSSL_LIBS="$LIBSSL_LIBS -lssl"
+                  LIBSSL_LIBS="-lssl $LIBSSL_LIBS"
+		  LIBS="$danetmpLIBS"
                   AC_SUBST(ldns_build_config_use_dane_ta_usage, 1)
                   AC_DEFINE_UNQUOTED([USE_DANE_TA_USAGE], [1], [Define this to enable DANE-TA usage type support.])
                   ;;
@@ -638,12 +711,43 @@ case "$enable_rrtype_avc" in
 	no|*)
 		;;
 esac
+AC_ARG_ENABLE(rrtype-doa, AC_HELP_STRING([--enable-rrtype-doa], [Enable draft RR type DOA.]))
+case "$enable_rrtype_doa" in
+	yes)
+		AC_DEFINE_UNQUOTED([RRTYPE_DOA], [], [Define this to enable RR type DOA.])
+		;;
+	no|*)
+		;;
+esac
+AC_ARG_ENABLE(rrtype-amtrelay, AC_HELP_STRING([--enable-rrtype-amtrelay], [Enable draft RR type AMTRELAY.]))
+case "$enable_rrtype_amtrelay" in
+	yes)
+		AC_DEFINE_UNQUOTED([RRTYPE_AMTRELAY], [], [Define this to enable RR type AMTRELAY.])
+		;;
+	no|*)
+		;;
+esac
+AC_ARG_ENABLE(rrtype-svcb-https, AC_HELP_STRING([--disable-rrtype-svcb-https], [Disable RR types SVCB and HTTPS.]))
+case "$enable_rrtype_svcb_https" in
+	no)
+		;;
+	yes|*)
+		AC_DEFINE_UNQUOTED([RRTYPE_SVCB_HTTPS], [], [Define this to enable RR types SVCB and HTTPS.])
+		;;
+esac
+
+
 
 AC_SUBST(LIBSSL_CPPFLAGS)
 AC_SUBST(LIBSSL_LDFLAGS)
 AC_SUBST(LIBSSL_LIBS)
 if test "x$HAVE_SSL" = "xyes"; then
-AC_SUBST(LIBSSL_SSL_LIBS, ["-lssl $LIBSSL_LIBS"])
+    if echo "$LIBSSL_LIBS" | grep -- "-lssl" >/dev/null 2>&1; then
+	LIBSSL_SSL_LIBS="$LIBSSL_LIBS"
+    else
+	LIBSSL_SSL_LIBS="-lssl $LIBSSL_LIBS"
+    fi
+    AC_SUBST(LIBSSL_SSL_LIBS, "$LIBSSL_SSL_LIBS")
 fi
 CPPFLAGS=$tmp_CPPFLAGS
 LDFLAGS=$tmp_LDFLAGS
@@ -755,7 +859,7 @@ AC_CHECK_LIB(pcap, pcap_open_offline, [
     ]
 )
 AC_CHECK_HEADERS([netinet/in_systm.h net/if.h netinet/ip.h netinet/udp.h netinet/igmp.h netinet/if_ether.h netinet/ip6.h net/ethernet.h netinet/ip_compat.h],,, [
-AC_INCLUDES_DEFAULT 
+AC_INCLUDES_DEFAULT
 #ifdef HAVE_NETINET_IN_SYSTM_H
 #include <netinet/in_systm.h>
 #endif
@@ -796,8 +900,9 @@ AC_CHECK_TYPE(in_port_t, [], [AC_DEFINE([in_port_t], [uint16_t], [in_port_t])],
 #endif])
 ACX_CHECK_SS_FAMILY
 
-AC_FUNC_MALLOC
-AC_FUNC_REALLOC
+# AC_FUNC_MALLOC suffers false failures and causes Asan failures.
+# AC_FUNC_MALLOC
+# AC_FUNC_REALLOC
 
 AC_REPLACE_FUNCS(b64_pton)
 AC_REPLACE_FUNCS(b64_ntop)
@@ -815,6 +920,16 @@ AC_REPLACE_FUNCS(snprintf)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_FUNC_FORK
+AC_MSG_CHECKING([compile of fork])
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
+#include <unistd.h>
+], [
+	(void)fork();
+])], [
+	AC_MSG_RESULT(yes)
+	AC_DEFINE([HAVE_FORK_AVAILABLE], 1, [if fork is available for compile])
+], [	AC_MSG_RESULT(no)
+])
 AC_CHECK_FUNCS([endprotoent endservent sleep random fcntl strtoul bzero memset b32_ntop b32_pton])
 if test "x$HAVE_B32_NTOP" = "xyes"; then
 	AC_SUBST(ldns_build_config_have_b32_ntop, 1)
@@ -841,16 +956,31 @@ ACX_FUNC_IOCTLSOCKET
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
 
-# check OSX deployment target, if needed
-if echo $build_os | grep darwin > /dev/null; then
-  sdk_p=`xcode-select -print-path`;
-  sdk_v="$( /usr/bin/xcrun --show-sdk-version )";
-  case $sdk_v in
-       10.9|10.8)   sdk_c="10.7";;
-       10.11|10.10|*) sdk_c="10.10";;
-  esac
-  export MACOSX_DEPLOYMENT_TARGET="${sdk_c}";
-  export CFLAGS="$CFLAGS -mmacosx-version-min=${sdk_c} -isysroot ${sdk_p}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX${sdk_v}.sdk";
+AC_ARG_WITH(xcode-sdk, AC_HELP_STRING([--with-xcode-sdk],
+ [Set xcode SDK version. Default is autodetect]),
+ [],[with_xcode_sdk="yes"])
+if test "x_$with_xcode_sdk" != "x_no" ; then
+   # check OSX deployment target, if needed
+   if echo $target_os | grep darwin > /dev/null; then
+     sdk_p=`xcode-select -print-path`;
+     if test "x_$with_xcode_sdk" = "x_yes" ; then
+        sdk_v="$( /usr/bin/xcrun --show-sdk-version 2>/dev/null )"
+     else
+        sdk_v="$with_xcode_sdk"
+     fi
+     # xcrun only got that option in 10.7
+     if test -z "$sdk_v" ; then
+        sdk_c="10.6"
+        sdk_v="10.6"
+     fi
+     SYSROOT="$( find ${sdk_p} -name MacOSX${sdk_v}.sdk )"
+     case $sdk_v in
+          10.9|10.8)   sdk_c="10.7";;
+          10.11|10.10|*) sdk_c="10.10";;
+     esac
+     export MACOSX_DEPLOYMENT_TARGET="${sdk_c}";
+     export CFLAGS="$CFLAGS -mmacosx-version-min=${sdk_c} -isysroot ${SYSROOT}"
+   fi
 fi
 
 AC_DEFINE([SYSCONFDIR], [sysconfdir], [System configuration dir])
@@ -1016,10 +1146,10 @@ size_t strlcpy(char *dst, const char *src, size_t siz);
 
 #ifdef USE_WINSOCK
 #define SOCK_INVALID INVALID_SOCKET
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {closesocket(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {closesocket(_s); _s = -1;} } while(0)
 #else
 #define SOCK_INVALID -1
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {close(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s); _s = -1;} } while(0)
 #endif
 
 #ifdef __cplusplus
@@ -1049,7 +1179,7 @@ else
   AC_SUBST(ldns_build_config_have_attr_unused, 0)
 fi
 
-CONFIG_FILES="Makefile ldns/common.h ldns/net.h ldns/util.h packaging/libldns.pc packaging/ldns-config"
+CONFIG_FILES="Makefile libdns.doxygen ldns/common.h ldns/net.h ldns/util.h packaging/libldns.pc packaging/ldns-config"
 AC_SUBST(CONFIG_FILES)
 AC_CONFIG_FILES([$CONFIG_FILES])
 
@@ -1058,5 +1188,3 @@ AC_OUTPUT
 COPY_HEADER_FILES(ldns/, ldns/)
 
 dnl AC_CONFIG_SUBDIRS([drill])
-
-
diff --git a/contrib/ldns/contrib/DNS-LDNS/Changes b/contrib/ldns/contrib/DNS-LDNS/Changes
new file mode 100644
index 00000000000000..fbdcb2e47f932b
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/Changes
@@ -0,0 +1,53 @@
+Revision history for Perl extension DNS::LDNS.
+
+0.01  Thu Nov 22 12:48:29 2012
+	- original version; created by h2xs 1.23 with options
+		-A -n LDNS
+
+0.02  Fri Jan 18 09:47:57 2013
+        - Support for DNSSec and Resolver. Added some more constants from 
+	  the header files; created by h2xs 1.23 with options
+                -n LDNS /usr/include/ldns/ldns.h /usr/include/ldns/error.h /usr/include/ldns/rr.h /usr/include/ldns/keys.h /usr/include/ldns/packet.h /usr/include/ldns/resolver.h /usr/include/ldns/rdata.h /usr/include/ldns/dnssec.h
+
+0.03  Fri Apr 19 13:40:57 2013
+        - Renamed module to Net::LDNS
+
+0.04  Fri Dec 13 14:15:26 2013
+        - Renamed module to DNS::LDNS
+
+0.05  Mon Dec 30 10:14:00 2013
+        - Corrected versioning variable in all classes.
+        - Cleaned up the base class documentation.
+
+0.06  Tue Dec 31 12:17:00 2013
+        - Corrected pod syntax
+
+0.50  Sun Mar 30 11:05:23 2014
+        - Added prev parameter to the DNS::LDNS::RR::new(str) constructor.
+        - Corrected DNS::LDNS::RR::new(file/filename) constructor. Added prev
+          parameter, changed the default_ttl and origin parameters to 
+          references so they can return data back to the caller as intended.
+          Using the 'built-in' default values for ttl and origin, rather than
+          my own values.
+        - Corrected the DNS::LDNS::Zone::new() constructor. Corrected file
+          option for reading zone from stream. Using the 'built-in' default
+          values for ttl and origin, rather than my own values.
+        - Removed the $DNS::LDNS::DEFAULT_* variables, they proved to be less 
+          useful after modifying the Zone and RR constructors.
+        - More robust Makefile.PL. Check for existence of ldns library
+          and perl modules required for the test suite.
+
+0.51  Wed Apr 2 09:12:00 2014
+        - Added META.yml, and added some more package dependencies.
+        - Compatibility with ldns < 1.6.12.
+
+0.52  Tue May 5 09:13:00 2015
+        - Fixed typo in META.yml
+
+0.60  Thu Dec 29 11:15:00 2016
+        - Compatibility with ldns 1.7
+        - Dist::zilla build management
+
+0.61  Fri Dec 30 14:32:00 2016
+        - Bugfixes for ldns 1.7 compatibility
+        - Compatibility with perl 5.25
diff --git a/contrib/ldns/contrib/DNS-LDNS/LICENSE b/contrib/ldns/contrib/DNS-LDNS/LICENSE
new file mode 100644
index 00000000000000..35a251387ec50b
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/LICENSE
@@ -0,0 +1,4 @@
+This software is copyright (c) 2013 by UNINETT Norid AS.  No
+license is granted to other entities.
+
+All rights reserved.
diff --git a/contrib/ldns/contrib/DNS-LDNS/MANIFEST b/contrib/ldns/contrib/DNS-LDNS/MANIFEST
new file mode 100644
index 00000000000000..7cfbae91a46c22
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/MANIFEST
@@ -0,0 +1,38 @@
+Changes
+constants.PL
+dist.ini
+LDNS.xs
+lib/DNS/LDNS.pm
+lib/DNS/LDNS/DNSSecDataChain.pm
+lib/DNS/LDNS/DNSSecName.pm
+lib/DNS/LDNS/DNSSecRRs.pm
+lib/DNS/LDNS/DNSSecRRSets.pm
+lib/DNS/LDNS/DNSSecTrustTree.pm
+lib/DNS/LDNS/DNSSecZone.pm
+lib/DNS/LDNS/GC.pm
+lib/DNS/LDNS/Key.pm
+lib/DNS/LDNS/KeyList.pm
+lib/DNS/LDNS/Packet.pm
+lib/DNS/LDNS/RBNode.pm
+lib/DNS/LDNS/RBTree.pm
+lib/DNS/LDNS/RData.pm
+lib/DNS/LDNS/Resolver.pm
+lib/DNS/LDNS/RR.pm
+lib/DNS/LDNS/RRList.pm
+lib/DNS/LDNS/Zone.pm
+MANIFEST
+ppport.h
+README
+t/dnssec_datachain.t
+t/dnssec_zone.t
+t/key.t
+t/DNS-LDNS.t
+t/rdata.t
+t/resolver.t
+t/rr.t
+t/rrlist.t
+t/testdata/key.private
+t/testdata/myzone.org
+t/testdata/resolv.conf
+t/zone.t
+typemap
diff --git a/contrib/ldns/contrib/DNS-LDNS/META.yml b/contrib/ldns/contrib/DNS-LDNS/META.yml
new file mode 100644
index 00000000000000..79efd69d9e45fd
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/META.yml
@@ -0,0 +1,29 @@
+---
+abstract: 'Perl extension for the ldns library'
+author:
+  - 'Erik Ostlyngen <erik@uninett.no>'
+build_requires:
+  FindBin: '0'
+  Test::Exception: '0'
+  Test::More: '0'
+configure_requires:
+  Devel::CheckLib: '0.9'
+  ExtUtils::MakeMaker: '0'
+dynamic_config: 0
+generated_by: 'Dist::Zilla version 6.024, CPAN::Meta::Converter version 2.150010'
+license: restrictive
+meta-spec:
+  url: http://module-build.sourceforge.net/META-spec-v1.4.html
+  version: '1.4'
+name: DNS-LDNS
+requires:
+  AutoLoader: '0'
+  Carp: '0'
+  Exporter: '0'
+  XSLoader: '0'
+  perl: '5.014002'
+  strict: '0'
+  warnings: '0'
+version: '0.61'
+x_generated_by_perl: v5.34.0
+x_serialization_backend: 'YAML::Tiny version 1.73'
diff --git a/contrib/ldns/contrib/DNS-LDNS/Makefile.PL b/contrib/ldns/contrib/DNS-LDNS/Makefile.PL
new file mode 100644
index 00000000000000..53ed134757a5b7
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/Makefile.PL
@@ -0,0 +1,355 @@
+# This Makefile.PL for DNS-LDNS was generated by
+# Dist::Zilla::Plugin::MakeMaker::Awesome 0.49.
+# Don't edit it but the dist.ini and plugins used to construct it.
+
+use strict;
+use warnings;
+
+# inserted by Dist::Zilla::Plugin::CheckLib 0.007
+use Devel::CheckLib;
+check_lib_or_exit(
+    header => 'ldns/ldns.h',
+    lib => 'ldns',
+);
+
+use 5.014002;
+use ExtUtils::MakeMaker;
+
+my %WriteMakefileArgs = (
+  "ABSTRACT" => "Perl extension for the ldns library",
+  "AUTHOR" => "Erik Ostlyngen <erik\@uninett.no>",
+  "CONFIGURE_REQUIRES" => {
+    "Devel::CheckLib" => "0.9",
+    "ExtUtils::MakeMaker" => 0
+  },
+  "DISTNAME" => "DNS-LDNS",
+  "LICENSE" => "restrictive",
+  "MIN_PERL_VERSION" => "5.014002",
+  "NAME" => "DNS::LDNS",
+  "PREREQ_PM" => {
+    "AutoLoader" => 0,
+    "Carp" => 0,
+    "Exporter" => 0,
+    "XSLoader" => 0,
+    "strict" => 0,
+    "warnings" => 0
+  },
+  "TEST_REQUIRES" => {
+    "FindBin" => 0,
+    "Test::Exception" => 0,
+    "Test::More" => 0
+  },
+  "VERSION" => "0.61",
+  "test" => {
+    "TESTS" => "t/*.t"
+  }
+);
+
+%WriteMakefileArgs = (
+    %WriteMakefileArgs,
+    LIBS => ['-lldns'],
+);
+
+my %FallbackPrereqs = (
+  "AutoLoader" => 0,
+  "Carp" => 0,
+  "Exporter" => 0,
+  "FindBin" => 0,
+  "Test::Exception" => 0,
+  "Test::More" => 0,
+  "XSLoader" => 0,
+  "strict" => 0,
+  "warnings" => 0
+);
+
+unless ( eval { ExtUtils::MakeMaker->VERSION('6.63_03') } ) {
+  delete $WriteMakefileArgs{TEST_REQUIRES};
+  delete $WriteMakefileArgs{BUILD_REQUIRES};
+  $WriteMakefileArgs{PREREQ_PM} = \%FallbackPrereqs;
+}
+
+delete $WriteMakefileArgs{CONFIGURE_REQUIRES}
+  unless eval { ExtUtils::MakeMaker->VERSION(6.52) };
+
+WriteMakefile(%WriteMakefileArgs);
+
+use ExtUtils::Constant;
+
+# If you edit these definitions to change the constants used by this module,
+# you will need to use the generated const-c.inc and const-xs.inc
+# files to replace their "fallback" counterparts before distributing your
+# changes.
+my @names = (qw(LDNS_AA LDNS_AD LDNS_CD LDNS_DEFAULT_EXP_TIME
+                 LDNS_DEFAULT_TTL LDNS_DNSSEC_KEYPROTO LDNS_IP4ADDRLEN
+                 LDNS_IP6ADDRLEN LDNS_KEY_REVOKE_KEY LDNS_KEY_SEP_KEY
+                 LDNS_KEY_ZONE_KEY LDNS_MAX_DOMAINLEN LDNS_MAX_KEYLEN
+                 LDNS_MAX_LABELLEN LDNS_MAX_PACKETLEN LDNS_MAX_POINTERS 
+                 LDNS_MAX_RDFLEN LDNS_NSEC3_MAX_ITERATIONS
+                 LDNS_NSEC3_VARS_OPTOUT_MASK LDNS_PORT LDNS_QR LDNS_RA LDNS_RD
+                 LDNS_RDATA_FIELD_DESCRIPTORS_COMMON LDNS_RDF_SIZE_16BYTES
+                 LDNS_RDF_SIZE_6BYTES LDNS_RDF_SIZE_BYTE
+                 LDNS_RDF_SIZE_DOUBLEWORD LDNS_RDF_SIZE_WORD LDNS_RESOLV_ANCHOR
+                 LDNS_RESOLV_DEFDOMAIN LDNS_RESOLV_INET LDNS_RESOLV_INET6
+                 LDNS_RESOLV_INETANY LDNS_RESOLV_KEYWORD LDNS_RESOLV_KEYWORDS
+                 LDNS_RESOLV_NAMESERVER LDNS_RESOLV_OPTIONS LDNS_RESOLV_RTT_INF
+                 LDNS_RESOLV_RTT_MIN LDNS_RESOLV_SEARCH LDNS_RESOLV_SORTLIST
+                 LDNS_RR_OVERHEAD LDNS_SIGNATURE_LEAVE_ADD_NEW
+                 LDNS_SIGNATURE_LEAVE_NO_ADD LDNS_SIGNATURE_REMOVE_ADD_NEW
+                 LDNS_SIGNATURE_REMOVE_NO_ADD LDNS_TC),
+	     {name=>"LDNS_CERT_ACPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_IACPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_IPGP", macro=>"1"},
+	     {name=>"LDNS_CERT_IPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_ISPKI", macro=>"1"},
+	     {name=>"LDNS_CERT_OID", macro=>"1"},
+	     {name=>"LDNS_CERT_PGP", macro=>"1"},
+	     {name=>"LDNS_CERT_PKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_SPKI", macro=>"1"},
+	     {name=>"LDNS_CERT_URI", macro=>"1"},
+	     {name=>"LDNS_DH", macro=>"1"},
+	     {name=>"LDNS_DSA", macro=>"1"},
+	     {name=>"LDNS_DSA_NSEC3", macro=>"1"},
+	     {name=>"LDNS_ECC", macro=>"1"},
+	     {name=>"LDNS_ECC_GOST", macro=>"1"},
+	     {name=>"LDNS_HASH_GOST", macro=>"1"},
+	     {name=>"LDNS_PACKET_ANSWER", macro=>"1"},
+	     {name=>"LDNS_PACKET_IQUERY", macro=>"1"},
+	     {name=>"LDNS_PACKET_NODATA", macro=>"1"},
+	     {name=>"LDNS_PACKET_NOTIFY", macro=>"1"},
+	     {name=>"LDNS_PACKET_NXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_PACKET_QUERY", macro=>"1"},
+	     {name=>"LDNS_PACKET_QUESTION", macro=>"1"},
+	     {name=>"LDNS_PACKET_REFERRAL", macro=>"1"},
+	     {name=>"LDNS_PACKET_STATUS", macro=>"1"},
+	     {name=>"LDNS_PACKET_UNKNOWN", macro=>"1"},
+	     {name=>"LDNS_PACKET_UPDATE", macro=>"1"},
+	     {name=>"LDNS_PRIVATEDNS", macro=>"1"},
+	     {name=>"LDNS_PRIVATEOID", macro=>"1"},
+	     {name=>"LDNS_RCODE_FORMERR", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOERROR", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTAUTH", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTIMPL", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTZONE", macro=>"1"},
+	     {name=>"LDNS_RCODE_NXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_RCODE_NXRRSET", macro=>"1"},
+	     {name=>"LDNS_RCODE_REFUSED", macro=>"1"},
+	     {name=>"LDNS_RCODE_SERVFAIL", macro=>"1"},
+	     {name=>"LDNS_RCODE_YXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_RCODE_YXRRSET", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_A", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_AAAA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_ALG", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_APL", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_ATMA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_B32_EXT", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_B64", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_CERT_ALG", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_CLASS", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_DNAME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_HEX", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT16", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT16_DATA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT32", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT8", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_IPSECKEY", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_LOC", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NONE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSAP", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC3_NEXT_OWNER", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC3_SALT", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_PERIOD", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_SERVICE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_STR", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TIME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_HIP", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TSIGTIME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TYPE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_UNKNOWN", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_WKS", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_ANY", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_CH", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_COUNT", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_FIRST", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_HS", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_IN", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_LAST", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_NONE", macro=>"1"},
+	     {name=>"LDNS_RR_COMPRESS", macro=>"1"},
+	     {name=>"LDNS_RR_NO_COMPRESS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_A", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_A6", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AAAA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AFSDB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ANY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_APL", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ATMA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AXFR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_CERT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_CNAME", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_COUNT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DHCID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DLV", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DNAME", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_EID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_FIRST", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_GID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_GPOS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_HINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_IPSECKEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ISDN", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_IXFR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_KEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_KX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_LAST", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_LOC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MAILA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MAILB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MD", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MF", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NAPTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NIMLOC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSAP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSAP_PTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3PARAM", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3PARAMS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NULL", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NXT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_OPT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_PTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_PX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RRSIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SINK", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SOA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SPF", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SRV", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SSHFP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TALINK", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TSIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TXT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UNSPEC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_WKS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_X25", macro=>"1"},
+	     {name=>"LDNS_RSAMD5", macro=>"1"},
+	     {name=>"LDNS_RSASHA1", macro=>"1"},
+	     {name=>"LDNS_RSASHA1_NSEC3", macro=>"1"},
+	     {name=>"LDNS_RSASHA256", macro=>"1"},
+	     {name=>"LDNS_RSASHA512", macro=>"1"},
+	     {name=>"LDNS_SECTION_ADDITIONAL", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANSWER", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANY", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANY_NOQUESTION", macro=>"1"},
+	     {name=>"LDNS_SECTION_AUTHORITY", macro=>"1"},
+	     {name=>"LDNS_SECTION_QUESTION", macro=>"1"},
+	     {name=>"LDNS_SHA1", macro=>"1"},
+	     {name=>"LDNS_SHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_DSA", macro=>"1"},
+	     {name=>"LDNS_SIGN_DSA_NSEC3", macro=>"1"},
+	     {name=>"LDNS_SIGN_ECC_GOST", macro=>"1"},
+	     {name=>"LDNS_SIGN_HMACSHA1", macro=>"1"},
+	     {name=>"LDNS_SIGN_HMACSHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSAMD5", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA1", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA1_NSEC3", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA512", macro=>"1"},
+	     {name=>"LDNS_STATUS_ADDRESS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CERT_BAD_ALGORITHM", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_BOGUS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_DS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_RRSIG", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_TRUSTED_DS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_SIG_EXPIRED", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TSIG_BOGUS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TSIG_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_UNKNOWN_ALGO", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_VALIDATED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DDD_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_EXISTENCE_DENIED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DOMAINNAME_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_DOMAINNAME_UNDERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_EMPTY_LABEL", macro=>"1"},
+	     {name=>"LDNS_STATUS_ENGINE_KEY_NOT_LOADED", macro=>"1"},
+	     {name=>"LDNS_STATUS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_FILE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INTERNAL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_B32_EXT", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_B64", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_HEX", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_INT", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_IP4", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_IP6", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_POINTER", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_STR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_TIME", macro=>"1"},
+	     {name=>"LDNS_STATUS_LABEL_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_MEM_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_MISSING_RDATA_FIELDS_KEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG", macro=>"1"},
+	     {name=>"LDNS_STATUS_NETWORK_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_NOT_IMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_NO_DATA", macro=>"1"},
+	     {name=>"LDNS_STATUS_NSEC3_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_NULL", macro=>"1"},
+	     {name=>"LDNS_STATUS_OK", macro=>"1"},
+	     {name=>"LDNS_STATUS_PACKET_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_RES_NO_NS", macro=>"1"},
+	     {name=>"LDNS_STATUS_RES_QUERY", macro=>"1"},
+	     {name=>"LDNS_STATUS_SOCKET_ERROR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SSL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ALG_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_BAD_ESCAPE", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_CLASS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_DNAME_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_EMPTY", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INCLUDE", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ITERATIONS_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_KEYWORD_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ORIGIN", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_RDATA_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TTL", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TTL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TYPE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_VERSION_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_UNKNOWN_INET", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_ANSWER", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_HEADER", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_QUESTION", macro=>"1"});
+ExtUtils::Constant::WriteConstants(
+    NAME         => 'LDNS',
+    NAMES        => \@names,
+    DEFAULT_TYPE => 'IV',
+    C_FILE       => 'const-c.inc',
+    XS_FILE      => 'const-xs.inc',
+);
diff --git a/contrib/ldns/contrib/DNS-LDNS/README b/contrib/ldns/contrib/DNS-LDNS/README
new file mode 100644
index 00000000000000..035d08bbca45c5
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/README
@@ -0,0 +1,36 @@
+DNS::LDNS version 0.61
+======================
+
+DESCRIPTION
+
+DNS::LDNS is a perl OO-wrapper for the ldns library. For a detailed 
+description on how this library works, you are advised to read the ldns 
+documentation. For a functional description of the wrapper classes,
+please read the perldoc for DNS::LDNS and subclasses.
+
+INSTALLATION
+
+To install this module type the following:
+
+   perl Makefile.PL
+   make
+   make test
+   make install
+
+DEPENDENCIES
+
+This module requires these other modules and libraries:
+
+    ldns
+
+AUTHOR
+
+Erik Pihl Ostlyngen, erik.ostlyngen@uninett.no
+
+COPYRIGHT AND LICENCE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.8.8 or,
+at your option, any later version of Perl 5 you may have available.
diff --git a/contrib/ldns/contrib/DNS-LDNS/constants.PL b/contrib/ldns/contrib/DNS-LDNS/constants.PL
new file mode 100644
index 00000000000000..78885aaf5718c5
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/constants.PL
@@ -0,0 +1,280 @@
+use ExtUtils::Constant;
+
+# If you edit these definitions to change the constants used by this module,
+# you will need to use the generated const-c.inc and const-xs.inc
+# files to replace their "fallback" counterparts before distributing your
+# changes.
+my @names = (qw(LDNS_AA LDNS_AD LDNS_CD LDNS_DEFAULT_EXP_TIME
+                 LDNS_DEFAULT_TTL LDNS_DNSSEC_KEYPROTO LDNS_IP4ADDRLEN
+                 LDNS_IP6ADDRLEN LDNS_KEY_REVOKE_KEY LDNS_KEY_SEP_KEY
+                 LDNS_KEY_ZONE_KEY LDNS_MAX_DOMAINLEN LDNS_MAX_KEYLEN
+                 LDNS_MAX_LABELLEN LDNS_MAX_PACKETLEN LDNS_MAX_POINTERS 
+                 LDNS_MAX_RDFLEN LDNS_NSEC3_MAX_ITERATIONS
+                 LDNS_NSEC3_VARS_OPTOUT_MASK LDNS_PORT LDNS_QR LDNS_RA LDNS_RD
+                 LDNS_RDATA_FIELD_DESCRIPTORS_COMMON LDNS_RDF_SIZE_16BYTES
+                 LDNS_RDF_SIZE_6BYTES LDNS_RDF_SIZE_BYTE
+                 LDNS_RDF_SIZE_DOUBLEWORD LDNS_RDF_SIZE_WORD LDNS_RESOLV_ANCHOR
+                 LDNS_RESOLV_DEFDOMAIN LDNS_RESOLV_INET LDNS_RESOLV_INET6
+                 LDNS_RESOLV_INETANY LDNS_RESOLV_KEYWORD LDNS_RESOLV_KEYWORDS
+                 LDNS_RESOLV_NAMESERVER LDNS_RESOLV_OPTIONS LDNS_RESOLV_RTT_INF
+                 LDNS_RESOLV_RTT_MIN LDNS_RESOLV_SEARCH LDNS_RESOLV_SORTLIST
+                 LDNS_RR_OVERHEAD LDNS_SIGNATURE_LEAVE_ADD_NEW
+                 LDNS_SIGNATURE_LEAVE_NO_ADD LDNS_SIGNATURE_REMOVE_ADD_NEW
+                 LDNS_SIGNATURE_REMOVE_NO_ADD LDNS_TC),
+	     {name=>"LDNS_CERT_ACPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_IACPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_IPGP", macro=>"1"},
+	     {name=>"LDNS_CERT_IPKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_ISPKI", macro=>"1"},
+	     {name=>"LDNS_CERT_OID", macro=>"1"},
+	     {name=>"LDNS_CERT_PGP", macro=>"1"},
+	     {name=>"LDNS_CERT_PKIX", macro=>"1"},
+	     {name=>"LDNS_CERT_SPKI", macro=>"1"},
+	     {name=>"LDNS_CERT_URI", macro=>"1"},
+	     {name=>"LDNS_DH", macro=>"1"},
+	     {name=>"LDNS_DSA", macro=>"1"},
+	     {name=>"LDNS_DSA_NSEC3", macro=>"1"},
+	     {name=>"LDNS_ECC", macro=>"1"},
+	     {name=>"LDNS_ECC_GOST", macro=>"1"},
+	     {name=>"LDNS_HASH_GOST", macro=>"1"},
+	     {name=>"LDNS_PACKET_ANSWER", macro=>"1"},
+	     {name=>"LDNS_PACKET_IQUERY", macro=>"1"},
+	     {name=>"LDNS_PACKET_NODATA", macro=>"1"},
+	     {name=>"LDNS_PACKET_NOTIFY", macro=>"1"},
+	     {name=>"LDNS_PACKET_NXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_PACKET_QUERY", macro=>"1"},
+	     {name=>"LDNS_PACKET_QUESTION", macro=>"1"},
+	     {name=>"LDNS_PACKET_REFERRAL", macro=>"1"},
+	     {name=>"LDNS_PACKET_STATUS", macro=>"1"},
+	     {name=>"LDNS_PACKET_UNKNOWN", macro=>"1"},
+	     {name=>"LDNS_PACKET_UPDATE", macro=>"1"},
+	     {name=>"LDNS_PRIVATEDNS", macro=>"1"},
+	     {name=>"LDNS_PRIVATEOID", macro=>"1"},
+	     {name=>"LDNS_RCODE_FORMERR", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOERROR", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTAUTH", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTIMPL", macro=>"1"},
+	     {name=>"LDNS_RCODE_NOTZONE", macro=>"1"},
+	     {name=>"LDNS_RCODE_NXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_RCODE_NXRRSET", macro=>"1"},
+	     {name=>"LDNS_RCODE_REFUSED", macro=>"1"},
+	     {name=>"LDNS_RCODE_SERVFAIL", macro=>"1"},
+	     {name=>"LDNS_RCODE_YXDOMAIN", macro=>"1"},
+	     {name=>"LDNS_RCODE_YXRRSET", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_A", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_AAAA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_ALG", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_APL", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_ATMA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_B32_EXT", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_B64", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_CERT_ALG", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_CLASS", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_DNAME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_HEX", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT16", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT16_DATA", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT32", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_INT8", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_IPSECKEY", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_LOC", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NONE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSAP", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC3_NEXT_OWNER", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_NSEC3_SALT", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_PERIOD", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_SERVICE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_STR", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TIME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_HIP", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TSIGTIME", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_TYPE", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_UNKNOWN", macro=>"1"},
+	     {name=>"LDNS_RDF_TYPE_WKS", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_ANY", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_CH", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_COUNT", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_FIRST", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_HS", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_IN", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_LAST", macro=>"1"},
+	     {name=>"LDNS_RR_CLASS_NONE", macro=>"1"},
+	     {name=>"LDNS_RR_COMPRESS", macro=>"1"},
+	     {name=>"LDNS_RR_NO_COMPRESS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_A", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_A6", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AAAA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AFSDB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ANY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_APL", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ATMA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_AXFR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_CERT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_CNAME", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_COUNT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DHCID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DLV", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DNAME", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_DS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_EID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_FIRST", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_GID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_GPOS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_HINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_IPSECKEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_ISDN", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_IXFR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_KEY", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_KX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_LAST", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_LOC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MAILA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MAILB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MB", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MD", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MF", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_MX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NAPTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NIMLOC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSAP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSAP_PTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3PARAM", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NSEC3PARAMS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NULL", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_NXT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_OPT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_PTR", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_PX", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RRSIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_RT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SINK", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SOA", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SPF", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SRV", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_SSHFP", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TALINK", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TSIG", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_TXT", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UID", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UINFO", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_UNSPEC", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_WKS", macro=>"1"},
+	     {name=>"LDNS_RR_TYPE_X25", macro=>"1"},
+	     {name=>"LDNS_RSAMD5", macro=>"1"},
+	     {name=>"LDNS_RSASHA1", macro=>"1"},
+	     {name=>"LDNS_RSASHA1_NSEC3", macro=>"1"},
+	     {name=>"LDNS_RSASHA256", macro=>"1"},
+	     {name=>"LDNS_RSASHA512", macro=>"1"},
+	     {name=>"LDNS_SECTION_ADDITIONAL", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANSWER", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANY", macro=>"1"},
+	     {name=>"LDNS_SECTION_ANY_NOQUESTION", macro=>"1"},
+	     {name=>"LDNS_SECTION_AUTHORITY", macro=>"1"},
+	     {name=>"LDNS_SECTION_QUESTION", macro=>"1"},
+	     {name=>"LDNS_SHA1", macro=>"1"},
+	     {name=>"LDNS_SHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_DSA", macro=>"1"},
+	     {name=>"LDNS_SIGN_DSA_NSEC3", macro=>"1"},
+	     {name=>"LDNS_SIGN_ECC_GOST", macro=>"1"},
+	     {name=>"LDNS_SIGN_HMACSHA1", macro=>"1"},
+	     {name=>"LDNS_SIGN_HMACSHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSAMD5", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA1", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA1_NSEC3", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA256", macro=>"1"},
+	     {name=>"LDNS_SIGN_RSASHA512", macro=>"1"},
+	     {name=>"LDNS_STATUS_ADDRESS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CERT_BAD_ALGORITHM", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_BOGUS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_DS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_RRSIG", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_NO_TRUSTED_DS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_SIG_EXPIRED", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TSIG_BOGUS", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TSIG_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_UNKNOWN_ALGO", macro=>"1"},
+	     {name=>"LDNS_STATUS_CRYPTO_VALIDATED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DDD_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_EXISTENCE_DENIED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED", macro=>"1"},
+	     {name=>"LDNS_STATUS_DOMAINNAME_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_DOMAINNAME_UNDERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_EMPTY_LABEL", macro=>"1"},
+	     {name=>"LDNS_STATUS_ENGINE_KEY_NOT_LOADED", macro=>"1"},
+	     {name=>"LDNS_STATUS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_FILE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INTERNAL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_B32_EXT", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_B64", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_HEX", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_INT", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_IP4", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_IP6", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_POINTER", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_STR", macro=>"1"},
+	     {name=>"LDNS_STATUS_INVALID_TIME", macro=>"1"},
+	     {name=>"LDNS_STATUS_LABEL_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_MEM_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_MISSING_RDATA_FIELDS_KEY", macro=>"1"},
+	     {name=>"LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG", macro=>"1"},
+	     {name=>"LDNS_STATUS_NETWORK_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_NOT_IMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_NO_DATA", macro=>"1"},
+	     {name=>"LDNS_STATUS_NSEC3_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_NULL", macro=>"1"},
+	     {name=>"LDNS_STATUS_OK", macro=>"1"},
+	     {name=>"LDNS_STATUS_PACKET_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_RES_NO_NS", macro=>"1"},
+	     {name=>"LDNS_STATUS_RES_QUERY", macro=>"1"},
+	     {name=>"LDNS_STATUS_SOCKET_ERROR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SSL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ALG_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_BAD_ESCAPE", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_CLASS_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_DNAME_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_EMPTY", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INCLUDE", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ITERATIONS_OVERFLOW", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_KEYWORD_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_ORIGIN", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_RDATA_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TTL", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TTL_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_TYPE_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_SYNTAX_VERSION_ERR", macro=>"1"},
+	     {name=>"LDNS_STATUS_UNKNOWN_INET", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_ANSWER", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_HEADER", macro=>"1"},
+	     {name=>"LDNS_STATUS_WIRE_INCOMPLETE_QUESTION", macro=>"1"});
+ExtUtils::Constant::WriteConstants(
+    NAME         => 'LDNS',
+    NAMES        => \@names,
+    DEFAULT_TYPE => 'IV',
+    C_FILE       => 'const-c.inc',
+    XS_FILE      => 'const-xs.inc',
+);
diff --git a/contrib/ldns/contrib/DNS-LDNS/dist.ini b/contrib/ldns/contrib/DNS-LDNS/dist.ini
new file mode 100644
index 00000000000000..553fb8633424f4
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/dist.ini
@@ -0,0 +1,18 @@
+name    = DNS-LDNS
+author  = Erik Ostlyngen <erik@uninett.no>
+copyright_holder = UNINETT Norid AS
+copyright_year = 2013
+license = None
+version = 0.61
+
+[AutoPrereqs]
+[GatherDir]
+[MetaYAML]
+[MakeMaker::Awesome]
+WriteMakefile_arg = LIBS => ['-lldns']
+footer_file = constants.PL
+[CheckLib]
+lib = ldns
+header = ldns/ldns.h
+[License]
+[PruneCruft]
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS.pm
new file mode 100644
index 00000000000000..5f01849c9698be
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS.pm
@@ -0,0 +1,1298 @@
+package DNS::LDNS;
+
+use 5.014002;
+use strict;
+use warnings;
+use Carp;
+
+require Exporter;
+use AutoLoader;
+
+our @ISA = qw(Exporter);
+
+# Items to export into callers namespace by default. Note: do not export
+# names by default without a very good reason. Use EXPORT_OK instead.
+# Do not simply export all your public functions/methods/constants.
+
+our %EXPORT_TAGS = ( 'all' => [ qw(
+	LDNS_AA
+	LDNS_AD
+	LDNS_CD
+	LDNS_CERT_ACPKIX
+	LDNS_CERT_IACPKIX
+	LDNS_CERT_IPGP
+	LDNS_CERT_IPKIX
+	LDNS_CERT_ISPKI
+	LDNS_CERT_OID
+	LDNS_CERT_PGP
+	LDNS_CERT_PKIX
+	LDNS_CERT_SPKI
+	LDNS_CERT_URI
+	LDNS_DEFAULT_EXP_TIME
+	LDNS_DEFAULT_TTL
+	LDNS_DH
+	LDNS_DNSSEC_KEYPROTO
+	LDNS_DSA
+	LDNS_DSA_NSEC3
+	LDNS_ECC
+	LDNS_ECC_GOST
+	LDNS_HASH_GOST
+	LDNS_IP4ADDRLEN
+	LDNS_IP6ADDRLEN
+	LDNS_KEY_REVOKE_KEY
+	LDNS_KEY_SEP_KEY
+	LDNS_KEY_ZONE_KEY
+	LDNS_MAX_DOMAINLEN
+	LDNS_MAX_KEYLEN
+	LDNS_MAX_LABELLEN
+	LDNS_MAX_PACKETLEN
+	LDNS_MAX_POINTERS
+	LDNS_MAX_RDFLEN
+	LDNS_NSEC3_MAX_ITERATIONS
+	LDNS_NSEC3_VARS_OPTOUT_MASK
+	LDNS_PACKET_ANSWER
+	LDNS_PACKET_IQUERY
+	LDNS_PACKET_NODATA
+	LDNS_PACKET_NOTIFY
+	LDNS_PACKET_NXDOMAIN
+	LDNS_PACKET_QUERY
+	LDNS_PACKET_QUESTION
+	LDNS_PACKET_REFERRAL
+	LDNS_PACKET_STATUS
+	LDNS_PACKET_UNKNOWN
+	LDNS_PACKET_UPDATE
+	LDNS_PORT
+	LDNS_PRIVATEDNS
+	LDNS_PRIVATEOID
+	LDNS_QR
+	LDNS_RA
+	LDNS_RCODE_FORMERR
+	LDNS_RCODE_NOERROR
+	LDNS_RCODE_NOTAUTH
+	LDNS_RCODE_NOTIMPL
+	LDNS_RCODE_NOTZONE
+	LDNS_RCODE_NXDOMAIN
+	LDNS_RCODE_NXRRSET
+	LDNS_RCODE_REFUSED
+	LDNS_RCODE_SERVFAIL
+	LDNS_RCODE_YXDOMAIN
+	LDNS_RCODE_YXRRSET
+	LDNS_RD
+	LDNS_RDATA_FIELD_DESCRIPTORS_COMMON
+	LDNS_RDF_SIZE_16BYTES
+	LDNS_RDF_SIZE_6BYTES
+	LDNS_RDF_SIZE_BYTE
+	LDNS_RDF_SIZE_DOUBLEWORD
+	LDNS_RDF_SIZE_WORD
+	LDNS_RDF_TYPE_A
+	LDNS_RDF_TYPE_AAAA
+	LDNS_RDF_TYPE_ALG
+	LDNS_RDF_TYPE_APL
+	LDNS_RDF_TYPE_ATMA
+	LDNS_RDF_TYPE_B32_EXT
+	LDNS_RDF_TYPE_B64
+	LDNS_RDF_TYPE_CERT_ALG
+	LDNS_RDF_TYPE_CLASS
+	LDNS_RDF_TYPE_DNAME
+	LDNS_RDF_TYPE_HEX
+	LDNS_RDF_TYPE_INT16
+	LDNS_RDF_TYPE_INT16_DATA
+	LDNS_RDF_TYPE_INT32
+	LDNS_RDF_TYPE_INT8
+	LDNS_RDF_TYPE_IPSECKEY
+	LDNS_RDF_TYPE_LOC
+	LDNS_RDF_TYPE_NONE
+	LDNS_RDF_TYPE_NSAP
+	LDNS_RDF_TYPE_NSEC
+	LDNS_RDF_TYPE_NSEC3_NEXT_OWNER
+	LDNS_RDF_TYPE_NSEC3_SALT
+	LDNS_RDF_TYPE_PERIOD
+	LDNS_RDF_TYPE_SERVICE
+	LDNS_RDF_TYPE_STR
+	LDNS_RDF_TYPE_TIME
+	LDNS_RDF_TYPE_HIP
+	LDNS_RDF_TYPE_TSIGTIME
+	LDNS_RDF_TYPE_TYPE
+	LDNS_RDF_TYPE_UNKNOWN
+	LDNS_RDF_TYPE_WKS
+	LDNS_RESOLV_ANCHOR
+	LDNS_RESOLV_DEFDOMAIN
+	LDNS_RESOLV_INET
+	LDNS_RESOLV_INET6
+	LDNS_RESOLV_INETANY
+	LDNS_RESOLV_KEYWORD
+	LDNS_RESOLV_KEYWORDS
+	LDNS_RESOLV_NAMESERVER
+	LDNS_RESOLV_OPTIONS
+	LDNS_RESOLV_RTT_INF
+	LDNS_RESOLV_RTT_MIN
+	LDNS_RESOLV_SEARCH
+	LDNS_RESOLV_SORTLIST
+	LDNS_RR_CLASS_ANY
+	LDNS_RR_CLASS_CH
+	LDNS_RR_CLASS_COUNT
+	LDNS_RR_CLASS_FIRST
+	LDNS_RR_CLASS_HS
+	LDNS_RR_CLASS_IN
+	LDNS_RR_CLASS_LAST
+	LDNS_RR_CLASS_NONE
+	LDNS_RR_COMPRESS
+	LDNS_RR_NO_COMPRESS
+	LDNS_RR_OVERHEAD
+	LDNS_RR_TYPE_A
+	LDNS_RR_TYPE_A6
+	LDNS_RR_TYPE_AAAA
+	LDNS_RR_TYPE_AFSDB
+	LDNS_RR_TYPE_ANY
+	LDNS_RR_TYPE_APL
+	LDNS_RR_TYPE_ATMA
+	LDNS_RR_TYPE_AXFR
+	LDNS_RR_TYPE_CERT
+	LDNS_RR_TYPE_CNAME
+	LDNS_RR_TYPE_COUNT
+	LDNS_RR_TYPE_DHCID
+	LDNS_RR_TYPE_DLV
+	LDNS_RR_TYPE_DNAME
+	LDNS_RR_TYPE_DNSKEY
+	LDNS_RR_TYPE_DS
+	LDNS_RR_TYPE_EID
+	LDNS_RR_TYPE_FIRST
+	LDNS_RR_TYPE_GID
+	LDNS_RR_TYPE_GPOS
+	LDNS_RR_TYPE_HINFO
+	LDNS_RR_TYPE_IPSECKEY
+	LDNS_RR_TYPE_ISDN
+	LDNS_RR_TYPE_IXFR
+	LDNS_RR_TYPE_KEY
+	LDNS_RR_TYPE_KX
+	LDNS_RR_TYPE_LAST
+	LDNS_RR_TYPE_LOC
+	LDNS_RR_TYPE_MAILA
+	LDNS_RR_TYPE_MAILB
+	LDNS_RR_TYPE_MB
+	LDNS_RR_TYPE_MD
+	LDNS_RR_TYPE_MF
+	LDNS_RR_TYPE_MG
+	LDNS_RR_TYPE_MINFO
+	LDNS_RR_TYPE_MR
+	LDNS_RR_TYPE_MX
+	LDNS_RR_TYPE_NAPTR
+	LDNS_RR_TYPE_NIMLOC
+	LDNS_RR_TYPE_NS
+	LDNS_RR_TYPE_NSAP
+	LDNS_RR_TYPE_NSAP_PTR
+	LDNS_RR_TYPE_NSEC
+	LDNS_RR_TYPE_NSEC3
+	LDNS_RR_TYPE_NSEC3PARAM
+	LDNS_RR_TYPE_NSEC3PARAMS
+	LDNS_RR_TYPE_NULL
+	LDNS_RR_TYPE_NXT
+	LDNS_RR_TYPE_OPT
+	LDNS_RR_TYPE_PTR
+	LDNS_RR_TYPE_PX
+	LDNS_RR_TYPE_RP
+	LDNS_RR_TYPE_RRSIG
+	LDNS_RR_TYPE_RT
+	LDNS_RR_TYPE_SIG
+	LDNS_RR_TYPE_SINK
+	LDNS_RR_TYPE_SOA
+	LDNS_RR_TYPE_SPF
+	LDNS_RR_TYPE_SRV
+	LDNS_RR_TYPE_SSHFP
+	LDNS_RR_TYPE_TALINK
+	LDNS_RR_TYPE_TSIG
+	LDNS_RR_TYPE_TXT
+	LDNS_RR_TYPE_UID
+	LDNS_RR_TYPE_UINFO
+	LDNS_RR_TYPE_UNSPEC
+	LDNS_RR_TYPE_WKS
+	LDNS_RR_TYPE_X25
+	LDNS_RSAMD5
+	LDNS_RSASHA1
+	LDNS_RSASHA1_NSEC3
+	LDNS_RSASHA256
+	LDNS_RSASHA512
+	LDNS_SECTION_ADDITIONAL
+	LDNS_SECTION_ANSWER
+	LDNS_SECTION_ANY
+	LDNS_SECTION_ANY_NOQUESTION
+	LDNS_SECTION_AUTHORITY
+	LDNS_SECTION_QUESTION
+	LDNS_SHA1
+	LDNS_SHA256
+	LDNS_SIGNATURE_LEAVE_ADD_NEW
+	LDNS_SIGNATURE_LEAVE_NO_ADD
+	LDNS_SIGNATURE_REMOVE_ADD_NEW
+	LDNS_SIGNATURE_REMOVE_NO_ADD
+	LDNS_SIGN_DSA
+	LDNS_SIGN_DSA_NSEC3
+	LDNS_SIGN_ECC_GOST
+	LDNS_SIGN_HMACSHA1
+	LDNS_SIGN_HMACSHA256
+	LDNS_SIGN_RSAMD5
+	LDNS_SIGN_RSASHA1
+	LDNS_SIGN_RSASHA1_NSEC3
+	LDNS_SIGN_RSASHA256
+	LDNS_SIGN_RSASHA512
+	LDNS_STATUS_ADDRESS_ERR
+	LDNS_STATUS_CERT_BAD_ALGORITHM
+	LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL
+	LDNS_STATUS_CRYPTO_BOGUS
+	LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION
+	LDNS_STATUS_CRYPTO_NO_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_DS
+	LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_RRSIG
+	LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_TRUSTED_DS
+	LDNS_STATUS_CRYPTO_SIG_EXPIRED
+	LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED
+	LDNS_STATUS_CRYPTO_TSIG_BOGUS
+	LDNS_STATUS_CRYPTO_TSIG_ERR
+	LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR
+	LDNS_STATUS_CRYPTO_UNKNOWN_ALGO
+	LDNS_STATUS_CRYPTO_VALIDATED
+	LDNS_STATUS_DDD_OVERFLOW
+	LDNS_STATUS_DNSSEC_EXISTENCE_DENIED
+	LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND
+	LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED
+	LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED
+	LDNS_STATUS_DOMAINNAME_OVERFLOW
+	LDNS_STATUS_DOMAINNAME_UNDERFLOW
+	LDNS_STATUS_EMPTY_LABEL
+	LDNS_STATUS_ENGINE_KEY_NOT_LOADED
+	LDNS_STATUS_ERR
+	LDNS_STATUS_FILE_ERR
+	LDNS_STATUS_INTERNAL_ERR
+	LDNS_STATUS_INVALID_B32_EXT
+	LDNS_STATUS_INVALID_B64
+	LDNS_STATUS_INVALID_HEX
+	LDNS_STATUS_INVALID_INT
+	LDNS_STATUS_INVALID_IP4
+	LDNS_STATUS_INVALID_IP6
+	LDNS_STATUS_INVALID_POINTER
+	LDNS_STATUS_INVALID_STR
+	LDNS_STATUS_INVALID_TIME
+	LDNS_STATUS_LABEL_OVERFLOW
+	LDNS_STATUS_MEM_ERR
+	LDNS_STATUS_MISSING_RDATA_FIELDS_KEY
+	LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG
+	LDNS_STATUS_NETWORK_ERR
+	LDNS_STATUS_NOT_IMPL
+	LDNS_STATUS_NO_DATA
+	LDNS_STATUS_NSEC3_ERR
+	LDNS_STATUS_NULL
+	LDNS_STATUS_OK
+	LDNS_STATUS_PACKET_OVERFLOW
+	LDNS_STATUS_RES_NO_NS
+	LDNS_STATUS_RES_QUERY
+	LDNS_STATUS_SOCKET_ERROR
+	LDNS_STATUS_SSL_ERR
+	LDNS_STATUS_SYNTAX_ALG_ERR
+	LDNS_STATUS_SYNTAX_BAD_ESCAPE
+	LDNS_STATUS_SYNTAX_CLASS_ERR
+	LDNS_STATUS_SYNTAX_DNAME_ERR
+	LDNS_STATUS_SYNTAX_EMPTY
+	LDNS_STATUS_SYNTAX_ERR
+	LDNS_STATUS_SYNTAX_INCLUDE
+	LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL
+	LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW
+	LDNS_STATUS_SYNTAX_ITERATIONS_OVERFLOW
+	LDNS_STATUS_SYNTAX_KEYWORD_ERR
+	LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR
+	LDNS_STATUS_SYNTAX_ORIGIN
+	LDNS_STATUS_SYNTAX_RDATA_ERR
+	LDNS_STATUS_SYNTAX_TTL
+	LDNS_STATUS_SYNTAX_TTL_ERR
+	LDNS_STATUS_SYNTAX_TYPE_ERR
+	LDNS_STATUS_SYNTAX_VERSION_ERR
+	LDNS_STATUS_UNKNOWN_INET
+	LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL
+	LDNS_STATUS_WIRE_INCOMPLETE_ANSWER
+	LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY
+	LDNS_STATUS_WIRE_INCOMPLETE_HEADER
+	LDNS_STATUS_WIRE_INCOMPLETE_QUESTION
+	LDNS_TC
+
+	dnssec_create_nsec
+	dnssec_create_nsec3
+	create_nsec
+	create_nsec3
+
+	rr_type2str
+	rr_class2str
+	rr_type_by_name
+	rr_class_by_name
+        pkt_opcode2str
+        pkt_rcode2str
+
+	errorstr_by_id
+	signing_algorithm_by_name
+	key_algorithm_supported
+	read_anchor_file
+) ] );
+
+our @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } );
+
+our @EXPORT = qw(
+	LDNS_AA
+	LDNS_AD
+	LDNS_CD
+	LDNS_CERT_ACPKIX
+	LDNS_CERT_IACPKIX
+	LDNS_CERT_IPGP
+	LDNS_CERT_IPKIX
+	LDNS_CERT_ISPKI
+	LDNS_CERT_OID
+	LDNS_CERT_PGP
+	LDNS_CERT_PKIX
+	LDNS_CERT_SPKI
+	LDNS_CERT_URI
+	LDNS_DEFAULT_EXP_TIME
+	LDNS_DEFAULT_TTL
+	LDNS_DH
+	LDNS_DNSSEC_KEYPROTO
+	LDNS_DSA
+	LDNS_DSA_NSEC3
+	LDNS_ECC
+	LDNS_ECC_GOST
+	LDNS_HASH_GOST
+	LDNS_IP4ADDRLEN
+	LDNS_IP6ADDRLEN
+	LDNS_KEY_REVOKE_KEY
+	LDNS_KEY_SEP_KEY
+	LDNS_KEY_ZONE_KEY
+	LDNS_MAX_DOMAINLEN
+	LDNS_MAX_KEYLEN
+	LDNS_MAX_LABELLEN
+	LDNS_MAX_PACKETLEN
+	LDNS_MAX_POINTERS
+	LDNS_MAX_RDFLEN
+	LDNS_NSEC3_MAX_ITERATIONS
+	LDNS_NSEC3_VARS_OPTOUT_MASK
+	LDNS_PACKET_ANSWER
+	LDNS_PACKET_IQUERY
+	LDNS_PACKET_NODATA
+	LDNS_PACKET_NOTIFY
+	LDNS_PACKET_NXDOMAIN
+	LDNS_PACKET_QUERY
+	LDNS_PACKET_QUESTION
+	LDNS_PACKET_REFERRAL
+	LDNS_PACKET_STATUS
+	LDNS_PACKET_UNKNOWN
+	LDNS_PACKET_UPDATE
+	LDNS_PORT
+	LDNS_PRIVATEDNS
+	LDNS_PRIVATEOID
+	LDNS_QR
+	LDNS_RA
+	LDNS_RCODE_FORMERR
+	LDNS_RCODE_NOERROR
+	LDNS_RCODE_NOTAUTH
+	LDNS_RCODE_NOTIMPL
+	LDNS_RCODE_NOTZONE
+	LDNS_RCODE_NXDOMAIN
+	LDNS_RCODE_NXRRSET
+	LDNS_RCODE_REFUSED
+	LDNS_RCODE_SERVFAIL
+	LDNS_RCODE_YXDOMAIN
+	LDNS_RCODE_YXRRSET
+	LDNS_RD
+	LDNS_RDATA_FIELD_DESCRIPTORS_COMMON
+	LDNS_RDF_SIZE_16BYTES
+	LDNS_RDF_SIZE_6BYTES
+	LDNS_RDF_SIZE_BYTE
+	LDNS_RDF_SIZE_DOUBLEWORD
+	LDNS_RDF_SIZE_WORD
+	LDNS_RDF_TYPE_A
+	LDNS_RDF_TYPE_AAAA
+	LDNS_RDF_TYPE_ALG
+	LDNS_RDF_TYPE_APL
+	LDNS_RDF_TYPE_ATMA
+	LDNS_RDF_TYPE_B32_EXT
+	LDNS_RDF_TYPE_B64
+	LDNS_RDF_TYPE_CERT_ALG
+	LDNS_RDF_TYPE_CLASS
+	LDNS_RDF_TYPE_DNAME
+	LDNS_RDF_TYPE_HEX
+	LDNS_RDF_TYPE_INT16
+	LDNS_RDF_TYPE_INT16_DATA
+	LDNS_RDF_TYPE_INT32
+	LDNS_RDF_TYPE_INT8
+	LDNS_RDF_TYPE_IPSECKEY
+	LDNS_RDF_TYPE_LOC
+	LDNS_RDF_TYPE_NONE
+	LDNS_RDF_TYPE_NSAP
+	LDNS_RDF_TYPE_NSEC
+	LDNS_RDF_TYPE_NSEC3_NEXT_OWNER
+	LDNS_RDF_TYPE_NSEC3_SALT
+	LDNS_RDF_TYPE_PERIOD
+	LDNS_RDF_TYPE_SERVICE
+	LDNS_RDF_TYPE_STR
+	LDNS_RDF_TYPE_TIME
+	LDNS_RDF_TYPE_HIP
+	LDNS_RDF_TYPE_TSIGTIME
+	LDNS_RDF_TYPE_TYPE
+	LDNS_RDF_TYPE_UNKNOWN
+	LDNS_RDF_TYPE_WKS
+	LDNS_RESOLV_ANCHOR
+	LDNS_RESOLV_DEFDOMAIN
+	LDNS_RESOLV_INET
+	LDNS_RESOLV_INET6
+	LDNS_RESOLV_INETANY
+	LDNS_RESOLV_KEYWORD
+	LDNS_RESOLV_KEYWORDS
+	LDNS_RESOLV_NAMESERVER
+	LDNS_RESOLV_OPTIONS
+	LDNS_RESOLV_RTT_INF
+	LDNS_RESOLV_RTT_MIN
+	LDNS_RESOLV_SEARCH
+	LDNS_RESOLV_SORTLIST
+	LDNS_RR_CLASS_ANY
+	LDNS_RR_CLASS_CH
+	LDNS_RR_CLASS_COUNT
+	LDNS_RR_CLASS_FIRST
+	LDNS_RR_CLASS_HS
+	LDNS_RR_CLASS_IN
+	LDNS_RR_CLASS_LAST
+	LDNS_RR_CLASS_NONE
+	LDNS_RR_COMPRESS
+	LDNS_RR_NO_COMPRESS
+	LDNS_RR_OVERHEAD
+	LDNS_RR_TYPE_A
+	LDNS_RR_TYPE_A6
+	LDNS_RR_TYPE_AAAA
+	LDNS_RR_TYPE_AFSDB
+	LDNS_RR_TYPE_ANY
+	LDNS_RR_TYPE_APL
+	LDNS_RR_TYPE_ATMA
+	LDNS_RR_TYPE_AXFR
+	LDNS_RR_TYPE_CERT
+	LDNS_RR_TYPE_CNAME
+	LDNS_RR_TYPE_COUNT
+	LDNS_RR_TYPE_DHCID
+	LDNS_RR_TYPE_DLV
+	LDNS_RR_TYPE_DNAME
+	LDNS_RR_TYPE_DNSKEY
+	LDNS_RR_TYPE_DS
+	LDNS_RR_TYPE_EID
+	LDNS_RR_TYPE_FIRST
+	LDNS_RR_TYPE_GID
+	LDNS_RR_TYPE_GPOS
+	LDNS_RR_TYPE_HINFO
+	LDNS_RR_TYPE_IPSECKEY
+	LDNS_RR_TYPE_ISDN
+	LDNS_RR_TYPE_IXFR
+	LDNS_RR_TYPE_KEY
+	LDNS_RR_TYPE_KX
+	LDNS_RR_TYPE_LAST
+	LDNS_RR_TYPE_LOC
+	LDNS_RR_TYPE_MAILA
+	LDNS_RR_TYPE_MAILB
+	LDNS_RR_TYPE_MB
+	LDNS_RR_TYPE_MD
+	LDNS_RR_TYPE_MF
+	LDNS_RR_TYPE_MG
+	LDNS_RR_TYPE_MINFO
+	LDNS_RR_TYPE_MR
+	LDNS_RR_TYPE_MX
+	LDNS_RR_TYPE_NAPTR
+	LDNS_RR_TYPE_NIMLOC
+	LDNS_RR_TYPE_NS
+	LDNS_RR_TYPE_NSAP
+	LDNS_RR_TYPE_NSAP_PTR
+	LDNS_RR_TYPE_NSEC
+	LDNS_RR_TYPE_NSEC3
+	LDNS_RR_TYPE_NSEC3PARAM
+	LDNS_RR_TYPE_NSEC3PARAMS
+	LDNS_RR_TYPE_NULL
+	LDNS_RR_TYPE_NXT
+	LDNS_RR_TYPE_OPT
+	LDNS_RR_TYPE_PTR
+	LDNS_RR_TYPE_PX
+	LDNS_RR_TYPE_RP
+	LDNS_RR_TYPE_RRSIG
+	LDNS_RR_TYPE_RT
+	LDNS_RR_TYPE_SIG
+	LDNS_RR_TYPE_SINK
+	LDNS_RR_TYPE_SOA
+	LDNS_RR_TYPE_SPF
+	LDNS_RR_TYPE_SRV
+	LDNS_RR_TYPE_SSHFP
+	LDNS_RR_TYPE_TALINK
+	LDNS_RR_TYPE_TSIG
+	LDNS_RR_TYPE_TXT
+	LDNS_RR_TYPE_UID
+	LDNS_RR_TYPE_UINFO
+	LDNS_RR_TYPE_UNSPEC
+	LDNS_RR_TYPE_WKS
+	LDNS_RR_TYPE_X25
+	LDNS_RSAMD5
+	LDNS_RSASHA1
+	LDNS_RSASHA1_NSEC3
+	LDNS_RSASHA256
+	LDNS_RSASHA512
+	LDNS_SECTION_ADDITIONAL
+	LDNS_SECTION_ANSWER
+	LDNS_SECTION_ANY
+	LDNS_SECTION_ANY_NOQUESTION
+	LDNS_SECTION_AUTHORITY
+	LDNS_SECTION_QUESTION
+	LDNS_SHA1
+	LDNS_SHA256
+	LDNS_SIGNATURE_LEAVE_ADD_NEW
+	LDNS_SIGNATURE_LEAVE_NO_ADD
+	LDNS_SIGNATURE_REMOVE_ADD_NEW
+	LDNS_SIGNATURE_REMOVE_NO_ADD
+	LDNS_SIGN_DSA
+	LDNS_SIGN_DSA_NSEC3
+	LDNS_SIGN_ECC_GOST
+	LDNS_SIGN_HMACSHA1
+	LDNS_SIGN_HMACSHA256
+	LDNS_SIGN_RSAMD5
+	LDNS_SIGN_RSASHA1
+	LDNS_SIGN_RSASHA1_NSEC3
+	LDNS_SIGN_RSASHA256
+	LDNS_SIGN_RSASHA512
+	LDNS_STATUS_ADDRESS_ERR
+	LDNS_STATUS_CERT_BAD_ALGORITHM
+	LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL
+	LDNS_STATUS_CRYPTO_BOGUS
+	LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION
+	LDNS_STATUS_CRYPTO_NO_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_DS
+	LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_RRSIG
+	LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY
+	LDNS_STATUS_CRYPTO_NO_TRUSTED_DS
+	LDNS_STATUS_CRYPTO_SIG_EXPIRED
+	LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED
+	LDNS_STATUS_CRYPTO_TSIG_BOGUS
+	LDNS_STATUS_CRYPTO_TSIG_ERR
+	LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR
+	LDNS_STATUS_CRYPTO_UNKNOWN_ALGO
+	LDNS_STATUS_CRYPTO_VALIDATED
+	LDNS_STATUS_DDD_OVERFLOW
+	LDNS_STATUS_DNSSEC_EXISTENCE_DENIED
+	LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND
+	LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED
+	LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED
+	LDNS_STATUS_DOMAINNAME_OVERFLOW
+	LDNS_STATUS_DOMAINNAME_UNDERFLOW
+	LDNS_STATUS_EMPTY_LABEL
+	LDNS_STATUS_ENGINE_KEY_NOT_LOADED
+	LDNS_STATUS_ERR
+	LDNS_STATUS_FILE_ERR
+	LDNS_STATUS_INTERNAL_ERR
+	LDNS_STATUS_INVALID_B32_EXT
+	LDNS_STATUS_INVALID_B64
+	LDNS_STATUS_INVALID_HEX
+	LDNS_STATUS_INVALID_INT
+	LDNS_STATUS_INVALID_IP4
+	LDNS_STATUS_INVALID_IP6
+	LDNS_STATUS_INVALID_POINTER
+	LDNS_STATUS_INVALID_STR
+	LDNS_STATUS_INVALID_TIME
+	LDNS_STATUS_LABEL_OVERFLOW
+	LDNS_STATUS_MEM_ERR
+	LDNS_STATUS_MISSING_RDATA_FIELDS_KEY
+	LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG
+	LDNS_STATUS_NETWORK_ERR
+	LDNS_STATUS_NOT_IMPL
+	LDNS_STATUS_NO_DATA
+	LDNS_STATUS_NSEC3_ERR
+	LDNS_STATUS_NULL
+	LDNS_STATUS_OK
+	LDNS_STATUS_PACKET_OVERFLOW
+	LDNS_STATUS_RES_NO_NS
+	LDNS_STATUS_RES_QUERY
+	LDNS_STATUS_SOCKET_ERROR
+	LDNS_STATUS_SSL_ERR
+	LDNS_STATUS_SYNTAX_ALG_ERR
+	LDNS_STATUS_SYNTAX_BAD_ESCAPE
+	LDNS_STATUS_SYNTAX_CLASS_ERR
+	LDNS_STATUS_SYNTAX_DNAME_ERR
+	LDNS_STATUS_SYNTAX_EMPTY
+	LDNS_STATUS_SYNTAX_ERR
+	LDNS_STATUS_SYNTAX_INCLUDE
+	LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL
+	LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW
+	LDNS_STATUS_SYNTAX_ITERATIONS_OVERFLOW
+	LDNS_STATUS_SYNTAX_KEYWORD_ERR
+	LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR
+	LDNS_STATUS_SYNTAX_ORIGIN
+	LDNS_STATUS_SYNTAX_RDATA_ERR
+	LDNS_STATUS_SYNTAX_TTL
+	LDNS_STATUS_SYNTAX_TTL_ERR
+	LDNS_STATUS_SYNTAX_TYPE_ERR
+	LDNS_STATUS_SYNTAX_VERSION_ERR
+	LDNS_STATUS_UNKNOWN_INET
+	LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL
+	LDNS_STATUS_WIRE_INCOMPLETE_ANSWER
+	LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY
+	LDNS_STATUS_WIRE_INCOMPLETE_HEADER
+	LDNS_STATUS_WIRE_INCOMPLETE_QUESTION
+	LDNS_TC
+
+	dnssec_create_nsec
+	dnssec_create_nsec3
+	create_nsec
+	create_nsec3
+
+	rr_type2str
+	rr_class2str
+	pkt_opcode2str
+	pkt_rcode2str
+        rr_type_by_name
+        rr_class_by_name
+	errorstr_by_id
+	signing_algorithm_by_name
+	key_algorithm_supported
+	read_anchor_file
+);
+
+our $VERSION = '0.61';
+
+sub AUTOLOAD {
+    # This AUTOLOAD is used to 'autoload' constants from the constant()
+    # XS function.
+
+    my $constname;
+    our $AUTOLOAD;
+    ($constname = $AUTOLOAD) =~ s/.*:://;
+    croak "&DNS::LDNS::constant not defined" if $constname eq 'constant';
+    my ($error, $val) = constant($constname);
+    if ($error) { croak $error; }
+    {
+	no strict 'refs';
+	# Fixed between 5.005_53 and 5.005_61
+#XXX	if ($] >= 5.00561) {
+#XXX	    *$AUTOLOAD = sub () { $val };
+#XXX	}
+#XXX	else {
+	    *$AUTOLOAD = sub { $val };
+#XXX	}
+    }
+    goto &$AUTOLOAD;
+}
+
+require XSLoader;
+XSLoader::load('DNS::LDNS', $VERSION);
+
+# Preloaded methods go here.
+
+our $last_status;
+our $line_nr;
+
+sub last_error {
+    return errorstr_by_id($DNS::LDNS::last_status);
+}
+
+require DNS::LDNS::RR;
+require DNS::LDNS::GC;
+require DNS::LDNS::RData;
+require DNS::LDNS::Zone;
+require DNS::LDNS::RRList;
+require DNS::LDNS::DNSSecZone;
+require DNS::LDNS::DNSSecRRSets;
+require DNS::LDNS::DNSSecRRs;
+require DNS::LDNS::DNSSecName;
+require DNS::LDNS::RBTree;
+require DNS::LDNS::RBNode;
+require DNS::LDNS::Resolver;
+require DNS::LDNS::Packet;
+require DNS::LDNS::Key;
+require DNS::LDNS::KeyList;
+require DNS::LDNS::DNSSecDataChain;
+require DNS::LDNS::DNSSecTrustTree;
+
+# Autoload methods go after =cut, and are processed by the autosplit program.
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS - Perl extension for the ldns library
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+=head1 DESCRIPTION
+
+DNS::LDNS is a perl OO-wrapper for the ldns library. A complete list
+of object methods is found in the perldoc for each of the individual
+classes. You may also read the documentation of the ldns library
+(http://www.nlnetlabs.nl/projects/ldns). 
+
+=head2 Brief examples of usage
+
+  use DNS::LDNS ':all';
+
+  my $z = new DNS::LDNS::Zone(filename => '/path/to/myzone');
+  print DNS::LDNS::last_error;
+  my $rr = new DNS::LDNS::RR('mylabel 3600 IN A 168.10.10.10');
+  print $z->soa->to_string;
+  my $rrlist = $z->rrs->push($rr);
+  print $z->to_string;
+
+  my $kl = new DNS::LDNS::KeyList;
+  $kl->push(new DNS::LDNS::Key(filename => 'key');
+  $kl->key(0)->set_pubkey_owner(
+      new DNS::LDNS::RData(LDNS_RDF_TYPE_DNAME, 'myzone.org'));
+  my $signedz = $z->sign($kl);
+  print $signedz->to_string;
+
+  my $r = new DNS::LDNS::Resolver(filename => '/my/resolv.conf');
+  my $p = $r->send(
+    new DNS::LDNS::RData(LDNS_RDF_TYPE_DNAME, 'www.google.com'), 
+    LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, LDNS_RD);
+  print $p->answer->to_string;
+  print $p->authority->to_string;
+
+=head2 Classes
+
+A description of the classes included and how they map to the ldns
+library structures:
+
+=over 20
+
+=item B<DNS::LDNS>
+
+Base class with static functions and constants
+
+=item B<DNS::LDNS::Zone>
+
+Represents a parsed zonefile (maps to the ldns_zone struct)
+
+=item B<DNS::LDNS::RRList>
+
+Represents a list of RRs. This class is also used to represent an
+RRSet if all the dnames and types are equal, (maps to the the
+ldns_rr_list struct)
+
+=item B<DNS::LDNS::RR>
+
+Represents a resource record (RR), (maps to the ldns_rr struct)
+
+=item B<DNS::LDNS::RData>
+
+Represents an rdata field or a dname in an RR (maps to the ldns_rdf
+struct)
+
+=item B<DNS::LDNS::Resolver>
+
+Represents a DNS resolver (maps to the ldns_resolver struct)
+
+=item B<DNS::LDNS::Packet>
+
+Represents a DNS package (maps to the ldns_pkt struct)
+
+=item B<DNS::LDNS::Key>
+
+Represents a DNSSec private key (maps to the ldns_key struct)
+
+=item B<DNS::LDNS::KeyList>
+
+Represents a linked list of keys (maps to the ldns_key_list struct)
+
+=item B<DNS::LDNS::DNSSecZone>
+
+Represents a zone with dnssec data (maps to the ldns_dnssec_zone
+struct)
+
+=item B<DNS::LDNS::RBTree>
+
+Represents a tree of DNSSecName nodes (maps to the ldns_rbtree struct)
+
+=item B<DNS::LDNS::RBNode>
+
+Represents a node in the RBTree (maps to the ldns_rbnode struct)
+
+=item B<DNS::LDNS::DNSSecName>
+
+Represents a dname in a DNSSecZone and holds a DNSSecRRSets list for
+this  dname, possibly with signatures (maps to the ldns_dnssec_name
+struct)
+
+=item B<DNS::LDNS::DNSSecRRSets>
+
+Represents a linked list of DNSSec RR sets, possibly with signatures
+(maps  to the ldns_dnssec_rrsets struct)
+
+=item B<DNS::LDNS::DNSSecRRs>
+
+Represents a linked list of RRs (maps to the ldns_dnssec_rrs struct)
+
+=item B<DNS::LDNS::DNSSecDataChain>
+
+Represents a chain of RR, DNSKEY, and DS data used for building a
+dnssec  trust tree (maps to the ldns_dnssec_data_chain struct)
+
+=item B<DNS::LDNS::DNSSecTrustTree>
+
+Represents a tree of chained trust relationships from a signed RR to a
+set  of trust anchors (maps to the ldns_dnssec_trust_tree struct).
+
+=item B<DNS::LDNS::GC>
+
+Garbage collector. Handles ownership dependencies and freeing data
+used by  the other classes. Used internally only.
+
+=back
+
+One thing to note is that some of the classes have a seemingly
+overlapping  functionality. The Zone and RRList are used to represent
+a generic zone. It  may contain dnssec data but treats it like any
+other dns data and does not  have any knowledge of its structure. The
+DNSSec* and RB* classes are  building blocks for representing a signed
+zone in a more structured way.
+
+=head2 Static functions
+
+  str = rr_type2str(type)
+  str = rr_class2str(class)
+  type = rr_type_by_name(str)
+  class = rr_class_by_name(str)
+  str = pkt_opcode2str(opcode)
+  str = pkt_rcode2str(rcode)
+  error = errorstr_by_id(status)
+  str = DNS::LDNS::last_error
+  status = DNS::LDNS::last_status
+  rr = dnssec_create_nsec(from, to, type)
+  rr = dnssec_create_nsec3(from, to, algorithm, flags, iterations, salt)
+  rr = create_nsec(current, next, rrs)
+  rr = create_nsec3(cur_owner, cur_zone, algorithm, flags, 
+                    iterations, salt, empty_nonterminals)
+  algo = signing_algorithm_by_name(name)
+  bool = key_algorithm_supported(algorithm)
+  rr = read_anchor_file(filename)
+
+=head2 Object references and cloning
+
+Since some of the objects are found as sub objects within other
+objects, it  is important to know how the wrapper classes handle
+object references,  dependencies and cloning. The general rule is that
+accessor methods just  return a reference to the object while methods
+inserting data inserts inserts  a clone of the object. Most classes
+have a clone method which can be used if  a cloned object is what you
+really want.
+
+=head3 Examples
+
+DNS::LDNS::Zone::rrs returns a reference to the DNS::LDNS::RRList
+within  the zone, so if you make changes to the RRList you also
+changes the Zone  object. 
+
+DNS::LDNS::RRList::push(rr) clones the rr, then pushes the cloned rr
+to the  list. Changing the rr afterwards will not change the list.
+
+An exception is the Key class which does not have a clone
+mechanism. In this  case we allow a free Key to be added to only one
+KeyList. Adding it to  multiple lists will provoke an error.
+
+The wrapper keeps track of allocated data structures and references.
+Whenever data is no longer referred to by a perl object, it will be
+freed.
+
+=head2 ERROR HANDLING
+
+The purpose for writing this wrapper class has been to be able to
+process zone file data with good time performance. Data checking and
+error handling is a bit sparse.
+
+Most constructors will update the DNS::LDNS::last_status variable if 
+they fail (return undef). Wrapper methods to ldns functions which would 
+return a status will update the static DNS::LDNS::last_status variable. 
+Most methods do not return a status and will not reset this variable 
+even though they succeeds.
+
+=head2 EXPORT
+
+None by default.
+
+=head2 Exportable constants
+
+=head3 Status
+
+  LDNS_STATUS_ADDRESS_ERR
+  LDNS_STATUS_CERT_BAD_ALGORITHM
+  LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL
+  LDNS_STATUS_CRYPTO_BOGUS
+  LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION
+  LDNS_STATUS_CRYPTO_NO_DNSKEY
+  LDNS_STATUS_CRYPTO_NO_DS
+  LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY
+  LDNS_STATUS_CRYPTO_NO_RRSIG
+  LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY
+  LDNS_STATUS_CRYPTO_NO_TRUSTED_DS
+  LDNS_STATUS_CRYPTO_SIG_EXPIRED
+  LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED
+  LDNS_STATUS_CRYPTO_TSIG_BOGUS
+  LDNS_STATUS_CRYPTO_TSIG_ERR
+  LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR
+  LDNS_STATUS_CRYPTO_UNKNOWN_ALGO
+  LDNS_STATUS_CRYPTO_VALIDATED
+  LDNS_STATUS_DDD_OVERFLOW
+  LDNS_STATUS_DNSSEC_EXISTENCE_DENIED
+  LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND
+  LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED
+  LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED
+  LDNS_STATUS_DOMAINNAME_OVERFLOW
+  LDNS_STATUS_DOMAINNAME_UNDERFLOW
+  LDNS_STATUS_EMPTY_LABEL
+  LDNS_STATUS_ENGINE_KEY_NOT_LOADED
+  LDNS_STATUS_ERR
+  LDNS_STATUS_FILE_ERR
+  LDNS_STATUS_INTERNAL_ERR
+  LDNS_STATUS_INVALID_B32_EXT
+  LDNS_STATUS_INVALID_B64
+  LDNS_STATUS_INVALID_HEX
+  LDNS_STATUS_INVALID_INT
+  LDNS_STATUS_INVALID_IP4
+  LDNS_STATUS_INVALID_IP6
+  LDNS_STATUS_INVALID_POINTER
+  LDNS_STATUS_INVALID_STR
+  LDNS_STATUS_INVALID_TIME
+  LDNS_STATUS_LABEL_OVERFLOW
+  LDNS_STATUS_MEM_ERR
+  LDNS_STATUS_MISSING_RDATA_FIELDS_KEY
+  LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG
+  LDNS_STATUS_NETWORK_ERR
+  LDNS_STATUS_NOT_IMPL
+  LDNS_STATUS_NO_DATA
+  LDNS_STATUS_NSEC3_ERR
+  LDNS_STATUS_NULL
+  LDNS_STATUS_OK
+  LDNS_STATUS_PACKET_OVERFLOW
+  LDNS_STATUS_RES_NO_NS
+  LDNS_STATUS_RES_QUERY
+  LDNS_STATUS_SOCKET_ERROR
+  LDNS_STATUS_SSL_ERR
+  LDNS_STATUS_SYNTAX_ALG_ERR
+  LDNS_STATUS_SYNTAX_BAD_ESCAPE
+  LDNS_STATUS_SYNTAX_CLASS_ERR
+  LDNS_STATUS_SYNTAX_DNAME_ERR
+  LDNS_STATUS_SYNTAX_EMPTY
+  LDNS_STATUS_SYNTAX_ERR
+  LDNS_STATUS_SYNTAX_INCLUDE
+  LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL
+  LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW
+  LDNS_STATUS_SYNTAX_ITERATIONS_OVERFLOW
+  LDNS_STATUS_SYNTAX_KEYWORD_ERR
+  LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR
+  LDNS_STATUS_SYNTAX_ORIGIN
+  LDNS_STATUS_SYNTAX_RDATA_ERR
+  LDNS_STATUS_SYNTAX_TTL
+  LDNS_STATUS_SYNTAX_TTL_ERR
+  LDNS_STATUS_SYNTAX_TYPE_ERR
+  LDNS_STATUS_SYNTAX_VERSION_ERR
+  LDNS_STATUS_UNKNOWN_INET
+  LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL
+  LDNS_STATUS_WIRE_INCOMPLETE_ANSWER
+  LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY
+  LDNS_STATUS_WIRE_INCOMPLETE_HEADER
+  LDNS_STATUS_WIRE_INCOMPLETE_QUESTION
+
+=head3 Resolver flags and constants
+
+  LDNS_RESOLV_ANCHOR
+  LDNS_RESOLV_DEFDOMAIN
+  LDNS_RESOLV_INET
+  LDNS_RESOLV_INET6
+  LDNS_RESOLV_INETANY
+  LDNS_RESOLV_KEYWORD
+  LDNS_RESOLV_KEYWORDS
+  LDNS_RESOLV_NAMESERVER
+  LDNS_RESOLV_OPTIONS
+  LDNS_RESOLV_RTT_INF
+  LDNS_RESOLV_RTT_MIN
+  LDNS_RESOLV_SEARCH
+  LDNS_RESOLV_SORTLIST
+
+=head3 Resolver query flags
+
+  LDNS_AA
+  LDNS_AD
+  LDNS_CD
+  LDNS_QR
+  LDNS_RA
+  LDNS_RD
+  LDNS_TC
+
+=head3 Resolver rcodes
+
+  LDNS_RCODE_FORMERR
+  LDNS_RCODE_NOERROR
+  LDNS_RCODE_NOTAUTH
+  LDNS_RCODE_NOTIMPL
+  LDNS_RCODE_NOTZONE
+  LDNS_RCODE_NXDOMAIN
+  LDNS_RCODE_NXRRSET
+  LDNS_RCODE_REFUSED
+  LDNS_RCODE_SERVFAIL
+  LDNS_RCODE_YXDOMAIN
+  LDNS_RCODE_YXRRSET
+
+=head3 Packet types
+
+  LDNS_PACKET_ANSWER
+  LDNS_PACKET_NODATA
+  LDNS_PACKET_NXDOMAIN
+  LDNS_PACKET_QUESTION
+  LDNS_PACKET_REFERRAL
+  LDNS_PACKET_UNKNOWN
+
+=head3 Packet opcodes
+
+  LDNS_PACKET_IQUERY
+  LDNS_PACKET_NOTIFY
+  LDNS_PACKET_QUERY
+  LDNS_PACKET_STATUS
+  LDNS_PACKET_UPDATE
+
+=head3 Packet sections
+
+  LDNS_SECTION_ADDITIONAL
+  LDNS_SECTION_ANSWER
+  LDNS_SECTION_ANY
+  LDNS_SECTION_ANY_NOQUESTION
+  LDNS_SECTION_AUTHORITY
+  LDNS_SECTION_QUESTION
+
+=head3 DNSSec constants
+
+  LDNS_DEFAULT_EXP_TIME
+  LDNS_MAX_KEYLEN
+  LDNS_DNSSEC_KEYPROTO
+
+=head3 DNSSec sign policies
+
+  LDNS_SIGNATURE_LEAVE_ADD_NEW
+  LDNS_SIGNATURE_LEAVE_NO_ADD
+  LDNS_SIGNATURE_REMOVE_ADD_NEW
+  LDNS_SIGNATURE_REMOVE_NO_ADD
+  LDNS_NSEC3_MAX_ITERATIONS
+
+=head3 Key flags
+
+  LDNS_KEY_REVOKE_KEY
+  LDNS_KEY_SEP_KEY
+  LDNS_KEY_ZONE_KEY
+
+=head3 Key algorithms
+
+  LDNS_DH
+  LDNS_DSA
+  LDNS_DSA_NSEC3
+  LDNS_ECC
+  LDNS_RSAMD5
+  LDNS_RSASHA1
+  LDNS_RSASHA1_NSEC3
+  LDNS_RSASHA256
+  LDNS_RSASHA512
+  LDNS_ECC_GOST
+  LDNS_PRIVATEDNS
+  LDNS_PRIVATEOID
+
+=head3 Signing algorithms
+
+  LDNS_SIGN_DSA
+  LDNS_SIGN_DSA_NSEC3
+  LDNS_SIGN_ECC_GOST
+  LDNS_SIGN_HMACSHA1
+  LDNS_SIGN_HMACSHA256
+  LDNS_SIGN_RSAMD5
+  LDNS_SIGN_RSASHA1
+  LDNS_SIGN_RSASHA1_NSEC3
+  LDNS_SIGN_RSASHA256
+  LDNS_SIGN_RSASHA512
+
+=head3 Hashing algorithm
+
+  LDNS_SHA1
+  LDNS_SHA256
+  LDNS_HASH_GOST
+
+=head3 Rdata constants
+
+  LDNS_MAX_RDFLEN
+  LDNS_NSEC3_VARS_OPTOUT_MASK
+
+  LDNS_RDF_SIZE_16BYTES
+  LDNS_RDF_SIZE_6BYTES
+  LDNS_RDF_SIZE_BYTE
+  LDNS_RDF_SIZE_DOUBLEWORD
+  LDNS_RDF_SIZE_WORD
+
+=head3 Rdata types
+
+  LDNS_RDF_TYPE_A
+  LDNS_RDF_TYPE_AAAA
+  LDNS_RDF_TYPE_ALG
+  LDNS_RDF_TYPE_APL
+  LDNS_RDF_TYPE_ATMA
+  LDNS_RDF_TYPE_B32_EXT
+  LDNS_RDF_TYPE_B64
+  LDNS_RDF_TYPE_CERT_ALG
+  LDNS_RDF_TYPE_CLASS
+  LDNS_RDF_TYPE_DNAME
+  LDNS_RDF_TYPE_HEX
+  LDNS_RDF_TYPE_INT16
+  LDNS_RDF_TYPE_INT16_DATA
+  LDNS_RDF_TYPE_INT32
+  LDNS_RDF_TYPE_INT8
+  LDNS_RDF_TYPE_IPSECKEY
+  LDNS_RDF_TYPE_LOC
+  LDNS_RDF_TYPE_NONE
+  LDNS_RDF_TYPE_NSAP
+  LDNS_RDF_TYPE_NSEC
+  LDNS_RDF_TYPE_NSEC3_NEXT_OWNER
+  LDNS_RDF_TYPE_NSEC3_SALT
+  LDNS_RDF_TYPE_PERIOD
+  LDNS_RDF_TYPE_SERVICE
+  LDNS_RDF_TYPE_STR
+  LDNS_RDF_TYPE_TIME
+  LDNS_RDF_TYPE_HIP
+  LDNS_RDF_TYPE_TSIGTIME
+  LDNS_RDF_TYPE_TYPE
+  LDNS_RDF_TYPE_UNKNOWN
+  LDNS_RDF_TYPE_WKS
+
+=head3 Algorithms used in CERT RRs.
+
+  LDNS_CERT_ACPKIX
+  LDNS_CERT_IACPKIX
+  LDNS_CERT_IPGP
+  LDNS_CERT_IPKIX
+  LDNS_CERT_ISPKI
+  LDNS_CERT_OID
+  LDNS_CERT_PGP
+  LDNS_CERT_PKIX
+  LDNS_CERT_SPKI
+  LDNS_CERT_URI
+
+=head3 RR compress flag
+
+  LDNS_RR_COMPRESS
+  LDNS_RR_NO_COMPRESS
+
+=head3 RR classes
+
+  LDNS_RR_CLASS_ANY
+  LDNS_RR_CLASS_CH
+  LDNS_RR_CLASS_COUNT
+  LDNS_RR_CLASS_FIRST
+  LDNS_RR_CLASS_HS
+  LDNS_RR_CLASS_IN
+  LDNS_RR_CLASS_LAST
+  LDNS_RR_CLASS_NONE
+
+=head3 RR types
+
+  LDNS_RR_TYPE_A
+  LDNS_RR_TYPE_A6
+  LDNS_RR_TYPE_AAAA
+  LDNS_RR_TYPE_AFSDB
+  LDNS_RR_TYPE_ANY
+  LDNS_RR_TYPE_APL
+  LDNS_RR_TYPE_ATMA
+  LDNS_RR_TYPE_AXFR
+  LDNS_RR_TYPE_CERT
+  LDNS_RR_TYPE_CNAME
+  LDNS_RR_TYPE_COUNT
+  LDNS_RR_TYPE_DHCID
+  LDNS_RR_TYPE_DLV
+  LDNS_RR_TYPE_DNAME
+  LDNS_RR_TYPE_DNSKEY
+  LDNS_RR_TYPE_DS
+  LDNS_RR_TYPE_EID
+  LDNS_RR_TYPE_FIRST
+  LDNS_RR_TYPE_GID
+  LDNS_RR_TYPE_GPOS
+  LDNS_RR_TYPE_HINFO
+  LDNS_RR_TYPE_IPSECKEY
+  LDNS_RR_TYPE_ISDN
+  LDNS_RR_TYPE_IXFR
+  LDNS_RR_TYPE_KEY
+  LDNS_RR_TYPE_KX
+  LDNS_RR_TYPE_LAST
+  LDNS_RR_TYPE_LOC
+  LDNS_RR_TYPE_MAILA
+  LDNS_RR_TYPE_MAILB
+  LDNS_RR_TYPE_MB
+  LDNS_RR_TYPE_MD
+  LDNS_RR_TYPE_MF
+  LDNS_RR_TYPE_MG
+  LDNS_RR_TYPE_MINFO
+  LDNS_RR_TYPE_MR
+  LDNS_RR_TYPE_MX
+  LDNS_RR_TYPE_NAPTR
+  LDNS_RR_TYPE_NIMLOC
+  LDNS_RR_TYPE_NS
+  LDNS_RR_TYPE_NSAP
+  LDNS_RR_TYPE_NSAP_PTR
+  LDNS_RR_TYPE_NSEC
+  LDNS_RR_TYPE_NSEC3
+  LDNS_RR_TYPE_NSEC3PARAM
+  LDNS_RR_TYPE_NSEC3PARAMS
+  LDNS_RR_TYPE_NULL
+  LDNS_RR_TYPE_NXT
+  LDNS_RR_TYPE_OPT
+  LDNS_RR_TYPE_PTR
+  LDNS_RR_TYPE_PX
+  LDNS_RR_TYPE_RP
+  LDNS_RR_TYPE_RRSIG
+  LDNS_RR_TYPE_RT
+  LDNS_RR_TYPE_SIG
+  LDNS_RR_TYPE_SINK
+  LDNS_RR_TYPE_SOA
+  LDNS_RR_TYPE_SPF
+  LDNS_RR_TYPE_SRV
+  LDNS_RR_TYPE_SSHFP
+  LDNS_RR_TYPE_TALINK
+  LDNS_RR_TYPE_TSIG
+  LDNS_RR_TYPE_TXT
+  LDNS_RR_TYPE_UID
+  LDNS_RR_TYPE_UINFO
+  LDNS_RR_TYPE_UNSPEC
+  LDNS_RR_TYPE_WKS
+  LDNS_RR_TYPE_X25
+
+=head3 Various defaults and other constants
+
+  LDNS_DEFAULT_TTL
+  LDNS_PORT
+  LDNS_IP4ADDRLEN
+  LDNS_IP6ADDRLEN
+  LDNS_MAX_DOMAINLEN
+  LDNS_MAX_LABELLEN
+  LDNS_MAX_PACKETLEN
+  LDNS_MAX_POINTERS
+  LDNS_RR_OVERHEAD
+  LDNS_RDATA_FIELD_DESCRIPTORS_COMMON
+
+=head1 BUGS
+
+This package is still in the beta stage of development. There no known bugs, 
+although parts of the code has not yet been very well tested. Bugreports will 
+be greatly appreciated.
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecDataChain.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecDataChain.pm
new file mode 100644
index 00000000000000..661e0f6d4073a3
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecDataChain.pm
@@ -0,0 +1,87 @@
+package DNS::LDNS::DNSSecDataChain;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+sub rrset {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrset, $self);
+}
+
+sub signatures {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_signatures, $self);
+}
+
+sub parent {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_parent, $self);
+}
+
+sub derive_trust_tree {
+    my ($self, $rr) = @_;
+
+    if (!DNS::LDNS::GC::is_owned($rr) or DNS::LDNS::GC::owner($rr) ne $self) {
+	die "The rr ($rr) must be in the data chain ($self)";
+    }
+    return DNS::LDNS::GC::own($self->_derive_trust_tree($rr), $self);
+}
+
+sub derive_trust_tree_time {
+    my ($self, $rr, $checktime) = @_;
+
+    if (!DNS::LDNS::GC::is_owned($rr) or DNS::LDNS::GC::owner($rr) ne $self) {
+	die "The rr ($rr) must be in the data chain ($self)";
+    }
+    return DNS::LDNS::GC::own(
+	$self->_derive_trust_tree_time($rr, $checktime), $self);
+}
+
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecDataChain - DNSSec data chain element
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  chain = new DNS::LDNS::DNSSecDataChain
+  chain->print(fp)
+  chain->derive_trust_tree(rr)
+  chain->derive_trust_tree_time(rr, checktime)
+
+  # Node attributes
+  rrset = chain->rrset
+  rrset = chain->signatures
+  rrtype = chain->parent_type
+  pchain = chain->parent
+  rcode = chain->packet_rcode
+  rrtype = chain->packet_qtype
+  bool = chain->packet_nodata
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecName.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecName.pm
new file mode 100644
index 00000000000000..8d94f6e387a1ba
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecName.pm
@@ -0,0 +1,110 @@
+package DNS::LDNS::DNSSecName;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my $class = shift;
+    return _new;
+}
+
+sub name {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_name, $self);
+}
+
+sub set_name {
+    my ($self, $name) = @_;
+
+    DNS::LDNS::GC::disown(my $old = $self->name);
+    _set_name($self, my $copy = $name->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub rrsets {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsets, $self);
+}
+
+sub add_rr {
+    my ($self, $rr) = @_;
+
+    my $s = _add_rr($self, my $copy = $rr->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub nsec {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_nsec, $self);
+}
+
+sub set_nsec {
+    my ($self, $nsec) = @_;
+
+    DNS::LDNS::GC::disown(my $old = $self->nsec);
+    _set_nsec($self, my $copy = $nsec->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub hashed_name {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_hashed_name, $self);
+}
+
+sub nsec_signatures {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_nsec_signatures, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecName - Dname with rrsets in a dnssec zone
+
+=head1 SYNOPSIS
+
+  use LDNS ':all'
+
+  my name = new DNS::LDNS::DNSSecName
+
+  rdata = name->name
+  name->set_name(rdata)
+  bool = name->is_glue
+  rrsets = name->rrsets
+  name->add_rr(rr)
+
+  rr = name->nsec
+  name->set_nsec(rr)
+  hash = name->hashed_name
+  rrs = name->nsec_signatures
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRSets.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRSets.pm
new file mode 100644
index 00000000000000..1dabd0c56425e9
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRSets.pm
@@ -0,0 +1,85 @@
+package DNS::LDNS::DNSSecRRSets;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+# Note: Since this class does not have a constructor, we can let its child
+# objects be owned by the parent. This reduces the recursion depth on
+# DESTROY.
+
+sub rrs {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrs, DNS::LDNS::GC::owner($self));
+}
+
+sub signatures {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_signatures, DNS::LDNS::GC::owner($self));
+}
+
+sub next {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_next, DNS::LDNS::GC::owner($self));
+}
+
+sub set_type {
+    my ($self, $type) = @_;
+    my $s = _set_type($self, $type);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub add_rr {
+    my ($self, $rr) = @_;
+
+    my $s = _add_rr($self, my $copy = $rr->clone);
+    $DNS::LDNS::last_status = $s;
+    DNS::LDNS::GC::own($copy, $self);
+    return $s;
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecRRSets - Linked list of rrsets in a dnssec zone
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  rrs = rrsets->rrs
+  rrs = rrsets->signatures
+  rrsets2 = rrsets->next
+  rrsets->add_rr(rr)
+  bool = rrsets->contains_type(rr_type)
+  rr_type = rrsets->type
+  rrsets->set_type(rr_type)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRs.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRs.pm
new file mode 100644
index 00000000000000..3a6b1cac471009
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRs.pm
@@ -0,0 +1,82 @@
+package DNS::LDNS::DNSSecRRs;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+# Note: This class does not have a constructor. Thus, it can not be created
+# as an individual object. The data structure of the node is owned 
+# and freed by the owner of the parent rather than the parent node. This
+# is to prevent deep recursion on DESTROY.
+
+sub to_string {
+    my $self = shift;
+    my $ret = '';
+    while ($self and $self->rr) {
+	$ret .= $self->rr->to_string;
+	$self = $self->next;
+    }
+
+    return $ret;
+}
+
+sub add_rr {
+    my ($self, $rr) = @_;
+
+    my $s = _add_rr($self, my $copy = $rr->clone);
+    DNS::LDNS::GC::own($self, $copy);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub rr {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rr, DNS::LDNS::GC::owner($self));
+}
+
+sub next {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_next, DNS::LDNS::GC::owner($self));
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecRRs - Linked list of rrs in a dnssec zone
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  rrs->to_string
+  rrs->add_rr(rr)
+  rr = rrs->rr
+  rrs2 = rrs->next
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecTrustTree.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecTrustTree.pm
new file mode 100644
index 00000000000000..7e0d4435c84e47
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecTrustTree.pm
@@ -0,0 +1,99 @@
+package DNS::LDNS::DNSSecTrustTree;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+sub add_parent {
+    my ($self, $parent, $sig, $parent_status) = @_;
+
+    if (DNS::LDNS::GC::is_owned($parent)) {
+	die "Cannot add to multiple trees.";
+    }
+    my $s = _add_parent($self, $parent, $sig, $parent_status);
+    DNS::LDNS::GC::own($parent, $self);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub contains_keys {
+    my ($self, $trusted_keys) = @_;
+
+    my $s = _contains_keys($self, $trusted_keys);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub rr {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rr, $self);
+}
+
+sub rrset {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrset, $self);
+}
+
+sub parent {
+    my ($self, $i) = @_;
+    return DNS::LDNS::GC::own($self->_parent($i), $self);
+}
+
+sub parent_status {
+    my ($self, $i) = @_;
+    my $s = _parent_status($self, $i);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub parent_signature {
+    my ($self, $i) = @_;
+    return DNS::LDNS::GC::own($self->_parent_signature($i), $self);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecTrustTree - Trust tree from signed RR to trust anchors
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  tree = new DNS::LDNS::DNSSecTrustTree
+  tree->print(fp)
+  d = tree->depth
+  status = tree->add_parent(parent, sig, parent_status)
+  status = tree->contains_keys(trusted_keys)
+
+  # Node attributes
+  rr = tree->rr;
+  rrset = tree->rrset
+  ptree = tree->parent(i)
+  pstatus = tree->parent_status(i)
+  rr = tree->parent_signature(i)
+  count = tree->parent_count
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecZone.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecZone.pm
new file mode 100644
index 00000000000000..15e2b46c7ffe78
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecZone.pm
@@ -0,0 +1,176 @@
+package DNS::LDNS::DNSSecZone;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+
+    my $line_nr;
+    my $status = &LDNS_STATUS_OK;
+    my $zone;
+    my $file;
+
+    if ($args{filename}) {
+	unless (open FILE, $args{filename}) {
+	    $DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+	    $DNS::LDNS::line_nr = 0;
+	    return;
+	}
+
+	$file = \*FILE;
+    }
+    elsif ($args{file}) {
+	$file = $args{file};
+    }
+
+    if ($file) {
+	$zone = _new_from_file($file, 
+			       $args{origin}, 
+			       $args{ttl} || 0, 
+			       $args{class} || 0, 
+			       $status, $line_nr);
+    }
+    else {
+	$zone = _new();
+    }
+
+    if ($args{filename}) {
+	close $file;
+    }
+
+    $DNS::LDNS::last_status = $status;
+    $DNS::LDNS::line_nr = $line_nr;
+    if (!defined $zone) {
+	return;
+    }
+
+    return $zone;
+}
+
+sub soa {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_soa, $self);
+}
+
+sub names {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_names, $self);
+}
+
+sub find_rrset {
+    my ($self, $name, $type) = @_;
+    return DNS::LDNS::GC::own($self->_find_rrset($name, $type), $self);
+}
+
+sub add_rr {
+    my ($self, $rr) = @_;
+
+    # Set a copy of the rr in case it is already owned
+    my $s = _add_rr($self, my $copy = $rr->clone);
+    $DNS::LDNS::last_status = $s;
+    DNS::LDNS::GC::own($copy, $self);
+    return $s;
+}
+
+sub add_empty_nonterminals {
+    my $self = shift;
+    my $s = _add_empty_nonterminals($self);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub mark_glue {
+    my $self = shift;
+    my $s = _mark_glue($self);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub sign {
+    my ($self, $keylist, $policy, $flags) = @_;
+    my $s = _sign($self, $keylist, $policy, $flags);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub sign_nsec3 {
+    my ($self, $keylist, $policy, $algorithm, $flags, $iterations, $salt,
+	$signflags) = @_;
+    my $s = _sign_nsec3($self, $keylist, $policy, $algorithm, $flags, 
+	$iterations, $salt, $signflags);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub to_string {
+    return "DNS::LDNS::DNSSecZone::to_string is not yet implemented";
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::DNSSecZone - Zone with dnssec data
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my z = new DNS::LDNS::DNSSecZone(
+    filename => '/path/to/myzone',
+    origin => new DNS::LDNS::RData(LDNS_RDF_TYPE_DNAME, 'myzone'), #optional
+    ttl => 3600, #optional
+    class => LDNS_RR_CLASS_, #optional
+  )
+  my z = new DNS::LDNS::DNSSecZone(
+    file => \*FILE,
+    origin => ..., ttl => ..., class => ...
+  )
+  my z = new DNS::LDNS::DNSSecZone
+
+  rr = z->soa
+  rbtree = z->names
+  rrsets = z->find_rrset
+  z->add_rr(rr)
+  z->create_from_zone(zone)
+  z->add_empty_nonterminals
+
+  z->sign(keylist, policy)
+  z->sign_nsec3(keylist, policy, algorithm, flags, iterations, salt)
+
+  z->create_nsecs
+  z->create_nsec3s(algorithm, flags, iterations, salt)
+  z->create_rrsigs(key_list, policy, flags)
+
+=head1 TODO
+
+  z->to_string
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/GC.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/GC.pm
new file mode 100644
index 00000000000000..877c15c36248b7
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/GC.pm
@@ -0,0 +1,122 @@
+package DNS::LDNS::GC;
+
+use strict;
+use warnings;
+
+our $VERSION = '0.61';
+
+my %ref_count;
+my %owned_by;
+
+sub own {
+    my ($obj, $owner) = @_;
+
+#    print STDERR "Owning $obj -> $owner\n";
+    return unless (defined $obj);
+
+    if ($owned_by{$$owner}) {
+	# If the owner is an owned object, let obj be owned by
+	# the owners owner. We want to avoid recursive ownerships.
+	$owner = $owned_by{$$owner};
+    }
+
+    if (exists $owned_by{$$obj}) {
+	$ref_count{$$obj}++;
+    }
+    else {
+	$ref_count{$$obj} = 1;
+	$owned_by{$$obj} = $owner;
+    }
+    return $obj;
+}
+
+# Return true if the object is owned by someone
+sub is_owned {
+    return (exists $owned_by{${$_[0]}});
+}
+
+sub owner {
+    return $owned_by{${$_[0]}};
+}
+
+sub disown {
+    return unless (defined $_[0]);
+    delete $owned_by{${$_[0]}};
+}
+
+my %free_method = (
+    'DNS::LDNS::Zone'         => '_zone_deep_free',
+    'DNS::LDNS::RRList'       => '_rrlist_deep_free',
+    'DNS::LDNS::RR'           => '_rr_free',
+    'DNS::LDNS::RData'        => '_rdata_deep_free',
+    'DNS::LDNS::DNSSecZone'   => '_dnssec_zone_deep_free',
+    'DNS::LDNS::DNSSecName'   => '_dnssec_name_deep_free',
+    'DNS::LDNS::Resolver'     => '_resolver_deep_free',
+    'DNS::LDNS::Packet'       => '_packet_free',
+    'DNS::LDNS::Key'          => '_key_deep_free',
+    'DNS::LDNS::KeyList'      => '_keylist_free',
+    'DNS::LDNS::DNSSecDataChain' => '_dnssec_datachain',
+);
+
+my %not_deleted_by_owner = (
+    'DNS::LDNS::DNSSecTrustChain' => 1,
+);
+
+sub free {
+    my $obj = shift;
+
+#    print STDERR "Freeing $obj\n";
+
+    if (exists $ref_count{$$obj}) {
+#	print STDERR "Derefing $obj\n";
+	$ref_count{$$obj}--;
+	return if ($ref_count{$$obj} > 0);
+    }
+
+#    print STDERR "Deleting $obj\n";
+
+    delete $ref_count{$$obj};
+
+    if (exists $owned_by{$$obj}) {
+	delete $owned_by{$$obj};
+	return unless ($not_deleted_by_owner{ref $obj});
+    }
+
+    my $class = ref $obj;
+    my $free = $free_method{ref $obj};
+
+    die "Internal error: No freeing method for $obj (".ref $obj.")"
+	unless ($free);
+
+    no strict;
+    &$free($obj);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::GC - Garbage collector, used internally by the DNS::LDNS modules
+
+=head1 SYNOPSIS
+
+Garbage collector class for DNS::LDNS objects.
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Key.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Key.pm
new file mode 100644
index 00000000000000..250373cdc8503a
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Key.pm
@@ -0,0 +1,122 @@
+package DNS::LDNS::Key;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+
+    my $key;
+
+    if ($args{filename} or $args{file}) {
+	my $status = &LDNS_STATUS_OK;
+	my $line_nr = 0;
+	my $file = $args{file};
+	if ($args{filename}) {
+	    unless (open FILE, $args{filename}) {
+		$DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+		return;
+	    }
+	    $file = \*FILE;
+	}
+
+	$key = _new_from_file($file, $line_nr, $status);
+	if ($args{filename}) {
+	    close $file;
+	}
+
+	$DNS::LDNS::last_status = $status;
+	$DNS::LDNS::line_nr = $line_nr;
+	if (!defined $key) {
+	    return;
+	}
+    }
+    else {
+	$key = _new();
+    }
+
+    return $key;
+}
+
+sub set_pubkey_owner {
+    my ($self, $owner) = @_;
+    my $oldowner = $self->pubkey_owner;
+    DNS::LDNS::GC::disown(my $old = $self->pubkey_owner);
+    $self->_set_pubkey_owner($owner);
+    return DNS::LDNS::GC::own($owner, $self);
+}
+
+sub pubkey_owner {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_pubkey_owner, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::Key - DNSSec private key
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  key = new DNS::LDNS::Key
+  key = new DNS::LDNS::Key(file => \*FILE)
+  key = new DNS::LDNS::Key(filename => 'keyfile')
+
+  str = key->to_string
+  key->print(\*OUTPUT)
+
+  key->set_algorithm(alg)
+  alg = key->algorithm
+  key->set_flags(flags)
+  flags = key->flags
+  key->set_hmac_key(hmac)
+  hmac = key->hmac_key
+  key->set_hmac_size(size)
+  size = key->hmac_size
+  key->set_origttl(ttl)
+  ttl = key->origttl
+  key->set_inception(epoch)
+  epoch = key->inception
+  key->set_expiration(epoch)
+  epoch = key->expiration
+  key->set_pubkey_owner(rdata)
+  rdata = key->pubkey_owner
+  key->set_keytag(tag)
+  tag = key->keytag
+  key->set_use(bool)
+  bool = key->use
+
+  str = key->get_file_base_name
+
+  rr = key->to_rr
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/KeyList.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/KeyList.pm
new file mode 100644
index 00000000000000..e25093a792c2cf
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/KeyList.pm
@@ -0,0 +1,72 @@
+package DNS::LDNS::KeyList;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my $class = shift;
+    
+    return _new();
+}
+
+sub push {
+    my ($self, @keys) = @_;
+
+    for my $k (@keys) {
+	if (DNS::LDNS::GC::is_owned($k)) {
+	    die "Cannot push a key on multiple lists.";
+	}
+	$self->_push($k);
+	DNS::LDNS::GC::own($k, $self);
+    }
+}
+
+sub key {
+    my ($self, $index) = @_;
+    return DNS::LDNS::GC::own($self->_key($index), $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::KeyList - Linked list of dnssec keys
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my l = new DNS::LDNS::KeyList
+  l->set_use(bool)
+  l->push(@keys)
+  key = l->pop
+  c = l->count
+  key = l->key(index)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Packet.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Packet.pm
new file mode 100644
index 00000000000000..f975eae4947af0
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Packet.pm
@@ -0,0 +1,259 @@
+package DNS::LDNS::Packet;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+
+    if ($args{name}) {
+	return _query_new(
+	    $args{name}, $args{type}, $args{class}, $args{flags});
+    }
+    else {
+	return _new;
+    }
+}
+
+sub question {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_question, $self);
+}
+
+sub set_question {
+    my ($self, $l) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->question);
+    $self->_set_question($l);
+    return DNS::LDNS::GC::own($l, $self);
+}
+
+sub answer {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_answer, $self);
+}
+
+sub set_answer {
+    my ($self, $l) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->answer);
+    $self->_set_answer($l);
+    return DNS::LDNS::GC::own($l, $self);
+}
+
+sub authority {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_authority, $self);
+}
+
+sub set_authority {
+    my ($self, $l) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->authority);
+    $self->_set_authority($l);
+    return DNS::LDNS::GC::own($l, $self);
+}
+
+sub additional {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_additional, $self);
+}
+
+sub set_additional {
+    my ($self, $l) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->additional);
+    $self->_set_additional($l);
+    return DNS::LDNS::GC::own($l, $self);
+}
+
+sub answerfrom {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_answerfrom, $self);
+}
+
+sub set_answerfrom {
+    my ($self, $a) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->answerfrom);
+    $self->_set_answerfrom($a);
+    return DNS::LDNS::GC::own($a, $self);
+}
+
+
+sub timestamp {
+    my $self = shift;
+    my $t = _timestamp($self);
+    return wantarray ? @$t : $t;
+}
+
+sub edns_data {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_edns_data, $self);
+}
+
+sub set_edns_data {
+    my ($self, $data) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->edns_data);
+    $self->_set_edns_data($data);
+    return DNS::LDNS::GC::own($data, $self);
+}
+
+sub push_rr {
+    my ($self, $sec, $rr) = @_;
+
+    my $ret = $self->_push_rr($sec, my $copy = $_->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $ret;
+}
+
+sub safe_push_rr {
+    my ($self, $sec, $rr) = @_;
+
+    my $ret = $self->_safe_push_rr($sec, my $copy = $_->clone);
+    if ($ret) {
+	DNS::LDNS::GC::own($copy, $self);
+    }
+    return $ret;
+}
+
+sub tsig {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_tsig, $self);
+}
+
+sub set_tsig {
+    my ($self, $rr) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->tsig);
+    $self->_set_tsig($rr);
+    return DNS::LDNS::GC::own($rr, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::Packet - DNS packet
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my pkt = new DNS::LDNS::Packet(name => rdata, type => LDNS_RR_TYPE_...,
+    class => LDNS_RR_CLASS_..., flags => ...)
+  my pkt = new DNS::LDNS::Packet
+
+  pkt2 = pkt->clone
+
+  pkt->to_string
+
+  rrlist = pkt->question
+  pkt->set_question(rrlist)
+'
+  rrlist = pkt->answer
+  pkt->set_answer(rrlist)
+
+  rrlist = pkt->authority
+  pkt->set_authority(rrlist)
+
+  rrlist = pkt->additional
+  pkt->set_additional(rrlist)
+
+  rrlist = pkt->all
+  rrlist = pkt->all_noquestion
+
+  for (qw/qr aa tc rd cd ra ad/) {
+    bool = pkt->$_
+    pkt->set_$_(bool)
+  }
+
+  id = pkt->id
+  pkt->set_id(id)
+  pkt->set_random_id
+
+  count = pkt->qdcount
+  count = pkt->ancount
+  count = pkt->nscount
+  count = pkt->arcount
+
+  opcode = pkt->opcode
+  pkt->set_opcode(opcode)
+
+  rcode = pkt->rcode                  # Response code
+  pkt->set_rcode(rcode)
+
+  size = pkt->size
+
+  epoch = pkt->querytime
+  pkt->set_querytime(epoch)
+
+  rdata = pkt->answerfrom
+  pkt->set_answerfrom(rdata)
+
+  (sec, usec) = pkt->timestamp
+  pkt->set_timestamp(sec, usec)
+
+  bool = pkt->edns
+
+  size = pkt->edns_udp_size
+  pkt->set_edns_udp_size(size)
+
+  rcode = pkt->edns_extended_rcode
+  pkt->set_edns_extended_rcode(rcode)
+
+  v = pkt->edns_version
+  pkt->set_edns_version(v)
+
+  z = pkt->edns_z
+  pkt->set_edns_z(z)
+
+  do = pkt->edns_do
+  pkt->set_edns_do(do)
+
+  rdata = pkt->edns_data
+  pkt->set_edns_data(rdata)
+
+  pkt->set_flags(flags)
+
+  rrlist = pkt->rr_list_by_name(rdata, section)
+  rrlist = pkt->rr_list_by_type(type, section)
+  rrlist = pkt->rr_list_by_name_and_type(rdata, type, section)
+
+  bool = pkt->rr(section, rr)       # Check if rr exists
+
+  pkt->push_rr(section, rr)
+  pkt->safe_push_rr(section, rr)
+
+  count = pkt->section_count(section)
+  bool = pkt->empty
+
+  rr = pkt->tsig
+  pkt->set_tsig(rr)
+
+  type = pkt->reply_type
+
+  rrlist = pkt->get_rrsigs_for_name_and_type(rdata, rrtype)
+  rrlist = pkt->get_rrsigs_for_type(rrtype)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBNode.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBNode.pm
new file mode 100644
index 00000000000000..b12547a2c01218
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBNode.pm
@@ -0,0 +1,71 @@
+package DNS::LDNS::RBNode;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+# Note: This class does not have a constructor. Thus, it can not be created
+# as an individual object. The data structure of the object will always be 
+# owned and freed by its parent object.
+
+sub next {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_next, $self);
+}
+
+sub previous {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_previous, $self);
+}
+
+sub next_nonglue {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_next_nonglue, $self);
+}
+
+sub name {
+    my ($self) = @_;
+    return DNS::LDNS::GC::own($self->_name, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::RBNode - Node in the RBTree
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  node2 = node->next
+  node2 = node->next_nonglue
+  bool = node->is_null
+  dnssec_name = node->name
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBTree.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBTree.pm
new file mode 100644
index 00000000000000..e6e761902ecb44
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RBTree.pm
@@ -0,0 +1,59 @@
+package DNS::LDNS::RBTree;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+# Note: Since this class does not have a constructor, we can let its child
+# objects be owned by the parent. This reduces the recursion depth on
+# DESTROY.
+
+sub first {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_first, $self);
+}
+
+sub last {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_last, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::RBTree - Tree of DNSSecName nodes
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  rbnode = rbtree->first
+  rbnode = rbtree->last
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RData.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RData.pm
new file mode 100644
index 00000000000000..8b29aecae3c10d
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RData.pm
@@ -0,0 +1,91 @@
+package DNS::LDNS::RData;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, $type, $str) = @_;
+    return _new($type, $str);
+}
+
+sub cat {
+    my ($self, $other) = @_;
+
+    my $s = _cat($self, $other);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub nsec3_hash_name {
+    my ($self, $algorithm, $iterations, $salt) = @_;
+    return DNS::LDNS::GC::own(
+	$self->_nsec3_hash_name($algorithm, $iterations, $salt), $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::RData - Rdata field or a dname in an rr
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my rd = new DNS::LDNS::RData(rdf_type, str)
+  rd2 = rd->clone
+
+  rdf_type = rd->type
+  rd->set_type(rdf_type)
+
+  rd->print(\*FILE)
+  str = rd->to_string
+
+  count = rd->label_count
+  rd2 = rd->label(pos)
+
+  bool = rd->is_wildcard
+  bool = rd->matches_wildcard(wildcard)
+  bool = rd->is_subdomain(parent)
+
+  rd2 = rd->left_chop
+
+  status = rd->cat(rd2)
+  rd->compare(rd2)
+  rd2 = rd->address_reverse
+  rd2 = rd->dname_reverse
+
+  rd2 = rd->nsec3_hash_name(name, algorithm, iterations, salt)
+
+  epoch = rd->to_unix_time
+( epoch = rd->2native_time_t )
+
+  rr_type = rd->to_rr_type
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RR.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RR.pm
new file mode 100644
index 00000000000000..95d663c1526397
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RR.pm
@@ -0,0 +1,493 @@
+package DNS::LDNS::RR;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my $class = shift;
+
+    my $rr;
+    my $status = &LDNS_STATUS_OK;
+
+    if (scalar(@_) == 0) {
+	$rr = _new;
+    }
+    elsif (scalar(@_) == 1) {
+	$rr = _new_from_str($_[0], 0, 
+	    undef, undef,
+	    $status);
+    }
+    else {
+	my %args = @_;
+	# Perl 5.25 does not allow us to pass read-only undef into a
+	# parameter changing function. So we must send it with a variable.
+        my $undef = undef;
+
+	if ($args{str}) {
+	    $rr = _new_from_str($args{str}, 
+		$args{default_ttl} || 0,
+		$args{origin},
+		$args{prev} ? ${$args{prev}} : $undef,
+		$status);
+	}
+	elsif ($args{filename} or $args{file}) {
+	    my $line_nr = 0;
+	    my $file = $args{file};
+	    if ($args{filename}) {
+		unless (open FILE, $args{filename}) {
+		    $DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+		    $DNS::LDNS::line_nr = 0;
+		    return;
+		}
+		$file = \*FILE;
+	    }
+
+	    my $ttl = 0;
+	    $rr = _new_from_file($file, 
+		 $args{default_ttl} ? ${$args{default_ttl}} : $ttl,
+		 $args{origin} ? ${$args{origin}} : $undef,
+		 $args{prev} ? ${$args{prev}} : $undef,
+		 $status,
+		 $line_nr);
+	    if ($args{filename}) {
+		close $file;
+	    }
+
+	    $DNS::LDNS::line_nr = $line_nr;
+	}
+	elsif ($args{type}) {
+	    $rr = _new_from_type($args{type});
+	    if ($args{owner}) {
+		$rr->set_owner(ref $args{owner} ? $args{owner} : 
+		    new DNS::LDNS::RData(&LDNS_RDF_TYPE_DNAME, $args{owner}));
+	    }
+	    $rr->set_ttl($args{ttl}) if ($args{ttl});
+	    $rr->set_class($args{class}) if ($args{class});
+
+	    if ($args{rdata}) {
+		if (!$rr->set_rdata(@{$args{rdata}})) {
+		    $DNS::LDNS::last_status = &LDNS_STATUS_SYNTAX_RDATA_ERR;
+		    return;
+		}
+	    }
+	}
+    }
+
+    if (!defined $rr) {
+	$DNS::LDNS::last_status = $status;
+	return;
+    }
+    return $rr;
+}
+
+sub owner {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_owner, $self);
+}
+
+sub set_owner {
+    my ($self, $owner) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->owner);
+    $self->_set_owner($owner);
+    return DNS::LDNS::GC::own($owner, $self);
+}
+
+sub dname {
+    return $_[0]->owner->to_string;
+}
+
+sub rdata {
+    my ($self, $index) = @_;
+    return DNS::LDNS::GC::own($self->_rdata($index), $self);
+}
+
+# replace all existing rdata with new ones. Requires the
+# input array to be exactly same length as rd_count
+sub set_rdata {
+    my ($self, @rdata) = @_;
+
+    if (scalar @rdata != $self->rd_count) {
+	# Hopefully this is a proper error to return here...
+	$DNS::LDNS::last_status = LDNS_STATUS_SYNTAX_RDATA_ERR;
+	return;
+    }
+    my $i = 0;
+    for (@rdata) {
+	my $oldrd = _set_rdata($self, my $copy = $_->clone, $i);
+	DNS::LDNS::GC::disown(my $old = $oldrd);
+	DNS::LDNS::GC::own($copy, $self);
+	$i++;
+    }
+
+    return 1;
+}
+
+sub push_rdata {
+    my ($self, @rdata) = @_;
+
+    for (@rdata) {
+	# Push a copy in case the input rdata are already owned
+	$self->_push_rdata(my $copy = $_->clone);
+	DNS::LDNS::GC::own($copy, $self);
+    }
+}
+
+sub rrsig_typecovered {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_typecovered, $self);
+}
+
+sub rrsig_set_typecovered {
+    my ($self, $type) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_typecovered);
+    my $result = $self->_rrsig_set_typecovered(my $copy = $type->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_algorithm {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_algorithm, $self);
+}
+
+sub rrsig_set_algorithm {
+    my ($self, $algo) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_algorithm);
+    my $result = $self->_rrsig_set_algorithm(my $copy = $algo->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_expiration {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_expiration, $self);
+}
+
+sub rrsig_set_expiration {
+    my ($self, $date) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_expiration);
+    my $result = $self->_rrsig_set_expiration(my $copy = $date->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_inception {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_inception, $self);
+}
+
+sub rrsig_set_inception {
+    my ($self, $date) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_inception);
+    my $result = $self->_rrsig_set_inception(my $copy = $date->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_keytag {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_keytag, $self);
+}
+
+sub rrsig_set_keytag {
+    my ($self, $tag) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_keytag);
+    my $result = $self->_rrsig_set_keytag(my $copy = $tag->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_sig {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_sig, $self);
+}
+
+sub rrsig_set_sig {
+    my ($self, $sig) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_sig);
+    my $result = $self->_rrsig_set_sig(my $copy = $sig->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_labels {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_labels, $self);
+}
+
+sub rrsig_set_labels {
+    my ($self, $lab) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_labels);
+    my $result = $self->_rrsig_set_labels(my $copy = $lab->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_origttl {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_origttl, $self);
+}
+
+sub rrsig_set_origttl {
+    my ($self, $ttl) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_origttl);
+    my $result = $self->_rrsig_set_origttl(my $copy = $ttl->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub rrsig_signame {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrsig_signame, $self);
+}
+
+sub rrsig_set_signame {
+    my ($self, $name) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->rrsig_signame);
+    my $result = $self->_rrsig_set_signame(my $copy = $name->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub dnskey_algorithm {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_dnskey_algorithm, $self);
+}
+
+sub dnskey_set_algorithm {
+    my ($self, $algo) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->dnskey_algorithm);
+    my $result = $self->_dnskey_set_algorithm(my $copy = $algo->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub dnskey_flags {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_dnskey_flags, $self);
+}
+
+sub dnskey_set_flags {
+    my ($self, $flags) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->flags);
+    my $result = $self->_dnskey_set_flags(my $copy = $flags->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub dnskey_protocol {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_dnskey_protocol, $self);
+}
+
+sub dnskey_set_protocol {
+    my ($self, $proto) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->dnskey_protocol);
+    my $result = $self->_dnskey_set_protocol(my $copy = $proto->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub dnskey_key {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_dnskey_key, $self);
+}
+
+sub dnskey_set_key {
+    my ($self, $key) = shift;
+    DNS::LDNS::GC::disown(my $old = $self->dnskey_key);
+    my $result = $self->_dnskey_set_key(my $copy = $key->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    return $result;
+}
+
+sub nsec3_next_owner {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_nsec3_next_owner, $self);
+}
+
+sub nsec3_bitmap {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_nsec3_bitmap, $self);
+}
+
+sub nsec3_salt {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_nsec3_salt, $self);
+}
+
+sub hash_name_from_nsec3 {
+    my ($self, $name) = @_;
+    my $hash = $self->_hash_name_from_nsec3($name);
+    return DNS::LDNS::GC::own($self->_hash_name_from_nsec3($name), $self);
+}
+
+sub verify_denial {
+    my ($self, $nsecs, $rrsigs) = @_;
+    my $s = _verify_denial($self, $nsecs, $rrsigs);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub verify_denial_nsec3 {
+    my ($self, $nsecs, $rrsigs, $packet_rcode, $packet_qtype, 
+	$packet_nodata) = @_;
+    my $s = _verify_denial_nsec3($self, $nsecs, $rrsigs, $packet_rcode, 
+				 $packet_qtype, $packet_nodata);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub verify_denial_nsec3_match {
+    my ($self, $nsecs, $rrsigs, $packet_rcode, $packet_qtype, 
+	$packet_nodata) = @_;
+
+    my $status;
+    my $match = _verify_denial_nsec3_match($self, $nsecs, $rrsigs, $packet_rcode, $packet_qtype, $packet_nodata, $status);
+    $DNS::LDNS::last_status = $status;
+    if ($status != &LDNS_STATUS_OK) {
+	return;
+    }
+
+    # $match is an RR owned by the $nsecs list.
+    return DNS::LDNS::GC::own($match, $nsecs);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::RR - Resource record
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my rr = new DNS::LDNS::RR('mylabel 3600 IN A 168.10.10.10')
+  my rr = new DNS::LDNS::RR(
+    str => 'mylabel 3600 IN A 168.10.10.10',
+    default_ttl => 3600,     # optional
+    origin => $origin_rdata, # optional
+    prev => \$prev_rdata,    # optional
+  )
+  my rr = new DNS::LDNS::RR(
+    filename => '/path/to/rr',
+    default_ttl => \$ttl,     # optional
+    origin => \$origin_rdata, # optional
+    prev => \$prev_rdata)     # optional
+  my rr = new DNS::LDNS::RR(
+    file => \*FILE,
+    default_ttl => \$ttl,     # optional
+    origin => \$origin_rdata, # optional
+    prev => \$prev_rdata)     # optional
+  my rr = new DNS::LDNS::RR(
+    type => LDNS_RR_TYPE_A,
+    rdata => [new DNS::LDNS::RData(...), new DNS::LDNS::RData(...), ...],
+    class => LDNS_RR_CLASS_IN, # optional
+    ttl => 3600, # optional
+    owner => new DNS::LDNS::RData(LDNS_RDF_TYPE_DNAME, 'mylabel'), # optional)
+  my rr = new DNS::LDNS::RR
+
+  rr2 = rr->clone
+
+  rr->print(\*FILE)
+  rr->to_string
+
+  ttl = rr->ttl
+  rr->set_ttl(ttl)
+
+  type = rr->type
+  rr->set_type(type)
+
+  class = rr->class
+  rr->set_class(class)
+
+  rdata = rr->owner
+  rr->set_owner(rdata)
+  str = rr->dname
+
+  count = rr->rd_count
+  rdata = rr->rdata(index)
+  rr->set_rdata(rd1, rd2, rd3, ...)
+  rr->push_rdata(rd1, rd2, rd3, ...)
+  rdata = rr->pop_rdata
+
+  rr->compare(rr2)
+  rr->compare_dname(rr2)
+  rr->compare_no_rdata(rr2)
+  rr->compare_ds(rr2)
+
+  hash = rr->hash_name_from_nsec3(dname)
+
+  status = rr->verify_denial(nsecs, rrsigs)
+  status = rr->verify_denial_nsec3(nsecs, rrsigs, packet_rcode, packet_qtype, packet_nodata)
+  match = rr->verify_denial_nsec3_match(nsecs, rrsigs, packet_rcode, packet_qtype, packet_nodata)
+
+  rr->nsec3_add_param_rdfs(algorithm, flags, iterations, salt)
+  a = rr->nsec3_algorithm
+  f = rr->nsec3_flags
+  o = rr->nsec3_optout
+  i = rr->nsec3_iterations
+  rdata = rr->nsec3_next_owner
+  rdata = rr->nsec3_bitmap
+  rdata = rr->nsec3_salt
+
+  rdata = rr->rrsig_keytag
+  bool = rr->rrsig_set_keytag(rdata)
+  rdata = rr->rrsig_signame
+  bool = rr->rrsig_set_signame(rdata)
+  rdata = rr->rrsig_sig
+  bool = rr->rrsig_set_sig(rdata)
+  rdata = rr->rrsig_algorithm
+  bool = rr->rrsig_set_algorithm(rdata)
+  rdata = rr->rrsig_inception
+  bool = rr->rrsig_set_inception(rdata)
+  rdata = rr->rrsig_expiration
+  bool = rr->rrsig_set_expiration(rdata)
+  rdata = rr->rrsig_labels
+  bool = rr->rrsig_set_labels(rdata)
+  rdata = rr->rrsig_origttl
+  bool = rr->rrsig_set_origttl(rdata)
+  key = rr->get_dnskey_for_rrsig(rrlist)
+
+  rdata = rr->dnskey_algorithm
+  bool = rr->dnskey_set_algorithm(rdata)
+  rdata = rr->dnskey_flags
+  bool = rr->dnskey_set_flags(rdata)
+  rdata = rr->dnskey_protocol
+  bool = rr->dnskey_set_protocol(rdata)
+  rdata = rr->dnskey_key
+  bool = rr->dnskey_set_key(rdata)
+  bits = rr->dnskey_key_size
+  tag = rr->calc_keytag
+  ds = rr->key_to_ds(hash)
+
+  rr->is_question
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RRList.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RRList.pm
new file mode 100644
index 00000000000000..69b8d567be710d
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/RRList.pm
@@ -0,0 +1,183 @@
+package DNS::LDNS::RRList;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS;
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+
+    if ($args{hosts_filename} or $args{hosts_file})  {
+	my $file = $args{hosts_file};
+	if ($args{hosts_filename}) {
+	    unless (open FILE, $args{hosts_filename}) {
+		$DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+		$DNS::LDNS::line_nr = 0;
+		return;
+	    }
+	    $file = \*FILE;
+	}
+	my $list = _new_hosts_from_file($file, $DNS::LDNS::line_nr);
+	if ($args{hosts_filename}) {
+	    close $file;
+	}
+	return $list;
+    }
+    
+    return _new();
+}
+
+sub rr {
+    my ($self, $index) = @_;
+    return DNS::LDNS::GC::own($self->_rr($index), $self);
+}
+
+sub push {
+    my ($self, @rrs) = @_;
+
+    for my $rr (@rrs) {
+	# Push a copy of the rr in case it is already owned
+	$self->_push(my $copy = $rr->clone);
+	DNS::LDNS::GC::own($copy, $self);
+    }
+}
+
+sub push_list {
+    my ($self, $list) = @_;
+
+    $self->_push_list(my $copy = $list->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub verify {
+    my ($self, $sig, $keys) = @_;
+    my $goodkeys = new DNS::LDNS::RRList;
+    my $s = _verify($self, $sig, $keys, $goodkeys);
+    $DNS::LDNS::last_status = $s;
+    return wantarray ? ($s, $goodkeys) : $s;
+}
+
+sub verify_time {
+    my ($self, $sig, $keys, $checktime) = @_;
+    my $goodkeys = new DNS::LDNS::RRList;
+    my $s = _verify_time($self, $sig, $keys, $checktime, $goodkeys);
+    $DNS::LDNS::last_status = $s;
+    return wantarray ? ($s, $goodkeys) : $s;
+}
+
+sub verify_notime {
+    my ($self, $sig, $keys) = @_;
+    my $goodkeys = new DNS::LDNS::RRList;
+    my $s = _verify_notime($self, $sig, $keys, $goodkeys);
+    $DNS::LDNS::last_status = $s;
+    return wantarray ? ($s, $goodkeys) : $s;
+}
+
+sub verify_rrsig_keylist {
+    my ($self, $sig, $keys) = @_;
+    my $goodkeys = new DNS::LDNS::RRList;
+    my $s = _verify_rrsig_keylist($self, $sig, $keys, $goodkeys);
+    $DNS::LDNS::last_status = $s;
+    return wantarray ? ($s, $goodkeys) : $s;
+}
+
+sub verify_rrsig_keylist_notime {
+    my ($self, $sig, $keys, $check_time) = @_;
+    my $goodkeys = new DNS::LDNS::RRList;
+    my $s = _verify_rrsig_keylist_notime($self, $sig, $keys, $goodkeys);
+    $DNS::LDNS::last_status = $s;
+    return wantarray ? ($s, $goodkeys) : $s;
+}
+
+sub get_dnskey_for_rrsig {
+    my ($self, $rrsig) = @_;
+    return DNS::LDNS::GC::own(_get_dnskey_for_rrsig($rrsig, $self), $self);
+}
+
+sub get_rrsig_for_name_and_type {
+    my ($self, $name, $type) = @_;
+    return DNS::LDNS::GC::own(
+	_get_dnskey_for_name_and_type($name, $type, $self), $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::RRList - List of rrs
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my l = new DNS::LDNS::RRList
+  my l = new DNS::LDNS::RRList(hosts_file => \*FILE)
+  my l = new DNS::LDNS::RRList(hosts_filename => fname)
+  my l2 = l->clone
+
+  l->to_string
+
+  l->print(\*FILE)
+  count = l->rr_count
+
+  rr = l->rr(index)
+  l->push(@rr)
+  rr = l->pop
+
+  l->push_list(l2)
+  l2 = l->pop_list(count)
+  l2 = l->pop_rrset
+
+  l->compare(l2)
+
+  l2 = l->subtype_by_rdata(rdata, pos)
+
+  bool = l->is_rrset
+
+  bool = l->contains_rr(rr)
+
+  (status, goodkeys) = l->verify(sig, keys)
+  (status, goodkeys) = l->verify_time(sig, keys, checktime)
+  (status, goodkeys) = l->verify_notime(sig, keys)
+  (status, goodkeys) = l->verify_rrsig_keylist(sig, keys)
+  (status, goodkeys) = l->verify_rrsig_keylist_time(sig, keys, checktime)
+  (status, goodkeys) = l->verify_rrsig_keylist_notime(sig, keys)
+  status = l->verify_rrsig(sig, keys)
+  status = l->verify_rrsig_time(sig, keys, checktime)
+
+  rr = l->create_empty_rrsig(key)
+  rrlist = l->sign_public(keylist)
+
+  rrlist->canonicalize
+  rrlist->sort
+  rrlist->sort_nsec3   # the list must contain only nsec3 rrs
+
+  rr = keylist->get_dnskey_for_rrsig(rrsig)
+  rr = keylist->get_rrsig_for_name_and_type(name, type)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Resolver.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Resolver.pm
new file mode 100644
index 00000000000000..e389a045f90121
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Resolver.pm
@@ -0,0 +1,355 @@
+package DNS::LDNS::Resolver;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+    
+    my $file;
+    my $status = &LDNS_STATUS_OK;
+
+    if ($args{filename}) {
+	unless (open FILE, $args{filename}) {
+	    $DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+	    $DNS::LDNS::line_nr = 0;
+	    return;
+	}
+
+	$file = \*FILE;
+    }
+    elsif ($args{file}) {
+	$file = $args{file};
+    }
+
+    my $resolver;
+    if ($file) {
+	$resolver = _new_from_file($file, $status);
+    }
+    else {
+	$resolver = _new();
+    }
+
+    if ($args{filename}) {
+	close $file;
+    }
+
+    $DNS::LDNS::last_status = $status;
+    if (!defined $resolver) {
+	return;
+    }
+
+    return $resolver;
+}
+
+sub dnssec_anchors {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_dnssec_anchors, $self);
+}
+
+sub push_dnssec_anchor {
+    my ($self, $rr) = @_;
+    
+    _push_dnssec_anchor($self, my $copy = $rr->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub set_dnssec_anchors {
+    my ($self, $l) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->dnssec_anchors);
+    $self->_set_dnssec_anchors($l);
+    DNS::LDNS::GC::own($l, $self);
+    return $l;
+}
+
+sub domain {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_domain, $self);
+}
+
+sub set_domain {
+    my ($self, $dom) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->domain);
+    _set_domain($self, my $copy = $dom->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub nameservers {
+    my $self = shift;
+    my $list = _nameservers($self);
+    for my $r (@$list) {
+	DNS::LDNS::GC::own($r, $self);
+    }
+    return wantarray ? @$list : $list;
+}
+
+sub push_nameserver {
+    my ($self, $n) = @_;
+
+    my $s = _push_nameserver($self, my $copy = $n->clone);
+    DNS::LDNS::GC::own($copy, $self);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub pop_nameserver {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_pop_nameserver);
+}
+
+sub push_searchlist {
+    my ($self, $rd) = @_;
+
+    _push_searchlist($self, my $copy = $rd->clone);
+    DNS::LDNS::GC::own($copy, $self);
+}
+
+sub searchlist {
+    my $self = shift;
+    my $list = _searchlist($self);
+    for my $r (@$list) {
+	DNS::LDNS::GC::own($r, $self);
+    }
+    return wantarray ? @$list : $list;
+}
+
+sub timeout {
+    my $self = shift;
+    my $t = _timeout($self);
+    return wantarray ? @$t : $t;
+}
+
+sub rtt {
+    my $self = shift;
+    my $list = _rtt($self);
+    return wantarray ? @$list : $list;
+}
+
+sub set_rtt {
+    my ($self, @rtt) = @_;
+    # FIXME: Validate @rtt, existence, size
+    _set_rtt($self, \@rtt);
+}
+
+sub fetch_valid_domain_keys {
+    my ($self, $domain, $keys) = @_;
+
+    my $status;
+    my $trusted = _fetch_valid_domain_keys($self, $domain, $keys, $status);
+    $DNS::LDNS::last_status = $status;
+    if (!$trusted) {
+	return;
+    }
+
+    return DNS::LDNS::GC::own($trusted, $self);
+}
+
+sub fetch_valid_domain_keys_time {
+    my ($self, $domain, $keys, $checktime) = @_;
+
+    my $status;
+    my $trusted = _fetch_valid_domain_keys_time(
+	$self, $domain, $keys, $checktime, $status);
+    $DNS::LDNS::last_status = $status;
+    if (!$trusted) {
+	return;
+    }
+
+    return DNS::LDNS::GC::own($trusted, $self);
+}
+
+sub prepare_query_pkt {
+    my ($self, $rdata, $type, $class, $flags) = @_;
+
+    my $s = &LDNS_STATUS_OK;
+    my $qry = _prepare_query_pkt($self, $rdata, $type, $class, $flags, $s);
+    $DNS::LDNS::last_status = $s;
+    if ($s != LDNS_STATUS_OK) {
+	return;
+    }
+    return $qry;
+}
+
+sub send {
+    my ($self, $rdata, $type, $class, $flags) = @_;
+
+    my $s = &LDNS_STATUS_OK;
+    my $ans = _send($self, $rdata, $type, $class, $flags, $s);
+    $DNS::LDNS::last_status = $s;
+    if ($s != LDNS_STATUS_OK) {
+	return;
+    }
+    return $ans;
+}
+
+sub send_pkt {
+    my ($self, $qry) = @_;
+
+    my $s = &LDNS_STATUS_OK;
+    my $ans = _send_pkt($self, $qry, $s);
+    $DNS::LDNS::last_status = $s;
+    if ($s != LDNS_STATUS_OK) {
+	return;
+    }
+    return $ans;
+}
+
+sub verify_trusted {
+    my ($self, $rrset, $rrsigs, $validating_keys) = @_;
+    my $s = _verify_trusted($self, $rrset, $rrsigs, $validating_keys);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub verify_trusted_time {
+    my ($self, $rrset, $rrsigs, $check_time, $validating_keys) = @_;
+    my $s = _verify_trusted_time($self, $rrset, $rrsigs, $check_time, 
+			    $validating_keys);
+    $DNS::LDNS::last_status = $s;
+    return $s;
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::Resolver - DNS resolver
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my r = new DNS::LDNS::Resolver(filename => '/my/resolv.conf')
+  my r = new DNS::LDNS::Resolver(file => \*FILE)
+  my r = new DNS::LDNS::Resolver
+
+  bool = r->dnssec
+  r->set_dnssec(bool)
+
+  bool = r->dnssec_cd        # Resolver sets the CD bit
+  r->set_dnssec_cd(bool)
+
+  port = r->port
+  r->set_port(port)
+
+  bool = r->recursive
+  r->set_recursive(bool)
+
+  bool = r->debug
+  r->set_debug(bool)
+
+  count = r->retry
+  r->set_retry(count)
+
+  count = r->retrans
+  r->set_retrans(count)
+
+  bool = r->fallback          # Resolver truncation fallback mechanism
+  r->set_fallback(bool)
+
+  bool = r->ip6
+  r->set_ip6(bool)
+
+  size = r->edns_udp_size
+  r->set_edns_udp_size(size)
+
+  bool = r->usevc             # Use virtual circuit (TCP)
+  r->set_usevc(bool)
+
+  r->fail
+  r->set_fail
+
+  r->defnames
+  r->set_defnames
+
+  r->dnsrch
+  r->set_dnsrch
+
+  r->igntc
+  r->set_igntc
+
+  bool = r->random            # randomize nameserver before usage
+  r->set_random(bool)
+
+  rrlist = r->dnssec_anchors  # list of trusted DNSSEC anchors
+  r->push_dnssec_anchor(rr)
+  r->set_dnssec_anchors(rrlist)
+
+  rdata = r->domain           # Domain to add to relative queries
+  r->set_domain(rdata)
+
+  @rdata = r->nameservers
+  count = r->nameserver_count
+  r->push_nameserver(rdata)
+  rdata = r->pop_nameserver
+  r->nameservers_randomize
+
+  str = r->tsig_keyname
+  r->set_tsig_keyname(str)
+
+  str = r->tsig_algorithm
+  r->set_tsig_algorithm(str)
+
+  str = r->tsig_keydata
+  r->set_tsig_keydata(str)
+
+  count = r->searchlist_count
+  r->push_searchlist(rdata)
+  @rdata = r->searchlist
+
+  @times = r->rtt              # Round trip times
+  r->set_rtt(@rtt)
+  time = r->nameserver_rtt(pos)
+  r->set_nameserver_rtt(pos, time)
+
+  (sec, usec) = r->timeout
+  r->set_timeout(sec, usec)
+
+  # DNSSec validation
+  rrlist = r->fetch_valid_domain_keys(domain, keys)
+  rrlist = r->fetch_valid_domain_keys_time(domain, keys, checktime)
+  rrlist = r->validate_domain_ds(domain, keys)
+  rrlist = r->validate_domain_ds_time(domain, keys, checktime)
+  rrlist = r->validate_domain_dnskey(domain, keys)
+  rrlist = r->validate_domain_dnskey_time(domain, keys, checktime)
+  status = r->verify_trusted(rrset, rrsigs, validation_keys)
+  status = r->verify_trusted_time(rrset, rrsigs, checktime, validation_keys)
+  bool = r->trusted_key(keys, trusted_keys)
+  chain = r->build_data_chain(qflags, dataset, pkt, orig_rr)
+
+  # Query
+  pkt = r->query(rdata, type, class, flags)
+  pkt = r->search(rdata, type, class, flags)
+  query = r->prepare_query_pkt(rdata, type, class, flags)
+  answer = r->send(rdata, type, class, flags)
+  answer = r->send_pkt(query)
+  rrlist = r->get_rr_list_addr_by_name(name, class, flags)
+  rrlist = r->get_rr_list_name_by_addr(addr, class, flags)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Zone.pm b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Zone.pm
new file mode 100644
index 00000000000000..cb48186f16f0b4
--- /dev/null
+++ b/contrib/ldns/contrib/DNS-LDNS/lib/DNS/LDNS/Zone.pm
@@ -0,0 +1,140 @@
+package DNS::LDNS::Zone;
+
+use 5.008008;
+use strict;
+use warnings;
+
+use DNS::LDNS ':all';
+
+our $VERSION = '0.61';
+
+sub new {
+    my ($class, %args) = @_;
+
+    my $line_nr = 0;
+    my $status = &LDNS_STATUS_OK;
+    my $zone;
+    my $file;
+
+    if ($args{filename}) {
+	unless (open FILE, $args{filename}) {
+	    $DNS::LDNS::last_status = &LDNS_STATUS_FILE_ERR;
+	    $DNS::LDNS::line_nr = 0;
+	    return;
+	}
+
+	$file = \*FILE;
+    }
+    elsif ($args{file}) {
+	$file = $args{file};
+    }
+
+    if ($file) {
+	$zone = _new_from_file($file, 
+			       $args{origin},
+			       $args{default_ttl} || 0,
+			       $args{class} || 0,
+			       $status, $line_nr);
+    }
+    else {
+	$zone = _new();
+    }
+
+    if ($args{filename}) {
+	close $file;
+    }
+
+    $DNS::LDNS::last_status = $status;
+    $DNS::LDNS::line_nr = $line_nr;
+    if (!defined $zone) {
+	return;
+    }
+
+    return $zone;
+}
+
+sub to_string {
+    my $self = shift;
+
+    return join('', map { $self->$_ ? $self->$_->to_string : '' } qw/soa rrs/);
+}
+
+sub soa {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_soa, $self);
+}
+
+sub set_soa {
+    my ($self, $soa) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->soa);
+    $self->_set_soa(my $copy = $soa->clone);
+    return DNS::LDNS::GC::own($copy, $self);
+}
+
+sub rrs {
+    my $self = shift;
+    return DNS::LDNS::GC::own($self->_rrs, $self);
+}
+
+sub set_rrs {
+    my ($self, $list) = @_;
+    DNS::LDNS::GC::disown(my $old = $self->rrs);
+    $self->_set_rrs(my $copy = $list->clone);
+    return DNS::LDNS::GC::own($copy, $self);
+}
+
+sub DESTROY {
+    DNS::LDNS::GC::free($_[0]);
+}
+
+1;
+__END__
+
+=head1 NAME
+
+DNS::LDNS::Zone - Parsed zonefile
+
+=head1 SYNOPSIS
+
+  use DNS::LDNS ':all'
+
+  my z = new DNS::LDNS::Zone(
+    filename => '/path/to/myzone',
+    origin => new DNS::LDNS::RData(LDNS_RDF_TYPE_DNAME, 'myzone'), #optional
+    default_ttl => 3600, #optional
+    class => LDNS_RR_CLASS_IN, #optional
+  )
+  my z = new DNS::LDNS::Zone(
+    file => \*FILE,
+    origin => ..., default_ttl => ..., class => ...
+  )
+  my z = new DNS::LDNS::Zone
+
+  z->to_string
+  z->print(\*FILE)
+  z->canonicalize
+  z->sort
+  rr = z->soa
+  z->set_soa(rr)
+  rrlist = z->rrs
+  z->set_rrs(rrlist)
+  z->sign(keylist)
+  z->sign_nsec3(keylist, algorithm, flags, iterations, salt)
+
+=head1 SEE ALSO
+
+http://www.nlnetlabs.nl/projects/ldns
+
+=head1 AUTHOR
+
+Erik Pihl Ostlyngen, E<lt>erik.ostlyngen@uninett.noE<gt>
+
+=head1 COPYRIGHT AND LICENSE
+
+Copyright (C) 2013 by UNINETT Norid AS
+
+This library is free software; you can redistribute it and/or modify
+it under the same terms as Perl itself, either Perl version 5.14.2 or,
+at your option, any later version of Perl 5 you may have available.
+
+=cut
diff --git a/contrib/ldns/contrib/android/15-android.conf b/contrib/ldns/contrib/android/15-android.conf
new file mode 100644
index 00000000000000..e1fc91e703f263
--- /dev/null
+++ b/contrib/ldns/contrib/android/15-android.conf
@@ -0,0 +1,37 @@
+#### Android...
+#
+# Heavily hacked 15-android.conf based on OpenSSL's config file of the same name.
+# This 15-android.conf avoids compiler errors using NDK-r20. This 15-android.conf
+# requires an environment set (sourced) using setenv-android.sh.
+
+my %targets = (
+    "android" => {
+        inherit_from     => [ "linux-generic32" ],
+        template         => 1,
+        bin_cflags       => add("-fPIE"),
+        bin_lflags       => add("-pie"),
+        enable           => [ ],
+    },
+
+    "android-arm" => {
+        inherit_from     => [ "android", asm("armv4_asm") ],
+        bn_ops           => [ "BN_LLONG", "RC4_CHAR" ],
+    },
+    "android-arm64" => {
+        inherit_from     => [ "android", asm("aarch64_asm") ],
+        bn_ops           => [ "SIXTY_FOUR_BIT_LONG", "RC4_CHAR" ],
+        perlasm_scheme   => "linux64",
+    },
+
+    "android-x86" => {
+        inherit_from     => [ "android", asm("x86_asm") ],
+        cflags           => add(picker(release => "-fomit-frame-pointer")),
+        bn_ops           => [ "BN_LLONG", "RC4_INT" ],
+        perlasm_scheme   => "android",
+    },
+    "android-x86_64" => {
+        inherit_from     => [ "android", asm("x86_64_asm") ],
+        bn_ops           => [ "SIXTY_FOUR_BIT_LONG", "RC4_INT" ],
+        perlasm_scheme   => "elf",
+    },
+);
diff --git a/contrib/ldns/contrib/android/bootstrap_ldns.sh b/contrib/ldns/contrib/android/bootstrap_ldns.sh
new file mode 100755
index 00000000000000..7e423030ccae11
--- /dev/null
+++ b/contrib/ldns/contrib/android/bootstrap_ldns.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+if ! git submodule update --init; then
+    echo "Failed to init submodule"
+    exit 1
+fi
+
+echo "AUTOTOOLS_BUILD: $AUTOTOOLS_BUILD"
+echo "AUTOTOOLS_HOST:  $AUTOTOOLS_HOST"
+
+# libtool complains about our updated config.guess and config.sub.
+# Remove them to get through bootstrap. Re-add them after libtoolize.
+
+echo "Running libtoolize"
+if [ -n "$(command -v glibtoolize)" ]; then
+    rm -f config.guess config.sub
+    if ! glibtoolize -ci ; then
+        echo "Failed to libtoolize (glibtoolize)"
+        exit 1
+    fi
+elif [ -n "$(command -v libtoolize)" ]; then
+    rm -f config.guess config.sub
+    if ! libtoolize -ci ; then
+        echo "Failed to libtoolize (libtoolize)"
+        exit 1
+    fi
+else
+    echo "Failed to find a libtool"
+    exit 1
+fi
+
+echo "Updating config.guess"
+if ! wget -q -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'; then
+    echo "Failed to download config.guess"
+fi
+
+echo "Updating config.sub"
+if ! wget -q -O config.sub 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD'; then
+    echo "Failed to download config.sub"
+fi
+
+echo "Fixing config permissions"
+chmod a+x config.guess config.sub
+if [ -n "$(command -v xattr 2>/dev/null)" ]; then
+    xattr -d com.apple.quarantine config.guess 2>/dev/null
+    xattr -d com.apple.quarantine config.sub 2>/dev/null
+fi
+
+echo "Running autoreconf"
+if ! autoreconf -fi ; then
+    echo "Failed to autoreconf"
+    exit 1
+fi
+
+exit 0
diff --git a/contrib/ldns/contrib/android/install_ndk.sh b/contrib/ldns/contrib/android/install_ndk.sh
new file mode 100755
index 00000000000000..90e453153db5dd
--- /dev/null
+++ b/contrib/ldns/contrib/android/install_ndk.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+if [ -z "$ANDROID_SDK_ROOT" ]; then
+    echo "ERROR: ANDROID_SDK_ROOT is not set. Please set it."
+    echo "SDK root is $ANDROID_SDK_ROOT"
+    exit 1
+fi
+
+if [ -z "$ANDROID_NDK_ROOT" ]; then
+    echo "ERROR: ANDROID_NDK_ROOT is not set. Please set it."
+    echo "NDK root is $ANDROID_NDK_ROOT"
+    exit 1
+fi
+
+echo "Using ANDROID_SDK_ROOT: $ANDROID_SDK_ROOT"
+echo "Using ANDROID_NDK_ROOT: $ANDROID_NDK_ROOT"
+
+echo "Downloading SDK"
+if ! curl -L -k -s -o "$HOME/android-sdk.zip" https://dl.google.com/android/repository/commandlinetools-linux-6200805_latest.zip;
+then
+    echo "Failed to download SDK"
+    exit 1
+fi
+
+echo "Downloading NDK"
+if ! curl -L -k -s -o "$HOME/android-ndk.zip" https://dl.google.com/android/repository/android-ndk-r20b-linux-x86_64.zip;
+then
+    echo "Failed to download NDK"
+    exit 1
+fi
+
+echo "Unpacking SDK to $ANDROID_SDK_ROOT"
+if ! unzip -qq "$HOME/android-sdk.zip" -d "$ANDROID_SDK_ROOT";
+then
+    echo "Failed to unpack SDK"
+    exit 1
+fi
+
+echo "Unpacking NDK to $ANDROID_NDK_ROOT"
+if ! unzip -qq "$HOME/android-ndk.zip" -d "$HOME";
+then
+    echo "Failed to unpack NDK"
+    exit 1
+fi
+
+if ! mv "$HOME/android-ndk-r20b" "$ANDROID_NDK_ROOT";
+then
+    echo "Failed to move $HOME/android-ndk-r20b to $ANDROID_NDK_ROOT"
+    exit 1
+fi
+
+rm -f "$HOME/android-sdk.zip"
+rm -f "$HOME/android-ndk.zip"
+
+# https://stackoverflow.com/a/47028911/608639
+touch "$ANDROID_SDK_ROOT/repositories.cfg"
+
+echo "Finished installing SDK and NDK"
+
+exit 0
diff --git a/contrib/ldns/contrib/android/install_openssl.sh b/contrib/ldns/contrib/android/install_openssl.sh
new file mode 100755
index 00000000000000..e4fb87266e2eb8
--- /dev/null
+++ b/contrib/ldns/contrib/android/install_openssl.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+echo "Downloading OpenSSL"
+if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
+then
+    echo "Failed to download OpenSSL"
+    exit 1
+fi
+
+echo "Unpacking OpenSSL"
+rm -rf ./openssl-1.1.1d
+if ! tar -xf openssl-1.1.1d.tar.gz;
+then
+    echo "Failed to unpack OpenSSL"
+    exit 1
+fi
+
+cd openssl-1.1.1d || exit 1
+
+if ! cp ../contrib/android/15-android.conf Configurations/; then
+    echo "Failed to copy OpenSSL Android config"
+    exit 1
+fi
+
+echo "Configuring OpenSSL"
+if ! ./Configure "$OPENSSL_HOST" no-comp no-asm no-hw no-engine shared \
+       --prefix="$ANDROID_PREFIX" --openssldir="$ANDROID_PREFIX"; then
+    echo "Failed to configure OpenSSL"
+    exit 1
+fi
+
+echo "Building OpenSSL"
+if ! make; then
+    echo "Failed to build OpenSSL"
+    exit 1
+fi
+
+echo "Installing OpenSSL"
+if ! make install_sw; then
+    echo "Failed to install OpenSSL"
+    exit 1
+fi
+
+exit 0
diff --git a/contrib/ldns/contrib/android/install_tools.sh b/contrib/ldns/contrib/android/install_tools.sh
new file mode 100755
index 00000000000000..45aff601e2d7ad
--- /dev/null
+++ b/contrib/ldns/contrib/android/install_tools.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# This step should install tools needed for all packages - OpenSSL and LDNS
+echo "Updating tools"
+sudo apt-get -qq update
+sudo apt-get -qq install --no-install-recommends curl wget tar zip unzip patch perl openjdk-8-jdk autoconf automake libtool pkg-config
+
+# Android builds run config.guess early to determine BUILD and HOST. We need to add config.guess
+# and config.sub now. Later, bootstrap_ldns.sh will handle the complete bootstrap of LDNS.
+
+echo "Adding config.guess"
+if ! wget -q -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'; then
+    echo "Failed to download config.guess"
+fi
+
+echo "Adding config.sub"
+if ! wget -q -O config.sub 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD'; then
+    echo "Failed to download config.sub"
+fi
+
+echo "Fixing config permissions"
+chmod a+x config.guess config.sub
+if [ -n "$(command -v xattr 2>/dev/null)" ]; then
+    xattr -d com.apple.quarantine config.guess 2>/dev/null
+    xattr -d com.apple.quarantine config.sub 2>/dev/null
+fi
diff --git a/contrib/ldns/contrib/android/setenv_android.sh b/contrib/ldns/contrib/android/setenv_android.sh
new file mode 100755
index 00000000000000..f45acb0f7ead32
--- /dev/null
+++ b/contrib/ldns/contrib/android/setenv_android.sh
@@ -0,0 +1,203 @@
+#!/usr/bin/env bash
+
+# ====================================================================
+# Sets the cross compile environment for Android
+#
+# Based upon OpenSSL's setenv-android.sh by TH, JW, and SM.
+# Heavily modified by JWW for Crypto++.
+# Updated by Skycoder42 for current recommendations for Android.
+# Modified by JWW for LDNS.
+# ====================================================================
+
+#########################################
+#####        Some validation        #####
+#########################################
+
+if [ -z "$ANDROID_API" ]; then
+    echo "ANDROID_API is not set. Please set it"
+    [[ "$0" = "${BASH_SOURCE[0]}" ]] && exit 1 || return 1
+fi
+
+if [ -z "$ANDROID_CPU" ]; then
+    echo "ANDROID_CPU is not set. Please set it"
+    [[ "$0" = "${BASH_SOURCE[0]}" ]] && exit 1 || return 1
+fi
+
+if [ ! -d "$ANDROID_NDK_ROOT" ]; then
+    echo "ERROR: ANDROID_NDK_ROOT is not a valid path. Please set it."
+    echo "NDK root is $ANDROID_NDK_ROOT"
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# cryptest-android.sh may run this script without sourcing.
+if [ "$0" = "${BASH_SOURCE[0]}" ]; then
+    echo "setenv-android.sh is usually sourced, but not this time."
+fi
+
+#####################################################################
+
+# Need to set THIS_HOST to darwin-x86_64, linux-x86_64,
+# windows, or windows-x86_64
+
+if [[ "$(uname -s | grep -i -c darwin)" -ne 0 ]]; then
+    THIS_HOST=darwin-x86_64
+elif [[ "$(uname -s | grep -i -c linux)" -ne 0 ]]; then
+    THIS_HOST=linux-x86_64
+else
+    echo "ERROR: Unknown host"
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+ANDROID_TOOLCHAIN="$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/$THIS_HOST/bin"
+ANDROID_SYSROOT="$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/$THIS_HOST/sysroot"
+
+# Error checking
+if [ ! -d "$ANDROID_TOOLCHAIN" ]; then
+    echo "ERROR: ANDROID_TOOLCHAIN is not a valid path. Please set it."
+    echo "Path is $ANDROID_TOOLCHAIN"
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -d "$ANDROID_SYSROOT" ]; then
+    echo "ERROR: ANDROID_SYSROOT is not a valid path. Please set it."
+    echo "Path is $ANDROID_SYSROOT"
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+#####################################################################
+
+THE_ARCH=$(tr '[:upper:]' '[:lower:]' <<< "$ANDROID_CPU")
+
+# https://developer.android.com/ndk/guides/abis.html
+case "$THE_ARCH" in
+  armv7*|armeabi*)
+    CC="armv7a-linux-androideabi$ANDROID_API-clang"
+    CXX="armv7a-linux-androideabi$ANDROID_API-clang++"
+    LD="arm-linux-androideabi-ld"
+    AS="arm-linux-androideabi-as"
+    AR="arm-linux-androideabi-ar"
+    RANLIB="arm-linux-androideabi-ranlib"
+    STRIP="arm-linux-androideabi-strip"
+
+    CFLAGS="-march=armv7-a -mthumb -mfloat-abi=softfp -funwind-tables -fexceptions"
+    CXXFLAGS="-march=armv7-a -mthumb -mfloat-abi=softfp -funwind-tables -fexceptions -frtti"
+    ;;
+
+  armv8*|aarch64|arm64)
+    CC="aarch64-linux-android$ANDROID_API-clang"
+    CXX="aarch64-linux-android$ANDROID_API-clang++"
+    LD="aarch64-linux-android-ld"
+    AS="aarch64-linux-android-as"
+    AR="aarch64-linux-android-ar"
+    RANLIB="aarch64-linux-android-ranlib"
+    STRIP="aarch64-linux-android-strip"
+
+    CFLAGS="-funwind-tables -fexceptions"
+    CXXFLAGS="-funwind-tables -fexceptions -frtti"
+    ;;
+
+  x86)
+    CC="i686-linux-android$ANDROID_API-clang"
+    CXX="i686-linux-android$ANDROID_API-clang++"
+    LD="i686-linux-android-ld"
+    AS="i686-linux-android-as"
+    AR="i686-linux-android-ar"
+    RANLIB="i686-linux-android-ranlib"
+    STRIP="i686-linux-android-strip"
+
+    CFLAGS="-mtune=intel -mssse3 -mfpmath=sse -funwind-tables -fexceptions"
+    CXXFLAGS="-mtune=intel -mssse3 -mfpmath=sse -funwind-tables -fexceptions -frtti"
+    ;;
+
+  x86_64|x64)
+    CC="x86_64-linux-android$ANDROID_API-clang"
+    CXX="x86_64-linux-android$ANDROID_API-clang++"
+    LD="x86_64-linux-android-ld"
+    AS="x86_64-linux-android-as"
+    AR="x86_64-linux-android-ar"
+    RANLIB="x86_64-linux-android-ranlib"
+    STRIP="x86_64-linux-android-strip"
+
+    CFLAGS="-march=x86-64 -msse4.2 -mpopcnt -mtune=intel -funwind-tables -fexceptions"
+    CXXFLAGS="-march=x86-64 -msse4.2 -mpopcnt -mtune=intel -funwind-tables -fexceptions -frtti"
+    ;;
+
+  *)
+    echo "ERROR: Unknown architecture $ANDROID_CPU"
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+    ;;
+esac
+
+#####################################################################
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$CC" ]; then
+    echo "ERROR: Failed to find Android clang. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$CXX" ]; then
+    echo "ERROR: Failed to find Android clang++. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$RANLIB" ]; then
+    echo "ERROR: Failed to find Android ranlib. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$AR" ]; then
+    echo "ERROR: Failed to find Android ar. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$AS" ]; then
+    echo "ERROR: Failed to find Android as. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$ANDROID_TOOLCHAIN/$LD" ]; then
+    echo "ERROR: Failed to find Android ld. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+#####################################################################
+
+LENGTH=${#ANDROID_TOOLCHAIN}
+SUBSTR=${PATH:0:$LENGTH}
+if [ "$SUBSTR" != "$ANDROID_TOOLCHAIN" ]; then
+    export PATH="$ANDROID_TOOLCHAIN:$PATH"
+fi
+
+#####################################################################
+
+export CPP CC CXX LD AS AR RANLIB STRIP
+export ANDROID_SYSROOT="$AOSP_SYSROOT"
+export CPPFLAGS="-D__ANDROID_API__=$ANDROID_API"
+export CFLAGS="$CFLAGS --sysroot=$AOSP_SYSROOT"
+export CXXFLAGS="$CXXFLAGS -stdlib=libc++ --sysroot=$AOSP_SYSROOT"
+
+#####################################################################
+
+echo "ANDROID_TOOLCHAIN: $ANDROID_TOOLCHAIN"
+
+echo "CPP: $(command -v "$CPP")"
+echo "CC: $(command -v "$CC")"
+echo "CXX: $(command -v "$CXX")"
+echo "LD: $(command -v "$LD")"
+echo "AS: $(command -v "$AS")"
+echo "AR: $(command -v "$AR")"
+
+echo "ANDROID_SYSROOT: $ANDROID_SYSROOT"
+
+echo "CPPFLAGS: $CPPFLAGS"
+echo "CFLAGS: $CFLAGS"
+echo "CXXFLAGS: $CXXFLAGS"
+
+[ "$0" = "${BASH_SOURCE[0]}" ] && exit 0 || return 0
diff --git a/contrib/ldns/contrib/build-solaris.sh b/contrib/ldns/contrib/build-solaris.sh
new file mode 100644
index 00000000000000..c4719de3c63858
--- /dev/null
+++ b/contrib/ldns/contrib/build-solaris.sh
@@ -0,0 +1,50 @@
+#!/bin/ksh
+#
+# $Id$
+
+
+PREFIX=/opt/ldns
+OPENSSL=/usr/sfw
+SUDO=sudo
+
+MAKE_PROGRAM=gmake
+MAKE_ARGS="-j 4"
+
+OBJ32=obj32
+OBJ64=obj64
+
+SRCDIR=`pwd`
+
+
+test -d $OBJ32 && $SUDO rm -fr $OBJ32
+mkdir $OBJ32
+
+export CFLAGS=""
+export LDFLAGS="-L${OPENSSL}/lib -R${OPENSSL}/lib"
+
+(cd $OBJ32; \
+${SRCDIR}/configure --with-ssl=${OPENSSL} --prefix=${PREFIX} --libdir=${PREFIX}/lib; \
+$MAKE_PROGRAM $MAKE_ARGS)
+
+if [ `isainfo -k` = amd64 ]; then
+	test -d $OBJ64 && $SUDO rm -fr $OBJ64
+	mkdir $OBJ64
+
+	export CFLAGS="-m64"
+	export LDFLAGS="-L${OPENSSL}/lib/amd64 -R${OPENSSL}/lib/amd64"
+
+	(cd $OBJ64; \
+	${SRCDIR}/configure --with-ssl=${OPENSSL} --prefix=${PREFIX} --libdir=${PREFIX}/lib/amd64; \
+	$MAKE_PROGRAM $MAKE_ARGS)
+fi
+
+# optionally install
+#
+if [ x$1 = xinstall ]; then
+	(cd $OBJ32; $SUDO $MAKE_PROGRAM install-h)
+	(cd $OBJ32; $SUDO $MAKE_PROGRAM install-doc)
+	(cd $OBJ32; $SUDO $MAKE_PROGRAM install-lib)
+	if [ `isainfo -k` = amd64 ]; then
+		(cd $OBJ64; $SUDO $MAKE_PROGRAM install-lib)
+	fi
+fi
diff --git a/contrib/ldns/contrib/ios/15-ios.conf b/contrib/ldns/contrib/ios/15-ios.conf
new file mode 100644
index 00000000000000..364ed6ebfd2910
--- /dev/null
+++ b/contrib/ldns/contrib/ios/15-ios.conf
@@ -0,0 +1,41 @@
+#### iPhoneOS/iOS
+#
+# It takes recent enough Xcode to use following two targets. It shouldn't
+# be a problem by now, but if they don't work, original targets below
+# that depend on manual definition of environment variables should still
+# work...
+#
+my %targets = (
+    "ios-common" => {
+        template         => 1,
+        inherit_from     => [ "darwin-common" ],
+        sys_id           => "iOS",
+        disable          => [ "engine", "async" ],
+    },
+    "ios-xcrun" => {
+        inherit_from     => [ "ios-common", asm("armv4_asm") ],
+        bn_ops           => [ "BN_LLONG", "RC4_CHAR" ],
+        perlasm_scheme   => "ios32",
+    },
+    "ios64-xcrun" => {
+        inherit_from     => [ "ios-common", asm("aarch64_asm") ],
+        bn_ops           => [ "SIXTY_FOUR_BIT_LONG", "RC4_CHAR" ],
+        perlasm_scheme   => "ios64",
+    },
+    "iossimulator-xcrun" => {
+        inherit_from     => [ "ios-common" ],
+    },
+
+    "iphoneos-cross" => {
+        inherit_from     => [ "ios-common" ],
+        cflags           => add("-Wall -fno-common"),
+    },
+    "ios-cross" => {
+        inherit_from     => [ "ios-xcrun" ],
+        cflags           => add("-Wall -fno-common"),
+    },
+    "ios64-cross" => {
+        inherit_from     => [ "ios64-xcrun" ],
+        cflags           => add("-Wall -fno-common"),
+    },
+);
diff --git a/contrib/ldns/contrib/ios/bootstrap_ldns.sh b/contrib/ldns/contrib/ios/bootstrap_ldns.sh
new file mode 100755
index 00000000000000..7e423030ccae11
--- /dev/null
+++ b/contrib/ldns/contrib/ios/bootstrap_ldns.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+if ! git submodule update --init; then
+    echo "Failed to init submodule"
+    exit 1
+fi
+
+echo "AUTOTOOLS_BUILD: $AUTOTOOLS_BUILD"
+echo "AUTOTOOLS_HOST:  $AUTOTOOLS_HOST"
+
+# libtool complains about our updated config.guess and config.sub.
+# Remove them to get through bootstrap. Re-add them after libtoolize.
+
+echo "Running libtoolize"
+if [ -n "$(command -v glibtoolize)" ]; then
+    rm -f config.guess config.sub
+    if ! glibtoolize -ci ; then
+        echo "Failed to libtoolize (glibtoolize)"
+        exit 1
+    fi
+elif [ -n "$(command -v libtoolize)" ]; then
+    rm -f config.guess config.sub
+    if ! libtoolize -ci ; then
+        echo "Failed to libtoolize (libtoolize)"
+        exit 1
+    fi
+else
+    echo "Failed to find a libtool"
+    exit 1
+fi
+
+echo "Updating config.guess"
+if ! wget -q -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'; then
+    echo "Failed to download config.guess"
+fi
+
+echo "Updating config.sub"
+if ! wget -q -O config.sub 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD'; then
+    echo "Failed to download config.sub"
+fi
+
+echo "Fixing config permissions"
+chmod a+x config.guess config.sub
+if [ -n "$(command -v xattr 2>/dev/null)" ]; then
+    xattr -d com.apple.quarantine config.guess 2>/dev/null
+    xattr -d com.apple.quarantine config.sub 2>/dev/null
+fi
+
+echo "Running autoreconf"
+if ! autoreconf -fi ; then
+    echo "Failed to autoreconf"
+    exit 1
+fi
+
+exit 0
diff --git a/contrib/ldns/contrib/ios/install_openssl.sh b/contrib/ldns/contrib/ios/install_openssl.sh
new file mode 100755
index 00000000000000..fc5af4d47c48cb
--- /dev/null
+++ b/contrib/ldns/contrib/ios/install_openssl.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+echo "Downloading OpenSSL"
+if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
+then
+    echo "Failed to download OpenSSL"
+    exit 1
+fi
+
+echo "Unpacking OpenSSL"
+rm -rf ./openssl-1.1.1d
+if ! tar -xf openssl-1.1.1d.tar.gz;
+then
+    echo "Failed to unpack OpenSSL"
+    exit 1
+fi
+
+cd openssl-1.1.1d || exit 1
+
+if ! cp ../contrib/ios/15-ios.conf Configurations/; then
+    echo "Failed to copy OpenSSL ios config"
+    exit 1
+fi
+
+# ocsp.c:947:23: error: 'fork' is unavailable: not available on tvOS
+# ocsp.c:978:23: error: 'fork' is unavailable: not available on watchOS
+# Also see https://github.com/openssl/openssl/issues/7607.
+if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
+    echo "Failed to patch OpenSSL"
+    exit 1
+fi
+
+echo "Configuring OpenSSL"
+if ! ./Configure "$OPENSSL_HOST" -DNO_FORK no-comp no-asm no-hw no-engine no-tests no-unit-test \
+       --prefix="$IOS_PREFIX" --openssldir="$IOS_PREFIX"; then
+    echo "Failed to configure OpenSSL"
+    exit 1
+fi
+
+echo "Building OpenSSL"
+if ! make; then
+    echo "Failed to build OpenSSL"
+    exit 1
+fi
+
+echo "Installing OpenSSL"
+if ! make install_sw; then
+    echo "Failed to install OpenSSL"
+    exit 1
+fi
+
+exit 0
diff --git a/contrib/ldns/contrib/ios/install_tools.sh b/contrib/ldns/contrib/ios/install_tools.sh
new file mode 100755
index 00000000000000..796833d8314334
--- /dev/null
+++ b/contrib/ldns/contrib/ios/install_tools.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# This step should install tools needed for all packages - OpenSSL and LDNS
+# When running on Travis, Homebrew fails in unusual ways, hence '|| true'.
+# https://travis-ci.community/t/homebrew-fails-because-an-automake-update-is-an-error/7831/3
+echo "Updating tools"
+brew update 1>/dev/null || true
+echo "Installing tools"
+brew install autoconf automake libtool pkg-config curl perl 1>/dev/null || true
diff --git a/contrib/ldns/contrib/ios/openssl.patch b/contrib/ldns/contrib/ios/openssl.patch
new file mode 100644
index 00000000000000..58cef232c9e919
--- /dev/null
+++ b/contrib/ldns/contrib/ios/openssl.patch
@@ -0,0 +1,48 @@
+--- apps/speed.c
++++ apps/speed.c
+@@ -99,6 +99,13 @@
+ #endif
+ #include <openssl/modes.h>
+ 
++/* fork() breaks AppleTVOS, WatchOS, AppleTVSimulator and WatchSimulator */
++/* Users should configure with -DNO_FORK */
++#if defined(NO_FORK)
++# undef HAVE_FORK
++# define HAVE_FORK 0
++#endif
++
+ #ifndef HAVE_FORK
+ # if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_VXWORKS)
+ #  define HAVE_FORK 0
+@@ -110,6 +117,7 @@
+ #if HAVE_FORK
+ # undef NO_FORK
+ #else
++# undef NO_FORK
+ # define NO_FORK
+ #endif
+ 
+--- apps/ocsp.c
++++ apps/ocsp.c
+@@ -36,6 +36,13 @@
+ # include <openssl/x509v3.h>
+ # include <openssl/rand.h>
+ 
++/* fork() breaks AppleTVOS, WatchOS, AppleTVSimulator and WatchSimulator */
++/* Users should configure with -DNO_FORK */
++#if defined(NO_FORK)
++# undef HAVE_FORK
++# define HAVE_FORK 0
++#endif
++
+ #ifndef HAVE_FORK
+ # if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
+ #  define HAVE_FORK 0
+@@ -47,6 +54,7 @@
+ #if HAVE_FORK
+ # undef NO_FORK
+ #else
++# undef NO_FORK
+ # define NO_FORK
+ #endif
+ 
diff --git a/contrib/ldns/contrib/ios/setenv_ios.sh b/contrib/ldns/contrib/ios/setenv_ios.sh
new file mode 100755
index 00000000000000..8f49f328d1632e
--- /dev/null
+++ b/contrib/ldns/contrib/ios/setenv_ios.sh
@@ -0,0 +1,274 @@
+#!/usr/bin/env bash
+
+# ====================================================================
+# Sets the cross compile environment for Xcode/iOS
+#
+# Based upon OpenSSL's setenv-ios.sh  by TH, JW, and SM.
+# Heavily modified by JWW for Crypto++.
+# Modified by JWW for LDNS.
+# ====================================================================
+
+#########################################
+#####        Some validation        #####
+#########################################
+
+# In the past we could mostly infer arch or cpu from the SDK (and
+# mostly vice-versa). Nowadays we need it set for us because Apple
+# platforms can be either 32-bit or 64-bit.
+
+if [ -z "$IOS_SDK" ]; then
+    echo "IOS_SDK is not set. Please set it"
+    [[ "$0" = "${BASH_SOURCE[0]}" ]] && exit 1 || return 1
+fi
+
+if [ -z "$IOS_CPU" ]; then
+    echo "IOS_CPU is not set. Please set it"
+    [[ "$0" = "${BASH_SOURCE[0]}" ]] && exit 1 || return 1
+fi
+
+# cryptest-ios.sh may run this script without sourcing.
+if [ "$0" = "${BASH_SOURCE[0]}" ]; then
+    echo "setenv-ios.sh is usually sourced, but not this time."
+fi
+
+#########################################
+#####    Small Fixups, if needed    #####
+#########################################
+
+if [[ "$IOS_SDK" == "iPhone" ]]; then
+    IOS_SDK=iPhoneOS
+fi
+
+if [[ "$IOS_SDK" == "iPhoneOSSimulator" ]]; then
+    IOS_SDK=iPhoneSimulator
+fi
+
+if [[ "$IOS_SDK" == "TV" || "$IOS_SDK" == "AppleTV" ]]; then
+    IOS_SDK=AppleTVOS
+fi
+
+if [[ "$IOS_SDK" == "Watch" || "$IOS_SDK" == "AppleWatch" ]]; then
+    IOS_SDK=WatchOS
+fi
+
+if [[ "$IOS_CPU" == "aarch64" || "$IOS_CPU" == "armv8"* ]] ; then
+    IOS_CPU=arm64
+fi
+
+########################################
+#####         Environment          #####
+########################################
+
+# The flags below were tested with Xcode 8 on Travis. If
+# you use downlevel versions of Xcode, then you can push
+# xxx-version-min=n lower. For example, Xcode 6 can use
+# -miphoneos-version-min=5.
+
+# iPhones can be either 32-bit or 64-bit
+if [[ "$IOS_SDK" == "iPhoneOS" && "$IOS_CPU" == "armv7"* ]]; then
+    MIN_VER=-miphoneos-version-min=6
+elif [[ "$IOS_SDK" == "iPhoneOS" && "$IOS_CPU" == "arm64" ]]; then
+    MIN_VER=-miphoneos-version-min=6
+
+# Fixups for convenience
+elif [[ "$IOS_SDK" == "iPhoneOS" && "$IOS_CPU" == "i386" ]]; then
+    IOS_SDK=iPhoneSimulator
+    # MIN_VER=-miphoneos-version-min=6
+    MIN_VER=-miphonesimulator-version-min=6
+elif [[ "$IOS_SDK" == "iPhoneOS" && "$IOS_CPU" == "x86_64" ]]; then
+    IOS_SDK=iPhoneSimulator
+    # MIN_VER=-miphoneos-version-min=6
+    MIN_VER=-miphonesimulator-version-min=6
+
+# Simulator builds
+elif [[ "$IOS_SDK" == "iPhoneSimulator" && "$IOS_CPU" == "i386" ]]; then
+    MIN_VER=-miphonesimulator-version-min=6
+elif [[ "$IOS_SDK" == "iPhoneSimulator" && "$IOS_CPU" == "x86_64" ]]; then
+    MIN_VER=-miphonesimulator-version-min=6
+
+# Apple TV can be 32-bit Intel (1st gen), 32-bit ARM (2nd, 3rd gen) or 64-bit ARM (4th gen)
+elif [[ "$IOS_SDK" == "AppleTVOS" && "$IOS_CPU" == "i386" ]]; then
+    MIN_VER=-mappletvos-version-min=6
+elif [[ "$IOS_SDK" == "AppleTVOS" && "$IOS_CPU" == "armv7"* ]]; then
+    MIN_VER=-mappletvos-version-min=6
+elif [[ "$IOS_SDK" == "AppleTVOS" && "$IOS_CPU" == "arm64" ]]; then
+    MIN_VER=-mappletvos-version-min=6
+
+# Simulator builds
+elif [[ "$IOS_SDK" == "AppleTVSimulator" && "$IOS_CPU" == "i386" ]]; then
+    MIN_VER=-mappletvsimulator-version-min=6
+elif [[ "$IOS_SDK" == "AppleTVSimulator" && "$IOS_CPU" == "x86_64" ]]; then
+    MIN_VER=-mappletvsimulator-version-min=6
+
+# Watch can be either 32-bit or 64-bit ARM. TODO: figure out which
+# -mwatchos-version-min=n is needed for arm64. 9 is not enough.
+elif [[ "$IOS_SDK" == "WatchOS" && "$IOS_CPU" == "armv7"* ]]; then
+    MIN_VER=-mwatchos-version-min=6
+elif [[ "$IOS_SDK" == "WatchOS" && "$IOS_CPU" == "arm64" ]]; then
+    MIN_VER=-mwatchos-version-min=10
+
+# Simulator builds. TODO: figure out which -watchos-version-min=n
+# is needed for arm64. 6 compiles and links, but is it correct?
+elif [[ "$IOS_SDK" == "WatchSimulator" && "$IOS_CPU" == "i386" ]]; then
+    MIN_VER=-mwatchsimulator-version-min=6
+elif [[ "$IOS_SDK" == "WatchSimulator" && "$IOS_CPU" == "x86_64" ]]; then
+    MIN_VER=-mwatchsimulator-version-min=6
+
+# And the final catch-all
+else
+    echo "IOS_SDK and IOS_CPU are not valid. Please fix them"
+    [[ "$0" = "${BASH_SOURCE[0]}" ]] && exit 1 || return 1
+fi
+
+#####################################################################
+
+# Xcode 6 and below cannot handle -miphonesimulator-version-min
+# Fix it so the simulator will compile as expected. This trick
+# may work on other SDKs, but it was not tested.
+
+if [ -n "$(command -v xcodebuild 2>/dev/null)" ]; then
+    # Output of xcodebuild is similar to "Xcode 6.2". The first cut gets
+    # the dotted decimal value. The second cut gets the major version.
+    XCODE_VERSION=$(xcodebuild -version 2>/dev/null | head -n 1 | cut -f2 -d" " | cut -f1 -d".")
+    if [ -z "$XCODE_VERSION" ]; then XCODE_VERSION=100; fi
+
+    if [ "$XCODE_VERSION" -le 6 ]; then
+        MIN_VER="${MIN_VER//iphonesimulator/iphoneos}"
+    fi
+fi
+
+#####################################################################
+
+# Allow a user override? I think we should be doing this. The use case is,
+# move /Applications/Xcode somewhere else for a side-by-side installation.
+if [ -z "${XCODE_DEVELOPER-}" ]; then
+  XCODE_DEVELOPER=$(xcode-select -print-path 2>/dev/null)
+fi
+
+if [ ! -d "$XCODE_DEVELOPER" ]; then
+  echo "ERROR: unable to find XCODE_DEVELOPER directory."
+  [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# XCODE_DEVELOPER_SDK is the SDK location.
+XCODE_DEVELOPER_SDK="$XCODE_DEVELOPER/Platforms/$IOS_SDK.platform"
+
+if [ ! -d "$XCODE_DEVELOPER_SDK" ]; then
+  echo "ERROR: unable to find XCODE_DEVELOPER_SDK directory."
+  echo "       Is the SDK supported by Xcode and installed?"
+  [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# XCODE_TOOLCHAIN is the location of the actual compiler tools.
+if [ -d "$XCODE_DEVELOPER/Toolchains/XcodeDefault.xctoolchain/usr/bin/" ]; then
+  XCODE_TOOLCHAIN="$XCODE_DEVELOPER/Toolchains/XcodeDefault.xctoolchain/usr/bin/"
+elif [ -d "$XCODE_DEVELOPER_SDK/Developer/usr/bin/" ]; then
+  XCODE_TOOLCHAIN="$XCODE_DEVELOPER_SDK/Developer/usr/bin/"
+fi
+
+if [ -z "$XCODE_TOOLCHAIN" ] || [ ! -d "$XCODE_TOOLCHAIN" ]; then
+  echo "ERROR: unable to find Xcode cross-compiler tools."
+  [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# XCODE_SDK is the SDK name/version being used - adjust the list as appropriate.
+# For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
+# the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
+XCODE_SDK=
+for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
+do
+    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
+        XCODE_SDK="$IOS_SDK$i.sdk"
+        break
+    fi
+done
+
+# Error checking
+if [ -z "$XCODE_SDK" ]; then
+    echo "ERROR: unable to find a SDK."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+IOS_SYSROOT="$XCODE_DEVELOPER_SDK/Developer/SDKs/$XCODE_SDK"
+
+if [ -z "$IOS_SYSROOT" ] || [ ! -d "$IOS_SYSROOT" ]; then
+  echo "ERROR: unable to find IOS_SYSROOT directory."
+  [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+#####################################################################
+
+# We want to set AR=libtool and ARFLAGS="-static -o",
+# but I am not sure Autotools can handle it.
+CPP=cpp; CC=clang; CXX=clang++; LD=ld
+AS=as; AR=ar; RANLIB=ranlib; STRIP=strip
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$CC" ]; then
+    echo "ERROR: Failed to find iOS clang. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$CXX" ]; then
+    echo "ERROR: Failed to find iOS clang++. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$RANLIB" ]; then
+    echo "ERROR: Failed to find iOS ranlib. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$AR" ]; then
+    echo "ERROR: Failed to find iOS ar. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$AS" ]; then
+    echo "ERROR: Failed to find iOS as. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+# Error checking
+if [ ! -e "$XCODE_TOOLCHAIN/$LD" ]; then
+    echo "ERROR: Failed to find iOS ld. Please edit this script."
+    [ "$0" = "${BASH_SOURCE[0]}" ] && exit 1 || return 1
+fi
+
+#####################################################################
+
+LENGTH=${#XCODE_TOOLCHAIN}
+SUBSTR=${PATH:0:$LENGTH}
+if [ "$SUBSTR" != "$XCODE_TOOLCHAIN" ]; then
+    export PATH="$XCODE_TOOLCHAIN":"$PATH"
+fi
+
+#####################################################################
+
+export CPP CC CXX LD AS AR RANLIB STRIP
+export IOS_SYSROOT
+export CFLAGS="-arch $IOS_CPU $MIN_VER --sysroot=$IOS_SYSROOT"
+export CXXFLAGS="-arch $IOS_CPU $MIN_VER -stdlib-libc++ --sysroot=$IOS_SYSROOT"
+
+#####################################################################
+
+echo "XCODE_TOOLCHAIN: $XCODE_TOOLCHAIN"
+
+echo "CPP: $(command -v "$CPP")"
+echo "CC: $(command -v "$CC")"
+echo "CXX: $(command -v "$CXX")"
+echo "LD: $(command -v "$LD")"
+echo "AS: $(command -v "$AS")"
+echo "AR: $(command -v "$AR")"
+
+echo "IOS_SYSROOT: $IOS_SYSROOT"
+
+echo "CPPFLAGS: $CPPFLAGS"
+echo "CFLAGS: $CFLAGS"
+echo "CXXFLAGS: $CXXFLAGS"
+
+[ "$0" = "${BASH_SOURCE[0]}" ] && exit 0 || return 0
diff --git a/contrib/ldns/contrib/ldnsx/README b/contrib/ldns/contrib/ldnsx/README
new file mode 100644
index 00000000000000..780cf83691a91f
--- /dev/null
+++ b/contrib/ldns/contrib/ldnsx/README
@@ -0,0 +1,36 @@
+LDNSX: Easy DNS (including DNSSEC) via ldns.
+
+ldns is a great library. It is a powerful tool for
+working with DNS. python-ldns it is a straight up clone of the C
+interface, however that is not a very good interface for python. Its
+documentation is incomplete and some functions don't work as
+described. And some objects don't have a full python API.
+
+ldnsx aims to fix this. It wraps around the ldns python bindings,
+working around its limitations and providing a well-documented, more
+pythonistic interface.
+
+Written by Christopher Olah <chris@xelerance.com>
+
+Examples
+========
+
+Query the default resolver for google.com's A records. Print the response
+packet.
+
+>>> import ldnsx
+>>> resolver = ldnsx.resolver()
+>>> print resolver.query("google.com","A")
+
+Print the NS records for com. from f.root-servers.net if we get a
+response, else an error message.
+
+>>> import ldnsx
+>>> pkt = ldnsx.resolver("f.root-servers.net").query("com.","NS")
+>>> if pkt:
+>>>    for rr in pkt.answer():
+>>>       print rr
+>>> else:
+>>>    print "response not received" 
+
+
diff --git a/contrib/ldns/contrib/ldnsx/ldnsx.py b/contrib/ldns/contrib/ldnsx/ldnsx.py
new file mode 100644
index 00000000000000..e2bd0e517e316b
--- /dev/null
+++ b/contrib/ldns/contrib/ldnsx/ldnsx.py
@@ -0,0 +1,921 @@
+# Copyright (C) Xelerance Corp. <http://www.xelerance.com/>.
+# Author: Christopher Olah <colah@xelerance.com>
+# License: BSD
+
+""" Easy DNS (including DNSSEC) via ldns.
+
+ldns is a great library. It is a powerful tool for
+working with DNS. python-ldns it is a straight up clone of the C
+interface, however that is not a very good interface for python. Its
+documentation is incomplete and some functions don't work as
+described. And some objects don't have a full python API.
+
+ldnsx aims to fix this. It wraps around the ldns python bindings,
+working around its limitations and providing a well-documented, more
+pythonistic interface.
+
+**WARNING:** 
+
+**API subject to change.** No backwards compatibility guarantee. Write software using this version at your own risk!
+
+Examples
+--------
+
+Query the default resolver for google.com's A records. Print the response
+packet.
+
+>>> import ldnsx
+>>> resolver = ldnsx.resolver()
+>>> print resolver.query("google.com","A")
+
+
+Print the root NS records from f.root-servers.net; if we get a
+response, else an error message.
+
+>>> import ldnsx
+>>> pkt = ldnsx.resolver("f.root-servers.net").query(".", "NS")
+>>> if pkt:
+>>>    for rr in pkt.answer():
+>>>       print rr
+>>> else:
+>>>    print "response not received" 
+
+"""
+
+import time, sys, calendar, warnings, socket
+try:
+	import ldns
+except ImportError:
+	print >> sys.stderr, "ldnsx requires the ldns-python sub-package from http://www.nlnetlabs.nl/projects/ldns/"
+	print >> sys.stderr, "Fedora/CentOS: yum install ldns-python"
+	print >> sys.stderr, "Debian/Ubuntu: apt-get install python-ldns"
+	print >> sys.stderr, "openSUSE: zypper in python-ldns"
+	sys.exit(1)
+
+__version__ = "0.1"
+
+def isValidIP(ipaddr):
+	try:
+		v4 = socket.inet_pton(socket.AF_INET,ipaddr)
+		return 4
+	except:
+		try:
+			v6 = socket.inet_pton(socket.AF_INET6,ipaddr)
+			return 6
+		except:
+			return 0
+
+def query(name, rr_type, rr_class="IN", flags=["RD"], tries = 3, res=None):
+	"""Convenience function. Creates a resolver and then queries it. Refer to resolver.query() 
+	   * name -- domain to query for 
+	   * rr_type -- rr_type to query for
+	   * flags -- flags for query (list of strings)
+	   * tries -- number of times to retry the query on failure
+	   * res -- configurations for the resolver as a dict -- see resolver()
+	   """
+	if isinstance(res, list) or isinstance(res, tuple):
+		res = resolver(*res)
+	elif isinstance(res, dict):
+		res = resolver(**res)
+	else:
+		res = resolver(res)
+	return res.query(name, rr_type, rr_class, flags, tries)
+
+def get_rrs(name, rr_type, rr_class="IN", tries = 3, strict = False, res=None, **kwds):
+	"""Convenience function. Gets RRs for name of type rr_type trying tries times. 
+	   If strict, it raises and exception on failure, otherwise it returns []. 
+	   * name -- domain to query for 
+	   * rr_type -- rr_type to query for
+	   * flags -- flags for query (list of strings)
+	   * tries -- number of times to retry the query on failure
+	   * strict -- if the query fails, do we return [] or raise an exception?
+	   * res -- configurations for the resolver as a dict -- see resolver()
+	   * kwds -- query filters, refer to packet.answer()
+       """
+	if isinstance(res, list) or isinstance(res, tuple):
+		res = resolver(*res)
+	elif isinstance(res, dict):
+		res = resolver(**res)
+	else:
+		res = resolver(res)
+	if "|" in rr_type:
+		pkt = res.query(name, "ANY", rr_class=rr_class, tries=tries)
+	else:
+		pkt = res.query(name, rr_type, rr_class=rr_class, tries=tries)
+	if pkt:
+		if rr_type in ["", "ANY", "*"]:
+			return pkt.answer( **kwds)
+		else:
+			return pkt.answer(rr_type=rr_type, **kwds)
+	else:
+		if strict:
+			raise Exception("LDNS couldn't complete query")
+		else:
+			return []
+
+def secure_query(name, rr_type, rr_class="IN", flags=["RD"], tries = 1, flex=False, res=None):
+	"""Convenience function. Creates a resolver and then does a DNSSEC query. Refer to resolver.query() 
+	   * name -- domain to query for 
+	   * rr_type -- rr_type to query for
+	   * flags -- flags for query (list of strings)
+	   * tries -- number of times to retry the query on failure
+	   * flex -- if we can't verify data, exception or warning?
+	   * res -- configurations for the resolver as a dict -- see resolver()"""
+	if isinstance(res, list) or isinstance(res, tuple):
+		res = resolver(*res)
+	elif isinstance(res, dict):
+		res = resolver(**res)
+	else:
+		res = resolver(res)
+	pkt = res.query(name, rr_type, rr_class, flags, tries)
+	if pkt.rcode() == "SERVFAIL":
+		raise Exception("%s lookup failed (server error or dnssec validation failed)" % name)
+	if pkt.rcode() == "NXDOMAIN":
+		if "AD" in pkt.flags():
+			raise Exception("%s lookup failed (non-existence proven by DNSSEC)" % name )
+		else:
+			raise Exception("%s lookup failed" % name )
+	if pkt.rcode() == "NOERROR":
+		if "AD" not in pkt.flags():
+			if not flex:
+				raise Exception("DNS lookup was insecure")
+			else:
+				warnings.warn("DNS lookup was insecure")
+		return pkt
+	else:
+		raise Exception("unknown ldns error, %s" % pkt.rcode())
+
+
+
+class resolver:
+	""" A wrapper around ldns.ldns_resolver. 
+
+			**Examples**
+
+			Making resolvers is easy!
+
+			>>> from ldnsx import resolver
+			>>> resolver() # from /etc/resolv.conf
+			<resolver: 192.168.111.9>
+			>>> resolver("") # resolver with no nameservers
+			<resolver: >
+			>>> resolver("193.110.157.135") #resolver pointing to ip addr
+			<resolver: 193.110.157.135>
+			>>> resolver("f.root-servers.net") # resolver pointing ip address(es) resolved from name
+			<resolver: 2001:500:2f::f, 192.5.5.241>
+			>>> resolver("193.110.157.135, 193.110.157.136") 
+			>>> # resolver pointing to multiple ip addr, first takes precedence.
+			<resolver: 193.110.157.136, 193.110.157.135>
+
+			So is playing around with their nameservers!
+
+			>>> import ldnsx
+			>>> res = ldnsx.resolver("192.168.1.1")
+			>>> res.add_nameserver("192.168.1.2")
+			>>> res.add_nameserver("192.168.1.3")
+			>>> res.nameservers_ip()
+			["192.168.1.1","192.168.1.2","192.168.1.3"]
+
+			And querying!
+
+			>>> from ldnsx import resolver
+			>>> res= resolver()
+			>>> res.query("cow.com","A")
+			;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 7663
+			;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
+			;; QUESTION SECTION:
+			;; cow.com.     IN      A
+			;; ANSWER SECTION:
+			cow.com.        300     IN      A       208.87.34.18
+			;; AUTHORITY SECTION:
+			;; ADDITIONAL SECTION:
+			;; Query time: 313 msec
+			;; SERVER: 192.168.111.9
+			;; WHEN: Fri Jun  3 11:01:02 2011
+			;; MSG SIZE  rcvd: 41
+
+	
+			"""
+	
+	def __init__(self, ns = None, dnssec = False, tcp = False, port = 53):
+		"""resolver constructor
+			
+			* ns    --  the nameserver/comma delimited nameserver list
+			            defaults to settings from /etc/resolv.conf
+			* dnssec -- should the resolver try and use dnssec or not?
+		    * tcp -- should the resolver use TCP
+		             'auto' is a deprecated work around for old ldns problems
+		    * port -- the port to use, must be the same for all nameservers
+
+			"""
+		# We construct based on a file and dump the nameservers rather than using
+		# ldns_resolver_new() to avoid environment/configuration/magic specific 
+		# bugs.
+		self._ldns_resolver = ldns.ldns_resolver.new_frm_file("/etc/resolv.conf")
+		if ns != None:
+			self.drop_nameservers()
+			nm_list = ns.split(',')
+			nm_list = map(lambda s: s.strip(), nm_list)
+			nm_list = filter(lambda s: s != "", nm_list)
+			nm_list.reverse()
+			for nm in nm_list:
+				self.add_nameserver(nm)
+		# Configure DNSSEC, tcp and port
+		self.set_dnssec(dnssec)
+		if tcp == 'auto':
+			self.autotcp = True
+			self._ldns_resolver.set_usevc(False)
+		else:
+			self.autotcp = False
+			self._ldns_resolver.set_usevc(tcp)
+		self._ldns_resolver.set_port(port)
+
+	
+	def query(self, name, rr_type, rr_class="IN", flags=["RD"], tries = 3):
+		"""Run a query on the resolver.
+				
+			* name -- name to query for
+			* rr_type -- the record type to query for
+			* rr_class -- the class to query for, defaults to IN (Internet)
+			* flags -- the flags to send the query with 
+			* tries -- the number of times to attempt to achieve query in case of packet loss, etc
+			
+			**Examples**
+			
+			Let's get some A records!
+
+			>>> google_a_records = resolver.query("google.com","A").answer()
+			
+			Using DNSSEC is easy :)
+
+			>>> dnssec_pkt = ldnsx.resolver(dnssec=True).query("xelerance.com")
+			
+			We let you use strings to make things easy, but if you prefer stay close to DNS...
+
+			>>> AAAA = 28
+			>>> resolver.query("ipv6.google.com", AAAA)
+			
+			**More about rr_type**
+			
+			rr_type must be a supported resource record type. There are a large number of RR types:
+
+			===========  ===================================  ==================
+			TYPE         Value and meaning                    Reference
+			===========  ===================================  ==================
+			A            1 a host address                     [RFC1035]
+			NS           2 an authoritative name server       [RFC1035]
+			...
+			AAAA         28 IP6 Address                       [RFC3596]
+			...
+			DS           43 Delegation Signer                 [RFC4034][RFC3658]
+			...
+			DNSKEY       48 DNSKEY                            [RFC4034][RFC3755]
+			...
+			Unassigned   32770-65279  
+			Private use  65280-65534
+			Reserved     65535 
+			===========  ===================================  ==================
+			
+			(From http://www.iana.org/assignments/dns-parameters)
+
+			RR types are given as a string (eg. "A"). In the case of Unassigned/Private use/Reserved ones,
+			they are given as "TYPEXXXXX" where XXXXX is the number. ie. RR type 65280 is "TYPE65280". You 
+			may also pass the integer, but you always be given the string.
+
+			If the version of ldnsx you are using is old, it is possible that there could be new rr_types that
+			we don't recognise mnemonic for. You can still use the number XXX or the string "TYPEXXX". To
+			determine what rr_type mnemonics we support, please refer to resolver.supported_rr_types()
+
+		"""
+		# Determine rr_type int
+		if rr_type in _rr_types.keys():
+			_rr_type = _rr_types[rr_type]
+		elif isinstance(rr_type,int):
+			_rr_type = rr_type
+		elif isinstance(rr_type,str) and rr_type[0:4] == "TYPE":
+			try:
+				_rr_type = int(rr_type[4:])
+			except:
+				raise Exception("%s is a bad RR type. TYPEXXXX: XXXX must be a number")
+		else:
+			raise Exception("ldnsx (version %s) does not support the RR type %s."  % (__version__, str(rr_type)) ) 
+		# Determine rr_class int
+		if   rr_class == "IN": _rr_class = ldns.LDNS_RR_CLASS_IN 
+		elif rr_class == "CH": _rr_class = ldns.LDNS_RR_CLASS_CH
+		elif rr_class == "HS": _rr_class = ldns.LDNS_RR_CLASS_HS
+		else:
+			raise Exception("ldnsx (version %s) does not support the RR class %s." % (__version__, str(rr_class)) ) 
+		# Determine flags int
+		_flags = 0
+		if "QR" in flags:  _flags |= ldns.LDNS_QR
+		if "AA" in flags:  _flags |= ldns.LDNS_AA
+		if "TC" in flags:  _flags |= ldns.LDNS_TC
+		if "RD" in flags:  _flags |= ldns.LDNS_RD
+		if "CD" in flags:  _flags |= ldns.LDNS_CD
+		if "RA" in flags:  _flags |= ldns.LDNS_RA
+		if "AD" in flags:  _flags |= ldns.LDNS_AD
+		# Query
+		if tries == 0: return None
+		try:
+			pkt = self._ldns_resolver.query(name, _rr_type, _rr_class, _flags)
+		except KeyboardInterrupt: #Since so much time is spent waiting on ldns, this is very common place for Ctr-C to fall
+			raise
+		except: #Since the ldns exception is not very descriptive...
+			raise Exception("ldns backend ran into problems. Likely, the name you were querying for, %s, was invalid." % name)
+		#Deal with failed queries
+		if not pkt:
+			if tries <= 1:
+				return None
+			else:
+				# One of the major causes of none-packets is truncation of packets
+				# When autotcp is set, we are in a flexible enough position to try and use tcp
+				# to get around this.
+				# Either way, we want to replace the resolver, since resolvers will sometimes
+				# just freeze up.
+				if self.autotcp:
+					self = resolver( ",".join(self.nameservers_ip()),tcp=True, dnssec = self._ldns_resolver.dnssec())
+					self.autotcp = True
+					pkt = self.query(name, rr_type, rr_class=rr_class, flags=flags, tries = tries-1) 
+					self._ldns_resolver.set_usevc(False)
+					return pkt
+				else:
+					self = resolver( ",".join(self.nameservers_ip()), tcp = self._ldns_resolver.usevc(), dnssec = self._ldns_resolver.dnssec() )
+					time.sleep(1) # It could be that things are failing because of a brief outage
+					return self.query(name, rr_type, rr_class=rr_class, flags=flags, tries = tries-1) 
+		elif self.autotcp:
+			pkt = packet(pkt)
+			if "TC" in pkt.flags():
+				self._ldns_resolver.set_usevc(True)
+				pkt2 = self.query(name, rr_type, rr_class=rr_class, flags=flags, tries = tries-1) 
+				self._ldns_resolver.set_usevc(False)
+				if pkt2: return packet(pkt2)
+			return pkt
+		return packet(pkt)
+		#ret = []
+		#for rr in pkt.answer().rrs():
+		#	ret.append([str(rr.owner()),rr.ttl(),rr.get_class_str(),rr.get_type_str()]+[str(rdf) for rdf in rr.rdfs()])
+		#return ret
+
+	def suported_rr_types(self):
+		""" Returns the supported DNS resource record types.
+
+			Refer to resolver.query() for thorough documentation of resource 
+			record types or refer to:
+
+			http://www.iana.org/assignments/dns-parameters
+
+		"""
+		return _rr_types.keys()
+	
+	def AXFR(self,name):
+		"""AXFR for name
+
+			* name -- name to AXFR for
+			
+			This function is a generator. As it AXFRs it will yield you the records.
+
+			**Example**
+
+			Let's get a list of the tlds (gotta catch em all!):
+
+			>>> tlds = []
+			>>> for rr in resolver("f.root-servers.net").AXFR("."):
+			>>>    if rr.rr_type() == "NS":
+			>>>       tlds.append(rr.owner())
+
+		"""
+		#Dname seems to be unnecessary on some computers, but it is on others. Avoid bugs.
+		if self._ldns_resolver.axfr_start(ldns.ldns_dname(name), ldns.LDNS_RR_CLASS_IN) != ldns.LDNS_STATUS_OK:
+			raise Exception("Starting AXFR failed. Error: %s" % ldns.ldns_get_errorstr_by_id(status))
+		pres = self._ldns_resolver.axfr_next()
+		while pres:
+			yield resource_record(pres)
+			pres = self._ldns_resolver.axfr_next()
+
+	def nameservers_ip(self):
+		""" returns a list of the resolvers nameservers (as IP addr)
+		
+		"""
+		nm_stack2 =[]
+		nm_str_stack2=[]
+		nm = self._ldns_resolver.pop_nameserver()
+		while nm:
+			nm_stack2.append(nm)
+			nm_str_stack2.append(str(nm))
+			nm = self._ldns_resolver.pop_nameserver()
+		for nm in nm_stack2:
+			self._ldns_resolver.push_nameserver(nm)
+		nm_str_stack2.reverse()
+		return nm_str_stack2
+
+
+	def add_nameserver(self,ns):
+		""" Add a nameserver, IPv4/IPv6/name.
+
+		"""
+		if isValidIP(ns) == 4:
+			address = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A,ns)
+			self._ldns_resolver.push_nameserver(address)
+		elif isValidIP(ns) == 6:
+			address = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_AAAA,ns)
+			self._ldns_resolver.push_nameserver(address)
+		else:
+			resolver = ldns.ldns_resolver.new_frm_file("/etc/resolv.conf")
+			#address = resolver.get_addr_by_name(ns)
+			address = resolver.get_addr_by_name(ldns.ldns_dname(ns))
+			if not address:
+				address = resolver.get_addr_by_name(ldns.ldns_dname(ns))
+				if not address:
+					raise Exception("Failed to resolve address for %s" % ns)
+			for rr in address.rrs():
+				self._ldns_resolver.push_nameserver_rr(rr)
+
+	def drop_nameservers(self):
+		"""Drops all nameservers.
+			This function causes the resolver to forget all nameservers.
+
+		"""
+		while self._ldns_resolver.pop_nameserver():
+			pass
+
+	def set_nameservers(self, nm_list):
+		"""Takes a list of nameservers and sets the resolver to use them
+		
+		"""
+		self.drop_nameservers()
+		for nm in nm_list:
+			self.add_nameserver(nm)
+
+	def __repr__(self):
+		return "<resolver: %s>" % ", ".join(self.nameservers_ip())
+	__str__ = __repr__
+
+	def set_dnssec(self,new_dnssec_status):
+		"""Set whether the resolver uses DNSSEC.
+		
+		"""
+		self._ldns_resolver.set_dnssec(new_dnssec_status)
+
+class packet:
+	
+	def _construct_rr_filter(self, **kwds):
+		def match(pattern, target):
+			if pattern[0] in ["<",">","!"]:
+				rel = pattern[0]
+				pattern=pattern[1:]
+			elif pattern[0:2] in ["<=","=>"]:
+				rel = pattern[0:2]
+				pattern=pattern[2:]
+			else:
+				rel = "="
+			for val in pattern.split("|"):
+				if {"<" : target <  val,
+				    ">" : target >  val,
+				    "!" : target != val,
+				    "=" : target == val,
+				    ">=": target >= val,
+				    "<=": target <= val}[rel]:
+					return True
+			return False
+		def f(rr):
+			for key in kwds.keys():
+				if ( ( isinstance(kwds[key], list) and str(rr[key]) not in map(str,kwds[key]) )
+				  or ( not isinstance(kwds[key], list) and not match(str(kwds[key]), str(rr[key])))):
+					return False
+			return True
+		return f
+	
+	def __init__(self, pkt):
+		self._ldns_pkt = pkt
+	
+	def __repr__(self):
+		return str(self._ldns_pkt)
+	__str__ = __repr__
+	
+	def rcode(self):
+		"""Returns the rcode.
+
+		Example returned value: "NOERROR"
+
+		possible rcodes (via ldns): "FORMERR", "MASK", "NOERROR",
+		"NOTAUTH", "NOTIMPL", "NOTZONE", "NXDOMAIN",
+		"NXRSET", "REFUSED", "SERVFAIL", "SHIFT", 
+		"YXDOMAIN", "YXRRSET"
+
+		Refer to http://www.iana.org/assignments/dns-parameters
+		section: DNS RCODEs
+		"""
+		return self._ldns_pkt.rcode2str()
+
+	def opcode(self):
+		"""Returns the rcode.
+
+		Example returned value: "QUERY"
+
+		"""
+		return self._ldns_pkt.opcode2str()
+	
+	def flags(self):
+		"""Return packet flags (as list of strings).
+		
+		Example returned value: ['QR', 'RA', 'RD']
+
+		**What are the flags?**
+		
+		========  ====  =====================  =========
+		Bit       Flag  Description            Reference
+		========  ====  =====================  =========
+		bit 5     AA    Authoritative Answer   [RFC1035]
+		bit 6     TC    Truncated Response     [RFC1035]
+		bit 7     RD    Recursion Desired      [RFC1035]
+		bit 8     RA    Recursion Allowed      [RFC1035]
+		bit 9           Reserved
+		bit 10    AD    Authentic Data         [RFC4035]
+		bit 11    CD    Checking Disabled      [RFC4035]
+		========  ====  =====================  =========
+
+		(from http://www.iana.org/assignments/dns-parameters)
+
+		There is also QR. It is mentioned in other sources,
+		though not the above page. It being false means that
+		the packet is a query, it being true means that it is
+		a response.
+
+		"""
+		ret = []
+		if self._ldns_pkt.aa(): ret += ["AA"]
+		if self._ldns_pkt.ad(): ret += ["AD"]
+		if self._ldns_pkt.cd(): ret += ["CD"]
+		if self._ldns_pkt.qr(): ret += ["QR"]
+		if self._ldns_pkt.ra(): ret += ["RA"]
+		if self._ldns_pkt.rd(): ret += ["RD"]
+		if self._ldns_pkt.tc(): ret += ["TC"]
+		return ret
+
+	def answer(self, **filters):
+		"""Returns the answer section.
+		
+		* filters -- a filtering mechanism
+		
+		Since a very common desire is to filter the resource records in a packet
+		section, we provide a special tool for doing this: filters. They are a
+		lot like regular python filters, but more convenient. If you set a 
+		field equal to some value, you will only receive resource records for which
+		it holds true.
+
+		**Examples**
+
+		>>> res = ldnsx.resolver()
+		>>> pkt = res.query("google.ca","A")
+		>>> pkt.answer()
+		[google.ca.     28      IN      A       74.125.91.99
+		, google.ca.    28      IN      A       74.125.91.105
+		, google.ca.    28      IN      A       74.125.91.147
+		, google.ca.    28      IN      A       74.125.91.103
+		, google.ca.    28      IN      A       74.125.91.104
+		, google.ca.    28      IN      A       74.125.91.106
+		]
+
+		To understand filters, consider the following:
+
+		>>> pkt = ldnsx.query("cow.com","ANY")
+		>>> pkt.answer()
+		[cow.com.       276     IN      A       208.87.32.75
+		, cow.com.      3576    IN      NS      sell.internettraffic.com.
+		, cow.com.      3576    IN      NS      buy.internettraffic.com.
+		, cow.com.      3576    IN      SOA     buy.internettraffic.com. hostmaster.hostingnet.com. 1308785320 10800 3600 604800 3600
+		]
+		>>> pkt.answer(rr_type="A")
+		[cow.com.       276     IN      A       208.87.32.75
+		]
+		>>> pkt.answer(rr_type="A|NS")
+		[cow.com.       276     IN      A       208.87.32.75
+		, cow.com.      3576    IN      NS      sell.internettraffic.com.
+		, cow.com.      3576    IN      NS      buy.internettraffic.com.
+		]
+		>>> pkt.answer(rr_type="!NS")
+		[cow.com.       276     IN      A       208.87.32.75
+		, cow.com.      3576    IN      SOA     buy.internettraffic.com. hostmaster.hostingnet.com. 1308785320 10800 3600 604800 3600
+		]
+		
+		fields are the same as when indexing a resource record.
+		note: ordering is alphabetical.
+		"""
+		ret =  [resource_record(rr) for rr in self._ldns_pkt.answer().rrs()]
+		return filter(self._construct_rr_filter(**filters), ret)
+
+	def authority(self, **filters):
+		"""Returns the authority section.
+
+		* filters -- a filtering mechanism
+		
+		Since a very common desire is to filter the resource records in a packet
+		section, we provide a special tool for doing this: filters. They are a
+		lot like regular python filters, but more convenient. If you set a 
+		field equal to some value, you will only receive resource records for which
+		it holds true. See answer() for details.
+
+		**Examples**
+
+		>>> res = ldnsx.resolver()
+		>>> pkt = res.query("google.ca","A")
+		>>> pkt.authority()
+		[google.ca.     251090  IN      NS      ns3.google.com.
+		, google.ca.    251090  IN      NS      ns1.google.com.
+		, google.ca.    251090  IN      NS      ns2.google.com.
+		, google.ca.    251090  IN      NS      ns4.google.com.
+		]
+
+		"""
+		ret = [resource_record(rr) for rr in self._ldns_pkt.authority().rrs()]
+		return filter(self._construct_rr_filter(**filters), ret)
+
+	def additional(self, **filters):
+		"""Returns the additional section.
+
+		* filters -- a filtering mechanism
+		
+		Since a very common desire is to filter the resource records in a packet
+		section, we provide a special tool for doing this: filters. They are a
+		lot like regular python filters, but more convenient. If you set a 
+		field equal to some value, you will only receive resource records for which
+		it holds true. See answer() for details.
+
+		**Examples**
+
+		>>> res = ldnsx.resolver()
+		>>> pkt = res.query("google.ca","A")
+		>>> pkt.additional()
+		[ns3.google.com.        268778  IN      A       216.239.36.10
+		, ns1.google.com.       262925  IN      A       216.239.32.10
+		, ns2.google.com.       255659  IN      A       216.239.34.10
+		, ns4.google.com.       264489  IN      A       216.239.38.10
+		]
+
+		"""
+		ret = [resource_record(rr) for rr in self._ldns_pkt.additional().rrs()]
+		return filter(self._construct_rr_filter(**filters), ret)
+
+	def question(self, **filters):
+		"""Returns the question section.
+
+		* filters -- a filtering mechanism
+		
+		Since a very common desire is to filter the resource records in a packet
+		section, we provide a special tool for doing this: filters. They are a
+		lot like regular python filters, but more convenient. If you set a 
+		field equal to some value, you will only receive resource records for which
+		it holds true. See answer() for details.
+
+		"""
+		ret = [resource_record(rr) for rr in self._ldns_pkt.question().rrs()]
+		return filter(self._construct_rr_filter(**filters), ret)
+
+class resource_record:
+	
+	_rdfs = None
+	_iter_pos = None
+	
+	def __init__(self, rr):
+		self._ldns_rr = rr
+		self._rdfs = [str(rr.owner()),rr.ttl(),rr.get_class_str(),rr.get_type_str()]+[str(rdf) for rdf in rr.rdfs()]
+	
+	def __repr__(self):
+		return str(self._ldns_rr)
+	
+	__str__ = __repr__
+
+	def __iter__(self):
+		self._iter_pos = 0
+		return self
+
+	def next(self):
+		if self._iter_pos < len(self._rdfs):
+			self._iter_pos += 1
+			return self._rdfs[self._iter_pos-1]
+		else:
+			raise StopIteration
+
+	def __len__(self):
+		try:
+			return len(self._rdfs)
+		except:
+			return 0
+
+	def __getitem__(self, n):
+		if isinstance(n, int):
+			return self._rdfs[n]
+		elif isinstance(n, str):
+			n = n.lower()
+			if n in ["owner"]:
+				return self.owner()
+			elif n in ["rr_type", "rr type", "type"]:
+				return self.rr_type()
+			elif n in ["rr_class", "rr class", "class"]:
+				return self.rr_class()
+			elif n in ["covered_type", "covered type", "type2"]:
+				return self.covered_type()
+			elif n in ["ttl"]:
+				return self.ttl()
+			elif n in ["ip"]:
+				return self.ip()			
+			elif n in ["alg", "algorithm"]:
+				return self.alg()
+			elif n in ["protocol"]:
+				return self.protocol()
+			elif n in ["flags"]:
+				return self.flags()
+			else:
+				raise Exception("ldnsx (version %s) does not recognize the rr field %s" % (__version__,n) ) 
+		else:
+			raise TypeError("bad type %s for index resource record" % type(n) ) 
+			
+
+	#def rdfs(self):
+	#	return self._rdfs.clone()
+	
+	def owner(self):
+		"""Get the RR's owner"""
+		return str(self._ldns_rr.owner())
+	
+	def rr_type(self):
+		"""Get a RR's type """
+		return self._ldns_rr.get_type_str()
+
+	def covered_type(self):
+		"""Get an RRSIG RR's covered type"""
+		if self.rr_type() == "RRSIG":
+			return self[4]
+		else:
+			return ""
+	
+	def rr_class(self):
+		"""Get the RR's collapse"""
+		return self._ldns_rr.get_class_str()
+	
+	def ttl(self):
+		"""Get the RR's TTL"""
+		return self._ldns_rr.ttl()
+
+	def inception(self, out_format="UTC"):
+		"""returns the inception time in format out_format, defaulting to a UTC string. 
+		options for out_format are:
+
+		   UTC -- a UTC string eg. 20110712192610 (2011/07/12 19:26:10) 
+		   unix -- number of seconds since the epoch, Jan 1, 1970
+		   struct_time -- the format used by python's time library
+		"""
+		# Something very strange is going on with inception/expiration dates in DNS.
+		# According to RFC 4034 section 3.1.5 (http://tools.ietf.org/html/rfc4034#page-9)
+		# the inception/expiration fields should be in seconds since Jan 1, 1970, the Unix
+		# epoch (as is standard in unix). Yet all the packets I've seen provide UTC encoded
+		# as a string instead, eg. "20110712192610" which is 2011/07/12 19:26:10. 
+		#
+		# It turns out that this is a standard thing that ldns is doing before the data gets 
+		# to us.
+		if self.rr_type() == "RRSIG":
+			if out_format.lower() in ["utc", "utc str", "utc_str"]:
+				return self[9]
+			elif out_format.lower() in ["unix", "posix", "ctime"]:
+				return calendar.timegm(time.strptime(self[9], "%Y%m%d%H%M%S"))
+			elif out_format.lower() in ["relative"]:
+				return calendar.timegm(time.strptime(self[9], "%Y%m%d%H%M%S")) - time.time()
+			elif out_format.lower() in ["struct_time", "time.struct_time"]:
+				return time.strptime(self[9], "%Y%m%d%H%M%S")
+			else:
+				raise Exception("unrecognized time format")
+		else:
+			return ""
+
+	def expiration(self, out_format="UTC"):
+		"""get expiration time. see inception() for more information"""
+		if self.rr_type() == "RRSIG":
+			if out_format.lower() in ["utc", "utc str", "utc_str"]:
+				return self[8]
+			elif out_format.lower() in ["unix", "posix", "ctime"]:
+				return calendar.timegm(time.strptime(self[8], "%Y%m%d%H%M%S"))
+			elif out_format.lower() in ["relative"]:
+				return calendar.timegm(time.strptime(self[8], "%Y%m%d%H%M%S")) - time.time()
+			elif out_format.lower() in ["struct_time", "time.struct_time"]:
+				return time.strptime(self[8], "%Y%m%d%H%M%S")
+			else:
+				raise Exception("unrecognized time format")
+		else:
+			return ""
+
+	def ip(self):
+		""" IP address form A/AAAA record"""
+		if self.rr_type() in ["A", "AAAA"]:
+			return self[4]
+		else:
+			raise Exception("ldnsx does not support ip for records other than A/AAAA")
+
+	def alg(self):
+		"""Returns algorithm of RRSIG/DNSKEY/DS"""
+		t = self.rr_type() 
+		if t == "RRSIG":
+			return int(self[5])
+		elif t == "DNSKEY":
+			return int(self[6])
+		elif t == "DS":
+			return int(self[5])
+		else:
+			return -1
+
+	def protocol(self):
+		""" Returns protocol of the DNSKEY"""
+		t = self.rr_type() 
+		if t == "DNSKEY":
+			return int(self[5])
+		else:
+			return -1
+
+	def flags(self):
+		"""Return RR flags for DNSKEY """
+		t = self.rr_type() 
+		if t == "DNSKEY":
+			ret = []
+			n = int(self[4])
+			for m in range(1):
+				if 2**(15-m) & n:
+					if   m == 7: ret.append("ZONE")
+					elif m == 8: ret.append("REVOKE")
+					elif m ==15: ret.append("SEP")
+					else:        ret.append(m)
+			return ret
+		else:
+			return []
+
+_rr_types={
+	"A"    : ldns.LDNS_RR_TYPE_A,
+	"A6"   : ldns.LDNS_RR_TYPE_A6,
+	"AAAA" : ldns.LDNS_RR_TYPE_AAAA,
+	"AFSDB": ldns.LDNS_RR_TYPE_AFSDB,
+	"ANY"  : ldns.LDNS_RR_TYPE_ANY,
+	"APL"  : ldns.LDNS_RR_TYPE_APL,
+	"ATMA" : ldns.LDNS_RR_TYPE_ATMA,
+	"AXFR" : ldns.LDNS_RR_TYPE_AXFR,
+	"CDNSKEY" : ldns.LDNS_RR_TYPE_CDNSKEY,
+	"CDS" : ldns.LDNS_RR_TYPE_CDS,
+	"CERT" : ldns.LDNS_RR_TYPE_CERT,
+	"CNAME": ldns.LDNS_RR_TYPE_CNAME,
+	"COUNT": ldns.LDNS_RR_TYPE_COUNT,
+	"DHCID": ldns.LDNS_RR_TYPE_DHCID,
+	"DLV"  : ldns.LDNS_RR_TYPE_DLV,
+	"DNAME": ldns.LDNS_RR_TYPE_DNAME,
+	"DNSKEY": ldns.LDNS_RR_TYPE_DNSKEY,
+	"DS"   : ldns.LDNS_RR_TYPE_DS,
+	"EID"  : ldns.LDNS_RR_TYPE_EID,
+	"FIRST": ldns.LDNS_RR_TYPE_FIRST,
+	"GID"  : ldns.LDNS_RR_TYPE_GID,
+	"GPOS" : ldns.LDNS_RR_TYPE_GPOS,
+	"HINFO": ldns.LDNS_RR_TYPE_HINFO,
+	"IPSECKEY": ldns.LDNS_RR_TYPE_IPSECKEY,
+	"ISDN" : ldns.LDNS_RR_TYPE_ISDN,
+	"IXFR" : ldns.LDNS_RR_TYPE_IXFR,
+	"KEY"  : ldns.LDNS_RR_TYPE_KEY,
+	"KX"   : ldns.LDNS_RR_TYPE_KX,
+	"LAST" : ldns.LDNS_RR_TYPE_LAST,
+	"LOC"  : ldns.LDNS_RR_TYPE_LOC,
+	"MAILA": ldns.LDNS_RR_TYPE_MAILA,
+	"MAILB": ldns.LDNS_RR_TYPE_MAILB,
+	"MB"   : ldns.LDNS_RR_TYPE_MB,
+	"MD"   : ldns.LDNS_RR_TYPE_MD,
+	"MF"   : ldns.LDNS_RR_TYPE_MF,
+	"MG"   : ldns.LDNS_RR_TYPE_MG,
+	"MINFO": ldns.LDNS_RR_TYPE_MINFO,
+	"MR"   : ldns.LDNS_RR_TYPE_MR,
+	"MX"   : ldns.LDNS_RR_TYPE_MX,
+	"NAPTR": ldns.LDNS_RR_TYPE_NAPTR,
+	"NIMLOC": ldns.LDNS_RR_TYPE_NIMLOC,
+	"NS"   : ldns.LDNS_RR_TYPE_NS,
+	"NSAP" : ldns.LDNS_RR_TYPE_NSAP,
+	"NSAP_PTR" : ldns.LDNS_RR_TYPE_NSAP_PTR,
+	"NSEC" : ldns.LDNS_RR_TYPE_NSEC,
+	"NSEC3": ldns.LDNS_RR_TYPE_NSEC3,
+	"NSEC3PARAM" : ldns.LDNS_RR_TYPE_NSEC3PARAM,
+	"NSEC3PARAMS" : ldns.LDNS_RR_TYPE_NSEC3PARAMS,
+	"NULL" : ldns.LDNS_RR_TYPE_NULL,
+	"NXT"  : ldns.LDNS_RR_TYPE_NXT,
+	"OPENPGPKEY" : ldns.LDNS_RR_TYPE_OPENPGPKEY,
+	"OPT"  : ldns.LDNS_RR_TYPE_OPT,
+	"PTR"  : ldns.LDNS_RR_TYPE_PTR,
+	"PX"   : ldns.LDNS_RR_TYPE_PX,
+	"RP"   : ldns.LDNS_RR_TYPE_RP,
+	"RRSIG": ldns.LDNS_RR_TYPE_RRSIG,
+	"RT"   : ldns.LDNS_RR_TYPE_RT,
+	"SIG"  : ldns.LDNS_RR_TYPE_SIG,
+	"SINK" : ldns.LDNS_RR_TYPE_SINK,
+	"SOA"  : ldns.LDNS_RR_TYPE_SOA,
+	"SRV"  : ldns.LDNS_RR_TYPE_SRV,
+	"SSHFP": ldns.LDNS_RR_TYPE_SSHFP,
+	"TLSA" : ldns.LDNS_RR_TYPE_TLSA,
+	"TSIG" : ldns.LDNS_RR_TYPE_TSIG,
+	"TXT"  : ldns.LDNS_RR_TYPE_TXT,
+	"UID"  : ldns.LDNS_RR_TYPE_UID,
+	"UINFO": ldns.LDNS_RR_TYPE_UINFO,
+	"UNSPEC": ldns.LDNS_RR_TYPE_UNSPEC,
+	"WKS"  : ldns.LDNS_RR_TYPE_WKS,
+	"X25"  : ldns.LDNS_RR_TYPE_X25
+}
+
diff --git a/contrib/ldns/contrib/ldnsx/source/index.rst b/contrib/ldns/contrib/ldnsx/source/index.rst
new file mode 100644
index 00000000000000..efa2a77f32ed63
--- /dev/null
+++ b/contrib/ldns/contrib/ldnsx/source/index.rst
@@ -0,0 +1,57 @@
+Welcome to ldnsx's documentation!
+=================================
+
+LDNSX: Easy DNS (including DNSSEC) via ldns.
+
+ldns is a great library. It is a powerful tool for
+working with DNS. python-ldns it is a straight up clone of the C
+interface, however that is not a very good interface for python. Its
+documentation is incomplete and some functions don't work as
+described. And some objects don't have a full python API.
+
+ldnsx aims to fix this. It wraps around the ldns python bindings,
+working around its limitations and providing a well-documented, more
+pythonistic interface.
+
+Reference
+=========
+
+.. toctree::
+   :maxdepth: 1
+   
+   api/ldnsx
+
+.. toctree::
+   :maxdepth: 2
+
+   api/resolver
+   api/packet
+   api/resource_record
+
+Examples
+========
+
+Examples translated from ldns examples:
+
+.. toctree::
+   :maxdepth: 1
+
+   examples/ldnsx-axfr
+   examples/ldnsx-dnssec
+   examples/ldnsx-mx1
+   examples/ldnsx-mx2
+
+Others:
+
+.. toctree::
+   :maxdepth: 1
+
+   examples/ldnsx-walk
+
+
+Indices and tables
+==================
+
+* :ref:`genindex`
+* :ref:`search`
+
diff --git a/contrib/ldns/contrib/python/Changelog b/contrib/ldns/contrib/python/Changelog
new file mode 100644
index 00000000000000..4b449a84ab2c3f
--- /dev/null
+++ b/contrib/ldns/contrib/python/Changelog
@@ -0,0 +1,92 @@
+1.6.17	2014-01-10
+	* Added ldns_rdf.data_as_bytearray(). The method returns a bytearray object
+	  containing rdf data.
+	* Changed the behaviour of ldns_resolver.trusted_key() in order to prevent
+	  memory corruption and leaks.
+	* Fixed memory leaks when destroying ldns_resolver.
+	* Removed ldns_pkt.section_count(), ldns_resolver.set_searchlist_count()
+	  because it is marked static in the library.
+	* Added ldns_pkt.new(), ldns_resolver.new().
+	* Marked as returning new object ldns_pkt.get_section_clone(),
+	  ldns_resolver.get_addr_by_name(), ldns_resolver.get_name_by_addr(),
+	  ldns_resolver.search().
+	* Added push cloning for ldns_pkt.safe_push_rr(),
+	  ldns_pkt.safe_push_rr_list(), ldns_pkt.set_additional(),
+	  ldns_pkt.set_answer(), ldns_pkt.set_answerfrom(),
+	  ldns_pkt.set_authority(), ldns_pkt.set_edns_data(),
+	  ldns_pkt.set_question(), ldns_pkt.set_tsig(),
+	  ldns_resolver.set_dnssec_anchors(), ldns_resolver.set_domain().
+	* Added pull cloning for ldns_pkt.answerfrom(), ldns_pkt.edns_data(),
+	  ldns_pkt.tsig(), ldns_resolver.axfr_last_pkt(),
+	  ldns_resolver.dnssec_anchors(), ldns_resolver.domain(),
+	  ldns_resolver.tsig_algorithm(), ldns_resolver.tsig_keydata(),
+	  ldns_resolver.tsig_keyname().
+	* Method ldns_rdf.reverse() now throws an exception when not applied
+	  on dname rdfs. This is to prevent assertion fails in ldns' C code.
+
+1.6.16	2012-11-13
+	* Fix typo in ldns_struct_pkt.opcode2str
+
+1.6.14	2012-10-23
+	* Added rich comparison methods for ldns_dname, ldns_rdf, ldns_rr and
+	  ldns_rr_list classes.
+	* Added deprecation warnings into ldns_rr.new_frm_fp() and
+	  ldns_rr.new_frm_fp_l() and others.
+	* Fixed ldns_rr.set_rdf(), which may cause memory leaks, because it
+	  returns new objects (in the scope of Python). Also it leaked memory,
+	  when the call was not successful.
+	* Fixed ldns_get_rr_list_hosts_frm_file, marked as newobject.
+	* Fixed ldns_rr_list.cat() to return bool as mentioned in documentation.
+	* Fixed ldns_rr_list_cat_clone, marked as newobject.
+	* Fixed ldns_rr_list.new_frm_file(). Exception argument was invalid.
+	* Fixed ldns_rr_list.push_rr() to return bool as mentioned in
+	  documentation.
+	* Fixed ldns_rr_list.push_rr_list() to return bool as mentioned in
+	  documentation.
+	* Fixed ldns_rr_list.set_rr(), which caused memory corruption, double free
+	  problems and memory leaks. (The wrapper used original function instead
+	  of its push cloned variant which was missing.)
+	* Fixed ldns_rr_list.set_rr_count(), added python exception raise in order
+	  to avoid assertion failure.
+	* Fixed ldns_rr_list.subtype_by_rdf(), marked as newobject.
+	* Added ldns_rr.to_canonical(), ldns_rr.is_question(),
+	  ldns_rr.type_by_name(), ldns_rr.class_by_name(), ldns_rr_list.new(),
+	  ldns_rr.set_question().
+	* Modified ldns_rr_list.owner() and ldns_rr.owner(), now returns ldns_dname.
+	* Fixed assertion failures for several methods when receiving incorrect but
+	  syntactically valid arguments (i.e., ldns_rr.a_address(),
+	  ldns_rr.dnskey_algorithm(), ldns_rr.dnskey_flags(),
+	  ldns_rr.dnskey_key(), ldns_rr.dnskey_protocol(),
+	  ldns_rr.mx_exchange(), ldns_rr.mx_preference(), ldns_rr.ns_nsdname(),
+	  ldns_rr.owner(), ldns_rr.rdf(), ldns_rr.rrsig_algorithm(),
+	  ldns_rr.rrsig_expiration(), ldns_rr.rrsig_inception(),
+	  ldns_rr.rrsig_keytag(), ldns_rr.rrsig_labels(), ldns_rr.rrsig_origttl(),
+	  ldns_rr.rrsig_sig(), ldns_rr.rrsig_signame(),
+	  ldns_rr.rrsig_typecovered(), ldns_rr_list.owner(), ldns_rr_list.rr())
+	* Fixed ldns_rr.a_address(), which was asserting when called
+	  on non A or AAAA type rr. Now returns None when fails.
+	* Added scripts for testing the basic functionality of the ldns_rr,
+	  ldns_rr_descriptor and ldns_rr_list class code.
+	* Improved documentation of ldns_rr, ldns_rr_descriptor and ldns_rr_list.
+	* Fixed automatic conversion from Python string to ldns_rdf and
+	  ldns_dname. Caused memory corruption when using Python 3.
+	* The Python 3 wrapper code now raises TypeError instead of ValueError
+	  when receiving a non FILE * argument when it should be a FILE *.
+	* Fixed wrong handling of _ldns_rr_list_free() and
+	  _ldns_rr_list_deep_free() when compiling with LDNS_DEBUG directive.
+	* Fixed malfunctioning ldns.ldns_rdf_new_frm_fp_l().
+	* Fixed malfunctioning ldns_drf.absolute() and ldns_dname.absolute().
+	* Marked several functions related to ldns_rdf and ldns_buffer as
+	  returning new objects.
+	* Method operating on ldns_dnames and returning dname ldns_rdfs now
+	  return ldns_dname instances.
+	* Improved documentation of ldns_buffer, ldns_rdf and ldns_dname
+	  classes.
+	* Methods ldns_buffer.available() and ldns_buffer.available_at() now
+	  return bool types as described in the documentation.
+	* Added scripts for testing the basic functionality of the ldns_buffer,
+	  ldns_rdf, ldns_dname class code.
+	* Added deprecation warnings to ldns_rdf methods operating on dname
+	  rdfs. The user is encouraged to converts dname ldns_rdfs to
+	  ldns_dnames.
+	* Extended ldns_dname constructor to accept ldns_rdfs containing dnames.
diff --git a/contrib/ldns/contrib/python/docs/source/examples/example1.rst b/contrib/ldns/contrib/python/docs/source/examples/example1.rst
new file mode 100644
index 00000000000000..891e0853f85c0a
--- /dev/null
+++ b/contrib/ldns/contrib/python/docs/source/examples/example1.rst
@@ -0,0 +1,68 @@
+Resolving the MX records
+==============================
+
+This basic example shows how to create a resolver which asks for MX records which contain the information about mail servers.
+
+::
+
+	#!/usr/bin/python
+	#
+	# MX is a small program that prints out the mx records for a particular domain
+	#
+	import ldns
+	
+	resolver = ldns.ldns_resolver.new_frm_file("/etc/resolv.conf")
+
+	dname = ldns.ldns_dname("nic.cz")
+	
+	pkt = resolver.query(dname, ldns.LDNS_RR_TYPE_MX, ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+	if (pkt):
+		mx = pkt.rr_list_by_type(ldns.LDNS_RR_TYPE_MX, ldns.LDNS_SECTION_ANSWER)
+		if (mx):
+			mx.sort()
+			print mx
+
+Resolving step by step
+------------------------
+
+First of all we import :mod:`ldns` extension module which make LDNS functions and classes accessible::
+
+	import ldns
+
+If importing fails, it means that Python cannot find the module or ldns library.
+
+Then we create the resolver by :meth:`ldns.ldns_resolver.new_frm_file` constructor ::
+
+	resolver = ldns.ldns_resolver.new_frm_file("/etc/resolv.conf")
+
+and domain name variable dname::
+
+	dname = ldns.ldns_dname("nic.cz")
+
+To create a resolver you may also use::
+
+	resolver = ldns.ldns_resolver.new_frm_file(None)
+
+which behaves in the same manner as the command above.
+
+In the third step we tell the resolver to query for our domain, type MX, of class IN::
+	
+	pkt = resolver.query(dname, ldns.LDNS_RR_TYPE_MX, ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+
+The function should return a packet if everything goes well and this packet will contain resource records we asked for. 
+Note that there exists a simpler way. Instead of using a dname variable, we can use a string which will be automatically converted.
+::
+
+	pkt = resolver.query("fit.vutbr.cz", ldns.LDNS_RR_TYPE_MX, ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+
+Now, we test whether the resolver returns a packet and then get all RRs of type MX from the answer packet and store them in list mx::
+
+	if (pkt):
+		mx = pkt.rr_list_by_type(ldns.LDNS_RR_TYPE_MX, ldns.LDNS_SECTION_ANSWER)
+
+If this list is not empty, we sort and print the content to stdout::
+
+	if (mx):
+		mx.sort()
+		print mx
+
diff --git a/contrib/ldns/contrib/python/docs/source/examples/example8.rst b/contrib/ldns/contrib/python/docs/source/examples/example8.rst
new file mode 100644
index 00000000000000..2cd1daf2dd473f
--- /dev/null
+++ b/contrib/ldns/contrib/python/docs/source/examples/example8.rst
@@ -0,0 +1,17 @@
+Signing of a zone file
+===============================
+
+This example shows how to sign the content of the given zone file
+
+.. literalinclude:: ../../../examples/ldns-signzone.py
+   :language: python
+
+In order to be able sign a zone file, you have to generate a key-pair using ``ldns-keygen.py``. Don't forget to modify tag number.
+
+Signing consists of three steps
+
+1. In the first step, the content of a zone file is read and parsed. This can be done using :class:`ldns.ldns_zone` class.
+
+2. In the second step, the private and public key is read and public key is inserted into zone (as DNSKEY). 
+
+3. In the last step, the DNSSEC zone instance is created and all the RRs from zone file are copied here. Then, all the records are signed using :meth:`ldns.ldns_zone.sign` method. If the signing was successful, the content of DNSSEC zone is written to a file.
diff --git a/contrib/ldns/contrib/python/docs/source/install.rst b/contrib/ldns/contrib/python/docs/source/install.rst
new file mode 100644
index 00000000000000..27bf07652834fc
--- /dev/null
+++ b/contrib/ldns/contrib/python/docs/source/install.rst
@@ -0,0 +1,72 @@
+Installation
+===================================
+
+**Prerequisites**
+
+SWIG 1.3 and GNU make are required to build modules for Python 2.4 and higher
+(but lower than 3). In order to build modules for Python 3.2 or higher,
+SWIG in version 2.0.4 or higher is required.
+
+Note that Python 3.0 and 3.1 are not supported.
+
+In order to build this documentation the Sphinx Python documentation generator
+is required.
+
+**Download**
+
+The latest source codes can be downloaded from `here`_.
+
+.. _here: http://nlnetlabs.nl/projects/ldns/
+
+**Compiling**
+
+After downloading the source code archive (this example uses
+ldns-1.6.13.tar.gz), pyLDNS can be enabled and compiled by typing::
+
+	> tar -xzf ldns-1.6.13.tar.gz
+	> cd ldns-1.6.13
+	> ./configure --with-pyldns
+	> make
+
+You need GNU make to compile pyLDNS; SWIG and Python development libraries to
+compile the extension module.
+
+**Selecting Target Python Interpreter**
+
+By default, the pyLDNS module builds for the default Python interpreter (i.e.,
+the Python interpreter which can be accessed by just typing ``python`` in
+the command line). If you desire to build the pyLDNS module for a different
+Python version then you must specify the desired Python version by setting
+the ``PYTHON_VERSION`` variable during the configure phase::
+
+	> PYTHON_VERSION=3.2 ./configure --with-pyldns
+	> make
+
+By default the pyLDNS compiles from sources for a single Python interpreter.
+Remember to execute scripts requiring pyLDNS in those Python interpreters which
+have pyLDNS installed.
+
+**Testing**
+
+If the compilation is successful, you can test the python LDNS extension module
+by executing the commands::
+
+	> cd contrib/python
+	> make testenv
+	> ./ldns-mx.py
+
+Again, remember to use the Python interpreter version which the pyLDNS module
+has been compiled with.
+
+The commands will start a new shell, in which several symbolic links will be
+set-up. When you exit the shell, then symbolic links will be deleted.
+
+In ``contrib/python/examples`` several simple Python scripts utilising pyLDNS
+can be found. These scripts demonstrate the capabilities of the LDNS library.
+
+**Installation**
+
+To install the libraries and it's extensions type::
+
+	> cd ldns-1.6.13
+	> make install
diff --git a/contrib/ldns/contrib/python/examples/test_buffer.py b/contrib/ldns/contrib/python/examples/test_buffer.py
new file mode 100755
index 00000000000000..7bdf413e5c0b83
--- /dev/null
+++ b/contrib/ldns/contrib/python/examples/test_buffer.py
@@ -0,0 +1,843 @@
+#!/usr/bin/env python
+
+#
+# ldns_buffer testing script.
+#
+# Do not use constructs that differ between Python 2 and 3.
+# Use write on stdout or stderr.
+#
+
+
+import ldns
+import sys
+import os
+import inspect
+
+
+class_name = "ldns_buffer"
+method_name = None
+error_detected = False
+
+
+def set_error():
+    """
+        Writes an error message and sets error flag.
+    """
+    global class_name
+    global method_name
+    global error_detected
+    error_detected = True
+    sys.stderr.write("(line %d): malfunctioning method %s.\n" % \
+       (inspect.currentframe().f_back.f_lineno, method_name))
+    
+
+# Buffer creation.
+capacity = 1024
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.__init__()"
+    try:
+        buf = ldns.ldns_buffer(1024)
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.__str__()"
+    buf.printf("abcedf")
+    try:
+        string = buf.__str__()
+    except:
+        set_error()
+    if not isinstance(string, str):
+        # Should be string.
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.at()"
+    try:
+        ret = buf.at(512)
+    except:
+        set_error()
+    try:
+        # Must raise TypeError.
+        ret = buf.at("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.available()"
+    try:
+        ret = buf.available(capacity)
+    except:
+        set_error()
+    if not isinstance(ret, bool):
+        # Should be bool.
+        set_error()
+    if not buf.available(capacity):
+        # Should return True.
+        set_error()
+    if buf.available(capacity + 1):
+        # Should return False.
+        set_error()
+    try:
+        # Must raise TypeError.
+        ret = buf.available("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        # Must raise ValueError.
+#        ret = buf.available("")
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.available_at()"
+    try:
+        ret = buf.available_at(512, capacity - 512)
+    except:
+        set_error()
+    if not isinstance(ret, bool):
+        # Should be bool.
+        set_error()
+    if not buf.available_at(512, capacity - 512):
+        # Should return True.
+        set_error()
+    if buf.available_at(512, capacity - 512 + 1):
+        # Should return False.
+        set_error()
+    try:
+        # Must raise TypeError.
+        ret = buf.available_at("", 1)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    try:
+        # Must raise TypeError.
+        ret = buf.available_at(1, "")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        # Must raise ValueError.
+#        ret = buf.available_at(-1, 512)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+#    try:
+#        # Must raise ValueError.
+#        ret = buf.available_at(512, -1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.begin()"
+    try:
+        ret = buf.begin()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.capacity()"
+    try:
+        ret = buf.capacity()
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        # Should be int.
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.clear()"
+    try:
+        buf.clear()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.copy()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+#    buf2 = ldns.ldns_buffer(10)
+#    buf2.printf("abcdef")
+#    try:
+#        buf.copy(buf2)
+#        print buf.capacity()
+#        print buf2.capacity()
+#    except:
+#        set_error()
+#    buf.printf("2")
+#    print buf
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.current()"
+    try:
+        ret = buf.current()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.end()"
+    try:
+        ret = buf.end()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.export()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.flip()"
+    buf.printf("abcdef")
+    try:
+        buf.flip()
+    except:
+        set_error()
+#    if buf.remaining() != capacity:
+#        # Should be at beginning.
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.getc()"
+    buf.printf("a")
+    buf.rewind()
+    try:
+        ret = buf.getc()
+    except:
+        set_error()
+    if ret != ord("a"):
+        set_error()
+# Test return value for -1
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.invariant()"
+    try:
+        buf.invariant()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.limit()"
+    try:
+        ret = buf.limit()
+    except:
+        set_error()
+    if ret != capacity:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.position()"
+    try:
+        ret = buf.position()
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.printf()"
+    try:
+        ret = buf.printf("abcdef")
+    except:
+        set_error()
+    if not isinstance(ret, int):
+        set_error()
+    try:
+        ret = buf.printf(10)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_at()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u16()"
+    buf.printf("aac")
+    buf.rewind()
+    try:
+        ret = buf.read_u16()
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != (ord("a") * 0x0101):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u16_at()"
+    buf.printf("abbc")
+    try:
+        ret = buf.read_u16_at(1)
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != (ord("b") * 0x0101):
+        set_error()
+    try:
+        ret = buf.read_u16_at("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf.read_u16_at(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u32()"
+    buf.printf("aaaac")
+    buf.rewind()
+    try:
+        ret = buf.read_u32()
+    except:
+        set_error()
+    if not isinstance(ret, int):
+        set_error()
+    if ret != (ord("a") * 0x01010101):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u32_at()"
+    buf.printf("abbbbc")
+    try:
+        ret = buf.read_u32_at(1)
+    except:
+        set_error()
+    if not isinstance(ret, int):
+        set_error()
+    if ret != (ord("b") * 0x01010101):
+        set_error()
+    try:
+        ret = buf.read_u32_at("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf.read_u32_at(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u8()"
+    buf.printf("ac")
+    buf.rewind()
+    try:
+        ret = buf.read_u8()
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != ord("a"):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.read_u8_at()"
+    buf.printf("abc")
+    try:
+        ret = buf.read_u8_at(1)
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != ord("b"):
+        set_error()
+    try:
+        ret = buf.read_u8_at("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf.read_u8_at(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.remaining()"
+    buf.printf("abcdef")
+    try:
+        ret = buf.remaining()
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != (capacity - 6):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.remaining_at()"
+    buf.printf("abcdef")
+    try:
+        ret = buf.remaining_at(1)
+    except:
+        set_error()
+    if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+        set_error()
+    if ret != (capacity - 1):
+        set_error()
+    try:
+        ret = buf.remaining_at("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf.remaining_at(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.reserve()"
+    buf2 = ldns.ldns_buffer(512)
+    try:
+        ret = buf2.reserve(1024)
+    except:
+        set_error()
+    if not isinstance(ret, bool):
+        set_error()
+    try:
+        ret = buf2.reserve("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf2.reserve(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.rewind()"
+    buf.printf("abcdef")
+    try:
+        buf.rewind()
+    except:
+        set_error()
+    if buf.position() != 0:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.set_capacity()"
+    try:
+        ret = buf.set_capacity(capacity)
+    except:
+        set_error()
+    if not isinstance(ret, bool):
+        set_error()
+    try:
+        ret = buf.set_capacity("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        ret = buf.set_capacity(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.set_limit()"
+    try:
+        buf.set_limit(0)
+    except:
+        set_error()
+    try:
+        buf.set_limit("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        buf.set_limit(-1)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+    
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.set_position()"
+    try:
+        buf.set_position(0)
+    except:
+        set_error()
+    try:
+        buf.set_position("")
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        buf.set_position(-1)
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.skip()"
+    try:
+        buf.skip(10)
+    except:
+        set_error()
+    try:
+        buf.skip(-1)
+    except:
+        set_error()
+    try:
+        buf.skip("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.status()"
+    try:
+        ret = buf.status()
+    except:
+        set_error()
+    # Returned status is an integer.
+    if not isinstance(ret, int):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.status_ok()"
+    try:
+        ret = buf.status_ok()
+    except:
+        set_error()
+    if not isinstance(ret, bool):
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_at()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_string()"
+    try:
+        buf.write_string("abcdef")
+    except:
+        set_error()
+#    try:
+#        buf.write_sring(-1)
+#        set_error()
+#    except TypeError:
+#        pass
+#    except:
+#        set_error()
+    sys.stderr.write("%s not tested for parameter correctness.\n" % \
+        (method_name))
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_string_at()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u16()"
+    try:
+        buf.write_u16(ord("b") * 0x0101)
+    except:
+        set_error()
+    try:
+        buf.write_u16("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u16_at()"
+    buf.printf("a")
+    try:
+        buf.write_u16_at(1, ord("b") * 0x0101)
+    except:
+        set_error()
+    try:
+        buf.write_u16_at("", ord("b") * 0x0101)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        buf.write_u16_at(-1, ord("b") * 0x0101)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    try:
+        buf.write_u16_at(1, "")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u32()"
+    try:
+        buf.write_u32(ord("b") * 0x01010101)
+    except:
+        set_error()
+    try:
+        buf.write_u32("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u32_at()"
+    buf.printf("a")
+    try:
+        buf.write_u32_at(1, ord("b") * 0x01010101)
+    except:
+        set_error()
+    try:
+        buf.write_u32_at("", ord("b") * 0x01010101)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        buf.write_u32_at(-1, ord("b") * 0x01010101)
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    try:
+        buf.write_u32_at(1, "")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u8()"
+    try:
+        buf.write_u8(ord("b"))
+    except:
+        set_error()
+    try:
+        buf.write_u8("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    buf.clear()
+
+
+#if not error_detected:
+if True:
+    method_name = "ldns_buffer.write_u8_at()"
+    buf.printf("a")
+    try:
+        buf.write_u8_at(1, ord("b"))
+    except:
+        set_error()
+    try:
+        buf.write_u8_at("", ord("b"))
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+#    try:
+#        buf.write_u8_at(-1, ord("b"))
+#        set_error()
+#    except ValueError:
+#        pass
+#    except:
+#        set_error()
+    try:
+        buf.write_u8_at(1, "")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+if not error_detected:
+    sys.stdout.write("%s: passed.\n" % (os.path.basename(__file__)))
+else:
+    sys.stdout.write("%s: errors detected.\n" % (os.path.basename(__file__)))
+    sys.exit(1)
diff --git a/contrib/ldns/contrib/python/examples/test_dname.py b/contrib/ldns/contrib/python/examples/test_dname.py
new file mode 100755
index 00000000000000..4603543f1b31a3
--- /dev/null
+++ b/contrib/ldns/contrib/python/examples/test_dname.py
@@ -0,0 +1,474 @@
+#!/usr/bin/env python
+
+#
+# ldns_dname testing script.
+#
+# Do not use constructs that differ between Python 2 and 3.
+# Use write on stdout or stderr.
+#
+
+
+import ldns
+import sys
+import os
+import inspect
+
+
+class_name = "ldns_dname"
+method_name = None
+error_detected = False
+temp_fname = "tmp_dname.txt"
+
+
+def set_error():
+    """
+        Writes an error message and sets error flag.
+    """
+    global class_name
+    global method_name
+    global error_detected
+    error_detected = True
+    sys.stderr.write("(line %d): malfunctioning method %s.\n" % \
+       (inspect.currentframe().f_back.f_lineno, method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".__init__()"
+    rdf1 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_DNAME, "test.nic.cz.")
+    rdf2 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A, "217.31.205.50")
+    try:
+        dname = ldns.ldns_dname("www.nic.cz.")
+        if not isinstance(dname, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+    #
+    # Error when printing a dname which was created from an empty string.
+    # Must find out why.
+    #
+    try:
+        dname = ldns.ldns_dname(rdf1)
+        if not isinstance(dname, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+    # Test whether rdf1 and dname independent.
+    dname.cat(dname)
+    if dname.__str__() == rdf1.__str__():
+        set_error()
+    # Test whether rdf1 and dname are dependent.
+    dname = ldns.ldns_dname(rdf1, clone=False)
+    dname.cat(dname)
+    if dname.__str__() != rdf1.__str__():
+        set_error()
+    # Test whether constructs from non-dname rdfs.
+    try:
+        dname = ldns.ldns_dname(rdf2)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    try:
+        dname = ldns.ldns_dname(1)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".[comparison operators]"
+    dn1 = ldns.ldns_dname("a.test")
+    dn2 = ldns.ldns_dname("b.test")
+    try:
+        ret = dn1 < dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2 < dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 <= dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2 <= dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 == dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 == dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 != dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 != dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 > dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2 > dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1 >= dn2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2 >= dn1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".absolute()"
+    dname = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dname.absolute()
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".cat()"
+    rdf1 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_DNAME, "test.nic.cz.")
+    rdf2 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A, "217.31.205.50")
+    dname = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dname.cat(dname)
+        if ret != ldns.LDNS_STATUS_OK:
+            set_error()
+        if dname.__str__() != "www.nic.cz.www.nic.cz.":
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat(rdf1)
+        if ret != ldns.LDNS_STATUS_OK:
+            set_error()
+        if dname.__str__() != "www.nic.cz.www.nic.cz.test.nic.cz.":
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat(rdf2)
+        if ret == ldns.LDNS_STATUS_OK:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".cat_clone()"
+    rdf1 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_DNAME, "test.nic.cz.")
+    rdf2 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A, "217.31.205.50")
+    dname = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dname.cat_clone(dname)
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+        if ret.__str__() != "www.nic.cz.www.nic.cz.":
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat_clone(rdf1)
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+        if ret.__str__() != "www.nic.cz.test.nic.cz.":
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat_clone(rdf2)
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dname.cat_clone("")
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".interval()"
+    dn1 = ldns.ldns_dname("a.ns.nic.cz.")
+    dn2 = ldns.ldns_dname("b.ns.nic.cz.")
+    dn3 = ldns.ldns_dname("c.ns.nic.cz.")
+    try:
+        ret = dn1.interval(dn2, dn3)
+        if ret != -1:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2.interval(dn1, dn3)
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+    rdf4 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_DNAME, "d.ns.nic.cz.")
+    rdf5 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A, "194.0.12.1")
+    try:
+        ret = dn1.interval(dn2, rdf4)
+        if ret != -1:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn2.interval(dn1, rdf4)
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1.interval(dn2, rdf5)
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    try:
+        ret = dn1.interval(dn2, "")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".is_subdomain()"
+    dn1 = ldns.ldns_dname("nic.cz.")
+    dn2 = ldns.ldns_dname("www.nic.cz.")
+    rdf3 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_DNAME, "www.nic.cz.")
+    try:
+        ret = dn1.is_subdomain(dn2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret == True:
+            set_error()
+        ret = dn2.is_subdomain(dn1)
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1.is_subdomain(rdf3)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret == True:
+            set_error()
+    except:
+        set_error()
+    rdf4 = ldns.ldns_rdf_new_frm_str(ldns.LDNS_RDF_TYPE_A, "194.0.12.1")
+    try:
+        ret = dn1.is_subdomain(rdf4)
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn1.is_subdomain("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".label()"
+    dn = ldns.ldns_dname("nic.cz.")
+    try:
+        ret = dn.label(0)
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn.label(10)
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn.label("")
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".label_count()"
+    dn = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dn.label_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 3:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".left_chop()"
+    dn = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dn.left_chop()
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".make_canonical()"
+    dn = ldns.ldns_dname("WWW.NIC.CZ.")
+    try:
+        dn.make_canonical()
+        if dn.__str__() != "www.nic.cz.":
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_rdf()"
+    # Tested via constructor call.
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_str()"
+    # Tested via constructor call.
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".reverse()"
+    dn = ldns.ldns_dname("www.nic.cz.")
+    try:
+        ret = dn.reverse()
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+        if ret.__str__() != "cz.nic.www.":
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_to_buffer()"
+    dn = ldns.ldns_dname("www.nic.cz.")
+    buf = ldns.ldns_buffer(1024)
+    try:
+        ret = dn.write_to_buffer(buf)
+        if ret != ldns.LDNS_STATUS_OK:
+            set_error()
+        if buf.position() != 12:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = dn.write_to_buffer("")
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+if not error_detected:
+    sys.stdout.write("%s: passed.\n" % (os.path.basename(__file__)))
+else:
+    sys.stdout.write("%s: errors detected.\n" % (os.path.basename(__file__)))
+    sys.exit(1)
diff --git a/contrib/ldns/contrib/python/examples/test_rr.py b/contrib/ldns/contrib/python/examples/test_rr.py
new file mode 100755
index 00000000000000..07ba0e743073cf
--- /dev/null
+++ b/contrib/ldns/contrib/python/examples/test_rr.py
@@ -0,0 +1,2383 @@
+#!/usr/bin/env python
+
+#
+# ldns_rr and ldns_rr_list testing script.
+#
+# Do not use constructs that differ between Python 2 and 3.
+# Use write on stdout or stderr.
+#
+
+
+import ldns
+import sys
+import os
+import inspect
+
+
+class_name = "ldns_rr"
+method_name = None
+error_detected = False
+temp_fname = "tmp_rr.txt"
+
+
+def set_error():
+    """
+        Writes an error message and sets error flag.
+    """
+    global class_name
+    global method_name
+    global error_detected
+    error_detected = True
+    sys.stderr.write("(line %d): malfunctioning method %s.\n" % \
+       (inspect.currentframe().f_back.f_lineno, method_name))
+
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".[comparison operators]"
+    rr1 = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rr2 = ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1")
+    try:
+        ret = rr1 < rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr2 < rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 <= rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr2 <= rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 == rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 == rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 != rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 != rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 > rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr2 > rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr1 >= rr2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr2 >= rr1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + "__init__()"
+    try:
+        rr = ldns.ldns_rr()
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".a_address()"
+    rr = ldns.ldns_rr.new_frm_str("www.nic.cz 600 IN A 217.31.205.50")
+    try:
+        address = rr.a_address()
+        if not isinstance(address, ldns.ldns_rdf):
+            set_error()
+        if address == None:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("www.nic.cz 600 IN AAAA 2002:d91f:cd32::1")
+    try:
+        address = rr.a_address()
+        if not isinstance(address, ldns.ldns_rdf):
+            set_error()
+        if address == None:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("www.nic.cz 600 IN TXT text")
+    try:
+        address = rr.a_address()
+        if isinstance(address, ldns.ldns_rdf):
+            set_error()
+        if address != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".a_set_address()"
+    rdf = ldns.ldns_rdf.new_frm_str("127.0.0.1", ldns.LDNS_RDF_TYPE_A)
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.a_set_address(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    rdf = ldns.ldns_rdf.new_frm_str("::1", ldns.LDNS_RDF_TYPE_AAAA)
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN AAAA ::")
+    try:
+        ret = rr.a_set_address(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr.a_set_address("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".class_by_name()"
+    try:
+        ret = ldns.ldns_rr.class_by_name("IN")
+        if not isinstance(ret, int):
+            set_error()
+        if ret != ldns.LDNS_RR_CLASS_IN:
+            set_error()
+    except:
+        set_error()
+    method_name = class_name + ".class_by_name()"
+    try:
+        ret = ldns.ldns_rr.class_by_name("AA")
+        if not isinstance(ret, int):
+            set_error()
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".clone()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN TXT text")
+    try:
+        ret = rr.clone()
+        if not isinstance(ret, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".compare_ds()"
+    pubkey1 = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    pubkey2 = ldns.ldns_rr.new_frm_str("example2. 3600 IN DNSKEY 256 3 3 ALBoD2+1xYpzrE7gjU5EwwBHG2HNiD1977LDZGh+8VNifMGjixMpgUN6xRhFjvRSsC/seMVXmUGq+msUDF2pHnUHbW/dbQbBxVMAqx2jT0LTvAx5wUPGltHHsa92K8VdzD8ynTFwPvjmk7g3hqRRzt4UTQIeK7DYgrOOgvDv+DYWVQctLwYP0ktm85b4cMtIUNRIf/N+K25pfK6BM/tHN8HOm4ECvm2U9zqHHfnxJFdiNK2PydkNeJZZGUOubSFVvaOMhZoEeAgkm3q5QcwXHsLAhacZ ;{id = 30944 (zsk), size = 512b}")
+    ds1 = ldns.ldns_key_rr2ds(pubkey1, ldns.LDNS_SHA1)
+    ds2 = ldns.ldns_key_rr2ds(pubkey2, ldns.LDNS_SHA1)
+    try:
+        ret = pubkey1.compare_ds(pubkey1)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = pubkey1.compare_ds(pubkey2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = pubkey1.compare_ds(ds1)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = pubkey1.compare_ds(ds2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        pubkey1.compare_ds("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".compare_no_rdata()"
+    rr1 = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    rr2 = ldns.ldns_rr.new_frm_str("test 600 IN AAAA ::")
+    try:
+        ret = rr1.compare_no_rdata(rr2)
+        if not isinstance(ret, int):
+            set_error()
+        if ret != -27:
+            set_error()
+    except:
+        set_error()
+    try:
+        rr1.compare_no_rdata("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_algorithm()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    try:
+        ret = pubkey.dnskey_algorithm()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.dnskey_algorithm()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_flags()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    try:
+        ret = pubkey.dnskey_flags()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.dnskey_flags()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_errror()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_key()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    try:
+        ret = pubkey.dnskey_key()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.dnskey_key()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_errror()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_key_size()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    try:
+        ret = pubkey.dnskey_key_size()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 512:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.dnskey_key_size()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_key_size_raw()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_protocol()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    try:
+        ret = pubkey.dnskey_protocol()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.dnskey_protocol()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_set_algorithm()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    rdf = ldns.ldns_rdf.new_frm_str("3", ldns.LDNS_RDF_TYPE_ALG)
+    try:
+        ret = pubkey.dnskey_set_algorithm(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = pubkey.dnskey_set_algorithm(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = pubkey.dnskey_set_algorithm("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_set_flags()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    rdf = ldns.ldns_rdf.new_frm_str("256", ldns.LDNS_RDF_TYPE_INT16)
+    try:
+        ret = pubkey.dnskey_set_flags(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = pubkey.dnskey_set_flags(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = pubkey.dnskey_set_flags("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_set_key()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    rdf = ldns.ldns_rdf.new_frm_str("AMLdYflByPu1GEPCnu9qPTqbnC8n5mftFmFVTFQI10aefiDqp5DLpjBdTxdmz/GACMZh1+YG/iLj0QYX7qRVIl0rR00iREozqj44YwUILHo3cASSRSeAzyidvlGT8QSMKOlOsD33ygtETpzW0XDmzWhyU3bv0O7lnGpbtqdzP/nsZDbdtf5XI0YBdi91HftqtQpIlMtCg+zIzATO4+QWGt0oDX/+jdB7Y/vBahxnz13stNYeGYslGBSZNgpB7HBKlTwB70sprZ8XmNGhj/NixqB6Bzae", ldns.LDNS_RDF_TYPE_B64)
+    try:
+        ret = pubkey.dnskey_set_key(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = pubkey.dnskey_set_key(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = pubkey.dnskey_set_key("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".dnskey_set_protocol()"
+    pubkey = ldns.ldns_rr.new_frm_str("example1. 3600 IN DNSKEY 256 3 3 APw7tG8Nf7MYXjt2Y6DmyWUVxVy73bRKvKbKoGXhAXJx2vbcGGxfXsScT0i4FIC2wsJ/8zy/otB5vymm3JHBf2+7cQvRdp12UMLAnzlfrbgZUpvV36D+q6ch7kbmFzaBfwRjOKhnZkRLCcMYPAdX1SrgKVNXaOzAl9KytbzGQs5MKEHU+a0PAwKfIvEsS/+pW6gKgBnL0uy4Gr5cYJ5rk48iwFXOlZ/B30gUS5dD+rNRJuR0ZgEkxtVIPVxxhQPtEI53JhlJ2nEy0CqNW88nYLmX402b ;{id = 34898 (zsk), size = 512b}")
+    rdf = ldns.ldns_rdf.new_frm_str("3", ldns.LDNS_RDF_TYPE_INT8)
+    try:
+        ret = pubkey.dnskey_set_protocol(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = pubkey.dnskey_set_protocol(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = pubkey.dnskey_set_protocol("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".get_class()"
+    rr = ldns.ldns_rr.new_frm_str("test IN A 0.0.0.0", 600)
+    try:
+        ret = rr.get_class()
+        if not isinstance(ret, int):
+            set_error()
+        if ret != ldns.LDNS_RR_CLASS_IN:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".get_class_str()"
+    rr = ldns.ldns_rr.new_frm_str("test CH A 0.0.0.0", 600)
+    try:
+        ret = rr.get_class_str()
+        if not isinstance(ret, str):
+            set_error()
+        if ret != "CH":
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".get_type()"
+    rr = ldns.ldns_rr.new_frm_str("test IN A 0.0.0.0", 600)
+    try:
+        ret = rr.get_type()
+        if not isinstance(ret, int):
+            set_error()
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".get_type_str()"
+    rr = ldns.ldns_rr.new_frm_str("test IN A 0.0.0.0", 600)
+    try:
+        ret = rr.get_type_str()
+        if not isinstance(ret, str):
+            set_error()
+        if ret != "A":
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".is_question()"
+    rr = ldns.ldns_rr.new_frm_str("test IN A 0.0.0.0", 600)
+    try:
+        ret = rr.is_question()
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    rr.set_question(True)
+    try:
+        ret = rr.is_question()
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".label_count()"
+    rr = ldns.ldns_rr.new_frm_str("test.dom. IN A 0.0.0.0", 600)
+    try:
+        ret = rr.label_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 2:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str(". IN A 0.0.0.0", 600)
+    try:
+        ret = rr.label_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error(string)
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".mx_exchange()"
+    rr = ldns.ldns_rr.new_frm_str("nic.cz. IN MX 15 mail4.nic.cz.", 600)
+    try:
+        ret = rr.mx_exchange()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.mx_exchange()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".mx_preference()"
+    rr = ldns.ldns_rr.new_frm_str("nic.cz. IN MX 15 mail4.nic.cz.", 600)
+    try:
+        ret = rr.mx_preference()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.mx_preference()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_fp()"
+    f = open(temp_fname, "w")
+    f.write("test 600 IN A 0.0.0.0")
+    f.close()
+    f = open(temp_fname, "r")
+    rr, ttl, origin, prev = ldns.ldns_rr.new_frm_fp(f,
+        origin=ldns.ldns_dname("nic.cz"))
+    try:
+        # Reading past file end.
+        ret = ldns.ldns_rr.new_frm_fp(f, raiseException=False)
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        # Reading past file end.
+        rr, ttl, origin, prev = ldns.ldns_rr.new_frm_fp(f)
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    f.close()
+    os.remove(temp_fname)
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_fp_l()"
+    f = open(temp_fname, "w")
+    f.write("test 600 IN A 0.0.0.0")
+    f.close()
+    f = open(temp_fname, "r")
+    rr, line, ttl, origin, prev = ldns.ldns_rr.new_frm_fp_l(f,
+        origin=ldns.ldns_dname("nic.cz"))
+    try:
+        # Reading past file end.
+        ret = ldns.ldns_rr.new_frm_fp_l(f, raiseException=False)
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        # Reading past file end.
+        rr, ttl, origin, prev = ldns.ldns_rr.new_frm_fp_l(f)
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    f.close()
+    os.remove(temp_fname)
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_str()"
+    try:
+        rr = ldns.ldns_rr.new_frm_str("test IN A 0.0.0.0", 600,
+            origin=ldns.ldns_dname("nic.cz"))
+        if not isinstance(rr, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str(10)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str("")
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str("", raiseException=False)
+        if rr != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_str_prev()"
+    try:
+        rr, prev = ldns.ldns_rr.new_frm_str_prev("test IN A 0.0.0.0", 600,
+            origin=ldns.ldns_dname("nic.cz"))
+        if not isinstance(rr, ldns.ldns_rr):
+            set_error()
+#        if prev != None:
+#            set_error()
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str_prev(10)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str_prev("")
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_frm_str_prev("", raiseException=False)
+        if rr != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_question_frm_str()"
+    try:
+        rr = ldns.ldns_rr.new_question_frm_str("test IN A", 600,
+            origin=ldns.ldns_dname("nic.cz"))
+        if not isinstance(rr, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_question_frm_str(10)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_question_frm_str("")
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    try:
+        rr = ldns.ldns_rr.new_question_frm_str("", raiseException=False)
+        if rr != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".ns_nsdname()"
+    rr = ldns.ldns_rr.new_frm_str("nic.cz. 1800 IN NS a.ns.nic.cz.")
+    try:
+        ret = rr.ns_nsdname()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.ns_nsdname()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".owner()"
+    rr = ldns.ldns_rr.new_frm_str("nic.cz. 1800 IN NS a.ns.nic.cz.")
+    try:
+        ret = rr.owner()
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".pop_rdf()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.pop_rdf()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret.get_type() != ldns.LDNS_RDF_TYPE_A:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr.pop_rdf()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".print_to_file()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    f = open(temp_fname, "w")
+    try:
+        rr.print_to_file(f)
+    except:
+        set_error()
+    f.close()
+    f = open(temp_fname, "r")
+    if not f.readline():
+        set_error()
+    f.close()
+    os.remove(temp_fname)
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".push_rdf()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    rdf = ldns.ldns_rdf.new_frm_str("1.1.1.1", ldns.LDNS_RDF_TYPE_A)
+    try:
+        ret = rr.push_rdf(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr.push_rdf("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rd_count()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rd_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rdf()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rdf(0)
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr.rdf(1)
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rdfs()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rdfs()
+        if len(list(ret)) != 1:
+            set_error()
+    except:
+        set_error()
+
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_algorithm()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_algorithm()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_algorithm()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_expiration()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_expiration()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_expiration()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_inception()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_inception()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_inception()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_keytag()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_keytag()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_keytag()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_labels()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_labels()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_labels()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_origttl()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_origttl()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_origttl()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_algorithm()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("3", ldns.LDNS_RDF_TYPE_ALG)
+    try:
+        ret = rr.rrsig_set_algorithm(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_algorithm(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_algorithm("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_expiration()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("20130928153754", ldns.LDNS_RDF_TYPE_TIME)
+    try:
+        ret = rr.rrsig_set_expiration(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_expiration(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_expiration("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_inception()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("20120728153754", ldns.LDNS_RDF_TYPE_TIME)
+    try:
+        ret = rr.rrsig_set_inception(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_inception(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_inception("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_keytag()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("19032", ldns.LDNS_RDF_TYPE_INT16)
+    try:
+        ret = rr.rrsig_set_keytag(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_keytag(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_keytag("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_labels()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("1", ldns.LDNS_RDF_TYPE_INT8)
+    try:
+        ret = rr.rrsig_set_labels(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_labels(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_labels("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_origttl()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("1", ldns.LDNS_RDF_TYPE_INT8)
+    try:
+        ret = rr.rrsig_set_origttl(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_origttl(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_origttl("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_sig()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=", ldns.LDNS_RDF_TYPE_B64)
+    try:
+        ret = rr.rrsig_set_sig(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_sig(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_sig("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_signame()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("example.", ldns.LDNS_RDF_TYPE_DNAME)
+    try:
+        ret = rr.rrsig_set_signame(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_signame(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_signame("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_set_typecovered()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    rdf = ldns.ldns_rdf.new_frm_str("SOA", ldns.LDNS_RDF_TYPE_TYPE)
+    try:
+        ret = rr.rrsig_set_typecovered(rdf)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+#    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+#    try:
+#        ret = rr.rrsig_set_typecovered(rdf)
+#        if not isinstance(ret, bool):
+#            set_error()
+#        if ret != False:
+#            set_error()
+#    except:
+#        set_error()
+    try:
+        ret = rr.rrsig_set_typecovered("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_sig()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_sig()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_sig()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_signame()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_signame()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_signame()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrsig_typecovered()"
+    rr = ldns.ldns_rr.new_frm_str("example. 600 IN RRSIG SOA 3 1 600 20130828153754 20120828153754 19031 example. AIoCFhwZJxIgYOBEyo3cxxWFZEsUPqkxnt38xEl1cFAHHC9iQN9mlEg=")
+    try:
+        ret = rr.rrsig_typecovered()
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.rrsig_typecovered()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_class()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        rr.set_class(ldns.LDNS_RR_CLASS_CH)
+    except:
+        set_error()
+    try:
+        rr.set_class("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_owner()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    rdf = ldns.ldns_dname("test2")
+    try:
+        rr.set_owner(rdf)
+    except:
+        set_error()
+    try:
+        rr.set_owner("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_question()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        rr.set_question(True)
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_rd_count()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        rr.set_rd_count(1)
+    except:
+        set_error()
+    try:
+        rr.set_rd_count("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_rdf()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    rdf = ldns.ldns_rdf.new_frm_str("1.1.1.1", ldns.LDNS_RDF_TYPE_A)
+    rr.push_rdf(rdf)
+    try:
+        ret = rr.set_rdf(rdf, 0)
+        if not isinstance(ret, ldns.ldns_rdf):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rr.set_rdf(rdf, 2)
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        rr.set_rdf("", 1)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_ttl()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        rr.set_ttl(1)
+    except:
+        set_error()
+    try:
+        rr.set_ttl("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_type()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        rr.set_type(ldns.LDNS_RR_TYPE_A)
+    except:
+        set_error()
+    try:
+        rr.set_type("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".to_canonical()"
+    rr = ldns.ldns_rr.new_frm_str("TEST 600 IN A 0.0.0.0")
+    try:
+        rr.to_canonical()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".ttl()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.ttl()
+        if not isinstance(ret, int):
+            set_error()
+        if ret != 600:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".type_by_name()"
+    try:
+        ret = ldns.ldns_rr.type_by_name("A")
+        if not isinstance(ret, int):
+            set_error()
+        if ret != ldns.LDNS_RR_TYPE_A:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = ldns.ldns_rr.type_by_name("AA")
+        if not isinstance(ret, int):
+            set_error()
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = ldns.ldns_rr.type_by_name(1)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".uncompressed_size()"
+    rr = ldns.ldns_rr.new_frm_str("test 600 IN A 0.0.0.0")
+    try:
+        ret = rr.uncompressed_size()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 20:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_data_to_buffer()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_rrsig_to_buffer()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_to_buffer()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_to_buffer_canonical()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+###############################################################################
+###############################################################################
+
+
+class_name = "ldns_rr_descriptor"
+method_name = None
+error_detected = False
+temp_fname = "tmp_rr_descriptor.txt"
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".field_type()"
+    desc_a = ldns.ldns_rr_descriptor.ldns_rr_descriptor(ldns.LDNS_RR_TYPE_A)
+    try:
+        ret = desc_a.field_type(0)
+        if not isinstance(ret, int):
+            set_error()
+        if ret != ldns.LDNS_RDF_TYPE_A:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = desc_a.field_type("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".ldns_rr_descriptor()"
+    try:
+        ret = ldns.ldns_rr_descriptor.ldns_rr_descriptor(ldns.LDNS_RR_TYPE_A)
+        if not isinstance(ret, ldns.ldns_rr_descriptor):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".maximum()"
+    desc_a = ldns.ldns_rr_descriptor.ldns_rr_descriptor(ldns.LDNS_RR_TYPE_A)
+    try:
+        ret = desc_a.maximum()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".minimum()"
+    desc_a = ldns.ldns_rr_descriptor.ldns_rr_descriptor(ldns.LDNS_RR_TYPE_A)
+    try:
+        ret = desc_a.minimum()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+
+
+###############################################################################
+###############################################################################
+
+
+class_name = "ldns_rr_list"
+method_name = None
+error_detected = False
+temp_fname = "tmp_rr_list.txt"
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".[comparison operators]"
+    rrl1 = ldns.ldns_rr_list.new()
+    rrl1.push_rr(ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0"))
+    rrl2 = ldns.ldns_rr_list.new()
+    rrl2.push_rr(ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1"))
+    try:
+        ret = rrl1 < rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2 < rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 <= rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2 <= rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 == rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 == rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 != rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 != rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 > rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2 > rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl1 >= rrl2
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2 >= rrl1
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".cat()"
+    rrl1 = ldns.ldns_rr_list.new()
+    rrl2 = ldns.ldns_rr_list.new()
+    rrl1.push_rr(ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0"))
+    rrl2.push_rr(ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1"))
+    try:
+        ret = rrl1.cat(rrl2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2.cat("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".cat_clone()"
+    rrl1 = ldns.ldns_rr_list.new()
+    rrl2 = ldns.ldns_rr_list.new()
+    rrl1.push_rr(ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0"))
+    rrl2.push_rr(ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1"))
+    try:
+        ret = rrl1.cat_clone(rrl2)
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl2.cat_clone("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".clone()"
+    rrl = ldns.ldns_rr_list.new()
+    rrl.push_rr(ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0"))
+    try:
+        ret = rrl.clone()
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".contains_rr()"
+    rrl = ldns.ldns_rr_list.new()
+    rr1 = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rr2 = ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1")
+    rrl.push_rr(rr1)
+    try:
+        ret = rrl.contains_rr(rr1)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.contains_rr(rr2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != False:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.contains_rr("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".is_rrset()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.is_rrset()
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new()"
+    try:
+        ret = ldns.ldns_rr_list.new()
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".new_frm_file()"
+    try:
+        ret = ldns.ldns_rr_list.new_frm_file()
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = ldns.ldns_rr_list.new_frm_file("test")
+        set_error()
+    except Exception:
+        pass
+    except:
+        set_error()
+    try:
+        ret = ldns.ldns_rr_list.new_frm_file("test", raiseException=False)
+        if isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".owner()"
+    rrl = ldns.ldns_rr_list.new()
+    try:
+        ret = rrl.owner()
+        if isinstance(ret, ldns.ldns_rdf):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.owner()
+        if not isinstance(ret, ldns.ldns_dname):
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".pop_rr()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.pop_rr()
+        if not isinstance(ret, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.pop_rr()
+        if isinstance(ret, ldns.ldns_rr):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".pop_rr_list()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.pop_rr_list(2)
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.pop_rr_list(2)
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.pop_rr_list(2)
+        if isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.pop_rr_list("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".pop_rrset()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.pop_rrset()
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.pop_rrset()
+        if isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".print_to_file()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    f = open(temp_fname, "w")
+    try:
+        rrl.print_to_file(f)
+    except:
+        set_error()
+    f.close()
+    f = open(temp_fname, "r")
+    if len(f.readlines()) != 3:
+        set_error()
+    f.close()
+    os.remove(temp_fname)
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".push_rr()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    try:
+        ret = rrl.push_rr(rr)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.push_rr("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".push_rr_list()"
+    rrl1 = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl1.push_rr(rr)
+    rrl2 = rrl1.new()
+    try:
+        ret = rrl1.push_rr_list(rrl2)
+        if not isinstance(ret, bool):
+            set_error()
+        if ret != True:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.push_rr_list("")
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rr()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.rr(0)
+        if not isinstance(ret, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.rr(1)
+        if isinstance(ret, ldns.ldns_rr):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rr_count()"
+    rrl = ldns.ldns_rr_list.new()
+    try:
+        ret = rrl.rr_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.rr_count()
+        if (not isinstance(ret, int)) and (not isinstance(ret, long)):
+            set_error()
+        if ret != 1:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".rrs()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rrl.push_rr(rr)
+    try:
+        ret = list(rrl.rrs())
+        if not isinstance(ret, list):
+            set_error()
+        if len(ret) != 2:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_rr()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rr = ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1")
+    ret = rrl.set_rr(rr, 0)
+    try:
+        ret = rrl.set_rr(rr, 0)
+        if not isinstance(ret, ldns.ldns_rr):
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.set_rr(rr, 1)
+        if isinstance(ret, ldns.ldns_rr):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.set_rr("", 1)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".set_rr_count()"
+    rrl = ldns.ldns_rr_list.new()
+    try:
+        rrl.set_rr_count(0)
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        rrl.set_rr_count("")
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".sort()"
+    rrl = ldns.ldns_rr_list.new()
+    try:
+        rrl.sort()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".subtype_by_rdf()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("test1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rr = ldns.ldns_rr.new_frm_str("test2 600 IN A 1.1.1.1")
+    rrl.push_rr(rr)
+    rr = ldns.ldns_rr.new_frm_str("test3 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    rdf = ldns.ldns_rdf.new_frm_str("0.0.0.0", ldns.LDNS_RDF_TYPE_A)
+    try:
+        ret = rrl.subtype_by_rdf(rdf, 0)
+        if not isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+        if ret.rr_count() != 2:
+            set_error()
+    except:
+        set_error()
+    rdf = ldns.ldns_rdf.new_frm_str("::", ldns.LDNS_RDF_TYPE_AAAA)
+    try:
+        ret = rrl.subtype_by_rdf(rdf, 0)
+        if isinstance(ret, ldns.ldns_rr_list):
+            set_error()
+        if ret != None:
+            set_error()
+    except:
+        set_error()
+    try:
+        ret = rrl.subtype_by_rdf("", 0)
+        set_error()
+    except TypeError:
+        pass
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".to_canonical()"
+    rrl = ldns.ldns_rr_list.new()
+    rr = ldns.ldns_rr.new_frm_str("TEST1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        rrl.to_canonical()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".type()"
+    rrl = ldns.ldns_rr_list.new()
+    try:
+        ret = rrl.type()
+        if not isinstance(ret, int):
+            set_error()
+        if ret != 0:
+            set_error()
+    except:
+        set_error()
+    rr = ldns.ldns_rr.new_frm_str("TEST1 600 IN A 0.0.0.0")
+    rrl.push_rr(rr)
+    try:
+        ret = rrl.type()
+        if not isinstance(ret, int):
+            set_error()
+        if ret != ldns.LDNS_RR_TYPE_A:
+            set_error()
+    except:
+        set_error()
+
+
+#if not error_detected:
+if True:
+    method_name = class_name + ".write_to_buffer()"
+    sys.stderr.write("%s not tested.\n" % (method_name))
+
+
+if not error_detected:
+    sys.stdout.write("%s: passed.\n" % (os.path.basename(__file__)))
+else:
+    sys.stdout.write("%s: errors detected.\n" % (os.path.basename(__file__)))
+    sys.exit(1)
diff --git a/contrib/ldns/contrib/python/ldns.i b/contrib/ldns/contrib/python/ldns.i
new file mode 100644
index 00000000000000..881ba5e858a73f
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns.i
@@ -0,0 +1,467 @@
+/*
+ * ldns.i: LDNS interface file
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+%module ldns
+#pragma SWIG nowarn=454
+%{
+
+#include "ldns.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <inttypes.h>
+
+#include <ldns/util.h>
+#include <ldns/buffer.h>
+#include <ldns/common.h>
+#include <ldns/dname.h>
+#include <ldns/dnssec.h>
+#include <ldns/dnssec_verify.h>
+#include <ldns/dnssec_sign.h>
+#include <ldns/error.h>
+#include <ldns/higher.h>
+#include <ldns/host2str.h>
+#include <ldns/host2wire.h>
+#include <ldns/net.h>
+#include <ldns/packet.h>
+#include <ldns/rdata.h>
+#include <ldns/resolver.h>
+#include <ldns/rr.h>
+#include <ldns/str2host.h>
+#include <ldns/tsig.h>
+#include <ldns/update.h>
+#include <ldns/wire2host.h>
+#include <ldns/rr_functions.h>
+#include <ldns/keys.h>
+#include <ldns/parse.h>
+#include <ldns/zone.h>
+#include <ldns/dnssec_zone.h>
+#include <ldns/rbtree.h>
+%}
+
+//#define LDNS_DEBUG
+//#define SWIG_FILE3_DEBUG
+
+%include "stdint.i" // uint_16_t is known type now
+#ifdef PY3
+%include "file_py3.i" // python 3 FILE *
+#else
+%include "file.i"     // FILE * 
+#endif
+%include "typemaps.i"
+
+
+/* ========================================================================= */
+/* Preliminary Python code. */
+/* ========================================================================= */
+
+%pythoncode
+%{
+	#
+	# Use and don't ignore DeprecationWarning and
+	# PendingDeprecationWarning.
+	#
+	import warnings
+	warnings.filterwarnings("module", category=DeprecationWarning)
+	warnings.filterwarnings("module", category=PendingDeprecationWarning)
+%}
+
+
+/* Tell SWIG how to handle ssize_t as input parameter. */
+%typemap(in, noblock=1) (ssize_t)
+{
+  int $1_res = 0;
+  $1_res = SWIG_AsVal_long($input, &$1);
+  if (!SWIG_IsOK($1_res)) {
+    SWIG_exception_fail(SWIG_ArgError($1_res), "in method '"
+      "$symname" "', argument " "$argnum" " of type '"
+      "$type""'");
+  }
+}
+
+
+%inline %{
+struct timeval* ldns_make_timeval(uint32_t sec, uint32_t usec)
+{
+        struct timeval* res = (struct timeval*)malloc(sizeof(*res));
+        res->tv_sec = sec;
+        res->tv_usec = usec;
+        return res;
+}
+uint32_t ldns_read_timeval_sec(struct timeval* t) { 
+        return (uint32_t)t->tv_sec; }
+uint32_t ldns_read_timeval_usec(struct timeval* t) { 
+        return (uint32_t)t->tv_usec; }
+%}
+
+%immutable ldns_struct_lookup_table::name;
+%immutable ldns_struct_rr_descriptor::_name;
+%immutable ldns_error_str;
+%immutable ldns_signing_algorithms;
+%immutable ldns_tsig_credentials_struct::algorithm;
+%immutable ldns_tsig_credentials_struct::keyname;
+%immutable ldns_tsig_credentials_struct::keydata;
+
+//*_new_frm_fp_l
+%apply int *OUTPUT { (int *line_nr) };
+
+%apply uint32_t *OUTPUT { uint32_t *default_ttl};
+
+// wire2pkt
+%apply (char *STRING, int LENGTH) { (const char *str, int len) };
+
+%include "ldns_packet.i"
+%include "ldns_resolver.i"
+%include "ldns_rr.i"
+
+%include <ldns/rr.h>
+
+%inline %{
+int Python_str_Check(PyObject *o) {
+#if PY_VERSION_HEX>=0x03000000
+  return PyUnicode_Check(o);
+#else
+  return PyString_Check(o);
+#endif
+}
+%}
+
+%include "ldns_rdf.i"
+%include "ldns_zone.i"
+%include "ldns_key.i"
+%include "ldns_buffer.i"
+%include "ldns_dnssec.i"
+
+%include <ldns/util.h>
+  %include <ldns/buffer.h>
+%include <ldns/dnssec.h>
+%include <ldns/dnssec_verify.h>
+  %include <ldns/dnssec_sign.h>
+%include <ldns/error.h>
+%include <ldns/higher.h>
+  %include <ldns/host2str.h>
+  %include <ldns/host2wire.h>
+%include <ldns/net.h>
+  %include <ldns/packet.h>
+  %include <ldns/rdata.h>
+  %include <ldns/resolver.h>
+%include <ldns/str2host.h>
+%include <ldns/tsig.h>
+  %include <ldns/update.h>
+%include <ldns/wire2host.h>
+  %include <ldns/rr_functions.h>
+  %include <ldns/keys.h>
+%include <ldns/parse.h>
+  %include <ldns/zone.h>
+  %include <ldns/dnssec_zone.h>
+%include <ldns/rbtree.h>
+  %include <ldns/dname.h>
+
+typedef struct ldns_dnssec_name { };
+typedef struct ldns_dnssec_rrs { };
+typedef struct ldns_dnssec_rrsets { };
+typedef struct ldns_dnssec_zone { };
+// ================================================================================
+
+%include "ldns_dname.i"
+
+%inline %{
+ PyObject* ldns_rr_new_frm_str_(const char *str, uint32_t default_ttl, ldns_rdf* origin, ldns_rdf* prev) 
+ //returns tuple (status, ldns_rr, prev)
+ {
+   PyObject* tuple;
+
+   /*  origin and prev have to be cloned in order to decouple the data
+    *  from the python wrapper
+    */
+   if (origin != NULL)
+       origin = ldns_rdf_clone(origin);
+   if (prev != NULL)
+       prev = ldns_rdf_clone(prev);
+
+   ldns_rdf *p_prev = prev;
+   ldns_rdf **pp_prev = &p_prev;
+   if (p_prev == 0) pp_prev = 0;
+
+   ldns_rr *p_rr = 0;
+   ldns_rr **pp_rr = &p_rr;
+
+   ldns_status st = ldns_rr_new_frm_str(pp_rr, str, default_ttl, origin, pp_prev);
+
+   tuple = PyTuple_New(3);
+   PyTuple_SetItem(tuple, 0, SWIG_From_int(st)); 
+   PyTuple_SetItem(tuple, 1, (st == LDNS_STATUS_OK) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_rr), SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN |  0 ) : 
+		   (Py_INCREF(Py_None), Py_None));
+   PyTuple_SetItem(tuple, 2, (p_prev != prev) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_prev), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ) :
+		   (Py_INCREF(Py_None), Py_None));
+   return tuple;
+ }
+
+ PyObject* ldns_rr_new_frm_fp_(FILE *fp, uint32_t default_ttl,  ldns_rdf* origin,  ldns_rdf* prev) 
+ //returns tuple (status, ldns_rr, ttl, origin, prev)
+ {
+   uint32_t defttl = default_ttl;
+   uint32_t *p_defttl = &defttl;
+   if (defttl == 0) p_defttl = 0;
+
+   /*  origin and prev have to be cloned in order to decouple the data
+    *  from the python wrapper
+    */
+   if (origin != NULL)
+       origin = ldns_rdf_clone(origin);
+   if (prev != NULL)
+       prev = ldns_rdf_clone(prev);
+
+   ldns_rdf *p_origin = origin;
+   ldns_rdf **pp_origin = &p_origin;
+   //if (p_origin == 0) pp_origin = 0;
+
+   ldns_rdf *p_prev = prev;
+   ldns_rdf **pp_prev = &p_prev;
+   //if (p_prev == 0) pp_prev = 0;
+
+   ldns_rr *p_rr = 0;
+   ldns_rr **pp_rr = &p_rr;
+
+   ldns_status st = ldns_rr_new_frm_fp(pp_rr, fp, p_defttl, pp_origin, pp_prev);
+
+   PyObject* tuple;
+   tuple = PyTuple_New(5);
+   int idx = 0;
+   PyTuple_SetItem(tuple, idx, SWIG_From_int(st)); 
+   idx++;
+   PyTuple_SetItem(tuple, idx, (st == LDNS_STATUS_OK) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_rr), SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN |  0 ) : 
+		   (Py_INCREF(Py_None), Py_None));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_From_int(defttl));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_NewPointerObj(SWIG_as_voidptr(p_origin), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_NewPointerObj(SWIG_as_voidptr(p_prev), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ));
+   return tuple;
+ }
+
+ PyObject* ldns_rr_new_frm_fp_l_(FILE *fp, uint32_t default_ttl,  ldns_rdf* origin,  ldns_rdf* prev) 
+ //returns tuple (status, ldns_rr, line, ttl, origin, prev)
+ {
+   int linenr = 0;
+   int *p_linenr = &linenr;
+
+   uint32_t defttl = default_ttl;
+   uint32_t *p_defttl = &defttl;
+   if (defttl == 0) p_defttl = 0;
+
+   /*  origin and prev have to be cloned in order to decouple the data
+    *  from the python wrapper
+    */
+   if (origin != NULL)
+       origin = ldns_rdf_clone(origin);
+   if (prev != NULL)
+       prev = ldns_rdf_clone(prev);
+
+   ldns_rdf *p_origin = origin;
+   ldns_rdf **pp_origin = &p_origin;
+   //if (p_origin == 0) pp_origin = 0;
+
+   ldns_rdf *p_prev = prev;
+   ldns_rdf **pp_prev = &p_prev;
+   //if (p_prev == 0) pp_prev = 0;
+
+   ldns_rr *p_rr = 0;
+   ldns_rr **pp_rr = &p_rr;
+
+   ldns_status st = ldns_rr_new_frm_fp_l(pp_rr, fp, p_defttl, pp_origin, pp_prev, p_linenr);
+
+   PyObject* tuple;
+   tuple = PyTuple_New(6);
+   int idx = 0;
+   PyTuple_SetItem(tuple, idx, SWIG_From_int(st)); 
+   idx++;
+   PyTuple_SetItem(tuple, idx, (st == LDNS_STATUS_OK) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_rr), SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN |  0 ) : 
+		   (Py_INCREF(Py_None), Py_None));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_From_int(linenr));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_From_int(defttl));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_NewPointerObj(SWIG_as_voidptr(p_origin), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ));
+   idx++;
+   PyTuple_SetItem(tuple, idx, SWIG_NewPointerObj(SWIG_as_voidptr(p_prev), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ));
+   return tuple;
+ }
+
+
+PyObject* ldns_rr_new_question_frm_str_(const char *str, ldns_rdf* origin, ldns_rdf* prev) 
+ //returns tuple (status, ldns_rr, prev)
+ {
+   PyObject* tuple;
+
+   /*  origin and prev have to be cloned in order to decouple the data
+    *  from the python wrapper
+    */
+   if (origin != NULL)
+       origin = ldns_rdf_clone(origin);
+   if (prev != NULL)
+       prev = ldns_rdf_clone(prev);
+
+   ldns_rdf *p_prev = prev;
+   ldns_rdf **pp_prev = &p_prev;
+   if (p_prev == 0) pp_prev = 0;
+
+   ldns_rr *p_rr = 0;
+   ldns_rr **pp_rr = &p_rr;
+
+   ldns_status st = ldns_rr_new_question_frm_str(pp_rr, str, origin, pp_prev);
+
+   tuple = PyTuple_New(3);
+   PyTuple_SetItem(tuple, 0, SWIG_From_int(st)); 
+   PyTuple_SetItem(tuple, 1, (st == LDNS_STATUS_OK) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_rr), SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN |  0 ) : 
+		   (Py_INCREF(Py_None), Py_None));
+   PyTuple_SetItem(tuple, 2, (p_prev != prev) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(p_prev), SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN |  0 ) :
+		   (Py_INCREF(Py_None), Py_None));
+   return tuple;
+ }
+
+
+
+PyObject* ldns_fetch_valid_domain_keys_(const ldns_resolver * res, const ldns_rdf * domain,
+		const ldns_rr_list * keys)
+ //returns tuple (status, result)
+ {
+   PyObject* tuple;
+
+   ldns_rr_list *rrl = 0;
+   ldns_status st = 0;
+   rrl = ldns_fetch_valid_domain_keys(res, domain, keys, &st);
+
+
+   tuple = PyTuple_New(2);
+   PyTuple_SetItem(tuple, 0, SWIG_From_int(st)); 
+   PyTuple_SetItem(tuple, 1, (st == LDNS_STATUS_OK) ? 
+                             SWIG_NewPointerObj(SWIG_as_voidptr(rrl), SWIGTYPE_p_ldns_struct_rr_list, SWIG_POINTER_OWN |  0 ) : 
+		   (Py_INCREF(Py_None), Py_None));
+   return tuple;
+ }
+
+PyObject* ldns_wire2pkt_(const char *str, int len)
+ //returns tuple (status, result)
+ {
+  PyObject *resultobj = 0;
+  ldns_pkt *arg1 = NULL;
+  uint8_t *arg2 = (uint8_t *) str;
+  size_t arg3 = (size_t) len;
+  ldns_status result;
+  PyObject* tuple;
+  
+  result = (ldns_status)ldns_wire2pkt(&arg1,arg2,arg3);
+  tuple = PyTuple_New(2);
+  PyTuple_SetItem(tuple, 0, SWIG_From_int(result));
+  if (result == LDNS_STATUS_OK)
+     PyTuple_SetItem(tuple, 1, SWIG_NewPointerObj(SWIG_as_voidptr(arg1), SWIGTYPE_p_ldns_struct_pkt, SWIG_POINTER_OWN |  0 ));
+  else {
+     Py_INCREF(Py_None);
+     PyTuple_SetItem(tuple, 1, Py_None);
+  }
+  return tuple;
+}
+
+PyObject* ldns_pkt2wire_(const ldns_pkt *pkt)
+ //returns tuple (status, result)
+ {
+  PyObject *resultobj = 0;
+  uint8_t *arg1 = NULL;
+  size_t arg3;
+  ldns_status result;
+  PyObject* tuple;
+
+  result = (ldns_status)ldns_pkt2wire(&arg1,pkt,&arg3);
+  tuple = PyTuple_New(2);
+  PyTuple_SetItem(tuple, 0, SWIG_From_int(result));
+  if (result == LDNS_STATUS_OK)
+     PyTuple_SetItem(tuple, 1, SWIG_FromCharPtrAndSize((char *)arg1, arg3));
+  else {
+     Py_INCREF(Py_None);
+     PyTuple_SetItem(tuple, 1, Py_None);
+  }
+  LDNS_FREE(arg1);
+  return tuple;
+}
+
+%}
+
+%pythoncode %{
+def ldns_fetch_valid_domain_keys(res, domain, keys):
+    return _ldns.ldns_fetch_valid_domain_keys_(res, domain, keys)
+
+def ldns_wire2pkt(data):
+    return _ldns.ldns_wire2pkt_(data)
+
+def ldns_pkt2wire(data):
+    return _ldns.ldns_pkt2wire_(data)
+
+def ldns_rr_iter_frm_fp_l(input_file):
+    """Creates an iterator (generator) that returns individual parsed
+    RRs from an open zone file."""
+    # variables that preserve the parsers state
+    my_ttl = 0;
+    my_origin = None
+    my_prev = None
+    # additional state variables
+    last_pos = 0
+    line_nr = 0
+
+    while True:
+        ret = _ldns.ldns_rr_new_frm_fp_l_(input_file, my_ttl, my_origin, my_prev)
+        s, rr, line_inc, new_ttl, new_origin, new_prev = ret  # unpack the result
+        line_nr += line_inc # increase number of parsed lines
+        my_prev = new_prev  # update ref to previous owner
+
+        if s == _ldns.LDNS_STATUS_SYNTAX_TTL:
+            my_ttl = new_ttl  # update default TTL
+        elif s == _ldns.LDNS_STATUS_SYNTAX_ORIGIN:
+            my_origin = new_origin  # update reference to origin
+        elif s == _ldns.LDNS_STATUS_SYNTAX_EMPTY:
+            if last_pos == input_file.tell():
+                break  # no advance since last read - EOF
+            last_pos = input_file.tell()
+        elif s != _ldns.LDNS_STATUS_OK:
+            raise ValueError("Parse error in line %d" % line_nr)
+        else:
+            # we are sure to have LDNS_STATUS_OK
+            yield rr
+
+%}
diff --git a/contrib/ldns/contrib/python/ldns_buffer.i b/contrib/ldns/contrib/python/ldns_buffer.i
new file mode 100644
index 00000000000000..5c2d583bea4df2
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_buffer.i
@@ -0,0 +1,726 @@
+/******************************************************************************
+ * ldns_buffer.i: LDNS buffer class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/* Creates a temporary instance of (ldns_buffer *). */
+%typemap(in, numinputs=0, noblock=1) (ldns_buffer **)
+{
+  ldns_buffer *$1_buf;
+  $1 = &$1_buf;
+}
+          
+/* Result generation, appends (ldns_buffer *) after the result. */
+%typemap(argout, noblock=1) (ldns_buffer **)
+{
+  $result = SWIG_Python_AppendOutput($result,
+     SWIG_NewPointerObj(SWIG_as_voidptr($1_buf),
+       SWIGTYPE_p_ldns_struct_buffer, SWIG_POINTER_OWN | 0));
+}
+
+/*
+ * Limit the number of arguments to 2 and deal with variable
+ * number of arguments in the Python way.
+ */
+%varargs(2, char *arg = NULL) ldns_buffer_printf;
+
+%nodefaultctor ldns_struct_buffer; /* No default constructor. */
+%nodefaultdtor ldns_struct_buffer; /* No default destructor. */
+
+%newobject ldns_buffer_new;
+%newobject ldns_dname_new_frm_data;
+
+%delobject ldns_buffer_free;
+
+%rename(ldns_buffer) ldns_struct_buffer;
+
+%ignore ldns_struct_buffer::_position;
+%ignore ldns_struct_buffer::_limit;
+%ignore ldns_struct_buffer::_capacity;
+%ignore ldns_struct_buffer::_data;
+%ignore ldns_struct_buffer::_fixed;
+%ignore ldns_struct_buffer::_status;
+
+%ignore ldns_buffer_new_frm_data;
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_buffer_free) ldns_buffer_free;
+%inline
+%{
+  /*!
+   * @brief Frees the buffer and print a message.
+   */
+  void _ldns_buffer_free (ldns_buffer* b)
+  {
+    printf("******** LDNS_BUFFER free 0x%lX ************\n",
+    (long unsigned int) b);
+    ldns_buffer_free(b);
+  }
+%}
+#else /* !LDNS_DEBUG */
+%rename(_ldns_buffer_free) ldns_buffer_free;
+#endif /* LDNS_DEBUG */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+/* None. */
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+%feature("docstring") "LDNS buffer."
+
+%extend ldns_struct_buffer {
+ 
+  %pythoncode
+  %{
+        def __init__(self, capacity):
+            """
+               Creates a new buffer with the specified capacity.
+
+               :param capacity: Number of bytes to allocate for the buffer.
+               :type capacity: integer
+               :throws TypeError: When `capacity` of non-integer type.
+               :return: (:class:`ldns_buffer`)
+            """
+            self.this = _ldns.ldns_buffer_new(capacity)
+       
+        __swig_destroy__ = _ldns._ldns_buffer_free
+
+        def __str__(self):
+            """
+               Returns the data in the buffer as a string.
+               Buffer data must be char * type.
+
+               :return: string
+            """
+            return _ldns.ldns_buffer2str(self)
+
+        def getc(self):
+            """
+               Returns the next character from a buffer.
+               
+               Advances the position pointer with 1. When end of buffer
+               is reached returns EOF. This is the buffer's equivalent
+               for getc().
+               
+               :return: (integer) EOF on failure otherwise return
+                   the character.
+            """
+            return _ldns.ldns_bgetc(self)
+
+        #
+        # LDNS_BUFFER_METHODS_
+        #
+
+        def at(self, at):
+            """
+               Returns a pointer to the data at the indicated position.
+               
+               :param at: position
+               :type at: positive integer
+               :throws TypeError: When `at` of non-integer type.
+               :return: (uint8_t \*) The pointer to the data.
+            """
+            return _ldns.ldns_buffer_at(self, at)
+            #parameters: const ldns_buffer *, size_t,
+            #retvals: uint8_t *
+
+        def available(self, count):
+            """
+               Checks whether the buffer has count bytes available at
+               the current position.
+               
+               :param count: How much is available.
+               :type count: integer
+               :throws TypeError: When `count` of non-integer type.
+               :return: (bool) True or False.
+            """
+            return _ldns.ldns_buffer_available(self, count) != 0
+            #parameters: ldns_buffer *, size_t,
+            #retvals: int
+
+        def available_at(self, at, count):
+            """
+               Checks if the buffer has at least `count` more bytes available.
+               
+               Before reading or writing the caller needs to ensure that
+               enough space is available!
+               
+               :param at: Indicated position.
+               :type at: positive integer
+               :param count: How much is available.
+               :type count: positive integer
+               :throws TypeError: When `at` or `count` of non-integer type.
+               :return: (bool) True or False.
+            """
+            return _ldns.ldns_buffer_available_at(self, at, count) != 0
+            #parameters: ldns_buffer *,size_t,size_t,
+            #retvals: int
+
+        def begin(self):
+            """
+               Returns a pointer to the beginning of the buffer
+               (the data at position 0).
+               
+               :return: (uint8_t \*) Pointer.
+            """
+            return _ldns.ldns_buffer_begin(self)
+            #parameters: const ldns_buffer *,
+            #retvals: uint8_t *
+
+        def capacity(self):
+            """
+               Returns the number of bytes the buffer can hold.
+               
+               :return: (size_t) The number of bytes.
+            """
+            return _ldns.ldns_buffer_capacity(self)
+            #parameters: ldns_buffer *,
+            #retvals: size_t
+
+        def clear(self):
+            """
+               Clears the buffer and make it ready for writing.
+               
+               The buffer's limit is set to the capacity and the position
+               is set to 0.
+            """
+            _ldns.ldns_buffer_clear(self)
+            #parameters: ldns_buffer *,
+            #retvals: 
+
+        def copy(self, bfrom):
+            """
+               Copy contents of the other buffer to this buffer.
+               
+               Silently truncated if this buffer is too small.
+               
+               :param bfrom: Source buffer.
+               :type bfrom: :class:`ldns_buffer`
+               :throws TypeError: When `bfrom` of non-:class:`ldns_buffer`
+                   type.
+            """
+            _ldns.ldns_buffer_copy(self, bfrom)
+            #parameters: ldns_buffer *, ldns_buffer *,
+            #retvals: 
+
+        def current(self):
+            """
+               Returns a pointer to the data at the buffer's current position.
+               
+               :return: (uint8_t \*) A pointer.
+            """
+            return _ldns.ldns_buffer_current(self)
+            #parameters: ldns_buffer *,
+            #retvals: uint8_t *
+
+        def end(self):
+            """
+               Returns a pointer to the end of the buffer (the data
+               at the buffer's limit).
+               
+               :return: (uint8_t \*) Pointer.
+            """
+            return _ldns.ldns_buffer_end(self)
+            #parameters: ldns_buffer *,
+            #retvals: uint8_t *
+
+        def export(self):
+            """
+               Makes the buffer fixed and returns a pointer to the data.
+               
+               The caller is responsible for freeing the result.
+               
+               :return: (void \*) Void pointer.
+            """
+            return _ldns.ldns_buffer_export(self)
+            #parameters: ldns_buffer *,
+            #retvals: void *
+
+        def flip(self):
+            """
+               Makes the buffer ready for reading the data that has been
+               written to the buffer.
+               
+               The buffer's limit is set to the current position and
+               the position is set to 0.
+            """
+            _ldns.ldns_buffer_flip(self)
+            #parameters: ldns_buffer *,
+
+        def invariant(self):
+            """
+               Performs no action.
+
+               In debugging mode this method performs a buffer settings
+               check. It asserts if something is wrong.
+            """
+            _ldns.ldns_buffer_invariant(self)
+            #parameters: ldns_buffer *,
+
+        def limit(self):
+            """
+               Returns the maximum size of the buffer.
+               
+               :return: (size_t) The size.
+            """
+            return _ldns.ldns_buffer_limit(self)
+            #parameters: ldns_buffer *,
+            #retvals: size_t
+
+        def position(self):
+            """
+               Returns the current position in the buffer
+               (as a number of bytes).
+               
+               :return: (size_t) The current position.
+            """
+            return _ldns.ldns_buffer_position(self)
+            #parameters: ldns_buffer *,
+            #retvals: size_t
+
+        def printf(self, string, *args):
+            """
+               Prints to the buffer, increasing the capacity
+               if required using buffer_reserve().
+               
+               The buffer's position is set to the terminating '\0'.
+               Returns the number of characters written (not including
+               the terminating '\0') or -1 on failure.
+
+               :param string: A string to be written.
+               :type string: string
+               :throws: TypeError when `string` not a string.
+               :return: (int) Number of written characters or -1 on failure.
+            """
+            data = string % args
+            return _ldns.ldns_buffer_printf(self, data)
+            #parameters: ldns_buffer *, const char *, ...
+            #retvals: int
+
+        def read(self, data, count):
+            """
+               Copies count bytes of data at the current position to the given
+               `data`-array
+               
+               :param data: Target buffer to copy to.
+               :type data: void \*
+               :param count: The length of the data to copy.
+               :type count: size_t
+            """
+            _ldns.ldns_buffer_read(self,data,count)
+            #parameters: ldns_buffer *, void *, size_t,
+            #retvals: 
+
+        def read_at(self, at, data, count):
+            """
+               Copies count bytes of data at the given position to the
+               given `data`-array.
+               
+               :param at: The position in the buffer to start reading.
+               :type at: size_t
+               :param data: Target buffer to copy to.
+               :type data: void \*
+               :param count: The length of the data to copy.
+               :type count: size_t
+            """
+            _ldns.ldns_buffer_read_at(self,at,data,count)
+            #parameters: ldns_buffer *, size_t, void *, size_t,
+            #retvals: 
+
+        def read_u16(self):
+            """
+               Returns the 2-byte integer value at the current position
+               from the buffer.
+               
+               :return: (uint16_t) Word.
+            """
+            return _ldns.ldns_buffer_read_u16(self)
+            #parameters: ldns_buffer *,
+            #retvals: uint16_t
+
+        def read_u16_at(self, at):
+            """
+               Returns the 2-byte integer value at the given position
+               from the buffer.
+               
+               :param at: Position in the buffer.
+               :type at: positive integer
+               :throws TypeError: When `at` of non-integer type.
+               :return: (uint16_t) Word.
+            """
+            return _ldns.ldns_buffer_read_u16_at(self, at)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: uint16_t
+
+        def read_u32(self):
+            """
+               Returns the 4-byte integer value at the current position
+               from the buffer.
+               
+               :return: (uint32_t) Double-word.
+            """
+            return _ldns.ldns_buffer_read_u32(self)
+            #parameters: ldns_buffer *,
+            #retvals: uint32_t
+
+        def read_u32_at(self, at):
+            """
+               Returns the 4-byte integer value at the given position
+               from the buffer.
+               
+               :param at: Position in the buffer.
+               :type at: positive integer
+               :throws TypeError: When `at` of non-integer type.
+               :return: (uint32_t) Double-word.
+            """
+            return _ldns.ldns_buffer_read_u32_at(self, at)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: uint32_t
+
+        def read_u8(self):
+            """
+               Returns the byte value at the current position from the buffer.
+               
+               :return: (uint8_t) A byte (not a character).
+            """
+            return _ldns.ldns_buffer_read_u8(self)
+            #parameters: ldns_buffer *,
+            #retvals: uint8_t
+
+        def read_u8_at(self, at):
+            """
+               Returns the byte value at the given position from the buffer.
+               
+               :param at: The position in the buffer.
+               :type at: positive integer
+               :throws TypeError: When `at` of non-integer type.
+               :return: (uint8_t) Byte value.
+            """
+            return _ldns.ldns_buffer_read_u8_at(self, at)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: uint8_t
+
+        def remaining(self):
+            """
+               Returns the number of bytes remaining between the buffer's
+               position and limit.
+               
+               :return: (size_t) The number of bytes.
+            """
+            return _ldns.ldns_buffer_remaining(self)
+            #parameters: ldns_buffer *,
+            #retvals: size_t
+
+        def remaining_at(self, at):
+            """
+               Returns the number of bytes remaining between the indicated
+               position and the limit.
+               
+               :param at: Indicated position.
+               :type at: positive integer
+               :throws TypeError: When `at` of non-integer type.
+               :return: (size_t) number of bytes
+            """
+            return _ldns.ldns_buffer_remaining_at(self, at)
+            #parameters: ldns_buffer *,size_t,
+            #retvals: size_t
+
+        def reserve(self, amount):
+            """
+               Ensures that the buffer can contain at least `amount` more
+               bytes.
+               
+               The buffer's capacity is increased if necessary using
+               buffer_set_capacity().
+               
+               The buffer's limit is always set to the (possibly increased)
+               capacity.
+               
+               :param amount: Amount to use.
+               :type amount: positive integer
+               :throws TypeError: When `amount` of non-integer type.
+               :return: (bool) Whether this failed or succeeded.
+            """
+            return _ldns.ldns_buffer_reserve(self, amount)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: bool
+
+        def rewind(self):
+            """
+               Make the buffer ready for re-reading the data.
+               
+               The buffer's position is reset to 0.
+            """
+            _ldns.ldns_buffer_rewind(self)
+            #parameters: ldns_buffer *,
+            #retvals: 
+
+        def set_capacity(self, capacity):
+            """
+               Changes the buffer's capacity.
+               
+               The data is reallocated so any pointers to the data may become
+               invalid. The buffer's limit is set to the buffer's new capacity.
+               
+               :param capacity: The capacity to use.
+               :type capacity: positive integer
+               :throws TypeError: When `capacity` of non-integer type.
+               :return: (bool) whether this failed or succeeded
+            """
+            return _ldns.ldns_buffer_set_capacity(self, capacity)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: bool
+
+        def set_limit(self, limit):
+            """
+               Changes the buffer's limit.
+               
+               If the buffer's position is greater than the new limit
+               then the position is set to the limit.
+               
+               :param limit: The new limit.
+               :type limit: positive integer
+               :throws TypeError: When `limit` of non-integer type.
+            """
+            _ldns.ldns_buffer_set_limit(self, limit)
+            #parameters: ldns_buffer *, size_t,
+            #retvals: 
+
+        def set_position(self,mark):
+            """
+               Sets the buffer's position to `mark`.
+               
+               The position must be less than or equal to the buffer's limit.
+               
+               :param mark: The mark to use.
+               :type mark: positive integer
+               :throws TypeError: When `mark` of non-integer type.
+            """
+            _ldns.ldns_buffer_set_position(self,mark)
+            #parameters: ldns_buffer *,size_t,
+            #retvals: 
+
+        def skip(self, count):
+            """
+               Changes the buffer's position by `count` bytes.
+               
+               The position must not be moved behind the buffer's limit or
+               before the beginning of the buffer.
+               
+               :param count: The count to use.
+               :type count: integer
+               :throws TypeError: When `count` of non-integer type.
+            """
+            _ldns.ldns_buffer_skip(self, count)
+            #parameters: ldns_buffer *, ssize_t,
+            #retvals: 
+
+        def status(self):
+            """
+               Returns the status of the buffer.
+               
+               :return: (ldns_status) The status.
+            """
+            return _ldns.ldns_buffer_status(self)
+            #parameters: ldns_buffer *,
+            #retvals: ldns_status
+
+        def status_ok(self):
+            """
+               Returns True if the status of the buffer is LDNS_STATUS_OK,
+               False otherwise.
+               
+               :return: (bool) True or False.
+            """
+            return _ldns.ldns_buffer_status_ok(self)
+            #parameters: ldns_buffer *,
+            #retvals: bool
+
+        def write(self, data, count):
+            """
+               Writes count bytes of data to the current position of
+               the buffer.
+               
+               :param data: The data to write.
+               :type data: void \*
+               :param count: The length of the data to write.
+               :type count: size_t
+            """
+            _ldns.ldns_buffer_write(self, data, count)
+            #parameters: ldns_buffer *, const void *, size_t,
+            #retvals: 
+
+        def write_at(self, at, data, count):
+            """
+               Writes the given data to the buffer at the specified position
+               by `at`.
+               
+               :param at: The position (in number of bytes) to write the
+                   data at.
+               :param data: Pointer to the data to write to the buffer.
+               :param count: The number of bytes of data to write.
+            """
+            _ldns.ldns_buffer_write_at(self, at, data, count)
+            #parameters: ldns_buffer *, size_t, const void *, size_t,
+            #retvals: 
+
+        def write_string(self, string):
+            """
+               Copies the given (null-delimited) string to the current
+               position into the buffer.
+               
+               :param string: The string to write.
+               :type string: string
+               :throws TypeError: When `string` not a string.
+            """
+            _ldns.ldns_buffer_write_string(self,string)
+            #parameters: ldns_buffer *,const char *,
+            #retvals: 
+
+        def write_string_at(self, at, string):
+            """
+               Copies the given (null-delimited) string to the specified
+               position `at` into the buffer.
+               
+               :param at: The position in the buffer.
+               :type at: positive integer
+               :param string: The string to write.
+               :type string: string
+               :throws TypeError: When types mismatch.
+            """
+            _ldns.ldns_buffer_write_string_at(self, at, string)
+            #parameters: ldns_buffer *, size_t, const char *,
+            #retvals: 
+
+        def write_u16(self, data):
+            """Writes the given 2 byte integer at the current
+               position in the buffer.
+               
+               :param data: The word to write.
+               :type data: uint16_t
+               :throws TypeError: When `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u16(self, data)
+            #parameters: ldns_buffer *, uint16_t,
+            #retvals: 
+
+        def write_u16_at(self, at, data):
+            """
+               Writes the given 2 byte integer at the given position
+               in the buffer.
+               
+               :param at: The position in the buffer.
+               :type at: positive integer
+               :param data: The word to write.
+               :type data: uint16_t
+               :throws TypeError: When `at` or `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u16_at(self,at,data)
+            #parameters: ldns_buffer *,size_t,uint16_t,
+            #retvals: 
+
+        def write_u32(self, data):
+            """
+               Writes the given 4 byte integer at the current position
+               in the buffer.
+               
+               :param data: The double-word to write.
+               :type data: uint32_t
+               :throws TypeError: When `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u32(self, data)
+            #parameters: ldns_buffer *, uint32_t,
+            #retvals: 
+
+        def write_u32_at(self, at, data):
+            """
+               Writes the given 4 byte integer at the given position
+               in the buffer.
+               
+               :param at: The position in the buffer.
+               :type at: positive integer
+               :param data: The double-word to write.
+               :type data: uint32_t
+               :throws TypeError: When `at` or `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u32_at(self, at, data)
+            #parameters: ldns_buffer *,size_t,uint32_t,
+            #retvals: 
+
+        def write_u8(self, data):
+            """
+               Writes the given byte of data at the current position
+               in the buffer.
+               
+               :param data: The byte to write.
+               :type data: uint8_t
+               :throws TypeError: When `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u8(self, data)
+            #parameters: ldns_buffer *, uint8_t,
+            #retvals: 
+
+        def write_u8_at(self,at,data):
+            """
+               Writes the given byte of data at the given position
+               in the buffer.
+               
+               :param at: The position in the buffer.
+               :type at: positive integer
+               :param data: The byte to write.
+               :type data: uint8_t
+               :throws TypeError: When `at` or `data` of non-integer type.
+            """
+            _ldns.ldns_buffer_write_u8_at(self,at,data)
+            #parameters: ldns_buffer *,size_t,uint8_t,
+            #retvals: 
+
+        #
+        # _LDNS_BUFFER_METHODS
+        #
+  %}
+}
diff --git a/contrib/ldns/contrib/python/ldns_dname.i b/contrib/ldns/contrib/python/ldns_dname.i
new file mode 100644
index 00000000000000..f63e930c4dc6a9
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_dname.i
@@ -0,0 +1,625 @@
+/******************************************************************************
+ * ldns_dname.i: LDNS domain name class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/*
+ * Not here (with the exception of functions defined in this C code section),
+ * must be set in ldns_rdf.i.
+ */
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+/*
+ * Not here (with the exception of functions defined in this C code section),
+ * must be set in ldns_rdf.i.
+ */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+/* None */
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+%pythoncode
+%{
+    class ldns_dname(ldns_rdf):
+        """
+           Domain name.
+
+           This class contains methods to read and manipulate domain name drfs.
+           Domain names are stored in :class:`ldns_rdf` structures,
+           with the type LDNS_RDF_TYPE_DNAME. This class encapsulates such
+           rdfs.
+
+           **Usage** 
+
+               >>> import ldns
+               >>> dn1 = ldns.ldns_dname("test.nic.cz")
+               >>> print dn1
+               test.nic.cz.
+               >>> dn2 = ldns.ldns_dname("nic.cz")
+               >>> if dn2.is_subdomain(dn1): print dn2, "is sub-domain of", dn1
+               >>> if dn1.is_subdomain(dn2): print dn1, "is sub-domain of", dn2
+               test.nic.cz. is sub-domain of nic.cz.
+
+           The following two examples show the creation of :class:`ldns_dname`
+           from :class:`ldns_rdf`. The first shows the creation of
+           :class:`ldns_dname` instance which is independent of the original
+           `rdf`.
+           
+
+               >>> import ldns
+               >>> rdf = ldns.ldns_rdf.new_frm_str("a.ns.nic.cz", ldns.LDNS_RDF_TYPE_DNAME)
+               >>> dn = ldns.ldns_dname(rdf)
+               >>> print dn
+               a.ns.nic.cz.
+
+           The latter shows the wrapping of a :class:`ldns_rdf` onto
+           a :class:`ldns_dname` without the creation of a copy.
+
+               >>> import ldns
+               >>> dn = ldns.ldns_dname(ldns.ldns_rdf.new_frm_str("a.ns.nic.cz", ldns.LDNS_RDF_TYPE_DNAME), clone=False)
+               >>> print dn
+               a.ns.nic.cz.
+        """
+        def __init__(self, initialiser, clone=True):
+            """
+               Creates a new dname rdf from a string or :class:`ldns_rdf`.
+            
+               :param initialiser: string or :class:`ldns_rdf`
+               :type initialiser: string or :class:`ldns_rdf` containing
+                   a dname
+               :param clone: Whether to clone or directly grab the parameter.
+               :type clone: bool
+               :throws TypeError: When `initialiser` of invalid type.
+            """
+            if isinstance(initialiser, ldns_rdf) and \
+               (initialiser.get_type() == _ldns.LDNS_RDF_TYPE_DNAME):
+                if clone == True:
+                    self.this = _ldns.ldns_rdf_clone(initialiser)
+                else:
+                    self.this = initialiser
+            else:
+                self.this = _ldns.ldns_dname_new_frm_str(initialiser)
+
+        #
+        # LDNS_DNAME_CONSTRUCTORS_
+        #
+       
+        @staticmethod
+        def new_frm_str(string):
+            """
+               Creates a new dname rdf instance from a string.
+            
+               This static method is equivalent to using default
+               :class:`ldns_dname` constructor.
+ 
+               :param string: String to use.
+               :type string: string
+               :throws TypeError: When `string` not a string.
+               :return: (:class:`ldns_dname`) dname rdf.
+            """
+            return ldns_dname(string)
+
+        @staticmethod
+        def new_frm_rdf(rdf, clone=True):
+            """
+               Creates a new dname rdf instance from a dname :class:`ldns_rdf`.
+
+               This static method is equivalent to using the default
+               :class:`ldns_dname` constructor.
+
+               :param rdf: A dname :class:`ldns_rdf`.
+               :type rdf: :class:`ldns_rdf`
+               :throws TypeError: When `rdf` of inappropriate type.
+               :param clone: Whether to create a clone or to wrap present
+                   instance.
+               :type clone: bool
+               :return: (:class:`ldns_dname`) dname rdf.
+            """
+            return ldns_dname(rdf, clone=clone)
+
+        #
+        # _LDNS_DNAME_CONSTRUCTORS
+        #
+
+        def write_to_buffer(self, buffer):
+            """
+               Copies the dname data to the buffer in wire format.
+               
+               :param buffer: Buffer to append the result to.
+               :type param: :class:`ldns_buffer`
+               :throws TypeError: When `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_dname2buffer_wire(buffer, self)
+            #parameters: ldns_buffer *, const ldns_rdf *,
+            #retvals: ldns_status
+
+
+        #
+        # LDNS_DNAME_METHODS_
+        #
+
+        def absolute(self):
+            """
+               Checks whether the given dname string is absolute (i.e.,
+               ends with a '.').
+
+               :return: (bool) True or False
+            """
+            string = self.__str__()
+            return _ldns.ldns_dname_str_absolute(string) != 0
+
+        def make_canonical(self):
+            """
+               Put a dname into canonical format (i.e., convert to lower case).
+            """
+            _ldns.ldns_dname2canonical(self)
+
+        def __cmp__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (int) -1, 0 or 1 if self comes before other,
+                   self is equal or self comes after other respectively.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__cmp__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other)
+
+        def __lt__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is less than 'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__lt__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) == -1
+
+        def __le__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is less than or equal to
+                   'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__le__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) != 1
+
+        def __eq__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is equal to 'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__eq__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) == 0
+
+        def __ne__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is not equal to 'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__ne__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) != 0
+
+        def __gt__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is greater than 'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__gt__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) == 1
+
+        def __ge__(self, other):
+            """
+               Compares two dname rdf according to the algorithm for
+               ordering in RFC4034 Section 6.
+               
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_dname`
+               :throws TypeError: When `other` of invalid type.
+               :return: (bool) True when `self` is greater than or equal to
+                   'other'.
+
+               .. note::
+                   The type checking of parameter `other` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.                   
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(other, ldns_dname)) and \
+               isinstance(other, ldns_rdf) and \
+               other.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.__ge__() method will" +
+                    " drop the possibility to compare ldns_rdf." +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns.ldns_dname_compare(self, other) != -1
+
+        def cat(self, rd2):
+            """
+               Concatenates rd2 after this dname (`rd2` is copied,
+               `this` dname is modified).
+               
+               :param rd2: The right-hand side.
+               :type rd2: :class:`ldns_dname`
+               :throws TypeError: When `rd2` of invalid type.
+               :return: (ldns_status) LDNS_STATUS_OK on success
+
+               .. note::
+                   The type checking of parameter `rd2` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(rd2, ldns_dname)) and \
+               isinstance(rd2, ldns_rdf) and \
+               rd2.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.cat() method will" +
+                    " drop the support of ldns_rdf."  +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_cat(self, rd2)
+            #parameters: ldns_rdf *, ldns_rdf *,
+            #retvals: ldns_status
+
+        def cat_clone(self, rd2):
+            """
+               Concatenates two dnames together.
+               
+               :param rd2: The right-hand side.
+               :type rd2: :class:`ldns_dname`
+               :throws TypeError: When `rd2` of invalid type.
+               :return: (:class:`ldns_dname`) A new rdf with
+                   left-hand side + right-hand side content None when
+                   error.
+
+               .. note::
+                   The type checking of parameter `rd2` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(rd2, ldns_dname)) and \
+               isinstance(rd2, ldns_rdf) and \
+               rd2.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.cat_clone() method will" +
+                    " drop the support of ldns_rdf."  +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            ret = _ldns.ldns_dname_cat_clone(self, rd2)
+            if ret != None:
+                ret = ldns_dname(ret, clone=False)
+            return ret
+            #parameters: const ldns_rdf *, const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def interval(self, middle, next):
+            """
+               Check whether `middle` lays in the interval defined by
+               `this` and `next` (`this` <= `middle` < `next`).
+               
+               This method is useful for nsec checking.
+               
+               :param middle: The dname to check.
+               :type middle: :class:`ldns_dname`
+               :param next: The boundary.
+               :type next: :class:`ldns_dname`
+               :throws TypeError: When `middle` or `next` of
+                   non-:class:`ldns_rdf` type.
+               :throws Exception: When non-dname rdfs compared.
+               :return: (int) 0 on error or unknown,
+                   -1 when middle is in the interval, 1 when not.
+
+               .. note::
+                   The type checking of parameters is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(middle, ldns_rdf)) or \
+               (not isinstance(next, ldns_rdf)):
+                raise TypeError("Parameters must be derived from ldns_dname.")
+            if (self.get_type() != _ldns.LDNS_RDF_TYPE_DNAME) or \
+               (middle.get_type() != _ldns.LDNS_RDF_TYPE_DNAME) or \
+               (next.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("All operands must be dname rdfs.")
+            if (not isinstance(middle, ldns_dname)) or \
+               (not isinstance(next, ldns_dname)):
+                warnings.warn("The ldns_dname.interval() method will" +
+                    " drop the possibility to compare ldns_rdf."  +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_interval(self, middle, next)
+            #parameters: const ldns_rdf *, const ldns_rdf *, const ldns_rdf *,
+            #retvals: int
+
+        def is_subdomain(self, parent):
+            """
+               Tests whether the name of the instance falls under
+               `parent` (i.e., is a sub-domain of `parent`). 
+
+               This function will return false if the given dnames are equal.
+               
+               :param parent: The parent's name.
+               :type parent: :class:`ldns_dname`
+               :throws TypeError: When `parent` of non-:class:`ldns_rdf`
+                   or derived type.
+               :return: (bool) True if `this` falls under `parent`, otherwise
+                   False.
+
+               .. note::
+                   The type checking of parameters is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(parent, ldns_dname)) and \
+               isinstance(parent, ldns_rdf) and \
+               parent.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_dname.is_subdomain() method will" +
+                    " drop the support of ldns_rdf."  +
+                    " Convert arguments to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_is_subdomain(self, parent)
+            #parameters: const ldns_rdf *, const ldns_rdf *,
+            #retvals: bool
+
+        def label(self, labelpos):
+            """
+               Look inside the rdf and retrieve a specific label.
+               
+               The labels are numbered starting from 0 (left most).
+
+               :param labelpos: Index of the label. (Labels are numbered
+                   0, which is the left most.)
+               :type labelpos: integer
+               :throws TypeError: When `labelpos` of non-integer type.
+               :return: (:class:`ldns_dname`) A new rdf with the label
+                   as name or None on error.
+            """
+            ret = _ldns.ldns_dname_label(self, labelpos)
+            if ret != None:
+                ret = ldns_dname(ret, clone=False)
+            return ret
+            #parameters: const ldns_rdf *, uint8_t,
+            #retvals: ldns_rdf *
+
+        def label_count(self):
+            """
+               Counts the number of labels.
+               
+               :return: (uint8_t) the number of labels. Will return 0
+                   if not a dname.
+            """
+            return _ldns.ldns_dname_label_count(self)
+            #parameters: const ldns_rdf *,
+            #retvals: uint8_t
+
+        def left_chop(self):
+            """
+               Chop one label off the left side of a dname.
+               
+               (e.g., wwww.nlnetlabs.nl, becomes nlnetlabs.nl)
+               
+               :return: (:class:`ldns_dname`) The remaining dname or None
+                   when error.
+            """
+            return ldns_dname(_ldns.ldns_dname_left_chop(self), clone=False)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def reverse(self):
+            """
+               Returns a clone of the given dname with the labels reversed.
+               
+               :return: (:class:`ldns_dname`) A clone of the dname with
+                   the labels reversed.
+            """
+            return ldns_dname(_ldns.ldns_dname_reverse(self), clone=False)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        #
+        # _LDNS_DNAME_METHODS
+        #
+%}
diff --git a/contrib/ldns/contrib/python/ldns_dnssec.i b/contrib/ldns/contrib/python/ldns_dnssec.i
new file mode 100644
index 00000000000000..90c4e6b4594e95
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_dnssec.i
@@ -0,0 +1,457 @@
+/******************************************************************************
+ * ldns_dnssec.i: DNSSEC zone, name, rrs
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************/
+%nodefaultctor ldns_dnssec_rrs; //no default constructor & destructor
+%nodefaultdtor ldns_dnssec_rrs;
+
+%newobject ldns_dnssec_rrs_new;
+%delobject ldns_dnssec_rrs_free;
+
+%extend ldns_dnssec_rrs {
+  %pythoncode %{
+
+        def __init__(self):
+            """Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
+               
+               :returns: (ldns_dnssec_rrs) the allocated data
+            """
+            self.this = _ldns.ldns_dnssec_rrs_new()
+            if not self.this:
+                raise Exception("Can't create rrs instance")
+
+        __swig_destroy__ = _ldns.ldns_dnssec_rrs_free
+
+        #LDNS_DNSSEC_RRS_METHODS_#
+        def add_rr(self,rr):
+            """Adds an RR to the list of RRs.
+               
+               The list will remain ordered
+               
+               :param rr:
+                   the RR to add
+               :returns: (ldns_status) LDNS_STATUS_OK on success
+            """
+            return _ldns.ldns_dnssec_rrs_add_rr(self,rr)
+            #parameters: ldns_dnssec_rrs *,ldns_rr *,
+            #retvals: ldns_status
+        #_LDNS_DNSSEC_RRS_METHODS#
+ %}
+}
+
+// ================================================================================
+// DNNSEC RRS
+// ================================================================================
+%nodefaultctor ldns_dnssec_rrsets; //no default constructor & destructor
+%nodefaultdtor ldns_dnssec_rrsets;
+
+%newobject ldns_dnssec_rrsets_new;
+%delobject ldns_dnssec_rrsets_free;
+
+%extend ldns_dnssec_rrsets {
+  %pythoncode %{
+        def __init__(self):
+            """Creates a new list (entry) of RRsets.
+               
+               :returns: (ldns_dnssec_rrsets \*) instance
+            """
+            self.this = _ldns.ldns_dnssec_rrsets_new()
+            if not self.this:
+                raise Exception("Can't create rrsets instance")
+
+        __swig_destroy__ = _ldns.ldns_dnssec_rrsets_free
+
+        def print_to_file(self, file, follow):
+            """Print the given list of rrsets to the given file descriptor.
+
+               :param file: file pointer
+               :param follow: if set to false, only print the first RRset
+            """
+            _ldns.ldns_dnssec_rrsets_print(file,self,follow)
+            #parameters: FILE *,ldns_dnssec_rrsets *,bool,
+            #retvals: 
+
+        #LDNS_DNSSEC_RRSETS_METHODS_#
+        def add_rr(self,rr):
+            """Add an ldns_rr to the corresponding RRset in the given list of RRsets.
+               
+               If it is not present, add it as a new RRset with 1 record.
+               
+               :param rr:
+                   the rr to add to the list of rrsets
+               :returns: (ldns_status) LDNS_STATUS_OK on success
+            """
+            return _ldns.ldns_dnssec_rrsets_add_rr(self,rr)
+            #parameters: ldns_dnssec_rrsets *,ldns_rr *,
+            #retvals: ldns_status
+
+        def set_type(self,atype):
+            """Sets the RR type of the rrset (that is head of the given list).
+               
+               :param atype:
+               :returns: (ldns_status) LDNS_STATUS_OK on success
+            """
+            return _ldns.ldns_dnssec_rrsets_set_type(self,atype)
+            #parameters: ldns_dnssec_rrsets *,ldns_rr_type,
+            #retvals: ldns_status
+
+        def type(self):
+            """Returns the rr type of the rrset (that is head of the given list).
+               
+               :returns: (ldns_rr_type) the rr type
+            """
+            return _ldns.ldns_dnssec_rrsets_type(self)
+            #parameters: ldns_dnssec_rrsets *,
+            #retvals: ldns_rr_type
+        #_LDNS_DNSSEC_RRSETS_METHODS#
+ %}
+}
+
+// ================================================================================
+// DNNSEC NAME
+// ================================================================================
+%nodefaultctor ldns_dnssec_name; //no default constructor & destructor
+%nodefaultdtor ldns_dnssec_name;
+
+%newobject ldns_dnssec_name_new;
+%delobject ldns_dnssec_name_free;
+
+%extend ldns_dnssec_name {
+  %pythoncode %{
+        def __init__(self):
+            """Create a new instance of dnssec name."""
+            self.this = _ldns.ldns_dnssec_name_new()
+            if not self.this:
+               raise Exception("Can't create dnssec name instance")
+
+        __swig_destroy__ = _ldns.ldns_dnssec_name_free
+
+        def print_to_file(self,file):
+            """Prints the RRs in the dnssec name structure to the given file descriptor.
+
+               :param file: file pointer
+            """
+            _ldns.ldns_dnssec_name_print(file, self)
+            #parameters: FILE *,ldns_dnssec_name *,
+
+        @staticmethod
+        def new_frm_rr(raiseException=True):
+            """Create a new instance of dnssec name for the given RR.
+               
+               :returns: (ldns_dnssec_name) instance
+            """
+            name = _ldns.ldns_dnssec_name_new_frm_rr(self)
+            if (not name) and (raiseException): 
+               raise Exception("Can't create dnssec name")
+            return name
+
+        #LDNS_DNSSEC_NAME_METHODS_#
+        def add_rr(self,rr):
+            """Inserts the given rr at the right place in the current dnssec_name No checking is done whether the name matches.
+               
+               :param rr:
+                   The RR to add
+               :returns: (ldns_status) LDNS_STATUS_OK on success, error code otherwise
+            """
+            return _ldns.ldns_dnssec_name_add_rr(self,rr)
+            #parameters: ldns_dnssec_name *,ldns_rr *,
+            #retvals: ldns_status
+
+        def find_rrset(self,atype):
+            """Find the RRset with the given type in within this name structure.
+               
+               :param atype:
+               :returns: (ldns_dnssec_rrsets \*) the RRset, or NULL if not present
+            """
+            return _ldns.ldns_dnssec_name_find_rrset(self,atype)
+            #parameters: ldns_dnssec_name *,ldns_rr_type,
+            #retvals: ldns_dnssec_rrsets *
+
+        def name(self):
+            """Returns the domain name of the given dnssec_name structure.
+               
+               :returns: (ldns_rdf \*) the domain name
+            """
+            return _ldns.ldns_dnssec_name_name(self)
+            #parameters: ldns_dnssec_name *,
+            #retvals: ldns_rdf *
+
+        def set_name(self,dname):
+            """Sets the domain name of the given dnssec_name structure.
+               
+               :param dname:
+                   the domain name to set it to. This data is *not* copied.
+            """
+            _ldns.ldns_dnssec_name_set_name(self,dname)
+            #parameters: ldns_dnssec_name *,ldns_rdf *,
+            #retvals: 
+
+        def set_nsec(self,nsec):
+            """Sets the NSEC(3) RR of the given dnssec_name structure.
+               
+               :param nsec:
+                   the nsec rr to set it to. This data is *not* copied.
+            """
+            _ldns.ldns_dnssec_name_set_nsec(self,nsec)
+            #parameters: ldns_dnssec_name *,ldns_rr *,
+            #retvals: 
+        #_LDNS_DNSSEC_NAME_METHODS#
+ %}
+}
+
+// ================================================================================
+// DNNSEC ZONE
+// ================================================================================
+%nodefaultctor ldns_dnssec_zone; //no default constructor & destructor
+%nodefaultdtor ldns_dnssec_zone;
+
+%newobject ldns_dnssec_zone_new;
+%delobject ldns_dnssec_zone_free;
+
+%inline %{
+ldns_status ldns_dnssec_zone_sign_defcb(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int cbtype)
+{
+ if (cbtype == 0) 
+    return ldns_dnssec_zone_sign(zone, new_rrs, key_list, ldns_dnssec_default_add_to_signatures, NULL);
+ if (cbtype == 1) 
+    return ldns_dnssec_zone_sign(zone, new_rrs, key_list, ldns_dnssec_default_leave_signatures, NULL);
+ if (cbtype == 2) 
+    return ldns_dnssec_zone_sign(zone, new_rrs, key_list, ldns_dnssec_default_delete_signatures, NULL);
+
+ return ldns_dnssec_zone_sign(zone, new_rrs, key_list, ldns_dnssec_default_replace_signatures, NULL);
+}
+
+ldns_status ldns_dnssec_zone_add_rr_(ldns_dnssec_zone *zone, ldns_rr *rr)
+{
+  ldns_rr *new_rr;
+  ldns_status status;
+
+  new_rr = ldns_rr_clone(rr);
+
+  /*
+   * A clone of the RR is created to be stored in the DNSSEC zone.
+   * The Python engine frees a RR object as soon it's reference count
+   * reaches zero. The code must avoid double freeing or accessing of freed
+   * memory.
+   */
+
+  status = ldns_dnssec_zone_add_rr(zone, new_rr);
+
+  if (status != LDNS_STATUS_OK) {
+    ldns_rr_free(new_rr);
+  }
+
+  return status;
+}
+%}
+
+%extend ldns_dnssec_zone {
+  %pythoncode %{
+
+        def __init__(self):
+            """Creates a new dnssec_zone instance"""
+            self.this = _ldns.ldns_dnssec_zone_new()
+            if not self.this:
+               raise Exception("Can't create dnssec zone instance")
+
+        __swig_destroy__ = _ldns.ldns_dnssec_zone_free
+
+        def print_to_file(self,file):
+            """Prints the complete zone to the given file descriptor.
+               
+               :param file: file pointer
+            """
+            _ldns.ldns_dnssec_zone_print(file, self)
+            #parameters: FILE *, ldns_dnssec_zone *,
+            #retvals: 
+
+        def create_nsec3s(self,new_rrs,algorithm,flags,iterations,salt_length,salt):
+            """Adds NSEC3 records to the zone.
+               
+               :param new_rrs:
+               :param algorithm:
+               :param flags:
+               :param iterations:
+               :param salt_length:
+               :param salt:
+               :returns: (ldns_status) 
+            """
+            return _ldns.ldns_dnssec_zone_create_nsec3s(self,new_rrs,algorithm,flags,iterations,salt_length,salt)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,uint8_t,uint8_t,uint16_t,uint8_t,uint8_t *,
+            #retvals: ldns_status
+
+        def create_nsecs(self,new_rrs):
+            """Adds NSEC records to the given dnssec_zone.
+               
+               :param new_rrs:
+                   ldns_rr's created by this function are added to this rr list, so the caller can free them later
+               :returns: (ldns_status) LDNS_STATUS_OK on success, an error code otherwise
+            """
+            return _ldns.ldns_dnssec_zone_create_nsecs(self,new_rrs)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,
+            #retvals: ldns_status
+
+        def create_rrsigs(self,new_rrs,key_list,func,arg):
+            """Adds signatures to the zone.
+               
+               :param new_rrs:
+                   the RRSIG RRs that are created are also added to this list, so the caller can free them later
+               :param key_list:
+                   list of keys to sign with.
+               :param func:
+                   Callback function to decide what keys to use and what to do with old signatures
+               :param arg:
+                   Optional argument for the callback function
+               :returns: (ldns_status) LDNS_STATUS_OK on success, error otherwise
+            """
+            return _ldns.ldns_dnssec_zone_create_rrsigs(self,new_rrs,key_list,func,arg)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,ldns_key_list *,int(*)(ldns_rr *, void *),void *,
+            #retvals: ldns_status
+
+        def sign_cb(self,new_rrs,key_list,func,arg):
+            """signs the given zone with the given keys (with callback function)
+               
+               :param new_rrs:
+                   newly created resource records are added to this list, to free them later
+               :param key_list:
+                   the list of keys to sign the zone with
+               :param func:
+                   callback function that decides what to do with old signatures.
+                   This function takes an ldns_rr and an optional arg argument, and returns one of four values: 
+
+                     * LDNS_SIGNATURE_LEAVE_ADD_NEW - leave the signature and add a new one for the corresponding key 
+
+                     * LDNS_SIGNATURE_REMOVE_ADD_NEW - remove the signature and replace is with a new one from the same key 
+
+                     * LDNS_SIGNATURE_LEAVE_NO_ADD - leave the signature and do not add a new one with the corresponding key 
+
+                     * LDNS_SIGNATURE_REMOVE_NO_ADD - remove the signature and do not replace
+
+               :param arg:
+                   optional argument for the callback function
+               :returns: (ldns_status) LDNS_STATUS_OK on success, an error code otherwise
+            """
+            return _ldns.ldns_dnssec_zone_sign(self,new_rrs,key_list,func,arg)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,ldns_key_list *,int(*)(ldns_rr *, void *),void *,
+            #retvals: ldns_status
+
+        def sign(self,new_rrs,key_list, cbtype=3):
+            """signs the given zone with the given keys
+               
+               :param new_rrs:
+                   newly created resource records are added to this list, to free them later
+               :param key_list:
+                   the list of keys to sign the zone with
+               :param cb_type: 
+                   specifies how to deal with old signatures, possible values:
+
+                     *  0 - ldns_dnssec_default_add_to_signatures, 
+
+                     *  1 - ldns_dnssec_default_leave_signatures,
+
+                     *  2 - ldns_dnssec_default_delete_signatures,
+
+                     *  3 - ldns_dnssec_default_replace_signatures 
+
+               :returns: (ldns_status) LDNS_STATUS_OK on success, an error code otherwise
+            """
+            return _ldns.ldns_dnssec_zone_sign_defcb(self,new_rrs,key_list, cbtype)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,ldns_key_list *,
+            #retvals: ldns_status
+
+        def sign_nsec3(self,new_rrs,key_list,func,arg,algorithm,flags,iterations,salt_length,salt):
+            """signs the given zone with the given new zone, with NSEC3
+               
+               :param new_rrs:
+                   newly created resource records are added to this list, to free them later
+               :param key_list:
+                   the list of keys to sign the zone with
+               :param func:
+                   callback function that decides what to do with old signatures
+               :param arg:
+                   optional argument for the callback function
+               :param algorithm:
+                   the NSEC3 hashing algorithm to use
+               :param flags:
+                   NSEC3 flags
+               :param iterations:
+                   the number of NSEC3 hash iterations to use
+               :param salt_length:
+                   the length (in octets) of the NSEC3 salt
+               :param salt:
+                   the NSEC3 salt data
+               :returns: (ldns_status) LDNS_STATUS_OK on success, an error code otherwise
+            """
+            return _ldns.ldns_dnssec_zone_sign_nsec3(self,new_rrs,key_list,func,arg,algorithm,flags,iterations,salt_length,salt)
+            #parameters: ldns_dnssec_zone *,ldns_rr_list *,ldns_key_list *,int(*)(ldns_rr *, void *),void *,uint8_t,uint8_t,uint16_t,uint8_t,uint8_t *,
+            #retvals: ldns_status
+
+        #LDNS_DNSSEC_ZONE_METHODS_#
+        def add_empty_nonterminals(self):
+            """Adds explicit dnssec_name structures for the empty nonterminals in this zone.
+               
+               (this is needed for NSEC3 generation)
+               
+               :returns: (ldns_status) 
+            """
+            return _ldns.ldns_dnssec_zone_add_empty_nonterminals(self)
+            #parameters: ldns_dnssec_zone *,
+            #retvals: ldns_status
+
+        def add_rr(self,rr):
+            """Adds the given RR to the zone.
+               
+               It find whether there is a dnssec_name with that name present. 
+               If so, add it to that, if not create a new one.  
+               Special handling of NSEC and RRSIG provided.
+               
+               :param rr:
+                   The RR to add
+               :returns: (ldns_status) LDNS_STATUS_OK on success, an error code otherwise
+            """
+            return _ldns.ldns_dnssec_zone_add_rr_(self,rr)
+            #parameters: ldns_dnssec_zone *,ldns_rr *,
+            #retvals: ldns_status
+
+        def find_rrset(self,dname,atype):
+            """Find the RRset with the given name and type in the zone.
+               
+               :param dname:
+                   the domain name of the RRset to find
+               :param atype:
+               :returns: (ldns_dnssec_rrsets \*) the RRset, or NULL if not present
+            """
+            return _ldns.ldns_dnssec_zone_find_rrset(self,dname,atype)
+            #parameters: ldns_dnssec_zone *,ldns_rdf *,ldns_rr_type,
+            #retvals: ldns_dnssec_rrsets *
+
+        #_LDNS_DNSSEC_ZONE_METHODS#
+ %}
+}
diff --git a/contrib/ldns/contrib/python/ldns_key.i b/contrib/ldns/contrib/python/ldns_key.i
new file mode 100644
index 00000000000000..dc67e67bf7740a
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_key.i
@@ -0,0 +1,536 @@
+/******************************************************************************
+ * ldns_key.i: LDNS key class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************/
+%typemap(in,numinputs=0,noblock=1) (ldns_key **)
+{
+ ldns_key *$1_key;
+ $1 = &$1_key;
+}
+          
+/* result generation */
+%typemap(argout,noblock=1) (ldns_key **)
+{
+  $result = SWIG_Python_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_key), SWIGTYPE_p_ldns_struct_key, SWIG_POINTER_OWN |  0 ));
+}
+
+%typemap(argout) ldns_rdf *r "Py_INCREF($input);"
+
+%nodefaultctor ldns_struct_key; //no default constructor & destructor
+%nodefaultdtor ldns_struct_key;
+
+%delobject ldns_key_free;
+%delobject ldns_key_deep_free;
+%newobject ldns_key_list_pop_key;
+%newobject ldns_key2rr;
+%newobject ldns_key_new_frm_algorithm;
+%newobject ldns_key_new_frm_fp;
+%newobject ldns_key_new_frm_fp_l;
+%newobject ldns_key_new_frm_engine;
+
+%rename(ldns_key) ldns_struct_key;
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_key_free) ldns_key_free;
+%inline %{
+void _ldns_key_free (ldns_key* k) {
+   printf("******** LDNS_KEY free 0x%lX ************\n", (long unsigned int)k);
+   ldns_key_deep_free(k);
+}
+%}
+#else
+%rename(_ldns_key_free) ldns_key_deep_free;
+%rename(__ldns_key_free) ldns_key_free;
+#endif
+
+%feature("docstring") ldns_struct_key "Key class
+
+This class can contains all types of keys that are used in DNSSEC. Mostly used to store private keys, since public keys can also be stored in a ldns_rr with type LDNS_RR_TYPE_DNSKEY. This class can also store some variables that influence the signatures generated by signing with this key, for instance the inception date.
+
+**Usage**
+
+ >>> import ldns
+ >>> ldns.ldns_init_random(open(\"/dev/random\",\"rb\"), 512/8)
+ >>> key = ldns.ldns_key.new_frm_algorithm(ldns.LDNS_SIGN_DSA, 512) #generate new DSA key
+ >>> print key
+ Private-key-format: v1.2
+ Algorithm: 3 (DSA)
+ Prime(p): XXXXXXXXHRQBGRflHZQriSAoLI2g+LGvZz8BlEesO+ZQg65wrFGs9IC441y/mn3nFnXfCdtX6zbN5bQuabPdlQ==
+ Subprime(q): XXXXXdnWs/cWsGDglhEyZRLEVA8=
+ Base(g): XXXXXXXqrd+dm2bcxDBdCsZRzkXQ22FxCk2ycnjgevr+s2HfA57BPk3xwqCrHUwuOBVg3Fvq4bpldrCe0sT6Og==
+ Private_value(x): XXXXXcVubZF33pj04z4ZoETsQW1Y=
+ Public_value(y): XXXXXX8t6zfOxJHoy57qteIw9sOZ/Zu0yFiPO083sPm11NlFx3b4m7TJ2k41gYicHXHLUQK1p0xXFToeZEkPGQ==
+ >>> fw = open(\"key.priv\", \"wb\")
+ >>> key.print_to_file(fw) #write priv key to file
+"
+
+%extend ldns_struct_key {
+ 
+ %pythoncode %{
+        def __init__(self):
+            self.this = _ldns.ldns_key_new()
+            if not self.this:
+                raise Exception("Can't create instance of this class")
+       
+        __swig_destroy__ = _ldns._ldns_key_free
+
+        def __str__(self):
+            """converts the data to presentation format"""
+            return _ldns.ldns_key2str(self)
+
+
+        def key_to_rr(self):
+            """converts a ldns_key to a public key rr
+               
+               :returns: (ldns_rr \*) ldns_rr representation of the key
+            """
+            return _ldns.ldns_key2rr(self)
+            #parameters: const ldns_key *,
+            #retvals: ldns_rr *
+
+        def print_to_file(self, file):
+            """print a private key to the file output
+               
+               :param file: output file pointer
+            """
+            _ldns.ldns_key_print(file, self)
+            #parameters: FILE *, const ldns_key *,
+            #retvals: 
+
+        #LDNS_KEY_CONSTRUCTORS_#
+        @staticmethod
+        def new_frm_fp(file, raiseException=True):
+            """Creates a new priv key based on the contents of the file pointed by fp. 
+               
+               :param file: a file object
+               :param raiseException: if True, an exception occurs in case a key instance can't be created
+               :returns: key instance or None. If the object can't be created and raiseException is True, an exception occurs.
+            """
+            status, key = _ldns.ldns_key_new_frm_fp(file)
+            if status != LDNS_STATUS_OK:
+                if (raiseException): raise Exception("Can't create key, error: %s (%d)" % (_ldns.ldns_get_errorstr_by_id(status),status))
+                return None
+            return key
+
+        @staticmethod
+        def new_frm_fp_l(file, raiseException=True):
+            """Creates a new private key based on the contents of the file pointed by fp. 
+               
+               :param file: a file object
+               :param raiseException: if True, an exception occurs in case a key instance can't be created
+               :returns: 
+                  * key - key instance or None. If an instance can't be created and raiseException is True, an exception occurs.
+
+                  * line - the line number (for debugging)
+            """
+            status, key, line = _ldns.ldns_key_new_frm_fp_l(file)
+            if status != LDNS_STATUS_OK:
+                if (raiseException): raise Exception("Can't create key, error: %d" % status)
+                return None
+            return key, line
+
+        @staticmethod
+        def new_frm_algorithm(algorithm, size, raiseException=True):
+            """Creates a new key based on the algorithm. 
+               
+               :param algorithm: the algorithm to use
+               :param size: the number of bytes for the keysize
+               :param raiseException: if True, an exception occurs in case a key instance can't be created
+               :returns: key instance or None. If the object can't be created and raiseException is True, an exception occurs.
+
+               **Algorithms**
+                 LDNS_SIGN_RSAMD5, LDNS_SIGN_RSASHA1, LDNS_SIGN_DSA, LDNS_SIGN_RSASHA1_NSEC3, LDNS_SIGN_RSASHA256, LDNS_SIGN_RSASHA256_NSEC3, LDNS_SIGN_RSASHA512, LDNS_SIGN_RSASHA512_NSEC3, LDNS_SIGN_DSA_NSEC3, LDNS_SIGN_HMACMD5, LDNS_SIGN_HMACSHA1, LDNS_SIGN_HMACSHA256
+            """
+            key = _ldns.ldns_key_new_frm_algorithm(algorithm, size)
+            if (not key) and (raiseException): raise Exception("Can't create key, error: %d" % status)
+            return key
+        #_LDNS_KEY_CONSTRUCTORS#
+
+        #LDNS_KEY_METHODS_#
+        def algorithm(self):
+            """return the signing alg of the key
+               
+               :returns: (ldns_signing_algorithm) the algorithm
+            """
+            return _ldns.ldns_key_algorithm(self)
+            #parameters: const ldns_key *,
+            #retvals: ldns_signing_algorithm
+
+        def dsa_key(self):
+            """returns the (openssl) DSA struct contained in the key
+               
+               :returns: (DSA \*) 
+            """
+            return _ldns.ldns_key_dsa_key(self)
+            #parameters: const ldns_key *,
+            #retvals: DSA *
+
+        def evp_key(self):
+            """returns the (openssl) EVP struct contained in the key
+               
+               :returns: (EVP_PKEY \*) the RSA * structure in the key
+            """
+            return _ldns.ldns_key_evp_key(self)
+            #parameters: const ldns_key *,
+            #retvals: EVP_PKEY *
+
+        def expiration(self):
+            """return the key's expiration date
+               
+               :returns: (uint32_t) the expiration date
+            """
+            return _ldns.ldns_key_expiration(self)
+            #parameters: const ldns_key *,
+            #retvals: uint32_t
+
+        def flags(self):
+            """return the flag of the key
+               
+               :returns: (uint16_t) the flag
+            """
+            return _ldns.ldns_key_flags(self)
+            #parameters: const ldns_key *,
+            #retvals: uint16_t
+
+        def hmac_key(self):
+            """return the hmac key data
+               
+               :returns: (unsigned char \*) the hmac key data
+            """
+            return _ldns.ldns_key_hmac_key(self)
+            #parameters: const ldns_key *,
+            #retvals: unsigned char *
+
+        def hmac_size(self):
+            """return the hmac key size
+               
+               :returns: (size_t) the hmac key size
+            """
+            return _ldns.ldns_key_hmac_size(self)
+            #parameters: const ldns_key *,
+            #retvals: size_t
+
+        def inception(self):
+            """return the key's inception date
+               
+               :returns: (uint32_t) the inception date
+            """
+            return _ldns.ldns_key_inception(self)
+            #parameters: const ldns_key *,
+            #retvals: uint32_t
+
+        def keytag(self):
+            """return the keytag
+               
+               :returns: (uint16_t) the keytag
+            """
+            return _ldns.ldns_key_keytag(self)
+            #parameters: const ldns_key *,
+            #retvals: uint16_t
+
+        def origttl(self):
+            """return the original ttl of the key
+               
+               :returns: (uint32_t) the original ttl
+            """
+            return _ldns.ldns_key_origttl(self)
+            #parameters: const ldns_key *,
+            #retvals: uint32_t
+
+        def pubkey_owner(self):
+            """return the public key's owner
+               
+               :returns: (ldns_rdf \*) the owner
+            """
+            return _ldns.ldns_key_pubkey_owner(self)
+            #parameters: const ldns_key *,
+            #retvals: ldns_rdf *
+
+        def rsa_key(self):
+            """returns the (openssl) RSA struct contained in the key
+               
+               :returns: (RSA \*) the RSA * structure in the key
+            """
+            return _ldns.ldns_key_rsa_key(self)
+            #parameters: const ldns_key *,
+            #retvals: RSA *
+
+        def set_algorithm(self,l):
+            """Set the key's algorithm.
+               
+               :param l:
+                   the algorithm
+            """
+            _ldns.ldns_key_set_algorithm(self,l)
+            #parameters: ldns_key *,ldns_signing_algorithm,
+            #retvals: 
+
+        def set_dsa_key(self,d):
+            """Set the key's dsa data.
+               
+               :param d:
+                   the dsa data
+            """
+            _ldns.ldns_key_set_dsa_key(self,d)
+            #parameters: ldns_key *,DSA *,
+            #retvals: 
+
+        def set_evp_key(self,e):
+            """Set the key's evp key.
+               
+               :param e:
+                   the evp key
+            """
+            _ldns.ldns_key_set_evp_key(self,e)
+            #parameters: ldns_key *,EVP_PKEY *,
+            #retvals: 
+
+        def set_expiration(self,e):
+            """Set the key's expiration date (seconds after epoch).
+               
+               :param e:
+                   the expiration
+            """
+            _ldns.ldns_key_set_expiration(self,e)
+            #parameters: ldns_key *,uint32_t,
+            #retvals: 
+
+        def set_flags(self,flags):
+            """Set the key's flags.
+               
+               :param flags:
+                   the flags
+            """
+            _ldns.ldns_key_set_flags(self,flags)
+            #parameters: ldns_key *,uint16_t,
+            #retvals: 
+
+        def set_hmac_key(self,hmac):
+            """Set the key's hmac data.
+               
+               :param hmac:
+                   the raw key data
+            """
+            _ldns.ldns_key_set_hmac_key(self,hmac)
+            #parameters: ldns_key *,unsigned char *,
+            #retvals: 
+
+        def set_hmac_size(self,hmac_size):
+            """Set the key's hmac size.
+               
+               :param hmac_size:
+                   the size of the hmac data
+            """
+            _ldns.ldns_key_set_hmac_size(self,hmac_size)
+            #parameters: ldns_key *,size_t,
+            #retvals: 
+
+        def set_inception(self,i):
+            """Set the key's inception date (seconds after epoch).
+               
+               :param i:
+                   the inception
+            """
+            _ldns.ldns_key_set_inception(self,i)
+            #parameters: ldns_key *,uint32_t,
+            #retvals: 
+
+        def set_keytag(self,tag):
+            """Set the key's key tag.
+               
+               :param tag:
+                   the keytag
+            """
+            _ldns.ldns_key_set_keytag(self,tag)
+            #parameters: ldns_key *,uint16_t,
+            #retvals: 
+
+        def set_origttl(self,t):
+            """Set the key's original ttl.
+               
+               :param t:
+                   the ttl
+            """
+            _ldns.ldns_key_set_origttl(self,t)
+            #parameters: ldns_key *,uint32_t,
+            #retvals: 
+
+        def set_pubkey_owner(self,r):
+            """Set the key's pubkey owner.
+               
+               :param r:
+                   the owner
+            """
+            _ldns.ldns_key_set_pubkey_owner(self,r)
+            #parameters: ldns_key *,ldns_rdf *,
+            #retvals: 
+
+        def set_rsa_key(self,r):
+            """Set the key's rsa data.
+               
+               :param r:
+                   the rsa data
+            """
+            _ldns.ldns_key_set_rsa_key(self,r)
+            #parameters: ldns_key *,RSA *,
+            #retvals: 
+
+        def set_use(self,v):
+            """set the use flag
+               
+               :param v:
+                   the boolean value to set the _use field to
+            """
+            _ldns.ldns_key_set_use(self,v)
+            #parameters: ldns_key *,bool,
+            #retvals: 
+
+        def use(self):
+            """return the use flag
+               
+               :returns: (bool) the boolean value of the _use field
+            """
+            return _ldns.ldns_key_use(self)
+            #parameters: const ldns_key *,
+            #retvals: bool
+            #_LDNS_KEY_METHODS#
+ %}
+}
+
+%nodefaultctor ldns_struct_key_list; //no default constructor & destructor
+%nodefaultdtor ldns_struct_key_list;
+
+%newobject ldns_key_list_new;
+%newobject ldns_key_list_pop_key;
+%delobject ldns_key_list_free;
+%delobject ldns_key_list_push_key;
+
+%rename(ldns_key_list) ldns_struct_key_list;
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_key_list_free) ldns_key_list_free;
+%inline %{
+void _ldns_key_list_free (ldns_key_list* k) {
+   printf("******** LDNS_KEY_LIST free 0x%lX ************\n", (long unsigned int)k);
+   ldns_key_list_free(k);
+}
+%}
+#else
+%rename(_ldns_key_list_free) ldns_key_list_free;
+#endif
+
+%extend ldns_struct_key_list {
+ 
+ %pythoncode %{
+        def __init__(self):
+            self.this = _ldns.ldns_key_list_new()
+            if not self.this:
+                raise Exception("Can't create class")
+       
+        __swig_destroy__ = _ldns._ldns_key_list_free
+
+        def keys(self):
+            """Key list iterator"""
+            for i in range(0, self.key_count()):
+                yield self.key(i)
+
+        def __str__(self):
+            i = 0
+            s = ""
+            for k in self.keys():
+                i += 1
+                s += "key %d:\n   %s\n" % (i, str(k).replace("\n","\n   "))
+            return s
+
+           #LDNS_KEY_LIST_METHODS_#
+        def key(self,nr):
+            """returns a pointer to the key in the list at the given position
+               
+               :param nr:
+                   the position in the list
+               :returns: (ldns_key \*) the key
+            """
+            return _ldns.ldns_key_list_key(self,nr)
+            #parameters: const ldns_key_list *,size_t,
+            #retvals: ldns_key *
+
+        def key_count(self):
+            """returns the number of keys in the key list
+               
+               :returns: (size_t) the numbers of keys in the list
+            """
+            return _ldns.ldns_key_list_key_count(self)
+            #parameters: const ldns_key_list *,
+            #retvals: size_t
+
+        def pop_key(self):
+            """pops the last rr from a keylist
+               
+               :returns: (ldns_key \*) NULL if nothing to pop. Otherwise the popped RR
+            """
+            return _ldns.ldns_key_list_pop_key(self)
+            #parameters: ldns_key_list *,
+            #retvals: ldns_key *
+
+        def push_key(self,key):
+            """pushes a key to a keylist
+               
+               :param key:
+                   the key to push
+               :returns: (bool) false on error, otherwise true
+            """
+            return _ldns.ldns_key_list_push_key(self,key)
+            #parameters: ldns_key_list *,ldns_key *,
+            #retvals: bool
+
+        def set_key_count(self,count):
+            """Set the keylist's key count to count.
+               
+               :param count:
+                   the count
+            """
+            _ldns.ldns_key_list_set_key_count(self,count)
+            #parameters: ldns_key_list *,size_t,
+            #retvals: 
+
+        def set_use(self,v):
+            """Set the 'use' flag for all keys in the list.
+               
+               :param v:
+                   The value to set the use flags to
+            """
+            _ldns.ldns_key_list_set_use(self,v)
+            #parameters: ldns_key_list *,bool,
+            #retvals: 
+
+           #_LDNS_KEY_LIST_METHODS#
+ %}
+}
+
diff --git a/contrib/ldns/contrib/python/ldns_packet.i b/contrib/ldns/contrib/python/ldns_packet.i
new file mode 100644
index 00000000000000..c2d7a3b63cca0e
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_packet.i
@@ -0,0 +1,1588 @@
+/******************************************************************************
+ * ldns_packet.i: LDNS packet class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/* Creates a temporary instance of (ldns_pkt *). */
+%typemap(in,numinputs=0,noblock=1) (ldns_pkt **)
+{
+  ldns_pkt *$1_pkt;
+  $1 = &$1_pkt;
+}
+          
+/* Result generation, appends (ldns_pkt *) after the result. */
+%typemap(argout,noblock=1) (ldns_pkt **)
+{
+  $result = SWIG_Python_AppendOutput($result,
+    SWIG_NewPointerObj(SWIG_as_voidptr($1_pkt),
+      SWIGTYPE_p_ldns_struct_pkt, SWIG_POINTER_OWN |  0 ));
+}
+
+%newobject ldns_pkt_new;
+%newobject ldns_pkt_clone;
+%newobject ldns_pkt_rr_list_by_type;
+%newobject ldns_pkt_rr_list_by_name_and_type;
+%newobject ldns_pkt_rr_list_by_name;
+%newobject ldns_update_pkt_new;
+
+
+%nodefaultctor ldns_struct_pkt; /* No default constructor. */
+%nodefaultdtor ldns_struct_pkt; /* No default destructor. */
+
+%rename(ldns_pkt) ldns_struct_pkt;
+
+%newobject ldns_pkt2str;
+%newobject ldns_pkt_opcode2str;
+%newobject ldns_pkt_rcode2str;
+%newobject ldns_pkt_algorithm2str;
+%newobject ldns_pkt_cert_algorithm2str;
+%newobject ldns_pkt_get_section_clone;
+
+
+/* Clone data on pull. */
+
+
+%newobject _ldns_pkt_additional;
+%rename(__ldns_pkt_additional) ldns_pkt_additional;
+%inline
+%{
+  ldns_rr_list * _ldns_pkt_additional(ldns_pkt *p)
+  {
+    return ldns_rr_list_clone(ldns_pkt_additional(p));
+  }
+%}
+
+%newobject _ldns_pkt_answer;
+%rename(__ldns_pkt_answer) ldns_pkt_answer;
+%inline
+%{
+  ldns_rr_list * _ldns_pkt_answer(ldns_pkt *p)
+  {
+    return ldns_rr_list_clone(ldns_pkt_answer(p));
+  }
+%}
+
+%newobject _ldns_pkt_answerfrom;
+%rename(__ldns_pkt_answerfrom) ldns_pkt_answerfrom;
+%inline
+%{
+  ldns_rdf * _ldns_pkt_answerfrom(ldns_pkt *p)
+  {
+    ldns_rdf *rdf;
+
+    rdf = ldns_pkt_answerfrom(p);
+    if (rdf != NULL) {
+      rdf = ldns_rdf_clone(rdf);
+    }
+    return rdf;
+  }
+%}
+
+%newobject _ldns_pkt_authority;
+%rename(__ldns_pkt_authority) ldns_pkt_authority;
+%inline
+%{
+  ldns_rr_list * _ldns_pkt_authority(ldns_pkt *p)
+  {
+    return ldns_rr_list_clone(ldns_pkt_authority(p));
+  }
+%}
+
+%newobject _ldns_pkt_edns_data;
+%rename(__ldns_pkt_edns_data) ldns_pkt_edns_data;
+%inline
+%{
+  ldns_rdf * _ldns_pkt_edns_data(ldns_pkt *p)
+  {
+    ldns_rdf *rdf;
+
+    rdf = ldns_pkt_edns_data(p);
+    if (rdf != NULL) {
+      rdf = ldns_rdf_clone(rdf);
+    }
+    return rdf;
+  }
+%}
+
+%newobject _ldns_pkt_tsig;
+%rename(__ldns_pkt_tsig) ldns_pkt_tsig;
+%inline
+%{
+  ldns_rr * _ldns_pkt_tsig(const ldns_pkt *pkt)
+  {
+    return ldns_rr_clone(ldns_pkt_tsig(pkt));
+  }
+%}
+
+%newobject _ldns_pkt_question;
+%rename(__ldns_pkt_question) ldns_pkt_question;
+%inline
+%{
+  ldns_rr_list * _ldns_pkt_question(ldns_pkt *p)
+  {
+    return ldns_rr_list_clone(ldns_pkt_question(p));
+  }
+%}
+
+/* End of pull cloning. */
+
+/* Clone data on push. */
+
+%newobject _ldns_pkt_query_new;
+%rename(__ldns_pkt_query_new) ldns_pkt_query_new;
+%inline
+%{
+  ldns_pkt * _ldns_pkt_query_new(ldns_rdf *rr_name, ldns_rr_type rr_type,
+    ldns_rr_class rr_class, uint16_t flags)
+  {
+    return ldns_pkt_query_new(ldns_rdf_clone(rr_name), rr_type, rr_class,
+             flags);
+  }
+%}
+
+%rename(__ldns_pkt_push_rr) ldns_pkt_push_rr;
+%inline
+%{
+  bool _ldns_pkt_push_rr(ldns_pkt *p, ldns_pkt_section sec, ldns_rr *rr)
+  {
+    return ldns_pkt_push_rr(p, sec, ldns_rr_clone(rr));
+  }
+%}
+
+%rename(__ldns_pkt_safe_push_rr) ldns_pkt_safe_push_rr;
+%inline
+%{
+  bool _ldns_pkt_safe_push_rr(ldns_pkt *pkt, ldns_pkt_section sec,
+    ldns_rr *rr)
+  {
+    /* Prevents memory leaks when fails. */
+    ldns_rr *rr_clone = NULL;
+    bool ret;
+
+    if (rr != NULL) {
+      rr_clone = ldns_rr_clone(rr);
+    }
+    ret = ldns_pkt_safe_push_rr(pkt, sec, rr_clone);
+    if (!ret) {
+      ldns_rr_free(rr_clone);
+    }
+
+    return ret;
+  }
+%}
+
+%rename(__ldns_pkt_push_rr_list) ldns_pkt_push_rr_list;
+%inline
+%{
+  bool _ldns_pkt_push_rr_list(ldns_pkt *p, ldns_pkt_section sec,
+    ldns_rr_list *rrl)
+  {
+    return ldns_pkt_push_rr_list(p, sec, ldns_rr_list_clone(rrl));
+  }
+%}
+
+%rename(__ldns_pkt_safe_push_rr_list) ldns_pkt_safe_push_rr_list;
+%inline
+%{
+  bool _ldns_pkt_safe_push_rr_list(ldns_pkt *p, ldns_pkt_section s,
+    ldns_rr_list *rrl)
+  {
+    /* Prevents memory leaks when fails. */
+    ldns_rr_list *rrl_clone = NULL;
+    bool ret;
+
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    ret = ldns_pkt_safe_push_rr_list(p, s, rrl_clone);
+    if (!ret) {
+      ldns_rr_list_free(rrl_clone);
+    }
+
+    return ret;
+  }
+%}
+
+%rename(__ldns_pkt_set_additional) ldns_pkt_set_additional;
+%inline
+%{
+  void _ldns_pkt_set_additional(ldns_pkt *p, ldns_rr_list *rrl)
+  {
+    ldns_rr_list *rrl_clone = NULL;
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_additional(p, rrl_clone);
+  }
+%}
+
+%rename(__ldns_pkt_set_answer) ldns_pkt_set_answer;
+%inline
+%{
+  void _ldns_pkt_set_answer(ldns_pkt *p, ldns_rr_list *rrl)
+  {
+    ldns_rr_list *rrl_clone = NULL;
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_answer(p, rrl_clone);
+  }
+%}
+
+%rename (__ldns_pkt_set_answerfrom) ldns_pkt_set_answerfrom;
+%inline
+%{
+  void _ldns_pkt_set_answerfrom(ldns_pkt *packet, ldns_rdf *rdf)
+  {
+    ldns_rdf *rdf_clone = NULL;
+    if (rdf != NULL) {
+      rdf_clone = ldns_rdf_clone(rdf);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_answerfrom(packet, rdf_clone);
+  }
+%}
+
+%rename(__ldns_pkt_set_authority) ldns_pkt_set_authority;
+%inline
+%{
+  void _ldns_pkt_set_authority(ldns_pkt *p, ldns_rr_list *rrl)
+  {
+    ldns_rr_list *rrl_clone = NULL;
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_authority(p, rrl_clone);
+  }
+%}
+
+%rename(__ldns_pkt_set_edns_data) ldns_pkt_set_edns_data;
+%inline
+%{
+  void _ldns_pkt_set_edns_data(ldns_pkt *packet, ldns_rdf *rdf)
+  {
+    ldns_rdf *rdf_clone = NULL;
+    if (rdf != NULL) {
+      rdf_clone = ldns_rdf_clone(rdf);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_edns_data(packet, rdf_clone);
+  }
+%}
+
+%rename(__ldns_pkt_set_question) ldns_pkt_set_question;
+%inline
+%{
+  void _ldns_pkt_set_question(ldns_pkt *p, ldns_rr_list *rrl)
+  {
+    ldns_rr_list *rrl_clone = NULL;
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_question(p, rrl_clone);
+  }
+%}
+
+%rename(__ldns_pkt_set_tsig) ldns_pkt_set_tsig;
+%inline
+%{
+  void _ldns_pkt_set_tsig(ldns_pkt *pkt, ldns_rr *rr)
+  {
+    ldns_rr *rr_clone = NULL;
+    if (rr != NULL) {
+      rr_clone = ldns_rr_clone(rr);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_pkt_set_tsig(pkt, rr_clone);
+  }
+%}
+
+/* End of push cloning. */
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_pkt_free) ldns_pkt_free;
+%inline
+%{
+  /*!
+   * @brief Prints information about deallocated pkt and deallocates.
+   */
+  void _ldns_pkt_free (ldns_pkt* p) {
+    printf("******** LDNS_PKT free 0x%lX ************\n",
+      (long unsigned int) p);
+    ldns_pkt_free(p);
+  }
+%}
+#else /* !LDNS_DEBUG */
+%rename(_ldns_pkt_free) ldns_pkt_free;
+#endif /* LDNS_DEBUG */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+/* None. */
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+%feature("docstring") ldns_struct_pkt "LDNS packet object. 
+
+The :class:`ldns_pkt` object contains DNS packed (either a query or an answer).
+It is the complete representation of what you actually send to a name server,
+and what you get back (see :class:`ldns.ldns_resolver`).
+
+**Usage**
+
+>>> import ldns
+>>> resolver = ldns.ldns_resolver.new_frm_file(\"/etc/resolv.conf\")
+>>> pkt = resolver.query(\"nic.cz\", ldns.LDNS_RR_TYPE_NS,ldns.LDNS_RR_CLASS_IN)
+>>> print pkt
+;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 63004
+;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
+;; QUESTION SECTION:
+;; nic.cz.	IN	NS
+;; ANSWER SECTION:
+nic.cz.	758	IN	NS	a.ns.nic.cz.
+nic.cz.	758	IN	NS	c.ns.nic.cz.
+nic.cz.	758	IN	NS	e.ns.nic.cz.
+;; AUTHORITY SECTION:
+;; ADDITIONAL SECTION:
+;; Query time: 8 msec
+;; SERVER: 82.100.38.2
+;; WHEN: Thu Jan 11 12:54:33 2009
+;; MSG SIZE  rcvd: 75
+
+This simple example instances a resolver in order to resolve NS for nic.cz."
+
+%extend ldns_struct_pkt {
+ 
+  %pythoncode
+  %{
+        def __init__(self):
+            """
+               Cannot be created directly from Python.
+            """
+            raise Exception("This class can't be created directly. " +
+                "Please use: ldns_pkt_new, ldns_pkt_query_new " +
+                "or ldns_pkt_query_new_frm_str")
+
+        __swig_destroy__ = _ldns._ldns_pkt_free
+
+        #
+        # LDNS_PKT_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def new():
+            """
+               Creates new empty packet structure.
+
+               :return: (:class:`ldns_pkt` ) New empty packet.
+            """
+            return _ldns.ldns_pkt_new()
+
+        @staticmethod
+        def new_query(rr_name, rr_type, rr_class, flags):
+            """
+               Creates a packet with a query in it for the given name,
+               type and class.
+               
+               :param rr_name: The name to query for.
+               :type rr_name: :class:`ldns_dname`
+               :param rr_type: The type to query for.
+               :type rr_type: ldns_rr_type
+               :param rr_class: The class to query for.
+               :type rr_class: ldns_rr_class
+               :param flags: Packet flags.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_pkt`) New object.
+
+               .. note::
+                   The type checking of parameter `rr_name` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(rr_name, ldns_dname)) and \
+               isinstance(rr_name, ldns_rdf) and \
+               rr_name.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_pkt.new_query() method will" +
+                    " drop the possibility to accept ldns_rdf." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            if not isinstance(rr_name, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (rr_name.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            return _ldns._ldns_pkt_query_new(rr_name, rr_type, rr_class, flags)
+
+        @staticmethod
+        def new_query_frm_str(rr_name, rr_type, rr_class, flags, raiseException = True):
+            """
+               Creates a query packet for the given name, type, class.
+               
+               :param rr_name: The name to query for.
+               :type rr_name: str
+               :param rr_type: The type to query for.
+               :type rr_type: ldns_rr_type
+               :param rr_class: The class to query for.
+               :type rr_class: ldns_rr_class
+               :param flags: Packet flags.
+               :type flags: uint16_t
+               :param raiseException: If True, an exception occurs in case a
+                   packet object can't be created.
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When raiseException set and packet couldn't
+                   be created.
+               :return: (:class:`ldns_pkt`) Query packet object or None.
+                   If the object can't be created and raiseException is True,
+                   an exception occurs.
+
+
+               **Usage**
+
+               >>> pkt = ldns.ldns_pkt.new_query_frm_str("test.nic.cz",ldns.LDNS_RR_TYPE_ANY, ldns.LDNS_RR_CLASS_IN, ldns.LDNS_QR | ldns.LDNS_AA)
+               >>> rra = ldns.ldns_rr.new_frm_str("test.nic.cz. IN A 192.168.1.1",300)
+               >>> list = ldns.ldns_rr_list()
+               >>> if (rra): list.push_rr(rra)
+               >>> pkt.push_rr_list(ldns.LDNS_SECTION_ANSWER, list)
+               >>> print pkt
+               ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
+               ;; flags: qr aa ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
+               ;; QUESTION SECTION:
+               ;; test.nic.cz.	IN	ANY
+               ;; ANSWER SECTION:
+               test.nic.cz.	300	IN	A	192.168.1.1
+               ;; AUTHORITY SECTION:
+               ;; ADDITIONAL SECTION:
+               ;; Query time: 0 msec
+               ;; WHEN: Thu Jan  1 01:00:00 1970
+               ;; MSG SIZE  rcvd: 0
+            """
+            status, pkt = _ldns.ldns_pkt_query_new_frm_str(rr_name, rr_type, rr_class, flags)
+            if status != LDNS_STATUS_OK:
+                if (raiseException): raise Exception("Can't create query packet, error: %d" % status)
+                return None
+            return pkt
+
+        #
+        # _LDNS_PKT_CONSTRUCTORS
+        #
+     
+        def __str__(self):
+            """
+               Converts the data in the DNS packet to presentation format.
+
+               :return: (str)
+            """
+            return _ldns.ldns_pkt2str(self)
+
+        def opcode2str(self):
+            """
+               Converts a packet opcode to its mnemonic and returns that as an
+               allocated null-terminated string.
+
+               :return: (str)
+            """
+            return _ldns.ldns_pkt_opcode2str(self.get_opcode())
+
+        def rcode2str(self):
+            """
+               Converts a packet rcode to its mnemonic and returns that as an
+               allocated null-terminated string.
+
+               :return: (str)
+            """
+            return _ldns.ldns_pkt_rcode2str(self.get_rcode())
+
+        def print_to_file(self, output):
+            """
+               Prints the data in the DNS packet to the given file stream
+               (in presentation format).
+
+               :param output: Opened file to write to.
+               :type output: file
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_print(output, self)
+            #parameters: FILE *,const ldns_pkt *,
+
+        def write_to_buffer(self, buffer):
+            """
+               Copies the packet data to the buffer in wire format.
+               
+               :param buffer: Buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_pkt2buffer_wire(buffer, self)
+            #parameters: ldns_buffer *,const ldns_pkt *,
+            #retvals: ldns_status
+
+        @staticmethod
+        def algorithm2str(alg):
+            """
+               Converts a signing algorithms to its mnemonic and returns that
+               as an allocated null-terminated string.
+
+               :param alg: The algorithm to convert to text.
+               :type alg: ldns_algorithm
+               :return: (str)
+            """
+            return _ldns.ldns_pkt_algorithm2str(alg)
+            #parameters: ldns_algorithm,
+
+        @staticmethod
+        def cert_algorithm2str(alg):
+            """
+               Converts a cert algorithm to its mnemonic and returns that as an
+               allocated null-terminated string.
+
+               :param alg: Cert algorithm to convert to text.
+               :type alg: ldns_cert_algorithm
+               :return: (str)
+            """
+            return _ldns.ldns_pkt_cert_algorithm2str(alg)
+            #parameters: ldns_algorithm,
+
+        #
+        # LDNS_PKT_METHODS_
+        #
+
+        def aa(self):
+            """
+               Read the packet's aa bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_aa(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def ad(self):
+            """
+               Read the packet's ad bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_ad(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def additional(self):
+            """
+               Return the packet's additional section.
+               
+               :return: (:class:`ldns_rr_list`) The additional section.
+            """
+            return _ldns._ldns_pkt_additional(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def all(self):
+            """
+               Return the packet's question, answer, authority and additional
+               sections concatenated.
+
+               :return: (:class:`ldns_rr_list`) Concatenated sections.
+            """
+            return _ldns.ldns_pkt_all(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def all_noquestion(self):
+            """
+               Return the packet's answer, authority and additional sections
+               concatenated.
+               Like :meth:`all` but without the questions.
+
+               :return: (:class:`ldns_rr_list`) Concatenated sections except
+                   questions.
+            """
+            return _ldns.ldns_pkt_all_noquestion(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def ancount(self):
+            """
+               Return the packet's an count.
+               
+               :return: (int) The an count.
+            """
+            return _ldns.ldns_pkt_ancount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def answer(self):
+            """
+               Return the packet's answer section.
+               
+               :return: (:class:`ldns_rr_list`) The answer section.
+            """
+            return _ldns._ldns_pkt_answer(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def answerfrom(self):
+            """
+               Return the packet's answerfrom.
+               
+               :return: (:class:`ldns_rdf`) The name of the server.
+            """
+            return _ldns._ldns_pkt_answerfrom(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rdf *
+
+        def arcount(self):
+            """
+               Return the packet's ar count.
+               
+               :return: (int) The ar count.
+            """
+            return _ldns.ldns_pkt_arcount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def authority(self):
+            """
+               Return the packet's authority section.
+               
+               :return: (:class:`ldns_rr_list`) The authority section.
+            """
+            return _ldns._ldns_pkt_authority(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def cd(self):
+            """
+               Read the packet's cd bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_cd(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def clone(self):
+            """
+               Clones the packet, creating a fully allocated copy.
+               
+               :return: (:class:`ldns_pkt`) New packet clone.
+            """
+            return _ldns.ldns_pkt_clone(self)
+            #parameters: ldns_pkt *,
+            #retvals: ldns_pkt *
+
+        def edns(self):
+            """
+               Returns True if this packet needs and EDNS rr to be sent.
+               
+               At the moment the only reason is an expected packet size larger
+               than 512 bytes, but for instance DNSSEC would be a good reason
+               too.
+               
+               :return: (bool) True if packet needs EDNS rr.
+            """
+            return _ldns.ldns_pkt_edns(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def edns_data(self):
+            """
+               Return the packet's edns data.
+               
+               :return: (:class:`ldns_rdf`) The edns data.
+            """
+            return _ldns._ldns_pkt_edns_data(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rdf *
+
+        def edns_do(self):
+            """
+               Return the packet's edns do bit
+               
+               :return: (bool) The bit's value.
+            """
+            return _ldns.ldns_pkt_edns_do(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def edns_extended_rcode(self):
+            """
+               Return the packet's edns extended rcode.
+               
+               :return: (uint8_t) The rcode.
+            """
+            return _ldns.ldns_pkt_edns_extended_rcode(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint8_t
+
+        def edns_udp_size(self):
+            """
+               Return the packet's edns udp size.
+               
+               :return: (uint16_t) The udp size.
+            """
+            return _ldns.ldns_pkt_edns_udp_size(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def edns_version(self):
+            """
+               Return the packet's edns version.
+               
+               :return: (uint8_t) The edns version.
+            """
+            return _ldns.ldns_pkt_edns_version(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint8_t
+
+        def edns_z(self):
+            """
+               Return the packet's edns z value.
+               
+               :return: (uint16_t) The z value.
+            """
+            return _ldns.ldns_pkt_edns_z(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def empty(self):
+            """
+               Check if a packet is empty.
+               
+               :return: (bool) True: empty, False: not empty
+            """
+            return _ldns.ldns_pkt_empty(self)
+            #parameters: ldns_pkt *,
+            #retvals: bool
+
+        def get_opcode(self):
+            """
+               Read the packet's code.
+               
+               :return: (ldns_pkt_opcode) the opcode
+            """
+            return _ldns.ldns_pkt_get_opcode(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_pkt_opcode
+
+        def get_rcode(self):
+            """
+               Return the packet's response code.
+               
+               :return: (ldns_pkt_rcode) The response code.
+            """
+            return _ldns.ldns_pkt_get_rcode(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_pkt_rcode
+
+        def get_section_clone(self, s):
+            """
+               Return the selected rr_list's in the packet.
+               
+               :param s: What section(s) to return.
+               :type s: ldns_pkt_section
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) RR list with the rr's or None
+                   if none were found.
+            """
+            return _ldns.ldns_pkt_get_section_clone(self, s)
+            #parameters: const ldns_pkt *,ldns_pkt_section,
+            #retvals: ldns_rr_list *
+
+        def id(self):
+            """
+               Read the packet id.
+               
+               :return: (uint16_t) The packet id.
+            """
+            return _ldns.ldns_pkt_id(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def nscount(self):
+            """
+               Return the packet's ns count.
+               
+               :return: (uint16_t) The ns count.
+            """
+            return _ldns.ldns_pkt_nscount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def push_rr(self, section, rr):
+            """
+               Push an rr on a packet.
+               
+               :param section: Where to put it.
+               :type section: ldns_pkt_section
+               :param rr: RR to push.
+               :type rr: :class:`ldns_rr`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) A boolean which is True when the rr was added.
+            """
+            return _ldns._ldns_pkt_push_rr(self,section,rr)
+            #parameters: ldns_pkt *,ldns_pkt_section,ldns_rr *,
+            #retvals: bool
+
+        def push_rr_list(self, section, list):
+            """
+               Push a rr_list on a packet.
+               
+               :param section: Where to put it.
+               :type section: ldns_pkt_section
+               :param list: The rr_list to push.
+               :type list: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) A boolean which is True when the rr was added.
+            """
+            return _ldns._ldns_pkt_push_rr_list(self,section,list)
+            #parameters: ldns_pkt *,ldns_pkt_section,ldns_rr_list *,
+            #retvals: bool
+
+        def qdcount(self):
+            """
+               Return the packet's qd count.
+               
+               :return: (uint16_t) The qd count.
+            """
+            return _ldns.ldns_pkt_qdcount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def qr(self):
+            """
+               Read the packet's qr bit.
+               
+               :return: (bool) value of the bit
+            """
+            return _ldns.ldns_pkt_qr(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def querytime(self):
+            """
+               Return the packet's query time.
+               
+               :return: (uint32_t) The query time.
+            """
+            return _ldns.ldns_pkt_querytime(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint32_t
+
+        def question(self):
+            """
+               Return the packet's question section.
+               
+               :return: (:class:`ldns_rr_list`) The question section.
+            """
+            return _ldns._ldns_pkt_question(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr_list *
+
+        def ra(self):
+            """
+               Read the packet's ra bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_ra(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def rd(self):
+            """
+               Read the packet's rd bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_rd(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def reply_type(self):
+            """
+               Looks inside the packet to determine what kind of packet it is,
+               AUTH, NXDOMAIN, REFERRAL, etc.
+               
+               :return: (ldns_pkt_type) The type of packet.
+            """
+            return _ldns.ldns_pkt_reply_type(self)
+            #parameters: ldns_pkt *,
+            #retvals: ldns_pkt_type
+
+        def rr(self, sec, rr):
+            """
+               Check to see if an rr exist in the packet.
+               
+               :param sec: In which section to look.
+               :type sec: ldns_pkt_section
+               :param rr: The rr to look for.
+               :type rr: :class:`ldns_rr`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) Return True is exists.
+            """
+            return _ldns.ldns_pkt_rr(self, sec, rr)
+            #parameters: ldns_pkt *,ldns_pkt_section,ldns_rr *,
+            #retvals: bool
+
+        def rr_list_by_name(self, r, s):
+            """
+               Return all the rr with a specific name from a packet.
+               
+               :param r: The name.
+               :type r: :class:`ldns_rdf`
+               :param s: The packet's section.
+               :type s: ldns_pkt_section
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) A list with the rr's or None
+                   if none were found.
+            """
+            return _ldns.ldns_pkt_rr_list_by_name(self,r,s)
+            #parameters: ldns_pkt *,ldns_rdf *,ldns_pkt_section,
+            #retvals: ldns_rr_list *
+
+        def rr_list_by_name_and_type(self, ownername, atype, sec):
+            """
+               Return all the rr with a specific type and type from a packet.
+               
+               :param ownername: The name.
+               :type ownername: :class:`ldns_rdf`
+               :param atype: The type.
+               :type atype: ldns_rr_type
+               :param sec: The packet's section.
+               :type sec: ldns_pkt_section
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) A list with the rr's or None
+                   if none were found.
+            """
+            return _ldns.ldns_pkt_rr_list_by_name_and_type(self, ownername, atype, sec)
+            #parameters: const ldns_pkt *,const ldns_rdf *,ldns_rr_type,ldns_pkt_section,
+            #retvals: ldns_rr_list *
+
+        def rr_list_by_type(self, t, s):
+            """
+               Return all the rr with a specific type from a packet.
+               
+               :param t: The type.
+               :type t: ldns_rr_type
+               :param s: The packet's section.
+               :type s: ldns_pkt_section
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) A list with the rr's or None
+                   if none were found.
+            """
+            return _ldns.ldns_pkt_rr_list_by_type(self, t, s)
+            #parameters: const ldns_pkt *,ldns_rr_type,ldns_pkt_section,
+            #retvals: ldns_rr_list *
+
+        def safe_push_rr(self, sec, rr):
+            """
+               Push an rr on a packet, provided the RR is not there.
+               
+               :param sec: Where to put it.
+               :type sec: ldns_pkt_section
+               :param rr: RR to push.
+               :type rr: :class:`ldns_rr`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) A boolean which is True when the rr was added.
+            """
+            return _ldns._ldns_pkt_safe_push_rr(self,sec,rr)
+            #parameters: ldns_pkt *,ldns_pkt_section,ldns_rr *,
+            #retvals: bool
+
+        def safe_push_rr_list(self, sec, list):
+            """
+               Push an rr_list to a packet, provided the RRs are not already
+               there.
+               
+               :param sec: Where to put it.
+               :type sec: ldns_pkt_section
+               :param list: The rr_list to push.
+               :type list: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) A boolean which is True when the list was added.
+            """
+            return _ldns._ldns_pkt_safe_push_rr_list(self, sec, list)
+            #parameters: ldns_pkt *,ldns_pkt_section,ldns_rr_list *,
+            #retvals: bool
+
+        def set_aa(self, b):
+            """
+               Set the packet's aa bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_aa(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_ad(self, b):
+            """
+               Set the packet's ad bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_ad(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_additional(self, rr):
+            """
+               Directly set the additional section.
+               
+               :param rr: The rr list to set.
+               :type rr: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_additional(self, rr)
+            #parameters: ldns_pkt *,ldns_rr_list *,
+            #retvals: 
+
+        def set_ancount(self, c):
+            """
+               Set the packet's an count.
+               
+               :param c: The count.
+               :type c: int
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_ancount(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_answer(self, rr):
+            """
+               Directly set the answer section.
+               
+               :param rr: The rr list to set.
+               :type rr: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_answer(self, rr)
+            #parameters: ldns_pkt *,ldns_rr_list *,
+            #retvals: 
+
+        def set_answerfrom(self, r):
+            """
+               Set the packet's answering server.
+               
+               :param r: The address.
+               :type r: :class:`ldns_rdf`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_answerfrom(self, r)
+            #parameters: ldns_pkt *,ldns_rdf *,
+            #retvals: 
+
+        def set_arcount(self, c):
+            """
+               Set the packet's arcount.
+               
+               :param c: The count.
+               :type c: int
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_arcount(self,c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_authority(self, rr):
+            """
+               Directly set the authority section.
+               
+               :param rr: The rr list to set.
+               :type rr: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_authority(self, rr)
+            #parameters: ldns_pkt *,ldns_rr_list *,
+            #retvals: 
+
+        def set_cd(self, b):
+            """
+               Set the packet's cd bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_cd(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_edns_data(self, data):
+            """
+               Set the packet's edns data.
+               
+               :param data: The data.
+               :type data: :class:`ldns_rdf`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_edns_data(self, data)
+            #parameters: ldns_pkt *,ldns_rdf *,
+            #retvals: 
+
+        def set_edns_do(self, value):
+            """
+               Set the packet's edns do bit.
+               
+               :param value: The bit's new value.
+               :type value: bool
+            """
+            _ldns.ldns_pkt_set_edns_do(self, value)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_edns_extended_rcode(self, c):
+            """
+               Set the packet's edns extended rcode.
+               
+               :param c: The code.
+               :type c: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_edns_extended_rcode(self, c)
+            #parameters: ldns_pkt *,uint8_t,
+            #retvals: 
+
+        def set_edns_udp_size(self, s):
+            """
+               Set the packet's edns udp size.
+               
+               :param s: The size.
+               :type s: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_edns_udp_size(self, s)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_edns_version(self, v):
+            """
+               Set the packet's edns version.
+               
+               :param v: The version.
+               :type v: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_edns_version(self, v)
+            #parameters: ldns_pkt *,uint8_t,
+            #retvals: 
+
+        def set_edns_z(self, z):
+            """
+               Set the packet's edns z value.
+               
+               :param z: The value.
+               :type z: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_edns_z(self, z)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_flags(self, flags):
+            """
+               Sets the flags in a packet.
+               
+               :param flags: ORed values: LDNS_QR| LDNS_AR for instance.
+               :type flags: int
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns.ldns_pkt_set_flags(self, flags)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: bool
+
+        def set_id(self, id):
+            """
+               Set the packet's id.
+               
+               :param id: The id to set.
+               :type id: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_id(self, id)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_nscount(self, c):
+            """
+               Set the packet's ns count.
+               
+               :param c: The count.
+               :type c: int
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_nscount(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_opcode(self, c):
+            """
+               Set the packet's opcode.
+               
+               :param c: The opcode.
+               :type c: ldns_pkt_opcode
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_opcode(self, c)
+            #parameters: ldns_pkt *,ldns_pkt_opcode,
+            #retvals: 
+
+        def set_qdcount(self, c):
+            """
+               Set the packet's qd count.
+               
+               :param c: The count.
+               :type c: int
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_qdcount(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def set_qr(self, b):
+            """
+               Set the packet's qr bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_qr(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_querytime(self, t):
+            """
+               Set the packet's query time.
+               
+               :param t: The query time in msec.
+               :type t: uint32_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_querytime(self, t)
+            #parameters: ldns_pkt *,uint32_t,
+            #retvals: 
+
+        def set_question(self, rr):
+            """
+               Directly set the question section.
+               
+               :param rr: The rr list to set.
+               :type rr: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_question(self, rr)
+            #parameters: ldns_pkt *,ldns_rr_list *,
+            #retvals: 
+
+        def set_ra(self, b):
+            """
+               Set the packet's ra bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_ra(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_random_id(self):
+            """
+               Set the packet's id to a random value.
+            """
+            _ldns.ldns_pkt_set_random_id(self)
+            #parameters: ldns_pkt *,
+            #retvals: 
+
+        def set_rcode(self, c):
+            """
+               Set the packet's response code.
+               
+               :param c: The rcode.
+               :type c: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_rcode(self, c)
+            #parameters: ldns_pkt *,uint8_t,
+            #retvals: 
+
+        def set_rd(self, b):
+            """
+               Set the packet's rd bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_rd(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_section_count(self, s, x):
+            """
+               Set a packet's section count to x.
+               
+               :param s: The section.
+               :type s: ldns_pkt_section
+               :param x: The section count.
+               :type x: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_section_count(self, s, x)
+            #parameters: ldns_pkt *,ldns_pkt_section,uint16_t,
+            #retvals: 
+
+        def set_size(self, s):
+            """
+               Set the packet's size.
+               
+               :param s: The size.
+               :type s: int
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_size(self,s)
+            #parameters: ldns_pkt *,size_t,
+            #retvals: 
+
+        def set_tc(self, b):
+            """
+               Set the packet's tc bit.
+               
+               :param b: The value to set.
+               :type b: bool
+            """
+            _ldns.ldns_pkt_set_tc(self, b)
+            #parameters: ldns_pkt *,bool,
+            #retvals: 
+
+        def set_timestamp(self, timeval):
+            """
+               Set the packet's time stamp.
+
+               :param timestamp: The time stamp.
+               :type timestamp: struct timeval
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_pkt_set_timestamp(self, timeval)
+            #parameters: ldns_pkt *,struct timeval,
+            #retvals: 
+
+        def set_tsig(self, t):
+            """
+               Set the packet's tsig rr.
+               
+               :param t: The tsig rr.
+               :type t: :class:`ldns_rr`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_pkt_set_tsig(self, t)
+            #parameters: ldns_pkt *,ldns_rr *,
+            #retvals: 
+
+        def size(self):
+            """
+               Return the packet's size in bytes.
+               
+               :return: (size_t) The size.
+            """
+            return _ldns.ldns_pkt_size(self)
+            #parameters: const ldns_pkt *,
+            #retvals: size_t
+
+        def tc(self):
+            """
+               Read the packet's tc bit.
+               
+               :return: (bool) Value of the bit.
+            """
+            return _ldns.ldns_pkt_tc(self)
+            #parameters: const ldns_pkt *,
+            #retvals: bool
+
+        def timestamp(self):
+            """
+               Return the packet's time stamp.
+               
+               :return: (struct timeval) The time stamp.
+            """
+            return _ldns.ldns_pkt_timestamp(self)
+            #parameters: const ldns_pkt *,
+            #retvals: struct timeval
+
+        def tsig(self):
+            """
+               Return the packet's tsig pseudo rr's.
+               
+               :return: (:class:`ldns_rr`) The tsig rr.
+            """
+            return _ldns._ldns_pkt_tsig(self)
+            #parameters: const ldns_pkt *,
+            #retvals: ldns_rr *
+
+        #
+        # _LDNS_PKT_METHODS#
+        #
+
+        #
+        # LDNS update methods
+        #
+
+        #
+        # LDNS_METHODS_
+        #
+
+        def update_ad(self):
+            """
+               Get the ad count.
+
+               :return: (uint16_t) The ad count.
+            """
+            return _ldns.ldns_update_ad(self)
+            #parameters: ldns_pkt *
+            #retvals: uint16_t
+
+        def update_pkt_tsig_add(self, r):
+            """
+               Add tsig credentials to a packet from a resolver.
+               
+               :param r: Resolver to copy from.
+               :type r: :class:`ldns_resolver`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) Status whether successful or not.
+            """
+            return _ldns.ldns_update_pkt_tsig_add(self, r)
+            #parameters: ldns_pkt *,ldns_resolver *,
+            #retvals: ldns_status
+
+        def update_prcount(self):
+            """
+               Get the pr count.
+               
+               :return: (uint16_t) The pr count.
+            """
+            return _ldns.ldns_update_prcount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def update_set_adcount(self, c):
+            """
+               Set the ad count.
+               
+               :param c: The ad count to set.
+               :type c: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_update_set_adcount(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def update_set_prcount(self, c):
+            """
+               Set the pr count.
+               
+               :param c: The pr count to set.
+               :type c: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_update_set_prcount(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def update_set_upcount(self, c):
+            """
+               Set the up count.
+               
+               :param c: The up count to set.
+               :type c: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_update_set_upcount(self,c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def update_set_zo(self, c):
+            """
+               Set the zo count.
+
+               :param c: The zo count to set.
+               :type c: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_update_set_zo(self, c)
+            #parameters: ldns_pkt *,uint16_t,
+            #retvals: 
+
+        def update_upcount(self):
+            """
+               Get the up count.
+               
+               :return: (uint16_t) The up count.
+            """
+            return _ldns.ldns_update_upcount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        def update_zocount(self):
+            """
+               Get the zo count.
+               
+               :return: (uint16_t) The zo count.
+            """
+            return _ldns.ldns_update_zocount(self)
+            #parameters: const ldns_pkt *,
+            #retvals: uint16_t
+
+        #
+        # _LDNS_METHODS
+        #
+  %}
+} 
diff --git a/contrib/ldns/contrib/python/ldns_rdf.i b/contrib/ldns/contrib/python/ldns_rdf.i
new file mode 100644
index 00000000000000..5d7448fdc45cfa
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_rdf.i
@@ -0,0 +1,886 @@
+/******************************************************************************
+ * ldns_rdf.i: LDNS record data
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/* Creates a temporary instance of (ldns_rdf *). */
+%typemap(in, numinputs=0, noblock=1) (ldns_rdf **)
+{
+  ldns_rdf *$1_rdf = NULL;
+  $1 = &$1_rdf;
+}
+          
+/* Result generation, appends (ldns_rdf *) after the result. */
+%typemap(argout, noblock=1) (ldns_rdf **)
+{
+  $result = SWIG_Python_AppendOutput($result,
+    SWIG_NewPointerObj(SWIG_as_voidptr($1_rdf),
+      SWIGTYPE_p_ldns_struct_rdf, SWIG_POINTER_OWN | 0));
+}
+
+/*
+ * Automatic conversion of const (ldns_rdf *) parameter from string.
+ * Argument default value.
+ */
+%typemap(arginit, noblock=1) const ldns_rdf *
+{
+  char *$1_str = NULL;
+}
+
+/*
+ * Automatic conversion of const (ldns_rdf *) parameter from string.
+ * Preparation of arguments.
+ */
+%typemap(in, noblock=1) const ldns_rdf * (void* argp, $1_ltype tmp = 0, int res)
+{
+  if (Python_str_Check($input)) {
+    $1_str = SWIG_Python_str_AsChar($input);
+    if ($1_str == NULL) {
+      %argument_fail(SWIG_TypeError, "char *", $symname, $argnum);
+    }
+    tmp = ldns_dname_new_frm_str($1_str);
+    if (tmp == NULL) {
+      %argument_fail(SWIG_TypeError, "char *", $symname, $argnum);
+    }
+    $1 = ($1_ltype) tmp;
+  } else {
+    res = SWIG_ConvertPtr($input, &argp, SWIGTYPE_p_ldns_struct_rdf, 0 | 0);
+    if (!SWIG_IsOK(res)) {
+      %argument_fail(res, "ldns_rdf const *", $symname, $argnum);
+    }
+    $1 = ($1_ltype) argp;
+  }
+}
+
+/*
+ * Automatic conversion of const (ldns_rdf *) parameter from string.
+ * Freeing of allocated memory (in Python 3 when daling with strings).
+ */
+%typemap(freearg, noblock=1) const ldns_rdf *
+{
+  if ($1_str != NULL) {
+    /* Is not NULL only when a conversion form string occurred. */
+    SWIG_Python_str_DelForPy3($1_str); /* Is a empty macro for Python < 3. */
+  }
+}
+
+%nodefaultctor ldns_struct_rdf; /* No default constructor. */
+%nodefaultdtor ldns_struct_rdf; /* No default destructor. */
+
+
+/*
+ * This file must contain all %newobject and %delobject tags also for
+ * ldns_dname. This is because the ldns_dname is a derived class from ldns_rdf.
+ */
+
+
+%newobject ldns_rdf_new;
+%newobject ldns_rdf_new_frm_str;
+%newobject ldns_rdf_new_frm_data;
+
+%newobject ldns_rdf_address_reverse;
+%newobject ldns_rdf_clone;
+%newobject ldns_rdf2str;
+
+%newobject ldns_dname_new;
+%newobject ldns_dname_new_frm_str;
+%newobject ldns_dname_new_frm_data;
+
+%newobject ldns_dname_cat_clone;
+%newobject ldns_dname_label;
+%newobject ldns_dname_left_chop;
+%newobject ldns_dname_reverse;
+
+%delobject ldns_rdf_deep_free;
+%delobject ldns_rdf_free;
+
+
+/*
+ * Should the ldns_rdf_new() also be marked as deleting its data parameter?
+ */
+%delobject ldns_rdf_set_data; /* Because data are directly coupled into rdf. */
+
+%rename(ldns_rdf) ldns_struct_rdf;
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_rdf_deep_free) ldns_rdf_deep_free;
+%rename(__ldns_rdf_free) ldns_rdf_free;
+%inline
+%{
+  /*!
+   * @brief Prints information about deallocated rdf and deallocates.
+   */
+  void _ldns_rdf_deep_free (ldns_rdf *r)
+  {
+    printf("******** LDNS_RDF deep free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_rdf_deep_free(r);
+  }
+
+  /*!
+   * @brief Prints information about deallocated rdf and deallocates.
+   */
+  void _ldns_rdf_free (ldns_rdf* r)
+  {
+    printf("******** LDNS_RDF free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_rdf_free(r);
+  }
+%}
+#else /* !LDNS_DEBUG */
+%rename(_ldns_rdf_deep_free) ldns_rdf_deep_free;
+%rename(_ldns_rdf_free) ldns_rdf_free;
+#endif /* LDNS_DEBUG */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+
+%inline
+%{
+	/*!
+	 * @brief returns a human readable string containing rdf type.
+	 */
+	const char *ldns_rdf_type2str(const ldns_rdf *rdf)
+	{
+		if (rdf) {
+			switch(ldns_rdf_get_type(rdf)) {
+			case LDNS_RDF_TYPE_NONE:       return 0;
+			case LDNS_RDF_TYPE_DNAME:      return "DNAME";
+			case LDNS_RDF_TYPE_INT8:       return "INT8";
+			case LDNS_RDF_TYPE_INT16:      return "INT16";
+			case LDNS_RDF_TYPE_INT32:      return "INT32";
+			case LDNS_RDF_TYPE_A:          return "A";
+			case LDNS_RDF_TYPE_AAAA:       return "AAAA";
+			case LDNS_RDF_TYPE_STR:        return "STR";
+			case LDNS_RDF_TYPE_APL:        return "APL";
+			case LDNS_RDF_TYPE_B32_EXT:    return "B32_EXT";
+			case LDNS_RDF_TYPE_B64:        return "B64";
+			case LDNS_RDF_TYPE_HEX:        return "HEX";
+			case LDNS_RDF_TYPE_NSEC:       return "NSEC";
+			case LDNS_RDF_TYPE_TYPE:       return "TYPE";
+			case LDNS_RDF_TYPE_CLASS:      return "CLASS";
+			case LDNS_RDF_TYPE_CERT_ALG:   return "CER_ALG";
+			case LDNS_RDF_TYPE_ALG:        return "ALG";
+			case LDNS_RDF_TYPE_UNKNOWN:    return "UNKNOWN";
+			case LDNS_RDF_TYPE_TIME:       return "TIME";
+			case LDNS_RDF_TYPE_PERIOD:     return "PERIOD";
+			case LDNS_RDF_TYPE_TSIGTIME:   return "TSIGTIME";
+			case LDNS_RDF_TYPE_HIP:        return "HIP";
+			case LDNS_RDF_TYPE_INT16_DATA: return "INT16_DATA";
+			case LDNS_RDF_TYPE_SERVICE:    return "SERVICE";
+			case LDNS_RDF_TYPE_LOC:        return "LOC";
+			case LDNS_RDF_TYPE_WKS:        return "WKS";
+			case LDNS_RDF_TYPE_NSAP:       return "NSAP";
+			case LDNS_RDF_TYPE_ATMA:       return "ATMA";
+			case LDNS_RDF_TYPE_IPSECKEY:   return "IPSECKEY";
+			case LDNS_RDF_TYPE_NSEC3_SALT: return "NSEC3_SALT";
+			case LDNS_RDF_TYPE_NSEC3_NEXT_OWNER:
+			    return "NSEC3_NEXT_OWNER";
+			case LDNS_RDF_TYPE_ILNP64:     return "ILNP64";
+                        case LDNS_RDF_TYPE_EUI48:      return "EUI48";
+                        case LDNS_RDF_TYPE_EUI64:      return "EUI64";
+                        case LDNS_RDF_TYPE_TAG:        return "TAG";
+                        case LDNS_RDF_TYPE_LONG_STR:   return "LONG_STR";
+			case LDNS_RDF_TYPE_AMTRELAY:   return "AMTRELAY";
+                        case LDNS_RDF_TYPE_SVCPARAMS:  return "SVCPARAMS";
+                        case LDNS_RDF_TYPE_CERTIFICATE_USAGE:
+                            return "CERTIFICATE_USAGE";
+                        case LDNS_RDF_TYPE_SELECTOR:   return "SELECTOR";
+                        case LDNS_RDF_TYPE_MATCHING_TYPE:
+                            return "MATCHING_TYPE";
+			}
+		}
+		return 0;
+	}
+%}
+
+
+%inline
+%{
+  /*!
+   * @brief Returns the rdf data organised into a list of bytes.
+   */
+  PyObject * ldns_rdf_data_as_bytearray(const ldns_rdf *rdf)
+  {
+    Py_ssize_t len;
+    uint8_t *data;
+
+    assert(rdf != NULL);
+
+    len = ldns_rdf_size(rdf);
+    data = ldns_rdf_data(rdf);
+
+    return PyByteArray_FromStringAndSize((char *) data, len);
+  }
+%}
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+%feature("docstring") ldns_struct_rdf "Resource record data field.
+
+The data is a network ordered array of bytes, which size is specified
+by the (16-bit) size field. To correctly parse it, use the type
+specified in the (16-bit) type field with a value from ldns_rdf_type."
+
+%extend ldns_struct_rdf {
+ 
+  %pythoncode
+  %{
+        def __init__(self):
+            """
+               Cannot be created directly from Python.
+            """
+            raise Exception("This class can't be created directly. " +
+                "Please use: ldns_rdf_new, ldns_rdf_new_frm_data, " +
+                "ldns_rdf_new_frm_str, ldns_rdf_new_frm_fp, " +
+                "ldns_rdf_new_frm_fp_l")
+       
+        __swig_destroy__ = _ldns._ldns_rdf_deep_free
+
+        #
+        # LDNS_RDF_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def new_frm_str(string, rr_type, raiseException = True):
+            """
+               Creates a new rdf from a string of a given type.
+               
+               :param string: string to use
+               :type string: string
+               :param rr_type: The type of the rdf. See predefined `RDF_TYPE_`
+                   constants.
+               :type rr_type: integer
+               :param raiseException: If True, an exception occurs in case
+                   a RDF object can't be created.
+               :type raiseException: bool
+               :throws TypeError: When parameters of mismatching types.
+               :throws Exception: When raiseException set and rdf couldn't
+                   be created.
+               :return: :class:`ldns_rdf` object or None. If the object
+                   can't be created and `raiseException` is True,
+                   an exception occurs.
+
+               **Usage**
+
+                   >>> rdf = ldns.ldns_rdf.new_frm_str("74.125.43.99", ldns.LDNS_RDF_TYPE_A)
+                   >>> print rdf, rdf.get_type_str()
+                   A 74.125.43.99
+                   >>> name = ldns.ldns_resolver.new_frm_file().get_name_by_addr(rdf)
+                   >>> if (name): print name
+                   99.43.125.74.in-addr.arpa.	85277	IN	PTR	bw-in-f99.google.com.
+            """
+            rr = _ldns.ldns_rdf_new_frm_str(rr_type, string)
+            if (not rr) and raiseException:
+                raise Exception("Can't create query packet")
+            return rr
+
+        #
+        # _LDNS_RDF_CONSTRUCTORS
+        #
+
+        def __str__(self):
+            """
+               Converts the rdata field to presentation format.
+            """
+            return _ldns.ldns_rdf2str(self)
+
+        def __cmp__(self, other):
+            """
+               Compares two rdfs on their wire formats.
+               
+               (To order dnames according to rfc4034, use ldns_dname_compare.)
+               
+               :param other: The second one RDF.
+               :type other: :class:`ldns_rdf`
+               :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+               :return: (int) -1, 0 or 1 if self comes before other,
+                   is equal or self comes after other respectively.
+            """
+            return _ldns.ldns_rdf_compare(self, other)
+
+        def __lt__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is less than 'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) == -1
+
+        def __le__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is less than or equal to
+                    'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) != 1
+
+        def __eq__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is equal to 'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) == 0
+
+        def __ne__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is not equal to 'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) != 0
+
+        def __gt__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is greater than 'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) == 1
+
+        def __ge__(self, other):
+            """
+                Compares two rdfs on their formats.
+
+                :param other: The socond one RDF.
+                :type other: :class:`ldns_rdf`
+                :throws TypeError: When `other` of non-:class:`ldns_rdf` type.
+                :return: (bool) True when `self` is greater than or equal to
+                    'other'.
+            """
+            return _ldns.ldns_rdf_compare(self, other) != -1
+
+        def print_to_file(self, output):
+            """
+               Prints the data in the rdata field to the given `output` file
+               stream (in presentation format).
+            """
+            _ldns.ldns_rdf_print(output, self)
+
+        def get_type_str(self):
+            """
+               Returns the type of the rdf as a human readable string.
+
+               :return: String containing rdf type.
+            """
+            return ldns_rdf_type2str(self)
+
+        def write_to_buffer(self, buffer):
+            """
+               Copies the rdata data to the buffer in wire format.
+               
+               :param buffer: Buffer to append the rdf to.
+               :type param: :class:`ldns_buffer`
+               :throws TypeError: When `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rdf2buffer_wire(buffer, self)
+            #parameters: ldns_buffer *, const ldns_rdf *,
+            #retvals: ldns_status
+
+        def write_to_buffer_canonical(self, buffer):
+            """
+               Copies the rdata data to the buffer in wire format.
+               If the rdata is a dname, the letters will be converted
+               to lower case during the conversion.
+               
+               :param buffer: LDNS buffer.
+               :type buffer: :class:`ldns_buffer`
+               :throws TypeError: When `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rdf2buffer_wire_canonical(buffer, self)
+            #parameters: ldns_buffer *, const ldns_rdf *,
+            #retvals: ldns_status
+
+        #
+        # LDNS_RDF_METHODS_
+        #
+
+        def address_reverse(self):
+            """
+               Reverses an rdf, only actually useful for AAAA and A records.
+               
+               The returned rdf has the type LDNS_RDF_TYPE_DNAME!
+               
+               :return: (:class:`ldns_rdf`) The reversed rdf
+                   (a newly created rdf).
+            """
+            return _ldns.ldns_rdf_address_reverse(self)
+            #parameters: ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def clone(self):
+            """
+               Clones a rdf structure.
+               
+               The data are copied.
+               
+               :return: (:class:`ldns_rdf`) A new rdf structure.
+            """
+            return _ldns.ldns_rdf_clone(self)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def data(self):
+            """
+               Returns the data of the rdf.
+               
+               :return: (uint8_t \*) uint8_t* pointer to the rdf's data.
+            """
+            return _ldns.ldns_rdf_data(self)
+            #parameters: const ldns_rdf *,
+            #retvals: uint8_t *
+
+        def data_as_bytearray(self):
+            """
+               Returns the data of the rdf as a bytearray.
+
+               :return: (bytearray) Bytearray containing the rdf data.
+            """
+            return _ldns.ldns_rdf_data_as_bytearray(self)
+            #parameters: const ldns_rdf *,
+            #retvals: bytearray
+
+        def get_type(self):
+            """
+               Returns the type of the rdf.
+               
+               We need to prepend the prefix get_ here to prevent conflict
+               with the rdf_type TYPE.
+               
+               :return: (ldns_rdf_type) Identifier of the type.
+            """
+            return _ldns.ldns_rdf_get_type(self)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf_type
+
+        def set_data(self, data):
+            """
+               Sets the data portion of the rdf.
+
+               The data are not copied, but are assigned to the rdf,
+               `data` are decoupled from the Python engine.
+               
+               :param data: Data to be set.
+               :type data: void \*
+            """
+            _ldns.ldns_rdf_set_data(self, data)
+            #parameters: ldns_rdf *, void *,
+            #retvals: 
+
+        def set_size(self, size):
+            """
+               Sets the size of the rdf.
+               
+               :param size: The new size.
+               :type size: integer
+               :throws TypeError: When size of non-integer type.
+            """
+            _ldns.ldns_rdf_set_size(self,size)
+            #parameters: ldns_rdf *,size_t,
+            #retvals: 
+
+        def set_type(self, atype):
+            """
+               Sets the type of the rdf.
+               
+               :param atype: rdf type
+               :type atype: integer
+               :throws TypeError: When atype of non-integer type.
+            """
+            _ldns.ldns_rdf_set_type(self, atype)
+            #parameters: ldns_rdf *, ldns_rdf_type,
+            #retvals: 
+
+        def size(self):
+            """
+               Returns the size of the rdf.
+               
+               :return: (size_t) uint16_t with the size.
+            """
+            return _ldns.ldns_rdf_size(self)
+            #parameters: const ldns_rdf *,
+            #retvals: size_t
+
+        @staticmethod
+        def dname_new_frm_str(string):
+            """
+               Creates a new dname rdf instance from a given string.
+            
+               This static method is equivalent to using of default
+               :class:`ldns_rdf` constructor.
+ 
+               :parameter string: String to use.
+               :type string: string
+               :throws TypeError: When not a string used.
+               :return: :class:`ldns_rdf` or None if error.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Use
+                   :class:`ldns_dname` constructor instead.
+            """
+            warnings.warn("The ldns_rdf.dname_new_frm_str() method is" +
+                " scheduled to be deprecated in future releases." +
+                " Use ldns_dname constructor instead.",
+                PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_new_frm_str(string)
+
+        def absolute(self):
+            """
+               Checks whether the given dname string is absolute
+               (i.e., ends with a '.').
+
+               :return: (bool) True or False
+
+               .. note::
+
+                   This method was malfunctioning in ldns-1.3.16 and also
+                   possibly earlier.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname` to use the method.
+            """
+            warnings.warn("The ldns_rdf.absolute() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            if self.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                string = self.__str__()
+                return _ldns.ldns_dname_str_absolute(string) != 0
+            else:
+                return False
+
+        def make_canonical(self):
+            """
+               Put a dname into canonical format (i.e., convert to lower case).
+
+               Performs no action if not a dname.
+
+               .. warning::
+
+                   This method is scheduled to be deprecated and removed.
+                   Convert :class:`ldns_rdf` to :class:`ldns_dname` to use
+                   the method.
+            """
+            warnings.warn("The ldns_rdf.make_canonical() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            _ldns.ldns_dname2canonical(self)
+
+        def dname_compare(self, other):
+            """
+               Compares two dname rdf according to the algorithm
+               for ordering in RFC4034 Section 6.
+
+               :param other: The second dname rdf to compare.
+               :type other: :class:`ldns_rdf`
+               :throws TypeError: When not a :class:`ldns_rdf` used.
+               :throws Exception: When not dnames compared.
+               :return: (int) -1, 0 or 1 if `self` comes before `other`,
+                   `self` is equal or `self` comes after `other` respectively.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.dname_compare() method is" +
+                " scheduled to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if not isinstance(other, ldns_rdf):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (self.get_type() != _ldns.LDNS_RDF_TYPE_DNAME) or \
+               (other.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Both operands must be dname rdfs.")
+            return _ldns.ldns_dname_compare(self, other)
+
+        def cat(self, rd2):
+            """
+               Concatenates `rd2` after `this` dname (`rd2` is copied,
+               `this` dname is modified).
+               
+               :param rd2: The right-hand side.
+               :type rd2: :class:`ldns_rdf`
+               :throws TypeError: When `rd2` of non-:class:`ldns_rdf` or
+                   non-:class:`ldns_dname` type.
+               :return: (ldns_status) LDNS_STATUS_OK on success.
+
+               .. warning::
+
+                  It is scheduled to be deprecated and removed. Convert
+                  :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.cat() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_cat(self, rd2)
+            #parameters: ldns_rdf *, ldns_rdf *,
+            #retvals: ldns_status
+
+        def cat_clone(self, rd2):
+            """
+               Concatenates two dnames together.
+
+               :param rd2: The right-hand side.
+               :type rd2: :class:`ldns_rdf`
+               :throws TypeError: When `rd2` of non-:class:`ldns_rdf` or
+                   non-:class:`ldns_dname` type.
+               :return: (:class:`ldns_rdf`) A new rdf with
+                   left-hand side + right-hand side content None when
+                   error.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.cat_clone() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_cat_clone(self, rd2)
+            #parameters: const ldns_rdf *, const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def interval(self, middle, next):
+            """
+               Check whether the `middle` lays in the interval defined by
+               `this` and `next` (`this` <= `middle` < `next`).
+
+               This method is useful for nsec checking
+
+               :param middle: The dname to check.
+               :type middle: :class:`ldns_rdf`
+               :param next: The boundary.
+               :type next: :class:`ldns_rdf`
+               :throws TypeError: When `middle` or `next` of
+                   non-:class:`ldns_rdf` type.
+               :throws Exception: When non-dname rdfs compared.
+               :return: (int) 0 on error or unknown,
+                   -1 when middle is in the interval, 1 when not.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.interval() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            #
+            # The wrapped function generates asserts instead of setting
+            # error status. They cannot be caught from Python so a check
+            # is necessary. 
+            #
+            if (not isinstance(middle, ldns_rdf)) or \
+               (not isinstance(next, ldns_rdf)):
+                raise TypeError("Parameters must be derived from ldns_rdf.")
+            if (self.get_type() != _ldns.LDNS_RDF_TYPE_DNAME) or \
+               (middle.get_type() != _ldns.LDNS_RDF_TYPE_DNAME) or \
+               (next.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("All operands must be dname rdfs.")
+            return _ldns.ldns_dname_interval(self, middle, next)
+            #parameters: const ldns_rdf *, const ldns_rdf *, const ldns_rdf *,
+            #retvals: int
+
+        def is_subdomain(self, parent):
+            """
+               Tests whether the name of the given instance falls under
+               `parent` (i.e., is a sub-domain of `parent`).
+
+               This function will return False if the given dnames
+               are equal.
+               
+               :param parent: The parent's name.
+               :type parent: :class:`ldns_rdf`
+               :throws TypeError: When `parent` of non-:class:`ldns_rdf` type.
+               :return: (bool) True if `this` falls under `parent`, otherwise
+                   False.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.is_subdomain() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_is_subdomain(self, parent)
+            #parameters: const ldns_rdf *, const ldns_rdf *,
+            #retvals: bool
+
+        def label(self, labelpos):
+            """
+               Look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try
+               and retrieve a specific label.
+               
+               The labels are numbered starting from 0 (left most).
+               
+               :param labelpos: Index of the label. (Labels are numbered
+                   0, which is the left most.)
+               :type labelpos: integer
+               :throws TypeError: When `labelpos` of non-integer type.
+               :return: (:class:`ldns_rdf`) A new rdf with the label
+                   as name or None on error.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.label() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_label(self, labelpos)
+            #parameters: const ldns_rdf *, uint8_t,
+            #retvals: ldns_rdf *
+
+        def label_count(self):
+            """
+               Count the number of labels inside a LDNS_RDF_DNAME type rdf.
+               
+               :return: (uint8_t) The number of labels. Will return 0 if
+                   not a dname.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.label_count() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_label_count(self)
+            #parameters: const ldns_rdf *,
+            #retvals: uint8_t
+
+        def left_chop(self):
+            """
+               Chop one label off the left side of a dname.
+               
+               (e.g., wwww.nlnetlabs.nl, becomes nlnetlabs.nl)
+               
+               :return: (:class:`ldns_rdf`) The remaining dname or None when
+                   error.
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.left_chop() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            return _ldns.ldns_dname_left_chop(self)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        def reverse(self):
+            """
+               Returns a clone of the given dname with the labels reversed.
+
+               When reversing non-dnames a "." (root name) dname is returned.
+
+               :throws Exception: When used on non-dname rdfs.
+               :return: (:class:`ldns_rdf`) Clone of the dname with the labels
+                   reversed or ".".
+
+               .. warning::
+
+                   It is scheduled to be deprecated and removed. Convert
+                   :class:`ldns_rdf` to :class:`ldns_dname`.
+            """
+            warnings.warn("The ldns_rdf.reverse() method is scheduled" +
+                " to be deprecated in future releases." +
+                " Convert the ldns_rdf to ldns_dname and the use its" +
+                " methods.", PendingDeprecationWarning, stacklevel=2)
+            if self.get_type() != _ldns.LDNS_RDF_TYPE_DNAME:
+                raise Exception("Operand must be a dname rdf.")
+            return _ldns.ldns_dname_reverse(self)
+            #parameters: const ldns_rdf *,
+            #retvals: ldns_rdf *
+
+        #
+        # _LDNS_RDF_METHODS
+        #
+  %}
+} 
diff --git a/contrib/ldns/contrib/python/ldns_resolver.i b/contrib/ldns/contrib/python/ldns_resolver.i
new file mode 100644
index 00000000000000..8468cce3819ba9
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_resolver.i
@@ -0,0 +1,1454 @@
+/******************************************************************************
+ * ldns_resolver.i: LDNS resolver class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/* Creates temporary instance of (ldns_resolver *). */
+%typemap(in,numinputs=0,noblock=1) (ldns_resolver **r)
+{
+  ldns_resolver *$1_res;
+  $1 = &$1_res;
+}
+          
+/* Result generation, appends (ldns_resolver *) after the result. */
+%typemap(argout,noblock=1) (ldns_resolver **r)
+{
+  $result = SWIG_Python_AppendOutput($result,
+    SWIG_NewPointerObj(SWIG_as_voidptr($1_res),
+      SWIGTYPE_p_ldns_struct_resolver, SWIG_POINTER_OWN |  0 ));
+}
+
+%newobject ldns_resolver_new;
+%newobject ldns_resolver_pop_nameserver;
+%newobject ldns_resolver_query;
+%newobject ldns_resolver_search;
+%newobject ldns_axfr_next;
+%newobject ldns_get_rr_list_addr_by_name;
+%newobject ldns_get_rr_list_name_by_addr;
+
+%delobject ldns_resolver_deep_free;
+%delobject ldns_resolver_free;
+
+%nodefaultctor ldns_struct_resolver; /* No default constructor. */
+%nodefaultdtor ldns_struct_resolver; /* No default destructor. */
+
+%ignore ldns_struct_resolver::_searchlist;
+%ignore ldns_struct_resolver::_nameservers;
+%ignore ldns_resolver_set_nameservers;
+
+%rename(ldns_resolver) ldns_struct_resolver;
+
+
+/* Clone data on pull. */
+
+%newobject _ldns_axfr_last_pkt;
+%rename(__ldns_axfr_last_pkt) ldns_axfr_last_pkt;
+%inline
+%{
+  ldns_pkt * _ldns_axfr_last_pkt(const ldns_resolver *res)
+  {
+    return ldns_pkt_clone(ldns_axfr_last_pkt(res));
+  }
+%}
+
+%newobject _ldns_resolver_dnssec_anchors;
+%rename(__ldns_resolver_dnssec_anchors) ldns_resolver_dnssec_anchors;
+%inline
+%{
+  ldns_rr_list * _ldns_resolver_dnssec_anchors(const ldns_resolver *res)
+  {
+    return ldns_rr_list_clone(ldns_resolver_dnssec_anchors(res));
+  }
+%}
+
+%newobject _ldns_resolver_domain;
+%rename(__ldns_resolver_domain) ldns_resolver_domain;
+%inline
+%{
+  ldns_rdf * _ldns_resolver_domain(const ldns_resolver *res)
+  {
+    /* Prevents assertion failures. */
+    ldns_rdf *rdf;
+    rdf = ldns_resolver_domain(res);
+    if (rdf != NULL) {
+      rdf = ldns_rdf_clone(rdf);
+    }
+    return rdf;
+  }
+%}
+
+%newobject _ldns_resolver_tsig_algorithm;
+%rename(__ldns_resolver_tsig_algorithm) ldns_resolver_tsig_algorithm;
+%inline
+%{
+  const char * _ldns_resolver_tsig_algorithm(const ldns_resolver *res)
+  {
+    const char *str;
+    str = ldns_resolver_tsig_algorithm(res);
+    if (str != NULL) {
+      str = strdup(str);
+    }
+    return str;
+  }
+%}
+
+%newobject _ldns_resolver_tsig_keydata;
+%rename(__ldns_resolver_tsig_keydata) ldns_resolver_tsig_keydata;
+%inline
+%{
+  const char * _ldns_resolver_tsig_keydata(const ldns_resolver *res)
+  {
+    const char *str;
+    str = ldns_resolver_tsig_keydata(res);
+    if (str != NULL) {
+      str = strdup(str);
+    }
+    return str;
+  }
+%}
+
+%newobject _ldns_resolver_tsig_keyname;
+%rename(__ldns_resolver_tsig_keyname) ldns_resolver_tsig_keyname;
+%inline
+%{
+  const char * _ldns_resolver_tsig_keyname(const ldns_resolver *res)
+  {
+    const char *str;
+    str = ldns_resolver_tsig_keyname(res);
+    if (str != NULL) {
+      str = strdup(str);
+    }
+    return str;
+  }
+%}
+
+/* End of pull cloning. */
+
+/* Clone data on push. */
+
+%rename(__ldns_resolver_set_dnssec_anchors) ldns_resolver_set_dnssec_anchors;
+%inline
+%{
+  void _ldns_resolver_set_dnssec_anchors(ldns_resolver *res,
+    ldns_rr_list * rrl)
+  {
+    ldns_rr_list *rrl_clone = NULL;
+    if (rrl != NULL) {
+      rrl_clone = ldns_rr_list_clone(rrl);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_resolver_set_dnssec_anchors(res, rrl_clone);
+  }
+%}
+
+%rename(__ldns_resolver_set_domain) ldns_resolver_set_domain;
+%inline
+%{
+  void _ldns_resolver_set_domain(ldns_resolver *res, ldns_rdf *rdf)
+  {
+    ldns_rdf *rdf_clone = NULL;
+    if (rdf != NULL) {
+      rdf_clone = ldns_rdf_clone(rdf);
+    }
+    /* May leak memory, when overwriting pointer value. */
+    ldns_resolver_set_domain(res, rdf_clone);
+  }
+%}
+
+/* End of push cloning. */
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_resolver_deep_free) ldns_resolver_deep_free;
+%rename(__ldns_resolver_free) ldns_resolver_free;
+%inline
+%{
+  /*!
+   * @brief Prints information about deallocated resolver and deallocates.
+   */
+  void _ldns_resolver_deep_free(ldns_resolver *r)
+  {
+    printf("******** LDNS_RESOLVER deep free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_resolver_deep_free(r);
+  }
+
+  /*!
+   * @brief Prints information about deallocated resolver and deallocates.
+   *
+   * @note There should be no need to use this function in the wrapper code, as
+   *    it is likely to leak memory.
+   */
+  void _ldns_resolver_free(ldns_resolver *r)
+  {
+    printf("******** LDNS_RESOLVER free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_resolver_free(r);
+  }
+%}
+#else /* !LDNS_DEBUG */
+%rename(_ldns_resolver_deep_free) ldns_resolver_deep_free;
+%rename(_ldns_resolver_free) ldns_resolver_free;
+#endif /* LDNS_DEBUG */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+%newobject _replacement_ldns_resolver_trusted_key;
+%inline
+%{
+  /*!
+   * @brief Replaces the rrs in the list with their clones.
+   *
+   * Prevents memory corruption when automatically deallocating list content.
+   */
+  void _rr_list_replace_content_with_clones(ldns_rr_list *rrl)
+  {
+    size_t count;
+    unsigned int i;
+
+    if (rrl == NULL) {
+      return;
+    }
+
+    count = ldns_rr_list_rr_count(rrl);
+    for (i = 0; i < count; ++i) {
+      ldns_rr_list_set_rr(rrl,
+        ldns_rr_clone(ldns_rr_list_rr(rrl, i)),
+        i);
+    }
+  }
+
+  /*
+   * @brief Behaves similarly to ldns_resolver_trusted_key().
+   *
+   * Prevents memory leakage by controlling the usage of content cloning.
+   *
+   * @return Newly allocated list of trusted key clones if any found,
+   *     NULL else.
+   */
+  ldns_rr_list * _replacement_ldns_resolver_trusted_key(
+    const ldns_resolver *res, ldns_rr_list *keys)
+  {
+    ldns_rr_list *trusted_keys = ldns_rr_list_new();
+
+    if (ldns_resolver_trusted_key(res, keys, trusted_keys)) {
+      _rr_list_replace_content_with_clones(trusted_keys);
+    } else {
+      ldns_rr_list_deep_free(trusted_keys); trusted_keys = NULL;
+    }
+
+    return trusted_keys;
+  }
+%}
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+%feature("docstring") ldns_struct_resolver "LDNS resolver object. 
+
+The :class:`ldns_resolver` object keeps a list of name servers and can perform
+queries.
+
+**Usage**
+
+>>> import ldns
+>>> resolver = ldns.ldns_resolver.new_frm_file(\"/etc/resolv.conf\")
+>>> pkt = resolver.query(\"www.nic.cz\", ldns.LDNS_RR_TYPE_A,ldns.LDNS_RR_CLASS_IN)
+>>> if (pkt) and (pkt.answer()): 
+>>>    print pkt.answer()
+www.nic.cz.	1757	IN	A	217.31.205.50
+
+This simple example instances a resolver in order to resolve www.nic.cz A type
+record."
+
+%extend ldns_struct_resolver {
+ 
+  %pythoncode
+  %{
+        def __init__(self):
+            """
+               Cannot be created directly from Python.
+            """
+            raise Exception("This class can't be created directly. " +
+                "Please use: new_frm_file(filename), new_frm_fp(file) " +
+                "or new_frm_fp_l(file, line)")
+
+        __swig_destroy__ = _ldns._ldns_resolver_deep_free
+
+        #
+        # LDNS_RESOLVER_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def new():
+            """
+               Creates a new resolver object.
+
+               :return: (:class:`ldns_resolver`) New resolver object or None.
+
+               .. note::
+                   The returned resolver object is unusable unless some
+                   name servers are added.
+
+               **Usage**
+                 >>> resolver = ldns.ldns_resolver.new()
+                 >>> ns_addr = ldns.ldns_rdf.new_frm_str("8.8.8.8", ldns.LDNS_RDF_TYPE_A)
+                 >>> if not ns_addr: raise Exception("Can't create resolver address.")
+                 >>> status = resolver.push_nameserver(ns_addr)
+                 >>> if status != ldns.LDNS_STATUS_OK: raise Exception("Can't push resolver address.")
+                 >>> pkt = resolver.query("www.nic.cz.", ldns.LDNS_RR_TYPE_A, ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+                 >>> if (pkt) and (pkt.answer()):
+                 >>>     print pkt.answer()
+                 www.nic.cz.     1265    IN      A       217.31.205.50
+            """
+            return _ldns.ldns_resolver_new()
+
+        @staticmethod
+        def new_frm_file(filename = "/etc/resolv.conf", raiseException=True):
+            """
+               Creates a resolver object from given file name
+               
+               :param filename: Name of file which contains resolver
+                   information (usually /etc/resolv.conf).
+               :type filename: str
+               :param raiseException: If True, an exception occurs in case a
+                   resolver object can't be created.
+               :type raiseException: bool
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `raiseException` set and resolver
+                   couldn't be created.
+               :return: (:class:`ldns_resolver`) Resolver object or None.
+                   An exception occurs if the object can't be created and
+                   'raiseException' is True.
+            """
+            status, resolver = _ldns.ldns_resolver_new_frm_file(filename)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create resolver, error: %d" % status)
+                return None
+            return resolver
+
+        @staticmethod
+        def new_frm_fp(file, raiseException=True):
+            """
+               Creates a resolver object from file
+               
+               :param file: A file object.
+               :type file: file
+               :param raiseException: If True, an exception occurs in case a
+                   resolver object can't be created.
+               :type raiseException: bool
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `raiseException` set and resolver
+                   couldn't be created.
+               :return: (:class:`ldns_resolver`) Resolver object or None.
+                   An exception occurs if the object can't be created and
+                   `raiseException` is True.
+            """
+            status, resolver = _ldns.ldns_resolver_new_frm_fp(file)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create resolver, error: %d" % status)
+                return None
+            return resolver
+
+        @staticmethod
+        def new_frm_fp_l(file, raiseException=True):
+            """
+               Creates a resolver object from file
+               
+               :param file: A file object.
+               :type file: file
+               :param raiseException: If True, an exception occurs in case a
+                   resolver instance can't be created.
+               :type raiseException: bool
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `raiseException` set and resolver
+                   couldn't be created.
+               :return: 
+                  * (:class:`ldns_resolver`) Resolver instance or None.
+                      An exception occurs if an instance can't be created and
+                      `raiseException` is True.
+
+                  * (int) - The line number. (e.g., for debugging)
+            """
+            status, resolver, line = _ldns.ldns_resolver_new_frm_fp_l(file)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create resolver, error: %d" % status)
+                return None
+            return resolver, line
+
+        #
+        # _LDNS_RESOLVER_CONSTRUCTORS
+        #
+
+        # High level functions
+
+        def get_addr_by_name(self, name, aclass = _ldns.LDNS_RR_CLASS_IN, flags = _ldns.LDNS_RD):
+            """
+               Ask the resolver about name and return all address records.
+
+               :param name: The name to look for. String is automatically
+                   converted to dname.
+               :type name: :class:`ldns_dname` or str
+               :param aclass: The class to use.
+               :type aclass: ldns_rr_class
+               :param flags: Give some optional flags to the query.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) RR List object or None.
+
+               **Usage**
+                 >>> addr = resolver.get_addr_by_name("www.google.com", ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+                 >>> if (not addr): raise Exception("Can't retrieve server address")
+                 >>> for rr in addr.rrs():
+                 >>>     print rr
+                 www.l.google.com.	300	IN	A	74.125.43.99
+                 www.l.google.com.	300	IN	A	74.125.43.103
+                 www.l.google.com.	300	IN	A	74.125.43.104
+                 www.l.google.com.	300	IN	A	74.125.43.147
+            """
+            rdf = name
+            if isinstance(name, str):
+                rdf =  _ldns.ldns_dname_new_frm_str(name)
+            return _ldns.ldns_get_rr_list_addr_by_name(self, rdf, aclass, flags)
+
+        def get_name_by_addr(self, addr, aclass = _ldns.LDNS_RR_CLASS_IN, flags = _ldns.LDNS_RD):
+            """
+               Ask the resolver about the address and return the name.
+
+               :param name: (ldns_rdf of A or AAAA type) the addr to look for.
+                   If a string is given, A or AAAA type is identified
+                   automatically.
+               :type name: :class:`ldns_rdf` of A or AAAA type
+               :param aclass: The class to use.
+               :type aclass: ldns_rr_class
+               :param flags: Give some optional flags to the query.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) RR List object or None.
+
+               **Usage**
+                 >>> addr = resolver.get_name_by_addr("74.125.43.99", ldns.LDNS_RR_CLASS_IN, ldns.LDNS_RD)
+                 >>> if (not addr): raise Exception("Can't retrieve server address")
+                 >>> for rr in addr.rrs():
+                 >>>     print rr
+                 99.43.125.74.in-addr.arpa.	85641	IN	PTR	bw-in-f99.google.com.
+                    
+            """
+            rdf = addr
+            if isinstance(addr, str):
+                if (addr.find("::") >= 0): #IPv6
+                    rdf = _ldns.ldns_rdf_new_frm_str(_ldns.LDNS_RDF_TYPE_AAAA, addr)
+                else:
+                    rdf = _ldns.ldns_rdf_new_frm_str(_ldns.LDNS_RDF_TYPE_A, addr)
+            return _ldns.ldns_get_rr_list_name_by_addr(self, rdf, aclass, flags)
+
+        def print_to_file(self,output):
+            """Print a resolver (in so far that is possible) state to output."""
+            _ldns.ldns_resolver_print(output,self)
+
+        def axfr_complete(self):
+            """
+               Returns True if the axfr transfer has completed
+               (i.e., 2 SOA RRs and no errors were encountered).
+
+               :return: (bool)
+            """
+            return _ldns.ldns_axfr_complete(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def axfr_last_pkt(self):
+            """
+               Returns a last packet that was sent by the server in the AXFR
+               transfer (usable for instance to get the error code on failure).
+
+               :return: (:class:`ldns_pkt`) Last packet of the AXFR transfer.
+            """
+            return _ldns._ldns_axfr_last_pkt(self)
+            #parameters: const ldns_resolver *,
+            #retvals: ldns_pkt *
+
+        def axfr_next(self):
+            """
+               Get the next stream of RRs in a AXFR.
+
+               :return: (:class:`ldns_rr`) The next RR from the AXFR stream.
+            """
+            return _ldns.ldns_axfr_next(self)
+            #parameters: ldns_resolver *,
+            #retvals: ldns_rr *
+
+        def axfr_start(self, domain, aclass):
+            """
+               Prepares the resolver for an axfr query. The query is sent and
+               the answers can be read with :meth:`axfr_next`.
+
+               :param domain: Domain to axfr.
+               :type domain: :class:`dlsn_dname`
+               :param aclass: The class to use.
+               :type aclass: ldns_rr_class
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) The status of the transfer.
+
+               .. note::
+                   The type checking of parameter `domain` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+
+               **Usage**
+               ::
+    
+                  status = resolver.axfr_start("nic.cz", ldns.LDNS_RR_CLASS_IN)
+                  if (status != ldns.LDNS_STATUS_OK):
+                      raise Exception("Can't start AXFR, error: %s" % ldns.ldns_get_errorstr_by_id(status))
+                  #Print the results
+                  while True:
+                       rr = resolver.axfr_next()
+                       if not rr: 
+                          break
+
+                       print rr
+            """
+            # TODO -- Add checking for ldns_rdf and ldns_dname.
+            rdf = domain
+            if isinstance(domain, str):
+                rdf = _ldns.ldns_dname_new_frm_str(domain)
+            return _ldns.ldns_axfr_start(self, rdf, aclass)
+            #parameters: ldns_resolver *resolver, ldns_rdf *domain, ldns_rr_class c
+            #retvals: int
+
+        #
+        # LDNS_RESOLVER_METHODS_
+        #
+
+        def debug(self):
+            """
+               Get the debug status of the resolver.
+               
+               :return: (bool) True if so, otherwise False.
+            """
+            return _ldns.ldns_resolver_debug(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def dec_nameserver_count(self):
+            """
+               Decrement the resolver's name server count.
+            """
+            _ldns.ldns_resolver_dec_nameserver_count(self)
+            #parameters: ldns_resolver *,
+            #retvals: 
+
+        def defnames(self):
+            """
+               Does the resolver apply default domain name.
+
+               :return: (bool)
+            """
+            return _ldns.ldns_resolver_defnames(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def dnsrch(self):
+            """
+               Does the resolver apply search list.
+
+               :return: (bool)
+            """
+            return _ldns.ldns_resolver_dnsrch(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def dnssec(self):
+            """
+               Does the resolver do DNSSEC.
+               
+               :return: (bool) True: yes, False: no.
+            """
+            return _ldns.ldns_resolver_dnssec(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def dnssec_anchors(self):
+            """
+               Get the resolver's DNSSEC anchors.
+               
+               :return: (:class:`ldns_rr_list`) An rr list containing trusted
+                   DNSSEC anchors.
+            """
+            return _ldns._ldns_resolver_dnssec_anchors(self)
+            #parameters: const ldns_resolver *,
+            #retvals: ldns_rr_list *
+
+        def dnssec_cd(self):
+            """
+               Does the resolver set the CD bit.
+               
+               :return: (bool) True: yes, False: no.
+            """
+            return _ldns.ldns_resolver_dnssec_cd(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def domain(self):
+            """
+               What is the default dname to add to relative queries.
+               
+               :return: (:class:`ldns_dname`) The dname which is added.
+            """
+            dname = _ldns._ldns_resolver_domain(self)
+            if dname != None:
+                return ldns_dname(_ldns._ldns_resolver_domain(self), clone=False)
+            else:
+                return dname
+            #parameters: const ldns_resolver *,
+            #retvals: ldns_rdf *
+
+        def edns_udp_size(self):
+            """
+               Get the resolver's udp size.
+               
+               :return: (uint16_t) The udp mesg size.
+            """
+            return _ldns.ldns_resolver_edns_udp_size(self)
+            #parameters: const ldns_resolver *,
+            #retvals: uint16_t
+
+        def fail(self):
+            """
+               Does the resolver only try the first name server.
+               
+               :return: (bool) True: yes, fail, False: no, try the others.
+            """
+            return _ldns.ldns_resolver_fail(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def fallback(self):
+            """
+               Get the truncation fall-back status.
+               
+               :return: (bool) Whether the truncation fall*back mechanism
+                   is used.
+            """
+            return _ldns.ldns_resolver_fallback(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def igntc(self):
+            """
+               Does the resolver ignore the TC bit (truncated).
+               
+               :return: (bool) True: yes, False: no.
+            """
+            return _ldns.ldns_resolver_igntc(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def incr_nameserver_count(self):
+            """
+               Increment the resolver's name server count.
+            """
+            _ldns.ldns_resolver_incr_nameserver_count(self)
+            #parameters: ldns_resolver *,
+            #retvals: 
+
+        def ip6(self):
+            """
+               Does the resolver use ip6 or ip4.
+               
+               :return: (uint8_t) 0: both, 1: ip4, 2:ip6
+            """
+            return _ldns.ldns_resolver_ip6(self)
+            #parameters: const ldns_resolver *,
+            #retvals: uint8_t
+
+        def nameserver_count(self):
+            """
+               How many name server are configured in the resolver.
+               
+               :return: (size_t) Number of name servers.
+            """
+            return _ldns.ldns_resolver_nameserver_count(self)
+            #parameters: const ldns_resolver *,
+            #retvals: size_t
+
+        def nameserver_rtt(self, pos):
+            """
+               Return the used round trip time for a specific name server.
+               
+               :param pos: The index to the name server.
+               :type pos: size_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (size_t) The rrt, 0: infinite,
+                   >0: undefined (as of * yet).
+            """
+            return _ldns.ldns_resolver_nameserver_rtt(self, pos)
+            #parameters: const ldns_resolver *,size_t,
+            #retvals: size_t
+
+        def nameservers(self):
+            """
+               Return the configured name server ip address.
+               
+               :return: (ldns_rdf \*\*) A ldns_rdf pointer to a list of the
+                   addresses.
+            """
+            # TODO -- Convert to list of ldns_rdf.
+            return _ldns.ldns_resolver_nameservers(self)
+            #parameters: const ldns_resolver *,
+            #retvals: ldns_rdf **
+
+        def nameservers_randomize(self):
+            """
+               Randomize the name server list in the resolver.
+            """
+            _ldns.ldns_resolver_nameservers_randomize(self)
+            #parameters: ldns_resolver *,
+            #retvals: 
+
+        def pop_nameserver(self):
+            """
+               Pop the last name server from the resolver.
+               
+               :return: (:class:`ldns_rdf`) The popped address or None if empty.
+            """
+            return _ldns.ldns_resolver_pop_nameserver(self)
+            #parameters: ldns_resolver *,
+            #retvals: ldns_rdf *
+
+        def port(self):
+            """
+               Get the port the resolver should use.
+               
+               :return: (uint16_t) The port number.
+            """
+            return _ldns.ldns_resolver_port(self)
+            #parameters: const ldns_resolver *,
+            #retvals: uint16_t
+
+        def prepare_query_pkt(self, name, t, c, f, raiseException=True):
+            """
+               Form a query packet from a resolver and name/type/class combo.
+               
+               :param name: Query for this name.
+               :type name: :class:`ldns_dname` or str
+               :param t: Query for this type (may be 0, defaults to A).
+               :type t: ldns_rr_type
+               :param c: Query for this class (may be 0, default to IN).
+               :type c: ldns_rr_class
+               :param f: The query flags.
+               :type f: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `raiseException` set and answer
+                   couldn't be resolved.
+               :return: (:class:`ldns_pkt`) Query packet or None.
+                   An exception occurs if the object can't be created and
+                   'raiseException' is True.
+            """
+            rdf = name
+            if isinstance(name, str):
+                rdf = _ldns.ldns_dname_new_frm_str(name)
+            status, pkt = _ldns.ldns_resolver_prepare_query_pkt(self, rdf, t, c, f)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create resolver, error: %d" % status)
+                return None
+            return pkt
+            #parameters: ldns_resolver *,const ldns_rdf *,ldns_rr_type,ldns_rr_class,uint16_t,
+            #retvals: ldns_status,ldns_pkt **
+
+        def push_dnssec_anchor(self, rr):
+            """
+               Push a new trust anchor to the resolver.
+               It must be a DS or DNSKEY rr.
+               
+               :param rr: The RR to add as a trust anchor.
+               :type rr: DS of DNSKEY :class:`ldns_rr`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) A status.
+            """
+            return _ldns.ldns_resolver_push_dnssec_anchor(self, rr)
+            #parameters: ldns_resolver *,ldns_rr *,
+            #retvals: ldns_status
+
+        def push_nameserver(self, n):
+            """
+               Push a new name server to the resolver.
+               It must be an IP address v4 or v6.
+               
+               :param n: The ip address.
+               :type n: :class:`ldns_rdf` of A or AAAA type.
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) A status.
+            """
+            return _ldns.ldns_resolver_push_nameserver(self, n)
+            #parameters: ldns_resolver *,ldns_rdf *,
+            #retvals: ldns_status
+
+        def push_nameserver_rr(self, rr):
+            """
+               Push a new name server to the resolver.
+               It must be an A or AAAA RR record type.
+               
+               :param rr: The resource record.
+               :type rr: :class:`ldns_rr` of A or AAAA type.
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) A status.
+            """
+            return _ldns.ldns_resolver_push_nameserver_rr(self, rr)
+            #parameters: ldns_resolver *,ldns_rr *,
+            #retvals: ldns_status
+
+        def push_nameserver_rr_list(self, rrlist):
+            """
+               Push a new name server rr_list to the resolver.
+               
+               :param rrlist: The rr list to push.
+               :type rrlist: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (ldns_status) A status.
+            """
+            return _ldns.ldns_resolver_push_nameserver_rr_list(self, rrlist)
+            #parameters: ldns_resolver *,ldns_rr_list *,
+            #retvals: ldns_status
+
+        def push_searchlist(self, rd):
+            """
+               Push a new rd to the resolver's search-list.
+               
+               :param rd: To push.
+               :param rd: :class:`ldns_dname` or str
+               :throws TypeError: When arguments of inappropriate types.
+
+               .. note:
+                   The function does not return any return status,
+                   so the caller must ensure the correctness of the passed
+                   values.
+            """
+            rdf = rd
+            if isinstance(rd, str):
+                rdf = _ldns.ldns_dname_new_frm_str(rd)
+            _ldns.ldns_resolver_push_searchlist(self, rdf)
+            #parameters: ldns_resolver *,ldns_rdf *,
+            #retvals: 
+
+        def query(self,name,atype=_ldns.LDNS_RR_TYPE_A,aclass=_ldns.LDNS_RR_CLASS_IN,flags=_ldns.LDNS_RD):
+            """
+               Send a query to a name server.
+               
+               :param name: The name to look for.
+               :type name: :class:`ldns_dname` or str
+               :param atype: The RR type to use.
+               :type atype: ldns_rr_type
+               :param aclass: The RR class to use.
+               :type aclass: ldns_rr_class
+               :param flags: Give some optional flags to the query.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_pkt`) A packet with the reply from the
+                   name server if _defnames is true the default domain will
+                   be added.
+            """
+            # Explicit conversion from string to ldns_rdf prevents memory leaks.
+            # TODO -- Find out why.
+            dname = name
+            if isinstance(name, str):
+                dname = _ldns.ldns_dname_new_frm_str(name)
+            return _ldns.ldns_resolver_query(self, dname, atype, aclass, flags)
+            #parameters: const ldns_resolver *,const ldns_rdf *,ldns_rr_type,ldns_rr_class,uint16_t,
+            #retvals: ldns_pkt *
+
+        def random(self):
+            """
+               Does the resolver randomize the name server before usage?
+               
+               :return: (bool) True: yes, False: no.
+            """
+            return _ldns.ldns_resolver_random(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def recursive(self):
+            """
+               Is the resolver set to recurse?
+               
+               :return: (bool) True if so, otherwise False.
+            """
+            return _ldns.ldns_resolver_recursive(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        def retrans(self):
+            """
+               Get the retransmit interval.
+               
+               :return: (uint8_t) The retransmit interval.
+            """
+            return _ldns.ldns_resolver_retrans(self)
+            #parameters: const ldns_resolver *,
+            #retvals: uint8_t
+
+        def retry(self):
+            """
+               Get the number of retries.
+               
+               :return: (uint8_t) The number of retries.
+            """
+            return _ldns.ldns_resolver_retry(self)
+            #parameters: const ldns_resolver *,
+            #retvals: uint8_t
+
+        def rtt(self):
+            """
+               Return the used round trip times for the name servers.
+               
+               :return: (size_t \*) a size_t* pointer to the list. yet)
+            """
+            return _ldns.ldns_resolver_rtt(self)
+            #parameters: const ldns_resolver *,
+            #retvals: size_t *
+
+        def search(self, name, atype=_ldns.LDNS_RR_TYPE_A, aclass=_ldns.LDNS_RR_CLASS_IN, flags=_ldns.LDNS_RD):
+            """
+               Send the query for using the resolver and take the search list
+               into account The search algorithm is as follows: If the name is
+               absolute, try it as-is, otherwise apply the search list.
+
+               :param name: The name to look for.
+               :type name: :class:`ldns_dname` or str
+               :param atype: The RR type to use.
+               :type atype: ldns_rr_type
+               :param aclass: The RR class to use.
+               :type aclass: ldns_rr_class
+               :param flags: Give some optional flags to the query.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_pkt`) A packet with the reply from the
+                   name server.
+            """
+            # Explicit conversion from string to ldns_rdf prevents memory leaks.
+            # TODO -- Find out why.
+            dname = name
+            if isinstance(name, str):
+                dname = _ldns.ldns_dname_new_frm_str(name)
+            return _ldns.ldns_resolver_search(self, dname, atype, aclass, flags)
+            #parameters: const ldns_resolver *,const ldns_rdf *,ldns_rr_type,ldns_rr_class,uint16_t,
+            #retvals: ldns_pkt *
+
+        def searchlist(self):
+            """
+               What is the search-list as used by the resolver.
+               
+               :return: (ldns_rdf \*\*) A ldns_rdf pointer to a list of the addresses.
+            """
+            return _ldns.ldns_resolver_searchlist(self)
+            #parameters: const ldns_resolver *,
+            #retvals: ldns_rdf \*\*
+
+        def searchlist_count(self):
+            """
+               Return the resolver's search-list count.
+               
+               :return: (size_t) The search-list count.
+            """
+            return _ldns.ldns_resolver_searchlist_count(self)
+            #parameters: const ldns_resolver *,
+            #retvals: size_t
+
+        def send(self, name, atype, aclass, flags, raiseException=True):
+            """
+               Send the query for name as-is.
+
+               :param name: The name to look for.
+               :type name: :class:`ldns_dname` or str
+               :param atype: The RR type to use.
+               :type atype: ldns_rr_type
+               :param aclass: The RR class to use.
+               :type aclass: ldns_rr_class
+               :param flags: Give some optional flags to the query.
+               :type flags: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `raiseException` set and answer
+                   couldn't be resolved.
+               :return: (:class:`ldns_pkt`) A packet with the reply from the
+                   name server.
+            """
+            # Explicit conversion from string to ldns_rdf prevents memory leaks.
+            # TODO -- Find out why.
+            dname = name
+            if isinstance(name, str):
+                dname = _ldns.ldns_dname_new_frm_str(name)
+            status, pkt = _ldns.ldns_resolver_send(self, dname, atype, aclass, flags)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create resolver, error: %d" % status)
+                return None
+            return pkt
+            #parameters: ldns_resolver *,const ldns_rdf *,ldns_rr_type,ldns_rr_class,uint16_t,
+            #retvals: ldns_status,ldns_pkt **
+
+        def send_pkt(self, query_pkt):
+            """
+               Send the given packet to a name server.
+               
+               :param query_pkt: Query packet.
+               :type query_pkt: :class:`ldns_pkt`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: * (ldns_status) Return status.
+                        * (:class:`ldns_pkt`) Response packet if returns status ok.
+            """
+            status, answer = _ldns.ldns_resolver_send_pkt(self, query_pkt)
+            return _ldns.ldns_resolver_send_pkt(self,query_pkt)
+            #parameters: ldns_resolver *,ldns_pkt *,
+            #retvals: ldns_status,ldns_pkt **
+
+        def set_debug(self, b):
+            """
+               Set the resolver debugging.
+               
+               :param b: True: debug on, False: debug off.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_debug(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_defnames(self, b):
+            """
+               Whether the resolver uses the name set with _set_domain.
+               
+               :param b: True: use the defaults, False: don't use them.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_defnames(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_dnsrch(self, b):
+            """
+               Whether the resolver uses the search list.
+               
+               :param b: True: use the list, False: don't use the list.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_dnsrch(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_dnssec(self, b):
+            """
+               Whether the resolver uses DNSSEC.
+               
+               :param b: True: use DNSSEC, False: don't use DNSSEC.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_dnssec(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_dnssec_anchors(self, l):
+            """
+               Set the resolver's DNSSEC anchor list directly.
+               RRs should be of type DS or DNSKEY.
+               
+               :param l: The list of RRs to use as trust anchors.
+               :type l: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns._ldns_resolver_set_dnssec_anchors(self, l)
+            #parameters: ldns_resolver *,ldns_rr_list *,
+            #retvals: 
+
+        def set_dnssec_cd(self, b):
+            """
+               Whether the resolver uses the checking disable bit.
+               
+               :param b: True: enable, False: disable.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_dnssec_cd(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_domain(self, rd):
+            """
+               Set the resolver's default domain.
+               This gets appended when no absolute name is given.
+               
+               :param rd: The name to append.
+               :type rd: :class:`ldns_dname` or str
+               :throws TypeError: When arguments of inappropriate types.
+               :throws Exception: When `rd` a non dname rdf.
+
+               .. note::
+                   The type checking of parameter `rd` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            # Also has to be able to pass None or dame string.
+            if isinstance(rd, str):
+                dname = _ldns.ldns_dname_new_frm_str(rd)
+            elif (not isinstance(rd, ldns_dname)) and \
+               isinstance(rd, ldns_rdf) and \
+               rd.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_resolver.set_domain() method" +
+                    " will drop the possibility to accept ldns_rdf." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+                dname = rd
+            else:
+                dname = rd
+            if (not isinstance(dname, ldns_rdf)) and (dname != None):
+                raise TypeError("Parameter must be derived from ldns_rdf.")
+            if (isinstance(dname, ldns_rdf)) and \
+               (dname.get_type() != _ldns.LDNS_RDF_TYPE_DNAME):
+                raise Exception("Operands must be ldns_dname.")
+            _ldns._ldns_resolver_set_domain(self, dname)
+            #parameters: ldns_resolver *,ldns_rdf *,
+            #retvals: 
+
+        def set_edns_udp_size(self, s):
+            """
+               Set maximum udp size.
+               
+               :param s: The udp max size.
+               :type s: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_edns_udp_size(self,s)
+            #parameters: ldns_resolver *,uint16_t,
+            #retvals: 
+
+        def set_fail(self, b):
+            """
+               Whether or not to fail after one failed query.
+               
+               :param b: True: yes fail, False: continue with next name server.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_fail(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_fallback(self, fallback):
+            """
+               Set whether the resolvers truncation fall-back mechanism is used
+               when :meth:`query` is called.
+               
+               :param fallback: Whether to use the fall-back mechanism.
+               :type fallback: bool
+            """
+            _ldns.ldns_resolver_set_fallback(self, fallback)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_igntc(self, b):
+            """
+               Whether or not to ignore the TC bit.
+               
+               :param b: True: yes ignore, False: don't ignore.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_igntc(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_ip6(self, i):
+            """
+               Whether the resolver uses ip6.
+               
+               :param i: 0: no pref, 1: ip4, 2: ip6
+               :type i: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_ip6(self, i)
+            #parameters: ldns_resolver *,uint8_t,
+            #retvals: 
+
+        def set_nameserver_count(self, c):
+            """
+               Set the resolver's name server count directly.
+               
+               :param c: The name server count.
+               :type c: size_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_nameserver_count(self, c)
+            #parameters: ldns_resolver *,size_t,
+            #retvals: 
+
+        def set_nameserver_rtt(self, pos, value):
+            """
+               Set round trip time for a specific name server.
+               Note this currently differentiates between: unreachable and
+               reachable.
+               
+               :param pos: The name server position.
+               :type pos: size_t
+               :param value: The rtt.
+               :type value: size_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_nameserver_rtt(self, pos, value)
+            #parameters: ldns_resolver *,size_t,size_t,
+            #retvals: 
+
+        def set_nameservers(self, rd):
+            """
+               Set the resolver's name server count directly by using an
+               rdf list.
+               
+               :param rd: The resolver addresses.
+               :type rd: ldns_rdf \*\*
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_nameservers(self, rd)
+            #parameters: ldns_resolver *,ldns_rdf **,
+            #retvals: 
+
+        def set_port(self, p):
+            """
+               Set the port the resolver should use.
+               
+               :param p: The port number.
+               :type p: uint16_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_port(self, p)
+            #parameters: ldns_resolver *,uint16_t,
+            #retvals: 
+
+        def set_random(self, b):
+            """
+               Should the name server list be randomized before each use.
+               
+               :param b: True: randomize, False: don't.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_random(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_recursive(self, b):
+            """
+               Set the resolver recursion.
+               
+               :param b: True: set to recurse, False: unset.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_recursive(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def set_retrans(self, re):
+            """
+               Set the resolver retrans time-out (in seconds).
+               
+               :param re: The retransmission interval in seconds.
+               :type re: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_retrans(self, re)
+            #parameters: ldns_resolver *,uint8_t,
+            #retvals: 
+
+        def set_retry(self, re):
+            """
+               Set the resolver retry interval (in seconds).
+               
+               :param re: The retry interval.
+               :type re: uint8_t
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_retry(self,re)
+            #parameters: ldns_resolver *,uint8_t,
+            #retvals: 
+
+        def set_rtt(self, rtt):
+            """
+               Set round trip time for all name servers.
+               Note this currently differentiates between: unreachable and reachable.
+               
+               :param rtt: A list with the times.
+               :type rtt: size \*
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_rtt(self, rtt)
+            #parameters: ldns_resolver *,size_t *,
+            #retvals: 
+
+        def set_timeout(self, timeout):
+            """
+               Set the resolver's socket time out when talking to remote hosts.
+               
+               :param timeout: The time-out to use.
+               :param timeout: struct timeval
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_timeout(self,timeout)
+            #parameters: ldns_resolver *,struct timeval,
+            #retvals: 
+
+        def set_tsig_algorithm(self, tsig_algorithm):
+            """
+               Set the tsig algorithm.
+               
+               :param tsig_algorithm: The tsig algorithm.
+               :param tsig_algorithm: str
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_tsig_algorithm(self, tsig_algorithm)
+            #parameters: ldns_resolver *,char *,
+            #retvals: 
+
+        def set_tsig_keydata(self, tsig_keydata):
+            """
+               Set the tsig key data.
+               
+               :param tsig_keydata: The key data.
+               :type tsig_keydata: str
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_tsig_keydata(self, tsig_keydata)
+            #parameters: ldns_resolver *,char *,
+            #retvals: 
+
+        def set_tsig_keyname(self, tsig_keyname):
+            """
+               Set the tsig key name.
+               
+               :param tsig_keyname: The tsig key name.
+               :type tsig_keyname: str
+               :throws TypeError: When arguments of inappropriate types.
+            """
+            _ldns.ldns_resolver_set_tsig_keyname(self, tsig_keyname)
+            #parameters: ldns_resolver *,char *,
+            #retvals: 
+
+        def set_usevc(self, b):
+            """
+               Whether the resolver uses a virtual circuit (TCP).
+               
+               :param b: True: use TCP, False: don't use TCP.
+               :type b: bool
+            """
+            _ldns.ldns_resolver_set_usevc(self, b)
+            #parameters: ldns_resolver *,bool,
+            #retvals: 
+
+        def timeout(self):
+            """
+               What is the time-out on socket connections.
+               
+               :return: (struct timeval) The time-out.
+            """
+            return _ldns.ldns_resolver_timeout(self)
+            #parameters: const ldns_resolver *,
+            #retvals: struct timeval
+
+        def trusted_key(self, keys):
+            """
+               Returns true if at least one of the provided keys is a trust
+               anchor.
+               
+               :param keys: The key set to check.
+               :type keys: :class:`ldns_rr_list`
+               :throws TypeError: When arguments of inappropriate types.
+               :return: (:class:`ldns_rr_list`) List of trusted keys if at
+                   least one of the provided keys is a configured trust anchor,
+                   None else.
+            """
+            return _ldns._replacement_ldns_resolver_trusted_key(self, keys)
+            #parameters: const ldns_resolver *,ldns_rr_list *,ldns_rr_list *,
+            #retvals: bool
+
+        def tsig_algorithm(self):
+            """
+               Return the tsig algorithm as used by the name server.
+               
+               :return: (str) The algorithm used.
+            """
+            return _ldns._ldns_resolver_tsig_algorithm(self)
+            #parameters: const ldns_resolver *,
+            #retvals: char *
+
+        def tsig_keydata(self):
+            """
+               Return the tsig key data as used by the name server.
+               
+               :return: (str) The key data used.
+            """
+            return _ldns._ldns_resolver_tsig_keydata(self)
+            #parameters: const ldns_resolver *,
+            #retvals: char *
+
+        def tsig_keyname(self):
+            """
+               Return the tsig key name as used by the name server.
+               
+               :return: (str) The name used.
+            """
+            return _ldns._ldns_resolver_tsig_keyname(self)
+            #parameters: const ldns_resolver *,
+            #retvals: char *
+
+        def usevc(self):
+            """
+               Does the resolver use tcp or udp.
+               
+               :return: (bool) True: tcp, False: udp.
+            """
+            return _ldns.ldns_resolver_usevc(self)
+            #parameters: const ldns_resolver *,
+            #retvals: bool
+
+        #
+        # _LDNS_RESOLVER_METHODS
+        #
+  %}
+} 
diff --git a/contrib/ldns/contrib/python/ldns_rr.i b/contrib/ldns/contrib/python/ldns_rr.i
new file mode 100644
index 00000000000000..2e0a07140d41c1
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_rr.i
@@ -0,0 +1,2581 @@
+/******************************************************************************
+ * ldns_rr.i: LDNS resource records (RR), RR list
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+/* Creates a temporary instance of (ldns_rr *). */
+%typemap(in, numinputs=0, noblock=1) (ldns_rr **)
+{
+  ldns_rr *$1_rr;
+  $1 = &$1_rr;
+}
+          
+/* Result generation, appends (ldns_rr *) after the result. */
+%typemap(argout, noblock=1) (ldns_rr **) 
+{
+  $result = SWIG_Python_AppendOutput($result,
+    SWIG_NewPointerObj(SWIG_as_voidptr($1_rr),
+      SWIGTYPE_p_ldns_struct_rr, SWIG_POINTER_OWN |  0 ));
+}
+
+%nodefaultctor ldns_struct_rr; /* No default constructor. */
+%nodefaultdtor ldns_struct_rr; /* No default destructor. */
+
+%ignore ldns_struct_rr::_rdata_fields;
+
+%newobject ldns_rr_clone;
+%newobject ldns_rr_new;
+%newobject ldns_rr_new_frm_type;
+%newobject ldns_rr_pop_rdf;
+%delobject ldns_rr_free;
+
+%rename(ldns_rr) ldns_struct_rr;
+
+%newobject ldns_rr2str;
+%newobject ldns_rr_type2str;
+%newobject ldns_rr_class2str;
+%newobject ldns_read_anchor_file;
+
+
+/* Clone rdf data on pull. */
+
+/* Clone will fail with NULL argument. */
+
+%newobject _ldns_rr_rdf;
+%rename(__ldns_rr_rdf) ldns_rr_rdf;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rdf(ldns_rr *rr, size_t i)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rdf(rr, i);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_rrsig_algorithm;
+%rename(__ldns_rr_rrsig_algorithm) ldns_rr_rrsig_algorithm;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_algorithm(ldns_rr *rr) {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_algorithm(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_dnskey_algorithm;
+%rename(__ldns_rr_dnskey_algorithm) ldns_rr_dnskey_algorithm;
+%inline
+%{
+  ldns_rdf * _ldns_rr_dnskey_algorithm(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_dnskey_algorithm(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_dnskey_flags;
+%rename(__ldns_rr_dnskey_flags) ldns_rr_dnskey_flags;
+%inline
+ %{
+  ldns_rdf * _ldns_rr_dnskey_flags(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_dnskey_flags(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_dnskey_key;
+%rename(__ldns_rr_dnskey_key) ldns_rr_dnskey_key;
+%inline
+%{
+  ldns_rdf * _ldns_rr_dnskey_key(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_dnskey_key(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_dnskey_protocol;
+%rename(__ldns_rr_dnskey_protocol) ldns_rr_dnskey_protocol;
+%inline
+%{
+  ldns_rdf * _ldns_rr_dnskey_protocol(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_dnskey_protocol(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_owner;
+%rename(__ldns_rr_owner) ldns_rr_owner;
+%inline
+%{
+  ldns_rdf * _ldns_rr_owner(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_owner(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_a_address;
+%rename(__ldns_rr_a_address) ldns_rr_a_address;
+%inline
+%{
+  ldns_rdf * _ldns_rr_a_address(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_a_address(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_mx_exchange;
+%rename(__ldns_rr_mx_exchange) ldns_rr_mx_exchange;
+%inline
+%{
+  ldns_rdf * _ldns_rr_mx_exchange(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_mx_exchange(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_mx_preference;
+%rename(__ldns_rr_mx_preference) ldns_rr_mx_preference;
+%inline
+%{
+  ldns_rdf * _ldns_rr_mx_preference(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_mx_preference(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_ns_nsdname;
+%rename(__ldns_rr_ns_nsdname) ldns_rr_ns_nsdname;
+%inline
+%{
+  ldns_rdf * _ldns_rr_ns_nsdname(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_ns_nsdname(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_expiration;
+%rename(__ldns_rr_rrsig_expiration) ldns_rr_rrsig_expiration;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_expiration(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_expiration(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_inception;
+%rename(__ldns_rr_rrsig_inception) ldns_rr_rrsig_inception;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_inception(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_inception(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_keytag;
+%rename(__ldns_rr_rrsig_keytag) ldns_rr_rrsig_keytag;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_keytag(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_keytag(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_labels;
+%rename(__ldns_rr_rrsig_labels) ldns_rr_rrsig_labels;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_labels(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_labels(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_origttl;
+%rename(__ldns_rr_rrsig_origttl) ldns_rr_rrsig_origttl;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_origttl(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_origttl(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_sig;
+%rename(__ldns_rr_rrsig_sig) ldns_rr_rrsig_sig;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_sig(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_sig(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_signame;
+%rename(__ldns_rr_rrsig_signame) ldns_rr_rrsig_signame;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_signame(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_signame(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+%newobject _ldns_rr_rrsig_typecovered;
+%rename(__ldns_rr_rrsig_typecovered) ldns_rr_rrsig_typecovered;
+%inline
+%{
+  ldns_rdf * _ldns_rr_rrsig_typecovered(ldns_rr *rr)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_rrsig_typecovered(rr);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+/* End of pull cloning. */
+
+/* Clone rdf data on push. */
+
+%rename(__ldns_rr_a_set_address) ldns_rr_a_set_address;
+%inline
+%{
+  bool _ldns_rr_a_set_address(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_a_set_address(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_dnskey_set_algorithm) ldns_rr_dnskey_set_algorithm;
+%inline
+%{
+  bool _ldns_rr_dnskey_set_algorithm(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_dnskey_set_algorithm(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_dnskey_set_flags) ldns_rr_dnskey_set_flags;
+%inline
+%{
+  bool _ldns_rr_dnskey_set_flags(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_dnskey_set_flags(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_dnskey_set_key) ldns_rr_dnskey_set_key;
+%inline
+%{
+  bool _ldns_rr_dnskey_set_key(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_dnskey_set_key(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_dnskey_set_protocol) ldns_rr_dnskey_set_protocol;
+%inline
+%{
+  bool _ldns_rr_dnskey_set_protocol(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_dnskey_set_protocol(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_push_rdf) ldns_rr_push_rdf;
+%inline
+%{
+  bool _ldns_rr_push_rdf(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_push_rdf(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_algorithm) ldns_rr_rrsig_set_algorithm;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_algorithm(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_algorithm(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_expiration) ldns_rr_rrsig_set_expiration;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_expiration(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_expiration(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_inception) ldns_rr_rrsig_set_inception;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_inception(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_inception(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_keytag) ldns_rr_rrsig_set_keytag;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_keytag(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_keytag(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_labels) ldns_rr_rrsig_set_labels;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_labels(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_labels(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_origttl) ldns_rr_rrsig_set_origttl;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_origttl(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_origttl(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_sig) ldns_rr_rrsig_set_sig;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_sig(ldns_rr *rr, ldns_rdf *rdf) {
+    return ldns_rr_rrsig_set_sig(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_signame) ldns_rr_rrsig_set_signame;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_signame(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_signame(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_rrsig_set_typecovered) ldns_rr_rrsig_set_typecovered;
+%inline
+%{
+  bool _ldns_rr_rrsig_set_typecovered(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    return ldns_rr_rrsig_set_typecovered(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%rename(__ldns_rr_set_owner) ldns_rr_set_owner;
+%inline
+%{
+  void _ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *rdf)
+  {
+    ldns_rr_set_owner(rr, ldns_rdf_clone(rdf));
+  }
+%}
+
+%newobject _ldns_rr_set_rdf;
+%rename(__ldns_rr_set_rdf) ldns_rr_set_rdf;
+%inline
+%{
+  ldns_rdf * _ldns_rr_set_rdf(ldns_rr *rr, ldns_rdf *rdf, size_t pos)
+  {
+    /* May leak memory on unsuccessful calls. */
+    ldns_rdf *new, *ret;
+
+    new = ldns_rdf_clone(rdf);
+
+    if ((ret = ldns_rr_set_rdf(rr, new, pos)) == NULL) {
+        ldns_rdf_deep_free(new);
+    }
+
+    return ret;
+  }
+%}
+
+/* End of push cloning. */
+
+%rename(_ldns_rr_new_frm_str) ldns_rr_new_frm_str;
+%rename(_ldns_rr_new_frm_fp_l) ldns_rr_new_frm_fp_l;
+%rename(_ldns_rr_new_frm_fp) ldns_rr_new_frm_fp;
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_rr_free) ldns_rr_free;
+%inline %{
+  void _ldns_rr_free (ldns_rr *r)
+  {
+    printf("******** LDNS_RR free 0x%lX ************\n", (long unsigned int)r);
+    ldns_rr_free(r);
+  }
+%}
+#else /* !LDNS_DEBUG */
+%rename(_ldns_rr_free) ldns_rr_free;
+#endif /* LDNS_DEBUG */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+/* None. */
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+
+%feature("docstring") ldns_struct_rr "Resource Record (RR).
+
+The RR is the basic DNS element that contains actual data. This class allows
+to create RR and manipulate with the content.
+
+Use :meth:`ldns_rr_new`, :meth:`ldns_rr_new_frm_type`, :meth:`new_frm_fp`,
+:meth:`new_frm_fp_l`, :meth:`new_frm_str` or :meth:`new_question_frm_str`
+to create :class:`ldns_rr` instances.
+"
+
+%extend ldns_struct_rr {
+ 
+  %pythoncode
+  %{
+        def __init__(self):
+            raise Exception("This class can't be created directly. " +
+                "Please use: ldns_rr_new(), ldns_rr_new_frm_type(), " +
+                "new_frm_fp(), new_frm_fp_l(), new_frm_str() or " +
+                "new_question_frm_str()")
+       
+        __swig_destroy__ = _ldns._ldns_rr_free
+
+        #
+        # LDNS_RR_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def new_frm_str(string, default_ttl=0, origin=None, prev=None, raiseException=True):
+            """
+               Creates an rr object from a string.
+
+               The string should be a fully filled-in rr, like "owner_name
+               [space] TTL [space] CLASS [space] TYPE [space] RDATA."
+               
+               :param string: The string to convert.
+               :type string: str
+               :param default_ttl: Default ttl value for the rr.
+                   If 0 DEF_TTL will be used.
+               :type default_ttl: int
+               :param origin: When the owner is relative add this.
+               :type origin: :class:`ldns_dname`
+               :param prev: The previous owner name.
+               :type prev: :class:`ldns_rdf`
+               :param raiseException: If True, an exception occurs in case a rr
+                   instance can't be created.
+               :throws Exception: If `raiseException` is set and fails.
+               :throws TypeError: When parameters of incorrect types.
+               :return: (:class:`ldns_rr`) RR instance or None.
+
+               .. note::
+                   The type checking of `origin` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+        
+               **Usage**
+
+               >>> import ldns
+               >>> rr = ldns.ldns_rr.new_frm_str("www.nic.cz. IN A 192.168.1.1", 300)
+               >>> print rr
+               www.nic.cz.  300  IN  A  192.168.1.1
+               >>> rr = ldns.ldns_rr.new_frm_str("test.nic.cz. 600 IN A 192.168.1.2")
+               >>> print rr
+               test.nic.cz.  600  IN  A  192.168.1.2
+               
+            """
+            if (not isinstance(origin, ldns_dname)) and \
+               isinstance(origin, ldns_rdf) and \
+               origin.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_frm_str() method will" +
+                    " drop the possibility to accept ldns_rdf as origin." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            status, rr, prev = _ldns.ldns_rr_new_frm_str_(string, default_ttl,
+                origin, prev)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create RR, error: %d" % status)
+                return None
+            return rr
+
+        @staticmethod
+        def new_question_frm_str(string, default_ttl=0, origin=None, prev=None, raiseException=True):
+            """
+               Creates an rr object from a string.
+
+               The string is like :meth:`new_frm_str` but without rdata.
+
+               :param string: The string to convert.
+               :type string: str
+               :param origin: When the owner is relative add this.
+               :type origin: :class:`ldns_dname`
+               :param prev: The previous owner name.
+               :type prev: :class:`ldns_rdf`
+               :param raiseException: If True, an exception occurs in case
+                   a rr instance can't be created.
+               :throws Exception: If `raiseException` is set and fails.
+               :throws TypeError: When parameters of incorrect types.
+               :return: (:class:`ldns_rr`) RR instance or None. If the object
+                   can't be created and `raiseException` is True,
+                   an exception occurs.
+
+               .. note::
+                   The type checking of `origin` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(origin, ldns_dname)) and \
+               isinstance(origin, ldns_rdf) and \
+               origin.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_question_frm_str() method will" +
+                    " drop the possibility to accept ldns_rdf as origin." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            status, rr, prev = _ldns.ldns_rr_new_question_frm_str_(string,
+                origin, prev)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create RR, error: %d" % status)
+                return None
+            return rr
+
+        @staticmethod
+        def new_frm_str_prev(string, default_ttl=0, origin=None, prev=None, raiseException=True):
+            """
+               Creates an rr object from a string.
+
+               The string should be a fully filled-in rr, like "owner_name
+               [space] TTL [space] CLASS [space] TYPE [space] RDATA".
+               
+               :param string: The string to convert.
+               :type string: str
+               :param default_ttl: Default ttl value for the rr.
+                   If 0 DEF_TTL will be used.
+               :type default_ttl: int
+               :param origin: When the owner is relative add this.
+               :type origin: :class:`ldns_dname`
+               :param prev: The previous owner name.
+               :type prev: :class:`ldns_rdf`
+               :param raiseException: If True, an exception occurs in case when
+                   a rr instance can't be created.
+               :throws Exception: If `raiseException` is set and fails.
+               :throws TypeError: When parameters of incorrect types.
+               :return: None when fails, otherwise a tuple containing:
+
+                  * rr - (:class:`ldns_rr`) RR instance or None.
+                    If the object can't be created and `raiseException`
+                    is True, an exception occurs.
+        
+                  * prev - (:class:`ldns_rdf`) Owner name found in this string
+                    or None.
+
+               .. note::
+                   The type checking of `origin` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(origin, ldns_dname)) and \
+               isinstance(origin, ldns_rdf) and \
+               origin.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_frm_str_prev() method will" +
+                    " drop the possibility to accept ldns_rdf as origin." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            status, rr, prev = _ldns.ldns_rr_new_frm_str_(string, default_ttl,
+                origin, prev)
+            if status != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create RR, error: %d" % status)
+                return None
+            return rr, prev
+
+        @staticmethod
+        def new_frm_fp(file, default_ttl=0, origin=None, prev=None, raiseException=True):
+            """
+               Creates a new rr from a file containing a string.
+              
+               :param file: Opened file.
+               :param default_ttl: If 0 DEF_TTL will be used.
+               :type default_ttl: int
+               :param origin: When the owner is relative add this.
+               :type origin: :class:`ldns_dname`
+               :param prev: When the owner is white spaces use this.
+               :type prev: :class:`ldns_rdf`
+               :param raiseException: If True, an exception occurs in case
+                   a resolver object can't be created.
+               :throws Exception: If `raiseException` is set and the input
+                   cannot be read.
+               :throws TypeError: When parameters of incorrect types.
+               :return: None when fails, otherwise a tuple containing:
+
+                   * rr - (:class:`ldns_rr`) RR object or None. If the object
+                     can't be created and `raiseException` is True,
+                     an exception occurs.
+
+                   * ttl - (int) None or TTL if the file contains a TTL
+                     directive.
+
+                   * origin - (:class:`ldns_rdf`) None or dname rdf if the file
+                     contains a ORIGIN directive.
+
+                   * prev - (:class:`ldns_rdf`) None or updated value
+                     of prev parameter.
+
+               .. note::
+                   The type checking of `origin` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(origin, ldns_dname)) and \
+               isinstance(origin, ldns_rdf) and \
+               origin.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_frm_fp() method will" +
+                    " drop the possibility to accept ldns_rdf as origin." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            res = _ldns.ldns_rr_new_frm_fp_(file, default_ttl, origin, prev)
+            if res[0] != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create RR, error: %d" % res[0])
+                return None
+            return res[1:]
+
+        @staticmethod
+        def new_frm_fp_l(file, default_ttl=0, origin=None, prev=None, raiseException=True):
+            """
+               Creates a new rr from a file containing a string.
+              
+               :param file: Opened file.
+               :param default_ttl: If 0 DEF_TTL will be used.
+               :type default_ttl: int
+               :param origin: When the owner is relative add this.
+               :type origin: :class:`ldns_dname`
+               :param prev: When the owner is white spaces use this.
+               :type prev: :class:`ldns_rdf`
+               :param raiseException: If True, an exception occurs in case
+                   a resolver object can't be created.
+               :throws Exception: If `raiseException` is set and the input
+                   cannot be read.
+               :throws TypeError: When parameters of incorrect types.
+               :return: None when fails, otherwise a tuple containing:
+
+                  * rr - (:class:`ldns_rr`) RR object or None. If the object
+                    can't be created and `raiseException` is True,
+                    an exception occurs.
+
+                  * line - (int) line number (for debugging).
+
+                  * ttl - (int) None or TTL if the file contains a TTL
+                    directive .
+
+                  * origin - (:class:`ldns_rdf`) None or dname rdf if the file
+                    contains a ORIGIN directive.
+
+                  * prev - (:class:`ldns_rdf`) None or updated value of prev
+                    parameter.
+
+               .. note::
+                   The type checking of `origin` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(origin, ldns_dname)) and \
+               isinstance(origin, ldns_rdf) and \
+               origin.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_frm_fp_l() method will" +
+                    " drop the possibility to accept ldns_rdf as origin." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            res = _ldns.ldns_rr_new_frm_fp_l_(file, default_ttl, origin, prev)
+            if res[0] != LDNS_STATUS_OK:
+                if (raiseException):
+                    raise Exception("Can't create RR, error: %d" % res[0])
+                return None
+            return res[1:]
+
+        #
+        # _LDNS_RR_CONSTRUCTORS
+        #
+
+        def __str__(self):
+            """
+               Converts the data in the resource record to presentation format.
+
+               :return: (str)
+            """
+            return _ldns.ldns_rr2str(self)
+
+        def __cmp__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (int) 0 if equal, -1 if `self` comes before `other`,
+                   1 if `other` RR comes before `self`.
+            """
+            return _ldns.ldns_rr_compare(self, other)
+
+        def __lt__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is less than 'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) == -1
+
+        def __le__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is less than or equal to
+                   'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) != 1
+
+        def __eq__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is equal to 'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) == 0
+
+        def __ne__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is not equal to 'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) != 0
+
+        def __gt__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is greater than 'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) == 1
+
+        def __ge__(self, other):
+            """
+               Compares two rrs.
+               
+               The TTL is not looked at.
+               
+               :param other: The second RR one.
+               :type other: :class:`ldns_rr`
+               :throws TypeError: When `other` of non-:class:`ldns_rr` type.
+               :return: (bool) True when `self` is greater than or equal to
+                    'other'.
+            """
+            return _ldns.ldns_rr_compare(self, other) != -1
+
+        @staticmethod
+        def class_by_name(string):
+            """
+               Retrieves a class identifier value by looking up its name.
+
+               :param string: Class name.
+               :type string: str
+               :throws TypeError: when `string` of inappropriate type.
+               :return: (int) Class identifier value, or 0 if not valid
+                   class name given.
+            """
+            return _ldns.ldns_get_rr_class_by_name(string)
+
+        def rdfs(self):
+            """
+               Returns a generator object of rdata records.
+
+               :return: Generator of :class:`ldns_rdf`.
+            """
+            for i in range(0, self.rd_count()):
+                yield self.rdf(i)
+
+        def print_to_file(self, output):
+            """
+               Prints the data in the resource record to the given file stream
+               (in presentation format).
+
+               :param output: Opened file stream.
+               :throws TypeError: When `output` not a file.
+            """
+            _ldns.ldns_rr_print(output, self)
+            #parameters: FILE *, const ldns_rr *,
+
+        def get_type_str(self):
+            """
+               Converts an RR type value to its string representation,
+               and returns that string.
+
+               :return: (str) containing type identification.
+            """
+            return _ldns.ldns_rr_type2str(self.get_type())
+            #parameters: const ldns_rr_type,
+
+        def get_class_str(self):
+            """
+               Converts an RR class value to its string representation,
+               and returns that string.
+
+               :return: (str) containing class identification.
+            """
+            return _ldns.ldns_rr_class2str(self.get_class())
+            #parameters: const ldns_rr_class,
+
+        @staticmethod
+        def dnskey_key_size_raw(keydata, len, alg):
+            """
+               Get the length of the keydata in bits.
+
+               :param keydata: Key raw data.
+               :type keydata: unsigned char \*
+               :param len: Number of bytes of `keydata`.
+               :type len: size_t
+               :param alg: Algorithm identifier.
+               :type alg: ldns_algorithm
+
+               :return: (size_t) The length of key data in bits.
+            """
+            return _ldns.ldns_rr_dnskey_key_size_raw(keydata, len, alg)
+            #parameters: const unsigned char *,const size_t,const ldns_algorithm,
+            #retvals: size_t
+
+        def write_to_buffer(self,buffer,section):
+            """
+               Copies the rr data to the buffer in wire format.
+               
+               :param buffer: Buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :param section: The section in the packet this rr is supposed
+                   to be in (to determine whether to add rdata or not).
+               :type section: int
+               :throws TypeError: when arguments of mismatching types passed.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rr2buffer_wire(buffer, self, section)
+            #parameters: ldns_buffer *,const ldns_rr *,int,
+            #retvals: ldns_status
+
+        def write_to_buffer_canonical(self,buffer,section):
+            """
+               Copies the rr data to the buffer in wire format, in canonical
+               format according to RFC3597 (every dname in rdata fields
+               of RR's mentioned in that RFC will be converted to lower-case).
+               
+               :param buffer: Buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :param section: The section in the packet this rr is supposed
+                   to be in (to determine whether to add rdata or not).
+               :type section: int
+               :throws TypeError: when arguments of mismatching types passed.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rr2buffer_wire_canonical(buffer,self,section)
+            #parameters: ldns_buffer *,const ldns_rr *,int,
+            #retvals: ldns_status
+
+        def write_data_to_buffer(self, buffer):
+            """
+               Converts an rr's rdata to wire format, while excluding the
+               owner name and all the stuff before the rdata.
+               
+               This is needed in DNSSEC key-tag calculation, the ds
+               calculation from the key and maybe elsewhere.
+               
+               :param buffer: Buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :throws TypeError: when `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rr_rdata2buffer_wire(buffer,self)
+            #parameters: ldns_buffer *, const ldns_rr *,
+            #retvals: ldns_status
+
+        def write_rrsig_to_buffer(self, buffer):
+            """
+               Converts a rrsig to wire format BUT EXCLUDE the rrsig rdata.
+
+               This is needed in DNSSEC verification.
+               
+               :param buffer: Buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :throws TypeError: when `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rrsig2buffer_wire(buffer,self)
+            #parameters: ldns_buffer *,const ldns_rr *,
+            #retvals: ldns_status
+
+        #
+        # LDNS_RR_METHODS_
+        #
+
+        def a_address(self):
+            """
+               Returns the address rdf of a LDNS_RR_TYPE_A or LDNS_RR_TYPE_AAAA
+               rr.
+               
+               :return: (:class:`ldns_rdf`) with the address or None on
+                   failure.
+            """
+            return _ldns._ldns_rr_a_address(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def a_set_address(self, f):
+            """
+               Sets the address of a LDNS_RR_TYPE_A or LDNS_RR_TYPE_AAAA rr.
+               
+               :param f: The address to be set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_a_set_address(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def clone(self):
+            """
+               Clones a rr and all its data.
+               
+               :return: (:class:`ldns_rr`) The new rr or None on failure.
+            """
+            return _ldns.ldns_rr_clone(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rr *
+
+        def compare_ds(self, rr2):
+            """
+               Returns True if the given rr's are equal. 
+               
+               Also returns True if one record is a DS that represents the
+               same DNSKEY record as the other record.
+               
+               :param rr2: The second rr.
+               :type rr2: :class:`ldns_rr`
+               :throws TypeError: When `rr2` of non-:class:`ldns_rr` type.
+               :return: (bool) True if equal otherwise False.
+            """
+            return _ldns.ldns_rr_compare_ds(self, rr2)
+            #parameters: const ldns_rr *, const ldns_rr *,
+            #retvals: bool
+
+        def compare_no_rdata(self, rr2):
+            """
+               Compares two rrs, up to the rdata.
+               
+               :param rr2: Rhe second rr.
+               :type rr2: :class:`ldns_rr`
+               :throws TypeError: When `rr2` of non-:class:`ldns_rr` type.
+               :return: (int) 0 if equal, negative integer if `self` comes
+                   before `rr2`, positive integer if `rr2` comes before `self`.
+            """
+            return _ldns.ldns_rr_compare_no_rdata(self, rr2)
+            #parameters: const ldns_rr *, const ldns_rr *,
+            #retvals: int
+
+        def dnskey_algorithm(self):
+            """
+               Returns the algorithm of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :return: (:class:`ldns_rdf`) with the algorithm or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_dnskey_algorithm(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def dnskey_flags(self):
+            """
+               Returns the flags of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :return: (:class:`ldns_rdf`) with the flags or None on failure.
+            """
+            return _ldns._ldns_rr_dnskey_flags(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def dnskey_key(self):
+            """
+               Returns the key data of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :return: (:class:`ldns_rdf`) with the key data or None on
+                   failure.
+            """
+            return _ldns._ldns_rr_dnskey_key(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def dnskey_key_size(self):
+            """
+               Get the length of the keydata in bits.
+               
+               :return: (size_t) the keysize in bits.
+            """
+            return _ldns.ldns_rr_dnskey_key_size(self)
+            #parameters: const ldns_rr *,
+            #retvals: size_t
+
+        def dnskey_protocol(self):
+            """
+               Returns the protocol of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :return: (:class:`ldns_rdf`) with the protocol or None on
+                   failure.
+            """
+            return _ldns._ldns_rr_dnskey_protocol(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def dnskey_set_algorithm(self, f):
+            """
+               Sets the algorithm of a LDNS_RR_TYPE_DNSKEY rr
+               
+               :param f: The algorithm to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_dnskey_set_algorithm(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def dnskey_set_flags(self, f):
+            """
+               Sets the flags of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :param f: The flags to be set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_dnskey_set_flags(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def dnskey_set_key(self, f):
+            """
+               Sets the key data of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :param f: The key data to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_dnskey_set_key(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def dnskey_set_protocol(self,f):
+            """
+               Sets the protocol of a LDNS_RR_TYPE_DNSKEY rr.
+               
+               :param f: The protocol to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_dnskey_set_protocol(self,f)
+            #parameters: ldns_rr *,ldns_rdf *,
+            #retvals: bool
+
+        def get_class(self):
+            """
+               Returns the class of the rr.
+               
+               :return: (int) The class identifier of the rr.
+            """
+            return _ldns.ldns_rr_get_class(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rr_class
+
+        def get_type(self):
+            """
+               Returns the type of the rr.
+               
+               :return: (int) The type identifier of the rr.
+            """
+            return _ldns.ldns_rr_get_type(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rr_type
+
+        def is_question(self):
+            """
+               Returns the question flag of a rr structure.
+
+               :return: (bool) True if question flag is set.
+            """
+            return _ldns.ldns_rr_is_question(self)
+
+        def label_count(self):
+            """
+               Counts the number of labels of the owner name.
+               
+               :return: (int) The number of labels.
+            """
+            return _ldns.ldns_rr_label_count(self)
+            #parameters: ldns_rr *,
+            #retvals: uint8_t
+
+        def mx_exchange(self):
+            """
+               Returns the mx host of a LDNS_RR_TYPE_MX rr.
+               
+               :return: (:class:`ldns_rdf`) with the name of the MX host
+                  or None on failure.
+            """
+            return _ldns._ldns_rr_mx_exchange(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def mx_preference(self):
+            """
+               Returns the mx preference of a LDNS_RR_TYPE_MX rr.
+               
+               :return: (:class:`ldns_rdf`) with the preference or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_mx_preference(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def ns_nsdname(self):
+            """
+               Returns the name of a LDNS_RR_TYPE_NS rr.
+               
+               :return: (:class:`ldns_rdf`) A dname rdf with the name or
+                   None on failure.
+            """
+            return _ldns._ldns_rr_ns_nsdname(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def owner(self):
+            """
+               Returns the owner name of an rr structure.
+               
+               :return: (:class:`ldns_dname`) Owner name or None on failure.
+            """
+            rdf = _ldns._ldns_rr_owner(self)
+            if rdf:
+                rdf = ldns_dname(rdf, clone=False)
+            return rdf
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def pop_rdf(self):
+            """
+               Removes a rd_field member, it will be popped from the last
+               position.
+               
+               :return: (:class:`ldns_rdf`) rdf which was popped, None if
+                   nothing.
+            """
+            return _ldns.ldns_rr_pop_rdf(self)
+            #parameters: ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def push_rdf(self,f):
+            """
+               Sets rd_field member, it will be placed in the next available
+               spot.
+               
+               :param f: The rdf to be appended.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: When `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) Returns True if success, False otherwise.
+            """
+            return _ldns._ldns_rr_push_rdf(self, f)
+            #parameters: ldns_rr *, const ldns_rdf *,
+            #retvals: bool
+
+        def rd_count(self):
+            """
+               Returns the rd_count of an rr structure.
+               
+               :return: (size_t) the rd count of the rr.
+            """
+            return _ldns.ldns_rr_rd_count(self)
+            #parameters: const ldns_rr *,
+            #retvals: size_t
+
+        def rdf(self, nr):
+            """
+               Returns the rdata field with the given index.
+               
+               :param nr: The index of the rdf to return.
+               :type nr: positive int
+               :throws TypeError: When `nr` not a positive integer.
+               :return: (:class:`ldns_rdf`) The given rdf or None if fails.
+            """
+            return _ldns._ldns_rr_rdf(self, nr)
+            #parameters: const ldns_rr *, size_t,
+            #retvals: ldns_rdf *
+
+        def rrsig_algorithm(self):
+            """
+               Returns the algorithm identifier of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the algorithm or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_algorithm(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_expiration(self):
+            """
+               Returns the expiration time of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the expiration time or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_expiration(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_inception(self):
+            """
+               Returns the inception time of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the inception time or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_inception(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_keytag(self):
+            """
+               Returns the keytag of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the keytag or None on failure.
+            """
+            return _ldns._ldns_rr_rrsig_keytag(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_labels(self):
+            """
+               Returns the number of labels of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the number of labels or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_labels(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_origttl(self):
+            """
+               Returns the original TTL of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the original TTL or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_origttl(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_set_algorithm(self, f):
+            """
+               Sets the algorithm of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The algorithm to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_algorithm(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_expiration(self, f):
+            """
+               Sets the expiration date of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The expiration date to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_expiration(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_inception(self, f):
+            """
+               Sets the inception date of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The inception date to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_inception(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_keytag(self, f):
+            """
+               Sets the keytag of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The keytag to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_keytag(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_labels(self, f):
+            """
+               Sets the number of labels of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The number of labels to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_labels(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_origttl(self, f):
+            """
+               Sets the original TTL of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The original TTL to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_origttl(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_sig(self, f):
+            """
+               Sets the signature data of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The signature data to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_sig(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_signame(self, f):
+            """
+               Sets the signers name of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The signers name to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_signame(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_set_typecovered(self, f):
+            """
+               Sets the typecovered of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :param f: The type covered to set.
+               :type f: :class:`ldns_rdf`
+               :throws TypeError: when `f` of non-:class:`ldns_rdf` type.
+               :return: (bool) True on success, False otherwise.
+            """
+            return _ldns._ldns_rr_rrsig_set_typecovered(self, f)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals: bool
+
+        def rrsig_sig(self):
+            """
+               Returns the signature data of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the signature data or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_sig(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_signame(self):
+            """
+               Returns the signers name of a LDNS_RR_TYPE_RRSIG RR.
+               
+               :return: (:class:`ldns_rdf`) with the signers name or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_signame(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def rrsig_typecovered(self):
+            """
+               Returns the type covered of a LDNS_RR_TYPE_RRSIG rr.
+               
+               :return: (:class:`ldns_rdf`) with the type covered or None
+                   on failure.
+            """
+            return _ldns._ldns_rr_rrsig_typecovered(self)
+            #parameters: const ldns_rr *,
+            #retvals: ldns_rdf *
+
+        def set_class(self, rr_class):
+            """
+               Sets the class in the rr.
+               
+               :param rr_class: Set to this class.
+               :type rr_class: int
+               :throws TypeError: when `rr_class` of non-integer type.
+            """
+            _ldns.ldns_rr_set_class(self, rr_class)
+            #parameters: ldns_rr *, ldns_rr_class,
+            #retvals: 
+
+        def set_owner(self, owner):
+            """
+               Sets the owner in the rr structure.
+               
+               :param owner: Owner name.
+               :type owner: :class:`ldns_dname`
+               :throws TypeError: when `owner` of non-:class:`ldns_dname` type.
+
+               .. note::
+                   The type checking of `owner` is benevolent.
+                   It allows also to pass a dname :class:`ldns_rdf` object.
+                   This will probably change in future.
+            """
+            if (not isinstance(owner, ldns_dname)) and \
+               isinstance(owner, ldns_rdf) and \
+               owner.get_type() == _ldns.LDNS_RDF_TYPE_DNAME:
+                warnings.warn("The ldns_rr.new_frm_str() method will" +
+                    " drop the possibility to accept ldns_rdf as owner." +
+                    " Convert argument to ldns_dname.",
+                    PendingDeprecationWarning, stacklevel=2)
+            _ldns._ldns_rr_set_owner(self, owner)
+            #parameters: ldns_rr *, ldns_rdf *,
+            #retvals:
+
+        def set_question(self, question):
+            """
+               Sets the question flag in the rr structure.
+
+               :param question: Question flag.
+               :type question: bool
+            """
+            _ldns.ldns_rr_set_question(self, question)
+            #parameters: ldns_rr *, bool,
+            #retvals:
+
+        def set_rd_count(self, count):
+            """
+               Sets the rd_count in the rr.
+               
+               :param count: Set to this count.
+               :type count: positive int
+               :throws TypeError: when `count` of non-integer type.
+            """
+            _ldns.ldns_rr_set_rd_count(self, count)
+            #parameters: ldns_rr *, size_t,
+            #retvals: 
+
+        def set_rdf(self, f, position):
+            """
+               Sets a rdf member, it will be set on the position given.
+               
+               The old value is returned, like pop.
+               
+               :param f: The rdf to be set.
+               :type f: :class:`ldns_rdf`
+               :param position: The position the set the rdf.
+               :type position: positive int
+               :throws TypeError: when mismatching types passed.
+               :return: (:class:`ldns_rdf`) the old value in the rr, None
+                   on failure.
+            """
+            return _ldns._ldns_rr_set_rdf(self, f, position)
+            #parameters: ldns_rr *, const ldns_rdf *, size_t,
+            #retvals: ldns_rdf *
+
+        def set_ttl(self, ttl):
+            """
+               Sets the ttl in the rr structure.
+               
+               :param ttl: Set to this ttl.
+               :type ttl: positive int
+               :throws TypeError: when `ttl` of non-integer type.
+            """
+            _ldns.ldns_rr_set_ttl(self, ttl)
+            #parameters: ldns_rr *, uint32_t,
+            #retvals: 
+
+        def set_type(self, rr_type):
+            """
+               Sets the type in the rr.
+               
+               :param rr_type: Set to this type.
+               :type rr_type: integer
+               :throws TypeError: when `rr_type` of non-integer type.
+            """
+            _ldns.ldns_rr_set_type(self, rr_type)
+            #parameters: ldns_rr *, ldns_rr_type,
+            #retvals:
+
+        def to_canonical(self):
+            """
+               Converts each dname in a rr to its canonical form.
+            """
+            _ldns.ldns_rr2canonical(self)
+
+        def ttl(self):
+            """
+               Returns the ttl of an rr structure.
+               
+               :return: (int) the ttl of the rr.
+            """
+            return _ldns.ldns_rr_ttl(self)
+            #parameters: const ldns_rr *,
+            #retvals: uint32_t
+
+        @staticmethod
+        def type_by_name(string):
+            """
+               Retrieves a rr type identifier value by looking up its name.
+
+               Returns 0 if invalid name passed.
+
+               :param string: RR type name.
+               :type string: str
+               :throws TypeError: when `string` of inappropriate type.
+               :return: (int) RR type identifier, or 0 if no matching value
+                   to identifier found.
+            """
+            return _ldns.ldns_get_rr_type_by_name(string)
+
+        def uncompressed_size(self):
+            """
+               Calculates the uncompressed size of an RR.
+               
+               :return: (integer) size of the rr.
+            """
+            return _ldns.ldns_rr_uncompressed_size(self)
+            #parameters: const ldns_rr *,
+            #retvals: size_t
+
+        #
+        # _LDNS_RR_METHODS
+        #
+  %}
+}
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+
+%nodefaultctor ldns_struct_rr_list; /* No default constructor. */
+%nodefaultdtor ldns_struct_rr_list; /* No default destructor. */
+
+%ignore ldns_struct_rr_list::_rrs;
+
+%newobject ldns_rr_list_cat_clone;
+%newobject ldns_rr_list_clone;
+%newobject ldns_rr_list_pop_rr;
+%newobject ldns_rr_list_pop_rr_list;
+%newobject ldns_rr_list_pop_rrset;
+%newobject ldns_rr_list_rr;
+%newobject ldns_rr_list_new;
+%newobject ldns_get_rr_list_hosts_frm_file;
+%newobject ldns_rr_list_subtype_by_rdf;
+%newobject ldns_rr_list2str;
+%delobject ldns_rr_list_deep_free;
+%delobject ldns_rr_list_free;
+
+/* Clone data on push. */
+
+%rename(__ldns_rr_list_push_rr) ldns_rr_list_push_rr;
+%inline
+%{
+  bool _ldns_rr_list_push_rr(ldns_rr_list* r, ldns_rr *rr)
+  {
+    bool ret;
+    ldns_rr *new;
+
+    new = ldns_rr_clone(rr);
+    if (!(ret = ldns_rr_list_push_rr(r, new))) {
+      ldns_rr_free(new);
+    }
+    return ret;
+  }
+%}
+
+%rename(__ldns_rr_list_push_rr_list) ldns_rr_list_push_rr_list;
+%inline
+%{
+  bool _ldns_rr_list_push_rr_list(ldns_rr_list* r, ldns_rr_list *r2)
+  {
+    bool ret;
+    ldns_rr_list *new;
+
+    new = ldns_rr_list_clone(r2);
+    if (!(ret = ldns_rr_list_push_rr_list(r, new))) {
+      ldns_rr_list_deep_free(new);
+    }
+    return ret;
+  }
+%}
+
+
+%newobject _ldns_rr_list_set_rr;
+%rename(__ldns_rr_list_set_rr) ldns_rr_list_set_rr;
+%inline
+%{
+  ldns_rr * _ldns_rr_list_set_rr(ldns_rr_list * rrl, ldns_rr *rr,
+    size_t idx)
+  {
+    ldns_rr *ret;
+    ldns_rr *new;
+
+    new = ldns_rr_clone(rr);
+    if ((ret = ldns_rr_list_set_rr(rrl, new, idx)) == NULL) {
+       ldns_rr_free(new);
+    }
+    return ret;
+  }
+%}
+
+
+%rename(__ldns_rr_list_cat) ldns_rr_list_cat;
+%inline
+%{
+  bool _ldns_rr_list_cat(ldns_rr_list *r, ldns_rr_list *r2)
+  {
+    return ldns_rr_list_cat(r, ldns_rr_list_clone(r2));
+  }
+%}
+
+
+/* End clone data on push. */
+
+
+/* Clone data on pull. */
+
+%newobject _ldns_rr_list_rr;
+%rename(__ldns_rr_list_rr) ldns_rr_list_rr;
+%inline
+%{
+  ldns_rr * _ldns_rr_list_rr(ldns_rr_list *r, int i)
+  {
+    ldns_rr *rr;
+    rr = ldns_rr_list_rr(r, i);
+    return (rr != NULL) ? ldns_rr_clone(rr) : NULL;
+  }
+%}
+
+%newobject _ldns_rr_list_owner;
+%rename(__ldns_rr_list_owner) ldns_rr_list_owner;
+%inline
+%{
+  ldns_rdf * _ldns_rr_list_owner(ldns_rr_list *r)
+  {
+    ldns_rdf *rdf;
+    rdf = ldns_rr_list_owner(r);
+    return (rdf != NULL) ? ldns_rdf_clone(rdf) : NULL;
+  }
+%}
+
+
+/* End clone data on pull. */
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+
+%rename(ldns_rr_list) ldns_struct_rr_list;
+#ifdef LDNS_DEBUG
+%rename(__ldns_rr_list_deep_free) ldns_rr_list_deep_free;
+%rename(__ldns_rr_list_free) ldns_rr_list_free;
+%inline
+%{
+  void _ldns_rr_list_deep_free(ldns_rr_list *r)
+  {
+    printf("******** LDNS_RR_LIST deep free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_rr_list_deep_free(r);
+  }
+
+  void _ldns_rr_list_free(ldns_rr_list *r)
+  {
+    printf("******** LDNS_RR_LIST deep free 0x%lX ************\n",
+      (long unsigned int) r);
+    ldns_rr_list_free(r);
+  }
+%}
+#else
+%rename(_ldns_rr_list_deep_free) ldns_rr_list_deep_free;
+%rename(_ldns_rr_list_free) ldns_rr_list_free;
+#endif
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+
+/* None. */
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+
+%feature("docstring") ldns_struct_rr_list "List of Resource Records.
+
+This class contains a list of RR's (see :class:`ldns.ldns_rr`).
+"
+
+%extend ldns_struct_rr_list {
+ 
+  %pythoncode
+  %{
+        def __init__(self):
+            self.this = _ldns.ldns_rr_list_new()
+            if not self.this:
+                raise Exception("Can't create new RR_LIST")
+       
+        __swig_destroy__ = _ldns._ldns_rr_list_deep_free
+
+        #
+        # LDNS_RR_LIST_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def new(raiseException=True):
+            """
+               Creates an empty RR List object.
+
+               :param raiseException: Set to True if an exception should
+                   signal an error.
+               :type raiseException: bool
+               :throws Exception: when `raiseException` is True and error
+                   occurs.
+               :return: :class:`ldns_rr_list` Empty RR list.
+            """
+            rrl = _ldns.ldns_rr_list_new()
+            if (not rrl) and raiseException:
+                raise Exception("Can't create RR List.")
+            return rrl
+
+        @staticmethod
+        def new_frm_file(filename="/etc/hosts", raiseException=True):
+            """
+               Creates an RR List object from file content.
+
+               Goes through a file and returns a rr list containing
+               all the defined hosts in there.
+
+               :param filename: The filename to use.
+               :type filename: str
+               :param raiseException: Set to True if an exception should
+                   signal an error.
+               :type raiseException: bool
+               :throws TypeError: when `filename` of inappropriate type.
+               :throws Exception: when `raiseException` is True and error
+                   occurs.
+               :return: RR List object or None. If the object can't be
+                   created and `raiseException` is True, an exception occurs.
+
+               **Usage**
+
+               >>> alist = ldns.ldns_rr_list.new_frm_file()
+               >>> print alist
+               localhost.	3600	IN	A	127.0.0.1
+               ...
+
+            """
+            rr = _ldns.ldns_get_rr_list_hosts_frm_file(filename)
+            if (not rr) and (raiseException):
+                raise Exception("Can't create RR List.")
+            return rr
+
+        #
+        # _LDNS_RR_LIST_CONSTRUCTORS
+        #
+
+        def __str__(self):
+            """
+               Converts a list of resource records to presentation format.
+
+               :return: (str) Presentation format.
+            """
+            return _ldns.ldns_rr_list2str(self)
+
+        def print_to_file(self, output):
+            """
+               Print a rr_list to output.
+
+               :param output: Opened file to print to.
+               :throws TypeError: when `output` of inappropriate type.
+            """
+            _ldns.ldns_rr_list_print(output, self)
+
+
+        def to_canonical(self):
+            """
+               Converts each dname in each rr in a rr_list to its canonical
+               form.
+            """
+            _ldns.ldns_rr_list2canonical(self)
+            #parameters: ldns_rr_list *,
+            #retvals: 
+
+        def rrs(self):
+            """
+               Returns a generator object of a list of rr records.
+
+               :return: (generator) generator object.
+            """
+            for i in range(0, self.rr_count()):
+                yield self.rr(i)
+
+        def is_rrset(self):
+            """
+               Checks if the rr list is a rr set.
+
+               :return: (bool) True if rr list is a rr set.
+            """
+            return _ldns.ldns_is_rrset(self)
+
+        def __cmp__(self, rrl2):
+            """
+               Compares two rr lists.
+               
+               :param rrl2: The second one.
+               :type rrl2: :class:`ldns_rr_list`
+               :throws TypeError: when `rrl2` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (int) 0 if equal, -1 if this list comes before
+                   `rrl2`, 1 if `rrl2` comes before this list.
+            """
+            return _ldns.ldns_rr_list_compare(self, rrl2)
+
+        def __lt__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is less than 'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) == -1
+
+        def __le__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is less than or equal to
+                   'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) != 1
+
+        def __eq__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is equal to 'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) == 0
+
+        def __ne__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is not equal to 'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) != 0
+
+        def __gt__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is greater than 'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) == 1
+
+        def __ge__(self, other):
+            """
+               Compares two rr lists.
+               
+               :param other: The second one.
+               :type other: :class:`ldns_rr_list`
+               :throws TypeError: when `other` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True when `self` is greater than or equal to
+                   'other'.
+            """
+            return _ldns.ldns_rr_list_compare(self, other) != -1
+
+        def write_to_buffer(self, buffer):
+            """
+               Copies the rr_list data to the buffer in wire format.
+               
+               :param buffer: Output buffer to append the result to.
+               :type buffer: :class:`ldns_buffer`
+               :throws TypeError: when `buffer` of non-:class:`ldns_buffer`
+                   type.
+               :return: (ldns_status) ldns_status
+            """
+            return _ldns.ldns_rr_list2buffer_wire(buffer, self)
+
+        #
+        # LDNS_RR_LIST_METHODS_
+        #
+
+        def cat(self, right):
+            """
+               Concatenates two ldns_rr_lists together.
+               
+               This modifies rr list (to extend it and adds RRs from right).
+               
+               :param right: The right-hand side.
+               :type right: :class:`ldns_rr_list`
+               :throws TypeError: when `right` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (bool) True if success.
+            """
+            return _ldns._ldns_rr_list_cat(self, right)
+            #parameters: ldns_rr_list *, ldns_rr_list *,
+            #retvals: bool
+
+        def cat_clone(self, right):
+            """
+               Concatenates two ldns_rr_lists together, creates a new list
+               of the rr's (instead of appending the content to an existing
+               list).
+               
+               :param right: The right-hand side.
+               :type right: :class:`ldns_rr_list`
+               :throws TypeError: when `right` of non-:class:`ldns_rr_list`
+                   type.
+               :return: (:class:`ldns_rr_list`) rr list with left-hand side +
+                   right-hand side concatenated, on None on error.
+            """
+            return _ldns.ldns_rr_list_cat_clone(self, right)
+            #parameters: ldns_rr_list *, ldns_rr_list *,
+            #retvals: ldns_rr_list *
+
+        def clone(self):
+            """
+               Clones an rrlist.
+               
+               :return: (:class:`ldns_rr_list`) the cloned rr list,
+                   or None on error.
+            """
+            return _ldns.ldns_rr_list_clone(self)
+            #parameters: const ldns_rr_list *,
+            #retvals: ldns_rr_list *
+
+        def contains_rr(self, rr):
+            """
+               Returns True if the given rr is one of the rrs in the list,
+               or if it is equal to one.
+               
+               :param rr: The rr to check.
+               :type rr: :class:`ldns_rr`
+               :throws TypeError: when `rr` of non-:class:`ldns_rr` type.
+               :return: (bool) True if rr_list contains `rr`, False otherwise.
+            """
+            return _ldns.ldns_rr_list_contains_rr(self, rr)
+            #parameters: const ldns_rr_list *, ldns_rr *,
+            #retvals: bool
+
+        def owner(self):
+            """
+               Returns the owner domain name rdf of the first element of
+               the RR. If there are no elements present, None is returned.
+               
+               :return: (:class:`ldns_dname`) dname of the first element,
+                   or None if the list is empty.
+            """
+            rdf = _ldns._ldns_rr_list_owner(self)
+            if rdf:
+                rdf = ldns_dname(rdf, clone=False)
+            return rdf
+            #parameters: const ldns_rr_list *,
+            #retvals: ldns_rdf *
+
+        def pop_rr(self):
+            """
+               Pops the last rr from an rrlist.
+               
+               :return: (:class:`ldns_rr`) None if nothing to pop.
+                   Otherwise the popped RR.
+            """
+            rr = _ldns.ldns_rr_list_pop_rr(self)
+            return rr
+            #parameters: ldns_rr_list *,
+            #retvals: ldns_rr *
+
+        def pop_rr_list(self, size):
+            """
+               Pops an rr_list of size s from an rrlist.
+               
+               :param size: The number of rr's to pop.
+               :type size: positive int
+               :throws TypeError: when `size` of inappropriate type.
+               :return: (:class:`ldns_rr_list`) None if nothing to pop.
+                   Otherwise the popped rr list.
+            """
+            return _ldns.ldns_rr_list_pop_rr_list(self, size)
+            #parameters: ldns_rr_list *, size_t,
+            #retvals: ldns_rr_list *
+
+        def pop_rrset(self):
+            """
+               Pops the first rrset from the list, the list must be sorted,
+               so that all rr's from each rrset are next to each other.
+               
+               :return: (:class:`ldns_rr_list`) the first rrset, or None when
+                   empty.
+            """
+            return _ldns.ldns_rr_list_pop_rrset(self)
+            #parameters: ldns_rr_list *,
+            #retvals: ldns_rr_list *
+
+        def push_rr(self, rr):
+            """
+               Pushes an rr to an rrlist.
+               
+               :param rr: The rr to push.
+               :type rr: :class:`ldns_rr`
+               :throws TypeError: when `rr` of non-:class:`ldns_rr` type.
+               :return: (bool) False on error, otherwise True.
+            """
+            return _ldns._ldns_rr_list_push_rr(self, rr)
+            #parameters: ldns_rr_list *, const ldns_rr *,
+            #retvals: bool
+
+        def push_rr_list(self, push_list):
+            """
+               Pushes an rr list to an rr list.
+               
+               :param push_list: The rr_list to push.
+               :type push_list: :class:`ldns_rr_list`
+               :throws TypeError: when `push_list` of non-:class:`ldns_rr_list`
+                   type.
+               :returns: (bool) False on error, otherwise True.
+            """
+            return _ldns._ldns_rr_list_push_rr_list(self, push_list)
+            #parameters: ldns_rr_list *, const ldns_rr_list *,
+            #retvals: bool
+
+        def rr(self, nr):
+            """
+               Returns a specific rr of an rrlist.
+               
+               :param nr: Index of the desired rr.
+               :type nr: positive int
+               :throws TypeError: when `nr` of inappropriate type.
+               :return: (:class:`ldns_rr`) The rr at position `nr`, or None
+                   if failed.
+            """
+            return _ldns._ldns_rr_list_rr(self, nr)
+            #parameters: const ldns_rr_list *, size_t,
+            #retvals: ldns_rr *
+
+        def rr_count(self):
+            """
+               Returns the number of rr's in an rr_list.
+               
+               :return: (int) The number of rr's.
+            """
+            return _ldns.ldns_rr_list_rr_count(self)
+            #parameters: const ldns_rr_list *,
+            #retvals: size_t
+
+        def set_rr(self, r, idx):
+            """
+               Set a rr on a specific index in a ldns_rr_list.
+               
+               :param r: The rr to set.
+               :type r: :class:`ldns_rr`
+               :param idx: Index into the rr_list.
+               :type idx: positive int
+               :throws TypeError: when parameters of inappropriate types.
+               :return: (:class:`ldns_rr`) the old rr which was stored in
+                   the rr_list, or None if the index was too large
+                   to set a specific rr.
+            """
+            return _ldns._ldns_rr_list_set_rr(self, r, idx)
+            #parameters: ldns_rr_list *, const ldns_rr *, size_t,
+            #retvals: ldns_rr *
+
+        def set_rr_count(self, count):
+            """
+               Sets the number of rr's in an rr_list.
+               
+               :param count: The number of rr in this list.
+               :type count: positive int
+               :throws TypeError: when `count` of non-integer type.
+               :throws Exception: when `count` out of acceptable range.
+
+               .. warning::
+                   Don't use this method unless you really know what you
+                   are doing.
+            """
+            # The function C has a tendency to generate an assertion fail when 
+            # the count exceeds the list's capacity -- therefore the checking
+            # code.
+            if isinstance(count, int) and \
+               ((count < 0) or (count > self._rr_capacity)):
+                raise Exception("Given count %d is out of range " % (count) +
+                    "of the rr list's capacity %d." % (self._rr_capacity))
+            _ldns.ldns_rr_list_set_rr_count(self, count)
+            #parameters: ldns_rr_list *, size_t,
+            #retvals: 
+
+        def sort(self):
+            """
+               Sorts an rr_list (canonical wire format).
+            """
+            _ldns.ldns_rr_list_sort(self)
+            #parameters: ldns_rr_list *,
+            #retvals: 
+
+        def subtype_by_rdf(self, r, pos):
+            """
+               Return the rr_list which matches the rdf at position field.
+               
+               Think type-covered stuff for RRSIG.
+               
+               :param r: The rdf to use for the comparison.
+               :type r: :class:`ldns_rdf`
+               :param pos: At which position we can find the rdf.
+               :type pos: positive int
+               :throws TypeError: when parameters of inappropriate types.
+               :return: (:class:`ldns_rr_list`) a new rr list with only
+                   the RRs that match, or None when nothing matches.
+            """
+            return _ldns.ldns_rr_list_subtype_by_rdf(self, r, pos)
+            #parameters: ldns_rr_list *, ldns_rdf *, size_t,
+            #retvals: ldns_rr_list *
+
+        def type(self):
+            """
+               Returns the type of the first element of the RR.
+
+               If there are no elements present, 0 is returned.
+               
+               :return: (int) rr_type of the first element,
+                   or 0 if the list is empty.
+            """
+            return _ldns.ldns_rr_list_type(self)
+            #parameters: const ldns_rr_list *,
+            #retvals: ldns_rr_type
+
+        #
+        # _LDNS_RR_LIST_METHODS
+        #
+  %}
+}
+
+
+/* ========================================================================= */
+/* SWIG setting and definitions. */
+/* ========================================================================= */
+
+
+%newobject ldns_rr_descript;
+
+%nodefaultctor ldns_struct_rr_descriptor; /* No default constructor. */
+%nodefaultdtor ldns_struct_rr_descriptor; /* No default destructor.*/
+%rename(ldns_rr_descriptor) ldns_struct_rr_descriptor;
+
+
+/* ========================================================================= */
+/* Debugging related code. */
+/* ========================================================================= */
+
+/* None. */
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+
+%inline
+%{
+   /*
+    * Does nothing, but keeps the SWIG wrapper quiet about absent destructor.
+    */
+   void ldns_rr_descriptor_dummy_free(const ldns_rr_descriptor *rd)
+   {
+     (void) rd;
+   }
+%}
+
+
+/* ========================================================================= */
+/* Encapsulating Python code. */
+/* ========================================================================= */
+
+
+%feature("docstring") ldns_struct_rr_descriptor "Resource Record descriptor.
+
+This structure contains, for all rr types, the rdata fields that are defined.
+
+In order to create a class instance use :meth:`ldns_rr_descriptor`.
+"
+
+%extend ldns_struct_rr_descriptor {
+  %pythoncode
+  %{
+        def __init__(self, rr_type):
+            """
+               Returns the resource record descriptor for the given type.
+
+               :param rr_type: RR type. 
+               :type rr_type: int
+               :throws TypeError: when `rr_type` of inappropriate type.
+               :return: (:class:`ldns_rr_descriptor`) RR descriptor class.
+            """
+            self.this = self.ldns_rr_descriptor(rr_type)
+
+        def __str__(self):
+            raise Exception("The content of this class cannot be printed.")
+
+        __swig_destroy__ = _ldns.ldns_rr_descriptor_dummy_free
+
+        #
+        # LDNS_RR_DESCRIPTOR_CONSTRUCTORS_
+        #
+
+        @staticmethod
+        def ldns_rr_descriptor(rr_type):
+            """
+               Returns the resource record descriptor for the given type.
+
+               :param rr_type: RR type. 
+               :type rr_type: int
+               :throws TypeError: when `rr_type` of inappropriate type.
+               :return: (:class:`ldns_rr_descriptor`) RR descriptor class.
+            """
+            return _ldns.ldns_rr_descript(rr_type)
+            #parameters: uint16_t
+            #retvals: const ldns_rr_descriptor *
+
+        #
+        # _LDNS_RR_DESCRIPTOR_CONSTRUCTORS
+        #
+
+        #
+        # LDNS_RR_DESCRIPTOR_METHODS_
+        #
+
+        def field_type(self, field):
+            """
+               Returns the rdf type for the given rdata field number of the
+               rr type for the given descriptor.
+               
+               :param field: The field number.
+               :type field: positive int
+               :throws TypeError: when `field` of non-integer type.
+               :return: (int) the rdf type for the field.
+            """
+            return _ldns.ldns_rr_descriptor_field_type(self, field)
+            #parameters: const ldns_rr_descriptor *, size_t,
+            #retvals: ldns_rdf_type
+
+        def maximum(self):
+            """
+               Returns the maximum number of rdata fields of the rr type this
+               descriptor describes.
+               
+               :return: (int) the maximum number of rdata fields.
+            """
+            return _ldns.ldns_rr_descriptor_maximum(self)
+            #parameters: const ldns_rr_descriptor *,
+            #retvals: size_t
+
+        def minimum(self):
+            """
+               Returns the minimum number of rdata fields of the rr type this
+               descriptor describes.
+               
+               :return: (int) the minimum number of rdata fields.
+            """
+            return _ldns.ldns_rr_descriptor_minimum(self)
+            #parameters: const ldns_rr_descriptor *,
+            #retvals: size_t
+
+        #
+        # _LDNS_RR_DESCRIPTOR_METHODS
+        #
+  %}
+}
+
+
+/* ========================================================================= */
+/* Added C code. */
+/* ========================================================================= */
+
+
+/*
+ * rrsig checking wrappers
+ *
+ * Copying of rr pointers into the good_keys list leads to double free
+ * problems, therefore we provide two options - either ignore the keys
+ * or get list of indexes of the keys. The latter allows fetching of the
+ * keys later on from the original key set.
+ */
+
+%rename(__ldns_verify_rrsig_keylist) ldns_verify_rrsig_keylist;
+%inline
+%{
+  ldns_status ldns_verify_rrsig_keylist_status_only(ldns_rr_list *rrset,
+    ldns_rr *rrsig, const ldns_rr_list *keys)
+  {
+    ldns_rr_list *good_keys = ldns_rr_list_new();
+    ldns_status status = ldns_verify_rrsig_keylist(rrset, rrsig, keys,
+        good_keys);
+    ldns_rr_list_free(good_keys);
+    return status;
+  }
+%}
+
+%rename(__ldns_verify_rrsig_keylist) ldns_verify_rrsig_keylist;
+%inline
+%{
+  PyObject* ldns_verify_rrsig_keylist_(ldns_rr_list *rrset,
+    ldns_rr *rrsig, const ldns_rr_list *keys)
+  {
+    PyObject* tuple;
+    PyObject* keylist;
+    ldns_rr_list *good_keys = ldns_rr_list_new();
+    ldns_status status = ldns_verify_rrsig_keylist(rrset, rrsig, keys,
+      good_keys);
+
+    tuple = PyTuple_New(2);
+    PyTuple_SetItem(tuple, 0, SWIG_From_int(status)); 
+    keylist = PyList_New(0);
+    if (status == LDNS_STATUS_OK) {
+      unsigned int i;
+      for (i = 0; i < ldns_rr_list_rr_count(keys); i++) {
+         if (ldns_rr_list_contains_rr(good_keys, ldns_rr_list_rr(keys, i))) {
+           PyList_Append(keylist, SWIG_From_int(i));
+         }
+      }
+    }
+    PyTuple_SetItem(tuple, 1, keylist);
+    ldns_rr_list_free(good_keys);
+    return tuple;
+  }
+%}
+
+
+%rename(__ldns_verify_rrsig_keylist_notime) ldns_verify_rrsig_keylist_notime;
+%inline
+%{
+  ldns_status ldns_verify_rrsig_keylist_notime_status_only(ldns_rr_list *rrset,
+    ldns_rr *rrsig, const ldns_rr_list *keys)
+  {
+    ldns_rr_list *good_keys = ldns_rr_list_new();
+    ldns_status status = ldns_verify_rrsig_keylist_notime(rrset, rrsig, keys,
+      good_keys);
+    ldns_rr_list_free(good_keys);
+    return status;
+  }
+%}
+
+%rename(__ldns_verify_rrsig_keylist_notime) ldns_verify_rrsig_keylist_notime;
+%inline
+%{
+  PyObject* ldns_verify_rrsig_keylist_notime_(ldns_rr_list *rrset,
+    ldns_rr *rrsig, const ldns_rr_list *keys)
+  {
+    PyObject* tuple;
+    PyObject* keylist;
+    ldns_rr_list *good_keys = ldns_rr_list_new();
+    ldns_status status = ldns_verify_rrsig_keylist_notime(rrset, rrsig, keys,
+      good_keys);
+
+    tuple = PyTuple_New(2);
+    PyTuple_SetItem(tuple, 0, SWIG_From_int(status)); 
+    keylist = PyList_New(0);
+    if (status == LDNS_STATUS_OK) {
+      unsigned int i;
+      for (i = 0; i < ldns_rr_list_rr_count(keys); i++) {
+        if (ldns_rr_list_contains_rr(good_keys, ldns_rr_list_rr(keys, i))) {
+          PyList_Append(keylist, SWIG_From_int(i));
+        }
+      }
+    }
+    PyTuple_SetItem(tuple, 1, keylist);
+    ldns_rr_list_free(good_keys);
+    return tuple;
+  }
+%}
+
+/* End of rrsig checking wrappers. */
diff --git a/contrib/ldns/contrib/python/ldns_zone.i b/contrib/ldns/contrib/python/ldns_zone.i
new file mode 100644
index 00000000000000..bbb8d8f21aebf4
--- /dev/null
+++ b/contrib/ldns/contrib/python/ldns_zone.i
@@ -0,0 +1,298 @@
+/******************************************************************************
+ * ldns_zone.i: LDNS zone class
+ *
+ * Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+ *                     Karel Slany    (slany AT fit.vutbr.cz)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the organization nor the names of its
+ *       contributors may be used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************/
+
+%typemap(in,numinputs=0,noblock=1) (ldns_zone **)
+{
+ ldns_zone *$1_zone;
+ $1 = &$1_zone;
+}
+          
+/* result generation */
+%typemap(argout,noblock=1) (ldns_zone **)
+{
+ $result = SWIG_Python_AppendOutput($result, SWIG_NewPointerObj(SWIG_as_voidptr($1_zone), SWIGTYPE_p_ldns_struct_zone, SWIG_POINTER_OWN |  0 ));
+}
+
+%nodefaultctor ldns_struct_zone; //no default constructor & destructor
+%nodefaultdtor ldns_struct_zone;
+
+%newobject ldns_zone_new_frm_fp;
+%newobject ldns_zone_new_frm_fp_l;
+%newobject ldns_zone_new;
+%delobject ldns_zone_free;
+%delobject ldns_zone_deep_free;
+%delobject ldns_zone_push_rr;
+%delobject ldns_zone_push_rr_list;
+
+%ignore ldns_struct_zone::_soa;
+%ignore ldns_struct_zone::_rrs;
+
+%rename(ldns_zone) ldns_struct_zone;
+
+#ifdef LDNS_DEBUG
+%rename(__ldns_zone_free) ldns_zone_free;
+%rename(__ldns_zone_deep_free) ldns_zone_deep_free;
+%inline %{
+void _ldns_zone_free (ldns_zone* z) {
+   printf("******** LDNS_ZONE free 0x%lX ************\n", (long unsigned int)z);
+   ldns_zone_deep_free(z);
+}
+%}
+#else
+%rename(__ldns_zone_free) ldns_zone_free;
+%rename(_ldns_zone_free) ldns_zone_deep_free;
+#endif
+%feature("docstring") ldns_struct_zone "Zone definitions
+
+**Usage**
+
+This class is able to read and parse the content of zone file by doing:
+
+>>> import ldns
+>>> zone = ldns.ldns_zone.new_frm_fp(open(\"zone.txt\",\"r\"), None, 0, ldns.LDNS_RR_CLASS_IN)
+>>> print zone.soa()
+example.	600	IN	SOA	example. admin.example. 2008022501 28800 7200 604800 18000
+>>> print zone.rrs()
+example.	600	IN	MX	10 mail.example.
+example.	600	IN	NS	ns1.example.
+example.	600	IN	NS	ns2.example.
+example.	600	IN	A	192.168.1.1
+
+The ``zone.txt`` file contains the following records::
+
+   $ORIGIN example.
+   $TTL 600
+   
+   example.        IN SOA  example. admin.example. (
+                                   2008022501 ; serial
+                                   28800      ; refresh (8 hours)
+                                   7200       ; retry (2 hours)
+                                   604800     ; expire (1 week)
+                                   18000      ; minimum (5 hours)
+                                   )
+   
+   @       IN      MX      10 mail.example.
+   @       IN      NS      ns1
+   @       IN      NS      ns2
+   @       IN      A       192.168.1.1
+"
+
+%extend ldns_struct_zone {
+ 
+ %pythoncode %{
+        def __init__(self):
+            self.this = _ldns.ldns_zone_new()
+            if not self.this:
+                raise Exception("Can't create zone.")
+       
+        __swig_destroy__ = _ldns._ldns_zone_free
+
+        def __str__(self):
+            return str(self.soa()) + "\n" + str(self.rrs())
+
+        def print_to_file(self,output):
+            """Prints the data in the zone to the given file stream (in presentation format)."""
+            _ldns.ldns_zone_print(output,self)
+            #parameters: FILE *,const ldns_zone *,
+
+        #LDNS_ZONE_CONSTRUCTORS_#
+        @staticmethod
+        def new_frm_fp(file, origin, ttl, rr_class=_ldns.LDNS_RR_CLASS_IN, raiseException=True):
+            """Creates a new zone object from given file pointer
+               
+               :param file: a file object
+               :param origin: (ldns_rdf) the zones' origin
+               :param ttl: default ttl to use
+               :param rr_class: Default class to use (IN)
+               :param raiseException: if True, an exception occurs in case a zone instance can't be created
+               :returns: zone instance or None. If an instance can't be created and raiseException is True, an exception occurs.
+            """
+            status, zone = _ldns.ldns_zone_new_frm_fp(file, origin, ttl, rr_class)
+            if status != LDNS_STATUS_OK:
+                if (raiseException): raise Exception("Can't create zone, error: %s (%d)" % (_ldns.ldns_get_errorstr_by_id(status),status))
+                return None
+            return zone
+
+        @staticmethod
+        def new_frm_fp_l(file, origin, ttl, rr_class, raiseException=True):
+            """Create a new zone from a file, keep track of the line numbering
+               
+               :param file: a file object
+               :param origin: (ldns_rdf) the zones' origin
+               :param ttl: default ttl to use
+               :param rr_class: Default class to use (IN)
+               :param raiseException: if True, an exception occurs in case a zone instance can't be created
+               :returns: 
+                   * zone - zone instance or None. If an instance can't be created and raiseException is True, an exception occurs.
+
+                   * line - used for error msg, to get to the line number
+            """
+            status, zone = _ldns.ldns_zone_new_frm_fp_l(file, line)
+            if status != LDNS_STATUS_OK:
+                if (raiseException): raise Exception("Can't create zone, error: %d" % status)
+                return None
+            return zone
+        #_LDNS_ZONE_CONSTRUCTORS#
+
+        def sign(self,key_list):
+            """Signs the zone, and returns a newly allocated signed zone.
+               
+               :param key_list:
+                   list of keys to sign with
+               :returns: (ldns_zone \*) signed zone
+            """
+            return _ldns.ldns_zone_sign(self,key_list)
+            #parameters: const ldns_zone *,ldns_key_list *,
+            #retvals: ldns_zone *
+
+        def sign_nsec3(self,key_list,algorithm,flags,iterations,salt_length,salt):
+            """Signs the zone with NSEC3, and returns a newly allocated signed zone.
+               
+               :param key_list:
+                   list of keys to sign with
+               :param algorithm:
+                   the NSEC3 hashing algorithm to use
+               :param flags:
+                   NSEC3 flags
+               :param iterations:
+                   the number of NSEC3 hash iterations to use
+               :param salt_length:
+                   the length (in octets) of the NSEC3 salt
+               :param salt:
+                   the NSEC3 salt data
+               :returns: (ldns_zone \*) signed zone
+            """
+            return _ldns.ldns_zone_sign_nsec3(self,key_list,algorithm,flags,iterations,salt_length,salt)
+            #parameters: ldns_zone *,ldns_key_list *,uint8_t,uint8_t,uint16_t,uint8_t,uint8_t *,
+            #retvals: ldns_zone *
+
+        #LDNS_ZONE_METHODS_#
+        def glue_rr_list(self):
+            """Retrieve all resource records from the zone that are glue records.
+               
+               The resulting list does are pointer references to the zone's data.
+               
+               Due to the current zone implementation (as a list of rr's), this function is extremely slow. Another (probably better) way to do this is to use an ldns_dnssec_zone structure and the mark_glue function
+               
+               :returns: (ldns_rr_list \*) the rr_list with the glue
+            """
+            return _ldns.ldns_zone_glue_rr_list(self)
+            #parameters: const ldns_zone *,
+            #retvals: ldns_rr_list *
+
+        def push_rr(self,rr):
+            """push an single rr to a zone structure.
+               
+               This function use pointer copying, so the rr_list structure inside z is modified!
+               
+               :param rr:
+                   the rr to add
+               :returns: (bool) a true on success otherwise falsed
+            """
+            return _ldns.ldns_zone_push_rr(self,rr)
+            #parameters: ldns_zone *,ldns_rr *,
+            #retvals: bool
+
+        def push_rr_list(self,list):
+            """push an rrlist to a zone structure.
+               
+               This function use pointer copying, so the rr_list structure inside z is modified!
+               
+               :param list:
+                   the list to add
+               :returns: (bool) a true on success otherwise falsed
+            """
+            return _ldns.ldns_zone_push_rr_list(self,list)
+            #parameters: ldns_zone *,ldns_rr_list *,
+            #retvals: bool
+
+        def rr_count(self):
+            """Returns the number of resource records in the zone, NOT counting the SOA record.
+               
+               :returns: (size_t) the number of rr's in the zone
+            """
+            return _ldns.ldns_zone_rr_count(self)
+            #parameters: const ldns_zone *,
+            #retvals: size_t
+
+        def rrs(self):
+            """Get a list of a zone's content.
+               
+               Note that the SOA isn't included in this list. You need to get the with ldns_zone_soa.
+               
+               :returns: (ldns_rr_list \*) the rrs from this zone
+            """
+            return _ldns.ldns_zone_rrs(self)
+            #parameters: const ldns_zone *,
+            #retvals: ldns_rr_list *
+
+        def set_rrs(self,rrlist):
+            """Set the zone's contents.
+               
+               :param rrlist:
+                   the rrlist to use
+            """
+            _ldns.ldns_zone_set_rrs(self,rrlist)
+            #parameters: ldns_zone *,ldns_rr_list *,
+            #retvals: 
+
+        def set_soa(self,soa):
+            """Set the zone's soa record.
+               
+               :param soa:
+                   the soa to set
+            """
+            _ldns.ldns_zone_set_soa(self,soa)
+            #parameters: ldns_zone *,ldns_rr *,
+            #retvals: 
+
+        def soa(self):
+            """Return the soa record of a zone.
+               
+               :returns: (ldns_rr \*) the soa record in the zone
+            """
+            return _ldns.ldns_zone_soa(self)
+            #parameters: const ldns_zone *,
+            #retvals: ldns_rr *
+
+        def sort(self):
+            """Sort the rrs in a zone, with the current impl.
+               
+               this is slow
+            """
+            _ldns.ldns_zone_sort(self)
+            #parameters: ldns_zone *,
+            #retvals: 
+
+            #_LDNS_ZONE_METHODS#
+ %}
+}
diff --git a/contrib/ldns/dane.c b/contrib/ldns/dane.c
index 30dc1f700519e9..b8487b53a82572 100644
--- a/contrib/ldns/dane.c
+++ b/contrib/ldns/dane.c
@@ -1,7 +1,7 @@
 /*
  * Verify or create TLS authentication with DANE (RFC6698)
  *
- * (c) NLnetLabs 2012
+ * (c) NLnetLabs 2012-2020
  *
  * See the file LICENSE for the license.
  *
@@ -29,6 +29,63 @@
 #include <openssl/x509v3.h>
 #endif
 
+/* OpenSSL context options. At the moment, disable SSLv2, SSLv3
+ * and Compression, if available. TLSv1.0 is allowed at the moment.
+ * TLSv1.1 is the first to provide elliptic curves, so it is usually
+ * allowed in a TLS stack. TLSv1.2 is the first to provide authentication
+ * modes of operation, like GCM. The defines below are a moving
+ * target based on OpenSSL library version. Grep is useful to find
+ * the defines: grep -IR SSL_OP_NO_ /usr/include/openssl.
+ */
+#ifdef HAVE_SSL
+# ifdef SSL_OP_NO_SSLv2
+	const long NoOpenSSLv2 = SSL_OP_NO_SSLv2;
+# else
+	const long NoOpenSSLv2 = 0L;
+# endif
+# ifdef SSL_OP_NO_SSLv3
+	const long NoOpenSSLv3 = SSL_OP_NO_SSLv3;
+# else
+	const long NoOpenSSLv3 = 0L;
+# endif
+# ifdef SSL_OP_NO_TLSv1
+	const long NoOpenTLSv1 = SSL_OP_NO_TLSv1;
+# else
+	const long NoOpenTLSv1 = 0L;
+# endif
+# ifdef SSL_OP_NO_DTLSv1
+	const long NoOpenDTLSv1 = SSL_OP_NO_DTLSv1;
+# else
+	const long NoOpenDTLSv1 = 0L;
+# endif
+# ifdef SSL_OP_NO_COMPRESSION
+	const long NoOpenSSLCompression = SSL_OP_NO_COMPRESSION;
+# else
+	const long NoOpenSSLCompression = 0L;
+# endif
+#endif
+
+#if defined(USE_DANE_VERIFY) && defined(USE_DANE_TA_USAGE)
+static SSL_CTX*
+ldns_dane_new_ssl_context(void)
+{
+	SSL_CTX* ssl_ctx;
+
+	ssl_ctx = SSL_CTX_new(TLS_client_method());
+	if (ssl_ctx != NULL)
+	{
+		/* ldns allows TLS and DTLS v1.0 at the moment. Some may disagree.
+		 * Sometime in the future they may be disabled, too. Maybe
+		 * --disable-tlsv1 and --disable-dtlsv1 should be configure options.
+		 */
+		long flags = NoOpenSSLv2 | NoOpenSSLv3 | NoOpenSSLCompression;
+		SSL_CTX_set_options(ssl_ctx, flags);
+	}
+
+	return ssl_ctx;
+}
+#endif
+
 ldns_status
 ldns_dane_create_tlsa_owner(ldns_rdf** tlsa_owner, const ldns_rdf* name,
 		uint16_t port, ldns_dane_transport transport)
@@ -193,7 +250,7 @@ ldns_dane_pkix_validate(X509* cert, STACK_OF(X509)* extra_certs,
 }
 
 
-/* Orinary PKIX validation of cert (with extra_certs to help)
+/* Ordinary PKIX validation of cert (with extra_certs to help)
  * against the CA's in store, but also return the validation chain.
  */
 static ldns_status
@@ -641,7 +698,7 @@ ldns_dane_verify_rr(const ldns_rr* tlsa_rr,
 	 * verification.  We use these undocumented means with the ldns
 	 * dane function prototypes which did only offline dane verification.
 	 */
-	if (!(ssl_ctx = SSL_CTX_new(TLS_client_method())))
+	if (!(ssl_ctx = ldns_dane_new_ssl_context()))
 		s = LDNS_STATUS_MEM_ERR;
 
 	else if (SSL_CTX_dane_enable(ssl_ctx) <= 0)
@@ -841,7 +898,7 @@ ldns_dane_verify(const ldns_rr_list* tlsas,
 	 * verification.  We use these undocumented means with the ldns
 	 * dane function prototypes which did only offline dane verification.
 	 */
-	if (!(ssl_ctx = SSL_CTX_new(TLS_client_method())))
+	if (!(ssl_ctx = ldns_dane_new_ssl_context()))
 		s = LDNS_STATUS_MEM_ERR;
 
 	else if (SSL_CTX_dane_enable(ssl_ctx) <= 0)
diff --git a/contrib/ldns/dname.c b/contrib/ldns/dname.c
index 17afe1d333d0c2..4f311ee29856be 100644
--- a/contrib/ldns/dname.c
+++ b/contrib/ldns/dname.c
@@ -3,7 +3,7 @@
  *
  * dname specific rdata implementations
  * A dname is a rdf structure with type LDNS_RDF_TYPE_DNAME
- * It is not a /real/ type! All function must therefor check
+ * It is not a /real/ type! All function must therefore check
  * for LDNS_RDF_TYPE_DNAME.
  *
  * a Net::DNS like library for C
diff --git a/contrib/ldns/dnssec.c b/contrib/ldns/dnssec.c
index e3c99de27693e2..fbaa518a8cb040 100644
--- a/contrib/ldns/dnssec.c
+++ b/contrib/ldns/dnssec.c
@@ -23,6 +23,11 @@
 #include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/md5.h>
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#ifdef USE_DSA
+#include <openssl/dsa.h>
+#endif
 #endif
 
 ldns_rr *
@@ -149,6 +154,7 @@ ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname,
 	                LDNS_FREE(salt);
 	                ldns_rdf_deep_free(zone_name);
 	                ldns_rdf_deep_free(sname);
+			ldns_rdf_deep_free(hashed_sname);
                         return NULL;
                 }
 
@@ -326,6 +332,7 @@ uint16_t ldns_calc_keytag_raw(const uint8_t* key, size_t keysize)
 }
 
 #ifdef HAVE_SSL
+#ifdef USE_DSA
 DSA *
 ldns_key_buf2dsa(const ldns_buffer *key)
 {
@@ -365,7 +372,6 @@ ldns_key_buf2dsa_raw(const unsigned char* key, size_t len)
 	offset += length;
 
 	Y = BN_bin2bn(key+offset, (int)length, NULL);
-	offset += length;
 
 	/* create the key and set its properties */
 	if(!Q || !P || !G || !Y || !(dsa = DSA_new())) {
@@ -375,7 +381,7 @@ ldns_key_buf2dsa_raw(const unsigned char* key, size_t len)
 		BN_free(Y);
 		return NULL;
 	}
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 #ifndef S_SPLINT_S
 	dsa->p = P;
 	dsa->q = Q;
@@ -402,6 +408,7 @@ ldns_key_buf2dsa_raw(const unsigned char* key, size_t len)
 #endif /* OPENSSL_VERSION_NUMBER */
 	return dsa;
 }
+#endif /* USE_DSA */
 
 RSA *
 ldns_key_buf2rsa(const ldns_buffer *key)
@@ -427,7 +434,7 @@ ldns_key_buf2rsa_raw(const unsigned char* key, size_t len)
 			return NULL;
 		/* need some smart comment here XXX*/
 		/* the exponent is too large so it's places
-		 * futher...???? */
+		 * further...???? */
 		memmove(&int16, key+1, 2);
 		exp = ntohs(int16);
 		offset = 3;
@@ -461,7 +468,7 @@ ldns_key_buf2rsa_raw(const unsigned char* key, size_t len)
 		BN_free(modulus);
 		return NULL;
 	}
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 #ifndef S_SPLINT_S
 	rsa->n = modulus;
 	rsa->e = exponent;
@@ -905,7 +912,7 @@ ldns_dnssec_create_nsec3(const ldns_dnssec_name *from,
 	cur_rrsets = from->rrsets;
 	while (cur_rrsets) {
 		/* Do not include non-authoritative rrsets on the delegation point
-		 * in the type bitmap. Potentionally not skipping insecure
+		 * in the type bitmap. Potentially not skipping insecure
 		 * delegation should have been done earlier, in function
 		 * ldns_dnssec_zone_create_nsec3s, or even earlier in:
 		 * ldns_dnssec_zone_sign_nsec3_flg .
@@ -1327,6 +1334,8 @@ ldns_nsec3_salt_data(const ldns_rr *nsec3_rr)
 	ldns_rdf *salt_rdf = ldns_nsec3_salt(nsec3_rr);
 	if (salt_rdf && ldns_rdf_size(salt_rdf) > 0) {
 	    	salt_length = ldns_rdf_data(salt_rdf)[0];
+		if((size_t)salt_length+1 > ldns_rdf_size(salt_rdf))
+			return NULL;
 		salt = LDNS_XMALLOC(uint8_t, salt_length);
                 if(!salt) return NULL;
 		memcpy(salt, &ldns_rdf_data(salt_rdf)[1], salt_length);
@@ -1556,6 +1565,7 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,
 	ldns_rr_list *sigs_covered;
 	ldns_rdf *rdf_t;
 	ldns_rr_type t_netorder;
+	ldns_status status;
 
 	if (!k) {
 		return LDNS_STATUS_ERR;
@@ -1607,7 +1617,9 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,
 		}
 		return LDNS_STATUS_ERR;
 	}
-	return ldns_verify_time(rrset, sigs, k, check_time, good_keys);
+	status = ldns_verify_time(rrset, sigs, k, check_time, good_keys);
+	ldns_rr_list_deep_free(rrset);
+	return status;
 }
 
 ldns_status
@@ -1896,7 +1908,7 @@ ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
         const ldns_rdf *sig_rdf)
 {
         /* convert from two BIGNUMs in the rdata buffer, to ASN notation.
-	 * ASN preable:  30440220 <R 32bytefor256> 0220 <S 32bytefor256>
+	 * ASN preamble:  30440220 <R 32bytefor256> 0220 <S 32bytefor256>
 	 * the '20' is the length of that field (=bnsize).
 	 * the '44' is the total remaining length.
 	 * if negative, start with leading zero.
@@ -1942,69 +1954,4 @@ ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
 
 #endif /* S_SPLINT_S */
 #endif /* USE_ECDSA */
-
-#if defined(USE_ED25519) || defined(USE_ED448)
-/* debug printout routine */
-static void print_hex(const char* str, uint8_t* d, int len)
-{
-	const char hex[] = "0123456789abcdef";
-	int i;
-	printf("%s [len=%d]: ", str, len);
-	for(i=0; i<len; i++) {
-		int x = (d[i]&0xf0)>>4;
-		int y = (d[i]&0x0f);
-		printf("%c%c", hex[x], hex[y]);
-	}
-	printf("\n");
-}
-#endif
-
-#ifdef USE_ED25519
-ldns_rdf *
-ldns_convert_ed25519_rrsig_asn12rdf(const ldns_buffer *sig, long sig_len)
-{
-	unsigned char *data = (unsigned char*)ldns_buffer_begin(sig);
-        ldns_rdf* rdf = NULL;
-
-	/* TODO when Openssl supports signing and you can test this */
-	print_hex("sig in ASN", data, sig_len);
-
-        return rdf;
-}
-
-ldns_status
-ldns_convert_ed25519_rrsig_rdf2asn1(ldns_buffer *target_buffer,
-        const ldns_rdf *sig_rdf)
-{
-	/* TODO when Openssl supports signing and you can test this. */
-	/* convert sig_buf into ASN1 into the target_buffer */
-	print_hex("sig raw", ldns_rdf_data(sig_rdf), ldns_rdf_size(sig_rdf));
-        return ldns_buffer_status(target_buffer);
-}
-#endif /* USE_ED25519 */
-
-#ifdef USE_ED448
-ldns_rdf *
-ldns_convert_ed448_rrsig_asn12rdf(const ldns_buffer *sig, long sig_len)
-{
-	unsigned char *data = (unsigned char*)ldns_buffer_begin(sig);
-        ldns_rdf* rdf = NULL;
-
-	/* TODO when Openssl supports signing and you can test this */
-	print_hex("sig in ASN", data, sig_len);
-
-	return rdf;
-}
-
-ldns_status
-ldns_convert_ed448_rrsig_rdf2asn1(ldns_buffer *target_buffer,
-        const ldns_rdf *sig_rdf)
-{
-	/* TODO when Openssl supports signing and you can test this. */
-	/* convert sig_buf into ASN1 into the target_buffer */
-	print_hex("sig raw", ldns_rdf_data(sig_rdf), ldns_rdf_size(sig_rdf));
-        return ldns_buffer_status(target_buffer);
-}
-#endif /* USE_ED448 */
-
 #endif /* HAVE_SSL */
diff --git a/contrib/ldns/dnssec_sign.c b/contrib/ldns/dnssec_sign.c
index 22f09816dafe2a..41d845f3fa8f74 100644
--- a/contrib/ldns/dnssec_sign.c
+++ b/contrib/ldns/dnssec_sign.c
@@ -17,8 +17,16 @@
 #include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/md5.h>
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#ifdef USE_DSA
+#include <openssl/dsa.h>
+#endif
 #endif /* HAVE_SSL */
 
+#define LDNS_SIGN_WITH_ZONEMD ( LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 \
+                              | LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 )
+
 ldns_rr *
 ldns_create_empty_rrsig(const ldns_rr_list *rrset,
                         const ldns_key *current_key)
@@ -184,7 +192,7 @@ ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
 		b64rdf = ldns_sign_public_evp(
 				   sign_buf,
 				   ldns_key_evp_key(current_key),
-				   EVP_sha512());
+				   NULL);
                 break;
 #endif
 #ifdef USE_ED448
@@ -192,7 +200,7 @@ ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
 		b64rdf = ldns_sign_public_evp(
 				   sign_buf,
 				   ldns_key_evp_key(current_key),
-				   EVP_sha512());
+				   NULL);
                 break;
 #endif
 	case LDNS_SIGN_RSAMD5:
@@ -234,8 +242,6 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
 
 	new_owner = NULL;
 
-	signatures = ldns_rr_list_new();
-
 	/* prepare a signature and add all the know data
 	 * prepare the rrset. Sign this together.  */
 	rrset_clone = ldns_rr_list_clone(rrset);
@@ -252,6 +258,8 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
 	/* sort */
 	ldns_rr_list_sort(rrset_clone);
 
+	signatures = ldns_rr_list_new();
+
 	for (key_count = 0;
 		key_count < ldns_key_list_key_count(keys);
 		key_count++) {
@@ -320,14 +328,6 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
 	return signatures;
 }
 
-/**
- * Sign data with DSA
- *
- * \param[in] to_sign The ldns_buffer containing raw data that is
- *                    to be signed
- * \param[in] key The DSA key structure to sign with
- * \return ldns_rdf for the RRSIG ldns_rr
- */
 ldns_rdf *
 ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
 {
@@ -408,11 +408,14 @@ ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
 {
         EC_KEY* ec;
         const EC_GROUP* g;
-#ifdef HAVE_EVP_PKEY_BASE_ID
+#ifdef HAVE_EVP_PKEY_GET_BASE_ID
+        if(EVP_PKEY_get_base_id(pkey) != EVP_PKEY_EC)
+                return 0;
+#elif defined(HAVE_EVP_PKEY_BASE_ID)
         if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
                 return 0;
 #else
-        if(EVP_PKEY_type(key->type) != EVP_PKEY_EC)
+        if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
                 return 0;
 #endif
         ec = EVP_PKEY_get1_EC_KEY(pkey);
@@ -456,8 +459,19 @@ ldns_sign_public_evp(ldns_buffer *to_sign,
 
 	/* initializes a signing context */
 	md_type = digest_type;
+#ifdef USE_ED25519
+	if(EVP_PKEY_id(key) == NID_ED25519) {
+		/* digest must be NULL for ED25519 sign and verify */
+		md_type = NULL;
+	} else
+#endif
+#ifdef USE_ED448
+	if(EVP_PKEY_id(key) == NID_ED448) {
+		md_type = NULL;
+	} else
+#endif
 	if(!md_type) {
-		/* unknown message difest */
+		/* unknown message digest */
 		ldns_buffer_free(b64sig);
 		return NULL;
 	}
@@ -473,23 +487,34 @@ ldns_sign_public_evp(ldns_buffer *to_sign,
 		return NULL;
 	}
 
-	r = EVP_SignInit(ctx, md_type);
-	if(r == 1) {
-		r = EVP_SignUpdate(ctx, (unsigned char*)
-					    ldns_buffer_begin(to_sign),
-					    ldns_buffer_position(to_sign));
-	} else {
-		ldns_buffer_free(b64sig);
-		EVP_MD_CTX_destroy(ctx);
-		return NULL;
-	}
-	if(r == 1) {
-		r = EVP_SignFinal(ctx, (unsigned char*)
-					   ldns_buffer_begin(b64sig), &siglen, key);
+#if defined(USE_ED25519) || defined(USE_ED448)
+	if(md_type == NULL) {
+		/* for these methods we must use the one-shot DigestSign */
+		r = EVP_DigestSignInit(ctx, NULL, md_type, NULL, key);
+		if(r == 1) {
+			size_t siglen_sizet = ldns_buffer_capacity(b64sig);
+			r = EVP_DigestSign(ctx,
+				(unsigned char*)ldns_buffer_begin(b64sig),
+				&siglen_sizet,
+				(unsigned char*)ldns_buffer_begin(to_sign),
+				ldns_buffer_position(to_sign));
+			siglen = (unsigned int)siglen_sizet;
+		}
 	} else {
-		ldns_buffer_free(b64sig);
-		EVP_MD_CTX_destroy(ctx);
-		return NULL;
+#else
+	r = 0;
+	if(md_type != NULL) {
+#endif
+		r = EVP_SignInit(ctx, md_type);
+		if(r == 1) {
+			r = EVP_SignUpdate(ctx, (unsigned char*)
+						    ldns_buffer_begin(to_sign),
+						    ldns_buffer_position(to_sign));
+		}
+		if(r == 1) {
+			r = EVP_SignFinal(ctx, (unsigned char*)
+						   ldns_buffer_begin(b64sig), &siglen, key);
+		}
 	}
 	if(r != 1) {
 		ldns_buffer_free(b64sig);
@@ -502,7 +527,9 @@ ldns_sign_public_evp(ldns_buffer *to_sign,
 #ifdef USE_DSA
 #ifndef S_SPLINT_S
 	/* unfortunately, OpenSSL output is different from DNS DSA format */
-# ifdef HAVE_EVP_PKEY_BASE_ID
+# ifdef HAVE_EVP_PKEY_GET_BASE_ID
+	if (EVP_PKEY_get_base_id(key) == EVP_PKEY_DSA) {
+# elif defined(HAVE_EVP_PKEY_BASE_ID)
 	if (EVP_PKEY_base_id(key) == EVP_PKEY_DSA) {
 # else
 	if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
@@ -512,9 +539,11 @@ ldns_sign_public_evp(ldns_buffer *to_sign,
 	}
 #endif
 #endif
-#if defined(USE_ECDSA) || defined(USE_ED25519) || defined(USE_ED448)
+#if defined(USE_ECDSA)
 	if(
-#  ifdef HAVE_EVP_PKEY_BASE_ID
+#  ifdef HAVE_EVP_PKEY_GET_BASE_ID
+		EVP_PKEY_get_base_id(key)
+#  elif defined(HAVE_EVP_PKEY_BASE_ID)
 		EVP_PKEY_base_id(key)
 #  else
 		EVP_PKEY_type(key->type)
@@ -527,20 +556,6 @@ ldns_sign_public_evp(ldns_buffer *to_sign,
 				b64sig, (long)siglen, ldns_pkey_is_ecdsa(key));
 		}
 #  endif /* USE_ECDSA */
-#  ifdef USE_ED25519
-		if(EVP_PKEY_id(key) == NID_X25519) {
-			r = 1;
-			sigdata_rdf = ldns_convert_ed25519_rrsig_asn12rdf(
-				b64sig, siglen);
-		}
-#  endif /* USE_ED25519 */
-#  ifdef USE_ED448
-		if(EVP_PKEY_id(key) == NID_X448) {
-			r = 1;
-			sigdata_rdf = ldns_convert_ed448_rrsig_asn12rdf(
-				b64sig, siglen);
-		}
-#  endif /* USE_ED448 */
 	}
 #endif /* PKEY_EC */
 	if(r == 0) {
@@ -642,7 +657,7 @@ ldns_dnssec_addresses_on_glue_list(
 						/* ldns_rr_list_push_rr()
 						 * returns false when unable
 						 * to increase the capacity
-						 * of the ldsn_rr_list
+						 * of the ldns_rr_list
 						 */
 					}
 				}
@@ -653,20 +668,6 @@ ldns_dnssec_addresses_on_glue_list(
 	return LDNS_STATUS_OK;
 }
 
-/**
- * Marks the names in the zone that are occluded. Those names will be skipped
- * when walking the tree with the ldns_dnssec_name_node_next_nonglue()
- * function. But watch out! Names that are partially occluded (like glue with
- * the same name as the delegation) will not be marked and should specifically 
- * be taken into account separately.
- *
- * When glue_list is given (not NULL), in the process of marking the names, all
- * glue resource records will be pushed to that list, even glue at delegation names.
- *
- * \param[in] zone the zone in which to mark the names
- * \param[in] glue_list the list to which to push the glue rrs
- * \return LDNS_STATUS_OK on success, an error code otherwise
- */
 ldns_status
 ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, 
 	ldns_rr_list *glue_list)
@@ -678,7 +679,7 @@ ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone,
 	/* When the cut is caused by a delegation, below_delegation will be 1.
 	 * When caused by a DNAME, below_delegation will be 0.
 	 */
-	int below_delegation = -1; /* init suppresses comiler warning */
+	int below_delegation = -1; /* init suppresses compiler warning */
 	ldns_status s;
 
 	if (!zone || !zone->names) {
@@ -700,7 +701,7 @@ ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone,
 			 * FIXME! If there are labels in between the SOA and
 			 * the cut, going from the authoritative space (below
 			 * the SOA) up into occluded space again, will not be
-			 * detected with the contruct below!
+			 * detected with the construct below!
 			 */
 			if (ldns_dname_is_subdomain(owner, cut) &&
 					!ldns_dnssec_rrsets_contains_type(
@@ -746,16 +747,6 @@ ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone,
 	return LDNS_STATUS_OK;
 }
 
-/**
- * Marks the names in the zone that are occluded. Those names will be skipped
- * when walking the tree with the ldns_dnssec_name_node_next_nonglue()
- * function. But watch out! Names that are partially occluded (like glue with
- * the same name as the delegation) will not be marked and should specifically 
- * be taken into account separately.
- *
- * \param[in] zone the zone in which to mark the names
- * \return LDNS_STATUS_OK on success, an error code otherwise
- */
 ldns_status
 ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
 {
@@ -799,17 +790,24 @@ ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone,
 	uint32_t nsec_ttl;
 	ldns_dnssec_rrsets *soa;
 
-	/* the TTL of NSEC rrs should be set to the minimum TTL of
-	 * the zone SOA (RFC4035 Section 2.3)
+	/* The TTL value for any NSEC RR SHOULD be the same TTL value as the
+	 * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
+	 * itself. This matches the definition of the TTL for negative
+	 * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
+	 * RFC4035 Section 2.3)
 	 */
 	soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
 
 	/* did the caller actually set it? if not,
 	 * fall back to default ttl
 	 */
-	if (soa && soa->rrs && soa->rrs->rr
-			&& (ldns_rr_rdf(soa->rrs->rr, 6) != NULL)) {
-		nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
+	if (soa && soa->rrs && soa->rrs->rr) {
+		ldns_rr  *soa_rr  = soa->rrs->rr;
+		ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
+
+		nsec_ttl = min_rdf == NULL
+		       || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
+		        ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
 	} else {
 		nsec_ttl = LDNS_DEFAULT_TTL;
 	}
@@ -893,17 +891,24 @@ ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
 		return LDNS_STATUS_ERR;
 	}
 
-	/* the TTL of NSEC rrs should be set to the minimum TTL of
-	 * the zone SOA (RFC4035 Section 2.3)
+	/* The TTL value for any NSEC RR SHOULD be the same TTL value as the
+	 * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
+	 * itself. This matches the definition of the TTL for negative
+	 * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
+	 * RFC4035 Section 2.3)
 	 */
 	soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
 
 	/* did the caller actually set it? if not,
 	 * fall back to default ttl
 	 */
-	if (soa && soa->rrs && soa->rrs->rr
-			&& ldns_rr_rdf(soa->rrs->rr, 6) != NULL) {
-		nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
+	if (soa && soa->rrs && soa->rrs->rr) {
+		ldns_rr  *soa_rr  = soa->rrs->rr;
+		ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
+
+		nsec_ttl = min_rdf == NULL
+		       || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
+		        ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
 	} else {
 		nsec_ttl = LDNS_DEFAULT_TTL;
 	}
@@ -984,7 +989,6 @@ ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
 	    ; hashmap_node != LDNS_RBTREE_NULL
 	    ; hashmap_node  = ldns_rbtree_next(hashmap_node)
 	    ) {
-		current_name = (ldns_dnssec_name *) hashmap_node->data;
 		nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
 		if (nsec_rr) {
 			ldns_rr_list_push_rr(nsec3_list, nsec_rr);
@@ -1129,17 +1133,22 @@ ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
 	if (!ldns_key_list_key_count(key_list))
 		return;
 
+	/* Mark all KSKs */
 	for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
 		key = ldns_key_list_key(key_list, i);
-		if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_ksk)
-			saw_ksk = ldns_key_algorithm(key);
-		algos[ldns_key_algorithm(key)] = true;
+		if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
+			if (!saw_ksk)
+				saw_ksk = ldns_key_algorithm(key);
+			algos[ldns_key_algorithm(key)] = true;
+		}
 	}
 	if (!saw_ksk)
-		return;
-	else
-		algos[saw_ksk] = 0;
+		return; /* No KSKs means sign using all ZSKs */
 
+	/* Deselect the ZSKs so they do not sign DNSKEY RRs.
+	 * Except with the LDNS_SIGN_WITH_ALL_ALGORITHMS flag, then use it,
+	 * but only if it has an algorithm for which there is no KSK
+	 */
 	for (i =0; i < ldns_key_list_key_count(key_list); i++) {
 		key = ldns_key_list_key(key_list, i);
 		if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
@@ -1147,15 +1156,15 @@ ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
 			 * Still use it if it has a unique algorithm though!
 			 */
 			if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
-			    algos[ldns_key_algorithm(key)])
-				algos[ldns_key_algorithm(key)] = false;
+			    !algos[ldns_key_algorithm(key)])
+				algos[ldns_key_algorithm(key)] = true;
 			else
 				ldns_key_set_use(key, 0);
 		}
 	}
 }
 
-/** If there are no ZSKs use KSK as ZSK */
+/** If there are no ZSKs use KSKs as ZSK too */
 static void
 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
 {
@@ -1171,17 +1180,22 @@ ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
 	if (!ldns_key_list_key_count(key_list))
 		return;
 
+	/* Mark all ZSKs */
 	for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
 		key = ldns_key_list_key(key_list, i);
-		if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_zsk)
-			saw_zsk = ldns_key_algorithm(key);
-		algos[ldns_key_algorithm(key)] = true;
+		if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
+			if (!saw_zsk)
+				saw_zsk = ldns_key_algorithm(key);
+			algos[ldns_key_algorithm(key)] = true;
+		}
 	}
 	if (!saw_zsk)
-		return;
-	else
-		algos[saw_zsk] = 0;
+		return; /* No ZSKs means sign using all KSKs */
 
+	/* Deselect the KSKs so they do not sign non DNSKEY RRs.
+	 * Except with the LDNS_SIGN_WITH_ALL_ALGORITHMS flag, then use it,
+	 * but only if it has an algorithm for which there is no ZSK
+	 */
 	for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
 		key = ldns_key_list_key(key_list, i);
 		if((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
@@ -1189,8 +1203,8 @@ ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
 			 * Still use it if it has a unique algorithm though!
 			 */
 			if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
-			    algos[ldns_key_algorithm(key)])
-				algos[ldns_key_algorithm(key)] = false;
+			    !algos[ldns_key_algorithm(key)])
+				algos[ldns_key_algorithm(key)] = true;
 			else
 				ldns_key_set_use(key, 0);
 		}
@@ -1251,12 +1265,15 @@ ldns_dnssec_zone_create_rrsigs_flg( ldns_dnssec_zone *zone
 											key_list,
 											func,
 											arg);
-				if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK) &&
-					cur_rrset->type == LDNS_RR_TYPE_DNSKEY)
-					ldns_key_list_filter_for_dnskey(key_list, flags);
-
-				if(cur_rrset->type != LDNS_RR_TYPE_DNSKEY)
+				if(cur_rrset->type == LDNS_RR_TYPE_DNSKEY ||
+				   cur_rrset->type == LDNS_RR_TYPE_CDNSKEY ||
+				   cur_rrset->type == LDNS_RR_TYPE_CDS) {
+					if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK)) {
+						ldns_key_list_filter_for_dnskey(key_list, flags);
+					}
+				} else {
 					ldns_key_list_filter_for_non_dnskey(key_list, flags);
+				}
 
 				/* TODO: just set count to zero? */
 				rr_list = ldns_rr_list_new();
@@ -1350,6 +1367,8 @@ ldns_dnssec_zone_sign(ldns_dnssec_zone *zone,
 	return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
 }
 
+ldns_status dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone,
+		ldns_rr_list *new_rrs, ldns_key_list *key_list, int flags);
 ldns_status
 ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
 				  ldns_rr_list *new_rrs,
@@ -1359,25 +1378,46 @@ ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
 				  int flags)
 {
 	ldns_status result = LDNS_STATUS_OK;
+	ldns_dnssec_rrsets zonemd_rrset;
+	bool zonemd_added = false;
 
 	if (!zone || !new_rrs || !key_list) {
 		return LDNS_STATUS_ERR;
 	}
-
+	if (flags & LDNS_SIGN_WITH_ZONEMD) {
+		ldns_dnssec_rrsets **rrsets_ref = &zone->soa->rrsets;
+
+		while (*rrsets_ref
+		   && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
+			rrsets_ref = &(*rrsets_ref)->next;
+		if (!*rrsets_ref
+		||  (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
+			zonemd_rrset.rrs = NULL;
+			zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
+			zonemd_rrset.signatures = NULL;
+			zonemd_rrset.next = *rrsets_ref;
+			*rrsets_ref = &zonemd_rrset;
+			zonemd_added = true;
+		}
+	}
 	/* zone is already sorted */
 	result = ldns_dnssec_zone_mark_glue(zone);
 	if (result != LDNS_STATUS_OK) {
 		return result;
 	}
-
 	/* check whether we need to add nsecs */
-	if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
+	if ((flags & LDNS_SIGN_NO_KEYS_NO_NSECS)
+	&&  ldns_key_list_key_count(key_list) < 1)
+		; /* pass */
+
+	else if (zone->names
+	     && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
+
 		result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
 		if (result != LDNS_STATUS_OK) {
 			return result;
 		}
 	}
-
 	result = ldns_dnssec_zone_create_rrsigs_flg(zone,
 					new_rrs,
 					key_list,
@@ -1385,7 +1425,18 @@ ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
 					arg,
 					flags);
 
-	return result;
+	if (zonemd_added) {
+		ldns_dnssec_rrsets **rrsets_ref
+		    = &zone->soa->rrsets;
+
+		while (*rrsets_ref
+		   && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
+			rrsets_ref = &(*rrsets_ref)->next;
+		*rrsets_ref = zonemd_rrset.next;
+	}
+	return flags & LDNS_SIGN_WITH_ZONEMD
+	     ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, flags)
+	     : result;
 }
 
 ldns_status
@@ -1421,6 +1472,8 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
 {
 	ldns_rr *nsec3, *nsec3param;
 	ldns_status result = LDNS_STATUS_OK;
+	bool zonemd_added = false;
+	ldns_dnssec_rrsets zonemd_rrset;
 
 	/* zone is already sorted */
 	result = ldns_dnssec_zone_mark_glue(zone);
@@ -1439,7 +1492,13 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
 		}
 
 		nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
-		if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
+
+		/* check whether we need to add nsecs */
+		if ((signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)
+		&&  ldns_key_list_key_count(key_list) < 1)
+			; /* pass */
+
+		else if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
 			/* no need to recreate */
 		} else {
 			if (!ldns_dnssec_zone_find_rrset(zone,
@@ -1466,6 +1525,23 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
 				}
 				ldns_rr_list_push_rr(new_rrs, nsec3param);
 			}
+			if (signflags & LDNS_SIGN_WITH_ZONEMD) {
+				ldns_dnssec_rrsets **rrsets_ref
+				    = &zone->soa->rrsets;
+
+				while (*rrsets_ref
+				   && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
+					rrsets_ref = &(*rrsets_ref)->next;
+				if (!*rrsets_ref
+				||  (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
+					zonemd_rrset.rrs = NULL;
+					zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
+					zonemd_rrset.signatures = NULL;
+					zonemd_rrset.next = *rrsets_ref;
+					*rrsets_ref = &zonemd_rrset;
+					zonemd_added = true;
+				}
+			}
 			result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
 											new_rrs,
 											algorithm,
@@ -1474,6 +1550,15 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
 											salt_length,
 											salt,
 											map);
+			if (zonemd_added) {
+				ldns_dnssec_rrsets **rrsets_ref
+				    = &zone->soa->rrsets;
+
+				while (*rrsets_ref
+				   && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
+					rrsets_ref = &(*rrsets_ref)->next;
+				*rrsets_ref = zonemd_rrset.next;
+			}
 			if (result != LDNS_STATUS_OK) {
 				return result;
 			}
@@ -1486,8 +1571,12 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
 						arg,
 						signflags);
 	}
+	if (result || !zone->names)
+		return result;
 
-	return result;
+	return signflags & LDNS_SIGN_WITH_ZONEMD
+	     ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, signflags)
+	     : result;
 }
 
 ldns_status
diff --git a/contrib/ldns/dnssec_verify.c b/contrib/ldns/dnssec_verify.c
index c554e4f4cb19ab..d76f32eba71a65 100644
--- a/contrib/ldns/dnssec_verify.c
+++ b/contrib/ldns/dnssec_verify.c
@@ -21,7 +21,7 @@ ldns_dnssec_data_chain_new(void)
 	ldns_dnssec_data_chain *nc = LDNS_CALLOC(ldns_dnssec_data_chain, 1);
         if(!nc) return NULL;
 	/* 
-	 * not needed anymore because CALLOC initalizes everything to zero.
+	 * not needed anymore because CALLOC initializes everything to zero.
 
 	nc->rrset = NULL;
 	nc->parent_type = 0;
@@ -415,14 +415,17 @@ ldns_dnssec_build_data_chain(ldns_resolver *res,
 		                                              new_chain);
 	}
 	if (type != LDNS_RR_TYPE_DNSKEY) {
-		ldns_dnssec_build_data_chain_dnskey(res,
-		                                    qflags,
-		                                    pkt,
-		                                    signatures,
-		                                    new_chain,
-		                                    key_name,
-		                                    c
-		                                   );
+		if (type != LDNS_RR_TYPE_DS ||
+				ldns_dname_is_subdomain(name, key_name)) {
+			ldns_dnssec_build_data_chain_dnskey(res,
+			                                    qflags,
+			                                    pkt,
+			                                    signatures,
+			                                    new_chain,
+			                                    key_name,
+			                                    c
+			                                   );
+		}
 	} else {
 		ldns_dnssec_build_data_chain_other(res,
 		                                   qflags,
@@ -594,7 +597,9 @@ ldns_dnssec_trust_tree_print_sm_fmt(FILE *out,
 						if (tree->parent_status[i]
 						    == LDNS_STATUS_SSL_ERR) {
 							printf("; SSL Error: ");
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_LIBRESSL)
 							ERR_load_crypto_strings();
+#endif
 							ERR_print_errors_fp(stdout);
 							printf("\n");
 						}
@@ -903,8 +908,9 @@ ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
 				cur_status = ldns_verify_rrsig_time(
 						cur_rrset, cur_sig_rr, 
 						cur_parent_rr, check_time);
-				(void) ldns_dnssec_trust_tree_add_parent(new_tree,
-				            cur_parent_tree, cur_sig_rr, cur_status);
+				if (ldns_dnssec_trust_tree_add_parent(new_tree,
+				            cur_parent_tree, cur_sig_rr, cur_status))
+					ldns_dnssec_trust_tree_free(cur_parent_tree);
 			}
 		}
 	}
@@ -1018,8 +1024,10 @@ ldns_dnssec_derive_trust_tree_no_sig_time(
 						data_chain->parent, 
 						cur_parent_rr,
 						check_time);
-			(void) ldns_dnssec_trust_tree_add_parent(new_tree,
-			            cur_parent_tree, NULL, result);
+			if (ldns_dnssec_trust_tree_add_parent(new_tree,
+			            cur_parent_tree, NULL, result))
+				ldns_dnssec_trust_tree_free(cur_parent_tree);
+
 		}
 	}
 }
@@ -1495,7 +1503,7 @@ ldns_dnssec_verify_denial(ldns_rr *rr,
                           ldns_rr_list *rrsigs)
 {
 	ldns_rdf *rr_name;
-	ldns_rdf *wildcard_name;
+	ldns_rdf *wildcard_name = NULL;
 	ldns_rdf *chopped_dname;
 	ldns_rr *cur_nsec;
 	size_t i;
@@ -1506,14 +1514,19 @@ ldns_dnssec_verify_denial(ldns_rr *rr,
 	bool type_covered = false;
 	bool wildcard_covered = false;
 	bool wildcard_type_covered = false;
+	bool rr_name_is_root = false;
 
-	wildcard_name = ldns_dname_new_frm_str("*");
 	rr_name = ldns_rr_owner(rr);
-	chopped_dname = ldns_dname_left_chop(rr_name);
-	result = ldns_dname_cat(wildcard_name, chopped_dname);
-	ldns_rdf_deep_free(chopped_dname);
-	if (result != LDNS_STATUS_OK) {
-		return result;
+	rr_name_is_root =     ldns_rdf_size(rr_name) == 1
+	                  && *ldns_rdf_data(rr_name) == 0;
+	if (!rr_name_is_root) {
+		wildcard_name = ldns_dname_new_frm_str("*");
+		chopped_dname = ldns_dname_left_chop(rr_name);
+		result = ldns_dname_cat(wildcard_name, chopped_dname);
+		ldns_rdf_deep_free(chopped_dname);
+		if (result != LDNS_STATUS_OK) {
+			return result;
+		}
 	}
 	
 	for  (i = 0; i < ldns_rr_list_rr_count(nsecs); i++) {
@@ -1540,6 +1553,9 @@ ldns_dnssec_verify_denial(ldns_rr *rr,
 			name_covered = true;
 		}
 		
+		if (rr_name_is_root)
+			continue;
+
 		if (ldns_dname_compare(wildcard_name,
 						   ldns_rr_owner(cur_nsec)) == 0) {
 			if (ldns_nsec_bitmap_covers_type(ldns_nsec_get_bitmap(cur_nsec),
@@ -1560,6 +1576,9 @@ ldns_dnssec_verify_denial(ldns_rr *rr,
 		return LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;
 	}
 	
+	if (rr_name_is_root)
+		return LDNS_STATUS_OK;
+
 	if (wildcard_type_covered || !wildcard_covered) {
 		return LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED;
 	}
@@ -1583,8 +1602,6 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
 	bool wildcard_covered = false;
 	ldns_rdf *zone_name;
 	ldns_rdf *hashed_name;
-	/* self assignment to suppress uninitialized warning */
-	ldns_rdf *next_closer = next_closer;
 	ldns_rdf *hashed_next_closer;
 	size_t i;
 	ldns_status result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;
@@ -1659,6 +1676,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
 				}
 			}
 		}
+		ldns_rdf_deep_free(hashed_name);
 		result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;
 		/* wildcard no data? section 8.7 */
 		closest_encloser = ldns_dnssec_nsec3_closest_encloser(
@@ -1748,7 +1766,9 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
 			/* Query name *is* the "next closer". */
 			hashed_next_closer = hashed_name;
 		} else {
-
+			ldns_rdf *next_closer;
+			
+			ldns_rdf_deep_free(hashed_name);
 			/* "next closer" has less labels than the query name.
 			 * Create the name and hash it.
 			 */
@@ -1762,6 +1782,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
 					next_closer
 					);
 			(void) ldns_dname_cat(hashed_next_closer, zone_name);
+			ldns_rdf_deep_free(next_closer);
 		}
 		/* Find the NSEC3 that covers the "next closer" */
 		for (i = 0; i < ldns_rr_list_rr_count(nsecs); i++) {
@@ -1776,15 +1797,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
 				break;
 			}
 		}
-		if (ldns_dname_label_count(closest_encloser) + 1
-		    < ldns_dname_label_count(ldns_rr_owner(rr))) {
-
-			/* "next closer" has less labels than the query name.
-			 * Dispose of the temporary variables that held that name.
-			 */
-			ldns_rdf_deep_free(hashed_next_closer);
-			ldns_rdf_deep_free(next_closer);
-		}
+		ldns_rdf_deep_free(hashed_next_closer);
 		ldns_rdf_deep_free(closest_encloser);
 	}
 
@@ -1858,27 +1871,19 @@ ldns_verify_rrsig_gost_raw(const unsigned char* sig, size_t siglen,
 EVP_PKEY*
 ldns_ed255192pkey_raw(const unsigned char* key, size_t keylen)
 {
-        const unsigned char* pp = key; /* pp gets modified by o2i() */
+	/* ASN1 for ED25519 is 302a300506032b6570032100 <32byteskey> */
+	uint8_t pre[] = {0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65,
+		0x70, 0x03, 0x21, 0x00};
+        int pre_len = 12;
+	uint8_t buf[256];
         EVP_PKEY *evp_key;
-        EC_KEY *ec;
-	if(keylen != 32)
+	/* pp gets modified by d2i() */
+        const unsigned char* pp = (unsigned char*)buf;
+	if(keylen != 32 || keylen + pre_len > sizeof(buf))
 		return NULL; /* wrong length */
-        ec = EC_KEY_new_by_curve_name(NID_X25519);
-	if(!ec) return NULL;
-        if(!o2i_ECPublicKey(&ec, &pp, (int)keylen)) {
-                EC_KEY_free(ec);
-                return NULL;
-	}
-        evp_key = EVP_PKEY_new();
-        if(!evp_key) {
-                EC_KEY_free(ec);
-                return NULL;
-        }
-        if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
-		EVP_PKEY_free(evp_key);
-		EC_KEY_free(ec);
-		return NULL;
-	}
+	memmove(buf, pre, pre_len);
+	memmove(buf+pre_len, key, keylen);
+	evp_key = d2i_PUBKEY(NULL, &pp, (int)(pre_len+keylen));
         return evp_key;
 }
 
@@ -1894,8 +1899,7 @@ ldns_verify_rrsig_ed25519_raw(unsigned char* sig, size_t siglen,
 		/* could not convert key */
 		return LDNS_STATUS_CRYPTO_BOGUS;
         }
-	result = ldns_verify_rrsig_evp_raw(sig, siglen, rrset, evp_key,
-		EVP_sha512());
+	result = ldns_verify_rrsig_evp_raw(sig, siglen, rrset, evp_key, NULL);
 	EVP_PKEY_free(evp_key);
 	return result;
 }
@@ -1905,27 +1909,19 @@ ldns_verify_rrsig_ed25519_raw(unsigned char* sig, size_t siglen,
 EVP_PKEY*
 ldns_ed4482pkey_raw(const unsigned char* key, size_t keylen)
 {
-        const unsigned char* pp = key; /* pp gets modified by o2i() */
+	/* ASN1 for ED448 is 3043300506032b6571033a00 <57byteskey> */
+	uint8_t pre[] = {0x30, 0x43, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65,
+		0x71, 0x03, 0x3a, 0x00};
+        int pre_len = 12;
+	uint8_t buf[256];
         EVP_PKEY *evp_key;
-        EC_KEY *ec;
-	if(keylen != 57)
+	/* pp gets modified by d2i() */
+        const unsigned char* pp = (unsigned char*)buf;
+	if(keylen != 57 || keylen + pre_len > sizeof(buf))
 		return NULL; /* wrong length */
-        ec = EC_KEY_new_by_curve_name(NID_X448);
-	if(!ec) return NULL;
-        if(!o2i_ECPublicKey(&ec, &pp, (int)keylen)) {
-                EC_KEY_free(ec);
-                return NULL;
-	}
-        evp_key = EVP_PKEY_new();
-        if(!evp_key) {
-                EC_KEY_free(ec);
-                return NULL;
-        }
-        if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
-		EVP_PKEY_free(evp_key);
-		EC_KEY_free(ec);
-		return NULL;
-	}
+	memmove(buf, pre, pre_len);
+	memmove(buf+pre_len, key, keylen);
+	evp_key = d2i_PUBKEY(NULL, &pp, (int)(pre_len+keylen));
         return evp_key;
 }
 
@@ -1941,8 +1937,7 @@ ldns_verify_rrsig_ed448_raw(unsigned char* sig, size_t siglen,
 		/* could not convert key */
 		return LDNS_STATUS_CRYPTO_BOGUS;
         }
-	result = ldns_verify_rrsig_evp_raw(sig, siglen, rrset, evp_key,
-		EVP_sha512());
+	result = ldns_verify_rrsig_evp_raw(sig, siglen, rrset, evp_key, NULL);
 	EVP_PKEY_free(evp_key);
 	return result;
 }
@@ -2187,6 +2182,12 @@ ldns_rrsig2rawsig_buffer(ldns_buffer* rawsig_buf, const ldns_rr* rrsig)
 #endif
 #ifdef USE_GOST
 	case LDNS_ECC_GOST:
+#endif
+#ifdef USE_ED25519
+	case LDNS_ED25519:
+#endif
+#ifdef USE_ED448
+	case LDNS_ED448:
 #endif
 		if (ldns_rr_rdf(rrsig, 8) == NULL) {
 			return LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG;
@@ -2228,32 +2229,6 @@ ldns_rrsig2rawsig_buffer(ldns_buffer* rawsig_buf, const ldns_rr* rrsig)
 			return LDNS_STATUS_MEM_ERR;
                 }
                 break;
-#endif
-#ifdef USE_ED25519
-	case LDNS_ED25519:
-                /* EVP produces an ASN prefix on the signature, which is
-                 * not used in the DNS */
-		if (ldns_rr_rdf(rrsig, 8) == NULL) {
-			return LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG;
-		}
-		if (ldns_convert_ed25519_rrsig_rdf2asn1(
-			rawsig_buf, ldns_rr_rdf(rrsig, 8)) != LDNS_STATUS_OK) {
-			return LDNS_STATUS_MEM_ERR;
-                }
-		break;
-#endif
-#ifdef USE_ED448
-	case LDNS_ED448:
-                /* EVP produces an ASN prefix on the signature, which is
-                 * not used in the DNS */
-		if (ldns_rr_rdf(rrsig, 8) == NULL) {
-			return LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG;
-		}
-		if (ldns_convert_ed448_rrsig_rdf2asn1(
-			rawsig_buf, ldns_rr_rdf(rrsig, 8)) != LDNS_STATUS_OK) {
-			return LDNS_STATUS_MEM_ERR;
-                }
-		break;
 #endif
 	case LDNS_DH:
 	case LDNS_ECC:
@@ -2428,8 +2403,12 @@ ldns_verify_rrsig_keylist_time(
 		ldns_rr_list *good_keys)
 {
 	ldns_status result;
-	ldns_rr_list *valid = ldns_rr_list_new();
-	if (!valid)
+	ldns_rr_list *valid;
+
+	if (!good_keys)
+		valid = NULL;
+
+	else if (!(valid = ldns_rr_list_new()))
 		return LDNS_STATUS_MEM_ERR;
 
 	result = ldns_verify_rrsig_keylist_notime(rrset, rrsig, keys, valid);
@@ -2633,16 +2612,31 @@ ldns_verify_rrsig_evp_raw(const unsigned char *sig, size_t siglen,
 	if(!ctx)
 		return LDNS_STATUS_MEM_ERR;
 	
-	EVP_VerifyInit(ctx, digest_type);
-	EVP_VerifyUpdate(ctx,
-				  ldns_buffer_begin(rrset),
-				  ldns_buffer_position(rrset));
-	res = EVP_VerifyFinal(ctx, sig, (unsigned int) siglen, key);
+#if defined(USE_ED25519) || defined(USE_ED448)
+	if(!digest_type) {
+		res = EVP_DigestVerifyInit(ctx, NULL, digest_type, NULL, key);
+		if(res == 1) {
+			res = EVP_DigestVerify(ctx, sig, siglen,
+				ldns_buffer_begin(rrset),
+				ldns_buffer_position(rrset));
+		}
+	} else {
+#else
+	res = 0;
+	if(digest_type) {
+#endif
+		EVP_VerifyInit(ctx, digest_type);
+		EVP_VerifyUpdate(ctx,
+					  ldns_buffer_begin(rrset),
+					  ldns_buffer_position(rrset));
+		res = EVP_VerifyFinal(ctx, sig, (unsigned int) siglen, key);
+	}
 	
 	EVP_MD_CTX_destroy(ctx);
 	
 	if (res == 1) {
 		return LDNS_STATUS_OK;
+
 	} else if (res == 0) {
 		return LDNS_STATUS_CRYPTO_BOGUS;
 	}
diff --git a/contrib/ldns/dnssec_zone.c b/contrib/ldns/dnssec_zone.c
index f610a3cfe8fc66..013517f4ac1a64 100644
--- a/contrib/ldns/dnssec_zone.c
+++ b/contrib/ldns/dnssec_zone.c
@@ -323,7 +323,7 @@ ldns_dnssec_name_new(void)
 		return NULL;
 	}
 	/*
-	 * not needed anymore because CALLOC initalizes everything to zero.
+	 * not needed anymore because CALLOC initializes everything to zero.
 
 	new_name->name = NULL;
 	new_name->rrsets = NULL;
@@ -370,9 +370,10 @@ ldns_dnssec_name_free_internal(ldns_dnssec_name *name,
 			ldns_dnssec_rrs_free_internal(name->nsec_signatures, deep);
 		}
 		if (name->hashed_name) {
-			if (deep) {
-				ldns_rdf_deep_free(name->hashed_name);
-			}
+			/* Hashed name is always allocated when signing,
+			 * so always deep free
+			 */
+			ldns_rdf_deep_free(name->hashed_name);
 		}
 		LDNS_FREE(name);
 	}
@@ -588,7 +589,7 @@ rr_is_rrsig_covering(ldns_rr* rr, ldns_rr_type t)
 /* When the zone is first read into an list and then inserted into an
  * ldns_dnssec_zone (rbtree) the nodes of the rbtree are allocated close (next)
  * to each other. Because ldns-verify-zone (the only program that uses this
- * function) uses the rbtree mostly for sequentual walking, this results
+ * function) uses the rbtree mostly for sequential walking, this results
  * in a speed increase (of 15% on linux) because we have less CPU-cache misses.
  */
 #define FASTER_DNSSEC_ZONE_NEW_FRM_FP 1 /* Because of L2 cache efficiency */
@@ -606,7 +607,7 @@ ldns_todo_nsec3_ents_node_free(ldns_rbnode_t *node, void *arg) {
 
 ldns_status
 ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* origin,
-	       	uint32_t ttl, ldns_rr_class ATTR_UNUSED(c), int* line_nr)
+		uint32_t default_ttl, ldns_rr_class ATTR_UNUSED(c), int* line_nr)
 {
 	ldns_rr* cur_rr;
 	size_t i;
@@ -626,7 +627,7 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 	   nsec3_ents (where ent is e.n.t.; i.e. empty non terminal) will
 	   hold the NSEC3s that still didn't have a matching name in the
 	   zone tree, even after all names were read.  They can only match
-	   after the zone is equiped with all the empty non terminals. */
+	   after the zone is equipped with all the empty non terminals. */
 	ldns_rbtree_t todo_nsec3_ents;
 	ldns_rbnode_t *new_node;
 	ldns_rr_list* todo_nsec3_rrsigs = ldns_rr_list_new();
@@ -636,13 +637,19 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 #ifdef FASTER_DNSSEC_ZONE_NEW_FRM_FP
 	ldns_zone* zone = NULL;
 #else
-	uint32_t  my_ttl = ttl;
+	ldns_rr  *prev_rr = NULL;
+	uint32_t   my_ttl = default_ttl;
+	/* RFC 1035 Section 5.1, says 'Omitted class and TTL values are default
+	 * to the last explicitly stated values.'
+	 */
+	bool ttl_from_TTL = false;
+	bool explicit_ttl = false;
 #endif
 
 	ldns_rbtree_init(&todo_nsec3_ents, ldns_dname_compare_v);
 
 #ifdef FASTER_DNSSEC_ZONE_NEW_FRM_FP
-	status = ldns_zone_new_frm_fp_l(&zone, fp, origin,ttl, c, line_nr);
+	status = ldns_zone_new_frm_fp_l(&zone, fp, origin, default_ttl, c, line_nr);
 	if (status != LDNS_STATUS_OK)
 		goto error;
 #endif
@@ -672,13 +679,61 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 		status = LDNS_STATUS_OK;
 #else
 	while (!feof(fp)) {
+		/* If ttl came from $TTL line, then it should be the default.
+		 * (RFC 2308 Section 4)
+		 * Otherwise it "defaults to the last explicitly stated value"
+		 * (RFC 1035 Section 5.1)
+		 */
+		if (ttl_from_TTL)
+			my_ttl = default_ttl;
 		status = ldns_rr_new_frm_fp_l(&cur_rr, fp, &my_ttl, &my_origin,
-				&my_prev, line_nr);
-
+				&my_prev, line_nr, &explicit_ttl);
 #endif
 		switch (status) {
 		case LDNS_STATUS_OK:
+#ifndef FASTER_DNSSEC_ZONE_NEW_FRM_FP
+			if (explicit_ttl) {
+				if (!ttl_from_TTL) {
+					/* No $TTL, so ttl "defaults to the
+					 * last explicitly stated value"
+					 * (RFC 1035 Section 5.1)
+					 */
+					my_ttl = ldns_rr_ttl(cur_rr);
+				}
+			/* When ttl is implicit, try to adhere to the rules as
+			 * much as possible. (also for compatibility with bind)
+			 * This was changed when fixing an issue with ZONEMD
+			 * which hashes the TTL too.
+			 */
+			} else if (ldns_rr_get_type(cur_rr) == LDNS_RR_TYPE_SIG
+			       ||  ldns_rr_get_type(cur_rr) == LDNS_RR_TYPE_RRSIG) {
+				if (ldns_rr_rd_count(cur_rr) >= 4
+				&&  ldns_rdf_get_type(ldns_rr_rdf(cur_rr, 3)) == LDNS_RDF_TYPE_INT32)
+
+					/* SIG without explicit ttl get ttl
+					 * from the original_ttl field
+					 * (RFC 2535 Section 7.2)
+					 *
+					 * Similarly for RRSIG, but stated less
+					 * specifically in the spec.
+					 * (RFC 4034 Section 3)
+					 */
+					ldns_rr_set_ttl(cur_rr,
+					    ldns_rdf2native_int32(
+					        ldns_rr_rdf(rr, 3)));
+
+			} else if (prev_rr
+			       &&  ldns_rr_get_type(prev_rr) == ldns_rr_get_type(cur_rr)
+			       &&  ldns_dname_compare( ldns_rr_owner(prev_rr)
+			                             , ldns_rr_owner(cur_rr)) == 0)
+
+				/* "TTLs of all RRs in an RRSet must be the same"
+				 * (RFC 2881 Section 5.2)
+				 */
+				ldns_rr_set_ttl(cur_rr, ldns_rr_ttl(prev_rr));
 
+			prev_rr = cur_rr;
+#endif
 			status = ldns_dnssec_zone_add_rr(newzone, cur_rr);
 			if (status ==
 				LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND) {
@@ -698,9 +753,16 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 
 			break;
 
+		case LDNS_STATUS_SYNTAX_TTL:	/* the ttl was set*/
+#ifndef FASTER_DNSSEC_ZONE_NEW_FRM_FP
+			default_ttl = my_ttl;
+			ttl_from_TTL = true;
+#endif
+			status = LDNS_STATUS_OK;
+			break;
+
 
 		case LDNS_STATUS_SYNTAX_EMPTY:	/* empty line was seen */
-		case LDNS_STATUS_SYNTAX_TTL:	/* the ttl was set*/
 		case LDNS_STATUS_SYNTAX_ORIGIN:	/* the origin was set*/
 			status = LDNS_STATUS_OK;
 			break;
@@ -746,6 +808,7 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 		newzone = NULL;
 	} else {
 		ldns_dnssec_zone_free(newzone);
+		newzone = NULL;
 	}
 
 error:
@@ -792,10 +855,21 @@ ldns_dnssec_name_node_deep_free(ldns_rbnode_t *node, void *arg) {
 	LDNS_FREE(node);
 }
 
+static void
+ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
+	(void) arg;
+	LDNS_FREE(node);
+}
+
 void
 ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
 {
 	if (zone) {
+		if (zone->hashed_names) {
+			ldns_traverse_postorder(zone->hashed_names,
+					ldns_hashed_names_node_free, NULL);
+			LDNS_FREE(zone->hashed_names);
+		}
 		if (zone->names) {
 			/* destroy all name structures within the tree */
 			ldns_traverse_postorder(zone->names,
@@ -811,6 +885,11 @@ void
 ldns_dnssec_zone_deep_free(ldns_dnssec_zone *zone)
 {
 	if (zone) {
+		if (zone->hashed_names) {
+			ldns_traverse_postorder(zone->hashed_names,
+					ldns_hashed_names_node_free, NULL);
+			LDNS_FREE(zone->hashed_names);
+		}
 		if (zone->names) {
 			/* destroy all name structures within the tree */
 			ldns_traverse_postorder(zone->names,
@@ -832,12 +911,6 @@ static void
 ldns_dnssec_name_make_hashed_name(ldns_dnssec_zone *zone,
 		ldns_dnssec_name* name, ldns_rr* nsec3rr);
 
-static void
-ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
-	(void) arg;
-	LDNS_FREE(node);
-}
-
 static void
 ldns_dnssec_zone_hashed_names_from_nsec3(
 		ldns_dnssec_zone* zone, ldns_rr* nsec3rr)
@@ -907,20 +980,22 @@ ldns_dnssec_name_make_hashed_name(ldns_dnssec_zone *zone,
 static ldns_rbnode_t *
 ldns_dnssec_zone_find_nsec3_original(ldns_dnssec_zone *zone, ldns_rr *rr) {
 	ldns_rdf *hashed_name;
+	ldns_rbnode_t *to_return;
 
-	hashed_name = ldns_dname_label(ldns_rr_owner(rr), 0);
-	if (hashed_name == NULL) {
-		return NULL;
-	}
 	if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC3 && ! zone->_nsec3params){
 
 		ldns_dnssec_zone_hashed_names_from_nsec3(zone, rr);
 	}
 	if (zone->hashed_names == NULL) {
-		ldns_rdf_deep_free(hashed_name);
 		return NULL;
 	}
-	return  ldns_rbtree_search(zone->hashed_names, hashed_name);
+	hashed_name = ldns_dname_label(ldns_rr_owner(rr), 0);
+	if (hashed_name == NULL) {
+		return NULL;
+	}
+	to_return = ldns_rbtree_search(zone->hashed_names, hashed_name);
+	ldns_rdf_deep_free(hashed_name);
+	return to_return;
 }
 
 ldns_status
@@ -1105,8 +1180,12 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(
 				ldns_rdf *ent_name;
 
 				if (!(ent_name = ldns_dname_clone_from(
-						next_name, i)))
+						next_name, i))) {
+					
+					ldns_rdf_deep_free(l1);
+					ldns_rdf_deep_free(l2);
 					return LDNS_STATUS_MEM_ERR;
+				}
 
 				if (nsec3s && zone->_nsec3params) {
 					ldns_rdf *ent_hashed_name;
@@ -1114,28 +1193,35 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(
 					if (!(ent_hashed_name =
 					    ldns_nsec3_hash_name_frm_nsec3(
 							zone->_nsec3params,
-							ent_name)))
+							ent_name))) {
+						ldns_rdf_deep_free(l1);
+						ldns_rdf_deep_free(l2);
+						ldns_rdf_deep_free(ent_name);
 						return LDNS_STATUS_MEM_ERR;
+					}
 					node = ldns_rbtree_search(nsec3s, 
 							ent_hashed_name);
+					ldns_rdf_deep_free(ent_hashed_name);
 					if (!node) {
 						ldns_rdf_deep_free(l1);
 						ldns_rdf_deep_free(l2);
+						ldns_rdf_deep_free(ent_name);
 						continue;
 					}
 				}
 				new_name = ldns_dnssec_name_new();
 				if (!new_name) {
+					ldns_rdf_deep_free(l1);
+					ldns_rdf_deep_free(l2);
+					ldns_rdf_deep_free(ent_name);
 					return LDNS_STATUS_MEM_ERR;
 				}
 				new_name->name = ent_name;
-				if (!new_name->name) {
-					ldns_dnssec_name_free(new_name);
-					return LDNS_STATUS_MEM_ERR;
-				}
 				new_name->name_alloced = true;
 				new_node = LDNS_MALLOC(ldns_rbnode_t);
 				if (!new_node) {
+					ldns_rdf_deep_free(l1);
+					ldns_rdf_deep_free(l2);
 					ldns_dnssec_name_free(new_name);
 					return LDNS_STATUS_MEM_ERR;
 				}
@@ -1190,3 +1276,709 @@ ldns_dnssec_zone_is_nsec3_optout(const ldns_dnssec_zone* zone)
 	}
 	return false;
 }
+
+/*
+ * Stuff for calculating and verifying zone digests
+ */
+typedef enum dnssec_zone_rr_iter_state {
+	  DNSSEC_ZONE_RR_ITER_LT_RRSIG
+	, DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC
+	, DNSSEC_ZONE_RR_ITER_REST
+	, DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC
+	, DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC_REST
+	, DNSSEC_ZONE_RR_ITER_NSEC3
+	, DNSSEC_ZONE_RR_ITER_FINI
+} dnssec_zone_rr_iter_state;
+
+typedef struct dnssec_zone_rr_iter {
+	ldns_dnssec_zone         *zone;
+	ldns_rbnode_t            *node;
+	ldns_dnssec_name         *name;
+	ldns_dnssec_rrsets       *rrsets;
+	ldns_dnssec_rrs          *rrs;
+	ldns_dnssec_rrsets       *rrsets4rrsigs;
+	ldns_rbnode_t            *nsec3_node;
+	ldns_dnssec_name         *nsec3_name;
+	dnssec_zone_rr_iter_state state;
+	ldns_rdf                 *apex_name;
+	uint8_t                   apex_labs;
+} dnssec_zone_rr_iter;
+
+INLINE void
+dnssec_zone_rr_iter_set_state_for_next_name(dnssec_zone_rr_iter *i)
+{
+	/* Make sure the i->name is "in zone" (i.e. below the apex) */
+	if (i->apex_name) {
+		ldns_rdf *name = (ldns_rdf *)i->node->key;
+
+		while (i->name && name != i->apex_name        /* not apex */
+
+		&& (  ldns_dname_label_count(name) != i->apex_labs
+		   || ldns_dname_compare(name, i->apex_name)) /* not apex */
+
+		&& !ldns_dname_is_subdomain(name, i->apex_name) /* no sub */) {
+
+			/* next name */
+			i->node = ldns_rbtree_next(i->node);
+			if (i->node == LDNS_RBTREE_NULL)
+				i->name = NULL;
+			else {
+				i->name = (ldns_dnssec_name *)i->node->data;
+				name = (ldns_rdf *)i->node->key;
+			}
+		}
+	}
+	/* determine state */
+	if (!i->name) {
+		if (!i->nsec3_name)
+			i->state = DNSSEC_ZONE_RR_ITER_FINI;
+		else {
+			i->rrs = i->nsec3_name->nsec_signatures;
+			i->state = DNSSEC_ZONE_RR_ITER_NSEC3;
+		}
+	} else if (!i->nsec3_name) {
+		i->rrsets = i->name->rrsets;
+		i->state = DNSSEC_ZONE_RR_ITER_LT_RRSIG;
+
+	} else if (ldns_dname_compare( ldns_rr_owner(i->nsec3_name->nsec)
+	                             , (ldns_rdf *)i->node->key) < 0) {
+		i->rrs = i->nsec3_name->nsec_signatures;
+		i->state = DNSSEC_ZONE_RR_ITER_NSEC3;
+	} else {
+		i->rrsets = i->name->rrsets;
+		i->state = DNSSEC_ZONE_RR_ITER_LT_RRSIG;
+	}
+}
+
+/**
+ * Iterate over the RR's in the ldns_dnssec_zone in canonical order.
+ * There are three possible paths through the RR's in a ldns_dnssec_name.
+ * 
+ * 1. There is no NSEC:
+ *
+ *    1.1. All the RRs in the name->rrsets with type < RRSIG,
+ *         state: DNSSEC_ZONE_RR_ITER_LT_RRSIG
+ *
+ *    1.2. Then all the RRSIGs from name->rrsets (likely none)
+ *         state: DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC
+ *
+ *    1.3. Finally the remaining RRs in name->rrsets (type > RRSIG)
+ *         state: DNSSEC_ZONE_RR_ITER_REST
+ *
+ *
+ * 2. There is a NSEC of type NSEC with this name:
+ *
+ *    2.1. All the RRs in the name->rrsets with type < RRSIG,
+ *         state: DNSSEC_ZONE_RR_ITER_LT_RRSIG
+ *
+ *    2.2. Then all the RRSIGs from name->rrsets with type < NSEC
+ *         state: DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC
+ *
+ *    2.3. Then the signatures of the NSEC RR, followed by
+ *         the signatures of the remaining name->rrsets (type > NSEC),
+ *         followed by the NSEC rr.
+ *         state: DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC
+ *
+ *    2.4. Finally the remaining RRs in name->rrsets (type > RRSIG)
+ *         state: DNSSEC_ZONE_RR_ITER_REST
+ *
+ *
+ * 3. There is a NSEC of type NSEC3 for this name:
+ *
+ *    3.1. If the NSEC3 name is before the name for other RRsets in the zone,
+ *         Then all signatures of the NSEC3 RR, followed by the NSEC3
+ *         state: DNSSEC_ZONE_RR_ITER_NSEC3
+ *
+ *         otherwise follow path for "no NSEC" for the name for other RRsets
+ */
+static ldns_rr *
+dnssec_zone_rr_iter_next(dnssec_zone_rr_iter *i)
+{
+	ldns_rr *nsec3;
+
+	for (;;) {
+		if (i->rrs) {
+			ldns_rr *rr = i->rrs->rr;
+			i->rrs = i->rrs->next;
+			return rr;
+		}
+		switch (i->state) {
+		case DNSSEC_ZONE_RR_ITER_LT_RRSIG:
+			if (i->rrsets
+			&&  i->rrsets->type < LDNS_RR_TYPE_RRSIG) {
+
+				i->rrs = i->rrsets->rrs;
+				i->rrsets = i->rrsets->next;
+				break;
+			}
+			i->rrsets4rrsigs = i->name->rrsets;
+			if (i->name->nsec && ldns_rr_get_type(i->name->nsec)
+			                               == LDNS_RR_TYPE_NSEC) {
+
+				i->state = DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC;
+				break;
+			}
+			i->state = DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC;
+			/* fallthrough */
+
+		case DNSSEC_ZONE_RR_ITER_RRSIGs_NO_NSEC:
+			if (i->rrsets4rrsigs) {
+				i->rrs = i->rrsets4rrsigs->signatures;
+				i->rrsets4rrsigs = i->rrsets4rrsigs->next;
+				break;
+			}
+			i->state = DNSSEC_ZONE_RR_ITER_REST;
+			/* fallthrough */
+
+		case DNSSEC_ZONE_RR_ITER_REST:
+			if (i->rrsets) {
+				i->rrs = i->rrsets->rrs;
+				i->rrsets = i->rrsets->next;
+				break;
+			}
+			/* next name */
+			i->node = ldns_rbtree_next(i->node);
+			i->name = i->node == LDNS_RBTREE_NULL ? NULL
+				: (ldns_dnssec_name *)i->node->data;
+
+			dnssec_zone_rr_iter_set_state_for_next_name(i);
+			break;
+
+		case DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC:
+			if (i->rrsets4rrsigs
+			&&  i->rrsets4rrsigs->type < LDNS_RR_TYPE_NSEC) {
+
+				i->rrs = i->rrsets4rrsigs->signatures;
+				i->rrsets4rrsigs = i->rrsets4rrsigs->next;
+				break;
+			}
+			i->state = DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC_REST;
+			i->rrs = i->name->nsec_signatures;
+			break;
+
+		case DNSSEC_ZONE_RR_ITER_RRSIGs_NSEC_REST:
+			if (i->rrsets4rrsigs) {
+				i->rrs = i->rrsets4rrsigs->signatures;
+				i->rrsets4rrsigs = i->rrsets4rrsigs->next;
+				break;
+			}
+			i->state = DNSSEC_ZONE_RR_ITER_REST;
+			return i->name->nsec;
+
+		case DNSSEC_ZONE_RR_ITER_NSEC3:
+			nsec3 = i->nsec3_name->nsec;
+
+			/* next nsec3 */
+			do {
+				i->nsec3_node
+				    = ldns_rbtree_next(i->nsec3_node);
+				i->nsec3_name
+				    = i->nsec3_node == LDNS_RBTREE_NULL ? NULL
+				    : (ldns_dnssec_name*)i->nsec3_node->data;
+
+				/* names for glue can be in the hashed_names 
+				 * tree, but will not have a NSEC3 
+				 */
+			} while (i->nsec3_name && !i->nsec3_name->nsec);
+
+			dnssec_zone_rr_iter_set_state_for_next_name(i);
+			return nsec3;
+
+		case DNSSEC_ZONE_RR_ITER_FINI:
+			return NULL;
+		}
+	}
+}
+
+static ldns_rr *
+dnssec_zone_rr_iter_first(dnssec_zone_rr_iter *i, ldns_dnssec_zone *zone)
+{
+	if (!i || !zone)
+		return NULL;
+
+	memset(i, 0, sizeof(*i));
+	i->zone = zone;
+	if (zone->soa && zone->soa->name) {
+		i->apex_name = zone->soa->name;
+		i->apex_labs = ldns_dname_label_count(i->apex_name);
+	} else
+		i->apex_name = NULL;
+
+
+	i->node = ldns_rbtree_first(zone->names);
+	i->name = i->node == LDNS_RBTREE_NULL ? NULL
+		: (ldns_dnssec_name *)i->node->data;
+
+	if (zone->hashed_names) {
+		do {
+			i->nsec3_node = ldns_rbtree_first(zone->hashed_names);
+			i->nsec3_name = i->nsec3_node == LDNS_RBTREE_NULL ?NULL
+				      : (ldns_dnssec_name*)i->nsec3_node->data;
+		} while (i->nsec3_name && !i->nsec3_name->nsec);
+	}
+	dnssec_zone_rr_iter_set_state_for_next_name(i);
+	return dnssec_zone_rr_iter_next(i);
+}
+
+enum enum_zonemd_scheme {
+        ZONEMD_SCHEME_FIRST  = 1,
+        ZONEMD_SCHEME_SIMPLE = 1,
+        ZONEMD_SCHEME_LAST   = 1
+};
+typedef enum enum_zonemd_scheme zonemd_scheme;
+
+enum enum_zonemd_hash {
+        ZONEMD_HASH_FIRST  = 1,
+        ZONEMD_HASH_SHA384 = 1,
+        ZONEMD_HASH_SHA512 = 2,
+        ZONEMD_HASH_LAST   = 2
+};
+typedef enum enum_zonemd_hash zonemd_hash;
+
+struct struct_zone_digester {
+        ldns_sha384_CTX sha384_CTX;
+        ldns_sha512_CTX sha512_CTX;
+        unsigned simple_sha384 : 1;
+        unsigned simple_sha512 : 1;
+        unsigned double_sha384 : 1;
+        unsigned double_sha512 : 1;
+};
+typedef struct struct_zone_digester zone_digester;
+
+INLINE bool zone_digester_set(zone_digester *zd)
+{ return zd && (zd->simple_sha384 || zd->simple_sha512); }
+
+INLINE void zone_digester_init(zone_digester *zd)
+{ memset(zd, 0, sizeof(*zd)); }
+
+static ldns_status
+zone_digester_add(zone_digester *zd, zonemd_scheme scheme, zonemd_hash hash)
+{
+	if (!zd)
+		return LDNS_STATUS_NULL;
+
+	switch (scheme) {
+	case ZONEMD_SCHEME_SIMPLE:
+		switch (hash) {
+		case ZONEMD_HASH_SHA384:
+			if (zd->double_sha384)
+				return LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE;
+
+			else if (zd->simple_sha384) {
+				zd->simple_sha384 = 0;
+				zd->double_sha384 = 1;
+				return LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE;
+			}
+			ldns_sha384_init(&zd->sha384_CTX);
+			zd->simple_sha384 = 1;
+			break;
+
+		case ZONEMD_HASH_SHA512:
+			if (zd->double_sha512)
+				return LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE;
+
+			else if (zd->simple_sha512) {
+				zd->simple_sha512 = 0;
+				zd->double_sha512 = 1;
+				return LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE;
+			}
+			ldns_sha512_init(&zd->sha512_CTX);
+			zd->simple_sha512 = 1;
+			break;
+		default:
+			return LDNS_STATUS_ZONEMD_UNKNOWN_HASH;
+		}
+		break;
+	default:
+		return LDNS_STATUS_ZONEMD_UNKNOWN_SCHEME;
+	}
+	return LDNS_STATUS_OK;
+}
+
+static ldns_status
+zone_digester_update(zone_digester *zd, ldns_rr *rr)
+{
+	uint8_t data[65536];
+	ldns_buffer buf;
+	ldns_status st;
+	
+	buf._data = data;
+	buf._position = 0;
+	buf._limit = sizeof(data);
+	buf._capacity = sizeof(data);
+	buf._fixed = 1;
+	buf._status = LDNS_STATUS_OK;
+
+	if ((st = ldns_rr2buffer_wire_canonical(&buf, rr, LDNS_SECTION_ANSWER)))
+		return st;
+
+	if (zd->simple_sha384)
+		ldns_sha384_update(&zd->sha384_CTX, data, buf._position);
+
+	if (zd->simple_sha512)
+		ldns_sha512_update(&zd->sha512_CTX, data, buf._position);
+
+	return LDNS_STATUS_OK;
+}
+
+INLINE ldns_rr *
+new_zonemd(ldns_rr *soa, zonemd_hash hash)
+{
+	ldns_rr  *rr     = NULL;
+	uint8_t  *data   = NULL;
+	ldns_rdf *rdf;
+	size_t    md_len = hash == ZONEMD_HASH_SHA384
+	                 ? LDNS_SHA384_DIGEST_LENGTH
+	                 : LDNS_SHA512_DIGEST_LENGTH;
+
+	if (!(rr = ldns_rr_new_frm_type(LDNS_RR_TYPE_ZONEMD)))
+		return NULL;
+
+	if (!(rdf = ldns_rdf_clone(ldns_rr_owner(soa))))
+		goto error;
+
+	ldns_rr_set_owner(rr, rdf);
+	ldns_rr_set_class(rr, ldns_rr_get_class(soa));
+	ldns_rr_set_ttl(rr, ldns_rr_ttl(soa));
+
+	if (!(rdf = ldns_rdf_clone(ldns_rr_rdf(soa, 2))))
+		goto error;
+	ldns_rr_set_rdf(rr, rdf, 0);
+
+	if (!(rdf = ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, 1)))
+		goto error;
+	ldns_rr_set_rdf(rr, rdf, 1);
+
+	if (!(rdf = ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, hash)))
+		goto error;
+	ldns_rr_set_rdf(rr, rdf, 2);
+
+	if (!(data = LDNS_XMALLOC(uint8_t, md_len)))
+		goto error;
+
+	if (!(rdf = ldns_rdf_new(LDNS_RDF_TYPE_HEX, md_len, data)))
+		goto error;
+	ldns_rr_set_rdf(rr, rdf, 3);
+
+	return rr;
+error:
+	if (data)
+		LDNS_FREE(data);
+	ldns_rr_free(rr);
+	return NULL;
+}
+
+static ldns_rr_list *
+zone_digester_export(
+		zone_digester *zd, ldns_rr *soa, ldns_status *ret_st)
+{
+	ldns_status st = LDNS_STATUS_OK;
+	ldns_rr_list *rr_list = NULL;
+	ldns_rr *sha384 = NULL;
+	ldns_rr *sha512 = NULL;
+
+	if (!zd || !soa)
+		st = LDNS_STATUS_NULL;
+
+	else if (ldns_rr_get_type(soa) != LDNS_RR_TYPE_SOA
+	     ||  ldns_rr_rd_count(soa) < 3)
+		st = LDNS_STATUS_ZONEMD_INVALID_SOA;
+
+	else if (!(rr_list = ldns_rr_list_new()))
+		st = LDNS_STATUS_MEM_ERR;
+
+	else if (zd->simple_sha384
+	     && !(sha384 = new_zonemd(soa, ZONEMD_HASH_SHA384)))
+		st = LDNS_STATUS_MEM_ERR;
+
+	else if (zd->simple_sha512
+	     && !(sha512 = new_zonemd(soa, ZONEMD_HASH_SHA512)))
+		st = LDNS_STATUS_MEM_ERR;
+
+	else if (zd->simple_sha384
+	     && !ldns_rr_list_push_rr(rr_list, sha384))
+		st = LDNS_STATUS_MEM_ERR;
+
+	else if (zd->simple_sha512
+	     && !ldns_rr_list_push_rr(rr_list, sha512)) {
+		if (zd->simple_sha384)
+			sha384 = NULL; /* deleted by ldns_rr_list_deep_free */
+		st = LDNS_STATUS_MEM_ERR;
+
+	} else {
+		if (sha384)
+			ldns_sha384_final( ldns_rdf_data(ldns_rr_rdf(sha384,3))
+			                 , &zd->sha384_CTX);
+		if (sha512)
+			ldns_sha512_final( ldns_rdf_data(ldns_rr_rdf(sha512,3))
+			                 , &zd->sha512_CTX);
+		return rr_list;
+	}
+	if (ret_st)
+		*ret_st = st;
+	if (sha384)
+		ldns_rr_free(sha384);
+	if (sha512)
+		ldns_rr_free(sha512);
+	if (rr_list)
+		ldns_rr_list_deep_free(rr_list);
+	return NULL;
+}
+
+static ldns_status
+ldns_digest_zone(ldns_dnssec_zone *zone, zone_digester *zd)
+{
+	ldns_status st = LDNS_STATUS_OK;
+	dnssec_zone_rr_iter rr_iter;
+	ldns_rr *rr;
+	ldns_rdf *apex_name; /* name of zone apex */
+
+	if (!zone || !zd || !zone->soa || !zone->soa->name)
+		return LDNS_STATUS_NULL;
+
+	apex_name = zone->soa->name;
+	for ( rr = dnssec_zone_rr_iter_first(&rr_iter, zone)
+	    ; rr && !st
+	    ; rr = dnssec_zone_rr_iter_next(&rr_iter)) {
+		/* Skip apex ZONEMD RRs */
+		if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_ZONEMD
+		&& !ldns_dname_compare(ldns_rr_owner(rr), apex_name))
+			continue;
+		/* Skip RRSIGs for apex ZONEMD RRs */
+		if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_RRSIG
+		&&  LDNS_RR_TYPE_ZONEMD == ldns_rdf2rr_type(
+				ldns_rr_rrsig_typecovered(rr))
+		&& !ldns_dname_compare(ldns_rr_owner(rr), apex_name))
+			continue;
+		st = zone_digester_update(zd, rr);
+	}
+	return st;
+}
+
+ldns_status
+ldns_dnssec_zone_verify_zonemd(ldns_dnssec_zone *zone)
+{
+	ldns_dnssec_rrsets *zonemd, *soa;
+	zone_digester zd;
+	ldns_dnssec_rrs *rrs;
+	ldns_rr *soa_rr;
+	ldns_status st;
+	uint8_t simple_sha384[LDNS_SHA384_DIGEST_LENGTH];
+	uint8_t simple_sha512[LDNS_SHA512_DIGEST_LENGTH];
+	size_t valid_zonemds;
+
+	if (!zone)
+		return LDNS_STATUS_NULL;
+
+	zonemd = ldns_dnssec_zone_find_rrset(
+			zone, zone->soa->name, LDNS_RR_TYPE_ZONEMD);
+	if (!zonemd) {
+		ldns_rbnode_t *nsec3_node;
+
+		/* we need proof of non-existence for ZONEMD at the apex */
+		if (zone->soa->nsec) {
+			if (ldns_nsec_bitmap_covers_type(ldns_nsec_get_bitmap(
+							zone->soa->nsec),
+					       	LDNS_RR_TYPE_ZONEMD))
+				return LDNS_STATUS_NO_ZONEMD;
+
+		} else if (!zone->soa->hashed_name || !zone->hashed_names)
+			return LDNS_STATUS_NO_ZONEMD;
+
+		else if (LDNS_RBTREE_NULL == 
+		    (nsec3_node = ldns_rbtree_search( zone->hashed_names
+						    , zone->soa->hashed_name)))
+			return LDNS_STATUS_NO_ZONEMD;
+		else {
+			ldns_dnssec_name *nsec3
+				= (ldns_dnssec_name *)nsec3_node->data;
+			if (ldns_nsec_bitmap_covers_type(ldns_nsec_get_bitmap(
+							nsec3->nsec),
+						LDNS_RR_TYPE_ZONEMD))
+				return LDNS_STATUS_NO_ZONEMD;
+		}
+		/* ZONEMD at apex does really not exist */
+		return LDNS_STATUS_OK;
+	}
+	soa = ldns_dnssec_zone_find_rrset(
+			zone, zone->soa->name, LDNS_RR_TYPE_SOA);
+	if (!soa || !soa->rrs || !soa->rrs->rr)
+		return LDNS_STATUS_ZONEMD_INVALID_SOA;
+
+	soa_rr = soa->rrs->rr;
+	if (ldns_rr_get_type(soa_rr) != LDNS_RR_TYPE_SOA
+	||  ldns_rr_rd_count(soa_rr) < 3)
+		return LDNS_STATUS_ZONEMD_INVALID_SOA;
+
+	zone_digester_init(&zd);
+	for (rrs = zonemd->rrs; rrs; rrs = rrs->next) {
+		if (!rrs->rr
+		||  ldns_rr_get_type(rrs->rr) != LDNS_RR_TYPE_ZONEMD
+		||  ldns_rr_rd_count(rrs->rr) < 4)
+			continue;
+
+		/* serial should match SOA's serial */
+		if (ldns_rdf2native_int32(ldns_rr_rdf(soa_rr, 2))
+		    != ldns_rdf2native_int32(ldns_rr_rdf(rrs->rr, 0)))
+			continue;
+		
+		/* Add (scheme, hash) to digester */
+		zone_digester_add(&zd,
+				ldns_rdf2native_int8(ldns_rr_rdf(rrs->rr, 1)),
+				ldns_rdf2native_int8(ldns_rr_rdf(rrs->rr, 2)));
+	}
+	if (!zone_digester_set(&zd))
+		return LDNS_STATUS_NO_VALID_ZONEMD;
+
+	if ((st = ldns_digest_zone(zone, &zd)))
+		return st;
+
+	if (zd.simple_sha384)
+		ldns_sha384_final(simple_sha384, &zd.sha384_CTX);
+	if (zd.simple_sha512)
+		ldns_sha512_final(simple_sha512, &zd.sha512_CTX);
+
+	valid_zonemds = 0;
+	for (rrs = zonemd->rrs; rrs; rrs = rrs->next) {
+		if (!rrs->rr
+		||  ldns_rr_get_type(rrs->rr) != LDNS_RR_TYPE_ZONEMD
+		||  ldns_rr_rd_count(rrs->rr) < 4)
+			continue;
+
+		/* serial should match SOA's serial */
+		if (ldns_rdf2native_int32(ldns_rr_rdf(soa_rr, 2))
+		    != ldns_rdf2native_int32(ldns_rr_rdf(rrs->rr, 0)))
+			continue;
+		
+		if (ZONEMD_SCHEME_SIMPLE !=
+				ldns_rdf2native_int8(ldns_rr_rdf(rrs->rr, 1)))
+			continue;
+
+		if (ZONEMD_HASH_SHA384
+				== ldns_rdf2native_int8(ldns_rr_rdf(rrs->rr,2))
+		&&  LDNS_SHA384_DIGEST_LENGTH
+				== ldns_rdf_size(ldns_rr_rdf(rrs->rr, 3))
+		&&  memcmp( simple_sha384
+			  , ldns_rdf_data(ldns_rr_rdf(rrs->rr, 3))
+		          , LDNS_SHA384_DIGEST_LENGTH) == 0)
+
+			valid_zonemds += 1;
+
+		if (ZONEMD_HASH_SHA512
+				== ldns_rdf2native_int8(ldns_rr_rdf(rrs->rr,2))
+		&&  LDNS_SHA512_DIGEST_LENGTH
+				== ldns_rdf_size(ldns_rr_rdf(rrs->rr, 3))
+		&&  memcmp( simple_sha512
+			  , ldns_rdf_data(ldns_rr_rdf(rrs->rr, 3))
+		          , LDNS_SHA512_DIGEST_LENGTH) == 0)
+
+			valid_zonemds += 1;
+	}
+	return valid_zonemds ? LDNS_STATUS_OK : LDNS_STATUS_NO_VALID_ZONEMD;
+}
+
+#ifdef HAVE_SSL
+static ldns_status
+rr_list2dnssec_rrs(ldns_rr_list *rr_list, ldns_dnssec_rrs **rrs,
+		ldns_rr_list *new_rrs)
+{
+	ldns_rr *rr = NULL;
+
+	if (!rr_list || !rrs)
+		return LDNS_STATUS_NULL;
+
+	if (ldns_rr_list_rr_count(rr_list) == 0)
+		return LDNS_STATUS_OK;
+
+	if (!*rrs) {
+		if (!(*rrs = ldns_dnssec_rrs_new()))
+			return LDNS_STATUS_MEM_ERR;
+		(*rrs)->rr = ldns_rr_list_pop_rr(rr_list);
+		if (new_rrs)
+			ldns_rr_list_push_rr(new_rrs, (*rrs)->rr);
+	}
+	while ((rr = ldns_rr_list_pop_rr(rr_list))) {
+		ldns_status st;
+	       
+		if ((st = ldns_dnssec_rrs_add_rr(*rrs, rr))) {
+			ldns_rr_list_push_rr(rr_list, rr);
+			return st;
+		} else if (new_rrs)
+			ldns_rr_list_push_rr(new_rrs, rr);
+	}
+	return LDNS_STATUS_OK;
+}
+
+
+ldns_status
+dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone,
+		ldns_rr_list *new_rrs, ldns_key_list *key_list, int signflags);
+ldns_status
+dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone,
+		ldns_rr_list *new_rrs, ldns_key_list *key_list, int signflags)
+{
+	ldns_status st = LDNS_STATUS_OK;
+	zone_digester zd;
+	ldns_rr_list *zonemd_rr_list = NULL;
+	ldns_rr_list *zonemd_rrsigs = NULL;
+	ldns_dnssec_rrsets *soa_rrset;
+	ldns_rr *soa_rr = NULL;
+	ldns_dnssec_rrsets **rrset_ref;
+	ldns_dnssec_rrsets *zonemd_rrset;
+
+	zone_digester_init(&zd);
+	if (signflags & LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384)
+		zone_digester_add(&zd, ZONEMD_SCHEME_SIMPLE
+		                     , ZONEMD_HASH_SHA384);
+
+	if (signflags & LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512)
+		zone_digester_add(&zd, ZONEMD_SCHEME_SIMPLE
+		                     , ZONEMD_HASH_SHA512);
+
+	if ((st = ldns_digest_zone(zone, &zd)))
+		return st;
+
+	soa_rrset = ldns_dnssec_zone_find_rrset(
+			zone, zone->soa->name, LDNS_RR_TYPE_SOA);
+	if (!soa_rrset || !soa_rrset->rrs || !soa_rrset->rrs->rr)
+		return LDNS_STATUS_ZONEMD_INVALID_SOA;
+	soa_rr = soa_rrset->rrs->rr;
+
+	if (!(zonemd_rr_list = zone_digester_export(&zd, soa_rr, &st)))
+		return st;
+	
+	/* - replace or add ZONEMD rrset */
+	rrset_ref = &zone->soa->rrsets; /* scan rrsets at apex */
+	while (*rrset_ref && (*rrset_ref)->type < LDNS_RR_TYPE_ZONEMD)
+		rrset_ref = &(*rrset_ref)->next;
+	if (*rrset_ref && (*rrset_ref)->type == LDNS_RR_TYPE_ZONEMD) {
+		/* reuse zonemd rrset */
+		zonemd_rrset = *rrset_ref;
+		ldns_dnssec_rrs_free(zonemd_rrset->rrs);
+		zonemd_rrset->rrs = NULL;
+		ldns_dnssec_rrs_free(zonemd_rrset->signatures);
+		zonemd_rrset->signatures = NULL;
+	} else {
+		/* insert zonemd rrset */
+		zonemd_rrset = ldns_dnssec_rrsets_new();
+		if (!zonemd_rrset) {
+			ldns_rr_list_deep_free(zonemd_rr_list);
+			return LDNS_STATUS_MEM_ERR;
+		}
+		zonemd_rrset->type = LDNS_RR_TYPE_ZONEMD;
+		zonemd_rrset->next = *rrset_ref;
+		*rrset_ref = zonemd_rrset;
+	}
+	if ((zonemd_rrsigs = ldns_sign_public(zonemd_rr_list, key_list)))
+		st = rr_list2dnssec_rrs(  zonemd_rrsigs
+		                       , &zonemd_rrset->signatures, new_rrs);
+	if (!st)
+		st = rr_list2dnssec_rrs(  zonemd_rr_list
+		                       , &zonemd_rrset->rrs, new_rrs);
+	ldns_rr_list_deep_free(zonemd_rr_list);
+	ldns_rr_list_deep_free(zonemd_rrsigs);
+	return st;
+}
+
+#endif /* HAVE_SSL */
+
diff --git a/contrib/ldns/doc/API-header.xml b/contrib/ldns/doc/API-header.xml
new file mode 100644
index 00000000000000..eac42fc205caa0
--- /dev/null
+++ b/contrib/ldns/doc/API-header.xml
@@ -0,0 +1,109 @@
+<?xml version="1.0"?>
+
+<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
+<!-- $Id -->
+
+<?rfc toc="yes" ?>
+<?rfc compact="yes" ?>
+<?rfc editing="no" ?>
+<?rfc iprnotified="no" ?>
+<?rfc private="LibDNS API" ?>
+
+<rfc ipr="none" category="info" docName="API-00.txt">
+
+<front>
+<title>LibDNS API</title>
+    <author initials="R." surname="Gieben" fullname="Miek Gieben">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>miek@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+    <author initials="J." surname="Jansen" fullname="Jelte Jansen">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>jelte@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+    <author initials="E." surname="Rozendaal" fullname="Erik Rozendaal">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>erik@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+<date month="January" year="2005" />
+<keyword>DNS</keyword>
+<keyword>Elite</keyword>
+<keyword>Hacking</keyword>
+<abstract>
+<t>
+A small abstract will come here, TBD.
+</t>
+</abstract>
+</front>
+
+<middle>
+
+<section title="Introduction">
+<t>
+LibDNS (or lDNS) is modelled after the Net::DNS perl library. It has
+been shown that Net::DNS  can be used efficiently for
+programming DNS aware applications. We want to bring the same
+level of efficiency to C programmers.
+</t>
+<t>
+The lDNS API consist of two layers. The top-layer, this is
+what is actually exported to the application via the library. And the
+bottom-layer, this is what lDNS needs to compile and function.
+</t>
+</section> <!-- "Introduction" -->
+
+<section title="Differences With Other Libraries">
+<t>
+Short intermezzo detailing differences with other libraries. Most important
+ones are the libc resolver interface (from BIND8) and the lwres_ interface
+from BIND9.
+</t>
+</section> <!-- "Differences with other libraries" -->
+
+<section title="Interfaces">
+<t>
+At its lowest level lDNS  is only dependent on libc. It uses a 
+few networking systems calls; socket, bind, send/recv and friends.
+</t>
+<t>
+Further more it is to be expected that lDNS will depend on OpenSSL for
+its cryptography.
+</t>
+<t>
+As said, lDNS is modelled after Net::DNS, therefore its application API
+looks very much like the one used for Net::DNS. Some modification are made
+of course, because not all functionality of Perl can be caught in C.
+</t>
+
+<t>
+This API document was written by carefully looking at the documentation
+contained in the Net::DNS Perl module.
+</t>
+</section> <!-- "Interfaces" -->
diff --git a/contrib/ldns/doc/API.xml b/contrib/ldns/doc/API.xml
new file mode 100644
index 00000000000000..3d873d88f49a81
--- /dev/null
+++ b/contrib/ldns/doc/API.xml
@@ -0,0 +1,462 @@
+<?xml version="1.0"?>
+
+<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
+<!-- $Id -->
+
+<?rfc toc="yes" ?>
+<?rfc compact="yes" ?>
+<?rfc editing="no" ?>
+<?rfc iprnotified="no" ?>
+<?rfc private="LibDNS API" ?>
+
+<rfc ipr="none" category="info" docName="libdns-api-00.txt">
+
+<front>
+<title>LibDNS API</title>
+    <author initials="R." surname="Gieben" fullname="Miek Gieben">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>miek@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+    <author initials="J." surname="Jansen" fullname="Jelte Jansen">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>jelte@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+    <author initials="E." surname="Rozendaal" fullname="Erik Rozendaal">
+     <organization>NLnet Labs</organization>
+      <address>
+        <postal>
+          <street>Kruislaan 419</street>
+          <city>Amsterdam</city>
+          <code>1098 VA</code>
+          <country>The Netherlands</country>
+        </postal>
+        <email>erik@nlnetlabs.nl</email>
+        <uri>http://www.nlnetlabs.nl</uri>
+      </address>
+    </author>
+<date month="January" year="2005" />
+<keyword>DNS</keyword>
+<keyword>Elite</keyword>
+<keyword>Hacking</keyword>
+<abstract>
+<t>
+A small abstract will come here, TBD.
+</t>
+</abstract>
+</front>
+
+<middle>
+
+<section title="Introduction">
+<t>
+LibDNS (or lDNS) is modelled after the Net::DNS perl library. It has
+been shown that Net::DNS  can be used efficiently for
+programming DNS aware applications. We want to bring the same
+level of efficiency to C programmers.
+</t>
+<t>
+The lDNS API consist of two layers. The top-layer, this is
+what is actually exported to the application via the library. And the
+bottom-layer, this is what lDNS needs to compile and function.
+</t>
+</section> <!-- "Introduction" -->
+
+<section title="Differences With Other Libraries">
+<t>
+Short intermezzo detailing differences with other libraries. Most important
+ones are the libc resolver interface (from BIND8) and the lwres_ interface
+from BIND9.
+</t>
+</section> <!-- "Differences with other libraries" -->
+
+<section title="Interfaces">
+<t>
+At its lowest level lDNS  is only dependent on libc. It uses a 
+few networking systems calls; socket, bind, send/recv and friends.
+</t>
+<t>
+Further more it is to be expected that lDNS will depend on OpenSSL for
+its cryptography.
+</t>
+<t>
+As said, lDNS is modelled after Net::DNS, therefore its application API
+looks very much like the one used for Net::DNS. Some modification are made
+of course, because not all functionality of Perl can be caught in C.
+</t>
+
+<t>
+This API document was written by carefully looking at the documentation
+contained in the Net::DNS Perl module.
+</t>
+</section> <!-- "Interfaces" -->
+
+<section title="RDF Structure">
+<t>
+The rdf structure, the RData Field, is a type that contains the different 
+types in the rdata of an RR. Consider the following example:
+<artwork>
+example.com.	IN	MX	10 mx.example.com.
+</artwork>
+The "10 mx.example.com." is the rdata in this case. It consists of two
+fields, "10" and "mx.example.com". These have the types (in this case)
+LDNS_RDF_TYPE_INT8 and LDNS_RDF_TYPE_DNAME.
+</t>
+<t>
+The following functions operate on this structure.
+</t>
+<t>
+<list style="hanging">
+<t hangText="dns_rdf *ldns_rdf_new(uint16_t s, ldns_rdf_type t, uint8_t *d):">
+Create a new rdf structure. Return a pointer to it.
+</t>
+<t hangText="uint16_t ldns_rdf_size(ldns_rdf *r):">
+Get the size of a rdf structure.
+</t>
+<t hangText="void ldns_rdf_set_size(ldns_rdf *r, uint16_t):">
+Set the size of a rdf structure.
+</t>
+<t hangText="void ldns_rdf_set_type(ldns_rdf *r, ldns_rdf_type t):">
+Set the type of a rdf structure.
+</t>
+<t hangText="ldns_rdf_type ldns_rdf_get_type(ldns_rdf *r):">
+Get the type of a rdf structure.
+</t>
+<t hangText="void ldns_rdf_set_data(ldns_rdf *r, uint8_t *n):">
+Set the (binary/network order) data of a rdf structure.
+</t>
+<t hangText="uint8_t *ldns_rdf_data(ldns_rdf *r):">
+Get a pointer to the data in a rdf structure.
+</t>
+<t hangText="void ldns_rdf_free(ldns_rdf *r):">
+Free a rdf structure.
+</t>
+<t hangText="ldns_rdf_new_frm_str(uint8_t *s, ldns_rdf_type t):">
+Create a new rdf structure from a string and a specific rdf_type.
+The type is needed to perform the correct conversion.
+</t>
+</list>
+</t>
+</section> <!-- "RDF Structure" -->
+
+<section title="RR Structure">
+<t>
+These functions operate on ldns_rr structures.
+</t>
+<t>
+<list style="hanging">
+<t hangText="ldns_rr *ldns_rr_new(void):">
+Returns a pointer to the newly created ldns_rr structure.
+</t>
+<t hangText="void ldns_rr_print(FILE *s, ldns_rr *r):">
+Prints the record to the stream s.
+</t>
+<t hangText="ldns_buffer ldns_rr_rdatastr(ldns_rr *r):">
+Returns a pointer to a ldns_buffer containing with string containing
+RR-specific data.
+</t>
+<t hangText="ldns_rdf *ldns_rr_name(ldns_rr *r):">
+Returns the record's owner name as a ldns_rdf type. 
+</t>
+<t hangText="ldns_rdf_rr_type ldns_rr_get_type(ldns_rr *r):">
+Returns the record's type.
+</t>
+<t hangText="ldns_rr_class ldns_rr_get_class(ldns_rr *r):">
+Returns the record's class.
+</t>
+<t hangText="uint32_t ldns_rr_get_ttl(ldns_rr *r):">
+Returns the record's time-to-live (TTL).
+</t>
+</list>
+</t>
+
+<t>
+TODO the 'set' functions of the 'get'
+</t>
+</section> <!-- "RR Structure" -->
+
+<section title="RR list Structure">
+<t>
+In the DNS the atomic data type is an RRset. This is a list
+of RRs with the same ownername, type and class. Net::DNS doesn't
+have rrsets as a separate object.
+</t>
+<t>
+In lDNS we have the ldns_rr_list, which just holds a bunch of RR's.
+No specific check are made on the RRs that can be put in such a list.
+Special wrapper functions exist which allow the usage of ldns_rr_list
+of real (RFC compliant) RR sets.
+</t>
+<t>
+TODO:  See rr.c
+</t>
+</section> <!-- "RR list Structure" -->
+
+<section title="Resolver Structure">
+<t>
+<list style="hanging">
+<t hangText="ldns_resolver* ldns_resolver_new(void):">
+Create a new resolver structure and return the pointer to that.
+</t>
+<t hangText="uint8_t ldns_version(resolver *res):">
+Returns the version of lDNS.
+</t>
+<t hangText="ldns_pkt *ldns_mx(ldns_resolver *res, ldns_rdf_type *dname):">
+Returns a ldns_pkt representing the MX records
+for the specified dname. Function is documented differently in Net::DNS.
+Do we need stuff like this?? XXX
+</t>
+<t hangText="ldns_status ldns_resolver_domain(resolver *res, ldns_rdf
+*domain):">
+ Set the default domain for this resolver. This domain is added
+     when a query is made with a name without a trailing dot.
+
+     
+</t>
+<t hangText="ldns_status ldns_resolver_nameserver_push(resolver *res,
+ldns_rdf *ip):">
+Add a new nameserver to the resolver. These nameservers are queried
+    when a search() or query() is done.
+    
+</t>
+<t hangText="ldns_status ldns_resolver_searchlist_push(resolver *res,
+ldns_rdf *domain):">
+ Add a domain to the searchlist of a resolver.
+</t>
+<t hangText=" ldns_pkt * ldns_resolver_search(ldns_resolver *res,
+                                ldns_rdf *domain,
+                                ldns_rr_type *type,
+                                ldns_class *class):">
+ Perform a query. Try all the nameservers in the *res structure. Apply
+ the search list. And default domain. 
+If type is NULL it defaults to 'A',
+If class is NULL it default to 'IN'.
+</t>
+<t hangText="ldns_pkt * ldns_resolver_query(ldns_resolver *res,
+                                 ldns_rdf *dom,
+                                 ldns_type *t,
+                                 ldns_class *cl):">
+Perform a query. Only the default domain is added.
+If type is NULL it defaults to 'A',
+If class is NULL it default to 'IN'.
+</t>
+<t hangText=" ldns_pkt * ldns_resolver_send(ldns_resolver *res,
+                                ldns_rdf *domain,
+                                ldns_type *type,
+                                ldns_class *class):">
+No search list nor default domain is applied. Return a pointer to a ldns_pkt
+structure with the information from the nameserver.
+If type is NULL it defaults to 'A',
+If class is NULL it default to 'IN'.
+</t>
+</list>
+</t>
+<t>
+TODO XX Gazillion  helper functions to set port, src-port, etc. etc.
+</t>
+</section> <!-- "Resolver Structure" -->
+
+<section title="Packet Structure">
+<t>
+A packet structure (ldns_pkt) has five sections:
+<list style="numbers">
+<t>The header section, a ldns_hdr structure.</t>
+<t>The question section, a ldns_rr_list structure.</t>
+<t>The answer section, a ldns_rr_list structure.</t>
+<t>The authority section, a ldns_rr_list structure.</t>
+<t>The additional section, a ldns_rr_list structure.</t>
+</list>
+</t>
+<t>
+<list style="hanging">
+<t hangText="Header Structure (ldns_hdr):">
+ldns_hdr represents the header section of a DNS packet.
+</t>
+<t hangText="Question Section (ldns_rr_list):">
+A list of RRs in the Question section of a DNS packet.
+</t>
+<t hangText="Answer Section (ldns_rr_list):">
+A list of RRs in the Question section of a DNS packet.                     
+</t>                             
+<t hangText="Authority Section (ldns_rr_list):">
+A list of RRs in the Question section of a DNS packet.
+</t> 
+<t hangText="Additional Section (ldns_rr_list):"> 
+A list of RRs in the Question section of a DNS packet.                      
+</t> 
+</list>
+</t>
+
+<t>
+<list style="hanging">
+<t hangText="ldns_pkt * ldns_pkt_new(void):">
+Creates a new empty packet.
+</t>
+<t hangText="ldns_buffer* ldns_pkt_data(ldns_pkt *pkt):">
+Returns the packet data in binary format, suitable for sending to a
+nameserver. [XXX, suitable for sending to a NS?]
+</t>
+<t hangText="ldns_hdr *ldns_header(ldn_pkt *pkt):">
+Returns a ldns_hdr structure representing the header section of
+the packet.
+</t>
+<t hangText="ldns_rr_list *ldns_question(ldns_pkt *pkt):">
+ Returns a pointer to a ldns_rr_list representing the question section
+of the packet.
+</t>
+<t hangText="ldns_rr_list *ldns_answer(ldns_pkt *pkt):">
+ Returns a pointer to a ldns_rr_list representing the answer section of
+the packet.
+     
+</t>
+<t hangText=" ldns_rr_list *ldns_authority(ldns_pkt *pkt):">
+Returns a pointer to a ldns_rr_list representing the authority section
+of the packet.
+    
+</t>
+<t hangText=" ldns_rr_list *ldns_additional(ldns_pkt *pkt):">
+Returns a pointer to a ldns_rr_list of representing the additional
+section of the packet.
+	
+</t>
+<t hangText=" void ldns_pkt_print(ldns_pkt *pkt):">
+Prints the packet data on the standard output in an ASCII format similar
+to that used in DNS zone files. See RFC1035.
+      
+</t>
+<t hangText="ldns_buffer *ldns_pkt_string(ldns_pkt *pkt):">
+Returns a ldns_buffer containing the string representation of the packet.
+ 
+</t>
+<t hangText="ldns_rdf* ldns_pkt_answerfrom(ldns_pkt *pkt):">
+Returns the IP address from which we received this packet. User-created
+packets will return NULL.
+     
+</t>
+<t hangText="uint16_t ldns_pkt_answersize(ldns_pkt *pkt):">
+Returns the size of the packet in bytes as it was received from a
+nameserver. User-created packets will return 0. [XXX
+user-created??]
+	
+</t>
+<t hangText="ldns_status ldns_push(ldns_pkt *pkt, ldns_pkt_section section,
+ldns_rr *rr):">
+Adds *rr to the specified section of the packet. Return LDNS_STATUS_OK
+on success, LDNS_STATUS_ERR otherwise.
+      
+</t>
+<t hangText="ldns_status ldns_unique_push(ldns_pkt *pkt, ldns_pkt_section
+section, ldns_rr *rr):">
+Adds *rr to the specified section of the packet provided that the RR
+does not already exist in the packet. Return LDNS_STATUS_OK
+on success, LDNS_STATUS_ERR otherwise.
+</t>
+<t hangText="ldns_rr *ldns_pop(ldns_pkt, ldns_pkt_section):">
+Removes a RR from the specified section of the packet. Returns NULL if
+no RR's could be popped.
+</t>
+<t hangText="ldns_rr_list *ldns_pkt_rrset(ldns_pkt *pkt,...):">
+Retrieve all RRs in a packet matching certain criteria. XXX function needs
+to be specified better.
+</t>
+<t hangText="void *ldns_pkt_print(FILE *s, ldns_pkt *p):">
+Print packet p to stream s.
+</t>
+
+</list>
+</t>
+</section> <!-- "Packet Structure" -->
+
+<section title="Specific RR Structures">
+<t>
+Some resource records can have special access function no other RR has.
+Those are detailed here. XXX TODO don't exist (yet?).
+</t>
+</section> <!-- "Specific RR Structures" -->
+
+<section title="Exported Defines and Macros">
+<t>
+insert your long list here.
+</t>
+</section> <!-- "Exported defines and macros" -->
+
+<section title="Examples">
+<t>
+A small example, which queries a nameserver on localhost
+to display the MX records for miek.nl.
+</t>
+
+<t>
+<figure>
+<artwork>
+/**
+ * An example ldns program
+ * In semi-C code
+ *
+ * Setup a resolver
+ * Query a nameserver
+ * Print the result
+ */
+
+#include &lt;ldns.h&gt;
+
+int 
+main(void)
+{
+	ldns_resolver *res;
+	ldns_rdf *default_dom;
+	ldns_rdf *nameserver;
+	ldns_rdf *qname;
+	ldns_pkt *pkt;
+
+	/* init */
+	res = ldns_resolver_new();
+	if (!res)
+		return 1;
+	
+	/* create a default domain and add it */
+	default_dom = ldns_rdf_new_frm_str("miek.nl.", LDNS_RDF_TYPE_DNAME);
+	nameserver  = ldns_rdf_new_frm_str("127.0.0.1", LDNS_RDF_TYPE_A);
+
+	if (ldns_resolver_domain(res, default_dom) != LDNS_STATUS_OK)
+		return 1;
+	if (ldns_resolver_nameserver_push(res, nameserver) != LDNS_STATUS_OK)
+		return 1;
+
+	/* setup the question */
+	qname = ldns_rdf_new_frm_str("www", LDNS_RDF_TYPE_DNAME);
+
+	/* fire it off. "miek.nl." will be added */
+	pkt = ldns_resolver_query(res, qname, LDNS_RR_TYPE_MX, NULL);
+
+	/* print the resulting pkt to stdout */
+	ldns_pkt_print(stdout, pkt);
+
+	return 0;
+}
+</artwork>
+</figure>
+</t>
+</section> <!-- title="Short Example" -->
+
+</middle>  
+<back>
+</back>
+</rfc>
diff --git a/contrib/ldns/doc/CodingStyle b/contrib/ldns/doc/CodingStyle
new file mode 100644
index 00000000000000..693fdd31c72dcf
--- /dev/null
+++ b/contrib/ldns/doc/CodingStyle
@@ -0,0 +1,64 @@
+The libdns coding style guide
+
+* Use of tabs (real tabs, 8 positions long)
+* Spaces only after comma's, and in between operators.
+  And after keywords (if, while, for)
+* Underscores to make long names readable
+* prefix (exported) identifiers with 'ldns_'
+* no unneeded parentheses after 'return'
+* always curly brackets in if-statements
+* use defines for (weird) constants, and masks
+* type 'bool', constants 'true'/'false'. Don't compare bools for
+  equality.
+* always use LDNS_MALLOC/FREE etc, or the new/free/deep_free functions
+* buffer can scale, so don't alloc the max size, but the min size
+* make lint (uses splint) is your friend
+
+
+* Return values:
+	- status code (structure to fill is usually passed as a first argument)
+	- new/pointer: return pointer or NULL on error
+	- 'read' functions: ldns_status wire2thing(uint8_t *p, size_t max,
+	                                           size_t pos, *thing);
+	- void functions like ldns_rr_free
+	- bool functions
+
+* Parameter sequence: (dest, [dest_meta, ] src, [src_meta] etc)
+* structure/union field names start with _ when "private"
+* enum for rcode, opcode, types etc,
+	example:
+	enum ldns_rcode {
+		LDNS_RCODE_OK = 0,
+		...      = .,
+		LDNS_RCODE_FIRST = LDNS_RCODE_OK,
+		LDNS_RCODE_LAST = 15,	
+		LDNS_RCODE_COUNT = LDNS_RCODE_LAST + 1
+	}
+* Everything by reference, all data structures an optional _clone() function
+* arrays: ps[] with size_t p_count for the number of elements
+* _size for size in bytes
+* _free and _clone copies perform deep free/copy.
+
+* Standard abbreviations, don't abbreviate other names:
+
+    id          = identity
+    rr          = resource record
+    rrset       = resource record set
+    rdata       = resource data
+    rdf         = resource data field
+    rcode       = result code
+    qr          = query/resource bit
+    aa          = authoritative answer
+    tc          = truncated
+    rd          = recursion disabled
+    cd          = checking disabled
+    ra          = recursion available
+    ad          = authentic data
+    qdcount     = question section count
+    ancount     = answer section count
+    nscount     = authority section count
+    arcount     = additional section count
+
+ldns-<tools>
+* use exit(EXIT_FAILURE)/ exit(EXIT_SUCCESS)
+* 
diff --git a/contrib/ldns/doc/dns-lib-implementations b/contrib/ldns/doc/dns-lib-implementations
new file mode 100644
index 00000000000000..4951ffaaf7875b
--- /dev/null
+++ b/contrib/ldns/doc/dns-lib-implementations
@@ -0,0 +1,56 @@
+http://www.posadis.org/projects/poslib.php
+Poslib DNS library - Default branch
+
+http://www.posadis.org/poslib?DokuWiki=2b00f9da090fb9d4ad3d6e98b9c2f61f
+
+Poslib is the C++ library for applications using the Domain Name System
+that is used by all Posadis tools, including the Posadis DNS server and the
+Zoneedit and Dnsquery tools. It consists of a library for creating client
+applications using DNS, and a server library for DNS servers.
+
+
+FireDNS Library
+http://firestuff.org/projects/firedns
+FireDNS Library
+---------------
+(c) 2002 Ian Gulliver under the GNU Public License, Version 2.
+See GPL for more details.
+
+From libfiredns(3):
+
+libfiredns is a library for handling asynchronous DNS
+requests.  It provides a very simple interface for sending
+requests and parsing responses, as well as low-timeout
+blocking functions.  libfiredns functions have much lower
+timeouts than the stock functions and tend to be faster
+because they send requests to all configured system
+nameservers at the same time.
+
+If you have questions or comments, you can reach me at
+ian@penguinhosting.net.
+
+
+
+skadns
+
+ Skadns is Kind of an Asynchronous DNS client software.
+
+    * Kind of: it's small. Really small. But it just works.
+    * Asynchronous: all DNS operations are non-blocking.
+    * DNS client software: it's a DNS client, what you may know as a "stub resolver". To perform full DNS resolution, you will still need a full resolver like dnscache.
+
+ Similar work
+
+     * ares is an asynchronous DNS resolver library with a nice interface
+     * and more configuration options than skadns (and a very reasonable
+     * size). Use it if you find that skadns lacks configurability (you
+     * shouldn't need more than it provides, but well, you're the user).
+     * Yet it doesn't hide the DNS internals as opaquely as skadns does,
+     * giving you a bunch of fds to select() on instead of just one.
+         * adns works fine, and is small for a GNU project. Impressive. But
+	 * the interface is still too complex and much too generic - the
+	 * usual problems with GNU software.
+
+	 
+ADNS; documentation scares - is it still active
+simular aims - different ways
diff --git a/contrib/ldns/doc/doxyparse.pl b/contrib/ldns/doc/doxyparse.pl
new file mode 100755
index 00000000000000..79da2df022f031
--- /dev/null
+++ b/contrib/ldns/doc/doxyparse.pl
@@ -0,0 +1,342 @@
+#!/usr/bin/env perl
+
+# Doxygen is useful for html documentation, but sucks
+# in making manual pages. Still tool also parses the .h
+# files with the doxygen documentation and creates
+# the man page we want
+#
+# 2 way process
+# 1. All the .h files are processed to create in file in which:
+# filename | API | description | return values
+# are documented
+# 2. Another file is parsed which states which function should
+# be grouped together in which manpage. Symlinks are also created.
+#
+# With this all in place, all documentation should be autogenerated
+# from the doxydoc.
+
+use Getopt::Std;
+
+my $state;
+my $description;
+my $struct_description;
+my $key;
+my $return;
+my $param;
+my $api;
+my $const;
+
+my %description;
+my %api;
+my %return;
+my %options;
+my %manpages;
+my %see_also;
+
+my $BASE="doc/man";
+my $MAN_SECTION = "3";
+my $MAN_HEADER = ".ad l\n.TH ldns $MAN_SECTION \"30 May 2006\"\n";
+my $MAN_MIDDLE = ".SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team\@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+";
+my $MAN_FOOTER = ".SH REMARKS
+This manpage was automatically generated from the ldns source code.
+";
+
+getopts("em:",\%options);
+# if -m manpage file is given process that file
+# parse the file which tells us what manpages go together
+my $functions, $see_also, $shorts;
+my $i = 0;
+my $report_errors = defined $options{'e'};
+my $errors = 0;
+my %unique;
+
+if (defined $options{'m'}) {
+	# process
+	open(MAN, "<$options{'m'}") or die "Cannot open $options{'m'}";
+		# it's line based:
+		# func1, func2, .. | see_also1, see_also2, ...
+		while(<MAN>) {
+			chomp;
+			$i += 1;
+			if (/^#/) { next; }
+			if (/^$/) { next; }
+			my @parts = split /[\t ]*\|[\t ]*/, $_;
+			$functions = shift @parts;
+			@parts = split /[\t ]*-[\t ]*/, join ', ', @parts;
+			$see_also = shift @parts;
+			if (! $see_also) {
+				@parts = split /[\t ]*-[\t ]*/, $_;
+				$functions = shift @parts;
+			}
+			#print "{$functions}\n";
+			#print "{$see_also}\n";
+			my @funcs = split /[\t ]*,[\t ]*/, $functions;
+			my @also = split /[\t ]*,[\t ]*/, $see_also;
+			$manpages{$funcs[0]} = \@funcs;
+			$see_also{$funcs[0]} = \@also;
+			$shorts{$funcs[0]} = join '', @parts;
+			foreach (@funcs) {
+				if ($unique{$_}) {
+					push @{$unique{$_}}, ($i,);
+				} else {
+					$unique{$_} = [$i];
+				}
+			}
+			#print "[", $funcs[0], "]\n";
+		}
+	close(MAN);
+	while (($func, $lines) = each %unique ) {
+		if (scalar @$lines > 1) {
+			print STDERR "$func in function_manpages on lines: "
+			    . join(", ",@$lines) . "\n" if $report_errors;
+			$errors += 1;
+		}
+	}
+} else {
+	print "Need -m file to process the .h files\n";
+	exit 1;
+}
+
+# 0 - somewhere in the file
+# 1 - in a doxygen par
+# 2 - after doxygen, expect function
+
+# create our pwd
+mkdir "doc";
+mkdir "doc/man";
+mkdir "doc/man/man$MAN_SECTION";
+
+$state = 0;
+$i = 0;
+my @lines = <STDIN>;
+my $max = @lines;
+
+while($i < $max) {
+	$typedef = "";
+	if ($lines[$i] =~ /^typedef struct/ and $lines[$i + 1] =~ /^struct/) {
+		# move typedef to below struct
+		$typedef = $lines[$i];
+		$j = $i;
+		while ($lines[$j] !~ /}/) {
+			$lines[$j] = $lines[$j+1];
+			$j++;
+		}
+	$lines[$j] = $lines[$j+1];
+	$lines[$j + 1] = $typedef;
+	}
+
+	$cur_line = $lines[$i];
+	chomp($cur_line);
+	if ($cur_line =~ /^\/\*\*[\t ]*$/) {
+		# /** Seen
+		#print "Comment seen! [$cur_line]\n";
+		$state = 1;
+		undef $description;
+		undef $struct_description;
+		$i++;
+		next;
+	}
+	if ($cur_line =~ /\*\// and $state == 1) {
+		#print "END Comment seen!\n";
+		if ($description =~ /^\\\\file/mg) {
+			# Doxygen text for the file, do not expect
+			# a function coming.
+			#
+			$state = 0;
+		} else {
+			$state = 2;
+		}
+		$i++;
+		next;
+	}
+
+	if ($state == 1) {
+		# inside doxygen 
+		$cur_line =~ s/\\/\\\\/g;
+		$cur_line =~ s/^[ \t]*\* ?//;
+		$description = $description . "\n" . $cur_line;
+		#$description = $description . "\n.br\n" . $cur_line;
+	}
+	if ($state == 2 and $cur_line =~ /const/) {
+		# the const word exists in the function call
+		#$const = "const";
+		#s/[\t ]*const[\t ]*//;
+	} else {
+		#undef $const;
+	}
+	
+	if ($cur_line =~ /^INLINE/) {
+		$cur_line =~ s/^INLINE\s*//;
+		while ($cur_line !~ /{/) {
+			$i++;
+			$cur_line .= " ".$lines[$i];
+			$cur_line =~ s/\n//;
+		}
+		$cur_line =~ s/{/;/;
+	}
+	
+	if ($cur_line =~ /^[^#*\/ ]([\w\*]+)[\t ]+(.*?)[({](.*)\s*/ and $state == 2) {
+		while ($cur_line !~ /\)\s*;/) {
+			$i++;
+			$cur_line .= $lines[$i];
+			chomp($cur_line);
+			$cur_line =~ s/\n/ /g;
+			$cur_line =~ s/\s\s*/ /g;
+		}
+		$cur_line =~ /([\w\* ]+)[\t ]+(.*?)\((.*)\)\s*;/;
+		# this should also end the current comment parsing
+		$return = $1;
+		$key = $2;
+		$api = $3;
+		# sometimes the * is stuck to the function
+		# name instead to the return type
+		if ($key =~ /^\*/) {
+			#print"Name starts with *\n";
+			$key =~ s/^\*//;
+			if (defined($const)) {
+				$return =  $const . " " . $return . '*';
+			} else {
+				$return =  $return . '*';
+			}
+		}
+		$description =~ s/\\param\[in\][ \t]*([\*\w]+)[ \t]+/.br\n\\fB$1\\fR: /g;
+		$description =~ s/\\param\[out\][ \t]*([\*\w]+)[ \t]+/.br\n\\fB$1\\fR: /g;
+		$description =~ s/\\return[ \t]*/.br\nReturns /g;
+
+		# Delete leading spaces to prevent manpages to be ascii format-
+		# ted and enable justification of text.
+		#
+		$description =~ s/^[ \t]*//mg;
+
+		# Prevent hyphening of all caps and underscore words
+		$description =~ s/\b([A-Z_]+)\b/\\%$1/g;
+
+		$description{$key} = $description;
+		$api{$key} = $api;
+		$return{$key} = $return;
+		undef $description;
+		undef $struct_description;
+		$state = 0;
+	} elsif ($state == 2 and (
+			$cur_line =~ /^typedef\sstruct\s(\w+)\s(\w+);/ or
+			$cur_line =~ /^typedef\senum\s(\w+)\s(\w+);/)) {
+		$struct_description .= "\n.br\n" . $cur_line;
+		$key = $2;
+		$struct_description =~ s/\/\*\*\s*(.*?)\s*\*\//\\fB$1:\\fR/g;
+		$description{$key} = $struct_description;
+		$api{$key} = "struct";
+		$return{$key} = $1;
+		undef $description;
+		undef $struct_description;
+		$state = 0;
+	} else {
+		$struct_description .= "\n.br\n" . $cur_line;
+	}
+	$i++;
+}
+
+# create the manpages
+foreach (keys %manpages) {
+	$name = $manpages{$_};
+	$also = $see_also{$_};
+	my $shrt = $shorts{$_};
+
+	$filename = @$name[0];
+	$filename = "$BASE/man$MAN_SECTION/$filename.$MAN_SECTION";
+
+	my $symlink_file = @$name[0] . "." . $MAN_SECTION;
+
+#	print STDOUT $filename,"\n";
+	open (MAN, ">$filename") or die "Can not open $filename";
+
+	print MAN  $MAN_HEADER;
+	print MAN  ".SH NAME\n";
+	print MAN  join ", ", @$name;
+	if ($shrt) {
+		print MAN " \\- $shrt";
+	}
+	print MAN  "\n\n";
+	print MAN  ".SH SYNOPSIS\n";
+
+	print MAN  "#include <stdint.h>\n.br\n";
+	print MAN  "#include <stdbool.h>\n.br\n";
+
+	print MAN  ".PP\n";
+	print MAN  "#include <ldns/ldns.h>\n";
+	print MAN  ".PP\n";
+
+	foreach (@$name) {
+		$b = $return{$_};
+		$b =~ s/\s+$//;
+		if ($api{$_} ne "struct") {
+			print MAN  $b, " ", $_;
+			print MAN  "(", $api{$_},");\n";
+			print MAN  ".PP\n";
+		}
+	}
+
+	print MAN  "\n.SH DESCRIPTION\n";
+	foreach (@$name) {
+		print MAN  ".HP\n";
+		print MAN "\\fI", $_, "\\fR";
+		if ($api{$_} ne "struct") {
+			print MAN "()"; 
+		}
+#		print MAN ".br\n";
+		print MAN  $description{$_};
+		print MAN  "\n.PP\n";
+	}
+
+	print MAN $MAN_MIDDLE;
+
+	if (@$also) {
+		print MAN "\n.SH SEE ALSO\n\\fI";
+		print MAN join "\\fR, \\fI", @$also;
+		print MAN "\\fR.\nAnd ";
+		print MAN "\\fBperldoc Net::DNS\\fR, \\fBRFC1034\\fR,
+\\fBRFC1035\\fR, \\fBRFC4033\\fR, \\fBRFC4034\\fR  and \\fBRFC4035\\fR.\n";
+	} else {
+		print MAN ".SH SEE ALSO
+\\fBperldoc Net::DNS\\fR, \\fBRFC1034\\fR,
+\\fBRFC1035\\fR, \\fBRFC4033\\fR, \\fBRFC4034\\fR and \\fBRFC4035\\fR.\n";
+	}
+	
+	print MAN $MAN_FOOTER;
+
+	# create symlinks
+	chdir("$BASE/man$MAN_SECTION");
+	foreach (@$name) {
+		print STDOUT $_,"\n";
+		my $new_file = $_ . "." . $MAN_SECTION;
+		if ($new_file eq $symlink_file) {
+			next;
+		}
+		#print STDOUT "\t", $new_file, " -> ", $symlink_file, "\n";
+		symlink $symlink_file, $new_file;
+	}
+	chdir("../../.."); # and back, tricky and fragile...
+	close(MAN);
+}
+foreach (keys %api) {
+	next if (/ / || /^$/);
+	if (not $unique{$_}) {
+		print STDERR "no man page for $_\n" if $report_errors;
+		#$errors += 1;
+	}
+}
+
+exit ($report_errors and $errors != 0);
diff --git a/contrib/ldns/doc/function_manpages b/contrib/ldns/doc/function_manpages
new file mode 100644
index 00000000000000..8f53f85b1e8019
--- /dev/null
+++ b/contrib/ldns/doc/function_manpages
@@ -0,0 +1,220 @@
+# first function name will be the real name of the manpage
+# other names are aliases (symlinks)
+# all functions specified on the same line are included in the
+# same manual page. We cannot deal with linebreaks!
+# function named after the pipe `|' are put in the "see also" section
+
+# functions that must be included, separated by commas
+
+### host2wire.h
+# conversion functions
+ldns_rr2wire, ldns_pkt2wire, ldns_rdf2wire | ldns_wire2rr, ldns_wire2pkt, ldns_wire2rdf - conversion functions
+# lower level conversions, some are from host2str.h
+ldns_pkt2buffer_str, ldns_pktheader2buffer_str, ldns_rr2buffer_str, ldns_rr_list2buffer_str, ldns_rdf2buffer_str, ldns_key2buffer_str, ldns_pkt2buffer_wire, ldns_rr2buffer_wire, ldns_rdf2buffer_wire, ldns_rrsig2buffer_wire, ldns_rr_rdata2buffer_wire | ldns_pkt2str, ldns_rr2str, ldns_rdf2str, ldns_rr_list2str, ldns_key2str - lower level conversions
+### /host2wire.h
+
+### host2str.h
+ldns_rr2str, ldns_pkt2str, ldns_rdf2str, ldns_rr_list2str, ldns_key2str | ldns_rr_print, ldns_rdf_print, ldns_pkt_print, ldns_rr_list_print, ldns_resolver_print, ldns_zone_print - functions for conversions to string
+### /host2str.h
+
+### host2str.h
+# and even lower
+ldns_rdf2buffer_str_a, ldns_rdf2buffer_str_aaaa, ldns_rdf2buffer_str_str, ldns_rdf2buffer_str_b64, ldns_rdf2buffer_str_hex, ldns_rdf2buffer_str_type, ldns_rdf2buffer_str_class, ldns_rdf2buffer_str_alg, ldns_rdf2buffer_str_loc, ldns_rdf2buffer_str_unknown, ldns_rdf2buffer_str_nsap, ldns_rdf2buffer_str_wks, ldns_rdf2buffer_str_nsec, ldns_rdf2buffer_str_period, ldns_rdf2buffer_str_tsigtime, ldns_rdf2buffer_str_apl, ldns_rdf2buffer_str_int16_data, ldns_rdf2buffer_str_int16, ldns_rdf2buffer_str_ipseckey - lower level to string conversion functions
+### /host2str.h
+
+### wire2host.h
+# wirefunctions
+ldns_wire2rr, ldns_wire2pkt, ldns_wire2rdf, ldns_wire2dname | ldns_rr2wire, ldns_pkt2wire, ldns_rdf2wire, ldns_dname2wire  -  convert from wire format to host type
+ldns_buffer2pkt_wire - convert buffer/wire format to ldns_pkt
+### /wire2host.h
+
+### dname.h
+ldns_dname_left_chop, ldns_dname_label_count - dname label functions
+ldns_dname2canonical - canonicalize dname
+ldns_dname_cat_clone, ldns_dname_cat - concatenate two dnames
+ldns_dname_new, ldns_dname_new_frm_str, ldns_dname_new_frm_data | ldns_pkt_query_new_frm_str, ldns_rdf_new_frm_str, ldns_rr_new_frm_str -  create a dname
+ldns_dname_is_subdomain, ldns_dname_str_absolute, ldns_dname_label - check properties of dnames
+ldns_dname_compare, ldns_dname_interval | ldns_dname_is_subdomain  - compare two dnames
+### /dname.h
+
+### dane.h
+ldns_dane_create_tlsa_rr, ldns_dane_create_tlsa_owner, ldns_dane_cert2rdf, ldns_dane_select_certificate | ldns_dane_verify, ldns_dane_verify_rr - TLSA RR creation functions
+ldns_dane_verify, ldns_dane_verify_rr | ldns_dane_create_tlsa_owner, ldns_dane_cert2rdf, ldns_dane_select_certificate, ldns_dane_create_tlsa_rr - TLSA RR verification functions
+### /dane.h
+
+### rdata.h
+ldns_rdf, ldns_rdf_type | ldns_rdf_set_size, ldns_rdf_set_type, ldns_rdf_set_data, ldns_rdf_size, ldns_rdf_get_type, ldns_rdf_data, ldns_rdf_compare, ldns_rdf_new, ldns_rdf_clone, ldns_rdf_new_frm_data, ldns_rdf_new_frm_str, ldns_rdf_new_frm_fp, ldns_rdf_free, ldns_rdf_deep_free, ldns_rdf_print, ldns_native2rdf_int8, ldns_native2rdf_int16, ldns_native2rdf_int32, ldns_native2rdf_int16_data, ldns_rdf2native_int8, ldns_rdf2native_int16, ldns_rdf2native_int32, ldns_rdf2native_sockaddr_storage, ldns_rdf2native_time_t, ldns_native2rdf_int8, ldns_native2rdf_int16, ldns_native2rdf_int32, ldns_native2rdf_int16_data, ldns_rdf2native_int8, ldns_rdf2native_int16, ldns_rdf2native_int32, ldns_rdf2native_sockaddr_storage, ldns_rdf2native_time_t, ldns_native2rdf_int8, ldns_native2rdf_int16, ldns_native2rdf_int32, ldns_native2rdf_int16_data, ldns_rdf2native_int8, ldns_rdf2native_int16, ldns_rdf2native_int32, ldns_rdf2native_sockaddr_storage, ldns_rdf2native_time_t - rdata field type
+ldns_rdf_set_size, ldns_rdf_set_type, ldns_rdf_set_data | ldns_rdf - set rdf attributes
+ldns_rdf_size, ldns_rdf_get_type, ldns_rdf_data, ldns_rdf_compare | ldns_rdf - get rdf attributes
+ldns_rdf_new, ldns_rdf_clone, ldns_rdf_new_frm_data, ldns_rdf_new_frm_str, ldns_rdf_new_frm_fp, ldns_rdf_free, ldns_rdf_deep_free, ldns_rdf_print | ldns_rdf - ldns_rdf creation, destruction and printing
+ldns_native2rdf_int8, ldns_native2rdf_int16, ldns_native2rdf_int32, ldns_native2rdf_int16_data, ldns_rdf2native_int8, ldns_rdf2native_int16, ldns_rdf2native_int32, ldns_rdf2native_sockaddr_storage, ldns_rdf2native_time_t | ldns_rdf - rdf numeric conversion functions
+ldns_rdf_address_reverse | ldns_rdf - reverse an address rdf
+ldns_octet | ldns_rdf - removes escaped from the input
+# why is this in rdata.h?
+ldns_str2period - converts a ttl value (like 5d2h) to a long
+### /rdata.h
+
+### higher.h
+ldns_get_rr_list_addr_by_name, ldns_get_rr_list_name_by_addr | ldns_rr_list, ldns_rr - get addresses by name or names by address
+ldns_get_rr_list_hosts_frm_file, ldns_get_rr_list_hosts_frm_fp, ldns_get_rr_list_hosts_frm_fp_l | ldns_rr_list, ldns_rr - parse /etc/hosts file
+ldns_getaddrinfo - mimic libc getaddrinfo
+### /higher.h
+
+#
+### dnssec.h
+#
+# algs
+ldns_verify_rrsig_dsa, ldns_verify_rrsig_rsasha1, ldns_verify_rrsig_rsamd5 | ldns_key, ldns_sign_public, ldns_zone_sign, ldns_verify, ldns_verify_rrsig - verify signature data buffers
+
+# tsig
+ldns_pkt_tsig_verify, ldns_pkt_tsig_sign | ldns_key - tsig signing and verification
+
+# verify
+ldns_verify, ldns_verify_rrsig, ldns_verify_rrsig_keylist, ldns_verify_rrsig_keylist_notime, ldns_verify_notime | ldns_verify_rrsig_evp | ldns_verify_rrsig_dsa, ldns_verify_rrsig_rsasha1, ldns_verify_rrsig_rsamd5, ldns_sign_public, ldns_zone_sign, ldns_key - verify rrsigs
+
+# convert
+ldns_key_buf2dsa, ldns_key_buf2rsa | ldns_key_rr2ds - convert buffer to openssl key
+ldns_key_rr2ds | ldns_key - create DS rr from DNSKEY rr
+ldns_create_nsec | ldns_sign_public - Create a NSEC record
+
+# signing
+ldns_sign_public | ldns_sign_public_dsa, ldns_sign_public_rsamd5, ldns_sign_public_rsasha1, ldns_verify, ldns_verify_rrsig, ldns_key - sign an rrset
+ldns_sign_public_dsa, ldns_sign_public_rsamd5, ldns_sign_public_rsasha1 | ldns_sign_public - sign buffer
+ldns_init_random | ldns_sign_public, ldns_key - seed the random function
+ldns_pkt_verify | ldns_verify, ldns_sign_public, ldns_zone_sign - verify a packet
+ldns_zone_sign, ldns_zone_sign_nsec3 - dnssec sign a zone
+
+# new family of dnssec functions
+ldns_dnssec_zone, ldns_dnssec_name, ldns_dnssec_rrs, ldns_dnssec_rrsets | ldns_dnssec_zone_new, ldns_dnssec_name_new, ldns_dnssec_rrs_new, ldns_dnssec_rrsets_new - data structures
+ldns_dnssec_zone_find_rrset, ldns_dnssec_zone_new, ldns_dnssec_zone_free, ldns_dnssec_zone_add_rr, ldns_dnssec_zone_names_print, ldns_dnssec_zone_print, ldns_dnssec_zone_add_empty_nonterminals | ldns_dnssec_zone - functions for ldns_dnssec_zone
+ldns_dnssec_name_new, ldns_dnssec_name_new_frm_rr, ldns_dnssec_name_free, ldns_dnssec_name_name, ldns_dnssec_name_set_name, ldns_dnssec_name_set_nsec, ldns_dnssec_name_cmp, ldns_dnssec_name_add_rr, ldns_dnssec_name_find_rrset, ldns_dnssec_name_print | ldns_dnssec_zone - functions for ldns_dnssec_name
+ldns_dnssec_rrsets_new, ldns_dnssec_rrsets_free, ldns_dnssec_rrsets_type, ldns_dnssec_rrsets_set_type, ldns_dnssec_rrsets_add_rr, ldns_dnssec_rrsets_print | ldns_dnssec_zone - functions for ldns_dnssec_rrsets
+ldns_dnssec_rrs_new, ldns_dnssec_rrs_free, ldns_dnssec_rrs_add_rr, ldns_dnssec_rrs_print | ldns_dnssec_zone - functions for ldns_dnssec-rrs
+
+# verification
+ldns_dnssec_data_chain, ldns_dnssec_data_chain_struct, ldns_dnssec_trust_tree | ldns_dnssec_data_chain_new, ldns_dnssec_trust_tree_new, ldns_dnssec_verify_denial - data structures for validation chains
+ldns_dnssec_data_chain_new, ldns_dnssec_data_chain_free, ldns_dnssec_data_chain_deep_free, ldns_dnssec_build_data_chain, ldns_dnssec_data_chain_print | ldns_dnssec_data_chain - ldns_chain creation, destruction and printing
+ldns_dnssec_trust_tree_new, ldns_dnssec_trust_tree_free, ldns_dnssec_trust_tree_depth, ldns_dnssec_derive_trust_tree, ldns_dnssec_trust_tree_contains_keys, ldns_dnssec_trust_tree_print, ldns_dnssec_trust_tree_print_sm, ldns_dnssec_trust_tree_add_parent, ldns_dnssec_derive_trust_tree_normal_rrset, ldns_dnssec_derive_trust_tree_dnskey_rrset, ldns_dnssec_derive_trust_tree_ds_rrset, ldns_dnssec_derive_trust_tree_no_sig | ldns_dnssec_data_chain, ldns_dnssec_trust_tree - functions for ldns_dnssec_trust_tree
+ldns_dnssec_verify_denial, ldns_dnssec_verify_denial_nsec3 | ldns_dnssec_trust_tree, ldns_dnssec_data_chain - verify denial of existence
+
+# new signing functions
+ldns_dnssec_zone_sign, ldns_dnssec_zone_sign_nsec3, ldns_dnssec_zone_mark_glue, ldns_dnssec_name_node_next_nonglue, ldns_dnssec_zone_create_nsecs, ldns_dnssec_remove_signatures, ldns_dnssec_zone_create_rrsigs | ldns_dnssec_zone - sign ldns_dnssec_zone
+
+### /dnssec.h
+
+### dnskey.h
+ldns_key_new, ldns_key_new_frm_algorithm, ldns_key_new_frm_fp, ldns_key_new_frm_fp_l, ldns_key_new_frm_fp_rsa, ldns_key_new_frm_fp_rsa_l, ldns_key_new_frm_fp_dsa, ldns_key_new_frm_fp_dsa_l | ldns_key - create a ldns_key
+ldns_key_list_new  - create a ldns_key_list
+# access, write
+ldns_key_set_algorithm, ldns_key_set_rsa_key, ldns_key_set_dsa_key, ldns_key_set_hmac_key, ldns_key_set_origttl, ldns_key_set_inception, ldns_key_set_expiration, ldns_key_set_pubkey_owner, ldns_key_set_keytag, ldns_key_set_flags, ldns_key_list_set_key_count, ldns_key_algo_supported | ldns_key_push_key, ldns_key - set ldns_key attributes
+ldns_key_list_push_key, ldns_key_list_pop_key | ldns_key - manipulate ldns_key_list
+# access, read
+ldns_key_list_key_count, ldns_key_list_key, ldns_key_rsa_key, ldns_key_dsa_key, ldns_key_algorithm, ldns_key_hmac_key, ldns_key_origttl, ldns_key_inception, ldns_key_expiration, ldns_key_keytag, ldns_key_pubkey_owner, ldns_key_flags | ldns_key - read ldns_keys
+# convert
+ldns_key2rr | ldns_key - convert ldns_key to rr
+ldns_key_free, ldns_key_deep_free, ldns_key_list_free | ldns_key - free a ldns_key
+#
+ldns_key_print | ldns_key_new, ldns_key - print a ldns_key
+ldns_calc_keytag, ldns_calc_keytag_raw | ldns_key - calculate ldns keytag
+ldns_key | ldns_key_new, ldns_key_new_frm_algorithm,ldns_key_new_frm_fp,ldns_key_new_frm_fp_l, ldns_key_new_frm_fp_rsa, ldns_key_new_frm_fp_rsa_l, ldns_key_new_frm_fp_dsa, ldns_key_new_frm_fp_dsa_l, ldns_key_list_new, ldns_key_set_algorithm, ldns_key_set_rsa_key, ldns_key_set_dsa_key, ldns_key_set_hmac_key, ldns_key_set_origttl, ldns_key_set_inception, ldns_key_set_expiration, ldns_key_set_pubkey_owner, ldns_key_set_keytag, ldns_key_set_flags, ldns_key_list_set_key_count, ldns_key_list_push_key, ldns_key_list_pop_key, ldns_key_list_key_count, ldns_key_list_key, ldns_key_rsa_key, ldns_key_dsa_key, ldns_key_algorithm, ldns_key_hmac_key, ldns_key_origttl, ldns_key_inception, ldns_key_expiration, ldns_key_keytag, ldns_key_pubkey_owner, ldns_key_flags, ldns_key2rr, ldns_key_free, ldns_key_deep_free, ldns_key_list_free, ldns_key_print - ldns_key data structure
+### /dnskey.h
+
+### MIEK TOT HIER TOT HIER
+
+# error.h
+ldns_get_errorstr_by_id, ldns_status - errors
+
+### net.h
+ldns_send | ldns_pkt, ldns_resolver - send a packet
+ldns_tcp_send_query, ldns_tcp_read_wire, ldns_tcp_connect | ldns_send, ldns_pkt, ldns_resolver - tcp queries
+### /net.h
+
+### buffer.h
+# general
+ldns_buffer, ldns_buffer_new, ldns_buffer_new_frm_data, ldns_buffer_clear, ldns_buffer_printf, ldns_buffer_free, ldns_buffer_copy, ldns_buffer_export, ldns_buffer_export2str, ldns_buffer2str | ldns_buffer_flip, ldns_buffer_rewind, ldns_buffer_position, ldns_buffer_set_position, ldns_buffer_skip, ldns_buffer_limit, ldns_buffer_set_limit, ldns_buffer_capacity, ldns_buffer_set_capacity, ldns_buffer_reserve, ldns_buffer_at, ldns_buffer_begin, ldns_buffer_end, ldns_buffer_current, ldns_buffer_remaining_at, ldns_buffer_remaining, ldns_buffer_available_at, ldns_buffer_available, ldns_buffer_status, ldns_buffer_status_ok, ldns_buffer_write_at, ldns_buffer_write, ldns_buffer_write_string_at, ldns_buffer_write_string, ldns_buffer_write_u8_at, ldns_buffer_write_u8, ldns_buffer_write_u16_at, ldns_buffer_write_u16, ldns_buffer_read_at, ldns_buffer_read, ldns_buffer_read_u8_at, ldns_buffer_read_u8, ldns_buffer_read_u16_at, ldns_buffer_read_u16, ldns_buffer_read_u32_at, ldns_buffer_read_u32, ldns_buffer_write_u32, ldns_buffer_write_u32_at - buffers
+# position
+ldns_buffer_flip, ldns_buffer_rewind, ldns_buffer_position, ldns_buffer_set_position, ldns_buffer_skip | ldns_buffer - buffer positioning
+# values and pointers
+ldns_buffer_limit, ldns_buffer_set_limit, ldns_buffer_capacity, ldns_buffer_set_capacity, ldns_buffer_reserve, ldns_buffer_at, ldns_buffer_begin, ldns_buffer_end, ldns_buffer_current | ldns_buffer - buffer limits and pointers
+# info
+ldns_buffer_remaining_at, ldns_buffer_remaining, ldns_buffer_available_at, ldns_buffer_available, ldns_buffer_status, ldns_buffer_status_ok | ldns_buffer - check buffer status
+# read and write
+ldns_buffer_write_at, ldns_buffer_write, ldns_buffer_write_string_at, ldns_buffer_write_string, ldns_buffer_write_u8_at, ldns_buffer_write_u8, ldns_buffer_write_u16_at, ldns_buffer_write_u16, ldns_buffer_read_at, ldns_buffer_read, ldns_buffer_read_u8_at, ldns_buffer_read_u8, ldns_buffer_read_u16_at, ldns_buffer_read_u16, ldns_buffer_read_u32_at, ldns_buffer_read_u32, ldns_buffer_write_u32, ldns_buffer_write_u32_at | ldns_buffer - reading and writing buffers
+### /buffer.h
+
+# parse.h
+ldns_bget_token, ldns_bgetc, ldns_bskipcs | ldns_buffer - get tokens from buffers
+ldns_fget_token, ldns_fskipcs | ldns_buffer - get tokens from files
+
+# rr.h and other general rr funcs
+ldns_rr, ldns_rr_class, ldns_rr_type, ldns_rr_compress, ldns_rr_list | ldns_rr_new, ldns_rr_new_frm_type, ldns_rr_new_frm_str, ldns_rr_new_frm_fp, ldns_rr_free, ldns_rr_print, ldns_rr_set_owner, ldns_rr_set_ttl, ldns_rr_set_type, ldns_rr_set_rd_count, ldns_rr_set_class, ldns_rr_set_rdf, ldns_rr_push_rdf, ldns_rr_pop_rdf, ldns_rr_rdf, ldns_rr_owner, ldns_rr_rd_count, ldns_rr_ttl, ldns_rr_get_class, ldns_rr_list_rr_count, ldns_rr_list_set_rr_count, ldns_rr_list_new, ldns_rr_list_free, ldns_rr_list_cat, ldns_rr_list_push_rr, ldns_rr_list_pop_rr, ldns_is_rrset, ldns_rr_set_push_rr, ldns_rr_set_pop_rr, ldns_get_rr_class_by_name, ldns_get_rr_type_by_name, ldns_rr_list_clone, ldns_rr_list_sort, ldns_rr_compare, ldns_rr_compare_ds, ldns_rr_uncompressed_size, ldns_rr2canonical, ldns_rr_label_count, ldns_is_rrset, ldns_rr_descriptor, ldns_rr_descript - types representing dns resource records
+ldns_rr_new, ldns_rr_new_frm_type, ldns_rr_new_frm_str, ldns_rr_new_frm_fp, ldns_rr_free, ldns_rr_print | ldns_rr, ldns_rr_list - ldns_rr creation, destruction and printing
+ldns_rr_set_owner, ldns_rr_set_ttl, ldns_rr_set_type, ldns_rr_set_rd_count, ldns_rr_set_class, ldns_rr_set_rdf | ldns_rr, ldns_rr_list - set ldns_rr attributes
+ldns_rr_push_rdf, ldns_rr_pop_rdf | ldns_rr, ldns_rr_list - push and pop rdata fields
+ldns_rr_rdf, ldns_rr_owner, ldns_rr_rd_count, ldns_rr_ttl, ldns_rr_get_class | ldns_rr, ldns_rr_list - access rdata fields on ldns_rr
+ldns_rr_list_rr_count, ldns_rr_list_set_rr_count | ldns_rr, ldns_rr_list - get and set ldns_rr_list length
+ldns_rr_list_new, ldns_rr_list_free | ldns_rr, ldns_rr_list - ldns_rr_list creation and destruction
+ldns_rr_list_cat, ldns_rr_list_push_rr, ldns_rr_list_pop_rr | ldns_rr, ldns_rr_list - ldns_rr_list manipulation
+ldns_is_rrset | ldns_rr, ldns_rr_list - is rr_list a rrset
+ldns_rr_set_push_rr, ldns_rr_set_pop_rr | ldns_rr, ldns_rr_list - push and pop rr on a rrset
+ldns_get_rr_class_by_name, ldns_get_rr_type_by_name | ldns_rr, ldns_rr_list - lookup class or type by name
+ldns_rr_list_clone | ldns_rr, ldns_rr_list - clone a ldns_rr_list
+ldns_rr_list_sort | ldns_rr, ldns_rr_list - sort a ldns_rr_list
+ldns_rr_compare, ldns_rr_compare_ds | ldns_rr, ldns_rr_list - compare a ldns_rr
+ldns_rr_uncompressed_size | ldns_rr, ldns_rr_list - calculates the uncompressed size of an RR
+ldns_rr2canonical | ldns_rr, ldns_rr_list - canonicalize a RR
+ldns_rr_label_count | ldns_rr, ldns_rr_list - return ownername label count
+
+# rr descriptors
+ldns_rr_descriptor, ldns_rr_descript, ldns_rr_descriptor_minimum, ldns_rr_descriptor_maximum, ldns_rr_descriptor_field_type | ldns_rr, ldns_rdf - rdata field descriptors
+
+# packet.h
+ldns_pkt, ldns_pkt_section, ldns_pkt_type | ldns_pkt_new, ldns_pkt_free, ldns_pkt_print, ldns_pkt_query_new, ldns_pkt_query_new_frm_str, ldns_pkt_reply_type, ldns_pkt_id, ldns_pkt_qr, ldns_pkt_aa, ldns_pkt_tc, ldns_pkt_rd, ldns_pkt_cd, ldns_pkt_ra, ldns_pkt_ad, ldns_pkt_get_opcode, ldns_pkt_get_rcode, ldns_pkt_qdcount, ldns_pkt_ancount, ldns_pkt_nscount, ldns_pkt_arcount, ldns_pkt_answerfrom, ldns_pkt_querytime, ldns_pkt_size, ldns_pkt_tsig, ldns_pkt_question, ldns_pkt_answer, ldns_pkt_authority, ldns_pkt_additional, ldns_pkt_get_section_clone, ldns_pkt_rr_list_by_name, ldns_pkt_rr_list_by_type, ldns_pkt_rr_list_by_name_and_type, ldns_pkt_set_flags, ldns_pkt_set_id, ldns_pkt_set_qr, ldns_pkt_set_aa, ldns_pkt_set_tc, ldns_pkt_set_rd, ldns_pkt_set_cd, ldns_pkt_set_ra, ldns_pkt_set_ad, ldns_pkt_set_opcode, ldns_pkt_set_rcode, ldns_pkt_set_qdcount, ldns_pkt_set_ancount, ldns_pkt_set_nscount, ldns_pkt_set_arcount, ldns_pkt_set_answerfrom, ldns_pkt_set_querytime, ldns_pkt_set_size, ldns_pkt_set_section_count, ldns_pkt_set_tsig, ldns_pkt_edns, ldns_pkt_edns_udp_size, ldns_pkt_edns_extended_rcode, ldns_pkt_edns_version, ldns_pkt_edns_z, ldns_pkt_edns_unassigned, ldns_pkt_edns_data, ldns_pkt_set_edns_udp_size, ldns_pkt_set_edns_extended_rcode, ldns_pkt_set_edns_version, ldns_pkt_set_edns_z, ldns_pkt_set_edns_unassigned, ldns_pkt_set_edns_data - request or answer packets types
+
+ldns_pkt_new, ldns_pkt_free, ldns_pkt_print, ldns_pkt_query_new, ldns_pkt_query_new_frm_str, ldns_pkt_reply_type | ldns_pkt - ldns_pkt creation, destruction and printing
+#	gets
+ldns_pkt_id, ldns_pkt_qr, ldns_pkt_aa, ldns_pkt_tc, ldns_pkt_rd, ldns_pkt_cd, ldns_pkt_ra, ldns_pkt_ad, ldns_pkt_get_opcode, ldns_pkt_get_rcode, ldns_pkt_qdcount, ldns_pkt_ancount, ldns_pkt_nscount, ldns_pkt_arcount, ldns_pkt_answerfrom, ldns_pkt_querytime, ldns_pkt_size, ldns_pkt_tsig, ldns_pkt_question, ldns_pkt_answer, ldns_pkt_authority, ldns_pkt_additional, ldns_pkt_get_section_clone, ldns_pkt_rr_list_by_name, ldns_pkt_rr_list_by_type, ldns_pkt_rr_list_by_name_and_type | ldns_pkt - get ldns_pkt attributes
+#	sets
+ldns_pkt_set_flags, ldns_pkt_set_id, ldns_pkt_set_qr, ldns_pkt_set_aa, ldns_pkt_set_tc, ldns_pkt_set_rd, ldns_pkt_set_cd, ldns_pkt_set_ra, ldns_pkt_set_ad, ldns_pkt_set_opcode, ldns_pkt_set_rcode, ldns_pkt_set_qdcount, ldns_pkt_set_ancount, ldns_pkt_set_nscount, ldns_pkt_set_arcount, ldns_pkt_set_answerfrom, ldns_pkt_set_querytime, ldns_pkt_set_size, ldns_pkt_set_section_count, ldns_pkt_set_tsig | ldns_pkt - set ldns_pkt attributes
+#	EDNS0
+ldns_pkt_edns, ldns_pkt_edns_udp_size, ldns_pkt_edns_extended_rcode, ldns_pkt_edns_version, ldns_pkt_edns_z, ldns_pkt_edns_data, ldns_pkt_set_edns_udp_size, ldns_pkt_set_edns_extended_rcode, ldns_pkt_set_edns_version, ldns_pkt_set_edns_z, ldns_pkt_set_edns_data | ldns_pkt - ldns_pkt ends0 related functions
+
+# rr_functions.h
+ldns_rr_ns_nsdname - get dname rdata field from NS RR
+#
+ldns_rr_mx_preference, ldns_rr_mx_exchange - get MX RR rdata fields
+#
+ldns_rr_rrsig_typecovered, ldns_rr_rrsig_set_typecovered, ldns_rr_rrsig_algorithm, ldns_rr_rrsig_set_algorithm, ldns_rr_rrsig_labels, ldns_rr_rrsig_set_labels, ldns_rr_rrsig_origttl, ldns_rr_rrsig_set_origttl, ldns_rr_rrsig_expiration, ldns_rr_rrsig_set_expiration, ldns_rr_rrsig_inception, ldns_rr_rrsig_set_inception, ldns_rr_rrsig_keytag, ldns_rr_rrsig_set_keytag, ldns_rr_rrsig_signame, ldns_rr_rrsig_set_signame, ldns_rr_rrsig_sig, ldns_rr_rrsig_set_sig - get and set RRSIG RR rdata fields
+#
+ldns_rr_dnskey_flags, ldns_rr_dnskey_set_flags, ldns_rr_dnskey_protocol, ldns_rr_dnskey_set_protocol, ldns_rr_dnskey_algorithm, ldns_rr_dnskey_set_algorithm, ldns_rr_dnskey_key, ldns_rr_dnskey_set_key | ldns_rr - get and set DNSKEY RR rdata fields
+
+### zone.h
+ldns_zone, ldns_zone_new, ldns_zone_free, ldns_zone_deep_free, ldns_zone_new_frm_fp, ldns_zone_new_frm_fp_l,  ldns_zone_print, ldns_zone_print_fmt - ldns_zone creation, destruction and printing
+ldns_zone_sort, ldns_zone_glue_rr_list | ldns_zone - sort a zone and get the glue records
+ldns_zone_push_rr, ldns_zone_push_rr_list | ldns_zone - add rr's to a ldns_zone
+ldns_zone_set_rrs, ldns_zone_set_soa | ldns_zone, ldns_zone_rrs, ldns_zone_soa - ldns_zone set content
+ldns_zone_rrs, ldns_zone_soa | ldns_zone ldns_zone_set_rrs - ldns_zone get content
+ldns_zone_rr_count | ldns_zone - get ldns_zone size
+
+### update.h
+ldns_update_pkt_new | ldns_update_pkt_tsig_add, ldns_update_pkt_tsig_add, ldns_update_zocount, ldns_update_prcount, ldns_update_upcount, ldns_update_adcount, ldns_update_set_zocount, ldns_update_set_prcount, ldns_update_set_upcount, ldns_update_set_adcount - create an update packet
+
+ldns_update_pkt_tsig_add | ldns_update_pkt_new - add resolver's tsig credentials to an ldns_pkt
+ldns_update_zocount, ldns_update_prcount, ldns_update_upcount, ldns_update_adcount | ldns_update_pkt_new - return update packet counters
+ldns_update_set_zocount, ldns_update_set_prcount, ldns_update_set_upcount, ldns_update_set_adcount | ldns_update_pkt_new - set the update packet counters
+
+### keys.h
+ldns_algorithm - numbers assigned to algorithms used in dns
+
+
+ldns_axfr_start, ldns_axfr_next, ldns_axfr_abort, ldns_axfr_complete, ldns_axfr_last_pkt - functions for full zone transfer
+
+ldns_b32_ntop_calculate_size, ldns_b32_pton_calculate_size, ldns_b64_ntop_calculate_size, ldns_b64_pton_calculate_size - return size needed for b32 or b64 encoded or decoded data
+
+ldns_duration_type, ldns_duration_create, ldns_duration_create_from_string, ldns_duration_cleanup, ldns_duration_compare, ldns_duration2string, ldns_duration2time - duration type and related functions
+
+ldns_bubblebabble - encode data as BubbleBabble
+
+ldns_version - return library version
+
+
diff --git a/contrib/ldns/doc/ldns_manpages b/contrib/ldns/doc/ldns_manpages
new file mode 100644
index 00000000000000..47a24c8d2bb091
--- /dev/null
+++ b/contrib/ldns/doc/ldns_manpages
@@ -0,0 +1,470 @@
+ldns_rr_new
+ldns_rr_new_frm_type
+ldns_rr_new_frm_str
+ldns_rr_new_frm_fp
+ldns_rr_free
+ldns_rr_print
+ldns_pkt_verify
+ldns_rr_uncompressed_size
+ldns_pkt_set_flags
+ldns_pkt_set_id
+ldns_pkt_set_qr
+ldns_pkt_set_aa
+ldns_pkt_set_tc
+ldns_pkt_set_rd
+ldns_pkt_set_cd
+ldns_pkt_set_ra
+ldns_pkt_set_ad
+ldns_pkt_set_opcode
+ldns_pkt_set_rcode
+ldns_pkt_set_qdcount
+ldns_pkt_set_ancount
+ldns_pkt_set_nscount
+ldns_pkt_set_arcount
+ldns_pkt_set_answerfrom
+ldns_pkt_set_querytime
+ldns_pkt_set_size
+ldns_pkt_set_section_count
+ldns_pkt_set_tsig
+ldns_dname2canonical
+ldns_dnssec_data_chain
+ldns_dnssec_data_chain_struct
+ldns_dnssec_trust_tree
+ldns_rr_list_sort
+ldns_key_list_push_key
+ldns_key_list_pop_key
+ldns_rr_set_push_rr
+ldns_rr_set_pop_rr
+ldns_get_rr_list_hosts_frm_file
+ldns_get_rr_list_hosts_frm_fp
+ldns_get_rr_list_hosts_frm_fp_l
+ldns_send
+ldns_verify
+ldns_verify_rrsig
+ldns_verify_rrsig_keylist
+ldns_verify_rrsig_keylist_notime
+ldns_verify_notime
+ldns_update_pkt_new
+ldns_zone_push_rr
+ldns_zone_push_rr_list
+ldns_key2rr
+ldns_rr_list_cat
+ldns_rr_list_push_rr
+ldns_rr_list_pop_rr
+ldns_zone_rrs
+ldns_zone_soa
+ldns_rr_rdf
+ldns_rr_owner
+ldns_rr_rd_count
+ldns_rr_ttl
+ldns_rr_get_class
+ldns_fget_token
+ldns_fskipcs
+ldns_rdf_address_reverse
+ldns_rr_label_count
+ldns_zone_sort
+ldns_zone_glue_rr_list
+ldns_dnssec_zone_sign
+ldns_dnssec_zone_sign_nsec3
+ldns_dnssec_zone_mark_glue
+ldns_dnssec_name_node_next_nonglue
+ldns_dnssec_zone_create_nsecs
+ldns_dnssec_remove_signatures
+ldns_dnssec_zone_create_rrsigs
+ldns_rr2wire
+ldns_pkt2wire
+ldns_rdf2wire
+ldns_native2rdf_int8
+ldns_native2rdf_int16
+ldns_native2rdf_int32
+ldns_native2rdf_int16_data
+ldns_rdf2native_int8
+ldns_rdf2native_int16
+ldns_rdf2native_int32
+ldns_rdf2native_sockaddr_storage
+ldns_rdf2native_time_t
+ldns_dane_create_tlsa_rr
+ldns_dane_create_tlsa_owner
+ldns_dane_cert2rdf
+ldns_dane_select_certificate
+ldns_dnssec_trust_tree_new
+ldns_dnssec_trust_tree_free
+ldns_dnssec_trust_tree_depth
+ldns_dnssec_derive_trust_tree
+ldns_dnssec_trust_tree_contains_keys
+ldns_dnssec_trust_tree_print
+ldns_dnssec_trust_tree_print_sm
+ldns_dnssec_trust_tree_add_parent
+ldns_dnssec_derive_trust_tree_normal_rrset
+ldns_dnssec_derive_trust_tree_dnskey_rrset
+ldns_dnssec_derive_trust_tree_ds_rrset
+ldns_dnssec_derive_trust_tree_no_sig
+ldns_update_set_zocount
+ldns_update_set_prcount
+ldns_update_set_upcount
+ldns_update_set_adcount
+ldns_rr2str
+ldns_pkt2str
+ldns_rdf2str
+ldns_rr_list2str
+ldns_key2str
+ldns_dname_left_chop
+ldns_dname_label_count
+ldns_dnssec_data_chain_new
+ldns_dnssec_data_chain_free
+ldns_dnssec_data_chain_deep_free
+ldns_dnssec_build_data_chain
+ldns_dnssec_data_chain_print
+ldns_zone_rr_count
+ldns_dname_cat_clone
+ldns_dname_cat
+ldns_rr_set_owner
+ldns_rr_set_ttl
+ldns_rr_set_type
+ldns_rr_set_rd_count
+ldns_rr_set_class
+ldns_rr_set_rdf
+ldns_buffer_write_at
+ldns_buffer_write
+ldns_buffer_write_string_at
+ldns_buffer_write_string
+ldns_buffer_write_u8_at
+ldns_buffer_write_u8
+ldns_buffer_write_u16_at
+ldns_buffer_write_u16
+ldns_buffer_read_at
+ldns_buffer_read
+ldns_buffer_read_u8_at
+ldns_buffer_read_u8
+ldns_buffer_read_u16_at
+ldns_buffer_read_u16
+ldns_buffer_read_u32_at
+ldns_buffer_read_u32
+ldns_buffer_write_u32
+ldns_buffer_write_u32_at
+ldns_b32_ntop_calculate_size
+ldns_b32_pton_calculate_size
+ldns_b64_ntop_calculate_size
+ldns_b64_pton_calculate_size
+ldns_rr_list_rr_count
+ldns_rr_list_set_rr_count
+ldns_get_rr_list_addr_by_name
+ldns_get_rr_list_name_by_addr
+ldns_calc_keytag
+ldns_calc_keytag_raw
+ldns_wire2rr
+ldns_wire2pkt
+ldns_wire2rdf
+ldns_wire2dname
+ldns_pkt
+ldns_pkt_section
+ldns_pkt_type
+ldns_dnssec_name_new
+ldns_dnssec_name_new_frm_rr
+ldns_dnssec_name_free
+ldns_dnssec_name_name
+ldns_dnssec_name_set_name
+ldns_dnssec_name_set_nsec
+ldns_dnssec_name_cmp
+ldns_dnssec_name_add_rr
+ldns_dnssec_name_find_rrset
+ldns_dnssec_name_print
+ldns_get_errorstr_by_id
+ldns_status
+ldns_pkt_id
+ldns_pkt_qr
+ldns_pkt_aa
+ldns_pkt_tc
+ldns_pkt_rd
+ldns_pkt_cd
+ldns_pkt_ra
+ldns_pkt_ad
+ldns_pkt_get_opcode
+ldns_pkt_get_rcode
+ldns_pkt_qdcount
+ldns_pkt_ancount
+ldns_pkt_nscount
+ldns_pkt_arcount
+ldns_pkt_answerfrom
+ldns_pkt_querytime
+ldns_pkt_size
+ldns_pkt_tsig
+ldns_pkt_question
+ldns_pkt_answer
+ldns_pkt_authority
+ldns_pkt_additional
+ldns_pkt_get_section_clone
+ldns_pkt_rr_list_by_name
+ldns_pkt_rr_list_by_type
+ldns_pkt_rr_list_by_name_and_type
+ldns_rdf_new
+ldns_rdf_clone
+ldns_rdf_new_frm_data
+ldns_rdf_new_frm_str
+ldns_rdf_new_frm_fp
+ldns_rdf_free
+ldns_rdf_deep_free
+ldns_rdf_print
+ldns_rr_list_clone
+ldns_rr2canonical
+ldns_octet
+ldns_key_new
+ldns_key_new_frm_algorithm
+ldns_key_new_frm_fp
+ldns_key_new_frm_fp_l
+ldns_key_new_frm_fp_rsa
+ldns_key_new_frm_fp_rsa_l
+ldns_key_new_frm_fp_dsa
+ldns_key_new_frm_fp_dsa_l
+ldns_rr_push_rdf
+ldns_rr_pop_rdf
+ldns_algorithm
+ldns_rr_ns_nsdname
+ldns_key_list_new
+ldns_rr_list_new
+ldns_rr_list_free
+ldns_key_buf2dsa
+ldns_key_buf2rsa
+ldns_rdf
+ldns_rdf_type
+ldns_rr_descriptor
+ldns_rr_descript
+ldns_rr_descriptor_minimum
+ldns_rr_descriptor_maximum
+ldns_rr_descriptor_field_type
+ldns_duration_type
+ldns_duration_create
+ldns_duration_create_from_string
+ldns_duration_cleanup
+ldns_duration_compare
+ldns_duration2string
+ldns_duration2time
+ldns_getaddrinfo
+ldns_is_rrset
+ldns_dname_new
+ldns_dname_new_frm_str
+ldns_dname_new_frm_data
+ldns_pkt_new
+ldns_pkt_free
+ldns_pkt_print
+ldns_pkt_query_new
+ldns_pkt_query_new_frm_str
+ldns_pkt_reply_type
+ldns_key_rr2ds
+ldns_key
+ldns_dnssec_zone_find_rrset
+ldns_dnssec_zone_new
+ldns_dnssec_zone_free
+ldns_dnssec_zone_add_rr
+ldns_dnssec_zone_names_print
+ldns_dnssec_zone_print
+ldns_dnssec_zone_add_empty_nonterminals
+ldns_str2period
+ldns_rr_dnskey_flags
+ldns_rr_dnskey_set_flags
+ldns_rr_dnskey_protocol
+ldns_rr_dnskey_set_protocol
+ldns_rr_dnskey_algorithm
+ldns_rr_dnskey_set_algorithm
+ldns_rr_dnskey_key
+ldns_rr_dnskey_set_key
+ldns_get_rr_class_by_name
+ldns_get_rr_type_by_name
+ldns_dname_is_subdomain
+ldns_dname_str_absolute
+ldns_dname_label
+ldns_pkt2buffer_str
+ldns_pktheader2buffer_str
+ldns_rr2buffer_str
+ldns_rr_list2buffer_str
+ldns_rdf2buffer_str
+ldns_key2buffer_str
+ldns_pkt2buffer_wire
+ldns_rr2buffer_wire
+ldns_rdf2buffer_wire
+ldns_rrsig2buffer_wire
+ldns_rr_rdata2buffer_wire
+ldns_key_set_algorithm
+ldns_key_set_rsa_key
+ldns_key_set_dsa_key
+ldns_key_set_hmac_key
+ldns_key_set_origttl
+ldns_key_set_inception
+ldns_key_set_expiration
+ldns_key_set_pubkey_owner
+ldns_key_set_keytag
+ldns_key_set_flags
+ldns_key_list_set_key_count
+ldns_key_algo_supported
+ldns_sign_public
+ldns_tcp_send_query
+ldns_tcp_read_wire
+ldns_tcp_connect
+ldns_buffer2pkt_wire
+ldns_rr
+ldns_rr_class
+ldns_rr_type
+ldns_rr_compress
+ldns_rr_list
+ldns_pkt_tsig_verify
+ldns_pkt_tsig_sign
+ldns_update_pkt_tsig_add
+ldns_key_list_key_count
+ldns_key_list_key
+ldns_key_rsa_key
+ldns_key_dsa_key
+ldns_key_algorithm
+ldns_key_hmac_key
+ldns_key_origttl
+ldns_key_inception
+ldns_key_expiration
+ldns_key_keytag
+ldns_key_pubkey_owner
+ldns_key_flags
+ldns_dnssec_rrsets_new
+ldns_dnssec_rrsets_free
+ldns_dnssec_rrsets_type
+ldns_dnssec_rrsets_set_type
+ldns_dnssec_rrsets_add_rr
+ldns_dnssec_rrsets_print
+ldns_zone_sign
+ldns_zone_sign_nsec3
+ldns_buffer
+ldns_buffer_new
+ldns_buffer_new_frm_data
+ldns_buffer_clear
+ldns_buffer_printf
+ldns_buffer_free
+ldns_buffer_copy
+ldns_buffer_export
+ldns_buffer_export2str
+ldns_buffer2str
+ldns_rdf2buffer_str_a
+ldns_rdf2buffer_str_aaaa
+ldns_rdf2buffer_str_str
+ldns_rdf2buffer_str_b64
+ldns_rdf2buffer_str_hex
+ldns_rdf2buffer_str_type
+ldns_rdf2buffer_str_class
+ldns_rdf2buffer_str_alg
+ldns_rdf2buffer_str_loc
+ldns_rdf2buffer_str_unknown
+ldns_rdf2buffer_str_nsap
+ldns_rdf2buffer_str_wks
+ldns_rdf2buffer_str_nsec
+ldns_rdf2buffer_str_period
+ldns_rdf2buffer_str_tsigtime
+ldns_rdf2buffer_str_apl
+ldns_rdf2buffer_str_int16_data
+ldns_rdf2buffer_str_int16
+ldns_rdf2buffer_str_ipseckey
+ldns_bubblebabble
+ldns_create_nsec
+ldns_dname_compare
+ldns_dname_interval
+ldns_rr_compare
+ldns_rr_compare_ds
+ldns_buffer_limit
+ldns_buffer_set_limit
+ldns_buffer_capacity
+ldns_buffer_set_capacity
+ldns_buffer_reserve
+ldns_buffer_at
+ldns_buffer_begin
+ldns_buffer_end
+ldns_buffer_current
+ldns_zone_set_rrs
+ldns_zone_set_soa
+ldns_dnssec_rrs_new
+ldns_dnssec_rrs_free
+ldns_dnssec_rrs_add_rr
+ldns_dnssec_rrs_print
+ldns_rr_mx_preference
+ldns_rr_mx_exchange
+ldns_rdf_size
+ldns_rdf_get_type
+ldns_rdf_data
+ldns_rdf_compare
+ldns_verify_rrsig_dsa
+ldns_verify_rrsig_rsasha1
+ldns_verify_rrsig_rsamd5
+ldns_dane_verify
+ldns_dane_verify_rr
+ldns_update_zocount
+ldns_update_prcount
+ldns_update_upcount
+ldns_update_adcount
+ldns_pkt_edns
+ldns_pkt_edns_udp_size
+ldns_pkt_edns_extended_rcode
+ldns_pkt_edns_version
+ldns_pkt_edns_z
+ldns_pkt_edns_data
+ldns_pkt_set_edns_udp_size
+ldns_pkt_set_edns_extended_rcode
+ldns_pkt_set_edns_version
+ldns_pkt_set_edns_z
+ldns_pkt_set_edns_data
+ldns_rr_rrsig_typecovered
+ldns_rr_rrsig_set_typecovered
+ldns_rr_rrsig_algorithm
+ldns_rr_rrsig_set_algorithm
+ldns_rr_rrsig_labels
+ldns_rr_rrsig_set_labels
+ldns_rr_rrsig_origttl
+ldns_rr_rrsig_set_origttl
+ldns_rr_rrsig_expiration
+ldns_rr_rrsig_set_expiration
+ldns_rr_rrsig_inception
+ldns_rr_rrsig_set_inception
+ldns_rr_rrsig_keytag
+ldns_rr_rrsig_set_keytag
+ldns_rr_rrsig_signame
+ldns_rr_rrsig_set_signame
+ldns_rr_rrsig_sig
+ldns_rr_rrsig_set_sig
+ldns_key_free
+ldns_key_deep_free
+ldns_key_list_free
+ldns_dnssec_verify_denial
+ldns_dnssec_verify_denial_nsec3
+ldns_sign_public_dsa
+ldns_sign_public_rsamd5
+ldns_sign_public_rsasha1
+ldns_buffer_flip
+ldns_buffer_rewind
+ldns_buffer_position
+ldns_buffer_set_position
+ldns_buffer_skip
+ldns_init_random
+ldns_zone
+ldns_zone_new
+ldns_zone_free
+ldns_zone_deep_free
+ldns_zone_new_frm_fp
+ldns_zone_new_frm_fp_l
+ldns_zone_print
+ldns_zone_print_fmt
+ldns_version
+ldns_dnssec_zone
+ldns_dnssec_name
+ldns_dnssec_rrs
+ldns_dnssec_rrsets
+ldns_rdf_set_size
+ldns_rdf_set_type
+ldns_rdf_set_data
+ldns_buffer_remaining_at
+ldns_buffer_remaining
+ldns_buffer_available_at
+ldns_buffer_available
+ldns_buffer_status
+ldns_buffer_status_ok
+ldns_bget_token
+ldns_bgetc
+ldns_bskipcs
+ldns_axfr_start
+ldns_axfr_next
+ldns_axfr_abort
+ldns_axfr_complete
+ldns_axfr_last_pkt
+ldns_key_print
diff --git a/contrib/ldns/doc/man/man3/ldns_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_algorithm.3
new file mode 100644
index 00000000000000..28d21ee2c987ec
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_algorithm.3
@@ -0,0 +1,81 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_algorithm \- numbers assigned to algorithms used in dns
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_algorithm\fR
+.br
+Algorithms used in dns
+.br
+enum ldns_enum_algorithm
+.br
+{
+.br
+        LDNS_RSAMD5             = 1,   /* RFC 4034,4035 */
+.br
+        LDNS_DH                 = 2,
+.br
+        LDNS_DSA                = 3,
+.br
+        LDNS_ECC                = 4,
+.br
+        LDNS_RSASHA1            = 5,
+.br
+        LDNS_DSA_NSEC3          = 6,
+.br
+        LDNS_RSASHA1_NSEC3      = 7,
+.br
+        LDNS_RSASHA256          = 8,   /* RFC 5702 */
+.br
+        LDNS_RSASHA512          = 10,  /* RFC 5702 */
+.br
+        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
+.br
+        LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
+.br
+        LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
+.br
+	LDNS_ED25519		= 15,  /* RFC 8080 */
+.br
+	LDNS_ED448		= 16,  /* RFC 8080 */
+.br
+        LDNS_INDIRECT           = 252,
+.br
+        LDNS_PRIVATEDNS         = 253,
+.br
+        LDNS_PRIVATEOID         = 254
+.br
+};
+.br
+typedef enum ldns_enum_algorithm ldns_algorithm;
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_axfr_abort.3 b/contrib/ldns/doc/man/man3/ldns_axfr_abort.3
new file mode 120000
index 00000000000000..e33d2660183088
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_axfr_abort.3
@@ -0,0 +1 @@
+ldns_axfr_start.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_axfr_complete.3 b/contrib/ldns/doc/man/man3/ldns_axfr_complete.3
new file mode 120000
index 00000000000000..e33d2660183088
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_axfr_complete.3
@@ -0,0 +1 @@
+ldns_axfr_start.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_axfr_last_pkt.3 b/contrib/ldns/doc/man/man3/ldns_axfr_last_pkt.3
new file mode 120000
index 00000000000000..e33d2660183088
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_axfr_last_pkt.3
@@ -0,0 +1 @@
+ldns_axfr_start.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_axfr_next.3 b/contrib/ldns/doc/man/man3/ldns_axfr_next.3
new file mode 120000
index 00000000000000..e33d2660183088
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_axfr_next.3
@@ -0,0 +1 @@
+ldns_axfr_start.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_axfr_start.3 b/contrib/ldns/doc/man/man3/ldns_axfr_start.3
new file mode 100644
index 00000000000000..1ad4b2da877245
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_axfr_start.3
@@ -0,0 +1,81 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_axfr_start, ldns_axfr_next, ldns_axfr_abort, ldns_axfr_complete, ldns_axfr_last_pkt \- functions for full zone transfer
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_axfr_start();
+.PP
+ldns_rr* ldns_axfr_next(ldns_resolver *resolver);
+.PP
+void ldns_axfr_abort(ldns_resolver *resolver);
+.PP
+bool ldns_axfr_complete(const ldns_resolver *resolver);
+.PP
+ldns_pkt* ldns_axfr_last_pkt(const ldns_resolver *res);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_axfr_start\fR()
+.PP
+.HP
+\fIldns_axfr_next\fR()
+Get the next stream of RRs in a \%AXFR
+\.br
+\fBresolver\fR: the resolver to use. First ldns_axfr_start() must be
+called
+\.br
+Returns ldns_rr the next \%RR from the \%AXFR stream
+After you get this returned \%RR (not \%NULL: on error), then check if 
+ldns_axfr_complete() is true to see if the zone transfer has completed.
+.PP
+.HP
+\fIldns_axfr_abort\fR()
+Abort a transfer that is in progress
+\.br
+\fBresolver\fR: the resolver that is used
+.PP
+.HP
+\fIldns_axfr_complete\fR()
+Returns true if the axfr transfer has completed (i.e. 2 \%SOA RRs and no errors were encountered
+\.br
+\fBresolver\fR: the resolver that is used
+\.br
+Returns bool true if axfr transfer was completed without error
+.PP
+.HP
+\fIldns_axfr_last_pkt\fR()
+Returns a pointer to the last ldns_pkt that was sent by the server in the \%AXFR transfer
+usable for instance to get the error code on failure
+\.br
+\fBres\fR: the resolver that was used in the axfr transfer
+\.br
+Returns ldns_pkt the last packet sent
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_b32_ntop_calculate_size.3 b/contrib/ldns/doc/man/man3/ldns_b32_ntop_calculate_size.3
new file mode 100644
index 00000000000000..1f838b73f16789
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_b32_ntop_calculate_size.3
@@ -0,0 +1,54 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_b32_ntop_calculate_size, ldns_b32_pton_calculate_size, ldns_b64_ntop_calculate_size, ldns_b64_pton_calculate_size \- return size needed for b32 or b64 encoded or decoded data
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_b32_ntop_calculate_size();
+.PP
+ ldns_b32_pton_calculate_size();
+.PP
+ ldns_b64_ntop_calculate_size();
+.PP
+ ldns_b64_pton_calculate_size();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_b32_ntop_calculate_size\fR()
+.PP
+.HP
+\fIldns_b32_pton_calculate_size\fR()
+.PP
+.HP
+\fIldns_b64_ntop_calculate_size\fR()
+.PP
+.HP
+\fIldns_b64_pton_calculate_size\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_b32_pton_calculate_size.3 b/contrib/ldns/doc/man/man3/ldns_b32_pton_calculate_size.3
new file mode 120000
index 00000000000000..e2256ffd7a2be1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_b32_pton_calculate_size.3
@@ -0,0 +1 @@
+ldns_b32_ntop_calculate_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_b64_ntop_calculate_size.3 b/contrib/ldns/doc/man/man3/ldns_b64_ntop_calculate_size.3
new file mode 120000
index 00000000000000..e2256ffd7a2be1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_b64_ntop_calculate_size.3
@@ -0,0 +1 @@
+ldns_b32_ntop_calculate_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_b64_pton_calculate_size.3 b/contrib/ldns/doc/man/man3/ldns_b64_pton_calculate_size.3
new file mode 120000
index 00000000000000..e2256ffd7a2be1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_b64_pton_calculate_size.3
@@ -0,0 +1 @@
+ldns_b32_ntop_calculate_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_bget_token.3 b/contrib/ldns/doc/man/man3/ldns_bget_token.3
new file mode 100644
index 00000000000000..d8dd1de261d676
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_bget_token.3
@@ -0,0 +1,79 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_bget_token, ldns_bgetc, ldns_bskipcs \- get tokens from buffers
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ssize_t ldns_bget_token(ldns_buffer *b, char *token, const char *delim, size_t limit);
+.PP
+int ldns_bgetc(ldns_buffer *buffer);
+.PP
+void ldns_bskipcs(ldns_buffer *buffer, const char *s);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_bget_token\fR()
+returns a token/char from the buffer b.
+This function deals with ( and ) in the buffer,
+and ignores when it finds them.
+\.br
+\fB*b\fR: the buffer to read from
+\.br
+\fB*token\fR: the token is put here
+\.br
+\fB*delim\fR: chars at which the parsing should stop
+\.br
+\fB*limit\fR: how much to read. If 0 the builtin maximum is used
+\.br
+Returns s 0 on error of \%EOF of b. Otherwise return the length of what is read
+.PP
+.HP
+\fIldns_bgetc\fR()
+returns the next character from a buffer. Advances the position pointer with 1.
+When end of buffer is reached returns \%EOF. This is the buffer's equivalent
+for getc().
+\.br
+\fB*buffer\fR: buffer to read from
+\.br
+Returns \%EOF on failure otherwise return the character
+.PP
+.HP
+\fIldns_bskipcs\fR()
+skips all of the characters in the given string in the buffer, moving
+the position to the first character that is not in *s.
+\.br
+\fB*buffer\fR: buffer to use
+\.br
+\fB*s\fR: characters to skip
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_bgetc.3 b/contrib/ldns/doc/man/man3/ldns_bgetc.3
new file mode 120000
index 00000000000000..2afa435dc574bf
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_bgetc.3
@@ -0,0 +1 @@
+ldns_bget_token.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_bskipcs.3 b/contrib/ldns/doc/man/man3/ldns_bskipcs.3
new file mode 120000
index 00000000000000..2afa435dc574bf
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_bskipcs.3
@@ -0,0 +1 @@
+ldns_bget_token.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_bubblebabble.3 b/contrib/ldns/doc/man/man3/ldns_bubblebabble.3
new file mode 100644
index 00000000000000..1cdac77e8ed18e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_bubblebabble.3
@@ -0,0 +1,39 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_bubblebabble \- encode data as BubbleBabble
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_bubblebabble();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_bubblebabble\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer.3 b/contrib/ldns/doc/man/man3/ldns_buffer.3
new file mode 100644
index 00000000000000..ab5252e0cd0ea5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer.3
@@ -0,0 +1,203 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer, ldns_buffer_new, ldns_buffer_new_frm_data, ldns_buffer_clear, ldns_buffer_printf, ldns_buffer_free, ldns_buffer_copy, ldns_buffer_export, ldns_buffer_export2str, ldns_buffer2str \- buffers
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_buffer* ldns_buffer_new(size_t capacity);
+.PP
+void ldns_buffer_new_frm_data(ldns_buffer *buffer, const void *data, size_t size);
+.PP
+void ldns_buffer_clear(ldns_buffer *buffer);
+.PP
+int ldns_buffer_printf(ldns_buffer *buffer, const char *format, ...);
+.PP
+void ldns_buffer_free(ldns_buffer *buffer);
+.PP
+void ldns_buffer_copy(ldns_buffer* result, const ldns_buffer* from);
+.PP
+void* ldns_buffer_export(ldns_buffer *buffer);
+.PP
+char* ldns_buffer_export2str(ldns_buffer *buffer);
+.PP
+char* ldns_buffer2str(ldns_buffer *buffer);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer\fR
+.br
+implementation of buffers to ease operations
+.br
+
+.br
+ldns_buffers can contain arbitrary information, per octet. You can write
+.br
+to the current end of a buffer, read from the current position, and
+.br
+access any data within it.
+.br
+
+.br
+Example use of buffers is in the source code of \\ref host2str.c
+.br
+struct ldns_struct_buffer
+.br
+{
+.br
+	\fBThe current position used for reading/writing:\fR 
+.br
+	size_t   _position;
+.br
+
+.br
+	\fBThe read/write limit:\fR
+.br
+	size_t   _limit;
+.br
+
+.br
+	\fBThe amount of data the buffer can contain:\fR
+.br
+	size_t   _capacity;
+.br
+
+.br
+	\fBThe data contained in the buffer:\fR
+.br
+	uint8_t *_data;
+.br
+
+.br
+	\fBIf the buffer is fixed it cannot be resized:\fR
+.br
+	unsigned _fixed : 1;
+.br
+
+.br
+	/** The current state of the buffer. If writing to the buffer fails
+.br
+	 * for any reason, this value is changed. This way, you can perform
+.br
+	 * multiple writes in sequence and check for success afterwards. */
+.br
+	ldns_status _status;
+.br
+};
+.br
+typedef struct ldns_struct_buffer ldns_buffer;
+.PP
+.HP
+\fIldns_buffer_new\fR()
+creates a new buffer with the specified capacity.
+
+\.br
+\fBcapacity\fR: the size (in bytes) to allocate for the buffer
+\.br
+Returns the created buffer
+.PP
+.HP
+\fIldns_buffer_new_frm_data\fR()
+creates a buffer with the specified data.  The data \%IS copied
+and \%MEMORY allocations are done.  The buffer is not fixed and can
+be resized using buffer_reserve().
+
+\.br
+\fBbuffer\fR: pointer to the buffer to put the data in
+\.br
+\fBdata\fR: the data to encapsulate in the buffer
+\.br
+\fBsize\fR: the size of the data
+.PP
+.HP
+\fIldns_buffer_clear\fR()
+clears the buffer and make it ready for writing.  The buffer's limit
+is set to the capacity and the position is set to 0.
+\.br
+\fBbuffer\fR: the buffer to clear
+.PP
+.HP
+\fIldns_buffer_printf\fR()
+prints to the buffer, increasing the capacity if required using
+buffer_reserve(). The buffer's position is set to the terminating '\\\\0'
+Returns the number of characters written (not including the
+terminating '\\\\0') or -1 on failure.
+.PP
+.HP
+\fIldns_buffer_free\fR()
+frees the buffer.
+\.br
+\fB*buffer\fR: the buffer to be freed
+\.br
+Returns void
+.PP
+.HP
+\fIldns_buffer_copy\fR()
+Copy contents of the from buffer to the result buffer and then flips 
+the result buffer. Data will be silently truncated if the result buffer is
+too small.
+\.br
+\fB*result\fR: resulting buffer which is copied to.
+\.br
+\fB*from\fR: what to copy to result.
+.PP
+.HP
+\fIldns_buffer_export\fR()
+Makes the buffer fixed and returns a pointer to the data.  The
+caller is responsible for free'ing the result.
+\.br
+\fB*buffer\fR: the buffer to be exported
+\.br
+Returns void
+.PP
+.HP
+\fIldns_buffer_export2str\fR()
+Exports and returns the data in the buffer as a null terminated
+char * string. The returned string must be freed by the caller.
+The buffer must be in write modus and may thus not have been flipped.
+The buffer is fixed after this function returns.
+
+\.br
+\fBbuffer\fR: buffer containing char * data
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.HP
+\fIldns_buffer2str\fR()
+Returns a copy of the data in the buffer as a null terminated
+char * string. The returned string must be freed by the caller.
+The buffer must be in write modus and may thus not have been flipped.
+
+\.br
+\fBbuffer\fR: buffer containing char * data
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer_flip\fR, \fIldns_buffer_rewind\fR, \fIldns_buffer_position\fR, \fIldns_buffer_set_position\fR, \fIldns_buffer_skip\fR, \fIldns_buffer_limit\fR, \fIldns_buffer_set_limit\fR, \fIldns_buffer_capacity\fR, \fIldns_buffer_set_capacity\fR, \fIldns_buffer_reserve\fR, \fIldns_buffer_at\fR, \fIldns_buffer_begin\fR, \fIldns_buffer_end\fR, \fIldns_buffer_current\fR, \fIldns_buffer_remaining_at\fR, \fIldns_buffer_remaining\fR, \fIldns_buffer_available_at\fR, \fIldns_buffer_available\fR, \fIldns_buffer_status\fR, \fIldns_buffer_status_ok\fR, \fIldns_buffer_write_at\fR, \fIldns_buffer_write\fR, \fIldns_buffer_write_string_at\fR, \fIldns_buffer_write_string\fR, \fIldns_buffer_write_u8_at\fR, \fIldns_buffer_write_u8\fR, \fIldns_buffer_write_u16_at\fR, \fIldns_buffer_write_u16\fR, \fIldns_buffer_read_at\fR, \fIldns_buffer_read\fR, \fIldns_buffer_read_u8_at\fR, \fIldns_buffer_read_u8\fR, \fIldns_buffer_read_u16_at\fR, \fIldns_buffer_read_u16\fR, \fIldns_buffer_read_u32_at\fR, \fIldns_buffer_read_u32\fR, \fIldns_buffer_write_u32\fR, \fIldns_buffer_write_u32_at\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer2pkt_wire.3 b/contrib/ldns/doc/man/man3/ldns_buffer2pkt_wire.3
new file mode 100644
index 00000000000000..db547fe0bf5c61
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer2pkt_wire.3
@@ -0,0 +1,49 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer2pkt_wire \- convert buffer/wire format to ldns_pkt
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_buffer2pkt_wire(ldns_pkt **packet, const ldns_buffer *buffer);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer2pkt_wire\fR()
+converts the data in the ldns_buffer (in wire format) to a \%DNS packet.
+This function will initialize and allocate memory space for the packet 
+structure.
+
+\.br
+\fBpacket\fR: pointer to the structure to hold the packet
+\.br
+\fBbuffer\fR: the buffer with the data
+\.br
+Returns \%LDNS_STATUS_OK if everything succeeds, error otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer2str.3 b/contrib/ldns/doc/man/man3/ldns_buffer2str.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer2str.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_at.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_at.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_available.3 b/contrib/ldns/doc/man/man3/ldns_buffer_available.3
new file mode 120000
index 00000000000000..517dd6aa4d2c7b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_available.3
@@ -0,0 +1 @@
+ldns_buffer_remaining_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_available_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_available_at.3
new file mode 120000
index 00000000000000..517dd6aa4d2c7b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_available_at.3
@@ -0,0 +1 @@
+ldns_buffer_remaining_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_begin.3 b/contrib/ldns/doc/man/man3/ldns_buffer_begin.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_begin.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_capacity.3 b/contrib/ldns/doc/man/man3/ldns_buffer_capacity.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_capacity.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_clear.3 b/contrib/ldns/doc/man/man3/ldns_buffer_clear.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_clear.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_copy.3 b/contrib/ldns/doc/man/man3/ldns_buffer_copy.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_copy.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_current.3 b/contrib/ldns/doc/man/man3/ldns_buffer_current.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_current.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_end.3 b/contrib/ldns/doc/man/man3/ldns_buffer_end.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_end.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_export.3 b/contrib/ldns/doc/man/man3/ldns_buffer_export.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_export.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_export2str.3 b/contrib/ldns/doc/man/man3/ldns_buffer_export2str.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_export2str.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_flip.3 b/contrib/ldns/doc/man/man3/ldns_buffer_flip.3
new file mode 100644
index 00000000000000..4c9d3be02bfe84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_flip.3
@@ -0,0 +1,91 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer_flip, ldns_buffer_rewind, ldns_buffer_position, ldns_buffer_set_position, ldns_buffer_skip \- buffer positioning
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_buffer_flip(ldns_buffer *buffer);
+.PP
+void ldns_buffer_rewind(ldns_buffer *buffer);
+.PP
+size_t ldns_buffer_position(const ldns_buffer *buffer);
+.PP
+void ldns_buffer_set_position(ldns_buffer *buffer, size_t mark);
+.PP
+void ldns_buffer_skip(ldns_buffer *buffer, ssize_t count);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer_flip\fR()
+makes the buffer ready for reading the data that has been written to
+the buffer.  The buffer's limit is set to the current position and
+the position is set to 0.
+
+\.br
+\fBbuffer\fR: the buffer to flip
+\.br
+Returns void
+.PP
+.HP
+\fIldns_buffer_rewind\fR()
+make the buffer ready for re-reading the data.  The buffer's
+position is reset to 0.
+\.br
+\fBbuffer\fR: the buffer to rewind
+.PP
+.HP
+\fIldns_buffer_position\fR()
+returns the current position in the buffer (as a number of bytes)
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the current position
+.PP
+.HP
+\fIldns_buffer_set_position\fR()
+sets the buffer's position to \%MARK.  The position must be less than
+or equal to the buffer's limit.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBmark\fR: the mark to use
+.PP
+.HP
+\fIldns_buffer_skip\fR()
+changes the buffer's position by \%COUNT bytes.  The position must not
+be moved behind the buffer's limit or before the beginning of the
+buffer.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBcount\fR: the count to use
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_free.3 b/contrib/ldns/doc/man/man3/ldns_buffer_free.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_free.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_limit.3 b/contrib/ldns/doc/man/man3/ldns_buffer_limit.3
new file mode 100644
index 00000000000000..20567972d79334
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_limit.3
@@ -0,0 +1,140 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer_limit, ldns_buffer_set_limit, ldns_buffer_capacity, ldns_buffer_set_capacity, ldns_buffer_reserve, ldns_buffer_at, ldns_buffer_begin, ldns_buffer_end, ldns_buffer_current \- buffer limits and pointers
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_buffer_limit(const ldns_buffer *buffer);
+.PP
+void ldns_buffer_set_limit(ldns_buffer *buffer, size_t limit);
+.PP
+size_t ldns_buffer_capacity(const ldns_buffer *buffer);
+.PP
+bool ldns_buffer_set_capacity(ldns_buffer *buffer, size_t capacity);
+.PP
+bool ldns_buffer_reserve(ldns_buffer *buffer, size_t amount);
+.PP
+uint8_t * ldns_buffer_at(const ldns_buffer *buffer, size_t at);
+.PP
+uint8_t * ldns_buffer_begin(const ldns_buffer *buffer);
+.PP
+uint8_t * ldns_buffer_end(const ldns_buffer *buffer);
+.PP
+uint8_t * ldns_buffer_current(const ldns_buffer *buffer);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer_limit\fR()
+returns the maximum size of the buffer
+\\param[in] buffer
+\.br
+Returns the size
+.PP
+.HP
+\fIldns_buffer_set_limit\fR()
+changes the buffer's limit.  If the buffer's position is greater
+than the new limit the position is set to the limit.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBlimit\fR: the new limit
+.PP
+.HP
+\fIldns_buffer_capacity\fR()
+returns the number of bytes the buffer can hold.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the number of bytes
+.PP
+.HP
+\fIldns_buffer_set_capacity\fR()
+changes the buffer's capacity.  The data is reallocated so any
+pointers to the data may become invalid.  The buffer's limit is set
+to the buffer's new capacity.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBcapacity\fR: the capacity to use
+\.br
+Returns whether this failed or succeeded
+.PP
+.HP
+\fIldns_buffer_reserve\fR()
+ensures \%BUFFER can contain at least \%AMOUNT more bytes.  The buffer's
+capacity is increased if necessary using buffer_set_capacity().
+
+The buffer's limit is always set to the (possibly increased)
+capacity.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBamount\fR: amount to use
+\.br
+Returns whether this failed or succeeded
+.PP
+.HP
+\fIldns_buffer_at\fR()
+returns a pointer to the data at the indicated position.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: position
+\.br
+Returns the pointer to the data
+.PP
+.HP
+\fIldns_buffer_begin\fR()
+returns a pointer to the beginning of the buffer (the data at
+position 0).
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the pointer
+.PP
+.HP
+\fIldns_buffer_end\fR()
+returns a pointer to the end of the buffer (the data at the buffer's
+limit).
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the pointer
+.PP
+.HP
+\fIldns_buffer_current\fR()
+returns a pointer to the data at the buffer's current position.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the pointer
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_new.3 b/contrib/ldns/doc/man/man3/ldns_buffer_new.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_new.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_new_frm_data.3 b/contrib/ldns/doc/man/man3/ldns_buffer_new_frm_data.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_new_frm_data.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_position.3 b/contrib/ldns/doc/man/man3/ldns_buffer_position.3
new file mode 120000
index 00000000000000..dc3c61fe725367
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_position.3
@@ -0,0 +1 @@
+ldns_buffer_flip.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_printf.3 b/contrib/ldns/doc/man/man3/ldns_buffer_printf.3
new file mode 120000
index 00000000000000..d7cbe03c051e2e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_printf.3
@@ -0,0 +1 @@
+ldns_buffer.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u16.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u16.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u16.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u16_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u16_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u16_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u32.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u32.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u32.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u32_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u32_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u32_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u8.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u8.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u8.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_read_u8_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_read_u8_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_read_u8_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_remaining.3 b/contrib/ldns/doc/man/man3/ldns_buffer_remaining.3
new file mode 120000
index 00000000000000..517dd6aa4d2c7b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_remaining.3
@@ -0,0 +1 @@
+ldns_buffer_remaining_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_remaining_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_remaining_at.3
new file mode 100644
index 00000000000000..6884e845172772
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_remaining_at.3
@@ -0,0 +1,107 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer_remaining_at, ldns_buffer_remaining, ldns_buffer_available_at, ldns_buffer_available, ldns_buffer_status, ldns_buffer_status_ok \- check buffer status
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_buffer_remaining_at(const ldns_buffer *buffer, size_t at);
+.PP
+size_t ldns_buffer_remaining(const ldns_buffer *buffer);
+.PP
+int ldns_buffer_available_at(const ldns_buffer *buffer, size_t at, size_t count);
+.PP
+int ldns_buffer_available(const ldns_buffer *buffer, size_t count);
+.PP
+ldns_status ldns_buffer_status(const ldns_buffer *buffer);
+.PP
+bool ldns_buffer_status_ok(const ldns_buffer *buffer);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer_remaining_at\fR()
+returns the number of bytes remaining between the indicated position and
+the limit.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: indicated position
+\.br
+Returns number of bytes
+.PP
+.HP
+\fIldns_buffer_remaining\fR()
+returns the number of bytes remaining between the buffer's position and
+limit.
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns the number of bytes
+.PP
+.HP
+\fIldns_buffer_available_at\fR()
+checks if the buffer has at least \%COUNT more bytes available.
+Before reading or writing the caller needs to ensure enough space
+is available!
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: indicated position
+\.br
+\fBcount\fR: how much is available
+\.br
+Returns true or false (as int?)
+.PP
+.HP
+\fIldns_buffer_available\fR()
+checks if the buffer has count bytes available at the current position
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBcount\fR: how much is available
+\.br
+Returns true or false (as int?)
+.PP
+.HP
+\fIldns_buffer_status\fR()
+returns the status of the buffer
+\\param[in] buffer
+\.br
+Returns the status
+.PP
+.HP
+\fIldns_buffer_status_ok\fR()
+returns true if the status of the buffer is \%LDNS_STATUS_OK, false otherwise
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns true or false
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_reserve.3 b/contrib/ldns/doc/man/man3/ldns_buffer_reserve.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_reserve.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_rewind.3 b/contrib/ldns/doc/man/man3/ldns_buffer_rewind.3
new file mode 120000
index 00000000000000..dc3c61fe725367
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_rewind.3
@@ -0,0 +1 @@
+ldns_buffer_flip.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_set_capacity.3 b/contrib/ldns/doc/man/man3/ldns_buffer_set_capacity.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_set_capacity.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_set_limit.3 b/contrib/ldns/doc/man/man3/ldns_buffer_set_limit.3
new file mode 120000
index 00000000000000..a621fda08e303a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_set_limit.3
@@ -0,0 +1 @@
+ldns_buffer_limit.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_set_position.3 b/contrib/ldns/doc/man/man3/ldns_buffer_set_position.3
new file mode 120000
index 00000000000000..dc3c61fe725367
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_set_position.3
@@ -0,0 +1 @@
+ldns_buffer_flip.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_skip.3 b/contrib/ldns/doc/man/man3/ldns_buffer_skip.3
new file mode 120000
index 00000000000000..dc3c61fe725367
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_skip.3
@@ -0,0 +1 @@
+ldns_buffer_flip.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_status.3 b/contrib/ldns/doc/man/man3/ldns_buffer_status.3
new file mode 120000
index 00000000000000..517dd6aa4d2c7b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_status.3
@@ -0,0 +1 @@
+ldns_buffer_remaining_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_status_ok.3 b/contrib/ldns/doc/man/man3/ldns_buffer_status_ok.3
new file mode 120000
index 00000000000000..517dd6aa4d2c7b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_status_ok.3
@@ -0,0 +1 @@
+ldns_buffer_remaining_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_at.3
new file mode 100644
index 00000000000000..6fa956e2a71195
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_at.3
@@ -0,0 +1,242 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_buffer_write_at, ldns_buffer_write, ldns_buffer_write_string_at, ldns_buffer_write_string, ldns_buffer_write_u8_at, ldns_buffer_write_u8, ldns_buffer_write_u16_at, ldns_buffer_write_u16, ldns_buffer_read_at, ldns_buffer_read, ldns_buffer_read_u8_at, ldns_buffer_read_u8, ldns_buffer_read_u16_at, ldns_buffer_read_u16, ldns_buffer_read_u32_at, ldns_buffer_read_u32, ldns_buffer_write_u32, ldns_buffer_write_u32_at \- reading and writing buffers
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_buffer_write_at(ldns_buffer *buffer, size_t at, const void *data, size_t count);
+.PP
+void ldns_buffer_write(ldns_buffer *buffer, const void *data, size_t count);
+.PP
+void ldns_buffer_write_string_at(ldns_buffer *buffer, size_t at, const char *str);
+.PP
+void ldns_buffer_write_string(ldns_buffer *buffer, const char *str);
+.PP
+void ldns_buffer_write_u8_at(ldns_buffer *buffer, size_t at, uint8_t data);
+.PP
+void ldns_buffer_write_u8(ldns_buffer *buffer, uint8_t data);
+.PP
+void ldns_buffer_write_u16_at(ldns_buffer *buffer, size_t at, uint16_t data);
+.PP
+void ldns_buffer_write_u16(ldns_buffer *buffer, uint16_t data);
+.PP
+void ldns_buffer_read_at(const ldns_buffer *buffer, size_t at, void *data, size_t count);
+.PP
+void ldns_buffer_read(ldns_buffer *buffer, void *data, size_t count);
+.PP
+uint8_t ldns_buffer_read_u8_at(const ldns_buffer *buffer, size_t at);
+.PP
+uint8_t ldns_buffer_read_u8(ldns_buffer *buffer);
+.PP
+uint16_t ldns_buffer_read_u16_at(ldns_buffer *buffer, size_t at);
+.PP
+uint16_t ldns_buffer_read_u16(ldns_buffer *buffer);
+.PP
+uint32_t ldns_buffer_read_u32_at(ldns_buffer *buffer, size_t at);
+.PP
+uint32_t ldns_buffer_read_u32(ldns_buffer *buffer);
+.PP
+void ldns_buffer_write_u32(ldns_buffer *buffer, uint32_t data);
+.PP
+void ldns_buffer_write_u32_at(ldns_buffer *buffer, size_t at, uint32_t data);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_buffer_write_at\fR()
+writes the given data to the buffer at the specified position
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position (in number of bytes) to write the data at
+\.br
+\fBdata\fR: pointer to the data to write to the buffer
+\.br
+\fBcount\fR: the number of bytes of data to write
+.PP
+.HP
+\fIldns_buffer_write\fR()
+writes count bytes of data to the current position of the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBdata\fR: the data to write
+\.br
+\fBcount\fR: the length of the data to write
+.PP
+.HP
+\fIldns_buffer_write_string_at\fR()
+copies the given (null-delimited) string to the specified position at the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer
+\.br
+\fBstr\fR: the string to write
+.PP
+.HP
+\fIldns_buffer_write_string\fR()
+copies the given (null-delimited) string to the current position at the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBstr\fR: the string to write
+.PP
+.HP
+\fIldns_buffer_write_u8_at\fR()
+writes the given byte of data at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer
+\.br
+\fBdata\fR: the 8 bits to write
+.PP
+.HP
+\fIldns_buffer_write_u8\fR()
+writes the given byte of data at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBdata\fR: the 8 bits to write
+.PP
+.HP
+\fIldns_buffer_write_u16_at\fR()
+writes the given 2 byte integer at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer
+\.br
+\fBdata\fR: the 16 bits to write
+.PP
+.HP
+\fIldns_buffer_write_u16\fR()
+writes the given 2 byte integer at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBdata\fR: the 16 bits to write
+.PP
+.HP
+\fIldns_buffer_read_at\fR()
+copies count bytes of data at the given position to the given data-array
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer to start
+\.br
+\fBdata\fR: buffer to copy to
+\.br
+\fBcount\fR: the length of the data to copy
+.PP
+.HP
+\fIldns_buffer_read\fR()
+copies count bytes of data at the current position to the given data-array
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBdata\fR: buffer to copy to
+\.br
+\fBcount\fR: the length of the data to copy
+.PP
+.HP
+\fIldns_buffer_read_u8_at\fR()
+returns the byte value at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer
+\.br
+Returns 1 byte integer
+.PP
+.HP
+\fIldns_buffer_read_u8\fR()
+returns the byte value at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns 1 byte integer
+.PP
+.HP
+\fIldns_buffer_read_u16_at\fR()
+returns the 2-byte integer value at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: position in the buffer
+\.br
+Returns 2 byte integer
+.PP
+.HP
+\fIldns_buffer_read_u16\fR()
+returns the 2-byte integer value at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns 2 byte integer
+.PP
+.HP
+\fIldns_buffer_read_u32_at\fR()
+returns the 4-byte integer value at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: position in the buffer
+\.br
+Returns 4 byte integer
+.PP
+.HP
+\fIldns_buffer_read_u32\fR()
+returns the 4-byte integer value at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+Returns 4 byte integer
+.PP
+.HP
+\fIldns_buffer_write_u32\fR()
+writes the given 4 byte integer at the current position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBdata\fR: the 32 bits to write
+.PP
+.HP
+\fIldns_buffer_write_u32_at\fR()
+writes the given 4 byte integer at the given position in the buffer
+\.br
+\fBbuffer\fR: the buffer
+\.br
+\fBat\fR: the position in the buffer
+\.br
+\fBdata\fR: the 32 bits to write
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_string.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_string.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_string.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_string_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_string_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_string_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u16.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u16.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u16.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u16_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u16_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u16_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u32.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u32.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u32.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u32_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u32_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u32_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u8.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u8.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u8.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_buffer_write_u8_at.3 b/contrib/ldns/doc/man/man3/ldns_buffer_write_u8_at.3
new file mode 120000
index 00000000000000..f693726e59c583
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_buffer_write_u8_at.3
@@ -0,0 +1 @@
+ldns_buffer_write_at.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_calc_keytag.3 b/contrib/ldns/doc/man/man3/ldns_calc_keytag.3
new file mode 100644
index 00000000000000..72528d7e8d2009
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_calc_keytag.3
@@ -0,0 +1,59 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_calc_keytag, ldns_calc_keytag_raw \- calculate ldns keytag
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+uint16_t ldns_calc_keytag(const ldns_rr *key);
+.PP
+uint16_t ldns_calc_keytag_raw(const uint8_t* key, size_t keysize);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_calc_keytag\fR()
+calculates a keytag of a key for use in \%DNSSEC.
+
+\.br
+\fBkey\fR: the key as an \%RR to use for the calc.
+\.br
+Returns the keytag
+.PP
+.HP
+\fIldns_calc_keytag_raw\fR()
+Calculates keytag of \%DNSSEC key, operates on wireformat rdata.
+\.br
+\fBkey\fR: the key as uncompressed wireformat rdata.
+\.br
+\fBkeysize\fR: length of key data.
+\.br
+Returns the keytag
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_calc_keytag_raw.3 b/contrib/ldns/doc/man/man3/ldns_calc_keytag_raw.3
new file mode 120000
index 00000000000000..0b90349cbebb9b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_calc_keytag_raw.3
@@ -0,0 +1 @@
+ldns_calc_keytag.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_create_nsec.3 b/contrib/ldns/doc/man/man3/ldns_create_nsec.3
new file mode 100644
index 00000000000000..b1f3ca308c158b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_create_nsec.3
@@ -0,0 +1,50 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_create_nsec \- Create a NSEC record
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr * ldns_create_nsec(ldns_rdf *cur_owner, ldns_rdf *next_owner, ldns_rr_list *rrs);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_create_nsec\fR()
+Create a \%NSEC record
+\.br
+\fBcur_owner\fR: the current owner which should be taken as the starting point
+\.br
+\fBnext_owner\fR: the rrlist which the nsec rr should point to 
+\.br
+\fBrrs\fR: all rrs from the zone, to find all \%RR types of cur_owner in
+\.br
+Returns a ldns_rr with the nsec record in it
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_sign_public\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_cert2rdf.3 b/contrib/ldns/doc/man/man3/ldns_dane_cert2rdf.3
new file mode 120000
index 00000000000000..8adf1e7ffd89be
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_cert2rdf.3
@@ -0,0 +1 @@
+ldns_dane_create_tlsa_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_owner.3 b/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_owner.3
new file mode 120000
index 00000000000000..8adf1e7ffd89be
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_owner.3
@@ -0,0 +1 @@
+ldns_dane_create_tlsa_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_rr.3 b/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_rr.3
new file mode 100644
index 00000000000000..254c04bbdfe87d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_create_tlsa_rr.3
@@ -0,0 +1,133 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dane_create_tlsa_rr, ldns_dane_create_tlsa_owner, ldns_dane_cert2rdf, ldns_dane_select_certificate \- TLSA RR creation functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_dane_create_tlsa_rr(ldns_rr** tlsa, ldns_tlsa_certificate_usage certificate_usage, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type, X509* cert);
+.PP
+ldns_status ldns_dane_create_tlsa_owner(ldns_rdf** tlsa_owner, const ldns_rdf* name, uint16_t port, ldns_dane_transport transport);
+.PP
+ldns_status ldns_dane_cert2rdf(ldns_rdf** rdf, X509* cert, ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type);
+.PP
+ldns_status ldns_dane_select_certificate(X509** selected_cert, X509* cert, STACK_OF(X509)* extra_certs, X509_STORE* pkix_validation_store, ldns_tlsa_certificate_usage cert_usage, int index);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dane_create_tlsa_rr\fR()
+Creates a \%TLSA resource record from the certificate.
+No \%PKIX validation is performed! The given certificate is used as data
+regardless the value of certificate_usage.
+
+\.br
+\fBtlsa\fR: The created \%TLSA resource record.
+\.br
+\fBcertificate_usage\fR: The value for the Certificate Usage field
+\.br
+\fBselector\fR: The value for the Selector field
+\.br
+\fBmatching_type\fR: The value for the Matching Type field
+\.br
+\fBcert\fR: The certificate which data will be represented
+
+\.br
+Returns \%LDNS_STATUS_OK on success or an error code otherwise.
+.PP
+.HP
+\fIldns_dane_create_tlsa_owner\fR()
+Creates a dname consisting of the given name, prefixed by the service port
+and type of transport: \%_<\%EM>port</\%EM>.\%_<\%EM>transport</\%EM>.<\%EM>name</\%EM>.
+
+\.br
+\fBtlsa_owner\fR: The created dname.
+\.br
+\fBname\fR: The dname that should be prefixed.
+\.br
+\fBport\fR: The service port number for which the name should be created.
+\.br
+\fBtransport\fR: The transport for which the name should be created.
+\.br
+Returns \%LDNS_STATUS_OK on success or an error code otherwise.
+.PP
+.HP
+\fIldns_dane_cert2rdf\fR()
+Creates a \%LDNS_RDF_TYPE_HEX type rdf based on the binary data chosen by
+the selector and encoded using matching_type.
+
+\.br
+\fBrdf\fR: The created created rdf of type \%LDNS_RDF_TYPE_HEX.
+\.br
+\fBcert\fR: The certificate from which the data is selected
+\.br
+\fBselector\fR: The full certificate or the public key
+\.br
+\fBmatching_type\fR: The full data or the SHA256 or SHA512 hash
+of the selected data
+\.br
+Returns \%LDNS_STATUS_OK on success or an error code otherwise.
+.PP
+.HP
+\fIldns_dane_select_certificate\fR()
+Selects the certificate from cert, extra_certs or the pkix_validation_store
+based on the value of cert_usage and index.
+
+\.br
+\fBselected_cert\fR: The selected cert.
+\.br
+\fBcert\fR: The certificate to validate (or not)
+\.br
+\fBextra_certs\fR: Intermediate certificates that might be necessary
+during validation. May be \%NULL, except when the certificate 
+usage is "Trust Anchor Assertion" because the trust anchor has
+to be provided.(otherwise choose a "Domain issued certificate!"
+\.br
+\fBpkix_validation_store\fR: Used when the certificate usage is 
+"\%CA constraint" or "Service Certificate Constraint" to 
+validate the certificate and, in case of "\%CA constraint",
+select the \%CA.
+When pkix_validation_store is \%NULL, validation is explicitly
+turned off and the behaviour is then the same as for "Trust
+anchor assertion" and "Domain issued certificate" respectively.
+\.br
+\fBcert_usage\fR: Which certificate to use and how to validate.
+\.br
+\fBindex\fR: Used to select the trust anchor when certificate usage
+is "Trust Anchor Assertion". 0 is the last certificate in the
+validation chain. 1 the one but last, etc. When index is -1,
+the last certificate is used that \%MUST be self-signed.
+This can help to make sure that the intended (self signed)
+trust anchor is actually present in extra_certs (which is a
+\%DANE requirement).
+
+\.br
+Returns \%LDNS_STATUS_OK on success or an error code otherwise.
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dane_verify\fR, \fIldns_dane_verify_rr\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_select_certificate.3 b/contrib/ldns/doc/man/man3/ldns_dane_select_certificate.3
new file mode 120000
index 00000000000000..8adf1e7ffd89be
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_select_certificate.3
@@ -0,0 +1 @@
+ldns_dane_create_tlsa_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_verify.3 b/contrib/ldns/doc/man/man3/ldns_dane_verify.3
new file mode 100644
index 00000000000000..6a95ca6f23b2cc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_verify.3
@@ -0,0 +1,124 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dane_verify, ldns_dane_verify_rr \- TLSA RR verification functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_dane_verify(const ldns_rr_list* tlsas, X509* cert, STACK_OF(X509)* extra_certs, X509_STORE* pkix_validation_store);
+.PP
+ldns_status ldns_dane_verify_rr(const ldns_rr* tlsa_rr, X509* cert, STACK_OF(X509)* extra_certs, X509_STORE* pkix_validation_store);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dane_verify\fR()
+\%BEWARE!  We strongly recommend to use OpenSSL 1.1.0 dane verification
+functions instead of the ones provided by ldns.  When OpenSSL 1.1.0 was
+available ldns will use the OpenSSL 1.1.0 dane verification functions
+under the hood.  When ldns was linked with OpenSSL < 1.1.0, this function
+will not be able to verify \%TLSA records with \%DANE-\%TA usage types.
+
+\%BEWARE! The ldns dane verification functions do *not* do server name
+checks.  The user has to perform additional server name checks themselves!
+
+Verify if any of the given \%TLSA resource records matches the given
+certificate.
+
+\.br
+\fBtlsas\fR: The resource records that specify what and how to
+match the certificate. One must match for this function
+to succeed. With tlsas == \%NULL or the number of \%TLSA records
+in tlsas == 0, regular \%PKIX validation is performed.
+\.br
+\fBcert\fR: The certificate to match (and validate)
+\.br
+\fBextra_certs\fR: Intermediate certificates that might be necessary
+creating the validation chain.
+\.br
+\fBpkix_validation_store\fR: Used when the certificate usage is 
+"\%CA constraint" or "Service Certificate Constraint" to 
+validate the certificate.
+
+\.br
+Returns \%LDNS_STATUS_OK on success,
+LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA when at least one
+of the \%TLSA's had usage type \%DANE-\%TA and none of the \%TLSA's matched
+or \%PKIX validated,
+\%LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE when one of the \%TLSA's
+matched but the \%PKIX validation failed,
+\%LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH when none of the \%TLSA's matched,
+or other ldns_status errors.
+.PP
+.HP
+\fIldns_dane_verify_rr\fR()
+\%BEWARE!  We strongly recommend to use OpenSSL 1.1.0 dane verification
+functions instead of the ones provided by ldns.  When OpenSSL 1.1.0 was
+available ldns will use the OpenSSL 1.1.0 dane verification functions
+under the hood.  When ldns was linked with OpenSSL < 1.1.0, this function
+will not be able to verify \%TLSA records with \%DANE-\%TA usage types.
+
+\%BEWARE! The ldns dane verification functions do *not* do server name
+checks.  The user has to perform additional server name checks themselves!
+
+Verify if the given \%TLSA resource record matches the given certificate.
+Reporting on a \%TLSA rr mismatch (\%LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH)
+is preferred over \%PKIX failure  (\%LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE).
+So when \%PKIX validation is required by the \%TLSA Certificate usage,
+but the \%TLSA data does not match, \%LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH
+is returned whether the \%PKIX validated or not.
+
+When ldns is linked with OpenSSL < 1.1.0 and this function is available,
+then the \%DANE-\%TA usage type will not be verified, and on a tlsa_rr with
+this usage type,
+LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA will be returned.
+
+\.br
+\fBtlsa_rr\fR: The resource record that specifies what and how to
+match the certificate. With tlsa_rr == \%NULL, regular \%PKIX
+validation is performed.
+\.br
+\fBcert\fR: The certificate to match (and validate)
+\.br
+\fBextra_certs\fR: Intermediate certificates that might be necessary
+creating the validation chain.
+\.br
+\fBpkix_validation_store\fR: Used when the certificate usage is 
+"\%CA constraint" or "Service Certificate Constraint" to 
+validate the certificate.
+
+\.br
+Returns \%LDNS_STATUS_OK on success,
+LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA when the
+provided \%TLSA had the \%DANE-\%TA usage type,
+\%LDNS_STATUS_DANE_TLSA_DID_NOT_MATCH on \%TLSA data mismatch,
+\%LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE when \%TLSA matched,
+but the \%PKIX validation failed, or other ldns_status errors.
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dane_create_tlsa_owner\fR, \fIldns_dane_cert2rdf\fR, \fIldns_dane_select_certificate\fR, \fIldns_dane_create_tlsa_rr\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dane_verify_rr.3 b/contrib/ldns/doc/man/man3/ldns_dane_verify_rr.3
new file mode 120000
index 00000000000000..9566a7fd8f9a72
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dane_verify_rr.3
@@ -0,0 +1 @@
+ldns_dane_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname2canonical.3 b/contrib/ldns/doc/man/man3/ldns_dname2canonical.3
new file mode 100644
index 00000000000000..bb597c6edd2222
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname2canonical.3
@@ -0,0 +1,44 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname2canonical \- canonicalize dname
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_dname2canonical(const ldns_rdf *rdf);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname2canonical\fR()
+Put a dname into canonical fmt - ie. lowercase it
+\.br
+\fBrdf\fR: the dname to lowercase
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_cat.3 b/contrib/ldns/doc/man/man3/ldns_dname_cat.3
new file mode 120000
index 00000000000000..3c694d5e36220d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_cat.3
@@ -0,0 +1 @@
+ldns_dname_cat_clone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_cat_clone.3 b/contrib/ldns/doc/man/man3/ldns_dname_cat_clone.3
new file mode 100644
index 00000000000000..0855625e421f3d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_cat_clone.3
@@ -0,0 +1,58 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname_cat_clone, ldns_dname_cat \- concatenate two dnames
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_dname_cat_clone(const ldns_rdf *rd1, const ldns_rdf *rd2);
+.PP
+ldns_status ldns_dname_cat(ldns_rdf *rd1, const ldns_rdf *rd2);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname_cat_clone\fR()
+concatenates two dnames together
+\.br
+\fBrd1\fR: the leftside
+\.br
+\fBrd2\fR: the rightside
+\.br
+Returns a new rdf with leftside/rightside
+.PP
+.HP
+\fIldns_dname_cat\fR()
+concatenates rd2 after rd1 (rd2 is copied, rd1 is modified)
+\.br
+\fBrd1\fR: the leftside
+\.br
+\fBrd2\fR: the rightside
+\.br
+Returns \%LDNS_STATUS_OK on success
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_compare.3 b/contrib/ldns/doc/man/man3/ldns_dname_compare.3
new file mode 100644
index 00000000000000..a8a802ca429a16
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_compare.3
@@ -0,0 +1,63 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname_compare, ldns_dname_interval \- compare two dnames
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+int ldns_dname_compare(const ldns_rdf *dname1, const ldns_rdf *dname2);
+.PP
+int ldns_dname_interval(const ldns_rdf *prev, const ldns_rdf *middle, const ldns_rdf *next);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname_compare\fR()
+Compares the two dname rdf's according to the algorithm for ordering
+in RFC4034 Section 6.
+\.br
+\fBdname1\fR: First dname rdf to compare
+\.br
+\fBdname2\fR: Second dname rdf to compare
+\.br
+Returns -1 if dname1 comes before dname2, 1 if dname1 comes after dname2, and 0 if they are equal.
+.PP
+.HP
+\fIldns_dname_interval\fR()
+check if middle lays in the interval defined by prev and next
+prev <= middle < next. This is useful for nsec checking
+\.br
+\fBprev\fR: the previous dname
+\.br
+\fBmiddle\fR: the dname to check
+\.br
+\fBnext\fR: the next dname
+return 0 on error or unknown, -1 when middle is in the interval, +1 when not
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dname_is_subdomain\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_interval.3 b/contrib/ldns/doc/man/man3/ldns_dname_interval.3
new file mode 120000
index 00000000000000..50c24cee8ebaad
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_interval.3
@@ -0,0 +1 @@
+ldns_dname_compare.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_is_subdomain.3 b/contrib/ldns/doc/man/man3/ldns_dname_is_subdomain.3
new file mode 100644
index 00000000000000..fac7c0a885c23a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_is_subdomain.3
@@ -0,0 +1,72 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname_is_subdomain, ldns_dname_str_absolute, ldns_dname_label \- check properties of dnames
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent);
+.PP
+bool ldns_dname_str_absolute(const char *dname_str);
+.PP
+ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname_is_subdomain\fR()
+test whether the name sub falls under parent (i.e. is a subdomain
+of parent). This function will return false if the given dnames are
+equal.
+\.br
+\fBsub\fR: the name to test
+\.br
+\fBparent\fR: the parent's name
+\.br
+Returns true if sub falls under parent, otherwise false
+.PP
+.HP
+\fIldns_dname_str_absolute\fR()
+Checks whether the given dname string is absolute (i.e. ends with a '.')
+\.br
+\fB*dname_str\fR: a string representing the dname
+\.br
+Returns true or false
+.PP
+.HP
+\fIldns_dname_label\fR()
+look inside the rdf and if it is an \%LDNS_RDF_TYPE_DNAME
+try and retrieve a specific label. The labels are numbered
+starting from 0 (left most).
+\.br
+\fBrdf\fR: the rdf to look in
+\.br
+\fBlabelpos\fR: return the label with this number
+\.br
+Returns a ldns_rdf* with the label as name or \%NULL on error
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_label.3 b/contrib/ldns/doc/man/man3/ldns_dname_label.3
new file mode 120000
index 00000000000000..414fbfebf6de48
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_label.3
@@ -0,0 +1 @@
+ldns_dname_is_subdomain.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_label_count.3 b/contrib/ldns/doc/man/man3/ldns_dname_label_count.3
new file mode 120000
index 00000000000000..5ac4eb7088e0f3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_label_count.3
@@ -0,0 +1 @@
+ldns_dname_left_chop.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_left_chop.3 b/contrib/ldns/doc/man/man3/ldns_dname_left_chop.3
new file mode 100644
index 00000000000000..94b61679606432
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_left_chop.3
@@ -0,0 +1,56 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname_left_chop, ldns_dname_label_count \- dname label functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_dname_left_chop(const ldns_rdf *d);
+.PP
+uint8_t ldns_dname_label_count(const ldns_rdf *r);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname_left_chop\fR()
+chop one label off the left side of a dname. so
+wwww.nlnetlabs.nl, becomes nlnetlabs.nl
+This new name is a clone and must be freed with ldns_deep_free()
+\.br
+\fBd\fR: the dname to chop
+\.br
+Returns the remaining dname
+.PP
+.HP
+\fIldns_dname_label_count\fR()
+count the number of labels inside a \%LDNS_RDF_DNAME type rdf.
+\.br
+\fB*r\fR: the rdf
+\.br
+Returns the number of labels
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_new.3 b/contrib/ldns/doc/man/man3/ldns_dname_new.3
new file mode 100644
index 00000000000000..db2e9d7617dc54
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_new.3
@@ -0,0 +1,73 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dname_new, ldns_dname_new_frm_str, ldns_dname_new_frm_data \- create a dname
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_dname_new(uint16_t s, void *data);
+.PP
+ldns_rdf* ldns_dname_new_frm_str(const char *str);
+.PP
+ldns_rdf* ldns_dname_new_frm_data(uint16_t size, const void *data);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dname_new\fR()
+Create a new dname rdf from a string. The data pointer
+is stored in the rdf, not a copy of the data
+\.br
+\fBs\fR: the size of the new dname
+\.br
+\fB*data\fR: pointer to the actual data
+
+\.br
+Returns ldns_rdf*
+.PP
+.HP
+\fIldns_dname_new_frm_str\fR()
+creates a new dname rdf from a string.
+\.br
+\fBstr\fR: string to use
+\.br
+Returns ldns_rdf* or \%NULL in case of an error
+.PP
+.HP
+\fIldns_dname_new_frm_data\fR()
+Create a new dname rdf from data (the data is copied)
+\.br
+\fBsize\fR: the size of the data
+\.br
+\fB*data\fR: pointer to the actual data
+
+\.br
+Returns ldns_rdf*
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt_query_new_frm_str\fR, \fIldns_rdf_new_frm_str\fR, \fIldns_rr_new_frm_str\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_new_frm_data.3 b/contrib/ldns/doc/man/man3/ldns_dname_new_frm_data.3
new file mode 120000
index 00000000000000..c5419061c714c3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_new_frm_data.3
@@ -0,0 +1 @@
+ldns_dname_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_new_frm_str.3 b/contrib/ldns/doc/man/man3/ldns_dname_new_frm_str.3
new file mode 120000
index 00000000000000..c5419061c714c3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_new_frm_str.3
@@ -0,0 +1 @@
+ldns_dname_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dname_str_absolute.3 b/contrib/ldns/doc/man/man3/ldns_dname_str_absolute.3
new file mode 120000
index 00000000000000..414fbfebf6de48
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dname_str_absolute.3
@@ -0,0 +1 @@
+ldns_dname_is_subdomain.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_build_data_chain.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_build_data_chain.3
new file mode 120000
index 00000000000000..3dabaa85e9e915
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_build_data_chain.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain.3
new file mode 100644
index 00000000000000..14a2edb9f42b02
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain.3
@@ -0,0 +1,157 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_data_chain, ldns_dnssec_data_chain_struct, ldns_dnssec_trust_tree \- data structures for validation chains
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_dnssec_data_chain_struct();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_data_chain\fR
+.br
+Chain structure that contains all DNSSEC data needed to
+.br
+verify an rrset
+.br
+struct ldns_dnssec_data_chain_struct
+.br
+{
+.br
+	ldns_rr_list *rrset;
+.br
+	ldns_rr_list *signatures;
+.br
+	ldns_rr_type parent_type;
+.br
+	ldns_dnssec_data_chain *parent;
+.br
+	ldns_pkt_rcode packet_rcode;
+.br
+	ldns_rr_type packet_qtype;
+.br
+	bool packet_nodata;
+.br
+};
+.br
+
+.br
+typedef struct ldns_dnssec_data_chain_struct ldns_dnssec_data_chain;
+.PP
+.HP
+\fIldns_dnssec_data_chain_struct\fR()
+.PP
+.HP
+\fIldns_dnssec_trust_tree\fR
+.br
+Tree structure that contains the relation of DNSSEC data,
+.br
+and their cryptographic status.
+.br
+
+.br
+This tree is derived from a data_chain, and can be used
+.br
+to look whether there is a connection between an RRSET
+.br
+and a trusted key. The tree only contains pointers to the
+.br
+data_chain, and therefore one should *never* free() the
+.br
+data_chain when there is still a trust tree derived from
+.br
+that chain.
+.br
+
+.br
+Example tree:
+.br
+    key   key    key
+.br
+      \\    |    /
+.br
+       \\   |   /
+.br
+        \\  |  /
+.br
+           ds
+.br
+           |
+.br
+          key
+.br
+           |
+.br
+          key
+.br
+           |
+.br
+           rr
+.br
+
+.br
+For each signature there is a parent; if the parent
+.br
+pointer is null, it couldn't be found and there was no
+.br
+denial; otherwise is a tree which contains either a
+.br
+DNSKEY, a DS, or a NSEC rr
+.br
+struct ldns_dnssec_trust_tree_struct
+.br
+{
+.br
+	ldns_rr *rr;
+.br
+	/* the complete rrset this rr was in */
+.br
+	ldns_rr_list *rrset;
+.br
+	ldns_dnssec_trust_tree *parents[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
+.br
+	ldns_status parent_status[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
+.br
+	/** for debugging, add signatures too (you might want
+.br
+	    those if they contain errors) */
+.br
+	ldns_rr *parent_signature[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
+.br
+	size_t parent_count;
+.br
+};
+.br
+
+.br
+typedef struct ldns_dnssec_trust_tree_struct ldns_dnssec_trust_tree;
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_data_chain_new\fR, \fIldns_dnssec_trust_tree_new\fR, \fIldns_dnssec_verify_denial\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_deep_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_deep_free.3
new file mode 120000
index 00000000000000..3dabaa85e9e915
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_deep_free.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_free.3
new file mode 120000
index 00000000000000..3dabaa85e9e915
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_free.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_new.3
new file mode 100644
index 00000000000000..8c465208f85b76
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_new.3
@@ -0,0 +1,98 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_data_chain_new, ldns_dnssec_data_chain_free, ldns_dnssec_data_chain_deep_free, ldns_dnssec_build_data_chain, ldns_dnssec_data_chain_print \- ldns_chain creation, destruction and printing
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_dnssec_data_chain* ldns_dnssec_data_chain_new(void);
+.PP
+void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain);
+.PP
+void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain);
+.PP
+ldns_dnssec_data_chain* ldns_dnssec_build_data_chain(ldns_resolver *res, const uint16_t qflags, const ldns_rr_list *data_set, const ldns_pkt *pkt, ldns_rr *orig_rr);
+.PP
+void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_data_chain_new\fR()
+Creates a new dnssec_chain structure
+\.br
+Returns ldns_dnssec_data_chain *
+.PP
+.HP
+\fIldns_dnssec_data_chain_free\fR()
+Frees a dnssec_data_chain structure
+
+\.br
+\fB*chain\fR: The chain to free
+.PP
+.HP
+\fIldns_dnssec_data_chain_deep_free\fR()
+Frees a dnssec_data_chain structure, and all data
+contained therein
+
+\.br
+\fB*chain\fR: The dnssec_data_chain to free
+.PP
+.HP
+\fIldns_dnssec_build_data_chain\fR()
+Build an ldns_dnssec_data_chain, which contains all
+\%DNSSEC data that is needed to derive the trust tree later
+
+The data_set will be cloned
+
+\.br
+\fB*res\fR: resolver structure for further needed queries
+\.br
+\fBqflags\fR: resolution flags
+\.br
+\fB*data_set\fR: The original rrset where the chain ends
+\.br
+\fB*pkt\fR: optional, can contain the original packet
+(and hence the sigs and maybe the key)
+\.br
+\fB*orig_rr\fR: The original Resource Record
+
+\.br
+Returns the \%DNSSEC data chain
+.PP
+.HP
+\fIldns_dnssec_data_chain_print\fR()
+Prints the dnssec_data_chain to the given file stream
+
+\.br
+\fB*out\fR: The file stream to print to
+\.br
+\fB*chain\fR: The dnssec_data_chain to print
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_data_chain\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_print.3
new file mode 120000
index 00000000000000..3dabaa85e9e915
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_print.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_struct.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_struct.3
new file mode 120000
index 00000000000000..6f6243cf7f5372
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_data_chain_struct.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_dnskey_rrset.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_dnskey_rrset.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_dnskey_rrset.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_ds_rrset.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_ds_rrset.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_ds_rrset.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_no_sig.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_no_sig.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_no_sig.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_normal_rrset.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_normal_rrset.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_derive_trust_tree_normal_rrset.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name.3
new file mode 120000
index 00000000000000..afaa9110b22c65
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name.3
@@ -0,0 +1 @@
+ldns_dnssec_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_add_rr.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_add_rr.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_add_rr.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_cmp.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_cmp.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_cmp.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_find_rrset.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_find_rrset.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_find_rrset.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_free.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_free.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_name.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_name.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_name.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_new.3
new file mode 100644
index 00000000000000..dfd50bc271a194
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_new.3
@@ -0,0 +1,151 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_name_new, ldns_dnssec_name_new_frm_rr, ldns_dnssec_name_free, ldns_dnssec_name_name, ldns_dnssec_name_set_name, ldns_dnssec_name_set_nsec, ldns_dnssec_name_cmp, ldns_dnssec_name_add_rr, ldns_dnssec_name_find_rrset, ldns_dnssec_name_print \- functions for ldns_dnssec_name
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_dnssec_name* ldns_dnssec_name_new(void);
+.PP
+ldns_dnssec_name* ldns_dnssec_name_new_frm_rr(ldns_rr *rr);
+.PP
+void ldns_dnssec_name_free(ldns_dnssec_name *name);
+.PP
+ldns_rdf* ldns_dnssec_name_name(const ldns_dnssec_name *name);
+.PP
+void ldns_dnssec_name_set_name(ldns_dnssec_name *name, ldns_rdf *dname);
+.PP
+void ldns_dnssec_name_set_nsec(ldns_dnssec_name *name, ldns_rr *nsec);
+.PP
+int ldns_dnssec_name_cmp(const void *a, const void *b);
+.PP
+ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr);
+.PP
+ldns_dnssec_rrsets* ldns_dnssec_name_find_rrset(const ldns_dnssec_name *name, ldns_rr_type type);
+.PP
+void ldns_dnssec_name_print(FILE *out, const ldns_dnssec_name *name);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_name_new\fR()
+Create a new data structure for a dnssec name
+\.br
+Returns the allocated structure
+.PP
+.HP
+\fIldns_dnssec_name_new_frm_rr\fR()
+Create a new data structure for a dnssec name for the given \%RR
+
+\.br
+\fBrr\fR: the \%RR to derive properties from, and to add to the name
+.PP
+.HP
+\fIldns_dnssec_name_free\fR()
+Frees the name structure and its rrs and rrsets.
+Individual ldns_rr records therein are not freed
+
+\.br
+\fBname\fR: the structure to free
+.PP
+.HP
+\fIldns_dnssec_name_name\fR()
+Returns the domain name of the given dnssec_name structure
+
+\.br
+\fBname\fR: the dnssec name to get the domain name from
+\.br
+Returns the domain name
+.PP
+.HP
+\fIldns_dnssec_name_set_name\fR()
+Sets the domain name of the given dnssec_name structure
+
+\.br
+\fBname\fR: the dnssec name to set the domain name of
+\.br
+\fBdname\fR: the domain name to set it to. This data is *not* copied.
+.PP
+.HP
+\fIldns_dnssec_name_set_nsec\fR()
+Sets the \%NSEC(3) \%RR of the given dnssec_name structure
+
+\.br
+\fBname\fR: the dnssec name to set the domain name of
+\.br
+\fBnsec\fR: the nsec rr to set it to. This data is *not* copied.
+.PP
+.HP
+\fIldns_dnssec_name_cmp\fR()
+Compares the domain names of the two arguments in their
+canonical ordering.
+
+\.br
+\fBa\fR: The first dnssec_name to compare
+\.br
+\fBb\fR: The second dnssec_name to compare
+\.br
+Returns -1 if the domain name of a comes before that of b in canonical
+ordering, 1 if it is the other way around, and 0 if they are
+equal
+.PP
+.HP
+\fIldns_dnssec_name_add_rr\fR()
+Inserts the given rr at the right place in the current dnssec_name
+No checking is done whether the name matches
+
+\.br
+\fBname\fR: The ldns_dnssec_name to add the \%RR to
+\.br
+\fBrr\fR: The \%RR to add
+\.br
+Returns \%LDNS_STATUS_OK on success, error code otherwise
+.PP
+.HP
+\fIldns_dnssec_name_find_rrset\fR()
+Find the RRset with the given type in within this name structure
+
+\.br
+\fBname\fR: the name to find the RRset in
+\.br
+\fBtype\fR: the type of the RRset to find
+\.br
+Returns the RRset, or \%NULL if not present
+.PP
+.HP
+\fIldns_dnssec_name_print\fR()
+Prints the RRs in the  dnssec name structure to the given
+file descriptor
+
+\.br
+\fBout\fR: the file descriptor to print to
+\.br
+\fBname\fR: the name structure to print the contents of
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_new_frm_rr.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_new_frm_rr.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_new_frm_rr.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_node_next_nonglue.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_node_next_nonglue.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_node_next_nonglue.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_print.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_print.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_name.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_name.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_name.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_nsec.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_nsec.3
new file mode 120000
index 00000000000000..ac20e9c485cd6f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_name_set_nsec.3
@@ -0,0 +1 @@
+ldns_dnssec_name_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_remove_signatures.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_remove_signatures.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_remove_signatures.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrs.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs.3
new file mode 120000
index 00000000000000..afaa9110b22c65
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs.3
@@ -0,0 +1 @@
+ldns_dnssec_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_add_rr.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_add_rr.3
new file mode 120000
index 00000000000000..eea7ca9ef7ed1c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_add_rr.3
@@ -0,0 +1 @@
+ldns_dnssec_rrs_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_free.3
new file mode 120000
index 00000000000000..eea7ca9ef7ed1c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_free.3
@@ -0,0 +1 @@
+ldns_dnssec_rrs_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_new.3
new file mode 100644
index 00000000000000..a5509b4f4d462f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_new.3
@@ -0,0 +1,76 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_rrs_new, ldns_dnssec_rrs_free, ldns_dnssec_rrs_add_rr, ldns_dnssec_rrs_print \- functions for ldns_dnssecrrs
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_dnssec_rrs_new();
+.PP
+void ldns_dnssec_rrs_free(ldns_dnssec_rrs *rrs);
+.PP
+ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr);
+.PP
+void ldns_dnssec_rrs_print(FILE *out, const ldns_dnssec_rrs *rrs);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_rrs_new\fR()
+.PP
+.HP
+\fIldns_dnssec_rrs_free\fR()
+Frees the list of rrs, but *not* the individual ldns_rr records
+contained in the list
+
+\.br
+\fBrrs\fR: the data structure to free
+.PP
+.HP
+\fIldns_dnssec_rrs_add_rr\fR()
+Adds an \%RR to the list of RRs. The list will remain ordered.
+If an equal \%RR already exists, this \%RR will not be added.
+
+\.br
+\fBrrs\fR: the list to add to
+\.br
+\fBrr\fR: the \%RR to add
+\.br
+Returns \%LDNS_STATUS_OK on success
+.PP
+.HP
+\fIldns_dnssec_rrs_print\fR()
+Prints the given rrs to the file descriptor
+
+\.br
+\fBout\fR: the file descriptor to print to
+\.br
+\fBrrs\fR: the list of RRs to print
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_print.3
new file mode 120000
index 00000000000000..eea7ca9ef7ed1c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrs_print.3
@@ -0,0 +1 @@
+ldns_dnssec_rrs_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets.3
new file mode 120000
index 00000000000000..afaa9110b22c65
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets.3
@@ -0,0 +1 @@
+ldns_dnssec_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_add_rr.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_add_rr.3
new file mode 120000
index 00000000000000..159c89c57f6d55
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_add_rr.3
@@ -0,0 +1 @@
+ldns_dnssec_rrsets_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_free.3
new file mode 120000
index 00000000000000..159c89c57f6d55
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_free.3
@@ -0,0 +1 @@
+ldns_dnssec_rrsets_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_new.3
new file mode 100644
index 00000000000000..3e39c071797396
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_new.3
@@ -0,0 +1,105 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_rrsets_new, ldns_dnssec_rrsets_free, ldns_dnssec_rrsets_type, ldns_dnssec_rrsets_set_type, ldns_dnssec_rrsets_add_rr, ldns_dnssec_rrsets_print \- functions for ldns_dnssec_rrsets
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_dnssec_rrsets* ldns_dnssec_rrsets_new(void);
+.PP
+void ldns_dnssec_rrsets_free(ldns_dnssec_rrsets *rrsets);
+.PP
+ldns_rr_type ldns_dnssec_rrsets_type(const ldns_dnssec_rrsets *rrsets);
+.PP
+ldns_status ldns_dnssec_rrsets_set_type(ldns_dnssec_rrsets *rrsets, ldns_rr_type type);
+.PP
+ldns_status ldns_dnssec_rrsets_add_rr(ldns_dnssec_rrsets *rrsets, ldns_rr *rr);
+.PP
+void ldns_dnssec_rrsets_print(FILE *out, const ldns_dnssec_rrsets *rrsets, bool follow);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_rrsets_new\fR()
+Creates a new list (entry) of RRsets
+\.br
+Returns the newly allocated structure
+.PP
+.HP
+\fIldns_dnssec_rrsets_free\fR()
+Frees the list of rrsets and their rrs, but *not* the ldns_rr
+records in the sets
+
+\.br
+\fBrrsets\fR: the data structure to free
+.PP
+.HP
+\fIldns_dnssec_rrsets_type\fR()
+Returns the rr type of the rrset (that is head of the given list)
+
+\.br
+\fBrrsets\fR: the rrset to get the type of
+\.br
+Returns the rr type
+.PP
+.HP
+\fIldns_dnssec_rrsets_set_type\fR()
+Sets the \%RR type of the rrset (that is head of the given list)
+
+\.br
+\fBrrsets\fR: the rrset to set the type of
+\.br
+\fBtype\fR: the type to set
+\.br
+Returns \%LDNS_STATUS_OK on success
+.PP
+.HP
+\fIldns_dnssec_rrsets_add_rr\fR()
+Add an ldns_rr to the corresponding RRset in the given list of RRsets.
+If it is not present, add it as a new RRset with 1 record.
+
+\.br
+\fBrrsets\fR: the list of rrsets to add the \%RR to
+\.br
+\fBrr\fR: the rr to add to the list of rrsets
+\.br
+Returns \%LDNS_STATUS_OK on success
+.PP
+.HP
+\fIldns_dnssec_rrsets_print\fR()
+Print the given list of rrsets to the given file descriptor
+
+\.br
+\fBout\fR: the file descriptor to print to
+\.br
+\fBrrsets\fR: the list of RRsets to print
+\.br
+\fBfollow\fR: if set to false, only print the first RRset
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_print.3
new file mode 120000
index 00000000000000..159c89c57f6d55
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_print.3
@@ -0,0 +1 @@
+ldns_dnssec_rrsets_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_set_type.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_set_type.3
new file mode 120000
index 00000000000000..159c89c57f6d55
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_set_type.3
@@ -0,0 +1 @@
+ldns_dnssec_rrsets_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_type.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_type.3
new file mode 120000
index 00000000000000..159c89c57f6d55
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_rrsets_type.3
@@ -0,0 +1 @@
+ldns_dnssec_rrsets_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree.3
new file mode 120000
index 00000000000000..6f6243cf7f5372
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree.3
@@ -0,0 +1 @@
+ldns_dnssec_data_chain.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_add_parent.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_add_parent.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_add_parent.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_contains_keys.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_contains_keys.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_contains_keys.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_depth.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_depth.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_depth.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_free.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_free.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_new.3
new file mode 100644
index 00000000000000..de0b57352e0258
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_new.3
@@ -0,0 +1,195 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_trust_tree_new, ldns_dnssec_trust_tree_free, ldns_dnssec_trust_tree_depth, ldns_dnssec_derive_trust_tree, ldns_dnssec_trust_tree_contains_keys, ldns_dnssec_trust_tree_print, ldns_dnssec_trust_tree_print_sm, ldns_dnssec_trust_tree_add_parent, ldns_dnssec_derive_trust_tree_normal_rrset, ldns_dnssec_derive_trust_tree_dnskey_rrset, ldns_dnssec_derive_trust_tree_ds_rrset, ldns_dnssec_derive_trust_tree_no_sig \- functions for ldns_dnssec_trust_tree
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_dnssec_trust_tree* ldns_dnssec_trust_tree_new(void);
+.PP
+void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree);
+.PP
+size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree);
+.PP
+ldns_dnssec_trust_tree* ldns_dnssec_derive_trust_tree( ldns_dnssec_data_chain *data_chain, ldns_rr *rr);
+.PP
+ldns_status ldns_dnssec_trust_tree_contains_keys( ldns_dnssec_trust_tree *tree, ldns_rr_list *keys);
+.PP
+void ldns_dnssec_trust_tree_print(FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended);
+.PP
+ ldns_dnssec_trust_tree_print_sm();
+.PP
+ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree, const ldns_dnssec_trust_tree *parent, const ldns_rr *parent_signature, const ldns_status parent_status);
+.PP
+void ldns_dnssec_derive_trust_tree_normal_rrset( ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr);
+.PP
+void ldns_dnssec_derive_trust_tree_dnskey_rrset( ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr);
+.PP
+void ldns_dnssec_derive_trust_tree_ds_rrset( ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr);
+.PP
+void ldns_dnssec_derive_trust_tree_no_sig( ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_trust_tree_new\fR()
+Creates a new (empty) dnssec_trust_tree structure
+
+\.br
+Returns ldns_dnssec_trust_tree *
+.PP
+.HP
+\fIldns_dnssec_trust_tree_free\fR()
+Frees the dnssec_trust_tree recursively
+
+There is no deep free; all data in the trust tree
+consists of pointers to a data_chain
+
+\.br
+\fBtree\fR: The tree to free
+.PP
+.HP
+\fIldns_dnssec_trust_tree_depth\fR()
+returns the depth of the trust tree
+
+\.br
+\fBtree\fR: tree to calculate the depth of
+\.br
+Returns The depth of the tree
+.PP
+.HP
+\fIldns_dnssec_derive_trust_tree\fR()
+Generates a dnssec_trust_tree for the given rr from the
+given data_chain
+
+This does not clone the actual data; Don't free the
+data_chain before you are done with this tree
+
+\.br
+\fB*data_chain\fR: The chain to derive the trust tree from
+\.br
+\fB*rr\fR: The \%RR this tree will be about
+\.br
+Returns ldns_dnssec_trust_tree *
+.PP
+.HP
+\fIldns_dnssec_trust_tree_contains_keys\fR()
+Returns \%OK if there is a trusted path in the tree to one of 
+the \%DNSKEY or \%DS RRs in the given list
+
+\\param *tree The trust tree so search
+\\param *keys \%A ldns_rr_list of \%DNSKEY and \%DS rrs to look for
+
+\.br
+Returns \%LDNS_STATUS_OK if there is a trusted path to one of
+the keys, or the *first* error encountered
+if there were no paths
+.PP
+.HP
+\fIldns_dnssec_trust_tree_print\fR()
+Prints the dnssec_trust_tree structure to the given file
+stream.
+
+If a link status is not \%LDNS_STATUS_OK; the status and
+relevant signatures are printed too
+
+\.br
+\fB*out\fR: The file stream to print to
+\.br
+\fBtree\fR: The trust tree to print
+\.br
+\fBtabs\fR: Prepend each line with tabs*2 spaces
+\.br
+\fBextended\fR: If true, add little explanation lines to the output
+.PP
+.HP
+\fIldns_dnssec_trust_tree_print_sm\fR()
+.PP
+.HP
+\fIldns_dnssec_trust_tree_add_parent\fR()
+Adds a trust tree as a parent for the given trust tree
+
+\.br
+\fB*tree\fR: The tree to add the parent to
+\.br
+\fB*parent\fR: The parent tree to add
+\.br
+\fB*parent_signature\fR: The \%RRSIG relevant to this parent/child
+connection
+\.br
+\fBparent_status\fR: The \%DNSSEC status for this parent, child and \%RRSIG
+\.br
+Returns \%LDNS_STATUS_OK if the addition succeeds, error otherwise
+.PP
+.HP
+\fIldns_dnssec_derive_trust_tree_normal_rrset\fR()
+Sub function for derive_trust_tree that is used for a 'normal' rrset
+
+\.br
+\fBnew_tree\fR: The trust tree that we are building
+\.br
+\fBdata_chain\fR: The data chain containing the data for the trust tree
+\.br
+\fBcur_sig_rr\fR: The currently relevant signature
+.PP
+.HP
+\fIldns_dnssec_derive_trust_tree_dnskey_rrset\fR()
+Sub function for derive_trust_tree that is used for \%DNSKEY rrsets
+
+\.br
+\fBnew_tree\fR: The trust tree that we are building
+\.br
+\fBdata_chain\fR: The data chain containing the data for the trust tree
+\.br
+\fBcur_rr\fR: The currently relevant \%DNSKEY \%RR
+\.br
+\fBcur_sig_rr\fR: The currently relevant signature
+.PP
+.HP
+\fIldns_dnssec_derive_trust_tree_ds_rrset\fR()
+Sub function for derive_trust_tree that is used for \%DS rrsets
+
+\.br
+\fBnew_tree\fR: The trust tree that we are building
+\.br
+\fBdata_chain\fR: The data chain containing the data for the trust tree
+\.br
+\fBcur_rr\fR: The currently relevant \%DS \%RR
+.PP
+.HP
+\fIldns_dnssec_derive_trust_tree_no_sig\fR()
+Sub function for derive_trust_tree that is used when there are no
+signatures
+
+\.br
+\fBnew_tree\fR: The trust tree that we are building
+\.br
+\fBdata_chain\fR: The data chain containing the data for the trust tree
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_data_chain\fR, \fIldns_dnssec_trust_tree\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print_sm.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print_sm.3
new file mode 120000
index 00000000000000..d95d1e07855f39
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_trust_tree_print_sm.3
@@ -0,0 +1 @@
+ldns_dnssec_trust_tree_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial.3
new file mode 100644
index 00000000000000..1b922c971bea76
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial.3
@@ -0,0 +1,80 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_verify_denial, ldns_dnssec_verify_denial_nsec3 \- verify denial of existence
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_dnssec_verify_denial(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs);
+.PP
+ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_verify_denial\fR()
+denial is not just a river in egypt
+
+\.br
+\fBrr\fR: The (query) \%RR to check the denial of existence for
+\.br
+\fBnsecs\fR: The list of \%NSEC RRs that are supposed to deny the
+existence of the \%RR
+\.br
+\fBrrsigs\fR: The \%RRSIG \%RR covering the \%NSEC RRs
+\.br
+Returns \%LDNS_STATUS_OK if the \%NSEC RRs deny the existence, error code
+containing the reason they do not otherwise
+.PP
+.HP
+\fIldns_dnssec_verify_denial_nsec3\fR()
+Denial of existence using NSEC3 records
+Since NSEC3 is a bit more complicated than normal denial, some
+context arguments are needed
+
+\.br
+\fBrr\fR: The (query) \%RR to check the denial of existence for
+\.br
+\fBnsecs\fR: The list of NSEC3 RRs that are supposed to deny the
+existence of the \%RR
+\.br
+\fBrrsigs\fR: The \%RRSIG rr covering the \%NSEC RRs
+\.br
+\fBpacket_rcode\fR: The \%RCODE value of the packet that provided the
+NSEC3 RRs
+\.br
+\fBpacket_qtype\fR: The original query \%RR type
+\.br
+\fBpacket_nodata\fR: True if the providing packet had an empty \%ANSWER
+section
+\.br
+Returns \%LDNS_STATUS_OK if the NSEC3 RRs deny the existence, error code
+containing the reason they do not otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_trust_tree\fR, \fIldns_dnssec_data_chain\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial_nsec3.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial_nsec3.3
new file mode 120000
index 00000000000000..4dc9b49ecf3177
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_verify_denial_nsec3.3
@@ -0,0 +1 @@
+ldns_dnssec_verify_denial.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone.3
new file mode 100644
index 00000000000000..516f0f185b5828
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone.3
@@ -0,0 +1,178 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_zone, ldns_dnssec_name, ldns_dnssec_rrs, ldns_dnssec_rrsets \- data structures
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_dnssec_zone();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_zone\fR()
+.PP
+.HP
+\fIldns_dnssec_name\fR
+.br
+Structure containing all resource records for a domain name
+.br
+Including the derived NSEC3, if present
+.br
+struct ldns_struct_dnssec_name
+.br
+{
+.br
+	/**
+.br
+	 * pointer to a dname containing the name.
+.br
+	 * Usually points to the owner name of the first RR of the first RRset
+.br
+	 */
+.br
+	ldns_rdf *name;
+.br
+	/** 
+.br
+	 * Usually, the name is a pointer to the owner name of the first rr for
+.br
+	 * this name, but sometimes there is no actual data to point to, 
+.br
+	 * for instance in
+.br
+	 * names representing empty nonterminals. If so, set name_alloced to true to
+.br
+	 * indicate that this data must also be freed when the name is freed
+.br
+	 */
+.br
+	bool name_alloced;
+.br
+	/**
+.br
+	 * The rrsets for this name
+.br
+	 */
+.br
+	ldns_dnssec_rrsets *rrsets;
+.br
+	/**
+.br
+	 * NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
+.br
+	 */
+.br
+	ldns_rr *nsec;
+.br
+	/**
+.br
+	 * signatures for the NSEC record
+.br
+	 */
+.br
+	ldns_dnssec_rrs *nsec_signatures;
+.br
+	/**
+.br
+	 * Unlike what the name is_glue suggests, this field is set to true by
+.br
+	 * ldns_dnssec_zone_mark_glue() or ldns_dnssec_zone_mark_and_get_glue()
+.br
+	 * when the name, this dnssec_name struct represents, is occluded.
+.br
+	 * Names that contain other occluded rrsets and records with glue on
+.br
+	 * the delegation point will NOT have this bool set to true.
+.br
+	 * This field should NOT be read directly, but only via the 
+.br
+	 * ldns_dnssec_name_is_glue() function!
+.br
+	 */
+.br
+	bool is_glue;
+.br
+	/**
+.br
+	 * pointer to store the hashed name (only used when in an NSEC3 zone
+.br
+	 */
+.br
+	ldns_rdf *hashed_name;
+.br
+};
+.br
+
+.br
+typedef struct ldns_struct_dnssec_name ldns_dnssec_name;
+.PP
+.HP
+\fIldns_dnssec_rrs\fR
+.br
+Singly linked list of rrs
+.br
+struct ldns_struct_dnssec_rrs
+.br
+{
+.br
+	ldns_rr *rr;
+.br
+	ldns_dnssec_rrs *next;
+.br
+};
+.br
+
+.br
+typedef struct ldns_struct_dnssec_rrs ldns_dnssec_rrs;
+.PP
+.HP
+\fIldns_dnssec_rrsets\fR
+.br
+Singly linked list of RRsets
+.br
+struct ldns_struct_dnssec_rrsets
+.br
+{
+.br
+	ldns_dnssec_rrs *rrs;
+.br
+	ldns_rr_type type;
+.br
+	ldns_dnssec_rrs *signatures;
+.br
+	ldns_dnssec_rrsets *next;
+.br
+};
+.br
+
+.br
+typedef struct ldns_struct_dnssec_rrsets ldns_dnssec_rrsets;
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone_new\fR, \fIldns_dnssec_name_new\fR, \fIldns_dnssec_rrs_new\fR, \fIldns_dnssec_rrsets_new\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_empty_nonterminals.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_empty_nonterminals.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_empty_nonterminals.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_rr.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_rr.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_add_rr.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_nsecs.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_nsecs.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_nsecs.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_rrsigs.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_rrsigs.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_create_rrsigs.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_find_rrset.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_find_rrset.3
new file mode 100644
index 00000000000000..191c11b95cd712
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_find_rrset.3
@@ -0,0 +1,119 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_zone_find_rrset, ldns_dnssec_zone_new, ldns_dnssec_zone_free, ldns_dnssec_zone_add_rr, ldns_dnssec_zone_names_print, ldns_dnssec_zone_print, ldns_dnssec_zone_add_empty_nonterminals \- functions for ldns_dnssec_zone
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_dnssec_rrsets* ldns_dnssec_zone_find_rrset(const ldns_dnssec_zone *zone, const ldns_rdf *dname, ldns_rr_type type);
+.PP
+ldns_dnssec_zone* ldns_dnssec_zone_new(void);
+.PP
+void ldns_dnssec_zone_free(ldns_dnssec_zone *zone);
+.PP
+ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr);
+.PP
+void ldns_dnssec_zone_names_print(FILE *out, const ldns_rbtree_t *tree, bool print_soa);
+.PP
+void ldns_dnssec_zone_print(FILE *out, const ldns_dnssec_zone *zone);
+.PP
+ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_zone_find_rrset\fR()
+Find the RRset with the given name and type in the zone
+
+\.br
+\fBzone\fR: the zone structure to find the RRset in
+\.br
+\fBdname\fR: the domain name of the RRset to find
+\.br
+\fBtype\fR: the type of the RRset to find
+\.br
+Returns the RRset, or \%NULL if not present
+.PP
+.HP
+\fIldns_dnssec_zone_new\fR()
+Creates a new dnssec_zone structure
+\.br
+Returns the allocated structure
+.PP
+.HP
+\fIldns_dnssec_zone_free\fR()
+Frees the given zone structure, and its rbtree of dnssec_names
+Individual ldns_rr RRs within those names are *not* freed
+\.br
+\fB*zone\fR: the zone to free
+.PP
+.HP
+\fIldns_dnssec_zone_add_rr\fR()
+Adds the given \%RR to the zone.
+It find whether there is a dnssec_name with that name present.
+If so, add it to that, if not create a new one. 
+Special handling of \%NSEC and \%RRSIG provided
+
+\.br
+\fBzone\fR: the zone to add the \%RR to
+\.br
+\fBrr\fR: The \%RR to add
+\.br
+Returns \%LDNS_STATUS_OK on success, an error code otherwise
+.PP
+.HP
+\fIldns_dnssec_zone_names_print\fR()
+Prints the rbtree of ldns_dnssec_name structures to the file descriptor
+
+\.br
+\fBout\fR: the file descriptor to print the names to
+\.br
+\fBtree\fR: the tree of ldns_dnssec_name structures to print
+\.br
+\fBprint_soa\fR: if true, print \%SOA records, if false, skip them
+.PP
+.HP
+\fIldns_dnssec_zone_print\fR()
+Prints the complete zone to the given file descriptor
+
+\.br
+\fBout\fR: the file descriptor to print to
+\.br
+\fBzone\fR: the dnssec_zone to print
+.PP
+.HP
+\fIldns_dnssec_zone_add_empty_nonterminals\fR()
+Adds explicit dnssec_name structures for the empty nonterminals
+in this zone. (this is needed for NSEC3 generation)
+
+\.br
+\fBzone\fR: the zone to check for empty nonterminals
+return \%LDNS_STATUS_OK on success.
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_free.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_free.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_free.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_mark_glue.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_mark_glue.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_mark_glue.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_names_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_names_print.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_names_print.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_new.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_new.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_new.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_print.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_print.3
new file mode 120000
index 00000000000000..2a554e71e1a960
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_print.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_find_rrset.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign.3
new file mode 100644
index 00000000000000..f39cdc4e3b899d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign.3
@@ -0,0 +1,170 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_dnssec_zone_sign, ldns_dnssec_zone_sign_nsec3, ldns_dnssec_zone_mark_glue, ldns_dnssec_name_node_next_nonglue, ldns_dnssec_zone_create_nsecs, ldns_dnssec_remove_signatures, ldns_dnssec_zone_create_rrsigs \- sign ldns_dnssec_zone
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *, void *), void *arg);
+.PP
+ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt);
+.PP
+ ldns_dnssec_zone_mark_glue();
+.PP
+ldns_rbnode_t* ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node);
+.PP
+ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs);
+.PP
+ldns_dnssec_rrs* ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list, int (*func)(ldns_rr *, void *), void *arg);
+.PP
+ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *, void*), void *arg);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_dnssec_zone_sign\fR()
+signs the given zone with the given keys
+
+\.br
+\fBzone\fR: the zone to sign
+\.br
+\fBkey_list\fR: the list of keys to sign the zone with
+\.br
+\fBnew_rrs\fR: newly created resource records are added to this list, to free them later
+\.br
+\fBfunc\fR: callback function that decides what to do with old signatures
+This function takes an ldns_rr* and an optional void *arg argument, and returns one of four values:
+\%LDNS_SIGNATURE_LEAVE_ADD_NEW:
+leave the signature and add a new one for the corresponding key
+\%LDNS_SIGNATURE_REMOVE_ADD_NEW:
+remove the signature and replace is with a new one from the same key
+\%LDNS_SIGNATURE_LEAVE_NO_ADD:
+leave the signature and do not add a new one with the corresponding key
+\%LDNS_SIGNATURE_REMOVE_NO_ADD:
+remove the signature and do not replace 
+
+\.br
+\fBarg\fR: optional argument for the callback function
+\.br
+Returns \%LDNS_STATUS_OK on success, an error code otherwise
+.PP
+.HP
+\fIldns_dnssec_zone_sign_nsec3\fR()
+signs the given zone with the given new zone, with NSEC3
+
+\.br
+\fBzone\fR: the zone to sign
+\.br
+\fBkey_list\fR: the list of keys to sign the zone with
+\.br
+\fBnew_rrs\fR: newly created resource records are added to this list, to free them later
+\.br
+\fBfunc\fR: callback function that decides what to do with old signatures
+\.br
+\fBarg\fR: optional argument for the callback function
+\.br
+\fBalgorithm\fR: the NSEC3 hashing algorithm to use
+\.br
+\fBflags\fR: NSEC3 flags
+\.br
+\fBiterations\fR: the number of NSEC3 hash iterations to use
+\.br
+\fBsalt_length\fR: the length (in octets) of the NSEC3 salt
+\.br
+\fBsalt\fR: the NSEC3 salt data
+\.br
+Returns \%LDNS_STATUS_OK on success, an error code otherwise
+.PP
+.HP
+\fIldns_dnssec_zone_mark_glue\fR()
+.PP
+.HP
+\fIldns_dnssec_name_node_next_nonglue\fR()
+Finds the first dnssec_name node in the rbtree that is not occluded.
+It *does* return names that are partially occluded.
+
+\.br
+\fBnode\fR: the first node to check
+\.br
+Returns the first node that has not been marked as glue, or \%NULL
+if not found (\%TODO: make that \%LDNS_RBTREE_NULL?)
+.PP
+.HP
+\fIldns_dnssec_zone_create_nsecs\fR()
+Adds \%NSEC records to the given dnssec_zone
+
+\.br
+\fBzone\fR: the zone to add the records to
+\.br
+\fBnew_rrs\fR: ldns_rr's created by this function are
+added to this rr list, so the caller can free them later
+\.br
+Returns \%LDNS_STATUS_OK on success, an error code otherwise
+.PP
+.HP
+\fIldns_dnssec_remove_signatures\fR()
+remove signatures if callback function tells to
+
+\.br
+\fBsignatures\fR: list of signatures to check, and
+possibly remove, depending on the value of the
+callback
+\.br
+\fBkey_list\fR: these are marked to be used or not,
+on the return value of the callback
+\.br
+\fBfunc\fR: this function is called to specify what to
+do with each signature (and corresponding key)
+\.br
+\fBarg\fR: Optional argument for the callback function
+\.br
+Returns s pointer to the new signatures rrs (the original
+passed to this function may have been removed)
+.PP
+.HP
+\fIldns_dnssec_zone_create_rrsigs\fR()
+Adds signatures to the zone
+
+\.br
+\fBzone\fR: the zone to add \%RRSIG Resource Records to
+\.br
+\fBnew_rrs\fR: the \%RRSIG RRs that are created are also
+added to this list, so the caller can free them
+later
+\.br
+\fBkey_list\fR: list of keys to sign with.
+\.br
+\fBfunc\fR: Callback function to decide what keys to
+use and what to do with old signatures
+\.br
+\fBarg\fR: Optional argument for the callback function
+\.br
+Returns \%LDNS_STATUS_OK on success, error otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_dnssec_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign_nsec3.3 b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign_nsec3.3
new file mode 120000
index 00000000000000..82fba1089c88a0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_dnssec_zone_sign_nsec3.3
@@ -0,0 +1 @@
+ldns_dnssec_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration2string.3 b/contrib/ldns/doc/man/man3/ldns_duration2string.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration2string.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration2time.3 b/contrib/ldns/doc/man/man3/ldns_duration2time.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration2time.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration_cleanup.3 b/contrib/ldns/doc/man/man3/ldns_duration_cleanup.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration_cleanup.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration_compare.3 b/contrib/ldns/doc/man/man3/ldns_duration_compare.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration_compare.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration_create.3 b/contrib/ldns/doc/man/man3/ldns_duration_create.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration_create.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration_create_from_string.3 b/contrib/ldns/doc/man/man3/ldns_duration_create_from_string.3
new file mode 120000
index 00000000000000..1440b7b19ae788
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration_create_from_string.3
@@ -0,0 +1 @@
+ldns_duration_type.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_duration_type.3 b/contrib/ldns/doc/man/man3/ldns_duration_type.3
new file mode 100644
index 00000000000000..a788e62e3bcac3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_duration_type.3
@@ -0,0 +1,129 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_duration_type, ldns_duration_create, ldns_duration_create_from_string, ldns_duration_cleanup, ldns_duration_compare, ldns_duration2string, ldns_duration2time \- duration type and related functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_duration_type* ldns_duration_create(void);
+.PP
+ldns_duration_type* ldns_duration_create_from_string(const char* str);
+.PP
+void ldns_duration_cleanup(ldns_duration_type* duration);
+.PP
+int ldns_duration_compare(const ldns_duration_type* d1, const ldns_duration_type* d2);
+.PP
+char* ldns_duration2string(const ldns_duration_type* duration);
+.PP
+time_t ldns_duration2time(const ldns_duration_type* duration);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_duration_type\fR
+.br
+Duration.
+.br
+
+.br
+struct ldns_duration_struct
+.br
+{
+.br
+    time_t years;
+.br
+    time_t months;
+.br
+    time_t weeks;
+.br
+    time_t days;
+.br
+    time_t hours;
+.br
+    time_t minutes;
+.br
+    time_t seconds;
+.br
+};
+.br
+
+.br
+typedef struct ldns_duration_struct ldns_duration_type;
+.PP
+.HP
+\fIldns_duration_create\fR()
+Create a new 'instant' duration.
+\.br
+Returns ldns_duration_type* created duration
+
+.PP
+.HP
+\fIldns_duration_create_from_string\fR()
+Create a duration from string.
+\.br
+\fBstr\fR: string-format duration
+\.br
+Returns ldns_duration_type* created duration
+
+.PP
+.HP
+\fIldns_duration_cleanup\fR()
+Clean up duration.
+\.br
+\fBduration\fR: duration to be cleaned up
+
+.PP
+.HP
+\fIldns_duration_compare\fR()
+Compare durations.
+\.br
+\fBd1\fR: one duration
+\.br
+\fBd2\fR: another duration
+\.br
+Returns int 0 if equal, -1 if d1 < d2, 1 if d2 < d1
+
+.PP
+.HP
+\fIldns_duration2string\fR()
+Convert a duration to a string.
+\.br
+\fBduration\fR: duration to be converted
+\.br
+Returns char* string-format duration
+
+.PP
+.HP
+\fIldns_duration2time\fR()
+Convert a duration to a time.
+\.br
+\fBduration\fR: duration to be converted
+\.br
+Returns time_t time-format duration
+
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_fget_token.3 b/contrib/ldns/doc/man/man3/ldns_fget_token.3
new file mode 100644
index 00000000000000..ddf7b50ecce487
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_fget_token.3
@@ -0,0 +1,67 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_fget_token, ldns_fskipcs \- get tokens from files
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ssize_t ldns_fget_token(FILE *f, char *token, const char *delim, size_t limit);
+.PP
+void ldns_fskipcs(FILE *fp, const char *s);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_fget_token\fR()
+returns a token/char from the stream \%F.
+This function deals with ( and ) in the stream,
+and ignores them when encountered
+\.br
+\fB*f\fR: the file to read from
+\.br
+\fB*token\fR: the read token is put here
+\.br
+\fB*delim\fR: chars at which the parsing should stop
+\.br
+\fB*limit\fR: how much to read. If 0 the builtin maximum is used
+\.br
+Returns 0 on error of \%EOF of the stream \%F.  Otherwise return the length of what is read
+.PP
+.HP
+\fIldns_fskipcs\fR()
+skips all of the characters in the given string in the fp, moving
+the position to the first character that is not in *s.
+\.br
+\fB*fp\fR: file to use
+\.br
+\fB*s\fR: characters to skip
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_buffer\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_fskipcs.3 b/contrib/ldns/doc/man/man3/ldns_fskipcs.3
new file mode 120000
index 00000000000000..d6c5851a4fc1ef
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_fskipcs.3
@@ -0,0 +1 @@
+ldns_fget_token.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_get_errorstr_by_id.3 b/contrib/ldns/doc/man/man3/ldns_get_errorstr_by_id.3
new file mode 100644
index 00000000000000..fdabd7de7c297c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_errorstr_by_id.3
@@ -0,0 +1,44 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_get_errorstr_by_id, ldns_status \- errors
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_get_errorstr_by_id();
+.PP
+ ldns_status();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_get_errorstr_by_id\fR()
+.PP
+.HP
+\fIldns_status\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_class_by_name.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_class_by_name.3
new file mode 100644
index 00000000000000..4e15e6b7bb38b7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_class_by_name.3
@@ -0,0 +1,56 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_get_rr_class_by_name, ldns_get_rr_type_by_name \- lookup class or type by name
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_class ldns_get_rr_class_by_name(const char *name);
+.PP
+ldns_rr_type ldns_get_rr_type_by_name(const char *name);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_get_rr_class_by_name\fR()
+retrieves a class by looking up its name.
+\.br
+\fBname\fR: string with the name
+\.br
+Returns the cass which corresponds with the name
+.PP
+.HP
+\fIldns_get_rr_type_by_name\fR()
+retrieves a rrtype by looking up its name.
+\.br
+\fBname\fR: a string with the name
+\.br
+Returns the type which corresponds with the name
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_list_addr_by_name.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_list_addr_by_name.3
new file mode 100644
index 00000000000000..ecc5d45d6238b6
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_list_addr_by_name.3
@@ -0,0 +1,66 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_get_rr_list_addr_by_name, ldns_get_rr_list_name_by_addr \- get addresses by name or names by address
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list* ldns_get_rr_list_addr_by_name(ldns_resolver *r, const ldns_rdf *name, ldns_rr_class c, uint16_t flags);
+.PP
+ldns_rr_list* ldns_get_rr_list_name_by_addr(ldns_resolver *r, const ldns_rdf *addr, ldns_rr_class c, uint16_t flags);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_get_rr_list_addr_by_name\fR()
+Ask the resolver about name
+and return all address records
+\.br
+\fBr\fR: the resolver to use
+\.br
+\fBname\fR: the name to look for
+\.br
+\fBc\fR: the class to use
+\.br
+\fBflags\fR: give some optional flags to the query
+.PP
+.HP
+\fIldns_get_rr_list_name_by_addr\fR()
+ask the resolver about the address
+and return the name
+\.br
+\fBr\fR: the resolver to use
+\.br
+\fBaddr\fR: the addr to look for
+\.br
+\fBc\fR: the class to use
+\.br
+\fBflags\fR: give some optional flags to the query
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr_list\fR, \fIldns_rr\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_file.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_file.3
new file mode 100644
index 00000000000000..2e5b8ffcd93b69
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_file.3
@@ -0,0 +1,74 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_get_rr_list_hosts_frm_file, ldns_get_rr_list_hosts_frm_fp, ldns_get_rr_list_hosts_frm_fp_l \- parse /etc/hosts file
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list* ldns_get_rr_list_hosts_frm_file(char *filename);
+.PP
+ldns_rr_list* ldns_get_rr_list_hosts_frm_fp(FILE *fp);
+.PP
+ldns_rr_list* ldns_get_rr_list_hosts_frm_fp_l(FILE *fp, int *line_nr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_get_rr_list_hosts_frm_file\fR()
+wade through fp (a /etc/hosts like file)
+and return a rr_list containing all the 
+defined hosts in there
+\.br
+\fBfilename\fR: the filename to use (\%NULL for /etc/hosts)
+\.br
+Returns ldns_rr_list * with the names
+.PP
+.HP
+\fIldns_get_rr_list_hosts_frm_fp\fR()
+wade through fp (a /etc/hosts like file)
+and return a rr_list containing all the 
+defined hosts in there
+\.br
+\fBfp\fR: the file pointer to use
+\.br
+Returns ldns_rr_list * with the names
+.PP
+.HP
+\fIldns_get_rr_list_hosts_frm_fp_l\fR()
+wade through fp (a /etc/hosts like file)
+and return a rr_list containing all the 
+defined hosts in there
+\.br
+\fBfp\fR: the file pointer to use
+\.br
+\fBline_nr\fR: pointer to an integer containing the current line number (for debugging purposes)
+\.br
+Returns ldns_rr_list * with the names
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr_list\fR, \fIldns_rr\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp.3
new file mode 120000
index 00000000000000..021232813d4688
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp.3
@@ -0,0 +1 @@
+ldns_get_rr_list_hosts_frm_file.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp_l.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp_l.3
new file mode 120000
index 00000000000000..021232813d4688
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_list_hosts_frm_fp_l.3
@@ -0,0 +1 @@
+ldns_get_rr_list_hosts_frm_file.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_list_name_by_addr.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_list_name_by_addr.3
new file mode 120000
index 00000000000000..7d07f06cde3822
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_list_name_by_addr.3
@@ -0,0 +1 @@
+ldns_get_rr_list_addr_by_name.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_get_rr_type_by_name.3 b/contrib/ldns/doc/man/man3/ldns_get_rr_type_by_name.3
new file mode 120000
index 00000000000000..bc80c435aa0f18
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_get_rr_type_by_name.3
@@ -0,0 +1 @@
+ldns_get_rr_class_by_name.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_getaddrinfo.3 b/contrib/ldns/doc/man/man3/ldns_getaddrinfo.3
new file mode 100644
index 00000000000000..2e24ac05a1f0ad
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_getaddrinfo.3
@@ -0,0 +1,54 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_getaddrinfo \- mimic libc getaddrinfo
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+uint16_t ldns_getaddrinfo(ldns_resolver *res, const ldns_rdf *node, ldns_rr_class c, ldns_rr_list **list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_getaddrinfo\fR()
+This function is a wrapper function for ldns_get_rr_list_name_by_addr
+and ldns_get_rr_list_addr_by_name. It's name is from the getaddrinfo() 
+library call. It tries to mimic that call, but without the lowlevel
+stuff.
+\.br
+\fBres\fR: The resolver. If this value is \%NULL then a resolver will
+be created by ldns_getaddrinfo.
+\.br
+\fBnode\fR: the name or ip address to look up
+\.br
+\fBc\fR: the class to look in
+\.br
+\fBlist\fR: put the found \%RR's in this list
+\.br
+Returns the number of \%RR found.
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_init_random.3 b/contrib/ldns/doc/man/man3/ldns_init_random.3
new file mode 100644
index 00000000000000..8f77edf55d8ea5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_init_random.3
@@ -0,0 +1,41 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_init_random \- seed the random function
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_init_random();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_init_random\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_sign_public\fR, \fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_is_rrset.3 b/contrib/ldns/doc/man/man3/ldns_is_rrset.3
new file mode 100644
index 00000000000000..8c3bfa64ce2db6
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_is_rrset.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_is_rrset \- is rr_list a rrset
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_is_rrset(const ldns_rr_list *rr_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_is_rrset\fR()
+checks if an rr_list is a rrset.
+\.br
+\fBrr_list\fR: the rr_list to check
+\.br
+Returns true if it is an rrset otherwise false
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key.3 b/contrib/ldns/doc/man/man3/ldns_key.3
new file mode 100644
index 00000000000000..5b6360aef5929f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key.3
@@ -0,0 +1,41 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key \- ldns_key data structure
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_key();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key_new\fR, \fIldns_key_new_frm_algorithm\fR, \fIldns_key_new_frm_fp\fR, \fIldns_key_new_frm_fp_l\fR, \fIldns_key_new_frm_fp_rsa\fR, \fIldns_key_new_frm_fp_rsa_l\fR, \fIldns_key_new_frm_fp_dsa\fR, \fIldns_key_new_frm_fp_dsa_l\fR, \fIldns_key_list_new\fR, \fIldns_key_set_algorithm\fR, \fIldns_key_set_rsa_key\fR, \fIldns_key_set_dsa_key\fR, \fIldns_key_set_hmac_key\fR, \fIldns_key_set_origttl\fR, \fIldns_key_set_inception\fR, \fIldns_key_set_expiration\fR, \fIldns_key_set_pubkey_owner\fR, \fIldns_key_set_keytag\fR, \fIldns_key_set_flags\fR, \fIldns_key_list_set_key_count\fR, \fIldns_key_list_push_key\fR, \fIldns_key_list_pop_key\fR, \fIldns_key_list_key_count\fR, \fIldns_key_list_key\fR, \fIldns_key_rsa_key\fR, \fIldns_key_dsa_key\fR, \fIldns_key_algorithm\fR, \fIldns_key_hmac_key\fR, \fIldns_key_origttl\fR, \fIldns_key_inception\fR, \fIldns_key_expiration\fR, \fIldns_key_keytag\fR, \fIldns_key_pubkey_owner\fR, \fIldns_key_flags\fR, \fIldns_key2rr\fR, \fIldns_key_free\fR, \fIldns_key_deep_free\fR, \fIldns_key_list_free\fR, \fIldns_key_print\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_key2buffer_str.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key2buffer_str.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key2rr.3 b/contrib/ldns/doc/man/man3/ldns_key2rr.3
new file mode 100644
index 00000000000000..f9eaf638da430b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key2rr.3
@@ -0,0 +1,50 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key2rr \- convert ldns_key to rr
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr* ldns_key2rr(const ldns_key *k);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key2rr\fR()
+converts a ldns_key to a public key rr
+If the key data exists at an external point, the corresponding
+rdata field must still be added with ldns_rr_rdf_push() to the
+result rr of this function
+
+\.br
+\fBk\fR: the ldns_key to convert
+\.br
+Returns ldns_rr representation of the key
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key2str.3 b/contrib/ldns/doc/man/man3/ldns_key2str.3
new file mode 120000
index 00000000000000..b2208d56a9d787
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key2str.3
@@ -0,0 +1 @@
+ldns_rr2str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_algo_supported.3 b/contrib/ldns/doc/man/man3/ldns_key_algo_supported.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_algo_supported.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_key_algorithm.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_algorithm.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_buf2dsa.3 b/contrib/ldns/doc/man/man3/ldns_key_buf2dsa.3
new file mode 100644
index 00000000000000..a046d3019be4f3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_buf2dsa.3
@@ -0,0 +1,58 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_buf2dsa, ldns_key_buf2rsa \- convert buffer to openssl key
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+DSA* ldns_key_buf2dsa(const ldns_buffer *key);
+.PP
+RSA* ldns_key_buf2rsa(const ldns_buffer *key);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_buf2dsa\fR()
+converts a buffer holding key material to a \%DSA key in openssl.
+
+\.br
+\fBkey\fR: the key to convert
+\.br
+Returns a \%DSA * structure with the key material
+.PP
+.HP
+\fIldns_key_buf2rsa\fR()
+converts a buffer holding key material to a \%RSA key in openssl.
+
+\.br
+\fBkey\fR: the key to convert
+\.br
+Returns a \%RSA * structure with the key material
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key_rr2ds\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_buf2rsa.3 b/contrib/ldns/doc/man/man3/ldns_key_buf2rsa.3
new file mode 120000
index 00000000000000..20e2b4f7563be9
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_buf2rsa.3
@@ -0,0 +1 @@
+ldns_key_buf2dsa.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_deep_free.3 b/contrib/ldns/doc/man/man3/ldns_key_deep_free.3
new file mode 120000
index 00000000000000..b98a250d6f638b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_deep_free.3
@@ -0,0 +1 @@
+ldns_key_free.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_dsa_key.3 b/contrib/ldns/doc/man/man3/ldns_key_dsa_key.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_dsa_key.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_expiration.3 b/contrib/ldns/doc/man/man3/ldns_key_expiration.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_expiration.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_flags.3 b/contrib/ldns/doc/man/man3/ldns_key_flags.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_flags.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_free.3 b/contrib/ldns/doc/man/man3/ldns_key_free.3
new file mode 100644
index 00000000000000..a0472a11106471
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_free.3
@@ -0,0 +1,63 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_free, ldns_key_deep_free, ldns_key_list_free \- free a ldns_key
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_key_free(ldns_key *key);
+.PP
+void ldns_key_deep_free(ldns_key *key);
+.PP
+void ldns_key_list_free(ldns_key_list *key_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_free\fR()
+frees a key structure, but not its internal data structures
+
+\.br
+\fBkey\fR: the key object to free
+.PP
+.HP
+\fIldns_key_deep_free\fR()
+frees a key structure and all its internal data structures, except
+the data set by ldns_key_set_external_key()
+
+\.br
+\fBkey\fR: the key object to free
+.PP
+.HP
+\fIldns_key_list_free\fR()
+Frees a key list structure
+\.br
+\fBkey_list\fR: the key list object to free
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_hmac_key.3 b/contrib/ldns/doc/man/man3/ldns_key_hmac_key.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_hmac_key.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_inception.3 b/contrib/ldns/doc/man/man3/ldns_key_inception.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_inception.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_keytag.3 b/contrib/ldns/doc/man/man3/ldns_key_keytag.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_keytag.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_free.3 b/contrib/ldns/doc/man/man3/ldns_key_list_free.3
new file mode 120000
index 00000000000000..b98a250d6f638b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_free.3
@@ -0,0 +1 @@
+ldns_key_free.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_key.3 b/contrib/ldns/doc/man/man3/ldns_key_list_key.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_key.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_key_count.3 b/contrib/ldns/doc/man/man3/ldns_key_list_key_count.3
new file mode 100644
index 00000000000000..27e296b6aa586e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_key_count.3
@@ -0,0 +1,154 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_list_key_count, ldns_key_list_key, ldns_key_rsa_key, ldns_key_dsa_key, ldns_key_algorithm, ldns_key_hmac_key, ldns_key_origttl, ldns_key_inception, ldns_key_expiration, ldns_key_keytag, ldns_key_pubkey_owner, ldns_key_flags \- read ldns_keys
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_key_list_key_count(const ldns_key_list *key_list);
+.PP
+ldns_key* ldns_key_list_key(const ldns_key_list *key, size_t nr);
+.PP
+RSA* ldns_key_rsa_key(const ldns_key *k);
+.PP
+DSA* ldns_key_dsa_key(const ldns_key *k);
+.PP
+ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k);
+.PP
+unsigned char* ldns_key_hmac_key(const ldns_key *k);
+.PP
+uint32_t ldns_key_origttl(const ldns_key *k);
+.PP
+uint32_t ldns_key_inception(const ldns_key *k);
+.PP
+uint32_t ldns_key_expiration(const ldns_key *k);
+.PP
+uint16_t ldns_key_keytag(const ldns_key *k);
+.PP
+ldns_rdf* ldns_key_pubkey_owner(const ldns_key *k);
+.PP
+uint16_t ldns_key_flags(const ldns_key *k);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_list_key_count\fR()
+returns the number of keys in the key list
+\.br
+\fBkey_list\fR: the key_list
+\.br
+Returns the numbers of keys in the list
+.PP
+.HP
+\fIldns_key_list_key\fR()
+returns a pointer to the key in the list at the given position
+\.br
+\fBkey\fR: the key
+\.br
+\fBnr\fR: the position in the list
+\.br
+Returns the key
+.PP
+.HP
+\fIldns_key_rsa_key\fR()
+returns the (openssl) \%RSA struct contained in the key
+\.br
+\fBk\fR: the key to look in
+\.br
+Returns the \%RSA * structure in the key
+.PP
+.HP
+\fIldns_key_dsa_key\fR()
+returns the (openssl) \%DSA struct contained in the key
+.PP
+.HP
+\fIldns_key_algorithm\fR()
+return the signing alg of the key
+\.br
+\fBk\fR: the key
+\.br
+Returns the algorithm
+.PP
+.HP
+\fIldns_key_hmac_key\fR()
+return the hmac key data
+\.br
+\fBk\fR: the key
+\.br
+Returns the hmac key data
+.PP
+.HP
+\fIldns_key_origttl\fR()
+return the original ttl of the key
+\.br
+\fBk\fR: the key
+\.br
+Returns the original ttl
+.PP
+.HP
+\fIldns_key_inception\fR()
+return the key's inception date
+\.br
+\fBk\fR: the key
+\.br
+Returns the inception date
+.PP
+.HP
+\fIldns_key_expiration\fR()
+return the key's expiration date
+\.br
+\fBk\fR: the key
+\.br
+Returns the expiration date
+.PP
+.HP
+\fIldns_key_keytag\fR()
+return the keytag
+\.br
+\fBk\fR: the key
+\.br
+Returns the keytag
+.PP
+.HP
+\fIldns_key_pubkey_owner\fR()
+return the public key's owner
+\.br
+\fBk\fR: the key
+\.br
+Returns the owner
+.PP
+.HP
+\fIldns_key_flags\fR()
+return the flag of the key
+\.br
+\fBk\fR: the key
+\.br
+Returns the flag
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_new.3 b/contrib/ldns/doc/man/man3/ldns_key_list_new.3
new file mode 100644
index 00000000000000..07b6fbba3ed743
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_new.3
@@ -0,0 +1,39 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_list_new \- create a ldns_key_list
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_key_list_new();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_list_new\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_pop_key.3 b/contrib/ldns/doc/man/man3/ldns_key_list_pop_key.3
new file mode 120000
index 00000000000000..ef5cc0b8a08f66
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_pop_key.3
@@ -0,0 +1 @@
+ldns_key_list_push_key.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_push_key.3 b/contrib/ldns/doc/man/man3/ldns_key_list_push_key.3
new file mode 100644
index 00000000000000..08a6598d3924e5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_push_key.3
@@ -0,0 +1,58 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_list_push_key, ldns_key_list_pop_key \- manipulate ldns_key_list
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key);
+.PP
+ldns_key* ldns_key_list_pop_key(ldns_key_list *key_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_list_push_key\fR()
+pushes a key to a keylist
+\.br
+\fBkey_list\fR: the key_list to push to 
+\.br
+\fBkey\fR: the key to push 
+\.br
+Returns false on error, otherwise true
+.PP
+.HP
+\fIldns_key_list_pop_key\fR()
+pops the last rr from a keylist
+\.br
+\fBkey_list\fR: the rr_list to pop from
+\.br
+Returns \%NULL if nothing to pop. Otherwise the popped \%RR
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_list_set_key_count.3 b/contrib/ldns/doc/man/man3/ldns_key_list_set_key_count.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_list_set_key_count.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new.3 b/contrib/ldns/doc/man/man3/ldns_key_new.3
new file mode 100644
index 00000000000000..c4df39a25d16cd
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new.3
@@ -0,0 +1,139 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_new, ldns_key_new_frm_algorithm, ldns_key_new_frm_fp, ldns_key_new_frm_fp_l, ldns_key_new_frm_fp_rsa, ldns_key_new_frm_fp_rsa_l, ldns_key_new_frm_fp_dsa, ldns_key_new_frm_fp_dsa_l \- create a ldns_key
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_key* ldns_key_new(void);
+.PP
+ldns_key* ldns_key_new_frm_algorithm(ldns_signing_algorithm a, uint16_t size);
+.PP
+ldns_status ldns_key_new_frm_fp(ldns_key **k, FILE *fp);
+.PP
+ldns_status ldns_key_new_frm_fp_l(ldns_key **k, FILE *fp, int *line_nr);
+.PP
+RSA* ldns_key_new_frm_fp_rsa(FILE *fp);
+.PP
+RSA* ldns_key_new_frm_fp_rsa_l(FILE *fp, int *line_nr);
+.PP
+DSA* ldns_key_new_frm_fp_dsa(FILE *fp);
+.PP
+DSA* ldns_key_new_frm_fp_dsa_l(FILE *fp, int *line_nr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_new\fR()
+Creates a new empty key structure
+\.br
+Returns a new ldns_key * structure
+.PP
+.HP
+\fIldns_key_new_frm_algorithm\fR()
+Creates a new key based on the algorithm
+
+\.br
+\fBa\fR: The algorithm to use
+\.br
+\fBsize\fR: the number of bytes for the keysize
+\.br
+Returns a new ldns_key structure with the key
+.PP
+.HP
+\fIldns_key_new_frm_fp\fR()
+Creates a new priv key based on the 
+contents of the file pointed by fp.
+
+The file should be in Private-key-format v1.x.
+
+\.br
+\fBk\fR: the new ldns_key structure
+\.br
+\fBfp\fR: the file pointer to use
+\.br
+Returns an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_key_new_frm_fp_l\fR()
+Creates a new private key based on the 
+contents of the file pointed by fp
+
+The file should be in Private-key-format v1.x.
+
+\.br
+\fBk\fR: the new ldns_key structure
+\.br
+\fBfp\fR: the file pointer to use
+\.br
+\fBline_nr\fR: pointer to an integer containing the current line number (for debugging purposes)
+\.br
+Returns an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_key_new_frm_fp_rsa\fR()
+frm_fp helper function. This function parses the
+remainder of the (\%RSA) priv. key file generated from bind9
+\.br
+\fBfp\fR: the file to parse
+\.br
+Returns \%NULL on failure otherwise a \%RSA structure
+.PP
+.HP
+\fIldns_key_new_frm_fp_rsa_l\fR()
+frm_fp helper function. This function parses the
+remainder of the (\%RSA) priv. key file generated from bind9
+\.br
+\fBfp\fR: the file to parse
+\.br
+\fBline_nr\fR: pointer to an integer containing the current line number (for debugging purposes)
+\.br
+Returns \%NULL on failure otherwise a \%RSA structure
+.PP
+.HP
+\fIldns_key_new_frm_fp_dsa\fR()
+frm_fp helper function. This function parses the
+remainder of the (\%DSA) priv. key file
+\.br
+\fBfp\fR: the file to parse
+\.br
+Returns \%NULL on failure otherwise a \%RSA structure
+.PP
+.HP
+\fIldns_key_new_frm_fp_dsa_l\fR()
+frm_fp helper function. This function parses the
+remainder of the (\%DSA) priv. key file
+\.br
+\fBfp\fR: the file to parse
+\.br
+\fBline_nr\fR: pointer to an integer containing the current line number (for debugging purposes)
+\.br
+Returns \%NULL on failure otherwise a \%RSA structure
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_algorithm.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_algorithm.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa_l.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa_l.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_dsa_l.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_l.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_l.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_l.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa_l.3 b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa_l.3
new file mode 120000
index 00000000000000..41446c9acb8e1e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_new_frm_fp_rsa_l.3
@@ -0,0 +1 @@
+ldns_key_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_origttl.3 b/contrib/ldns/doc/man/man3/ldns_key_origttl.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_origttl.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_print.3 b/contrib/ldns/doc/man/man3/ldns_key_print.3
new file mode 100644
index 00000000000000..17351478c555ad
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_print.3
@@ -0,0 +1,47 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_print \- print a ldns_key
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_key_print(FILE *output, const ldns_key *k);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_print\fR()
+print a private key to the file output
+
+\.br
+\fBoutput\fR: the \%FILE descriptor where to print to
+\.br
+\fBk\fR: the ldns_key to print
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key_new\fR, \fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_pubkey_owner.3 b/contrib/ldns/doc/man/man3/ldns_key_pubkey_owner.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_pubkey_owner.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_rr2ds.3 b/contrib/ldns/doc/man/man3/ldns_key_rr2ds.3
new file mode 100644
index 00000000000000..5757e5c5a438a3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_rr2ds.3
@@ -0,0 +1,50 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_rr2ds \- create DS rr from DNSKEY rr
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr* ldns_key_rr2ds(const ldns_rr *key, ldns_hash h);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_rr2ds\fR()
+returns a new \%DS rr that represents the given key rr.
+
+\.br
+\fB*key\fR: the key to convert
+\.br
+\fBh\fR: the hash to use LDNS_SHA1/LDNS_SHA256
+
+\.br
+Returns ldns_rr* a new rr pointer to a \%DS
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_rsa_key.3 b/contrib/ldns/doc/man/man3/ldns_key_rsa_key.3
new file mode 120000
index 00000000000000..3f6ce86cb23137
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_rsa_key.3
@@ -0,0 +1 @@
+ldns_key_list_key_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_key_set_algorithm.3
new file mode 100644
index 00000000000000..f0dd76ed0cbf83
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_algorithm.3
@@ -0,0 +1,158 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_key_set_algorithm, ldns_key_set_rsa_key, ldns_key_set_dsa_key, ldns_key_set_hmac_key, ldns_key_set_origttl, ldns_key_set_inception, ldns_key_set_expiration, ldns_key_set_pubkey_owner, ldns_key_set_keytag, ldns_key_set_flags, ldns_key_list_set_key_count, ldns_key_algo_supported \- set ldns_key attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l);
+.PP
+void ldns_key_set_rsa_key(ldns_key *k, RSA *r);
+.PP
+void ldns_key_set_dsa_key(ldns_key *k, DSA *d);
+.PP
+void ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac);
+.PP
+void ldns_key_set_origttl(ldns_key *k, uint32_t t);
+.PP
+void ldns_key_set_inception(ldns_key *k, uint32_t i);
+.PP
+void ldns_key_set_expiration(ldns_key *k, uint32_t e);
+.PP
+void ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r);
+.PP
+void ldns_key_set_keytag(ldns_key *k, uint16_t tag);
+.PP
+void ldns_key_set_flags(ldns_key *k, uint16_t flags);
+.PP
+void ldns_key_list_set_key_count(ldns_key_list *key, size_t count);
+.PP
+int ldns_key_algo_supported(int algo);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_key_set_algorithm\fR()
+Set the key's algorithm
+\.br
+\fBk\fR: the key
+\.br
+\fBl\fR: the algorithm
+.PP
+.HP
+\fIldns_key_set_rsa_key\fR()
+Set the key's rsa data.
+The rsa data should be freed by the user.
+\.br
+\fBk\fR: the key
+\.br
+\fBr\fR: the rsa data
+.PP
+.HP
+\fIldns_key_set_dsa_key\fR()
+Set the key's dsa data
+The dsa data should be freed by the user.
+\.br
+\fBk\fR: the key
+\.br
+\fBd\fR: the dsa data
+.PP
+.HP
+\fIldns_key_set_hmac_key\fR()
+Set the key's hmac data
+\.br
+\fBk\fR: the key
+\.br
+\fBhmac\fR: the raw key data
+.PP
+.HP
+\fIldns_key_set_origttl\fR()
+Set the key's original ttl
+\.br
+\fBk\fR: the key
+\.br
+\fBt\fR: the ttl
+.PP
+.HP
+\fIldns_key_set_inception\fR()
+Set the key's inception date (seconds after epoch)
+\.br
+\fBk\fR: the key
+\.br
+\fBi\fR: the inception
+.PP
+.HP
+\fIldns_key_set_expiration\fR()
+Set the key's expiration date (seconds after epoch)
+\.br
+\fBk\fR: the key
+\.br
+\fBe\fR: the expiration
+.PP
+.HP
+\fIldns_key_set_pubkey_owner\fR()
+Set the key's pubkey owner
+\.br
+\fBk\fR: the key
+\.br
+\fBr\fR: the owner
+.PP
+.HP
+\fIldns_key_set_keytag\fR()
+Set the key's key tag
+\.br
+\fBk\fR: the key
+\.br
+\fBtag\fR: the keytag
+.PP
+.HP
+\fIldns_key_set_flags\fR()
+Set the key's flags
+\.br
+\fBk\fR: the key
+\.br
+\fBflags\fR: the flags
+.PP
+.HP
+\fIldns_key_list_set_key_count\fR()
+Set the keylist's key count to count
+\.br
+\fBkey\fR: the key
+\.br
+\fBcount\fR: the count
+.PP
+.HP
+\fIldns_key_algo_supported\fR()
+See if a key algorithm is supported
+\.br
+\fBalgo\fR: the signing algorithm number.
+\.br
+Returns s true if supported.
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key_push_key\fR, \fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_dsa_key.3 b/contrib/ldns/doc/man/man3/ldns_key_set_dsa_key.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_dsa_key.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_expiration.3 b/contrib/ldns/doc/man/man3/ldns_key_set_expiration.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_expiration.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_flags.3 b/contrib/ldns/doc/man/man3/ldns_key_set_flags.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_flags.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_hmac_key.3 b/contrib/ldns/doc/man/man3/ldns_key_set_hmac_key.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_hmac_key.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_inception.3 b/contrib/ldns/doc/man/man3/ldns_key_set_inception.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_inception.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_keytag.3 b/contrib/ldns/doc/man/man3/ldns_key_set_keytag.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_keytag.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_origttl.3 b/contrib/ldns/doc/man/man3/ldns_key_set_origttl.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_origttl.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_pubkey_owner.3 b/contrib/ldns/doc/man/man3/ldns_key_set_pubkey_owner.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_pubkey_owner.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_key_set_rsa_key.3 b/contrib/ldns/doc/man/man3/ldns_key_set_rsa_key.3
new file mode 120000
index 00000000000000..cead7168496058
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_key_set_rsa_key.3
@@ -0,0 +1 @@
+ldns_key_set_algorithm.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_native2rdf_int16.3 b/contrib/ldns/doc/man/man3/ldns_native2rdf_int16.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_native2rdf_int16.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_native2rdf_int16_data.3 b/contrib/ldns/doc/man/man3/ldns_native2rdf_int16_data.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_native2rdf_int16_data.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_native2rdf_int32.3 b/contrib/ldns/doc/man/man3/ldns_native2rdf_int32.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_native2rdf_int32.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_native2rdf_int8.3 b/contrib/ldns/doc/man/man3/ldns_native2rdf_int8.3
new file mode 100644
index 00000000000000..73495978e8ac95
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_native2rdf_int8.3
@@ -0,0 +1,136 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_native2rdf_int8, ldns_native2rdf_int16, ldns_native2rdf_int32, ldns_native2rdf_int16_data, ldns_rdf2native_int8, ldns_rdf2native_int16, ldns_rdf2native_int32, ldns_rdf2native_sockaddr_storage, ldns_rdf2native_time_t \- rdf numeric conversion functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value);
+.PP
+ldns_rdf* ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value);
+.PP
+ldns_rdf* ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value);
+.PP
+ldns_rdf* ldns_native2rdf_int16_data(size_t size, uint8_t *data);
+.PP
+uint8_t ldns_rdf2native_int8(const ldns_rdf *rd);
+.PP
+uint16_t ldns_rdf2native_int16(const ldns_rdf *rd);
+.PP
+uint32_t ldns_rdf2native_int32(const ldns_rdf *rd);
+.PP
+ ldns_rdf2native_sockaddr_storage();
+.PP
+time_t ldns_rdf2native_time_t(const ldns_rdf *rd);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_native2rdf_int8\fR()
+returns the rdf containing the native uint8_t repr.
+\.br
+\fBtype\fR: the ldns_rdf type to use
+\.br
+\fBvalue\fR: the uint8_t to use
+\.br
+Returns ldns_rdf* with the converted value
+.PP
+.HP
+\fIldns_native2rdf_int16\fR()
+returns the rdf containing the native uint16_t representation.
+\.br
+\fBtype\fR: the ldns_rdf type to use
+\.br
+\fBvalue\fR: the uint16_t to use
+\.br
+Returns ldns_rdf* with the converted value
+.PP
+.HP
+\fIldns_native2rdf_int32\fR()
+returns an rdf that contains the given int32 value.
+
+Because multiple rdf types can contain an int32, the
+type must be specified
+\.br
+\fBtype\fR: the ldns_rdf type to use
+\.br
+\fBvalue\fR: the uint32_t to use
+\.br
+Returns ldns_rdf* with the converted value
+.PP
+.HP
+\fIldns_native2rdf_int16_data\fR()
+returns an int16_data rdf that contains the data in the
+given array, preceded by an int16 specifying the length.
+
+The memory is copied, and an LDNS_RDF_TYPE_INT16DATA is returned
+\.br
+\fBsize\fR: the size of the data
+\.br
+\fB*data\fR: pointer to the actual data
+
+\.br
+Returns ldns_rd* the rdf with the data
+.PP
+.HP
+\fIldns_rdf2native_int8\fR()
+returns the native uint8_t representation from the rdf.
+\.br
+\fBrd\fR: the ldns_rdf to operate on
+\.br
+Returns uint8_t the value extracted
+.PP
+.HP
+\fIldns_rdf2native_int16\fR()
+returns the native uint16_t representation from the rdf.
+\.br
+\fBrd\fR: the ldns_rdf to operate on
+\.br
+Returns uint16_t the value extracted
+.PP
+.HP
+\fIldns_rdf2native_int32\fR()
+returns the native uint32_t representation from the rdf.
+\.br
+\fBrd\fR: the ldns_rdf to operate on
+\.br
+Returns uint32_t the value extracted
+.PP
+.HP
+\fIldns_rdf2native_sockaddr_storage\fR()
+.PP
+.HP
+\fIldns_rdf2native_time_t\fR()
+returns the native time_t representation from the rdf.
+\.br
+\fBrd\fR: the ldns_rdf to operate on
+\.br
+Returns time_t the value extracted (32 bits currently)
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_octet.3 b/contrib/ldns/doc/man/man3/ldns_octet.3
new file mode 100644
index 00000000000000..8dab5d94302f42
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_octet.3
@@ -0,0 +1,49 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_octet \- removes escaped from the input
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_octet(char *word, size_t *length);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_octet\fR()
+removes \\\\\%DDD, \\\\[space] and other escapes from the input.
+See \%RFC 1035, section 5.1.
+\.br
+\fBword\fR: what to check
+\.br
+\fBlength\fR: the string
+\.br
+Returns ldns_status mesg
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt.3 b/contrib/ldns/doc/man/man3/ldns_pkt.3
new file mode 100644
index 00000000000000..abd24ef945849b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt.3
@@ -0,0 +1,139 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt, ldns_pkt_section, ldns_pkt_type \- request or answer packets types
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_pkt_section();
+.PP
+ ldns_pkt_type();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt\fR
+.br
+DNS packet
+.br
+
+.br
+This structure contains a complete DNS packet (either a query or an answer)
+.br
+
+.br
+It is the complete representation of what you actually send to a
+.br
+nameserver, and what it sends back (assuming you are the client here).
+.br
+struct ldns_struct_pkt
+.br
+{
+.br
+	\fBHeader section:\fR
+.br
+	ldns_hdr *_header;
+.br
+	/* extra items needed in a packet */
+.br
+	\fBan rdf (A or AAAA) with the IP address of the server it is from:\fR
+.br
+	ldns_rdf *_answerfrom;
+.br
+        \fBTimestamp of the time the packet was sent or created:\fR
+.br
+	struct timeval timestamp;
+.br
+	\fBThe duration of the query this packet is an answer to:\fR
+.br
+	uint32_t _querytime;
+.br
+	\fBThe size of the wire format of the packet in octets:\fR
+.br
+	size_t _size;
+.br
+	\fBOptional tsig rr:\fR
+.br
+	ldns_rr *_tsig_rr;
+.br
+	\fBEDNS0 available buffer size, see RFC2671:\fR
+.br
+	uint16_t _edns_udp_size;
+.br
+	\fBEDNS0 Extended rcode:\fR
+.br
+	uint8_t _edns_extended_rcode;
+.br
+	\fBEDNS Version:\fR
+.br
+	uint8_t _edns_version;
+.br
+	/* OPT pseudo-RR presence flag */
+.br
+	uint8_t _edns_present;
+.br
+	\fBReserved EDNS data bits:\fR
+.br
+	uint16_t _edns_z;
+.br
+	\fBArbitrary EDNS rdata:\fR
+.br
+	ldns_rdf *_edns_data;
+.br
+	\fBStructed EDNS data:\fR
+.br
+	ldns_edns_option_list *_edns_list;
+.br
+	\fBQuestion section:\fR
+.br
+	ldns_rr_list	*_question;
+.br
+	\fBAnswer section:\fR
+.br
+	ldns_rr_list	*_answer;
+.br
+	\fBAuthority section:\fR
+.br
+	ldns_rr_list	*_authority;
+.br
+	\fBAdditional section:\fR
+.br
+	ldns_rr_list	*_additional;
+.br
+};
+.br
+typedef struct ldns_struct_pkt ldns_pkt;
+.PP
+.HP
+\fIldns_pkt_section\fR()
+.PP
+.HP
+\fIldns_pkt_type\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt_new\fR, \fIldns_pkt_free\fR, \fIldns_pkt_print\fR, \fIldns_pkt_query_new\fR, \fIldns_pkt_query_new_frm_str\fR, \fIldns_pkt_reply_type\fR, \fIldns_pkt_id\fR, \fIldns_pkt_qr\fR, \fIldns_pkt_aa\fR, \fIldns_pkt_tc\fR, \fIldns_pkt_rd\fR, \fIldns_pkt_cd\fR, \fIldns_pkt_ra\fR, \fIldns_pkt_ad\fR, \fIldns_pkt_get_opcode\fR, \fIldns_pkt_get_rcode\fR, \fIldns_pkt_qdcount\fR, \fIldns_pkt_ancount\fR, \fIldns_pkt_nscount\fR, \fIldns_pkt_arcount\fR, \fIldns_pkt_answerfrom\fR, \fIldns_pkt_querytime\fR, \fIldns_pkt_size\fR, \fIldns_pkt_tsig\fR, \fIldns_pkt_question\fR, \fIldns_pkt_answer\fR, \fIldns_pkt_authority\fR, \fIldns_pkt_additional\fR, \fIldns_pkt_get_section_clone\fR, \fIldns_pkt_rr_list_by_name\fR, \fIldns_pkt_rr_list_by_type\fR, \fIldns_pkt_rr_list_by_name_and_type\fR, \fIldns_pkt_set_flags\fR, \fIldns_pkt_set_id\fR, \fIldns_pkt_set_qr\fR, \fIldns_pkt_set_aa\fR, \fIldns_pkt_set_tc\fR, \fIldns_pkt_set_rd\fR, \fIldns_pkt_set_cd\fR, \fIldns_pkt_set_ra\fR, \fIldns_pkt_set_ad\fR, \fIldns_pkt_set_opcode\fR, \fIldns_pkt_set_rcode\fR, \fIldns_pkt_set_qdcount\fR, \fIldns_pkt_set_ancount\fR, \fIldns_pkt_set_nscount\fR, \fIldns_pkt_set_arcount\fR, \fIldns_pkt_set_answerfrom\fR, \fIldns_pkt_set_querytime\fR, \fIldns_pkt_set_size\fR, \fIldns_pkt_set_section_count\fR, \fIldns_pkt_set_tsig\fR, \fIldns_pkt_edns\fR, \fIldns_pkt_edns_udp_size\fR, \fIldns_pkt_edns_extended_rcode\fR, \fIldns_pkt_edns_version\fR, \fIldns_pkt_edns_z\fR, \fIldns_pkt_edns_unassigned\fR, \fIldns_pkt_edns_data\fR, \fIldns_pkt_set_edns_udp_size\fR, \fIldns_pkt_set_edns_extended_rcode\fR, \fIldns_pkt_set_edns_version\fR, \fIldns_pkt_set_edns_z\fR, \fIldns_pkt_set_edns_unassigned\fR, \fIldns_pkt_set_edns_data\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_pkt2buffer_str.3
new file mode 100644
index 00000000000000..913790a86d13dd
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt2buffer_str.3
@@ -0,0 +1,188 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt2buffer_str, ldns_pktheader2buffer_str, ldns_rr2buffer_str, ldns_rr_list2buffer_str, ldns_rdf2buffer_str, ldns_key2buffer_str, ldns_pkt2buffer_wire, ldns_rr2buffer_wire, ldns_rdf2buffer_wire, ldns_rrsig2buffer_wire, ldns_rr_rdata2buffer_wire \- lower level conversions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_pkt2buffer_str(ldns_buffer *output, const ldns_pkt *pkt);
+.PP
+ldns_status ldns_pktheader2buffer_str(ldns_buffer *output, const ldns_pkt *pkt);
+.PP
+ldns_status ldns_rr2buffer_str(ldns_buffer *output, const ldns_rr *rr);
+.PP
+ldns_status ldns_rr_list2buffer_str(ldns_buffer *output, const ldns_rr_list *list);
+.PP
+ldns_status ldns_rdf2buffer_str(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k);
+.PP
+ldns_status ldns_pkt2buffer_wire(ldns_buffer *output, const ldns_pkt *pkt);
+.PP
+ldns_status ldns_rr2buffer_wire(ldns_buffer *output, const ldns_rr *rr, int section);
+.PP
+ldns_status ldns_rdf2buffer_wire(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rrsig2buffer_wire(ldns_buffer *output, const ldns_rr *sigrr);
+.PP
+ldns_status ldns_rr_rdata2buffer_wire(ldns_buffer *output, const ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt2buffer_str\fR()
+Converts the data in the \%DNS packet to presentation
+format (as char *) and appends it to the given buffer
+
+\.br
+\fBoutput\fR: pointer to the buffer to append the data to
+\.br
+\fBpkt\fR: the pointer to the packet to convert
+\.br
+Returns status
+.PP
+.HP
+\fIldns_pktheader2buffer_str\fR()
+Converts the header of a packet to presentation format and appends it to
+the output buffer
+\.br
+\fBoutput\fR: the buffer to append output to
+\.br
+\fBpkt\fR: the packet to convert the header of
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rr2buffer_str\fR()
+Converts the data in the resource record to presentation
+format (as char *) and appends it to the given buffer.
+The presentation format of \%DNSKEY record is annotated with comments giving
+the id, type and size of the key.
+
+\.br
+\fBoutput\fR: pointer to the buffer to append the data to
+\.br
+\fBrr\fR: the pointer to the rr field to convert
+\.br
+Returns status
+.PP
+.HP
+\fIldns_rr_list2buffer_str\fR()
+Converts a rr_list to presentation format and appends it to
+the output buffer
+\.br
+\fBoutput\fR: the buffer to append output to
+\.br
+\fBlist\fR: the ldns_rr_list to print
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rdf2buffer_str\fR()
+Converts the data in the rdata field to presentation
+format (as char *) and appends it to the given buffer
+
+\.br
+\fBoutput\fR: pointer to the buffer to append the data to
+\.br
+\fBrdf\fR: the pointer to the rdafa field containing the data
+\.br
+Returns status
+.PP
+.HP
+\fIldns_key2buffer_str\fR()
+Converts the data in the \%DNS packet to presentation
+format (as char *) and appends it to the given buffer
+
+\.br
+\fBoutput\fR: pointer to the buffer to append the data to
+\.br
+\fBk\fR: the pointer to the private key to convert
+\.br
+Returns status
+.PP
+.HP
+\fIldns_pkt2buffer_wire\fR()
+Copies the packet data to the buffer in wire format
+\.br
+\fB*output\fR: buffer to append the result to
+\.br
+\fB*pkt\fR: packet to convert
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rr2buffer_wire\fR()
+Copies the rr data to the buffer in wire format
+\.br
+\fB*output\fR: buffer to append the result to
+\.br
+\fB*rr\fR: resource record to convert
+\.br
+\fBsection\fR: the section in the packet this rr is supposed to be in
+(to determine whether to add rdata or not)
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rdf2buffer_wire\fR()
+Copies the rdata data to the buffer in wire format
+\.br
+\fB*output\fR: buffer to append the result to
+\.br
+\fB*rdf\fR: rdata to convert
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rrsig2buffer_wire\fR()
+Converts a rrsig to wireformat \%BUT \%EXCLUDE the rrsig rdata
+This is needed in \%DNSSEC verification
+\.br
+\fBoutput\fR: buffer to append the result to
+\.br
+\fBsigrr\fR: signature rr to operate on
+\.br
+Returns ldns_status
+.PP
+.HP
+\fIldns_rr_rdata2buffer_wire\fR()
+Converts an rr's rdata to wireformat, while excluding
+the ownername and all the stuff before the rdata.
+This is needed in \%DNSSEC keytag calculation, the ds
+calculation from the key and maybe elsewhere.
+
+\.br
+\fB*output\fR: buffer where to put the result
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+Returns ldns_status
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt2str\fR, \fIldns_rr2str\fR, \fIldns_rdf2str\fR, \fIldns_rr_list2str\fR, \fIldns_key2str\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt2buffer_wire.3 b/contrib/ldns/doc/man/man3/ldns_pkt2buffer_wire.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt2buffer_wire.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt2str.3 b/contrib/ldns/doc/man/man3/ldns_pkt2str.3
new file mode 120000
index 00000000000000..b2208d56a9d787
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt2str.3
@@ -0,0 +1 @@
+ldns_rr2str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt2wire.3 b/contrib/ldns/doc/man/man3/ldns_pkt2wire.3
new file mode 120000
index 00000000000000..c36af5febfbcea
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt2wire.3
@@ -0,0 +1 @@
+ldns_rr2wire.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_aa.3 b/contrib/ldns/doc/man/man3/ldns_pkt_aa.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_aa.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_ad.3 b/contrib/ldns/doc/man/man3/ldns_pkt_ad.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_ad.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_additional.3 b/contrib/ldns/doc/man/man3/ldns_pkt_additional.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_additional.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_ancount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_ancount.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_ancount.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_answer.3 b/contrib/ldns/doc/man/man3/ldns_pkt_answer.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_answer.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_answerfrom.3 b/contrib/ldns/doc/man/man3/ldns_pkt_answerfrom.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_answerfrom.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_arcount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_arcount.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_arcount.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_authority.3 b/contrib/ldns/doc/man/man3/ldns_pkt_authority.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_authority.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_cd.3 b/contrib/ldns/doc/man/man3/ldns_pkt_cd.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_cd.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns.3
new file mode 100644
index 00000000000000..3a6c7e905e77a7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns.3
@@ -0,0 +1,150 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_edns, ldns_pkt_edns_udp_size, ldns_pkt_edns_extended_rcode, ldns_pkt_edns_version, ldns_pkt_edns_z, ldns_pkt_edns_data, ldns_pkt_set_edns_udp_size, ldns_pkt_set_edns_extended_rcode, ldns_pkt_set_edns_version, ldns_pkt_set_edns_z, ldns_pkt_set_edns_data \- ldns_pkt ends0 related functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_pkt_edns(const ldns_pkt *packet);
+.PP
+uint16_t ldns_pkt_edns_udp_size(const ldns_pkt *packet);
+.PP
+uint8_t ldns_pkt_edns_extended_rcode(const ldns_pkt *packet);
+.PP
+uint8_t ldns_pkt_edns_version(const ldns_pkt *packet);
+.PP
+uint16_t ldns_pkt_edns_z(const ldns_pkt *packet);
+.PP
+ldns_rdf* ldns_pkt_edns_data(const ldns_pkt *packet);
+.PP
+void ldns_pkt_set_edns_udp_size(ldns_pkt *packet, uint16_t s);
+.PP
+void ldns_pkt_set_edns_extended_rcode(ldns_pkt *packet, uint8_t c);
+.PP
+void ldns_pkt_set_edns_version(ldns_pkt *packet, uint8_t v);
+.PP
+void ldns_pkt_set_edns_z(ldns_pkt *packet, uint16_t z);
+.PP
+void ldns_pkt_set_edns_data(ldns_pkt *packet, ldns_rdf *data);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_edns\fR()
+returns true if this packet needs and \%EDNS rr to be sent.
+At the moment the only reason is an expected packet
+size larger than 512 bytes, but for instance dnssec would
+be a good reason too.
+
+\.br
+\fBpacket\fR: the packet to check
+\.br
+Returns true if packet needs edns rr
+.PP
+.HP
+\fIldns_pkt_edns_udp_size\fR()
+return the packet's edns udp size
+\.br
+\fBpacket\fR: the packet
+\.br
+Returns the size
+.PP
+.HP
+\fIldns_pkt_edns_extended_rcode\fR()
+return the packet's edns extended rcode
+\.br
+\fBpacket\fR: the packet
+\.br
+Returns the rcode
+.PP
+.HP
+\fIldns_pkt_edns_version\fR()
+return the packet's edns version
+\.br
+\fBpacket\fR: the packet
+\.br
+Returns the version
+.PP
+.HP
+\fIldns_pkt_edns_z\fR()
+return the packet's edns z value
+\.br
+\fBpacket\fR: the packet
+\.br
+Returns the z value
+.PP
+.HP
+\fIldns_pkt_edns_data\fR()
+return the packet's \%EDNS data
+\.br
+\fBpacket\fR: the packet
+\.br
+Returns the data
+.PP
+.HP
+\fIldns_pkt_set_edns_udp_size\fR()
+Set the packet's edns udp size
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBs\fR: the size
+.PP
+.HP
+\fIldns_pkt_set_edns_extended_rcode\fR()
+Set the packet's edns extended rcode
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBc\fR: the code
+.PP
+.HP
+\fIldns_pkt_set_edns_version\fR()
+Set the packet's edns version
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBv\fR: the version
+.PP
+.HP
+\fIldns_pkt_set_edns_z\fR()
+Set the packet's edns z value
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBz\fR: the value
+.PP
+.HP
+\fIldns_pkt_set_edns_data\fR()
+Set the packet's \%EDNS data
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBdata\fR: the data
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns_data.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns_data.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns_data.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns_extended_rcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns_extended_rcode.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns_extended_rcode.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns_udp_size.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns_udp_size.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns_udp_size.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns_version.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns_version.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns_version.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_edns_z.3 b/contrib/ldns/doc/man/man3/ldns_pkt_edns_z.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_edns_z.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_free.3 b/contrib/ldns/doc/man/man3/ldns_pkt_free.3
new file mode 120000
index 00000000000000..76d296dc410cc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_free.3
@@ -0,0 +1 @@
+ldns_pkt_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_get_opcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_get_opcode.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_get_opcode.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_get_rcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_get_rcode.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_get_rcode.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_get_section_clone.3 b/contrib/ldns/doc/man/man3/ldns_pkt_get_section_clone.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_get_section_clone.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_id.3 b/contrib/ldns/doc/man/man3/ldns_pkt_id.3
new file mode 100644
index 00000000000000..18792e39bd11cf
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_id.3
@@ -0,0 +1,311 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_id, ldns_pkt_qr, ldns_pkt_aa, ldns_pkt_tc, ldns_pkt_rd, ldns_pkt_cd, ldns_pkt_ra, ldns_pkt_ad, ldns_pkt_get_opcode, ldns_pkt_get_rcode, ldns_pkt_qdcount, ldns_pkt_ancount, ldns_pkt_nscount, ldns_pkt_arcount, ldns_pkt_answerfrom, ldns_pkt_querytime, ldns_pkt_size, ldns_pkt_tsig, ldns_pkt_question, ldns_pkt_answer, ldns_pkt_authority, ldns_pkt_additional, ldns_pkt_get_section_clone, ldns_pkt_rr_list_by_name, ldns_pkt_rr_list_by_type, ldns_pkt_rr_list_by_name_and_type \- get ldns_pkt attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_pkt_id();
+.PP
+bool ldns_pkt_qr(const ldns_pkt *p);
+.PP
+bool ldns_pkt_aa(const ldns_pkt *p);
+.PP
+bool ldns_pkt_tc(const ldns_pkt *p);
+.PP
+bool ldns_pkt_rd(const ldns_pkt *p);
+.PP
+bool ldns_pkt_cd(const ldns_pkt *p);
+.PP
+bool ldns_pkt_ra(const ldns_pkt *p);
+.PP
+bool ldns_pkt_ad(const ldns_pkt *p);
+.PP
+ldns_pkt_opcode ldns_pkt_get_opcode(const ldns_pkt *p);
+.PP
+ldns_pkt_rcode ldns_pkt_get_rcode(const ldns_pkt *p);
+.PP
+uint16_t ldns_pkt_qdcount(const ldns_pkt *p);
+.PP
+uint16_t ldns_pkt_ancount(const ldns_pkt *p);
+.PP
+uint16_t ldns_pkt_nscount(const ldns_pkt *p);
+.PP
+uint16_t ldns_pkt_arcount(const ldns_pkt *p);
+.PP
+ldns_rdf* ldns_pkt_answerfrom(const ldns_pkt *p);
+.PP
+uint32_t ldns_pkt_querytime(const ldns_pkt *p);
+.PP
+size_t ldns_pkt_size(const ldns_pkt *p);
+.PP
+ldns_rr* ldns_pkt_tsig(const ldns_pkt *p);
+.PP
+ldns_rr_list* ldns_pkt_question(const ldns_pkt *p);
+.PP
+ldns_rr_list* ldns_pkt_answer(const ldns_pkt *p);
+.PP
+ldns_rr_list* ldns_pkt_authority(const ldns_pkt *p);
+.PP
+ldns_rr_list* ldns_pkt_additional(const ldns_pkt *p);
+.PP
+ldns_rr_list* ldns_pkt_get_section_clone(const ldns_pkt *p, ldns_pkt_section s);
+.PP
+ldns_rr_list* ldns_pkt_rr_list_by_name(const ldns_pkt *p, const ldns_rdf *r, ldns_pkt_section s);
+.PP
+ldns_rr_list* ldns_pkt_rr_list_by_type(const ldns_pkt *p, ldns_rr_type t, ldns_pkt_section s);
+.PP
+ldns_rr_list* ldns_pkt_rr_list_by_name_and_type(const ldns_pkt *packet, const ldns_rdf *ownername, ldns_rr_type type, ldns_pkt_section sec);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_id\fR()
+.PP
+.HP
+\fIldns_pkt_qr\fR()
+Read the packet's qr bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_aa\fR()
+Read the packet's aa bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_tc\fR()
+Read the packet's tc bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_rd\fR()
+Read the packet's rd bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_cd\fR()
+Read the packet's cd bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_ra\fR()
+Read the packet's ra bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_ad\fR()
+Read the packet's ad bit
+\.br
+\fBp\fR: the packet
+\.br
+Returns value of the bit
+.PP
+.HP
+\fIldns_pkt_get_opcode\fR()
+Read the packet's code
+\.br
+\fBp\fR: the packet
+\.br
+Returns the opcode
+.PP
+.HP
+\fIldns_pkt_get_rcode\fR()
+Return the packet's response code
+\.br
+\fBp\fR: the packet
+\.br
+Returns the response code
+.PP
+.HP
+\fIldns_pkt_qdcount\fR()
+Return the packet's qd count 
+\.br
+\fBp\fR: the packet
+\.br
+Returns the qd count
+.PP
+.HP
+\fIldns_pkt_ancount\fR()
+Return the packet's an count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the an count
+.PP
+.HP
+\fIldns_pkt_nscount\fR()
+Return the packet's ns count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the ns count
+.PP
+.HP
+\fIldns_pkt_arcount\fR()
+Return the packet's ar count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the ar count
+.PP
+.HP
+\fIldns_pkt_answerfrom\fR()
+Return the packet's answerfrom
+\.br
+\fBp\fR: packet
+\.br
+Returns the name of the server
+.PP
+.HP
+\fIldns_pkt_querytime\fR()
+Return the packet's querytime
+\.br
+\fBp\fR: the packet
+\.br
+Returns the querytime
+.PP
+.HP
+\fIldns_pkt_size\fR()
+Return the packet's size in bytes
+\.br
+\fBp\fR: the packet
+\.br
+Returns the size
+.PP
+.HP
+\fIldns_pkt_tsig\fR()
+Return the packet's tsig pseudo rr's
+\.br
+\fBp\fR: the packet
+\.br
+Returns the tsig rr
+.PP
+.HP
+\fIldns_pkt_question\fR()
+Return the packet's question section
+\.br
+\fBp\fR: the packet
+\.br
+Returns the section
+.PP
+.HP
+\fIldns_pkt_answer\fR()
+Return the packet's answer section
+\.br
+\fBp\fR: the packet
+\.br
+Returns the section
+.PP
+.HP
+\fIldns_pkt_authority\fR()
+Return the packet's authority section
+\.br
+\fBp\fR: the packet
+\.br
+Returns the section
+.PP
+.HP
+\fIldns_pkt_additional\fR()
+Return the packet's additional section
+\.br
+\fBp\fR: the packet
+\.br
+Returns the section
+.PP
+.HP
+\fIldns_pkt_get_section_clone\fR()
+return all the rr_list's in the packet. Clone the lists, instead
+of returning pointers. 
+\.br
+\fBp\fR: the packet to look in
+\.br
+\fBs\fR: what section(s) to return
+\.br
+Returns ldns_rr_list with the rr's or \%NULL if none were found
+.PP
+.HP
+\fIldns_pkt_rr_list_by_name\fR()
+return all the rr with a specific name from a packet. Optionally
+specify from which section in the packet
+\.br
+\fBp\fR: the packet
+\.br
+\fBr\fR: the name
+\.br
+\fBs\fR: the packet's section
+\.br
+Returns a list with the rr's or \%NULL if none were found
+.PP
+.HP
+\fIldns_pkt_rr_list_by_type\fR()
+return all the rr with a specific type from a packet. Optionally
+specify from which section in the packet
+\.br
+\fBp\fR: the packet
+\.br
+\fBt\fR: the type
+\.br
+\fBs\fR: the packet's section
+\.br
+Returns a list with the rr's or \%NULL if none were found
+.PP
+.HP
+\fIldns_pkt_rr_list_by_name_and_type\fR()
+return all the rr with a specific type and type from a packet. Optionally
+specify from which section in the packet
+\.br
+\fBpacket\fR: the packet
+\.br
+\fBownername\fR: the name
+\.br
+\fBtype\fR: the type
+\.br
+\fBsec\fR: the packet's section
+\.br
+Returns a list with the rr's or \%NULL if none were found
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_new.3 b/contrib/ldns/doc/man/man3/ldns_pkt_new.3
new file mode 100644
index 00000000000000..c233682eba5c61
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_new.3
@@ -0,0 +1,114 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_new, ldns_pkt_free, ldns_pkt_print, ldns_pkt_query_new, ldns_pkt_query_new_frm_str, ldns_pkt_reply_type \- ldns_pkt creation, destruction and printing
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_pkt* ldns_pkt_new(void);
+.PP
+void ldns_pkt_free(ldns_pkt *packet);
+.PP
+void ldns_pkt_print(FILE *output, const ldns_pkt *pkt);
+.PP
+ldns_pkt* ldns_pkt_query_new(ldns_rdf *rr_name, ldns_rr_type rr_type, ldns_rr_class rr_class, uint16_t flags);
+.PP
+ldns_status ldns_pkt_query_new_frm_str(ldns_pkt **p, const char *rr_name, ldns_rr_type rr_type, ldns_rr_class rr_class , uint16_t flags);
+.PP
+ldns_pkt_type ldns_pkt_reply_type(const ldns_pkt *p);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_new\fR()
+allocates and initializes a ldns_pkt structure.
+\.br
+Returns pointer to the new packet
+.PP
+.HP
+\fIldns_pkt_free\fR()
+frees the packet structure and all data that it contains.
+\.br
+\fBpacket\fR: The packet structure to free
+\.br
+Returns void
+.PP
+.HP
+\fIldns_pkt_print\fR()
+Prints the data in the \%DNS packet to the given file stream
+(in presentation format)
+
+\.br
+\fBoutput\fR: the file stream to print to
+\.br
+\fBpkt\fR: the packet to print
+\.br
+Returns void
+.PP
+.HP
+\fIldns_pkt_query_new\fR()
+creates a packet with a query in it for the given name, type and class.
+\.br
+\fBrr_name\fR: the name to query for (not copied).
+The returned packet will take ownership of rr_name, so the caller should not free it.
+\.br
+\fBrr_type\fR: the type to query for
+\.br
+\fBrr_class\fR: the class to query for
+\.br
+\fBflags\fR: packet flags
+\.br
+Returns ldns_pkt* a pointer to the new pkt
+.PP
+.HP
+\fIldns_pkt_query_new_frm_str\fR()
+creates a query packet for the given name, type, class.
+\.br
+\fBp\fR: the packet to be returned
+\.br
+\fBrr_name\fR: the name to query for (as string)
+\.br
+\fBrr_type\fR: the type to query for
+\.br
+\fBrr_class\fR: the class to query for
+\.br
+\fBflags\fR: packet flags
+\.br
+Returns \%LDNS_STATUS_OK or a ldns_status mesg with the error
+.PP
+.HP
+\fIldns_pkt_reply_type\fR()
+looks inside the packet to determine
+what kind of packet it is, \%AUTH, \%NXDOMAIN, \%REFERRAL, etc.
+\.br
+\fBp\fR: the packet to examine
+\.br
+Returns the type of packet
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_nscount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_nscount.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_nscount.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_print.3 b/contrib/ldns/doc/man/man3/ldns_pkt_print.3
new file mode 120000
index 00000000000000..76d296dc410cc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_print.3
@@ -0,0 +1 @@
+ldns_pkt_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_qdcount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_qdcount.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_qdcount.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_qr.3 b/contrib/ldns/doc/man/man3/ldns_pkt_qr.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_qr.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_query_new.3 b/contrib/ldns/doc/man/man3/ldns_pkt_query_new.3
new file mode 120000
index 00000000000000..76d296dc410cc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_query_new.3
@@ -0,0 +1 @@
+ldns_pkt_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_query_new_frm_str.3 b/contrib/ldns/doc/man/man3/ldns_pkt_query_new_frm_str.3
new file mode 120000
index 00000000000000..76d296dc410cc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_query_new_frm_str.3
@@ -0,0 +1 @@
+ldns_pkt_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_querytime.3 b/contrib/ldns/doc/man/man3/ldns_pkt_querytime.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_querytime.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_question.3 b/contrib/ldns/doc/man/man3/ldns_pkt_question.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_question.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_ra.3 b/contrib/ldns/doc/man/man3/ldns_pkt_ra.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_ra.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_rd.3 b/contrib/ldns/doc/man/man3/ldns_pkt_rd.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_rd.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_reply_type.3 b/contrib/ldns/doc/man/man3/ldns_pkt_reply_type.3
new file mode 120000
index 00000000000000..76d296dc410cc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_reply_type.3
@@ -0,0 +1 @@
+ldns_pkt_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name.3 b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name_and_type.3 b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name_and_type.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_name_and_type.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_type.3 b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_type.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_rr_list_by_type.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_section.3 b/contrib/ldns/doc/man/man3/ldns_pkt_section.3
new file mode 120000
index 00000000000000..fdc189a5b579d7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_section.3
@@ -0,0 +1 @@
+ldns_pkt.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_aa.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_aa.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_aa.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_ad.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_ad.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_ad.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_ancount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_ancount.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_ancount.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_answerfrom.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_answerfrom.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_answerfrom.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_arcount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_arcount.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_arcount.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_cd.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_cd.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_cd.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_data.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_data.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_data.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_extended_rcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_extended_rcode.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_extended_rcode.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_udp_size.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_udp_size.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_udp_size.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_version.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_version.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_version.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_z.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_z.3
new file mode 120000
index 00000000000000..91c750b9c74f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_edns_z.3
@@ -0,0 +1 @@
+ldns_pkt_edns.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_flags.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_flags.3
new file mode 100644
index 00000000000000..d38df758e77f63
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_flags.3
@@ -0,0 +1,240 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_set_flags, ldns_pkt_set_id, ldns_pkt_set_qr, ldns_pkt_set_aa, ldns_pkt_set_tc, ldns_pkt_set_rd, ldns_pkt_set_cd, ldns_pkt_set_ra, ldns_pkt_set_ad, ldns_pkt_set_opcode, ldns_pkt_set_rcode, ldns_pkt_set_qdcount, ldns_pkt_set_ancount, ldns_pkt_set_nscount, ldns_pkt_set_arcount, ldns_pkt_set_answerfrom, ldns_pkt_set_querytime, ldns_pkt_set_size, ldns_pkt_set_section_count, ldns_pkt_set_tsig \- set ldns_pkt attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_pkt_set_flags(ldns_pkt *pkt, uint16_t flags);
+.PP
+void ldns_pkt_set_id(ldns_pkt *p, uint16_t id);
+.PP
+void ldns_pkt_set_qr(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_aa(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_tc(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_rd(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_cd(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_ra(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_ad(ldns_pkt *p, bool b);
+.PP
+void ldns_pkt_set_opcode(ldns_pkt *p, ldns_pkt_opcode c);
+.PP
+void ldns_pkt_set_rcode(ldns_pkt *p, uint8_t c);
+.PP
+void ldns_pkt_set_qdcount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_pkt_set_ancount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_pkt_set_nscount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_pkt_set_arcount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_pkt_set_answerfrom(ldns_pkt *p, ldns_rdf *r);
+.PP
+void ldns_pkt_set_querytime(ldns_pkt *p, uint32_t t);
+.PP
+void ldns_pkt_set_size(ldns_pkt *p, size_t s);
+.PP
+void ldns_pkt_set_section_count(ldns_pkt *p, ldns_pkt_section s, uint16_t x);
+.PP
+void ldns_pkt_set_tsig(ldns_pkt *p, ldns_rr *t);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_set_flags\fR()
+sets the flags in a packet.
+\.br
+\fBpkt\fR: the packet to operate on
+\.br
+\fBflags\fR: ORed values: \%LDNS_QR| \%LDNS_AR for instance
+\.br
+Returns true on success otherwise false
+.PP
+.HP
+\fIldns_pkt_set_id\fR()
+Set the packet's id
+\.br
+\fBp\fR: the packet
+\.br
+\fBid\fR: the id to set
+.PP
+.HP
+\fIldns_pkt_set_qr\fR()
+Set the packet's qr bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_aa\fR()
+Set the packet's aa bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_tc\fR()
+Set the packet's tc bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_rd\fR()
+Set the packet's rd bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_cd\fR()
+Set the packet's cd bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_ra\fR()
+Set the packet's ra bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_ad\fR()
+Set the packet's ad bit
+\.br
+\fBp\fR: the packet
+\.br
+\fBb\fR: the value to set (boolean)
+.PP
+.HP
+\fIldns_pkt_set_opcode\fR()
+Set the packet's opcode
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the opcode
+.PP
+.HP
+\fIldns_pkt_set_rcode\fR()
+Set the packet's response code
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the rcode
+.PP
+.HP
+\fIldns_pkt_set_qdcount\fR()
+Set the packet's qd count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the count
+.PP
+.HP
+\fIldns_pkt_set_ancount\fR()
+Set the packet's an count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the count
+.PP
+.HP
+\fIldns_pkt_set_nscount\fR()
+Set the packet's ns count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the count
+.PP
+.HP
+\fIldns_pkt_set_arcount\fR()
+Set the packet's arcount
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the count
+.PP
+.HP
+\fIldns_pkt_set_answerfrom\fR()
+Set the packet's answering server
+\.br
+\fBp\fR: the packet
+\.br
+\fBr\fR: the address
+.PP
+.HP
+\fIldns_pkt_set_querytime\fR()
+Set the packet's query time
+\.br
+\fBp\fR: the packet
+\.br
+\fBt\fR: the querytime in msec
+.PP
+.HP
+\fIldns_pkt_set_size\fR()
+Set the packet's size
+\.br
+\fBp\fR: the packet
+\.br
+\fBs\fR: the size
+.PP
+.HP
+\fIldns_pkt_set_section_count\fR()
+Set a packet's section count to x
+\.br
+\fBp\fR: the packet
+\.br
+\fBs\fR: the section
+\.br
+\fBx\fR: the section count
+.PP
+.HP
+\fIldns_pkt_set_tsig\fR()
+Set the packet's tsig rr
+\.br
+\fBp\fR: the packet
+\.br
+\fBt\fR: the tsig rr
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_id.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_id.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_id.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_nscount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_nscount.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_nscount.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_opcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_opcode.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_opcode.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_qdcount.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_qdcount.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_qdcount.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_qr.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_qr.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_qr.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_querytime.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_querytime.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_querytime.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_ra.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_ra.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_ra.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_rcode.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_rcode.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_rcode.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_rd.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_rd.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_rd.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_section_count.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_section_count.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_section_count.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_size.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_size.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_size.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_tc.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_tc.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_tc.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_set_tsig.3 b/contrib/ldns/doc/man/man3/ldns_pkt_set_tsig.3
new file mode 120000
index 00000000000000..b34290ea5e7482
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_set_tsig.3
@@ -0,0 +1 @@
+ldns_pkt_set_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_size.3 b/contrib/ldns/doc/man/man3/ldns_pkt_size.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_size.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_tc.3 b/contrib/ldns/doc/man/man3/ldns_pkt_tc.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_tc.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_tsig.3 b/contrib/ldns/doc/man/man3/ldns_pkt_tsig.3
new file mode 120000
index 00000000000000..5b1de76a46eeb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_tsig.3
@@ -0,0 +1 @@
+ldns_pkt_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_tsig_sign.3 b/contrib/ldns/doc/man/man3/ldns_pkt_tsig_sign.3
new file mode 120000
index 00000000000000..4ae473502a817c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_tsig_sign.3
@@ -0,0 +1 @@
+ldns_pkt_tsig_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_tsig_verify.3 b/contrib/ldns/doc/man/man3/ldns_pkt_tsig_verify.3
new file mode 100644
index 00000000000000..648e843f730c66
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_tsig_verify.3
@@ -0,0 +1,77 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_tsig_verify, ldns_pkt_tsig_sign \- tsig signing and verification
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_pkt_tsig_verify(ldns_pkt *pkt, const uint8_t *wire, size_t wire_size, const char *key_name, const char *key_data, const ldns_rdf *mac);
+.PP
+ldns_status ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data, uint16_t fudge, const char *algorithm_name, const ldns_rdf *query_mac);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_tsig_verify\fR()
+verifies the tsig rr for the given packet and key.
+The wire must be given too because tsig does not sign normalized packets.
+\.br
+\fBpkt\fR: the packet to verify
+\.br
+\fBwire\fR: needed to verify the mac
+\.br
+\fBwire_size\fR: size of wire
+\.br
+\fBkey_name\fR: the name of the shared key
+\.br
+\fBkey_data\fR: the key in base 64 format
+\.br
+\fBmac\fR: original mac
+\.br
+Returns true if tsig is correct, false if not, or if tsig is not set
+.PP
+.HP
+\fIldns_pkt_tsig_sign\fR()
+creates a tsig rr for the given packet and key.
+\.br
+\fBpkt\fR: the packet to sign
+\.br
+\fBkey_name\fR: the name of the shared key
+\.br
+\fBkey_data\fR: the key in base 64 format
+\.br
+\fBfudge\fR: seconds of error permitted in time signed
+\.br
+\fBalgorithm_name\fR: the name of the algorithm used
+\.br
+\fBquery_mac\fR: is added to the digest if not \%NULL (so \%NULL is for signing queries, not \%NULL is for signing answers)
+\.br
+Returns status (\%OK if success)
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_type.3 b/contrib/ldns/doc/man/man3/ldns_pkt_type.3
new file mode 120000
index 00000000000000..fdc189a5b579d7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_type.3
@@ -0,0 +1 @@
+ldns_pkt.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_pkt_verify.3 b/contrib/ldns/doc/man/man3/ldns_pkt_verify.3
new file mode 100644
index 00000000000000..e21890beaaffc0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pkt_verify.3
@@ -0,0 +1,57 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_pkt_verify \- verify a packet
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_pkt_verify(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, const ldns_rr_list *k, const ldns_rr_list *s, ldns_rr_list *good_keys);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_pkt_verify\fR()
+verify a packet 
+\.br
+\fBp\fR: the packet
+\.br
+\fBt\fR: the rr set type to check
+\.br
+\fBo\fR: the rr set name to check
+\.br
+\fBk\fR: list of keys
+\.br
+\fBs\fR: list of sigs (may be null)
+\.br
+\fBgood_keys\fR: keys which validated the packet
+\.br
+Returns status 
+
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_verify\fR, \fIldns_sign_public\fR, \fIldns_zone_sign\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_pktheader2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_pktheader2buffer_str.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_pktheader2buffer_str.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf.3 b/contrib/ldns/doc/man/man3/ldns_rdf.3
new file mode 100644
index 00000000000000..680867f700b9a4
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf.3
@@ -0,0 +1,288 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf, ldns_rdf_type \- rdata field type
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf\fR
+.br
+Resource record data field.
+.br
+
+.br
+The data is a network ordered array of bytes, which size is specified by
+.br
+the (16-bit) size field. To correctly parse it, use the type
+.br
+specified in the (16-bit) type field with a value from \\ref ldns_rdf_type.
+.br
+struct ldns_struct_rdf
+.br
+{
+.br
+	\fBThe size of the data (in octets):\fR
+.br
+	size_t _size;
+.br
+	\fBThe type of the data:\fR
+.br
+	ldns_rdf_type _type;
+.br
+	\fBPointer to the data (raw octets):\fR
+.br
+	void  *_data;
+.br
+};
+.br
+typedef struct ldns_struct_rdf ldns_rdf;
+.PP
+.HP
+\fIldns_rdf_type\fR
+.br
+The different types of RDATA fields.
+.br
+enum ldns_enum_rdf_type
+.br
+{
+.br
+	\fBnone:\fR
+.br
+	LDNS_RDF_TYPE_NONE,
+.br
+	\fBdomain name:\fR
+.br
+	LDNS_RDF_TYPE_DNAME,
+.br
+	\fB8 bits:\fR
+.br
+	LDNS_RDF_TYPE_INT8,
+.br
+	\fB16 bits:\fR
+.br
+	LDNS_RDF_TYPE_INT16,
+.br
+	\fB32 bits:\fR
+.br
+	LDNS_RDF_TYPE_INT32,
+.br
+	\fBA record:\fR
+.br
+	LDNS_RDF_TYPE_A,
+.br
+	\fBAAAA record:\fR
+.br
+	LDNS_RDF_TYPE_AAAA,
+.br
+	\fBtxt string:\fR
+.br
+	LDNS_RDF_TYPE_STR,
+.br
+	\fBapl data:\fR
+.br
+	LDNS_RDF_TYPE_APL,
+.br
+	\fBb32 string:\fR
+.br
+	LDNS_RDF_TYPE_B32_EXT,
+.br
+	\fBb64 string:\fR
+.br
+	LDNS_RDF_TYPE_B64,
+.br
+	\fBhex string:\fR
+.br
+	LDNS_RDF_TYPE_HEX,
+.br
+	\fBnsec type codes:\fR
+.br
+	LDNS_RDF_TYPE_NSEC,
+.br
+	\fBa RR type:\fR
+.br
+	LDNS_RDF_TYPE_TYPE,
+.br
+	\fBa class:\fR
+.br
+	LDNS_RDF_TYPE_CLASS,
+.br
+	\fBcertificate algorithm:\fR
+.br
+	LDNS_RDF_TYPE_CERT_ALG,
+.br
+	\fBa key algorithm:\fR
+.br
+	LDNS_RDF_TYPE_ALG,
+.br
+	\fBunknown types:\fR
+.br
+	LDNS_RDF_TYPE_UNKNOWN,
+.br
+	\fBtime (32 bits):\fR
+.br
+	LDNS_RDF_TYPE_TIME,
+.br
+	\fBperiod:\fR
+.br
+	LDNS_RDF_TYPE_PERIOD,
+.br
+	\fBtsig time 48 bits:\fR
+.br
+	LDNS_RDF_TYPE_TSIGTIME,
+.br
+	/** Represents the Public Key Algorithm, HIT and Public Key fields
+.br
+	    for the HIP RR types.  A HIP specific rdf type is used because of
+.br
+	    the unusual layout in wireformat (see RFC 5205 Section 5) */
+.br
+	LDNS_RDF_TYPE_HIP,
+.br
+	/** variable length any type rdata where the length
+.br
+	    is specified by the first 2 bytes */
+.br
+	LDNS_RDF_TYPE_INT16_DATA,
+.br
+	\fBprotocol and port bitmaps:\fR
+.br
+	LDNS_RDF_TYPE_SERVICE,
+.br
+	\fBlocation data:\fR
+.br
+	LDNS_RDF_TYPE_LOC,
+.br
+	\fBwell known services:\fR
+.br
+	LDNS_RDF_TYPE_WKS,
+.br
+	\fBNSAP:\fR
+.br
+	LDNS_RDF_TYPE_NSAP,
+.br
+	\fBATMA:\fR
+.br
+	LDNS_RDF_TYPE_ATMA,
+.br
+	\fBIPSECKEY:\fR
+.br
+	LDNS_RDF_TYPE_IPSECKEY,
+.br
+	\fBnsec3 hash salt:\fR
+.br
+	LDNS_RDF_TYPE_NSEC3_SALT,
+.br
+	\fBnsec3 base32 string (with length byte on wire:\fR
+.br
+	LDNS_RDF_TYPE_NSEC3_NEXT_OWNER,
+.br
+
+.br
+	/** 4 shorts represented as 4 * 16 bit hex numbers
+.br
+	 *  separated by colons. For NID and L64.
+.br
+	 */
+.br
+	LDNS_RDF_TYPE_ILNP64,
+.br
+
+.br
+	\fB6 * 8 bit hex numbers separated by dashes. For EUI48.:\fR
+.br
+	LDNS_RDF_TYPE_EUI48,
+.br
+	\fB8 * 8 bit hex numbers separated by dashes. For EUI64.:\fR
+.br
+	LDNS_RDF_TYPE_EUI64,
+.br
+
+.br
+	/** A non-zero sequence of US-ASCII letters and numbers in lower case.
+.br
+	 *  For CAA.
+.br
+	 */
+.br
+	LDNS_RDF_TYPE_TAG,
+.br
+
+.br
+	/** A <character-string> encoding of the value field as specified 
+.br
+	 * [RFC1035], Section 5.1., encoded as remaining rdata.
+.br
+	 * For CAA.
+.br
+	 */
+.br
+	LDNS_RDF_TYPE_LONG_STR,
+.br
+
+.br
+	/** Since RFC7218 TLSA records can be given with mnemonics,
+.br
+	 * hence these rdata field types.  But as with DNSKEYs, the output
+.br
+	 * is always numeric.
+.br
+	 */
+.br
+	LDNS_RDF_TYPE_CERTIFICATE_USAGE,
+.br
+	LDNS_RDF_TYPE_SELECTOR,
+.br
+	LDNS_RDF_TYPE_MATCHING_TYPE,
+.br
+
+.br
+	\fBdraft-ietf-mboned-driad-amt-discovery *:\fR
+.br
+	LDNS_RDF_TYPE_AMTRELAY,
+.br
+
+.br
+	\fBdraft-ietf-dnsop-svcb-https *:\fR
+.br
+	LDNS_RDF_TYPE_SVCPARAMS,
+.br
+
+.br
+	/* Aliases */
+.br
+	LDNS_RDF_TYPE_BITMAP = LDNS_RDF_TYPE_NSEC
+.br
+};
+.br
+typedef enum ldns_enum_rdf_type ldns_rdf_type;
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf_set_size\fR, \fIldns_rdf_set_type\fR, \fIldns_rdf_set_data\fR, \fIldns_rdf_size\fR, \fIldns_rdf_get_type\fR, \fIldns_rdf_data\fR, \fIldns_rdf_compare\fR, \fIldns_rdf_new\fR, \fIldns_rdf_clone\fR, \fIldns_rdf_new_frm_data\fR, \fIldns_rdf_new_frm_str\fR, \fIldns_rdf_new_frm_fp\fR, \fIldns_rdf_free\fR, \fIldns_rdf_deep_free\fR, \fIldns_rdf_print\fR, \fIldns_native2rdf_int8\fR, \fIldns_native2rdf_int16\fR, \fIldns_native2rdf_int32\fR, \fIldns_native2rdf_int16_data\fR, \fIldns_rdf2native_int8\fR, \fIldns_rdf2native_int16\fR, \fIldns_rdf2native_int32\fR, \fIldns_rdf2native_sockaddr_storage\fR, \fIldns_rdf2native_time_t\fR, \fIldns_native2rdf_int8\fR, \fIldns_native2rdf_int16\fR, \fIldns_native2rdf_int32\fR, \fIldns_native2rdf_int16_data\fR, \fIldns_rdf2native_int8\fR, \fIldns_rdf2native_int16\fR, \fIldns_rdf2native_int32\fR, \fIldns_rdf2native_sockaddr_storage\fR, \fIldns_rdf2native_time_t\fR, \fIldns_native2rdf_int8\fR, \fIldns_native2rdf_int16\fR, \fIldns_native2rdf_int32\fR, \fIldns_native2rdf_int16_data\fR, \fIldns_rdf2native_int8\fR, \fIldns_rdf2native_int16\fR, \fIldns_rdf2native_int32\fR, \fIldns_rdf2native_sockaddr_storage\fR, \fIldns_rdf2native_time_t\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_a.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_a.3
new file mode 100644
index 00000000000000..0bdeddd6a82eb2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_a.3
@@ -0,0 +1,262 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf2buffer_str_a, ldns_rdf2buffer_str_aaaa, ldns_rdf2buffer_str_str, ldns_rdf2buffer_str_b64, ldns_rdf2buffer_str_hex, ldns_rdf2buffer_str_type, ldns_rdf2buffer_str_class, ldns_rdf2buffer_str_alg, ldns_rdf2buffer_str_loc, ldns_rdf2buffer_str_unknown, ldns_rdf2buffer_str_nsap, ldns_rdf2buffer_str_wks, ldns_rdf2buffer_str_nsec, ldns_rdf2buffer_str_period, ldns_rdf2buffer_str_tsigtime, ldns_rdf2buffer_str_apl, ldns_rdf2buffer_str_int16_data, ldns_rdf2buffer_str_int16, ldns_rdf2buffer_str_ipseckey \- lower level to string conversion functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_rdf2buffer_str_a(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_aaaa(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_str(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_b64(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_hex(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_type(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_class(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_alg(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_loc(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_unknown(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_nsap(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_wks(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_nsec(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_period(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_tsigtime(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_apl(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_int16_data(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_int16(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+ldns_status ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf2buffer_str_a\fR()
+Converts an \%LDNS_RDF_TYPE_A rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_aaaa\fR()
+Converts an \%LDNS_RDF_TYPE_AAAA rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_str\fR()
+Converts an \%LDNS_RDF_TYPE_STR rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_b64\fR()
+Converts an LDNS_RDF_TYPE_B64 rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_hex\fR()
+Converts an \%LDNS_RDF_TYPE_HEX rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_type\fR()
+Converts an \%LDNS_RDF_TYPE_TYPE rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_class\fR()
+Converts an \%LDNS_RDF_TYPE_CLASS rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_alg\fR()
+Converts an \%LDNS_RDF_TYPE_ALG rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_loc\fR()
+Converts an \%LDNS_RDF_TYPE_LOC rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_unknown\fR()
+Converts an \%LDNS_RDF_TYPE_UNKNOWN rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_nsap\fR()
+Converts an \%LDNS_RDF_TYPE_NSAP rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_wks\fR()
+Converts an \%LDNS_RDF_TYPE_WKS rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_nsec\fR()
+Converts an \%LDNS_RDF_TYPE_NSEC rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_period\fR()
+Converts an \%LDNS_RDF_TYPE_PERIOD rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_tsigtime\fR()
+Converts an \%LDNS_RDF_TYPE_TSIGTIME rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_apl\fR()
+Converts an \%LDNS_RDF_TYPE_APL rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_int16_data\fR()
+Converts an LDNS_RDF_TYPE_INT16_DATA rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_int16\fR()
+Converts an LDNS_RDF_TYPE_INT16 rdata element to string format and adds it to the output buffer
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.HP
+\fIldns_rdf2buffer_str_ipseckey\fR()
+Converts an \%LDNS_RDF_TYPE_IPSECKEY rdata element to string format and adds it to the output buffer 
+\.br
+\fB*rdf\fR: The rdata to convert
+\.br
+\fB*output\fR: The buffer to add the data to
+\.br
+Returns \%LDNS_STATUS_OK on success, and error status on failure
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_aaaa.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_aaaa.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_aaaa.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_alg.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_alg.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_alg.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_apl.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_apl.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_apl.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_b64.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_b64.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_b64.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_class.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_class.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_class.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_hex.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_hex.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_hex.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16_data.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16_data.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_int16_data.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_ipseckey.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_ipseckey.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_ipseckey.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_loc.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_loc.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_loc.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsap.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsap.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsap.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsec.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsec.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_nsec.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_period.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_period.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_period.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_str.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_str.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_str.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_tsigtime.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_tsigtime.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_tsigtime.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_type.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_type.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_type.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_unknown.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_unknown.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_unknown.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_wks.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_wks.3
new file mode 120000
index 00000000000000..6b3295e58c199e
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_str_wks.3
@@ -0,0 +1 @@
+ldns_rdf2buffer_str_a.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2buffer_wire.3 b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_wire.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2buffer_wire.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2native_int16.3 b/contrib/ldns/doc/man/man3/ldns_rdf2native_int16.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2native_int16.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2native_int32.3 b/contrib/ldns/doc/man/man3/ldns_rdf2native_int32.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2native_int32.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2native_int8.3 b/contrib/ldns/doc/man/man3/ldns_rdf2native_int8.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2native_int8.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2native_sockaddr_storage.3 b/contrib/ldns/doc/man/man3/ldns_rdf2native_sockaddr_storage.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2native_sockaddr_storage.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2native_time_t.3 b/contrib/ldns/doc/man/man3/ldns_rdf2native_time_t.3
new file mode 120000
index 00000000000000..66d860d6629519
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2native_time_t.3
@@ -0,0 +1 @@
+ldns_native2rdf_int8.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2str.3 b/contrib/ldns/doc/man/man3/ldns_rdf2str.3
new file mode 120000
index 00000000000000..b2208d56a9d787
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2str.3
@@ -0,0 +1 @@
+ldns_rr2str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf2wire.3 b/contrib/ldns/doc/man/man3/ldns_rdf2wire.3
new file mode 120000
index 00000000000000..c36af5febfbcea
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf2wire.3
@@ -0,0 +1 @@
+ldns_rr2wire.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_address_reverse.3 b/contrib/ldns/doc/man/man3/ldns_rdf_address_reverse.3
new file mode 100644
index 00000000000000..10c81a8b4084fb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_address_reverse.3
@@ -0,0 +1,47 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf_address_reverse \- reverse an address rdf
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rdf_address_reverse(const ldns_rdf *rd);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf_address_reverse\fR()
+reverses an rdf, only actually useful for \%AAAA and \%A records.
+The returned rdf has the type \%LDNS_RDF_TYPE_DNAME!
+\.br
+\fB*rd\fR: rdf to be reversed
+\.br
+Returns the reversed rdf (a newly created rdf)
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_clone.3 b/contrib/ldns/doc/man/man3/ldns_rdf_clone.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_clone.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_compare.3 b/contrib/ldns/doc/man/man3/ldns_rdf_compare.3
new file mode 120000
index 00000000000000..8aaa9624e19eda
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_compare.3
@@ -0,0 +1 @@
+ldns_rdf_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_data.3 b/contrib/ldns/doc/man/man3/ldns_rdf_data.3
new file mode 120000
index 00000000000000..8aaa9624e19eda
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_data.3
@@ -0,0 +1 @@
+ldns_rdf_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_deep_free.3 b/contrib/ldns/doc/man/man3/ldns_rdf_deep_free.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_deep_free.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_free.3 b/contrib/ldns/doc/man/man3/ldns_rdf_free.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_free.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_get_type.3 b/contrib/ldns/doc/man/man3/ldns_rdf_get_type.3
new file mode 120000
index 00000000000000..8aaa9624e19eda
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_get_type.3
@@ -0,0 +1 @@
+ldns_rdf_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_new.3 b/contrib/ldns/doc/man/man3/ldns_rdf_new.3
new file mode 100644
index 00000000000000..d8b7e957fc651b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_new.3
@@ -0,0 +1,140 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf_new, ldns_rdf_clone, ldns_rdf_new_frm_data, ldns_rdf_new_frm_str, ldns_rdf_new_frm_fp, ldns_rdf_free, ldns_rdf_deep_free, ldns_rdf_print \- ldns_rdf creation, destruction and printing
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rdf_new(ldns_rdf_type type, size_t size, void *data);
+.PP
+ldns_rdf* ldns_rdf_clone(const ldns_rdf *rd);
+.PP
+ldns_rdf* ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data);
+.PP
+ldns_rdf* ldns_rdf_new_frm_str(ldns_rdf_type type, const char *str);
+.PP
+ldns_status ldns_rdf_new_frm_fp(ldns_rdf **r, ldns_rdf_type type, FILE *fp);
+.PP
+void ldns_rdf_free(ldns_rdf *rd);
+.PP
+void ldns_rdf_deep_free(ldns_rdf *rd);
+.PP
+void ldns_rdf_print(FILE *output, const ldns_rdf *rdf);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf_new\fR()
+allocates a new rdf structure and fills it.
+This function \%DOES \%NOT copy the contents from
+the buffer, unlike ldns_rdf_new_frm_data()
+\.br
+\fBtype\fR: type of the rdf
+\.br
+\fBsize\fR: size of the buffer
+\.br
+\fBdata\fR: pointer to the buffer to be copied
+\.br
+Returns the new rdf structure or \%NULL on failure
+.PP
+.HP
+\fIldns_rdf_clone\fR()
+clones a rdf structure. The data is copied.
+\.br
+\fBrd\fR: rdf to be copied
+\.br
+Returns a new rdf structure
+.PP
+.HP
+\fIldns_rdf_new_frm_data\fR()
+allocates a new rdf structure and fills it.
+This function _does_ copy the contents from
+the buffer, unlike ldns_rdf_new()
+\.br
+\fBtype\fR: type of the rdf
+\.br
+\fBsize\fR: size of the buffer
+\.br
+\fBdata\fR: pointer to the buffer to be copied
+\.br
+Returns the new rdf structure or \%NULL on failure
+.PP
+.HP
+\fIldns_rdf_new_frm_str\fR()
+creates a new rdf from a string.
+\.br
+\fBtype\fR: type to use
+\.br
+\fBstr\fR: string to use
+\.br
+Returns ldns_rdf* or \%NULL in case of an error
+.PP
+.HP
+\fIldns_rdf_new_frm_fp\fR()
+creates a new rdf from a file containing a string.
+\.br
+\fBr\fR: the new rdf
+\.br
+\fBtype\fR: type to use
+\.br
+\fBfp\fR: the file pointer  to use
+\.br
+Returns \%LDNS_STATUS_OK or the error
+.PP
+.HP
+\fIldns_rdf_free\fR()
+frees a rdf structure, leaving the
+data pointer intact.
+\.br
+\fBrd\fR: the pointer to be freed
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rdf_deep_free\fR()
+frees a rdf structure _and_ frees the
+data. rdf should be created with _new_frm_data
+\.br
+\fBrd\fR: the rdf structure to be freed
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rdf_print\fR()
+Prints the data in the rdata field to the given file stream
+(in presentation format)
+
+\.br
+\fBoutput\fR: the file stream to print to
+\.br
+\fBrdf\fR: the rdata field to print
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_data.3 b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_data.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_data.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_fp.3 b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_fp.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_fp.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_str.3 b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_str.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_new_frm_str.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_print.3 b/contrib/ldns/doc/man/man3/ldns_rdf_print.3
new file mode 120000
index 00000000000000..216967835bd3bc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_print.3
@@ -0,0 +1 @@
+ldns_rdf_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_set_data.3 b/contrib/ldns/doc/man/man3/ldns_rdf_set_data.3
new file mode 120000
index 00000000000000..ca08e87fb9d550
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_set_data.3
@@ -0,0 +1 @@
+ldns_rdf_set_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_set_size.3 b/contrib/ldns/doc/man/man3/ldns_rdf_set_size.3
new file mode 100644
index 00000000000000..75f509b811f250
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_set_size.3
@@ -0,0 +1,72 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf_set_size, ldns_rdf_set_type, ldns_rdf_set_data \- set rdf attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_rdf_set_size(ldns_rdf *rd, size_t size);
+.PP
+void ldns_rdf_set_type(ldns_rdf *rd, ldns_rdf_type type);
+.PP
+void ldns_rdf_set_data(ldns_rdf *rd, void *data);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf_set_size\fR()
+sets the size of the rdf.
+\.br
+\fB*rd\fR: the rdf to operate on
+\.br
+\fBsize\fR: the new size
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rdf_set_type\fR()
+sets the size of the rdf.
+\.br
+\fB*rd\fR: the rdf to operate on
+\.br
+\fBtype\fR: the new type
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rdf_set_data\fR()
+sets the size of the rdf.
+\.br
+\fB*rd\fR: the rdf to operate on
+\.br
+\fB*data\fR: pointer to the new data
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_set_type.3 b/contrib/ldns/doc/man/man3/ldns_rdf_set_type.3
new file mode 120000
index 00000000000000..ca08e87fb9d550
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_set_type.3
@@ -0,0 +1 @@
+ldns_rdf_set_size.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_size.3 b/contrib/ldns/doc/man/man3/ldns_rdf_size.3
new file mode 100644
index 00000000000000..4b887b105a32df
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_size.3
@@ -0,0 +1,85 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rdf_size, ldns_rdf_get_type, ldns_rdf_data, ldns_rdf_compare \- get rdf attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_rdf_size(const ldns_rdf *rd);
+.PP
+ldns_rdf_type ldns_rdf_get_type(const ldns_rdf *rd);
+.PP
+uint8_t* ldns_rdf_data(const ldns_rdf *rd);
+.PP
+int ldns_rdf_compare(const ldns_rdf *rd1, const ldns_rdf *rd2);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rdf_size\fR()
+returns the size of the rdf.
+\.br
+\fB*rd\fR: the rdf to read from
+\.br
+Returns uint16_t with the size
+.PP
+.HP
+\fIldns_rdf_get_type\fR()
+returns the type of the rdf. We need to insert _get_
+here to prevent conflict the the rdf_type \%TYPE.
+\.br
+\fB*rd\fR: the rdf to read from
+\.br
+Returns ldns_rdf_type with the type
+.PP
+.HP
+\fIldns_rdf_data\fR()
+returns the data of the rdf.
+\.br
+\fB*rd\fR: the rdf to read from
+
+\.br
+Returns uint8_t* pointer to the rdf's data
+.PP
+.HP
+\fIldns_rdf_compare\fR()
+compares two rdf's on their wire formats.
+(To order dnames according to rfc4034, use ldns_dname_compare)
+\.br
+\fBrd1\fR: the first one
+\.br
+\fBrd2\fR: the second one
+\.br
+Returns 0 if equal
+\.br
+Returns -1 if rd1 comes before rd2
+\.br
+Returns +1 if rd2 comes before rd1
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rdf_type.3 b/contrib/ldns/doc/man/man3/ldns_rdf_type.3
new file mode 120000
index 00000000000000..5e5b4d38b2ae35
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rdf_type.3
@@ -0,0 +1 @@
+ldns_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr.3 b/contrib/ldns/doc/man/man3/ldns_rr.3
new file mode 100644
index 00000000000000..aec28941b981b7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr.3
@@ -0,0 +1,623 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr, ldns_rr_class, ldns_rr_type, ldns_rr_compress, ldns_rr_list \- types representing dns resource records
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr\fR
+.br
+Resource Record
+.br
+
+.br
+This is the basic DNS element that contains actual data
+.br
+
+.br
+From RFC1035:
+.br
+<pre>
+.br
+3.2.1. Format
+.br
+
+.br
+All RRs have the same top level format shown below:
+.br
+
+.br
+                                    1  1  1  1  1  1
+.br
+      0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+    |                                               |
+.br
+    /                                               /
+.br
+    /                      NAME                     /
+.br
+    |                                               |
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+    |                      TYPE                     |
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+    |                     CLASS                     |
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+    |                      TTL                      |
+.br
+    |                                               |
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+    |                   RDLENGTH                    |
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--|
+.br
+    /                     RDATA                     /
+.br
+    /                                               /
+.br
+    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+.br
+
+.br
+where:
+.br
+
+.br
+NAME            an owner name, i.e., the name of the node to which this
+.br
+                resource record pertains.
+.br
+
+.br
+TYPE            two octets containing one of the RR TYPE codes.
+.br
+
+.br
+CLASS           two octets containing one of the RR CLASS codes.
+.br
+
+.br
+TTL             a 32 bit signed integer that specifies the time interval
+.br
+                that the resource record may be cached before the source
+.br
+                of the information should again be consulted.  Zero
+.br
+                values are interpreted to mean that the RR can only be
+.br
+                used for the transaction in progress, and should not be
+.br
+                cached.  For example, SOA records are always distributed
+.br
+                with a zero TTL to prohibit caching.  Zero values can
+.br
+                also be used for extremely volatile data.
+.br
+
+.br
+RDLENGTH        an unsigned 16 bit integer that specifies the length in
+.br
+                octets of the RDATA field.
+.br
+
+.br
+RDATA           a variable length string of octets that describes the
+.br
+                resource.  The format of this information varies
+.br
+                according to the TYPE and CLASS of the resource record.
+.br
+</pre>
+.br
+
+.br
+The actual amount and type of rdata fields depend on the RR type of the
+.br
+RR, and can be found by using \\ref ldns_rr_descriptor functions.
+.br
+struct ldns_struct_rr
+.br
+{
+.br
+	\fBOwner name, uncompressed:\fR
+.br
+	ldns_rdf	*_owner;
+.br
+	\fBTime to live:\fR
+.br
+	uint32_t	_ttl;
+.br
+	\fBNumber of data fields:\fR
+.br
+	size_t	        _rd_count;
+.br
+	\fBthe type of the RR. A, MX etc.:\fR
+.br
+	ldns_rr_type	_rr_type;
+.br
+	\fBClass of the resource record.:\fR
+.br
+	ldns_rr_class	_rr_class;
+.br
+	/* everything in the rdata is in network order */
+.br
+	\fBThe array of rdata's:\fR
+.br
+	ldns_rdf	 **_rdata_fields;
+.br
+	/**  question rr [it would be nicer if thous is after _rd_count]
+.br
+		 ABI change: Fix this in next major release
+.br
+	 */
+.br
+	bool		_rr_question;
+.br
+};
+.br
+typedef struct ldns_struct_rr ldns_rr;
+.PP
+.HP
+\fIldns_rr_class\fR
+.br
+ The different RR classes.
+.br
+enum ldns_enum_rr_class
+.br
+{
+.br
+	\fBthe Internet:\fR
+.br
+	LDNS_RR_CLASS_IN 	= 1,
+.br
+	\fBChaos class:\fR
+.br
+	LDNS_RR_CLASS_CH	= 3,
+.br
+	\fBHesiod (Dyer 87):\fR
+.br
+	LDNS_RR_CLASS_HS	= 4,
+.br
+    \fBNone class, dynamic update:\fR
+.br
+    LDNS_RR_CLASS_NONE      = 254,
+.br
+	\fBAny class:\fR
+.br
+	LDNS_RR_CLASS_ANY	= 255,
+.br
+
+.br
+	LDNS_RR_CLASS_FIRST     = 0,
+.br
+	LDNS_RR_CLASS_LAST      = 65535,
+.br
+	LDNS_RR_CLASS_COUNT     = LDNS_RR_CLASS_LAST - LDNS_RR_CLASS_FIRST + 1
+.br
+};
+.br
+typedef enum ldns_enum_rr_class ldns_rr_class;
+.PP
+.HP
+\fIldns_rr_type\fR
+.br
+The different RR types.
+.br
+enum ldns_enum_rr_type
+.br
+{
+.br
+	\fBa host address:\fR
+.br
+	LDNS_RR_TYPE_A = 1,
+.br
+	\fBan authoritative name server:\fR
+.br
+	LDNS_RR_TYPE_NS = 2,
+.br
+	\fBa mail destination (Obsolete - use MX):\fR
+.br
+	LDNS_RR_TYPE_MD = 3,
+.br
+	\fBa mail forwarder (Obsolete - use MX):\fR
+.br
+	LDNS_RR_TYPE_MF = 4,
+.br
+	\fBthe canonical name for an alias:\fR
+.br
+	LDNS_RR_TYPE_CNAME = 5,
+.br
+	\fBmarks the start of a zone of authority:\fR
+.br
+	LDNS_RR_TYPE_SOA = 6,
+.br
+	\fBa mailbox domain name (EXPERIMENTAL):\fR
+.br
+	LDNS_RR_TYPE_MB = 7,
+.br
+	\fBa mail group member (EXPERIMENTAL):\fR
+.br
+	LDNS_RR_TYPE_MG = 8,
+.br
+	\fBa mail rename domain name (EXPERIMENTAL):\fR
+.br
+	LDNS_RR_TYPE_MR = 9,
+.br
+	\fBa null RR (EXPERIMENTAL):\fR
+.br
+	LDNS_RR_TYPE_NULL = 10,
+.br
+	\fBa well known service description:\fR
+.br
+	LDNS_RR_TYPE_WKS = 11,
+.br
+	\fBa domain name pointer:\fR
+.br
+	LDNS_RR_TYPE_PTR = 12,
+.br
+	\fBhost information:\fR
+.br
+	LDNS_RR_TYPE_HINFO = 13,
+.br
+	\fBmailbox or mail list information:\fR
+.br
+	LDNS_RR_TYPE_MINFO = 14,
+.br
+	\fBmail exchange:\fR
+.br
+	LDNS_RR_TYPE_MX = 15,
+.br
+	\fBtext strings:\fR
+.br
+	LDNS_RR_TYPE_TXT = 16,
+.br
+	\fBRFC1183:\fR
+.br
+	LDNS_RR_TYPE_RP = 17,
+.br
+	\fBRFC1183:\fR
+.br
+	LDNS_RR_TYPE_AFSDB = 18,
+.br
+	\fBRFC1183:\fR
+.br
+	LDNS_RR_TYPE_X25 = 19,
+.br
+	\fBRFC1183:\fR
+.br
+	LDNS_RR_TYPE_ISDN = 20,
+.br
+	\fBRFC1183:\fR
+.br
+	LDNS_RR_TYPE_RT = 21,
+.br
+	\fBRFC1706:\fR
+.br
+	LDNS_RR_TYPE_NSAP = 22,
+.br
+	\fBRFC1348:\fR
+.br
+	LDNS_RR_TYPE_NSAP_PTR = 23,
+.br
+	\fB2535typecode:\fR
+.br
+	LDNS_RR_TYPE_SIG = 24,
+.br
+	\fB2535typecode:\fR
+.br
+	LDNS_RR_TYPE_KEY = 25,
+.br
+	\fBRFC2163:\fR
+.br
+	LDNS_RR_TYPE_PX = 26,
+.br
+	\fBRFC1712:\fR
+.br
+	LDNS_RR_TYPE_GPOS = 27,
+.br
+	\fBipv6 address:\fR
+.br
+	LDNS_RR_TYPE_AAAA = 28,
+.br
+	\fBLOC record  RFC1876:\fR
+.br
+	LDNS_RR_TYPE_LOC = 29,
+.br
+	\fB2535typecode:\fR
+.br
+	LDNS_RR_TYPE_NXT = 30,
+.br
+	\fBdraft-ietf-nimrod-dns-01.txt:\fR
+.br
+	LDNS_RR_TYPE_EID = 31,
+.br
+	\fBdraft-ietf-nimrod-dns-01.txt:\fR
+.br
+	LDNS_RR_TYPE_NIMLOC = 32,
+.br
+	\fBSRV record RFC2782:\fR
+.br
+	LDNS_RR_TYPE_SRV = 33,
+.br
+	\fBhttp://www.jhsoft.com/rfc/af-saa-0069.000.rtf:\fR
+.br
+	LDNS_RR_TYPE_ATMA = 34,
+.br
+	\fBRFC2915:\fR
+.br
+	LDNS_RR_TYPE_NAPTR = 35,
+.br
+	\fBRFC2230:\fR
+.br
+	LDNS_RR_TYPE_KX = 36,
+.br
+	\fBRFC2538:\fR
+.br
+	LDNS_RR_TYPE_CERT = 37,
+.br
+	\fBRFC2874:\fR
+.br
+	LDNS_RR_TYPE_A6 = 38,
+.br
+	\fBRFC2672:\fR
+.br
+	LDNS_RR_TYPE_DNAME = 39,
+.br
+	\fBdnsind-kitchen-sink-02.txt:\fR
+.br
+	LDNS_RR_TYPE_SINK = 40,
+.br
+	\fBOPT record RFC 6891:\fR
+.br
+	LDNS_RR_TYPE_OPT = 41,
+.br
+	\fBRFC3123:\fR
+.br
+	LDNS_RR_TYPE_APL = 42,
+.br
+	\fBRFC4034, RFC3658:\fR
+.br
+	LDNS_RR_TYPE_DS = 43,
+.br
+	\fBSSH Key Fingerprint:\fR
+.br
+	LDNS_RR_TYPE_SSHFP = 44, /* RFC 4255 */
+.br
+	\fBIPsec Key:\fR
+.br
+	LDNS_RR_TYPE_IPSECKEY = 45, /* RFC 4025 */
+.br
+	\fBDNSSEC:\fR
+.br
+	LDNS_RR_TYPE_RRSIG = 46, /* RFC 4034 */
+.br
+	LDNS_RR_TYPE_NSEC = 47, /* RFC 4034 */
+.br
+	LDNS_RR_TYPE_DNSKEY = 48, /* RFC 4034 */
+.br
+
+.br
+	LDNS_RR_TYPE_DHCID = 49, /* RFC 4701 */
+.br
+	/* NSEC3 */
+.br
+	LDNS_RR_TYPE_NSEC3 = 50, /* RFC 5155 */
+.br
+	LDNS_RR_TYPE_NSEC3PARAM = 51, /* RFC 5155 */
+.br
+	LDNS_RR_TYPE_NSEC3PARAMS = 51,
+.br
+	LDNS_RR_TYPE_TLSA = 52, /* RFC 6698 */
+.br
+	LDNS_RR_TYPE_SMIMEA = 53, /* RFC 8162 */
+.br
+
+.br
+	LDNS_RR_TYPE_HIP = 55, /* RFC 5205 */
+.br
+
+.br
+	\fBdraft-reid-dnsext-zs:\fR
+.br
+	LDNS_RR_TYPE_NINFO = 56,
+.br
+	\fBdraft-reid-dnsext-rkey:\fR
+.br
+	LDNS_RR_TYPE_RKEY = 57,
+.br
+        \fBdraft-ietf-dnsop-trust-history:\fR
+.br
+        LDNS_RR_TYPE_TALINK = 58,
+.br
+	LDNS_RR_TYPE_CDS = 59, /* RFC 7344 */
+.br
+	LDNS_RR_TYPE_CDNSKEY = 60, /* RFC 7344 */
+.br
+	LDNS_RR_TYPE_OPENPGPKEY = 61, /* RFC 7929 */
+.br
+	LDNS_RR_TYPE_CSYNC = 62, /* RFC 7477 */
+.br
+	LDNS_RR_TYPE_ZONEMD = 63, /* draft-ietf-dnsop-dns-zone-digest */
+.br
+	LDNS_RR_TYPE_SVCB = 64, /* draft-ietf-dnsop-svcb-https */
+.br
+	LDNS_RR_TYPE_HTTPS = 65, /* draft-ietf-dnsop-svcb-https */
+.br
+
+.br
+	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */
+.br
+
+.br
+	LDNS_RR_TYPE_UINFO = 100,
+.br
+	LDNS_RR_TYPE_UID = 101,
+.br
+	LDNS_RR_TYPE_GID = 102,
+.br
+	LDNS_RR_TYPE_UNSPEC = 103,
+.br
+
+.br
+	LDNS_RR_TYPE_NID = 104, /* RFC 6742 */
+.br
+	LDNS_RR_TYPE_L32 = 105, /* RFC 6742 */
+.br
+	LDNS_RR_TYPE_L64 = 106, /* RFC 6742 */
+.br
+	LDNS_RR_TYPE_LP = 107, /* RFC 6742 */
+.br
+
+.br
+	LDNS_RR_TYPE_EUI48 = 108, /* RFC 7043 */
+.br
+	LDNS_RR_TYPE_EUI64 = 109, /* RFC 7043 */
+.br
+
+.br
+	LDNS_RR_TYPE_TKEY = 249, /* RFC 2930 */
+.br
+	LDNS_RR_TYPE_TSIG = 250,
+.br
+	LDNS_RR_TYPE_IXFR = 251,
+.br
+	LDNS_RR_TYPE_AXFR = 252,
+.br
+	\fBA request for mailbox-related records (MB, MG or MR):\fR
+.br
+	LDNS_RR_TYPE_MAILB = 253,
+.br
+	\fBA request for mail agent RRs (Obsolete - see MX):\fR
+.br
+	LDNS_RR_TYPE_MAILA = 254,
+.br
+	\fBany type (wildcard):\fR
+.br
+	LDNS_RR_TYPE_ANY = 255,
+.br
+	LDNS_RR_TYPE_URI = 256, /* RFC 7553 */
+.br
+	LDNS_RR_TYPE_CAA = 257, /* RFC 6844 */
+.br
+	LDNS_RR_TYPE_AVC = 258, /* Cisco's DNS-AS RR, see www.dns-as.org */
+.br
+	LDNS_RR_TYPE_DOA = 259, /* draft-durand-doa-over-dns */
+.br
+
+.br
+	\fBdraft-ietf-mboned-driad-amt-discovery *:\fR
+.br
+	LDNS_RR_TYPE_AMTRELAY = 260,
+.br
+
+.br
+	\fBDNSSEC Trust Authorities:\fR
+.br
+	LDNS_RR_TYPE_TA = 32768,
+.br
+	/* RFC 4431, 5074, DNSSEC Lookaside Validation */
+.br
+	LDNS_RR_TYPE_DLV = 32769,
+.br
+
+.br
+	/* type codes from nsec3 experimental phase
+.br
+	LDNS_RR_TYPE_NSEC3 = 65324,
+.br
+	LDNS_RR_TYPE_NSEC3PARAMS = 65325, */
+.br
+	LDNS_RR_TYPE_FIRST = 0,
+.br
+	LDNS_RR_TYPE_LAST  = 65535,
+.br
+	LDNS_RR_TYPE_COUNT = LDNS_RR_TYPE_LAST - LDNS_RR_TYPE_FIRST + 1
+.br
+};
+.br
+typedef enum ldns_enum_rr_type ldns_rr_type;
+.PP
+.HP
+\fIldns_rr_compress\fR
+.br
+ Used to specify whether compression is allowed.
+.br
+enum ldns_enum_rr_compress
+.br
+{
+.br
+	\fBcompression is allowed:\fR
+.br
+	LDNS_RR_COMPRESS,
+.br
+	LDNS_RR_NO_COMPRESS
+.br
+};
+.br
+typedef enum ldns_enum_rr_compress ldns_rr_compress;
+.PP
+.HP
+\fIldns_rr_list\fR
+.br
+List or Set of Resource Records
+.br
+
+.br
+Contains a list of rr's <br>
+.br
+No official RFC-like checks are made
+.br
+struct ldns_struct_rr_list
+.br
+{
+.br
+	size_t _rr_count;
+.br
+	size_t _rr_capacity;
+.br
+	ldns_rr **_rrs;
+.br
+};
+.br
+typedef struct ldns_struct_rr_list ldns_rr_list;
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr_new\fR, \fIldns_rr_new_frm_type\fR, \fIldns_rr_new_frm_str\fR, \fIldns_rr_new_frm_fp\fR, \fIldns_rr_free\fR, \fIldns_rr_print\fR, \fIldns_rr_set_owner\fR, \fIldns_rr_set_ttl\fR, \fIldns_rr_set_type\fR, \fIldns_rr_set_rd_count\fR, \fIldns_rr_set_class\fR, \fIldns_rr_set_rdf\fR, \fIldns_rr_push_rdf\fR, \fIldns_rr_pop_rdf\fR, \fIldns_rr_rdf\fR, \fIldns_rr_owner\fR, \fIldns_rr_rd_count\fR, \fIldns_rr_ttl\fR, \fIldns_rr_get_class\fR, \fIldns_rr_list_rr_count\fR, \fIldns_rr_list_set_rr_count\fR, \fIldns_rr_list_new\fR, \fIldns_rr_list_free\fR, \fIldns_rr_list_cat\fR, \fIldns_rr_list_push_rr\fR, \fIldns_rr_list_pop_rr\fR, \fIldns_is_rrset\fR, \fIldns_rr_set_push_rr\fR, \fIldns_rr_set_pop_rr\fR, \fIldns_get_rr_class_by_name\fR, \fIldns_get_rr_type_by_name\fR, \fIldns_rr_list_clone\fR, \fIldns_rr_list_sort\fR, \fIldns_rr_compare\fR, \fIldns_rr_compare_ds\fR, \fIldns_rr_uncompressed_size\fR, \fIldns_rr2canonical\fR, \fIldns_rr_label_count\fR, \fIldns_is_rrset\fR, \fIldns_rr_descriptor\fR, \fIldns_rr_descript\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_rr2buffer_str.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr2buffer_str.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr2buffer_wire.3 b/contrib/ldns/doc/man/man3/ldns_rr2buffer_wire.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr2buffer_wire.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr2canonical.3 b/contrib/ldns/doc/man/man3/ldns_rr2canonical.3
new file mode 100644
index 00000000000000..0003feae7ac020
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr2canonical.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr2canonical \- canonicalize a RR
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_rr2canonical(ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr2canonical\fR()
+converts each dname in a rr to its canonical form.
+\.br
+\fBrr\fR: the rr to work on
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr2str.3 b/contrib/ldns/doc/man/man3/ldns_rr2str.3
new file mode 100644
index 00000000000000..afe07b1424b339
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr2str.3
@@ -0,0 +1,101 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr2str, ldns_pkt2str, ldns_rdf2str, ldns_rr_list2str, ldns_key2str \- functions for conversions to string
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+char* ldns_rr2str(const ldns_rr *rr);
+.PP
+char* ldns_pkt2str(const ldns_pkt *pkt);
+.PP
+char* ldns_rdf2str(const ldns_rdf *rdf);
+.PP
+char* ldns_rr_list2str(const ldns_rr_list *rr_list);
+.PP
+char* ldns_key2str(const ldns_key *k);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr2str\fR()
+Converts the data in the resource record to presentation format and
+returns that as a char *.
+Remember to free it.
+
+\.br
+\fBrr\fR: The rdata field to convert
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.HP
+\fIldns_pkt2str\fR()
+Converts the data in the \%DNS packet to presentation format and
+returns that as a char *.
+Remember to free it.
+
+\.br
+\fBpkt\fR: The rdata field to convert
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.HP
+\fIldns_rdf2str\fR()
+Converts the data in the rdata field to presentation format and
+returns that as a char *.
+Remember to free it.
+
+\.br
+\fBrdf\fR: The rdata field to convert
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.HP
+\fIldns_rr_list2str\fR()
+Converts a list of resource records to presentation format
+and returns that as a char *.
+Remember to free it.
+
+\.br
+\fBrr_list\fR: the rr_list to convert to text
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.HP
+\fIldns_key2str\fR()
+Converts a private key to the test presentation fmt and
+returns that as a char *.
+Remember to free it.
+
+\.br
+\fBk\fR: the key to convert to text
+\.br
+Returns null terminated char * data, or \%NULL on error
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr_print\fR, \fIldns_rdf_print\fR, \fIldns_pkt_print\fR, \fIldns_rr_list_print\fR, \fIldns_resolver_print\fR, \fIldns_zone_print\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr2wire.3 b/contrib/ldns/doc/man/man3/ldns_rr2wire.3
new file mode 100644
index 00000000000000..3f6c4bf17ecc5d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr2wire.3
@@ -0,0 +1,89 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr2wire, ldns_pkt2wire, ldns_rdf2wire \- conversion functions
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_rr2wire(uint8_t **dest, const ldns_rr *rr, int section, size_t *size);
+.PP
+ldns_status ldns_pkt2wire(uint8_t **dest, const ldns_pkt *p, size_t *size);
+.PP
+ldns_status ldns_rdf2wire(uint8_t **dest, const ldns_rdf *rdf, size_t *size);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr2wire\fR()
+Allocates an array of uint8_t at dest, and puts the wireformat of the
+given rr in that array. The result_size value contains the
+length of the array, if it succeeds, and 0 otherwise (in which case
+the function also returns \%NULL)
+
+If the section argument is \%LDNS_SECTION_QUESTION, data like ttl and rdata
+are not put into the result
+
+\.br
+\fBdest\fR: pointer to the array of bytes to be created
+\.br
+\fBrr\fR: the rr to convert
+\.br
+\fBsection\fR: the rr section, determines how the rr is written.
+\.br
+\fBsize\fR: the size of the converted result
+.PP
+.HP
+\fIldns_pkt2wire\fR()
+Allocates an array of uint8_t at dest, and puts the wireformat of the
+given packet in that array. The result_size value contains the
+length of the array, if it succeeds, and 0 otherwise (in which case
+the function also returns \%NULL)
+
+\.br
+\fBdest\fR: pointer to the array of bytes to be created
+\.br
+\fBp\fR: the packet to convert
+\.br
+\fBsize\fR: the size of the converted result
+.PP
+.HP
+\fIldns_rdf2wire\fR()
+Allocates an array of uint8_t at dest, and puts the wireformat of the
+given rdf in that array. The result_size value contains the
+length of the array, if it succeeds, and 0 otherwise (in which case
+the function also returns \%NULL)
+
+\.br
+\fBdest\fR: pointer to the array of bytes to be created
+\.br
+\fBrdf\fR: the rdata field to convert
+\.br
+\fBsize\fR: the size of the converted result
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_wire2rr\fR, \fIldns_wire2pkt\fR, \fIldns_wire2rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_class.3 b/contrib/ldns/doc/man/man3/ldns_rr_class.3
new file mode 120000
index 00000000000000..270bcc371e2cf1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_class.3
@@ -0,0 +1 @@
+ldns_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_compare.3 b/contrib/ldns/doc/man/man3/ldns_rr_compare.3
new file mode 100644
index 00000000000000..3ce5b43dc236ff
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_compare.3
@@ -0,0 +1,64 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_compare, ldns_rr_compare_ds \- compare a ldns_rr
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+int ldns_rr_compare(const ldns_rr *rr1, const ldns_rr *rr2);
+.PP
+bool ldns_rr_compare_ds(const ldns_rr *rr1, const ldns_rr *rr2);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_compare\fR()
+compares two rrs. The \%TTL is not looked at.
+\.br
+\fBrr1\fR: the first one
+\.br
+\fBrr2\fR: the second one
+\.br
+Returns 0 if equal
+-1 if rr1 comes before rr2
++1 if rr2 comes before rr1
+.PP
+.HP
+\fIldns_rr_compare_ds\fR()
+returns true of the given rr's are equal.
+Also returns true if one record is a \%DS that represents the
+same \%DNSKEY record as the other record
+\.br
+\fBrr1\fR: the first rr
+\.br
+\fBrr2\fR: the second rr
+\.br
+Returns true if equal otherwise false
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_compare_ds.3 b/contrib/ldns/doc/man/man3/ldns_rr_compare_ds.3
new file mode 120000
index 00000000000000..1fe5664625cdec
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_compare_ds.3
@@ -0,0 +1 @@
+ldns_rr_compare.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_compress.3 b/contrib/ldns/doc/man/man3/ldns_rr_compress.3
new file mode 120000
index 00000000000000..270bcc371e2cf1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_compress.3
@@ -0,0 +1 @@
+ldns_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_descript.3 b/contrib/ldns/doc/man/man3/ldns_rr_descript.3
new file mode 120000
index 00000000000000..596e1e9e38222f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_descript.3
@@ -0,0 +1 @@
+ldns_rr_descriptor.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_descriptor.3 b/contrib/ldns/doc/man/man3/ldns_rr_descriptor.3
new file mode 100644
index 00000000000000..64055a995589c7
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_descriptor.3
@@ -0,0 +1,131 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_descriptor, ldns_rr_descript, ldns_rr_descriptor_minimum, ldns_rr_descriptor_maximum, ldns_rr_descriptor_field_type \- rdata field descriptors
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+const ldns_rr_descriptor* ldns_rr_descript(uint16_t type);
+.PP
+size_t ldns_rr_descriptor_minimum(const ldns_rr_descriptor *descriptor);
+.PP
+size_t ldns_rr_descriptor_maximum(const ldns_rr_descriptor *descriptor);
+.PP
+ldns_rdf_type ldns_rr_descriptor_field_type(const ldns_rr_descriptor *descriptor, size_t field);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_descriptor\fR
+.br
+Contains all information about resource record types.
+.br
+
+.br
+This structure contains, for all rr types, the rdata fields that are defined.
+.br
+struct ldns_struct_rr_descriptor
+.br
+{
+.br
+	\fBType of the RR that is described here:\fR
+.br
+	ldns_rr_type    _type;
+.br
+	\fBTextual name of the RR type.:\fR
+.br
+	const char *_name;
+.br
+	\fBMinimum number of rdata fields in the RRs of this type.:\fR
+.br
+	uint8_t     _minimum;
+.br
+	\fBMaximum number of rdata fields in the RRs of this type.:\fR
+.br
+	uint8_t     _maximum;
+.br
+	\fBWireformat specification for the rr, i.e. the types of rdata fields in their respective order.:\fR
+.br
+	const ldns_rdf_type *_wireformat;
+.br
+	\fBSpecial rdf types:\fR
+.br
+	ldns_rdf_type _variable;
+.br
+	\fBSpecifies whether compression can be used for dnames in this RR type.:\fR
+.br
+	ldns_rr_compress _compress;
+.br
+	\fBThe number of DNAMEs in the _wireformat string, for parsing.:\fR
+.br
+	uint8_t _dname_count;
+.br
+};
+.br
+typedef struct ldns_struct_rr_descriptor ldns_rr_descriptor;
+.PP
+.HP
+\fIldns_rr_descript\fR()
+returns the resource record descriptor for the given rr type.
+
+\.br
+\fBtype\fR: the type value of the rr type
+\.br
+Returns the ldns_rr_descriptor for this type
+.PP
+.HP
+\fIldns_rr_descriptor_minimum\fR()
+returns the minimum number of rdata fields of the rr type this descriptor describes.
+
+\.br
+\fBdescriptor\fR: for an rr type
+\.br
+Returns the minimum number of rdata fields
+.PP
+.HP
+\fIldns_rr_descriptor_maximum\fR()
+returns the maximum number of rdata fields of the rr type this descriptor describes.
+
+\.br
+\fBdescriptor\fR: for an rr type
+\.br
+Returns the maximum number of rdata fields
+.PP
+.HP
+\fIldns_rr_descriptor_field_type\fR()
+returns the rdf type for the given rdata field number of the rr type for the given descriptor.
+
+\.br
+\fBdescriptor\fR: for an rr type
+\.br
+\fBfield\fR: the field number
+\.br
+Returns the rdf type for the field
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rdf\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_descriptor_field_type.3 b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_field_type.3
new file mode 120000
index 00000000000000..596e1e9e38222f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_field_type.3
@@ -0,0 +1 @@
+ldns_rr_descriptor.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_descriptor_maximum.3 b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_maximum.3
new file mode 120000
index 00000000000000..596e1e9e38222f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_maximum.3
@@ -0,0 +1 @@
+ldns_rr_descriptor.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_descriptor_minimum.3 b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_minimum.3
new file mode 120000
index 00000000000000..596e1e9e38222f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_descriptor_minimum.3
@@ -0,0 +1 @@
+ldns_rr_descriptor.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_algorithm.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_algorithm.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_flags.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_flags.3
new file mode 100644
index 00000000000000..432629f611a4cb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_flags.3
@@ -0,0 +1,124 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_dnskey_flags, ldns_rr_dnskey_set_flags, ldns_rr_dnskey_protocol, ldns_rr_dnskey_set_protocol, ldns_rr_dnskey_algorithm, ldns_rr_dnskey_set_algorithm, ldns_rr_dnskey_key, ldns_rr_dnskey_set_key \- get and set DNSKEY RR rdata fields
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rr_dnskey_flags(const ldns_rr *r);
+.PP
+bool ldns_rr_dnskey_set_flags(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_dnskey_protocol(const ldns_rr *r);
+.PP
+bool ldns_rr_dnskey_set_protocol(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_dnskey_algorithm(const ldns_rr *r);
+.PP
+bool ldns_rr_dnskey_set_algorithm(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_dnskey_key(const ldns_rr *r);
+.PP
+bool ldns_rr_dnskey_set_key(ldns_rr *r, ldns_rdf *f);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_dnskey_flags\fR()
+returns the flags of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the flags or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_dnskey_set_flags\fR()
+sets the flags of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the flags to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_dnskey_protocol\fR()
+returns the protocol of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the protocol or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_dnskey_set_protocol\fR()
+sets the protocol of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the protocol to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_dnskey_algorithm\fR()
+returns the algorithm of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the algorithm or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_dnskey_set_algorithm\fR()
+sets the algorithm of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the algorithm to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_dnskey_key\fR()
+returns the key data of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the key data or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_dnskey_set_key\fR()
+sets the key data of a \%LDNS_RR_TYPE_DNSKEY rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the key data to set
+\.br
+Returns true on success, false otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_key.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_key.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_key.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_protocol.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_protocol.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_protocol.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_algorithm.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_algorithm.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_flags.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_flags.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_flags.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_key.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_key.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_key.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_protocol.3 b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_protocol.3
new file mode 120000
index 00000000000000..eb729bb85e0bdb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_dnskey_set_protocol.3
@@ -0,0 +1 @@
+ldns_rr_dnskey_flags.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_free.3 b/contrib/ldns/doc/man/man3/ldns_rr_free.3
new file mode 120000
index 00000000000000..b5c80ecde4714a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_free.3
@@ -0,0 +1 @@
+ldns_rr_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_get_class.3 b/contrib/ldns/doc/man/man3/ldns_rr_get_class.3
new file mode 120000
index 00000000000000..7ac87b76db7c74
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_get_class.3
@@ -0,0 +1 @@
+ldns_rr_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_label_count.3 b/contrib/ldns/doc/man/man3/ldns_rr_label_count.3
new file mode 100644
index 00000000000000..61cf8e86d97225
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_label_count.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_label_count \- return ownername label count
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+uint8_t ldns_rr_label_count(const ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_label_count\fR()
+counts the number of labels of the ownername.
+\.br
+\fBrr\fR: count the labels of this rr
+\.br
+Returns the number of labels
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list.3 b/contrib/ldns/doc/man/man3/ldns_rr_list.3
new file mode 120000
index 00000000000000..270bcc371e2cf1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list.3
@@ -0,0 +1 @@
+ldns_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list2buffer_str.3 b/contrib/ldns/doc/man/man3/ldns_rr_list2buffer_str.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list2buffer_str.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list2str.3 b/contrib/ldns/doc/man/man3/ldns_rr_list2str.3
new file mode 120000
index 00000000000000..b2208d56a9d787
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list2str.3
@@ -0,0 +1 @@
+ldns_rr2str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_cat.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_cat.3
new file mode 100644
index 00000000000000..d986f6f1972fa0
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_cat.3
@@ -0,0 +1,71 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_list_cat, ldns_rr_list_push_rr, ldns_rr_list_pop_rr \- ldns_rr_list manipulation
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_rr_list_cat(ldns_rr_list *left, const ldns_rr_list *right);
+.PP
+bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr);
+.PP
+ldns_rr* ldns_rr_list_pop_rr(ldns_rr_list *rr_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_list_cat\fR()
+concatenates two ldns_rr_lists together. This modifies
+*left (to extend it and add the pointers from *right).
+\.br
+\fBleft\fR: the leftside
+\.br
+\fBright\fR: the rightside
+\.br
+Returns a left with right concatenated to it
+.PP
+.HP
+\fIldns_rr_list_push_rr\fR()
+pushes an rr to an rrlist.
+\.br
+\fBrr_list\fR: the rr_list to push to 
+\.br
+\fBrr\fR: the rr to push 
+\.br
+Returns false on error, otherwise true
+.PP
+.HP
+\fIldns_rr_list_pop_rr\fR()
+pops the last rr from an rrlist.
+\.br
+\fBrr_list\fR: the rr_list to pop from
+\.br
+Returns \%NULL if nothing to pop. Otherwise the popped \%RR
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_clone.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_clone.3
new file mode 100644
index 00000000000000..69cd26ce70f8c2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_clone.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_list_clone \- clone a ldns_rr_list
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list* ldns_rr_list_clone(const ldns_rr_list *rrlist);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_list_clone\fR()
+clones an rrlist.
+\.br
+\fBrrlist\fR: the rrlist to clone
+\.br
+Returns the cloned rr list
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_free.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_free.3
new file mode 120000
index 00000000000000..06c4c55f03cfb5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_free.3
@@ -0,0 +1 @@
+ldns_rr_list_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_new.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_new.3
new file mode 100644
index 00000000000000..8b7ea82e97f681
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_new.3
@@ -0,0 +1,52 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_list_new, ldns_rr_list_free \- ldns_rr_list creation and destruction
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list* ldns_rr_list_new(void);
+.PP
+void ldns_rr_list_free(ldns_rr_list *rr_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_list_new\fR()
+creates a new rr_list structure.
+\.br
+Returns a new rr_list structure
+.PP
+.HP
+\fIldns_rr_list_free\fR()
+frees an rr_list structure.
+\.br
+\fBrr_list\fR: the list to free
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_pop_rr.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_pop_rr.3
new file mode 120000
index 00000000000000..8942e3f466ba33
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_pop_rr.3
@@ -0,0 +1 @@
+ldns_rr_list_cat.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_push_rr.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_push_rr.3
new file mode 120000
index 00000000000000..8942e3f466ba33
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_push_rr.3
@@ -0,0 +1 @@
+ldns_rr_list_cat.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_rr_count.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_rr_count.3
new file mode 100644
index 00000000000000..7e5f157ff6dbe8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_rr_count.3
@@ -0,0 +1,58 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_list_rr_count, ldns_rr_list_set_rr_count \- get and set ldns_rr_list length
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list);
+.PP
+void ldns_rr_list_set_rr_count(ldns_rr_list *rr_list, size_t count);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_list_rr_count\fR()
+returns the number of rr's in an rr_list.
+\.br
+\fBrr_list\fR: the rr_list to read from
+\.br
+Returns the number of rr's
+.PP
+.HP
+\fIldns_rr_list_set_rr_count\fR()
+sets the number of rr's in an rr_list.
+\.br
+\fBrr_list\fR: the rr_list to set the count on
+\.br
+\fBcount\fR: the number of rr in this list
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_set_rr_count.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_set_rr_count.3
new file mode 120000
index 00000000000000..34a0d778968dc3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_set_rr_count.3
@@ -0,0 +1 @@
+ldns_rr_list_rr_count.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_list_sort.3 b/contrib/ldns/doc/man/man3/ldns_rr_list_sort.3
new file mode 100644
index 00000000000000..84c6d5add0dcf5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_list_sort.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_list_sort \- sort a ldns_rr_list
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_rr_list_sort(ldns_rr_list *unsorted);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_list_sort\fR()
+sorts an rr_list (canonical wire format). the sorting is done inband.
+\.br
+\fBunsorted\fR: the rr_list to be sorted
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_mx_exchange.3 b/contrib/ldns/doc/man/man3/ldns_rr_mx_exchange.3
new file mode 120000
index 00000000000000..d216954869df11
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_mx_exchange.3
@@ -0,0 +1 @@
+ldns_rr_mx_preference.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_mx_preference.3 b/contrib/ldns/doc/man/man3/ldns_rr_mx_preference.3
new file mode 100644
index 00000000000000..0727fe5e898ebc
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_mx_preference.3
@@ -0,0 +1,54 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_mx_preference, ldns_rr_mx_exchange \- get MX RR rdata fields
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rr_mx_preference(const ldns_rr *r);
+.PP
+ldns_rdf* ldns_rr_mx_exchange(const ldns_rr *r);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_mx_preference\fR()
+returns the mx pref. of a \%LDNS_RR_TYPE_MX rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the preference or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_mx_exchange\fR()
+returns the mx host of a \%LDNS_RR_TYPE_MX rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the name of the \%MX host or \%NULL on failure
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_new.3 b/contrib/ldns/doc/man/man3/ldns_rr_new.3
new file mode 100644
index 00000000000000..8855c7251c6d75
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_new.3
@@ -0,0 +1,123 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_new, ldns_rr_new_frm_type, ldns_rr_new_frm_str, ldns_rr_new_frm_fp, ldns_rr_free, ldns_rr_print \- ldns_rr creation, destruction and printing
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr* ldns_rr_new(void);
+.PP
+ldns_rr* ldns_rr_new_frm_type(ldns_rr_type t);
+.PP
+ldns_status ldns_rr_new_frm_str(ldns_rr **n, const char *str, uint32_t default_ttl, const ldns_rdf *origin, ldns_rdf **prev);
+.PP
+ldns_status ldns_rr_new_frm_fp(ldns_rr **rr, FILE *fp, uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev);
+.PP
+void ldns_rr_free(ldns_rr *rr);
+.PP
+void ldns_rr_print(FILE *output, const ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_new\fR()
+creates a new rr structure.
+\.br
+Returns ldns_rr *
+.PP
+.HP
+\fIldns_rr_new_frm_type\fR()
+creates a new rr structure, based on the given type.
+alloc enough space to hold all the rdf's
+.PP
+.HP
+\fIldns_rr_new_frm_str\fR()
+creates an rr from a string.
+The string should be a fully filled-in rr, like
+ownername &lt;space&gt; \%TTL &lt;space&gt; \%CLASS &lt;space&gt;
+\%TYPE &lt;space&gt; \%RDATA.
+\.br
+\fBn\fR: the rr to return
+\.br
+\fBstr\fR: the string to convert
+\.br
+\fBdefault_ttl\fR: default ttl value for the rr.
+If 0 \%DEF_TTL will be used
+\.br
+\fBorigin\fR: when the owner is relative add this.
+The caller must ldns_rdf_deep_free it.
+\.br
+\fBprev\fR: the previous ownername. if this value is not \%NULL,
+the function overwrites this with the ownername found in this
+string. The caller must then ldns_rdf_deep_free it.
+\.br
+Returns a status msg describing an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_rr_new_frm_fp\fR()
+creates a new rr from a file containing a string.
+\.br
+\fBrr\fR: the new rr
+\.br
+\fBfp\fR: the file pointer to use
+\.br
+\fBdefault_ttl\fR: pointer to a default ttl for the rr. If \%NULL \%DEF_TTL will be used
+the pointer will be updated if the file contains a $\%TTL directive
+\.br
+\fBorigin\fR: when the owner is relative add this
+the pointer will be updated if the file contains a $\%ORIGIN directive
+The caller must ldns_rdf_deep_free it.
+\.br
+\fBprev\fR: when the owner is whitespaces use this as the * ownername
+the pointer will be updated after the call
+The caller must ldns_rdf_deep_free it.
+\.br
+Returns a ldns_status with an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_rr_free\fR()
+frees an \%RR structure
+\.br
+\fB*rr\fR: the \%RR to be freed
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_print\fR()
+Prints the data in the resource record to the given file stream
+(in presentation format)
+
+\.br
+\fBoutput\fR: the file stream to print to
+\.br
+\fBrr\fR: the resource record to print
+\.br
+Returns void
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_new_frm_fp.3 b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_fp.3
new file mode 120000
index 00000000000000..b5c80ecde4714a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_fp.3
@@ -0,0 +1 @@
+ldns_rr_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_new_frm_str.3 b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_str.3
new file mode 120000
index 00000000000000..b5c80ecde4714a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_str.3
@@ -0,0 +1 @@
+ldns_rr_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_new_frm_type.3 b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_type.3
new file mode 120000
index 00000000000000..b5c80ecde4714a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_new_frm_type.3
@@ -0,0 +1 @@
+ldns_rr_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_ns_nsdname.3 b/contrib/ldns/doc/man/man3/ldns_rr_ns_nsdname.3
new file mode 100644
index 00000000000000..547e6dab1c74a2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_ns_nsdname.3
@@ -0,0 +1,44 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_ns_nsdname \- get dname rdata field from NS RR
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rr_ns_nsdname(const ldns_rr *r);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_ns_nsdname\fR()
+returns the name of a \%LDNS_RR_TYPE_NS rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the name or \%NULL on failure
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_owner.3 b/contrib/ldns/doc/man/man3/ldns_rr_owner.3
new file mode 120000
index 00000000000000..7ac87b76db7c74
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_owner.3
@@ -0,0 +1 @@
+ldns_rr_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_pop_rdf.3 b/contrib/ldns/doc/man/man3/ldns_rr_pop_rdf.3
new file mode 120000
index 00000000000000..605449a1f5217c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_pop_rdf.3
@@ -0,0 +1 @@
+ldns_rr_push_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_print.3 b/contrib/ldns/doc/man/man3/ldns_rr_print.3
new file mode 120000
index 00000000000000..b5c80ecde4714a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_print.3
@@ -0,0 +1 @@
+ldns_rr_new.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_push_rdf.3 b/contrib/ldns/doc/man/man3/ldns_rr_push_rdf.3
new file mode 100644
index 00000000000000..877213b1154a10
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_push_rdf.3
@@ -0,0 +1,60 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_push_rdf, ldns_rr_pop_rdf \- push and pop rdata fields
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_rr_push_rdf(ldns_rr *rr, const ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_pop_rdf(ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_push_rdf\fR()
+sets rd_field member, it will be
+placed in the next available spot.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fB*f\fR: the data field member to set
+\.br
+Returns bool
+.PP
+.HP
+\fIldns_rr_pop_rdf\fR()
+removes a rd_field member, it will be
+popped from the last position.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+Returns rdf which was popped (null if nothing)
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rd_count.3 b/contrib/ldns/doc/man/man3/ldns_rr_rd_count.3
new file mode 120000
index 00000000000000..7ac87b76db7c74
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rd_count.3
@@ -0,0 +1 @@
+ldns_rr_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rdata2buffer_wire.3 b/contrib/ldns/doc/man/man3/ldns_rr_rdata2buffer_wire.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rdata2buffer_wire.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rdf.3 b/contrib/ldns/doc/man/man3/ldns_rr_rdf.3
new file mode 100644
index 00000000000000..fa34a5acb88b75
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rdf.3
@@ -0,0 +1,88 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_rdf, ldns_rr_owner, ldns_rr_rd_count, ldns_rr_ttl, ldns_rr_get_class \- access rdata fields on ldns_rr
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rr_rdf(const ldns_rr *rr, size_t nr);
+.PP
+ldns_rdf* ldns_rr_owner(const ldns_rr *rr);
+.PP
+size_t ldns_rr_rd_count(const ldns_rr *rr);
+.PP
+uint32_t ldns_rr_ttl(const ldns_rr *rr);
+.PP
+ldns_rr_class ldns_rr_get_class(const ldns_rr *rr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_rdf\fR()
+returns the rdata field member counter.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fBnr\fR: the number of the rdf to return
+\.br
+Returns ldns_rdf *
+.PP
+.HP
+\fIldns_rr_owner\fR()
+returns the owner name of an rr structure.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+Returns ldns_rdf *
+.PP
+.HP
+\fIldns_rr_rd_count\fR()
+returns the rd_count of an rr structure.
+\.br
+\fB*rr\fR: the rr to read from
+\.br
+Returns the rd count of the rr
+.PP
+.HP
+\fIldns_rr_ttl\fR()
+returns the ttl of an rr structure.
+\.br
+\fB*rr\fR: the rr to read from
+\.br
+Returns the ttl of the rr
+.PP
+.HP
+\fIldns_rr_get_class\fR()
+returns the class of the rr.
+\.br
+\fB*rr\fR: the rr to read from
+\.br
+Returns the class of the rr
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_algorithm.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_algorithm.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_expiration.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_expiration.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_expiration.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_inception.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_inception.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_inception.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_keytag.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_keytag.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_keytag.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_labels.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_labels.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_labels.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_origttl.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_origttl.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_origttl.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_algorithm.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_algorithm.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_algorithm.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_expiration.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_expiration.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_expiration.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_inception.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_inception.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_inception.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_keytag.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_keytag.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_keytag.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_labels.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_labels.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_labels.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_origttl.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_origttl.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_origttl.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_sig.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_sig.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_sig.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_signame.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_signame.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_signame.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_typecovered.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_typecovered.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_set_typecovered.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_sig.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_sig.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_sig.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_signame.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_signame.3
new file mode 120000
index 00000000000000..e1efe3b2cec93a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_signame.3
@@ -0,0 +1 @@
+ldns_rr_rrsig_typecovered.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_rrsig_typecovered.3 b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_typecovered.3
new file mode 100644
index 00000000000000..50667b5f1c10c2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_rrsig_typecovered.3
@@ -0,0 +1,232 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_rrsig_typecovered, ldns_rr_rrsig_set_typecovered, ldns_rr_rrsig_algorithm, ldns_rr_rrsig_set_algorithm, ldns_rr_rrsig_labels, ldns_rr_rrsig_set_labels, ldns_rr_rrsig_origttl, ldns_rr_rrsig_set_origttl, ldns_rr_rrsig_expiration, ldns_rr_rrsig_set_expiration, ldns_rr_rrsig_inception, ldns_rr_rrsig_set_inception, ldns_rr_rrsig_keytag, ldns_rr_rrsig_set_keytag, ldns_rr_rrsig_signame, ldns_rr_rrsig_set_signame, ldns_rr_rrsig_sig, ldns_rr_rrsig_set_sig \- get and set RRSIG RR rdata fields
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_rr_rrsig_typecovered(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_algorithm(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_labels(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_origttl(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_expiration(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_inception(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_keytag(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_signame(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f);
+.PP
+ldns_rdf* ldns_rr_rrsig_sig(const ldns_rr *r);
+.PP
+bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_rrsig_typecovered\fR()
+returns the type covered of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the type covered or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_typecovered\fR()
+sets the typecovered of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the typecovered to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_algorithm\fR()
+returns the algorithm of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the algorithm or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_algorithm\fR()
+sets the algorithm of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the algorithm to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_labels\fR()
+returns the number of labels of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the number of labels or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_labels\fR()
+sets the number of labels of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the number of labels to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_origttl\fR()
+returns the original \%TTL of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the original \%TTL or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_origttl\fR()
+sets the original \%TTL of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the original \%TTL to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_expiration\fR()
+returns the expiration time of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the expiration time or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_expiration\fR()
+sets the expiration date of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the expiration date to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_inception\fR()
+returns the inception time of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the inception time or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_inception\fR()
+sets the inception date of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the inception date to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_keytag\fR()
+returns the keytag of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the keytag or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_keytag\fR()
+sets the keytag of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the keytag to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_signame\fR()
+returns the signers name of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the signers name or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_signame\fR()
+sets the signers name of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the signers name to set
+\.br
+Returns true on success, false otherwise
+.PP
+.HP
+\fIldns_rr_rrsig_sig\fR()
+returns the signature data of a \%LDNS_RR_TYPE_RRSIG \%RR
+\.br
+\fBr\fR: the resource record
+\.br
+Returns a ldns_rdf* with the signature data or \%NULL on failure
+.PP
+.HP
+\fIldns_rr_rrsig_set_sig\fR()
+sets the signature data of a \%LDNS_RR_TYPE_RRSIG rr
+\.br
+\fBr\fR: the rr to use
+\.br
+\fBf\fR: the signature data to set
+\.br
+Returns true on success, false otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_class.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_class.3
new file mode 120000
index 00000000000000..ae969a4cd61495
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_class.3
@@ -0,0 +1 @@
+ldns_rr_set_owner.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_owner.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_owner.3
new file mode 100644
index 00000000000000..7b256cfbdd81a5
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_owner.3
@@ -0,0 +1,111 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_set_owner, ldns_rr_set_ttl, ldns_rr_set_type, ldns_rr_set_rd_count, ldns_rr_set_class, ldns_rr_set_rdf \- set ldns_rr attributes
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner);
+.PP
+void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl);
+.PP
+void ldns_rr_set_type(ldns_rr *rr, ldns_rr_type rr_type);
+.PP
+void ldns_rr_set_rd_count(ldns_rr *rr, size_t count);
+.PP
+void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class);
+.PP
+ldns_rdf* ldns_rr_set_rdf(ldns_rr *rr, const ldns_rdf *f, size_t position);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_set_owner\fR()
+sets the owner in the rr structure.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fB*owner\fR: set to this owner
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_set_ttl\fR()
+sets the ttl in the rr structure.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fBttl\fR: set to this ttl
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_set_type\fR()
+sets the type in the rr.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fBrr_type\fR: set to this type
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_set_rd_count\fR()
+sets the rd_count in the rr.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fBcount\fR: set to this count
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_set_class\fR()
+sets the class in the rr.
+\.br
+\fB*rr\fR: rr to operate on
+\.br
+\fBrr_class\fR: set to this class
+\.br
+Returns void
+.PP
+.HP
+\fIldns_rr_set_rdf\fR()
+sets a rdf member, it will be set on the
+position given. The old value is returned, like pop.
+\.br
+\fB*rr\fR: the rr to operate on
+\.br
+\fB*f\fR: the rdf to set
+\.br
+\fBposition\fR: the position the set the rdf
+\.br
+Returns the old value in the rr, \%NULL on failure
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_pop_rr.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_pop_rr.3
new file mode 120000
index 00000000000000..a831823259504b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_pop_rr.3
@@ -0,0 +1 @@
+ldns_rr_set_push_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_push_rr.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_push_rr.3
new file mode 100644
index 00000000000000..62a005a32bd0b1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_push_rr.3
@@ -0,0 +1,60 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_set_push_rr, ldns_rr_set_pop_rr \- push and pop rr on a rrset
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_rr_set_push_rr(ldns_rr_list *rr_list, ldns_rr *rr);
+.PP
+ldns_rr* ldns_rr_set_pop_rr(ldns_rr_list *rr_list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_set_push_rr\fR()
+pushes an rr to an rrset (which really are rr_list's).
+\.br
+\fB*rr_list\fR: the rrset to push the rr to
+\.br
+\fB*rr\fR: the rr to push
+\.br
+Returns true if the push succeeded otherwise false
+.PP
+.HP
+\fIldns_rr_set_pop_rr\fR()
+pops the last rr from an rrset. This function is there only
+for the symmetry.
+\.br
+\fBrr_list\fR: the rr_list to pop from
+\.br
+Returns \%NULL if nothing to pop. Otherwise the popped \%RR
+
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_rd_count.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_rd_count.3
new file mode 120000
index 00000000000000..ae969a4cd61495
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_rd_count.3
@@ -0,0 +1 @@
+ldns_rr_set_owner.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_rdf.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_rdf.3
new file mode 120000
index 00000000000000..ae969a4cd61495
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_rdf.3
@@ -0,0 +1 @@
+ldns_rr_set_owner.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_ttl.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_ttl.3
new file mode 120000
index 00000000000000..ae969a4cd61495
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_ttl.3
@@ -0,0 +1 @@
+ldns_rr_set_owner.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_set_type.3 b/contrib/ldns/doc/man/man3/ldns_rr_set_type.3
new file mode 120000
index 00000000000000..ae969a4cd61495
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_set_type.3
@@ -0,0 +1 @@
+ldns_rr_set_owner.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_ttl.3 b/contrib/ldns/doc/man/man3/ldns_rr_ttl.3
new file mode 120000
index 00000000000000..7ac87b76db7c74
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_ttl.3
@@ -0,0 +1 @@
+ldns_rr_rdf.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_type.3 b/contrib/ldns/doc/man/man3/ldns_rr_type.3
new file mode 120000
index 00000000000000..270bcc371e2cf1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_type.3
@@ -0,0 +1 @@
+ldns_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_rr_uncompressed_size.3 b/contrib/ldns/doc/man/man3/ldns_rr_uncompressed_size.3
new file mode 100644
index 00000000000000..be6858408dbe9d
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rr_uncompressed_size.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_rr_uncompressed_size \- calculates the uncompressed size of an RR
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_rr_uncompressed_size(const ldns_rr *r);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_rr_uncompressed_size\fR()
+calculates the uncompressed size of an \%RR.
+\.br
+\fBr\fR: the rr to operate on
+\.br
+Returns size of the rr
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr\fR, \fIldns_rr_list\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_rrsig2buffer_wire.3 b/contrib/ldns/doc/man/man3/ldns_rrsig2buffer_wire.3
new file mode 120000
index 00000000000000..7624fd4a576600
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_rrsig2buffer_wire.3
@@ -0,0 +1 @@
+ldns_pkt2buffer_str.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_send.3 b/contrib/ldns/doc/man/man3/ldns_send.3
new file mode 100644
index 00000000000000..69876aac36dc53
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_send.3
@@ -0,0 +1,41 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_send \- send a packet
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_send();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_send\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_pkt\fR, \fIldns_resolver\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_sign_public.3 b/contrib/ldns/doc/man/man3/ldns_sign_public.3
new file mode 100644
index 00000000000000..dd091c4985cbc8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_sign_public.3
@@ -0,0 +1,48 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_sign_public \- sign an rrset
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list* ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_sign_public\fR()
+Sign an rrset
+\.br
+\fBrrset\fR: the rrset
+\.br
+\fBkeys\fR: the keys to use
+\.br
+Returns a rr_list with the signatures
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_sign_public_dsa\fR, \fIldns_sign_public_rsamd5\fR, \fIldns_sign_public_rsasha1\fR, \fIldns_verify\fR, \fIldns_verify_rrsig\fR, \fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_sign_public_dsa.3 b/contrib/ldns/doc/man/man3/ldns_sign_public_dsa.3
new file mode 100644
index 00000000000000..94409f121e21de
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_sign_public_dsa.3
@@ -0,0 +1,73 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_sign_public_dsa, ldns_sign_public_rsamd5, ldns_sign_public_rsasha1 \- sign buffer
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rdf* ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key);
+.PP
+ldns_rdf* ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key);
+.PP
+ldns_rdf* ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_sign_public_dsa\fR()
+Sign a buffer with the \%DSA key (hash with SHA1)
+
+\.br
+\fBto_sign\fR: The ldns_buffer containing raw data that is to be signed
+\.br
+\fBkey\fR: The \%DSA key structure to sign with
+\.br
+Returns a ldns_rdf for the \%RRSIG ldns_rr
+.PP
+.HP
+\fIldns_sign_public_rsamd5\fR()
+Sign a buffer with the \%RSA key (hash with MD5)
+\.br
+\fBto_sign\fR: buffer with the data
+\.br
+\fBkey\fR: the key to use
+\.br
+Returns a ldns_rdf with the signed data
+.PP
+.HP
+\fIldns_sign_public_rsasha1\fR()
+Sign a buffer with the \%RSA key (hash with SHA1)
+\.br
+\fBto_sign\fR: buffer with the data
+\.br
+\fBkey\fR: the key to use
+\.br
+Returns a ldns_rdf with the signed data
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_sign_public\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_sign_public_rsamd5.3 b/contrib/ldns/doc/man/man3/ldns_sign_public_rsamd5.3
new file mode 120000
index 00000000000000..5733c48b2ec8d1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_sign_public_rsamd5.3
@@ -0,0 +1 @@
+ldns_sign_public_dsa.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_sign_public_rsasha1.3 b/contrib/ldns/doc/man/man3/ldns_sign_public_rsasha1.3
new file mode 120000
index 00000000000000..5733c48b2ec8d1
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_sign_public_rsasha1.3
@@ -0,0 +1 @@
+ldns_sign_public_dsa.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_status.3 b/contrib/ldns/doc/man/man3/ldns_status.3
new file mode 120000
index 00000000000000..738e3a18c1acc6
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_status.3
@@ -0,0 +1 @@
+ldns_get_errorstr_by_id.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_str2period.3 b/contrib/ldns/doc/man/man3/ldns_str2period.3
new file mode 100644
index 00000000000000..b78acbf4c351bb
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_str2period.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_str2period \- converts a ttl value (like 5d2h) to a long
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+uint32_t ldns_str2period(const char *nptr, const char **endptr);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_str2period\fR()
+converts a ttl value (like 5d2h) to a long.
+\.br
+\fBnptr\fR: the start of the string
+\.br
+\fBendptr\fR: points to the last char in case of error
+\.br
+Returns the convert duration value
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_tcp_connect.3 b/contrib/ldns/doc/man/man3/ldns_tcp_connect.3
new file mode 120000
index 00000000000000..2f88fceb460437
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_tcp_connect.3
@@ -0,0 +1 @@
+ldns_tcp_send_query.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_tcp_read_wire.3 b/contrib/ldns/doc/man/man3/ldns_tcp_read_wire.3
new file mode 120000
index 00000000000000..2f88fceb460437
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_tcp_read_wire.3
@@ -0,0 +1 @@
+ldns_tcp_send_query.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_tcp_send_query.3 b/contrib/ldns/doc/man/man3/ldns_tcp_send_query.3
new file mode 100644
index 00000000000000..f551c389285118
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_tcp_send_query.3
@@ -0,0 +1,51 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_tcp_send_query, ldns_tcp_read_wire, ldns_tcp_connect \- tcp queries
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_tcp_send_query();
+.PP
+ ldns_tcp_read_wire();
+.PP
+ ldns_tcp_connect();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_tcp_send_query\fR()
+.PP
+.HP
+\fIldns_tcp_read_wire\fR()
+.PP
+.HP
+\fIldns_tcp_connect\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_send\fR, \fIldns_pkt\fR, \fIldns_resolver\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_update_adcount.3 b/contrib/ldns/doc/man/man3/ldns_update_adcount.3
new file mode 120000
index 00000000000000..cddae856831f2c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_adcount.3
@@ -0,0 +1 @@
+ldns_update_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_pkt_new.3 b/contrib/ldns/doc/man/man3/ldns_update_pkt_new.3
new file mode 100644
index 00000000000000..50482bf84de591
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_pkt_new.3
@@ -0,0 +1,55 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_update_pkt_new \- create an update packet
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_pkt* ldns_update_pkt_new(ldns_rdf *zone_rdf, ldns_rr_class clas, const ldns_rr_list *pr_rrlist, const ldns_rr_list *up_rrlist, const ldns_rr_list *ad_rrlist);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_update_pkt_new\fR()
+create an update packet from zone name, class and the rr lists
+\.br
+\fBzone_rdf\fR: name of the zone
+The returned packet will take ownership of zone_rdf, so the caller should not free it
+\.br
+\fBclas\fR: zone class
+\.br
+\fBpr_rrlist\fR: list of Prerequisite Section RRs
+\.br
+\fBup_rrlist\fR: list of Updates Section RRs
+\.br
+\fBad_rrlist\fR: list of Additional Data Section RRs (currently unused)
+\.br
+Returns the new packet
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_update_pkt_tsig_add\fR, \fIldns_update_pkt_tsig_add\fR, \fIldns_update_zocount\fR, \fIldns_update_prcount\fR, \fIldns_update_upcount\fR, \fIldns_update_adcount\fR, \fIldns_update_set_zocount\fR, \fIldns_update_set_prcount\fR, \fIldns_update_set_upcount\fR, \fIldns_update_set_adcount\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_update_pkt_tsig_add.3 b/contrib/ldns/doc/man/man3/ldns_update_pkt_tsig_add.3
new file mode 100644
index 00000000000000..8246c505430d57
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_pkt_tsig_add.3
@@ -0,0 +1,50 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_update_pkt_tsig_add \- add resolver's tsig credentials to an ldns_pkt
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_update_pkt_tsig_add(ldns_pkt *p, const ldns_resolver *r);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_update_pkt_tsig_add\fR()
+add tsig credentials to
+a packet from a resolver
+\.br
+\fBp\fR: packet to copy to
+\.br
+\fBr\fR: resolver to copy from
+
+\.br
+Returns status whether successful or not
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_update_pkt_new\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_update_prcount.3 b/contrib/ldns/doc/man/man3/ldns_update_prcount.3
new file mode 120000
index 00000000000000..cddae856831f2c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_prcount.3
@@ -0,0 +1 @@
+ldns_update_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_set_adcount.3 b/contrib/ldns/doc/man/man3/ldns_update_set_adcount.3
new file mode 120000
index 00000000000000..021a1df3cfa447
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_set_adcount.3
@@ -0,0 +1 @@
+ldns_update_set_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_set_prcount.3 b/contrib/ldns/doc/man/man3/ldns_update_set_prcount.3
new file mode 120000
index 00000000000000..021a1df3cfa447
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_set_prcount.3
@@ -0,0 +1 @@
+ldns_update_set_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_set_upcount.3 b/contrib/ldns/doc/man/man3/ldns_update_set_upcount.3
new file mode 120000
index 00000000000000..021a1df3cfa447
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_set_upcount.3
@@ -0,0 +1 @@
+ldns_update_set_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_set_zocount.3 b/contrib/ldns/doc/man/man3/ldns_update_set_zocount.3
new file mode 100644
index 00000000000000..65b6db35b8087f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_set_zocount.3
@@ -0,0 +1,71 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_update_set_zocount, ldns_update_set_prcount, ldns_update_set_upcount, ldns_update_set_adcount \- set the update packet counters
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_update_set_zocount();
+.PP
+void ldns_update_set_prcount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_update_set_upcount(ldns_pkt *p, uint16_t c);
+.PP
+void ldns_update_set_adcount(ldns_pkt *p, uint16_t c);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_update_set_zocount\fR()
+.PP
+.HP
+\fIldns_update_set_prcount\fR()
+Set the pr count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the pr count to set
+.PP
+.HP
+\fIldns_update_set_upcount\fR()
+Set the up count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the up count to set
+.PP
+.HP
+\fIldns_update_set_adcount\fR()
+Set the ad count
+\.br
+\fBp\fR: the packet
+\.br
+\fBc\fR: the ad count to set
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_update_pkt_new\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_update_upcount.3 b/contrib/ldns/doc/man/man3/ldns_update_upcount.3
new file mode 120000
index 00000000000000..cddae856831f2c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_upcount.3
@@ -0,0 +1 @@
+ldns_update_zocount.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_update_zocount.3 b/contrib/ldns/doc/man/man3/ldns_update_zocount.3
new file mode 100644
index 00000000000000..46a2f1537ce11a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_update_zocount.3
@@ -0,0 +1,71 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_update_zocount, ldns_update_prcount, ldns_update_upcount, ldns_update_adcount \- return update packet counters
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+uint16_t ldns_update_zocount(const ldns_pkt *p);
+.PP
+uint16_t ldns_update_prcount(const ldns_pkt *p);
+.PP
+uint16_t ldns_update_upcount(const ldns_pkt *p);
+.PP
+ ldns_update_adcount();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_update_zocount\fR()
+Get the zo count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the zo count
+.PP
+.HP
+\fIldns_update_prcount\fR()
+Get the zo count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the pr count
+.PP
+.HP
+\fIldns_update_upcount\fR()
+Get the zo count
+\.br
+\fBp\fR: the packet
+\.br
+Returns the up count
+.PP
+.HP
+\fIldns_update_adcount\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_update_pkt_new\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_verify.3 b/contrib/ldns/doc/man/man3/ldns_verify.3
new file mode 100644
index 00000000000000..e1804ab0d841a3
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify.3
@@ -0,0 +1,127 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_verify, ldns_verify_rrsig, ldns_verify_rrsig_keylist, ldns_verify_rrsig_keylist_notime, ldns_verify_notime \- verify rrsigs
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_verify(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys);
+.PP
+ldns_status ldns_verify_rrsig(ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key);
+.PP
+ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys);
+.PP
+ldns_status ldns_verify_rrsig_keylist_notime(const ldns_rr_list *rrset, const ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys);
+.PP
+ldns_status ldns_verify_notime(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_verify\fR()
+Verifies a list of signatures for one rrset.
+
+\.br
+\fBrrset\fR: the rrset to verify
+\.br
+\fBrrsig\fR: a list of signatures to check
+\.br
+\fBkeys\fR: a list of keys to check with
+\.br
+\fBgood_keys\fR: if this is a (initialized) list, the pointer to keys
+from keys that validate one of the signatures
+are added to it
+\.br
+Returns status \%LDNS_STATUS_OK if there is at least one correct key
+.PP
+.HP
+\fIldns_verify_rrsig\fR()
+verify an rrsig with 1 key
+\.br
+\fBrrset\fR: the rrset
+\.br
+\fBrrsig\fR: the rrsig to verify
+\.br
+\fBkey\fR: the key to use
+\.br
+Returns status message whether verification succeeded.
+.PP
+.HP
+\fIldns_verify_rrsig_keylist\fR()
+Verifies an rrsig. All keys in the keyset are tried.
+\.br
+\fBrrset\fR: the rrset to check
+\.br
+\fBrrsig\fR: the signature of the rrset
+\.br
+\fBkeys\fR: the keys to try
+\.br
+\fBgood_keys\fR: if this is a (initialized) list, the pointer to keys
+from keys that validate one of the signatures
+are added to it
+\.br
+Returns a list of keys which validate the rrsig + rrset. Returns
+status \%LDNS_STATUS_OK if at least one key matched. Else an error.
+.PP
+.HP
+\fIldns_verify_rrsig_keylist_notime\fR()
+Verifies an rrsig. All keys in the keyset are tried. Time is not checked.
+\.br
+\fBrrset\fR: the rrset to check
+\.br
+\fBrrsig\fR: the signature of the rrset
+\.br
+\fBkeys\fR: the keys to try
+\.br
+\fBgood_keys\fR: if this is a (initialized) list, the pointer to keys
+from keys that validate one of the signatures
+are added to it
+\.br
+Returns a list of keys which validate the rrsig + rrset. Returns
+status \%LDNS_STATUS_OK if at least one key matched. Else an error.
+.PP
+.HP
+\fIldns_verify_notime\fR()
+Verifies a list of signatures for one rrset, but disregard the time.
+Inception and Expiration are not checked.
+
+\.br
+\fBrrset\fR: the rrset to verify
+\.br
+\fBrrsig\fR: a list of signatures to check
+\.br
+\fBkeys\fR: a list of keys to check with
+\.br
+\fBgood_keys\fR: if this is a (initialized) list, the pointer to keys
+from keys that validate one of the signatures
+are added to it
+\.br
+Returns status \%LDNS_STATUS_OK if there is at least one correct key
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_verify_rrsig_evp\fR, \fIldns_verify_rrsig_dsa\fR, \fIldns_verify_rrsig_rsasha1\fR, \fIldns_verify_rrsig_rsamd5\fR, \fIldns_sign_public\fR, \fIldns_zone_sign\fR, \fIldns_key\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_notime.3 b/contrib/ldns/doc/man/man3/ldns_verify_notime.3
new file mode 120000
index 00000000000000..c5978245821a28
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_notime.3
@@ -0,0 +1 @@
+ldns_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig.3
new file mode 120000
index 00000000000000..c5978245821a28
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig.3
@@ -0,0 +1 @@
+ldns_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig_dsa.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_dsa.3
new file mode 100644
index 00000000000000..6e4880feebb524
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_dsa.3
@@ -0,0 +1,78 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_verify_rrsig_dsa, ldns_verify_rrsig_rsasha1, ldns_verify_rrsig_rsamd5 \- verify signature data buffers
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key);
+.PP
+ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key);
+.PP
+ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_verify_rrsig_dsa\fR()
+verifies a buffer with signature data (\%DSA) for a buffer with rrset data 
+with a buffer with key data.
+
+\.br
+\fBsig\fR: the signature data
+\.br
+\fBrrset\fR: the rrset data, sorted and processed for verification
+\.br
+\fBkey\fR: the key data
+.PP
+.HP
+\fIldns_verify_rrsig_rsasha1\fR()
+verifies a buffer with signature data (RSASHA1) for a buffer with rrset data 
+with a buffer with key data.
+
+\.br
+\fBsig\fR: the signature data
+\.br
+\fBrrset\fR: the rrset data, sorted and processed for verification
+\.br
+\fBkey\fR: the key data
+.PP
+.HP
+\fIldns_verify_rrsig_rsamd5\fR()
+verifies a buffer with signature data (RSAMD5) for a buffer with rrset data 
+with a buffer with key data.
+
+\.br
+\fBsig\fR: the signature data
+\.br
+\fBrrset\fR: the rrset data, sorted and processed for verification
+\.br
+\fBkey\fR: the key data
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_key\fR, \fIldns_sign_public\fR, \fIldns_zone_sign\fR, \fIldns_verify\fR, \fIldns_verify_rrsig\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist.3
new file mode 120000
index 00000000000000..c5978245821a28
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist.3
@@ -0,0 +1 @@
+ldns_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist_notime.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist_notime.3
new file mode 120000
index 00000000000000..c5978245821a28
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_keylist_notime.3
@@ -0,0 +1 @@
+ldns_verify.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsamd5.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsamd5.3
new file mode 120000
index 00000000000000..495cd31e9ff532
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsamd5.3
@@ -0,0 +1 @@
+ldns_verify_rrsig_dsa.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsasha1.3 b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsasha1.3
new file mode 120000
index 00000000000000..495cd31e9ff532
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_verify_rrsig_rsasha1.3
@@ -0,0 +1 @@
+ldns_verify_rrsig_dsa.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_version.3 b/contrib/ldns/doc/man/man3/ldns_version.3
new file mode 100644
index 00000000000000..e4866928b4a27a
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_version.3
@@ -0,0 +1,39 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_version \- return library version
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ ldns_version();
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_version\fR()
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_wire2dname.3 b/contrib/ldns/doc/man/man3/ldns_wire2dname.3
new file mode 120000
index 00000000000000..4609c2b1203b6c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_wire2dname.3
@@ -0,0 +1 @@
+ldns_wire2rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_wire2pkt.3 b/contrib/ldns/doc/man/man3/ldns_wire2pkt.3
new file mode 120000
index 00000000000000..4609c2b1203b6c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_wire2pkt.3
@@ -0,0 +1 @@
+ldns_wire2rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_wire2rdf.3 b/contrib/ldns/doc/man/man3/ldns_wire2rdf.3
new file mode 120000
index 00000000000000..4609c2b1203b6c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_wire2rdf.3
@@ -0,0 +1 @@
+ldns_wire2rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_wire2rr.3 b/contrib/ldns/doc/man/man3/ldns_wire2rr.3
new file mode 100644
index 00000000000000..b4ebb0c9718c83
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_wire2rr.3
@@ -0,0 +1,123 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_wire2rr, ldns_wire2pkt, ldns_wire2rdf, ldns_wire2dname \- convert from wire format to host type
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_status ldns_wire2rr(ldns_rr **rr, const uint8_t *wire, size_t max, size_t *pos, ldns_pkt_section section);
+.PP
+ldns_status ldns_wire2pkt(ldns_pkt **packet, const uint8_t *data, size_t len);
+.PP
+ldns_status ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *pos);
+.PP
+ldns_status ldns_wire2dname(ldns_rdf **dname, const uint8_t *wire, size_t max, size_t *pos);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_wire2rr\fR()
+converts the data on the uint8_t bytearray (in wire format) to a \%DNS 
+resource record.
+This function will initialize and allocate memory space for the rr
+structure.
+The length of the wiredata of this rr is added to the *pos value.
+
+\.br
+\fBrr\fR: pointer to the structure to hold the rdata value
+\.br
+\fBwire\fR: pointer to the buffer with the data
+\.br
+\fBmax\fR: the length of the data buffer (in bytes)
+\.br
+\fBpos\fR: the position of the rr in the buffer (ie. the number of bytes 
+from the start of the buffer)
+\.br
+\fBsection\fR: the section in the packet the rr is meant for
+\.br
+Returns \%LDNS_STATUS_OK if everything succeeds, error otherwise
+.PP
+.HP
+\fIldns_wire2pkt\fR()
+converts the data on the uint8_t bytearray (in wire format) to a \%DNS packet.
+This function will initialize and allocate memory space for the packet 
+structure.
+
+\.br
+\fBpacket\fR: pointer to the structure to hold the packet
+\.br
+\fBdata\fR: pointer to the buffer with the data
+\.br
+\fBlen\fR: the length of the data buffer (in bytes)
+\.br
+Returns \%LDNS_STATUS_OK if everything succeeds, error otherwise
+.PP
+.HP
+\fIldns_wire2rdf\fR()
+converts the data on the uint8_t bytearray (in wire format) to \%DNS 
+rdata fields, and adds them to the list of rdfs of the given rr.
+This function will initialize and allocate memory space for the dname
+structures.
+The length of the wiredata of these rdfs is added to the *pos value.
+
+All rdfs belonging to the \%RR are read; the rr should have no rdfs
+yet. An error is returned if the format cannot be parsed.
+
+\.br
+\fBrr\fR: pointer to the ldns_rr structure to hold the rdata value
+\.br
+\fBwire\fR: pointer to the buffer with the data
+\.br
+\fBmax\fR: the length of the data buffer (in bytes)
+\.br
+\fBpos\fR: the position of the rdf in the buffer (ie. the number of bytes 
+from the start of the buffer)
+\.br
+Returns \%LDNS_STATUS_OK if everything succeeds, error otherwise
+.PP
+.HP
+\fIldns_wire2dname\fR()
+converts the data on the uint8_t bytearray (in wire format) to a \%DNS 
+dname rdata field. This function will initialize and allocate memory
+space for the dname structure. The length of the wiredata of this rdf 
+is added to the *pos value.
+
+\.br
+\fBdname\fR: pointer to the structure to hold the rdata value
+\.br
+\fBwire\fR: pointer to the buffer with the data
+\.br
+\fBmax\fR: the length of the data buffer (in bytes)
+\.br
+\fBpos\fR: the position of the rdf in the buffer (ie. the number of bytes 
+from the start of the buffer)
+\.br
+Returns \%LDNS_STATUS_OK if everything succeeds, error otherwise
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_rr2wire\fR, \fIldns_pkt2wire\fR, \fIldns_rdf2wire\fR, \fIldns_dname2wire\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone.3 b/contrib/ldns/doc/man/man3/ldns_zone.3
new file mode 100644
index 00000000000000..1c83234d607755
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone.3
@@ -0,0 +1,154 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone, ldns_zone_new, ldns_zone_free, ldns_zone_deep_free, ldns_zone_new_frm_fp, ldns_zone_new_frm_fp_l, ldns_zone_print, ldns_zone_print_fmt \- ldns_zone creation, destruction and printing
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_zone * ldns_zone_new(void);
+.PP
+void ldns_zone_free(ldns_zone *zone);
+.PP
+void ldns_zone_deep_free(ldns_zone *zone);
+.PP
+ldns_status ldns_zone_new_frm_fp(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t ttl, ldns_rr_class c);
+.PP
+ldns_status ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t ttl, ldns_rr_class c, int *line_nr);
+.PP
+void ldns_zone_print(FILE *output, const ldns_zone *z);
+.PP
+void ldns_zone_print_fmt(FILE *output, const ldns_output_format *fmt, const ldns_zone *z);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone\fR
+.br
+DNS Zone
+.br
+
+.br
+A list of RR's with some
+.br
+extra information which comes from the SOA RR
+.br
+Note: nothing has been done to make this efficient (yet).
+.br
+struct ldns_struct_zone
+.br
+{
+.br
+	\fBthe soa defines a zone:\fR
+.br
+	ldns_rr 	*_soa;
+.br
+	/* basically a zone is a list of rr's */
+.br
+	ldns_rr_list 	*_rrs;
+.br
+	/* we could change this to be a b-tree etc etc todo */
+.br
+};
+.br
+typedef struct ldns_struct_zone ldns_zone;	
+.PP
+.HP
+\fIldns_zone_new\fR()
+create a new ldns_zone structure
+\.br
+Returns a pointer to a ldns_zone structure
+.PP
+.HP
+\fIldns_zone_free\fR()
+Frees the allocated memory for the zone, and the rr_list structure in it
+\.br
+\fBzone\fR: the zone to free
+.PP
+.HP
+\fIldns_zone_deep_free\fR()
+Frees the allocated memory for the zone, the soa rr in it, 
+and the rr_list structure in it, including the rr's in that. etc.
+\.br
+\fBzone\fR: the zone to free
+.PP
+.HP
+\fIldns_zone_new_frm_fp\fR()
+Create a new zone from a file
+\.br
+\fBz\fR: the new zone
+\.br
+\fB*fp\fR: the filepointer to use
+\.br
+\fB*origin\fR: the zones' origin
+\.br
+\fBttl\fR: default ttl to use
+\.br
+\fBc\fR: default class to use (\%IN)
+
+\.br
+Returns ldns_status mesg with an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_zone_new_frm_fp_l\fR()
+Create a new zone from a file, keep track of the line numbering
+\.br
+\fBz\fR: the new zone
+\.br
+\fB*fp\fR: the filepointer to use
+\.br
+\fB*origin\fR: the zones' origin
+\.br
+\fBttl\fR: default ttl to use
+\.br
+\fBc\fR: default class to use (\%IN)
+\.br
+\fBline_nr\fR: used for error msg, to get to the line number
+
+\.br
+Returns ldns_status mesg with an error or \%LDNS_STATUS_OK
+.PP
+.HP
+\fIldns_zone_print\fR()
+Print a zone structure * to output. Note the \%SOA record
+is included in this output
+\.br
+\fBoutput\fR: the fd to print to
+\.br
+\fBz\fR: the zone to print
+.PP
+.HP
+\fIldns_zone_print_fmt\fR()
+Print a zone structure * to output. Note the \%SOA record
+is included in this output
+\.br
+\fBoutput\fR: the fd to print to
+\.br
+\fBfmt\fR: format of the textual representation
+\.br
+\fBz\fR: the zone to print
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_deep_free.3 b/contrib/ldns/doc/man/man3/ldns_zone_deep_free.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_deep_free.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_free.3 b/contrib/ldns/doc/man/man3/ldns_zone_free.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_free.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_glue_rr_list.3 b/contrib/ldns/doc/man/man3/ldns_zone_glue_rr_list.3
new file mode 120000
index 00000000000000..cc8febf823dd2c
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_glue_rr_list.3
@@ -0,0 +1 @@
+ldns_zone_sort.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_new.3 b/contrib/ldns/doc/man/man3/ldns_zone_new.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_new.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp.3 b/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp_l.3 b/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp_l.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_new_frm_fp_l.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_print.3 b/contrib/ldns/doc/man/man3/ldns_zone_print.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_print.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_print_fmt.3 b/contrib/ldns/doc/man/man3/ldns_zone_print_fmt.3
new file mode 120000
index 00000000000000..4cec49a3263f84
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_print_fmt.3
@@ -0,0 +1 @@
+ldns_zone.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_push_rr.3 b/contrib/ldns/doc/man/man3/ldns_zone_push_rr.3
new file mode 100644
index 00000000000000..5b1a453532533b
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_push_rr.3
@@ -0,0 +1,62 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_push_rr, ldns_zone_push_rr_list \- add rr's to a ldns_zone
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr);
+.PP
+bool ldns_zone_push_rr_list(ldns_zone *z, const ldns_rr_list *list);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_push_rr\fR()
+push an single rr to a zone structure. This function use pointer
+copying, so the rr_list structure inside z is modified!
+\.br
+\fBz\fR: the zone to add to
+\.br
+\fBrr\fR: the rr to add
+\.br
+Returns a true on success otherwise false
+.PP
+.HP
+\fIldns_zone_push_rr_list\fR()
+push an rrlist to a zone structure. This function use pointer
+copying, so the rr_list structure inside z is modified!
+\.br
+\fBz\fR: the zone to add to
+\.br
+\fBlist\fR: the list to add
+\.br
+Returns a true on success otherwise false
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_push_rr_list.3 b/contrib/ldns/doc/man/man3/ldns_zone_push_rr_list.3
new file mode 120000
index 00000000000000..6be4604e768d2f
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_push_rr_list.3
@@ -0,0 +1 @@
+ldns_zone_push_rr.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_rr_count.3 b/contrib/ldns/doc/man/man3/ldns_zone_rr_count.3
new file mode 100644
index 00000000000000..ef4082f276aff2
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_rr_count.3
@@ -0,0 +1,46 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_rr_count \- get ldns_zone size
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+size_t ldns_zone_rr_count(const ldns_zone *z);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_rr_count\fR()
+Returns the number of resource records in the zone, \%NOT counting the \%SOA record
+\.br
+\fBz\fR: the zone to read from
+\.br
+Returns the number of rr's in the zone
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_rrs.3 b/contrib/ldns/doc/man/man3/ldns_zone_rrs.3
new file mode 100644
index 00000000000000..8e6df6dbae4c57
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_rrs.3
@@ -0,0 +1,58 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_rrs, ldns_zone_soa \- ldns_zone get content
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_rr_list * ldns_zone_rrs(const ldns_zone *z);
+.PP
+ldns_rr * ldns_zone_soa(const ldns_zone *z);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_rrs\fR()
+Get a list of a zone's content. Note that the \%SOA
+isn't included in this list. You need to get the 
+with ldns_zone_soa.
+\.br
+\fBz\fR: the zone to read from
+\.br
+Returns the rrs from this zone
+.PP
+.HP
+\fIldns_zone_soa\fR()
+Return the soa record of a zone
+\.br
+\fBz\fR: the zone to read from
+\.br
+Returns the soa record in the zone
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_zone ldns_zone_set_rrs\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_set_rrs.3 b/contrib/ldns/doc/man/man3/ldns_zone_set_rrs.3
new file mode 100644
index 00000000000000..b09c33d89188e8
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_set_rrs.3
@@ -0,0 +1,56 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_set_rrs, ldns_zone_set_soa \- ldns_zone set content
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_zone_set_rrs(ldns_zone *z, ldns_rr_list *rrlist);
+.PP
+void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_set_rrs\fR()
+Set the zone's contents
+\.br
+\fBz\fR: the zone to put the new soa in
+\.br
+\fBrrlist\fR: the rrlist to use
+.PP
+.HP
+\fIldns_zone_set_soa\fR()
+Set the zone's soa record
+\.br
+\fBz\fR: the zone to put the new soa in
+\.br
+\fBsoa\fR: the soa to set
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_zone\fR, \fIldns_zone_rrs\fR, \fIldns_zone_soa\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_set_soa.3 b/contrib/ldns/doc/man/man3/ldns_zone_set_soa.3
new file mode 120000
index 00000000000000..6d4c20b54ef678
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_set_soa.3
@@ -0,0 +1 @@
+ldns_zone_set_rrs.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_sign.3 b/contrib/ldns/doc/man/man3/ldns_zone_sign.3
new file mode 100644
index 00000000000000..21e8c155527b11
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_sign.3
@@ -0,0 +1,68 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_sign, ldns_zone_sign_nsec3 \- dnssec sign a zone
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+ldns_zone* ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list);
+.PP
+ldns_zone* ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_sign\fR()
+Signs the zone, and returns a newly allocated signed zone
+\.br
+\fBzone\fR: the zone to sign
+\.br
+\fBkey_list\fR: list of keys to sign with
+\.br
+Returns signed zone
+.PP
+.HP
+\fIldns_zone_sign_nsec3\fR()
+Signs the zone with NSEC3, and returns a newly allocated signed zone
+\.br
+\fBzone\fR: the zone to sign
+\.br
+\fBkey_list\fR: list of keys to sign with
+\.br
+\fBalgorithm\fR: the NSEC3 hashing algorithm to use
+\.br
+\fBflags\fR: NSEC3 flags
+\.br
+\fBiterations\fR: the number of NSEC3 hash iterations to use
+\.br
+\fBsalt_length\fR: the length (in octets) of the NSEC3 salt
+\.br
+\fBsalt\fR: the NSEC3 salt data
+\.br
+Returns signed zone
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+.SH SEE ALSO
+\fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_sign_nsec3.3 b/contrib/ldns/doc/man/man3/ldns_zone_sign_nsec3.3
new file mode 120000
index 00000000000000..9af7f2ae149ae4
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_sign_nsec3.3
@@ -0,0 +1 @@
+ldns_zone_sign.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_soa.3 b/contrib/ldns/doc/man/man3/ldns_zone_soa.3
new file mode 120000
index 00000000000000..8f0905d7480166
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_soa.3
@@ -0,0 +1 @@
+ldns_zone_rrs.3
\ No newline at end of file
diff --git a/contrib/ldns/doc/man/man3/ldns_zone_sort.3 b/contrib/ldns/doc/man/man3/ldns_zone_sort.3
new file mode 100644
index 00000000000000..7e0ab53d8133a9
--- /dev/null
+++ b/contrib/ldns/doc/man/man3/ldns_zone_sort.3
@@ -0,0 +1,62 @@
+.ad l
+.TH ldns 3 "30 May 2006"
+.SH NAME
+ldns_zone_sort, ldns_zone_glue_rr_list \- sort a zone and get the glue records
+
+.SH SYNOPSIS
+#include <stdint.h>
+.br
+#include <stdbool.h>
+.br
+.PP
+#include <ldns/ldns.h>
+.PP
+void ldns_zone_sort(ldns_zone *zone);
+.PP
+ldns_rr_list* ldns_zone_glue_rr_list(const ldns_zone *z);
+.PP
+
+.SH DESCRIPTION
+.HP
+\fIldns_zone_sort\fR()
+Sort the rrs in a zone, with the current impl. this is slow
+\.br
+\fBzone\fR: the zone to sort
+.PP
+.HP
+\fIldns_zone_glue_rr_list\fR()
+Retrieve all resource records from the zone that are glue
+records. The resulting list does are pointer references
+to the zone's data.
+
+Due to the current zone implementation (as a list of rr's), this
+function is extremely slow. Another (probably better) way to do this
+is to use an ldns_dnssec_zone structure and the 
+ldns_dnssec_mark_and_get_glue() function.
+
+\.br
+\fBz\fR: the zone to look for glue
+\.br
+Returns the rr_list with the glue
+.PP
+.SH AUTHOR
+The ldns team at NLnet Labs.
+
+.SH REPORTING BUGS
+Please report bugs to ldns-team@nlnetlabs.nl or in 
+our bugzilla at
+http://www.nlnetlabs.nl/bugs/index.html
+
+.SH COPYRIGHT
+Copyright (c) 2004 - 2006 NLnet Labs.
+.PP
+Licensed under the BSD License. There is NO warranty; not even for
+MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+.SH SEE ALSO
+\fIldns_zone\fR.
+And \fBperldoc Net::DNS\fR, \fBRFC1034\fR,
+\fBRFC1035\fR, \fBRFC4033\fR, \fBRFC4034\fR  and \fBRFC4035\fR.
+.SH REMARKS
+This manpage was automatically generated from the ldns source code.
diff --git a/contrib/ldns/doc/tutorial1_mx.dox b/contrib/ldns/doc/tutorial1_mx.dox
new file mode 100644
index 00000000000000..443e5aa7b18277
--- /dev/null
+++ b/contrib/ldns/doc/tutorial1_mx.dox
@@ -0,0 +1,98 @@
+/**
+   \page tutorial1_mx Tutorial 1: Querying for MX records
+   \dontinclude ldns-mx.c 
+   
+   The full source code can be found in \link examples/ldns-mx.c \endlink
+   
+   ldns-mx is a simple tool that queries your default caching forwarder for
+   the MX (Mail exchange) record of the given domain.
+
+   <pre>
+   % ldns-mx nlnetlabs.nl
+   nlnetlabs.nl.   86400   IN      MX      100 omval.tednet.nl.
+   nlnetlabs.nl.   86400   IN      MX      50 open.nlnetlabs.nl.
+   </pre>
+  
+   First of all, we need to include the correct header files, so
+   that all functions are available to us:
+  
+   \skip include
+   \until dns.h
+
+   In this case we have used a configure script to generate a config.h file
+   that does all our inclusions for us, so that it can be compiled on
+   multiple platforms. If your platform supports the include files \c
+   stdint.h and \c stdlib.h, you can include these instead of using a
+   configure script.
+
+   The first included files are prerequisites that ldns needs to function.
+   The last one, of course, includes the functions of ldns itself.
+ 
+   In our main function, we declare some variables that we are going to use:
+
+   \skipline ldns_resolver
+   \until ldns_status
+
+   - The \c ldns_resolver structure keeps a list of nameservers, and can perform queries for us
+   - An \c ldns_rdf is a basic data type of dns, the RDATA. See \ref design for a description about the building blocks of DNS.
+     In this case, \c domain will be used to store the name the user specifies when calling the program
+   - An \c ldns_pkt is a DNS packet, for instance a complete query, or an answer
+   - The \c ldns_rr_list structure contains a list of DNS Resource Records (RRs). In this case, we will store the MX records we find in the list.
+   - \c ldns_status is the basic type for status messages in ldns. Most functions will return a value of this type.
+
+   First, we parse the command line argument (checks omitted on this page, see full source code), and store it in our \c domain variable:
+   \skipline ldns_dname_new_frm_str
+
+   This function takes a string containing a domain name (like
+   "nlnetlabs.nl") and returns an \c ldns_rdf representing that name. If
+   somehow the given string can not be parsed it returns NULL.
+
+   Then, we create the resolver structure:
+   \skipline ldns_resolver_new
+
+   Most of the functions work like this, the first argument is a pointer to
+   the structure where ldns should store its results (which is also a
+   pointer). The function returns a status code indicating success
+   (\ref LDNS_STATUS_OK) or an error number. Remember that these types of
+   functions allocate memory that you should free later (using the
+   ldns_free_<type> functions).
+
+   The second argument is the filename that contains information about the
+   resolver structure that is to be created. If this argument is NULL,
+   /etc/resolv.conf is used. The syntax of the file is like that of
+   /etc/resolv.conf.
+
+
+
+   We tell the resolver to query for our domain, type MX, of class IN:
+   \skipline ldns_resolver_search
+   \until )
+
+   The last argument contains flags to influence the type of query the
+   resolver structure sends. In this case, we want the nameserver to use
+   recursion, so that we'll get the final answer. Therefore, we specify the
+   \ref LDNS_RD (Recursion Desired) flag.
+
+   This should return a packet if everything goes well.
+
+   We get all RRs of type MX from the answer packet and store them in our list:
+   \skipline ldns_pkt_rr_list_by_type
+   \until )
+   
+   If this list is not empty, we sort and print it:
+   \skipline ldns_rr_list_sort
+   \skipline ldns_rr_list_print
+
+   And finally, just to be proper, we free our allocated data:
+   \skipline free(
+   \until resolver_deep_free
+
+   For structures that can contain other ldns structures, there are two types of free() function available
+     - \c ldns_free_<type> frees only the allocated data for the structure itself.
+     - \c ldns_deep_free_<type> frees the structure, and ALL structures that
+       are nested in it. For example, of you \c deep_free an ldns_rr_list,
+       all \c ldns_rr structures that were present in the list are also
+       freed.
+
+
+*/
diff --git a/contrib/ldns/drill/ChangeLog.22-nov-2005 b/contrib/ldns/drill/ChangeLog.22-nov-2005
index 1ce8b0b7c07674..6a18ed8da525c6 100644
--- a/contrib/ldns/drill/ChangeLog.22-nov-2005
+++ b/contrib/ldns/drill/ChangeLog.22-nov-2005
@@ -11,7 +11,7 @@
 	* Lint fixes for the code
 	* Bugzilla was setup for drill
 	* Bug #97 (drill); -S crash was fixed
-	* Add -Q (quiet) flag was added. This supresses output from drill.
+	* Add -Q (quiet) flag was added. This suppresses output from drill.
 
 1.0-pre2: 20 Jun 2005: drill-team
 	* Second prerelease
@@ -60,7 +60,7 @@
 	  - CERT RR supported
 	  - LOC RR support
 	* All non supported RRs are handled as unknown
-	* If no namservers found in /etc/resolv.conf 
+	* If no nameservers found in /etc/resolv.conf 
 	  default to 127.0.0.1
 	* Various bugs fixed
 	  - Close sockets after using them
@@ -74,7 +74,7 @@
 	* Dig is no longer needed to build drill
 
 0.7: Oct 21 2004: Miek
-	* reworked interal code
+	* reworked internal code
 	* DNSSEC is working, except the secure resolving
 	* build updates
 	* more sane options parsing
diff --git a/contrib/ldns/drill/Makefile.in b/contrib/ldns/drill/Makefile.in
deleted file mode 100644
index ac555fa1e5752e..00000000000000
--- a/contrib/ldns/drill/Makefile.in
+++ /dev/null
@@ -1,119 +0,0 @@
-# Standard installation pathnames
-# See the file LICENSE for the license
-SHELL = @SHELL@
-VERSION = @PACKAGE_VERSION@
-basesrcdir = $(shell basename `pwd`)
-srcdir = @srcdir@
-prefix  = @prefix@
-exec_prefix = @exec_prefix@
-bindir = @bindir@
-mandir = @mandir@
-includedir = @includedir@
-datarootdir = @datarootdir@
-
-CC = @CC@
-CFLAGS = -I. @CFLAGS@
-CPPFLAGS = @CPPFLAGS@ 
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-INSTALL = $(srcdir)/install-sh -c
-INSTALL_PROGRAM = $(INSTALL)
-LDNSDIR = @LDNSDIR@
-LIBS_STC = @LIBS_STC@
-
-COMPILE         = $(CC) $(CPPFLAGS) $(CFLAGS) -I. -I$(srcdir)
-LINK            = $(CC) $(CFLAGS) $(LDFLAGS) 
-
-LINT            = splint
-LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list
-#-Dglob64=glob -Dglobfree64=globfree
-# compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray -D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" -D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" -D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned"
-# compat with NetBSD
-ifeq "$(shell uname)" "NetBSD"
-LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
-endif
-# compat with OpenBSD
-LINTFLAGS+="-Dsigset_t=long"
-# FreeBSD8
-LINTFLAGS+="-D__uint16_t=uint16_t"
-LINTFLAGS+=-D__signed__=signed "-D__packed=" "-D__aligned(x)="
-# Ubuntu Linux 11.04
-LINTFLAGS+="-D__u16=struct __u16" "-D__u32=struct __u32" "-D__u64=struct __u64"
-
-OBJ=drill.o drill_util.o error.o root.o work.o chasetrace.o dnssec.o securetrace.o
-SRC=$(OBJ:.o=.c)
-
-HEADER=drill.h $(srcdir)/drill_util.h
-
-.PHONY:	all clean realclean docclean doc release tags install all-static
-
-all:	drill 
-all-static:	drill-stc 
-
-tags:	
-	ctags *.[ch]
-
-drill:	$(OBJ) 
-	$(LINK) -o drill $(OBJ) $(LIBS)
-
-drill-stc:	$(OBJ) 
-	$(LINK) -o drill $(OBJ) $(LIBS_STC)
-
-## implicit rule
-%.o:	$(srcdir)/%.c
-	$(COMPILE) -c $<
-
-clean:
-	rm -f ${OBJ}
-	rm -f drill
-	rm -f *core
-	rm -f config.h.in~
-	rm -f config.log
-	rm -f config.guess
-	rm -f config.status
-
-docclean:
-	rm -rf doxydoc
-
-distclean: clean docclean
-	rm -f config.h
-
-realclean: clean docclean
-	rm -f tags
-	rm -f config.log
-	rm -f config.sub
-	rm -f ltmain.sh
-	rm -f config.status
-	rm -rf autom4te.cache
-	rm -f config.h
-	rm -f config.h.in
-	rm -f configure
-	rm -f Makefile	
-	rm -f drill.1
-	rm -f aclocal.m4
-
-doc:	
-	doxygen drill.doxygen
-
-install: all
-	$(INSTALL) -d $(DESTDIR)$(bindir)
-	$(INSTALL) drill $(DESTDIR)$(bindir)/drill
-	$(INSTALL) -m 644 drill.1 $(DESTDIR)$(mandir)/man1/drill.1
-
-uninstall:
-	@echo
-	rm -f -- $(DESTDIR)$(bindir)/drill
-	rm -f -- $(DESTDIR)$(mandir)/man1/drill.1
-	rmdir -p $(DESTDIR)$(bindir)
-	rmdir -p $(DESTDIR)$(mandir)/man1
-	@echo
-
-lint:
-	@for i in $(SRC) ; do \
-                $(LINT) $(LINTFLAGS) $(CPPFLAGS) -I$(srcdir) $(srcdir)/$$i ; \
-                if [ $$? -ne 0 ] ; then exit 1 ; fi ; \
-        done
-
-confclean: clean
-	rm -rf config.log config.status config.h Makefile drill.1
diff --git a/contrib/ldns/drill/chasetrace.c b/contrib/ldns/drill/chasetrace.c
index 1f8a2901ab2658..3bd59563c5c056 100644
--- a/contrib/ldns/drill/chasetrace.c
+++ b/contrib/ldns/drill/chasetrace.c
@@ -171,7 +171,7 @@ do_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
         }
 
 	/* transfer some properties of local_res to res,
-	 * because they were given on the commandline */
+	 * because they were given on the command line */
 	ldns_resolver_set_ip6(res, 
 			ldns_resolver_ip6(local_res));
 	ldns_resolver_set_port(res, 
@@ -295,7 +295,7 @@ do_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 
 	ldns_pkt_free(p);
 	p = NULL;
-	status = ldns_resolver_send(&p, res, name, t, c, 0);
+	(void) ldns_resolver_send(&p, res, name, t, c, 0);
 	if (!p) {
 		goto cleanup;
 	}
diff --git a/contrib/ldns/drill/config.h.in b/contrib/ldns/drill/config.h.in
deleted file mode 100644
index 93abc62b58abc8..00000000000000
--- a/contrib/ldns/drill/config.h.in
+++ /dev/null
@@ -1,293 +0,0 @@
-/* config.h.in.  Generated from configure.ac by autoheader.  */
-
-/* Define to 1 if you have the <arpa/inet.h> header file. */
-#undef HAVE_ARPA_INET_H
-
-/* Define to 1 if you have the <assert.h> header file. */
-#undef HAVE_ASSERT_H
-
-/* Define to 1 if you have the <ctype.h> header file. */
-#undef HAVE_CTYPE_H
-
-/* Whether getaddrinfo is available */
-#undef HAVE_GETADDRINFO
-
-/* Define to 1 if you have the <getopt.h> header file. */
-#undef HAVE_GETOPT_H
-
-/* If you have HMAC_Update */
-#undef HAVE_HMAC_UPDATE
-
-/* Define to 1 if you have the <inttypes.h> header file. */
-#undef HAVE_INTTYPES_H
-
-/* Define to 1 if you have the `isblank' function. */
-#undef HAVE_ISBLANK
-
-/* Define to 1 if you have the `ldns' library (-lldns). */
-#undef HAVE_LIBLDNS
-
-/* Define to 1 if you have the <memory.h> header file. */
-#undef HAVE_MEMORY_H
-
-/* Define to 1 if you have the <netinet/if_ether.h> header file. */
-#undef HAVE_NETINET_IF_ETHER_H
-
-/* Define to 1 if you have the <netinet/in.h> header file. */
-#undef HAVE_NETINET_IN_H
-
-/* Define to 1 if you have the <netinet/in_systm.h> header file. */
-#undef HAVE_NETINET_IN_SYSTM_H
-
-/* Define to 1 if you have the <netinet/ip6.h> header file. */
-#undef HAVE_NETINET_IP6_H
-
-/* Define to 1 if you have the <netinet/ip.h> header file. */
-#undef HAVE_NETINET_IP_H
-
-/* Define to 1 if you have the <netinet/udp.h> header file. */
-#undef HAVE_NETINET_UDP_H
-
-/* Define to 1 if you have the <net/if.h> header file. */
-#undef HAVE_NET_IF_H
-
-/* Define to 1 if you have the <openssl/err.h> header file. */
-#undef HAVE_OPENSSL_ERR_H
-
-/* Define to 1 if you have the <openssl/rand.h> header file. */
-#undef HAVE_OPENSSL_RAND_H
-
-/* Define to 1 if you have the <openssl/ssl.h> header file. */
-#undef HAVE_OPENSSL_SSL_H
-
-/* Define if you have the SSL libraries installed. */
-#undef HAVE_SSL
-
-/* Define to 1 if you have the <stdint.h> header file. */
-#undef HAVE_STDINT_H
-
-/* Define to 1 if you have the <stdio.h> header file. */
-#undef HAVE_STDIO_H
-
-/* Define to 1 if you have the <stdlib.h> header file. */
-#undef HAVE_STDLIB_H
-
-/* Define to 1 if you have the <strings.h> header file. */
-#undef HAVE_STRINGS_H
-
-/* Define to 1 if you have the <string.h> header file. */
-#undef HAVE_STRING_H
-
-/* Define to 1 if you have the <sys/mount.h> header file. */
-#undef HAVE_SYS_MOUNT_H
-
-/* Define to 1 if you have the <sys/param.h> header file. */
-#undef HAVE_SYS_PARAM_H
-
-/* Define to 1 if you have the <sys/select.h> header file. */
-#undef HAVE_SYS_SELECT_H
-
-/* Define to 1 if you have the <sys/socket.h> header file. */
-#undef HAVE_SYS_SOCKET_H
-
-/* Define to 1 if you have the <sys/stat.h> header file. */
-#undef HAVE_SYS_STAT_H
-
-/* Define to 1 if you have the <sys/time.h> header file. */
-#undef HAVE_SYS_TIME_H
-
-/* Define to 1 if you have the <sys/types.h> header file. */
-#undef HAVE_SYS_TYPES_H
-
-/* Define to 1 if you have the <time.h> header file. */
-#undef HAVE_TIME_H
-
-/* Define to 1 if you have the <unistd.h> header file. */
-#undef HAVE_UNISTD_H
-
-/* Define to 1 if you have the <winsock2.h> header file. */
-#undef HAVE_WINSOCK2_H
-
-/* Define to 1 if you have the <ws2tcpip.h> header file. */
-#undef HAVE_WS2TCPIP_H
-
-/* Default trust anchor file */
-#undef LDNS_TRUST_ANCHOR_FILE
-
-/* Define to the address where bug reports for this package should be sent. */
-#undef PACKAGE_BUGREPORT
-
-/* Define to the full name of this package. */
-#undef PACKAGE_NAME
-
-/* Define to the full name and version of this package. */
-#undef PACKAGE_STRING
-
-/* Define to the one symbol short name of this package. */
-#undef PACKAGE_TARNAME
-
-/* Define to the home page for this package. */
-#undef PACKAGE_URL
-
-/* Define to the version of this package. */
-#undef PACKAGE_VERSION
-
-/* Define to 1 if you have the ANSI C header files. */
-#undef STDC_HEADERS
-
-/* Enable extensions on AIX 3, Interix.  */
-#ifndef _ALL_SOURCE
-# undef _ALL_SOURCE
-#endif
-/* Enable GNU extensions on systems that have them.  */
-#ifndef _GNU_SOURCE
-# undef _GNU_SOURCE
-#endif
-/* Enable threading extensions on Solaris.  */
-#ifndef _POSIX_PTHREAD_SEMANTICS
-# undef _POSIX_PTHREAD_SEMANTICS
-#endif
-/* Enable extensions on HP NonStop.  */
-#ifndef _TANDEM_SOURCE
-# undef _TANDEM_SOURCE
-#endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
-#endif
-
-
-/* Whether the windows socket API is used */
-#undef USE_WINSOCK
-
-/* the version of the windows API enabled */
-#undef WINVER
-
-/* Define to 1 if on MINIX. */
-#undef _MINIX
-
-/* Define to 2 if the system does not provide POSIX.1 features except with
-   this defined. */
-#undef _POSIX_1_SOURCE
-
-/* Define to 1 if you need to in order for `stat' and other things to work. */
-#undef _POSIX_SOURCE
-
-/* in_addr_t */
-#undef in_addr_t
-
-/* in_port_t */
-#undef in_port_t
-
-/* Define to `__inline__' or `__inline' if that's what the C compiler
-   calls it, or to nothing if 'inline' is not supported under any name.  */
-#ifndef __cplusplus
-#undef inline
-#endif
-
-/* Define to `short' if <sys/types.h> does not define. */
-#undef int16_t
-
-/* Define to `int' if <sys/types.h> does not define. */
-#undef int32_t
-
-/* Define to `long long' if <sys/types.h> does not define. */
-#undef int64_t
-
-/* Define to `char' if <sys/types.h> does not define. */
-#undef int8_t
-
-/* Define to `unsigned int' if <sys/types.h> does not define. */
-#undef size_t
-
-/* Define to 'int' if not defined */
-#undef socklen_t
-
-/* Define to `int' if <sys/types.h> does not define. */
-#undef ssize_t
-
-/* Define to `unsigned short' if <sys/types.h> does not define. */
-#undef uint16_t
-
-/* Define to `unsigned int' if <sys/types.h> does not define. */
-#undef uint32_t
-
-/* Define to `unsigned long long' if <sys/types.h> does not define. */
-#undef uint64_t
-
-/* Define to `unsigned char' if <sys/types.h> does not define. */
-#undef uint8_t
-
-
-
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include <assert.h>
-
-#if STDC_HEADERS
-#include <stdlib.h>
-#include <stddef.h>
-#endif
-
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#ifdef HAVE_NETINET_UDP_H
-#include <netinet/udp.h>
-#endif
-
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-
-#ifdef HAVE_NETINET_IN_SYSTM_H
-#include <netinet/in_systm.h>
-#endif
-
-#ifdef HAVE_NETINET_IP_H
-#include <netinet/ip.h>
-#endif
-
-#ifdef HAVE_NET_IF_H
-#include <net/if.h>
-#endif
-
-#ifdef HAVE_NETINET_IF_ETHER_H
-#include <netinet/if_ether.h>
-#endif
-
-#ifdef HAVE_WINSOCK2_H
-#define USE_WINSOCK 1
-#include <winsock2.h>
-#endif
-
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-
-#ifndef EXIT_FAILURE
-#define EXIT_FAILURE  1
-#endif
-#ifndef EXIT_SUCCESS
-#define EXIT_SUCCESS  0
-#endif
-
-#ifdef S_SPLINT_S
-#define FD_ZERO(a) /* a */
-#define FD_SET(a,b) /* a, b */
-#endif
-
diff --git a/contrib/ldns/drill/configure.ac b/contrib/ldns/drill/configure.ac
deleted file mode 100644
index 7a726da2a6470a..00000000000000
--- a/contrib/ldns/drill/configure.ac
+++ /dev/null
@@ -1,276 +0,0 @@
-#                                               -*- Autoconf -*-
-# Process this file with autoconf to produce a configure script.
-
-AC_PREREQ(2.56)
-AC_INIT(ldns, 1.7.0, libdns@nlnetlabs.nl,libdns)
-AC_CONFIG_SRCDIR([drill.c])
-sinclude(../acx_nlnetlabs.m4)
-
-OURCPPFLAGS=''
-CPPFLAGS=${CPPFLAGS:-${OURCPPFLAGS}}
-OURCFLAGS='-g'
-CFLAGS=${CFLAGS:-${OURCFLAGS}}
-AC_DEFINE(WINVER, 0x0502, [the version of the windows API enabled])
-
-AC_AIX
-# Checks for programs.
-AC_PROG_CC
-AC_PROG_MAKE_SET
-AC_CHECK_PROGS(libtool, [glibtool libtool15 libtool], [../libtool])
-
-# add option to disable the evil rpath
-dnl Check whether to use rpath or not
-AC_ARG_ENABLE(rpath,
-        [  --disable-rpath                disable hardcoded rpath (default=enabled)],
-	enable_rpath=$enableval, enable_rpath=yes)
-
-if test "x$enable_rpath" = xyes; then
-    RPATH_VAL="-Wl,-rpath=\${libdir}"
-fi
-
-
-ACX_CHECK_COMPILER_FLAG(std=c99, [C99FLAG="-std=c99"])
-ACX_CHECK_COMPILER_FLAG(xc99, [C99FLAG="-xc99"])
-
-AC_TYPE_SIZE_T
-ACX_CHECK_COMPILER_FLAG(O2, [CFLAGS="$CFLAGS -O2"])
-
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600,
-[
-#include "confdefs.h"
-#include <stdlib.h>
-#include <ctype.h>
-#include <sys/time.h>
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-#include <unistd.h>
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-int test() {
-	int a;
-	char **opts = NULL;
-	struct timeval tv;
-	char *t;
-	time_t time = 0;
-	char *buf = NULL;
-	t = ctime_r(&time, buf);
-	tv.tv_usec = 10;
-	srandom(32);
-	a = getopt(2, opts, "a");
-	a = isascii(32);
-	return a;
-}
-], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600"])
-
-
-ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG, [#include <stdbool.h>], [CFLAGS="$CFLAGS $C99FLAG"])
-
-AC_C_INLINE
-AC_CHECK_TYPE(int8_t, char)
-AC_CHECK_TYPE(int16_t, short)
-AC_CHECK_TYPE(int32_t, int)
-AC_CHECK_TYPE(int64_t, long long)
-AC_CHECK_TYPE(uint8_t, unsigned char)
-AC_CHECK_TYPE(uint16_t, unsigned short)
-AC_CHECK_TYPE(uint32_t, unsigned int)
-AC_CHECK_TYPE(uint64_t, unsigned long long)
-AC_CHECK_TYPE(ssize_t, int)
-
-AC_CHECK_HEADERS([sys/types.h getopt.h stdlib.h stdio.h assert.h netinet/in.h ctype.h time.h arpa/inet.h sys/time.h sys/socket.h sys/select.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([netinet/in_systm.h net/if.h netinet/ip.h netinet/udp.h netinet/if_ether.h netinet/ip6.h],,, [
-AC_INCLUDES_DEFAULT 
-#ifdef HAVE_NETINET_IN_SYSTM_H
-#include <netinet/in_systm.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NET_IF_H
-#include <net/if.h>
-#endif])
-# MinGW32 tests
-AC_CHECK_HEADERS([winsock2.h ws2tcpip.h],,, [AC_INCLUDES_DEFAULT])
-
-ACX_TYPE_SOCKLEN_T
-AC_CHECK_HEADERS([sys/param.h sys/mount.h],,,
-[AC_INCLUDES_DEFAULT]
-[
-  [
-   #if HAVE_SYS_PARAM_H
-   # include <sys/param.h>
-   #endif
-  ]
-])
-AC_CHECK_TYPE(in_addr_t, [], [AC_DEFINE([in_addr_t], [uint32_t], [in_addr_t])], [
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#if HAVE_NETINET_IN_H
-# include <netinet/in.h>
-#endif])
-AC_CHECK_TYPE(in_port_t, [], [AC_DEFINE([in_port_t], [uint16_t], [in_port_t])], [
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#if HAVE_NETINET_IN_H
-# include <netinet/in.h>
-#endif])
-
-# check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS(socket, socket)
-AC_SEARCH_LIBS([inet_pton], [nsl])
-
-ACX_WITH_SSL_OPTIONAL
-
-ACX_CHECK_GETADDRINFO_WITH_INCLUDES
-
-LIBS_STC="$LIBS"
-AC_SUBST(LIBS_STC)
-
-# check for ldns
-AC_ARG_WITH(ldns, 
-	AC_HELP_STRING([--with-ldns=PATH        specify prefix of path of ldns library to use])
-	,
-	[
-		specialldnsdir="$withval"
-		CPPFLAGS="$CPPFLAGS -I$withval/include"
-		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
-		LDNSDIR="$withval"
-		LIBS="-lldns $LIBS"
-		LIBS_STC="$withval/lib/libldns.a $LIBS_STC"
-	]
-)
-
-#AC_CHECK_HEADER(ldns/ldns.h,,  [
-#	AC_MSG_ERROR([Can't find ldns headers (make copy-headers in devel source.)])
-#	], [AC_INCLUDES_DEFAULT]
-#)
-
-AC_CHECK_FUNCS(isblank)
-
-# check for ldns development source tree
-AC_MSG_CHECKING([for ldns devel source])
-ldns_dev_dir=..
-if test -f $ldns_dev_dir/ldns/util.h && \
-	grep LDNS_VERSION $ldns_dev_dir/ldns/util.h >/dev/null; then
-	ldns_version=`grep LDNS_VERSION $ldns_dev_dir/ldns/util.h | sed -e 's/^.*"\(.*\)".*$/\1/'`
-	AC_MSG_RESULT([using $ldns_dev_dir with $ldns_version])
-	CPPFLAGS="$CPPFLAGS -I$ldns_dev_dir/include"
-	LDFLAGS="-L$ldns_dev_dir -L$ldns_dev_dir/lib $LDFLAGS"
-	LIBS="-lldns $LIBS"
-	AC_DEFINE(HAVE_LIBLDNS, 1, [If the ldns library is available.])
-	LDNSDIR="$ldns_dev_dir"
-	LIBS_STC="$ldns_dev_dir/lib/libldns.a $LIBS_STC"
-else
-	AC_MSG_RESULT([no])
-	AC_CHECK_LIB(ldns, ldns_rr_new, , [
-			AC_MSG_ERROR([Can't find ldns library])dnl '
-		]
-	)
-fi
-
-AC_SUBST(LDNSDIR)
-
-AC_ARG_WITH(trust-anchor, AC_HELP_STRING([--with-trust-anchor=KEYFILE],
-[Default location of the trust anchor file. [default=SYSCONFDIR/unbound/root.key]]), [
- LDNS_TRUST_ANCHOR_FILE="$withval"
-],[
- if test "x$LDNS_TRUST_ANCHOR_FILE" = "x"; then
-  if test "x$sysconfdir" = 'x${prefix}/etc' ; then
-   if test "x$prefix" = 'xNONE' ; then
-    LDNS_TRUST_ANCHOR_FILE="/etc/unbound/root.key"
-   else
-    LDNS_TRUST_ANCHOR_FILE="${prefix}/etc/unbound/root.key"
-   fi
-  else
-    LDNS_TRUST_ANCHOR_FILE="${sysconfdir}/unbound/root.key"
-  fi
- fi
-])
-AC_DEFINE_UNQUOTED([LDNS_TRUST_ANCHOR_FILE], ["$LDNS_TRUST_ANCHOR_FILE"], [Default trust anchor file])
-AC_SUBST(LDNS_TRUST_ANCHOR_FILE)
-AC_MSG_NOTICE([Default trust anchor: $LDNS_TRUST_ANCHOR_FILE])
-
-AH_BOTTOM([
-
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include <assert.h>
-
-#if STDC_HEADERS
-#include <stdlib.h>
-#include <stddef.h>
-#endif
-
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-
-#ifdef HAVE_NETINET_UDP_H
-#include <netinet/udp.h>
-#endif
-
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-
-#ifdef HAVE_NETINET_IN_SYSTM_H
-#include <netinet/in_systm.h>
-#endif
-
-#ifdef HAVE_NETINET_IP_H
-#include <netinet/ip.h>
-#endif
-
-#ifdef HAVE_NET_IF_H
-#include <net/if.h>
-#endif
-
-#ifdef HAVE_NETINET_IF_ETHER_H
-#include <netinet/if_ether.h>
-#endif
-
-#ifdef HAVE_WINSOCK2_H
-#define USE_WINSOCK 1
-#include <winsock2.h>
-#endif
-
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-
-#ifndef EXIT_FAILURE
-#define EXIT_FAILURE  1
-#endif
-#ifndef EXIT_SUCCESS
-#define EXIT_SUCCESS  0
-#endif
-
-#ifdef S_SPLINT_S
-#define FD_ZERO(a) /* a */
-#define FD_SET(a,b) /* a, b */
-#endif
-])
-
-AC_CONFIG_FILES([Makefile drill.1])
-AC_CONFIG_HEADER([config.h])
-AC_OUTPUT
diff --git a/contrib/ldns/drill/dnssec.c b/contrib/ldns/drill/dnssec.c
index b8074be03cc5e9..687cfe55a5729a 100644
--- a/contrib/ldns/drill/dnssec.c
+++ b/contrib/ldns/drill/dnssec.c
@@ -180,7 +180,20 @@ ldns_verify_denial(ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type, ldns_rr_lis
 
 	ldns_rr_list *nsecs;
 	ldns_status result;
-	
+	const ldns_rr_descriptor *descriptor;
+
+	if (!pkt) {
+		descriptor = ldns_rr_descript(type);
+
+		printf("NETWORk ERROR! Cannot verify denial for: ");
+		ldns_rdf_print(stdout, name);
+		printf(" type ");
+		if (descriptor && descriptor->_name)
+			printf("%s", descriptor->_name);
+		else
+			printf("TYPE%u", type);
+		return LDNS_STATUS_CRYPTO_NO_RRSIG;
+	}
 	if (verbosity >= 5) {
 		printf("VERIFY DENIAL FROM:\n");
 		ldns_pkt_print(stdout, pkt);
@@ -453,6 +466,7 @@ ldns_nsec3_closest_encloser(ldns_rdf *qname, ldns_rr_type qtype, ldns_rr_list *n
 		}
 
 		if (ldns_dname_cat(hashed_sname, zone_name) != LDNS_STATUS_OK){
+			ldns_rdf_deep_free(hashed_sname);
 			goto done;
 		}
 
diff --git a/contrib/ldns/drill/drill.1.in b/contrib/ldns/drill/drill.1.in
index c3da109fb060db..f249424394b6a3 100644
--- a/contrib/ldns/drill/drill.1.in
+++ b/contrib/ldns/drill/drill.1.in
@@ -19,8 +19,8 @@ drill \- get (debug) information out of DNS(SEC)
 ]
 
 .SH DESCRIPTION
-\fBdrill\fR is a tool to designed to get all sorts of information out of the
-DNS. It is specificly designed to be used with DNSSEC. 
+\fBdrill\fR is a tool designed to get all sorts of information out of the
+DNS. It is specifically designed to be used with DNSSEC.
 .PP
 The name \fBdrill\fR is a pun on \fBdig\fR. With \fBdrill\fR you should be able
 get even more information than with \fBdig\fR.
@@ -222,6 +222,15 @@ specify named base64 tsig key, and optional an algorithm (defaults to hmac-md5.s
 \fB\-z \fR
 don't randomize the nameserver list before sending queries.
 
+
+.SS EDNS QUERY OPTIONS
+
+.TP
+\fB\+nsid \fR
+When set, this EDNS option includes an EDNS name server ID request in the query.
+
+
+
 .SH "EXIT STATUS"
 The exit status is 0 if the looked up answer is secure and trusted,
 or insecure.
diff --git a/contrib/ldns/drill/drill.c b/contrib/ldns/drill/drill.c
index d66ee862c541ab..611c81f3a8e37e 100644
--- a/contrib/ldns/drill/drill.c
+++ b/contrib/ldns/drill/drill.c
@@ -59,7 +59,7 @@ usage(FILE *stream, const char *progname)
 	fprintf(stream, "\t-6\t\tstay on ip6\n");
 	fprintf(stream, "\t-a\t\tfallback to EDNS0 and TCP if the answer is truncated\n");
 	fprintf(stream, "\t-b <bufsize>\tuse <bufsize> as the buffer size (defaults to 512 b)\n");
-	fprintf(stream, "\t-c <file>\tuse file for rescursive nameserver configuration"
+	fprintf(stream, "\t-c <file>\tuse file for recursive nameserver configuration"
 			"\n\t\t\t(/etc/resolv.conf)\n");
 	fprintf(stream, "\t-k <file>\tspecify a file that contains a trusted DNSSEC key [**]\n");
 	fprintf(stream, "\t\t\tUsed to verify any signatures in the current answer.\n");
@@ -111,7 +111,7 @@ main(int argc, char *argv[])
         ldns_resolver   *cmdline_res = NULL; /* only used to resolv @name names */
 	ldns_rr_list	*cmdline_rr_list = NULL;
 	ldns_rdf	*cmdline_dname = NULL;
-        ldns_rdf 	*qname, *qname_tmp;
+        ldns_rdf 	*qname;
         ldns_pkt	*pkt;
         ldns_pkt	*qpkt;
         char 		*serv;
@@ -156,6 +156,7 @@ main(int argc, char *argv[])
 	bool		qds;
 	bool		qusevc;
 	bool 		qrandom;
+	bool            drill_reverse = false;
 	
 	char		*resolv_conf_file = NULL;
 	
@@ -165,11 +166,15 @@ main(int argc, char *argv[])
 
 	uint8_t         s6addr[16];
 	char            ip6_arpa_str[74];
+	uint8_t         s4addr[4];
+	char            in_addr_arpa_str[40];
 
 #ifdef USE_WINSOCK
 	int r;
 	WSADATA wsa_data;
 #endif
+	ldns_output_format_storage fmt_storage;
+	ldns_output_format* fmt = ldns_output_format_init(&fmt_storage);
 
 	int_type = -1; serv = NULL; type = 0; 
 	int_clas = -1; name = NULL; clas = 0;
@@ -198,6 +203,7 @@ main(int argc, char *argv[])
 	qusevc = false;
 	qrandom = true;
 	key_verified = NULL;
+	ldns_edns_option_list* edns_list = NULL;
 
 	ldns_init_random(NULL, 0);
 
@@ -244,6 +250,7 @@ main(int argc, char *argv[])
 				verbosity = atoi(optarg);
 				break;
 			case 'Q':
+				fmt->flags |= LDNS_FMT_SHORT;
 				verbosity = -1;
 				break;
 			case 'f':
@@ -357,12 +364,16 @@ main(int argc, char *argv[])
 				result = EXIT_SUCCESS;
 				goto exit;
 			case 'x':
-				PURPOSE = DRILL_REVERSE;
+				drill_reverse = true;
 				break;
 			case 'y':
 #ifdef HAVE_SSL
 				if (strchr(optarg, ':')) {
 					tsig_separator = (size_t) (strchr(optarg, ':') - optarg);
+					if (tsig_algorithm) {
+						free(tsig_algorithm);
+						tsig_algorithm = NULL;
+					}
 					if (strchr(optarg + tsig_separator + 1, ':')) {
 						tsig_separator2 = (size_t) (strchr(optarg + tsig_separator + 1, ':') - optarg);
 						tsig_algorithm = xmalloc(strlen(optarg) - tsig_separator2);
@@ -447,6 +458,31 @@ main(int argc, char *argv[])
 			serv = argv[i] + 1;
 			continue;
 		}
+		/* if ^+ then it's an EDNS option */
+		if (argv[i][0] == '+') {
+			if (!strcmp(argv[i]+1, "nsid")) {
+				ldns_edns_option *edns;
+				edns_list = ldns_edns_option_list_new();
+
+				/* create NSID EDNS*/
+				edns = ldns_edns_new_from_data(LDNS_EDNS_NSID, 0, NULL);
+
+				if (edns_list == NULL || edns == NULL) {
+					error("EDNS option could not be allocated");
+					break;
+				}
+
+				if (!(ldns_edns_option_list_push(edns_list, edns))) {
+					error("EDNS option NSID could not be attached");
+					break;
+				}
+				continue;
+			}
+			else {
+				error("Unsupported argument after '+'");
+				break;
+			}
+		}
 		/* if has a dot, it's a name */
 		if (strchr(argv[i], '.')) {
 			name = argv[i];
@@ -487,12 +523,66 @@ main(int argc, char *argv[])
 		clas = LDNS_RR_CLASS_IN;
 	}
 	if (int_type == -1) {
-		if (PURPOSE != DRILL_REVERSE) {
+		if (!drill_reverse) {
 			type = LDNS_RR_TYPE_A;
 		} else {
 			type = LDNS_RR_TYPE_PTR;
 		}
 	}
+	if (!drill_reverse)
+		; /* pass */
+	else if (strchr(name, ':')) { /* ipv4 or ipv6 addr? */
+		if (!inet_pton(AF_INET6, name, &s6addr)) {
+			error("Syntax error: cannot parse IPv6 address\n");
+		}
+		(void) snprintf(ip6_arpa_str, sizeof(ip6_arpa_str),
+		    "%x.%x.%x.%x.%x.%x.%x.%x."
+		    "%x.%x.%x.%x.%x.%x.%x.%x."
+		    "%x.%x.%x.%x.%x.%x.%x.%x."
+		    "%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpa.",
+		    (unsigned int)(s6addr[15] & 0x0F),
+		    (unsigned int)(s6addr[15] >> 4),
+		    (unsigned int)(s6addr[14] & 0x0F),
+		    (unsigned int)(s6addr[14] >> 4),
+		    (unsigned int)(s6addr[13] & 0x0F),
+		    (unsigned int)(s6addr[13] >> 4),
+		    (unsigned int)(s6addr[12] & 0x0F),
+		    (unsigned int)(s6addr[12] >> 4),
+		    (unsigned int)(s6addr[11] & 0x0F),
+		    (unsigned int)(s6addr[11] >> 4),
+		    (unsigned int)(s6addr[10] & 0x0F),
+		    (unsigned int)(s6addr[10] >> 4),
+		    (unsigned int)(s6addr[9] & 0x0F),
+		    (unsigned int)(s6addr[9] >> 4),
+		    (unsigned int)(s6addr[8] & 0x0F),
+		    (unsigned int)(s6addr[8] >> 4),
+		    (unsigned int)(s6addr[7] & 0x0F),
+		    (unsigned int)(s6addr[7] >> 4),
+		    (unsigned int)(s6addr[6] & 0x0F),
+		    (unsigned int)(s6addr[6] >> 4),
+		    (unsigned int)(s6addr[5] & 0x0F),
+		    (unsigned int)(s6addr[5] >> 4),
+		    (unsigned int)(s6addr[4] & 0x0F),
+		    (unsigned int)(s6addr[4] >> 4),
+		    (unsigned int)(s6addr[3] & 0x0F),
+		    (unsigned int)(s6addr[3] >> 4),
+		    (unsigned int)(s6addr[2] & 0x0F),
+		    (unsigned int)(s6addr[2] >> 4),
+		    (unsigned int)(s6addr[1] & 0x0F),
+		    (unsigned int)(s6addr[1] >> 4),
+		    (unsigned int)(s6addr[0] & 0x0F),
+		    (unsigned int)(s6addr[0] >> 4));
+		name = ip6_arpa_str;
+
+	} else if (!inet_pton(AF_INET, name, &s4addr)) {
+		error("Syntax error: cannot parse IPv4 address\n");
+
+	} else {
+		(void) snprintf(in_addr_arpa_str, sizeof(in_addr_arpa_str),
+		    "%d.%d.%d.%d.in-addr.arpa.", (int)s4addr[3],
+		    (int)s4addr[2], (int)s4addr[1], (int)s4addr[0]);
+		name = in_addr_arpa_str;
+	}
 
 	if (src) {
 		src_rdf = ldns_rdf_new_addr_frm_str(src);
@@ -732,7 +822,7 @@ main(int argc, char *argv[])
 			}
 			status = ldns_resolver_prepare_query_pkt(&qpkt, res, qname, type, clas, qflags);
 			if(status != LDNS_STATUS_OK) {
-				error("%s", "making query: %s", 
+				error("%s", "making query: %s",
 					ldns_get_errorstr_by_id(status));
 			}
 			dump_hex(qpkt, query_file);
@@ -740,89 +830,6 @@ main(int argc, char *argv[])
 			break;
 		case DRILL_NSEC:
 			break;
-		case DRILL_REVERSE:
-			/* ipv4 or ipv6 addr? */
-			if (strchr(name, ':')) {
-				if (!inet_pton(AF_INET6, name, &s6addr)) {
-					error("Syntax error: cannot parse IPv6 address\n");
-				}
-				(void) snprintf(ip6_arpa_str, sizeof(ip6_arpa_str),
-				    "%x.%x.%x.%x.%x.%x.%x.%x."
-				    "%x.%x.%x.%x.%x.%x.%x.%x."
-				    "%x.%x.%x.%x.%x.%x.%x.%x."
-				    "%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpa.",
-				    (unsigned int)(s6addr[15] & 0x0F),
-				    (unsigned int)(s6addr[15] >> 4),
-				    (unsigned int)(s6addr[14] & 0x0F),
-				    (unsigned int)(s6addr[14] >> 4),
-				    (unsigned int)(s6addr[13] & 0x0F),
-				    (unsigned int)(s6addr[13] >> 4),
-				    (unsigned int)(s6addr[12] & 0x0F),
-				    (unsigned int)(s6addr[12] >> 4),
-				    (unsigned int)(s6addr[11] & 0x0F),
-				    (unsigned int)(s6addr[11] >> 4),
-				    (unsigned int)(s6addr[10] & 0x0F),
-				    (unsigned int)(s6addr[10] >> 4),
-				    (unsigned int)(s6addr[9] & 0x0F),
-				    (unsigned int)(s6addr[9] >> 4),
-				    (unsigned int)(s6addr[8] & 0x0F),
-				    (unsigned int)(s6addr[8] >> 4),
-				    (unsigned int)(s6addr[7] & 0x0F),
-				    (unsigned int)(s6addr[7] >> 4),
-				    (unsigned int)(s6addr[6] & 0x0F),
-				    (unsigned int)(s6addr[6] >> 4),
-				    (unsigned int)(s6addr[5] & 0x0F),
-				    (unsigned int)(s6addr[5] >> 4),
-				    (unsigned int)(s6addr[4] & 0x0F),
-				    (unsigned int)(s6addr[4] >> 4),
-				    (unsigned int)(s6addr[3] & 0x0F),
-				    (unsigned int)(s6addr[3] >> 4),
-				    (unsigned int)(s6addr[2] & 0x0F),
-				    (unsigned int)(s6addr[2] >> 4),
-				    (unsigned int)(s6addr[1] & 0x0F),
-				    (unsigned int)(s6addr[1] >> 4),
-				    (unsigned int)(s6addr[0] & 0x0F),
-				    (unsigned int)(s6addr[0] >> 4));
-
-				qname = ldns_dname_new_frm_str(ip6_arpa_str);
-			} else {
-				qname = ldns_dname_new_frm_str(name);
-				if (qname) {
-					qname_tmp = ldns_dname_reverse(qname);
-					ldns_rdf_deep_free(qname);
-					qname = qname_tmp;
-					qname_tmp = ldns_dname_new_frm_str("in-addr.arpa.");
-					status = ldns_dname_cat(qname, qname_tmp);
-					if (status != LDNS_STATUS_OK) {
-						error("%s", "could not create reverse address for ip4: %s\n", ldns_get_errorstr_by_id(status));
-					}
-					ldns_rdf_deep_free(qname_tmp);
-				}
-			}
-			if (!qname) {
-				error("%s", "-x implies an ip address");
-			}
-			
-			/* create a packet and set the RD flag on it */
-			pkt = NULL;
-			status = ldns_resolver_query_status(
-					&pkt, res, qname, type, clas, qflags);
-			if (status != LDNS_STATUS_OK) {
-				error("error sending query: %s",
-					ldns_get_errorstr_by_id(status));
-			}
-			if (!pkt)  {
-				if (status == LDNS_STATUS_OK) {
-					error("%s", "pkt sending");
-				}
-				result = EXIT_FAILURE;
-			} else {
-				if (verbosity != -1) {
-					ldns_pkt_print(stdout, pkt);
-				}
-				ldns_pkt_free(pkt);
-			}
-			break;
 		case DRILL_QUERY:
 		default:
 			if (query_file) {
@@ -886,9 +893,22 @@ main(int argc, char *argv[])
 				} else {
 					/* create a packet and set the RD flag on it */
 					pkt = NULL;
-					status = ldns_resolver_query_status(
-							&pkt, res, qname,
-							type, clas, qflags);
+
+					status = ldns_resolver_prepare_query_pkt(&qpkt,
+						res, qname, type, clas, qflags);
+					if(status != LDNS_STATUS_OK) {
+						error("%s", "making query: %s", 
+							ldns_get_errorstr_by_id(status));
+					}
+
+					if (edns_list) {
+						/* attach the structed EDNS options */
+						ldns_pkt_set_edns_option_list(qpkt, edns_list);
+					}
+
+					status = ldns_resolver_send_pkt(&pkt, res, qpkt);
+					ldns_pkt_free(qpkt);
+
 					if (status != LDNS_STATUS_OK) {
 						error("error sending query: %s"
 						     , ldns_get_errorstr_by_id(
@@ -897,12 +917,13 @@ main(int argc, char *argv[])
 				}
 			}
 			
-			if (!pkt)  {
+			/* now handling the response message/packet */
+			if (!pkt) {
 				mesg("No packet received");
 				result = EXIT_FAILURE;
 			} else {
+				ldns_pkt_print_fmt(stdout, fmt, pkt);
 				if (verbosity != -1) {
-					ldns_pkt_print(stdout, pkt);
 					if (ldns_pkt_tc(pkt)) {
 						fprintf(stdout,
 							"\n;; WARNING: The answer packet was truncated; you might want to\n");
@@ -1016,9 +1037,17 @@ main(int argc, char *argv[])
 	xfree(tsig_algorithm);
 
 #ifdef HAVE_SSL
-	CRYPTO_cleanup_all_ex_data();
-	ERR_free_strings();
-	EVP_cleanup();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_LIBRESSL)
+#ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+	CRYPTO_cleanup_all_ex_data ();
+#endif
+#ifdef HAVE_ERR_FREE_STRINGS
+	ERR_free_strings ();
+#endif
+#ifdef HAVE_EVP_CLEANUP
+	EVP_cleanup ();
+#endif
+#endif
 #endif
 #ifdef USE_WINSOCK
 	WSACleanup();
diff --git a/contrib/ldns/drill/drill.h b/contrib/ldns/drill/drill.h
index cbccd75ec5c50f..4397fd06d95492 100644
--- a/contrib/ldns/drill/drill.h
+++ b/contrib/ldns/drill/drill.h
@@ -21,7 +21,6 @@
 #define DRILL_AFROMFILE 3
 #define DRILL_QTOFILE 	4
 #define DRILL_NSEC	5
-#define DRILL_REVERSE	6
 #define DRILL_SECTRACE 	7
 
 #define DRILL_ON(VAR, BIT) \
diff --git a/contrib/ldns/drill/error.c b/contrib/ldns/drill/error.c
index 591687d0db504f..137021f3866c6d 100644
--- a/contrib/ldns/drill/error.c
+++ b/contrib/ldns/drill/error.c
@@ -2,7 +2,7 @@
  * error.c
  *
  * error reporting routines
- * basicly wrappers around printf
+ * basically wrappers around printf
  *
  * (c) 2005 NLnet Labs
  *
diff --git a/contrib/ldns/drill/securetrace.c b/contrib/ldns/drill/securetrace.c
index 863875e138cdfa..90014b4e30075a 100644
--- a/contrib/ldns/drill/securetrace.c
+++ b/contrib/ldns/drill/securetrace.c
@@ -137,7 +137,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 	ldns_rr_list *correct_key_list;
 	ldns_rr_list *trusted_ds_rrs;
 	bool new_keys_trusted = false;
-	ldns_rr_list *current_correct_keys;
+	ldns_rr_list *current_correct_keys = NULL;
 	ldns_rr_list *dataset;
 
 	ldns_rr_list *nsec_rrs = NULL;
@@ -241,7 +241,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 			goto done;
 		}
 	}
-	labels = LDNS_XMALLOC(ldns_rdf*, labels_count + 2);
+	labels = LDNS_CALLOC(ldns_rdf*, labels_count + 2);
 	if (!labels) {
 		goto done;
 	}
@@ -256,6 +256,13 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 	 */
 	for(i = (ssize_t)labels_count + 1; i > 0; i--) {
 		status = ldns_resolver_send(&local_p, res, labels[i], LDNS_RR_TYPE_NS, c, 0);
+		if (status != LDNS_STATUS_OK) {
+			fprintf(stderr, "Error sending query: %s\n", ldns_get_errorstr_by_id(status));
+			result = status;
+			goto done;
+		}
+
+		/* TODO: handle status */
 
 		if (verbosity >= 5) {
 			ldns_pkt_print(stdout, local_p);
@@ -497,12 +504,43 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 			p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
 			(void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
 			if (!ds_list) {
-				ldns_pkt_free(p);
-				if (ds_sig_list) {
+				ldns_rr_list_deep_free(ds_sig_list);
+				(void) get_dnssec_rr( p, labels[i-1]
+				                    , LDNS_RR_TYPE_CNAME
+				                    , &ds_list, &ds_sig_list);
+				if (ds_list) {
+					st = ldns_verify( ds_list, ds_sig_list
+					                , correct_key_list
+					                , current_correct_keys);
+
+					if (st == LDNS_STATUS_OK) {
+						printf(";; No DS record found "
+						       "for ");
+						ldns_rdf_print(stdout,
+							labels[i-1]);
+						printf(", but valid CNAME");
+					} else {
+						printf(BOGUS " Unable to verify "
+						       "denial of existence for ");
+						ldns_rdf_print(stdout,
+							labels[i-1]);
+						printf(", because of BOGUS CNAME");
+					}
+					printf("\n");
 					ldns_rr_list_deep_free(ds_sig_list);
+					ldns_pkt_free(p);
+					ldns_rr_list_deep_free(ds_list);
+					ds_list = NULL;
+					ds_sig_list = NULL;
+					p = NULL;
+				} else {
+					ldns_rr_list_deep_free(ds_sig_list);
+					ldns_pkt_free(p);
+					p = get_dnssec_pkt(res, name,
+							LDNS_RR_TYPE_DNSKEY);
+					(void) get_ds(p, NULL
+					             , &ds_list, &ds_sig_list); 
 				}
-				p = get_dnssec_pkt(res, name, LDNS_RR_TYPE_DNSKEY);
-				(void) get_ds(p, NULL, &ds_list, &ds_sig_list); 
 			}
 			if (ds_sig_list) {
 				if (ds_list) {
@@ -606,7 +644,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 							printf(";; No DS for ");
 							ldns_rdf_print(stdout, labels[i - 1]);
 						} else {
-							printf("[B] Unable to verify denial of existence for ");
+							printf(BOGUS " Unable to verify denial of existence for ");
 							ldns_rdf_print(stdout, labels[i - 1]);
 							printf(" DS: %s\n", ldns_get_errorstr_by_id(status));
 						}
@@ -710,7 +748,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 						}
 						printf("\n");
 					} else {
-						printf("[B] Unable to verify denial of existence for ");
+						printf(BOGUS " Unable to verify denial of existence for ");
 						ldns_rdf_print(stdout, name);
 						printf(" type ");
 						if (descriptor && descriptor->_name) {
@@ -736,7 +774,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 		ldns_rr_list_deep_free(ds_sig_list);
 		ds_sig_list = NULL;
 	}
-	printf(";;" SELF " self sig OK; " BOGUS " bogus; " TRUST " trusted\n");
+	printf(";;" SELF " self sig OK; " BOGUS " bogus; " TRUST " trusted; " UNSIGNED " unsigned\n");
 	/* verbose mode?
 	printf("Trusted keys:\n");
 	ldns_rr_list_print(stdout, trusted_keys);
diff --git a/contrib/ldns/duration.c b/contrib/ldns/duration.c
index 1abeb12515d80f..abff9a074fc34b 100644
--- a/contrib/ldns/duration.c
+++ b/contrib/ldns/duration.c
@@ -183,7 +183,6 @@ ldns_duration_create_from_string(const char* str)
             return NULL;
         } else {
             duration->weeks = (time_t) atoi(str+1);
-            str = W;
         }
     }
     return duration;
@@ -191,123 +190,51 @@ ldns_duration_create_from_string(const char* str)
 
 
 /**
- * Get the number of digits in a number.
- *
+ * Helper func for ldns_duration2string below. If t > 0,
+ * scan print t and c on buf, forwarding buf. Return 0 on success.
  */
-static size_t
-digits_in_number(time_t duration)
+static inline int dur_scan_print(char **buf, char *eob, char c, time_t t)
 {
-    uint32_t period = (uint32_t) duration;
-    size_t count = 0;
-
-    while (period > 0) {
-        count++;
-        period /= 10;
-    }
-    return count;
+	if (t > 0) {
+		int r = snprintf(*buf, eob - *buf, "%u%c", (unsigned)t, c);
+		if (r < 0 || (*buf += r) >= eob)
+			return -1;
+	}
+	return 0;
 }
 
-
 /**
  * Convert a duration to a string.
  *
  */
 char*
-ldns_duration2string(const ldns_duration_type* duration)
+ldns_duration2string(const ldns_duration_type* d)
 {
-    char* str = NULL, *num = NULL;
-    size_t count = 2;
-    int T = 0;
-
-    if (!duration) {
-        return NULL;
-    }
-
-    if (duration->years > 0) {
-        count = count + 1 + digits_in_number(duration->years);
-    }
-    if (duration->months > 0) {
-        count = count + 1 + digits_in_number(duration->months);
-    }
-    if (duration->weeks > 0) {
-        count = count + 1 + digits_in_number(duration->weeks);
-    }
-    if (duration->days > 0) {
-        count = count + 1 + digits_in_number(duration->days);
-    }
-    if (duration->hours > 0) {
-        count = count + 1 + digits_in_number(duration->hours);
-        T = 1;
-    }
-    if (duration->minutes > 0) {
-        count = count + 1 + digits_in_number(duration->minutes);
-        T = 1;
-    }
-    if (duration->seconds > 0) {
-        count = count + 1 + digits_in_number(duration->seconds);
-        T = 1;
-    }
-    if (T) {
-        count++;
-    }
-
-    str = (char*) calloc(count, sizeof(char));
-    str[0] = 'P';
-    str[1] = '\0';
-
-    if (duration->years > 0) {
-        count = digits_in_number(duration->years);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uY", (unsigned int) duration->years);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (duration->months > 0) {
-        count = digits_in_number(duration->months);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uM", (unsigned int) duration->months);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (duration->weeks > 0) {
-        count = digits_in_number(duration->weeks);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uW", (unsigned int) duration->weeks);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (duration->days > 0) {
-        count = digits_in_number(duration->days);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uD", (unsigned int) duration->days);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (T) {
-        str = strncat(str, "T", 1);
-    }
-    if (duration->hours > 0) {
-        count = digits_in_number(duration->hours);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uH", (unsigned int) duration->hours);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (duration->minutes > 0) {
-        count = digits_in_number(duration->minutes);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uM", (unsigned int) duration->minutes);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    if (duration->seconds > 0) {
-        count = digits_in_number(duration->seconds);
-        num = (char*) calloc(count+2, sizeof(char));
-        snprintf(num, count+2, "%uS", (unsigned int) duration->seconds);
-        str = strncat(str, num, count+2);
-        free((void*) num);
-    }
-    return str;
+ 	/* Max string size should be 7 * 40 + 3 on a 127 bits machine
+	 * So 300 (< 273) is more than enough.
+	 */
+	char buf[300] = "P0D", *eob = buf + sizeof(buf), *p = buf + 1;
+
+	if (!d)
+		return NULL;
+
+	if (dur_scan_print(&p, eob, 'Y', d->years)
+	||  dur_scan_print(&p, eob, 'M', d->months)
+	||  dur_scan_print(&p, eob, 'W', d->weeks)
+	||  dur_scan_print(&p, eob, 'D', d->days))
+		return NULL;
+
+	if (d->hours || d->minutes || d->seconds) {
+		if (p > (eob - 2))
+			return NULL; /* Error; no space left on buf for 'T' */
+
+		*p++ = 'T'; *p = 0;
+		if (dur_scan_print(&p, eob, 'H', d->hours)
+		||  dur_scan_print(&p, eob, 'M', d->minutes)
+		||  dur_scan_print(&p, eob, 'S', d->seconds))
+			return NULL;
+	}
+	return strdup(buf);
 }
 
 
diff --git a/contrib/ldns/edns.c b/contrib/ldns/edns.c
new file mode 100644
index 00000000000000..bc374835c3e775
--- /dev/null
+++ b/contrib/ldns/edns.c
@@ -0,0 +1,436 @@
+/*
+ * edns.c
+ *
+ * edns implementation
+ *
+ * a Net::DNS like library for C
+ *
+ * (c) NLnet Labs, 2004-2022
+ *
+ * See the file LICENSE for the license
+ */
+
+#include <ldns/ldns.h>
+
+#define LDNS_OPTIONLIST_INIT 8
+
+/*
+ * Access functions
+ * functions to get and set type checking
+ */
+
+/* read */
+size_t
+ldns_edns_get_size(const ldns_edns_option *edns)
+{
+	assert(edns != NULL);
+	return edns->_size;
+}
+
+ldns_edns_option_code
+ldns_edns_get_code(const ldns_edns_option *edns)
+{
+	assert(edns != NULL);
+	return edns->_code;
+}
+
+uint8_t *
+ldns_edns_get_data(const ldns_edns_option *edns)
+{
+	assert(edns != NULL);
+	return edns->_data;
+}
+
+ldns_buffer *
+ldns_edns_get_wireformat_buffer(const ldns_edns_option *edns)
+{
+	uint16_t option;
+	size_t size;
+	uint8_t* data;
+	ldns_buffer* buffer;
+
+	if (edns == NULL) {
+		return NULL;
+	}
+
+	option = ldns_edns_get_code(edns);
+	size = ldns_edns_get_size(edns);
+	data = ldns_edns_get_data(edns);
+
+	buffer = ldns_buffer_new(size + 4);
+
+	if (buffer == NULL) {
+		return NULL;
+	}
+
+	ldns_buffer_write_u16(buffer, option);
+	ldns_buffer_write_u16(buffer, size);
+	ldns_buffer_write(buffer, data, size);
+
+	ldns_buffer_flip(buffer);
+
+	return buffer;
+}
+
+/* write */
+static void
+ldns_edns_set_size(ldns_edns_option *edns, size_t size)
+{
+	assert(edns != NULL);
+	edns->_size = size;
+}
+
+static void
+ldns_edns_set_code(ldns_edns_option *edns, ldns_edns_option_code code)
+{
+	assert(edns != NULL);
+	edns->_code = code;
+}
+
+static void
+ldns_edns_set_data(ldns_edns_option *edns, void *data)
+{
+	/* only copy the pointer */
+	assert(edns != NULL);
+	edns->_data = data;
+}
+
+/* note: data must be allocated memory */
+ldns_edns_option *
+ldns_edns_new(ldns_edns_option_code code, size_t size, void *data)
+{
+	ldns_edns_option *edns;
+	edns = LDNS_MALLOC(ldns_edns_option);
+	if (!edns) {
+		return NULL;
+	}
+	ldns_edns_set_code(edns, code);
+	ldns_edns_set_size(edns, size);
+	ldns_edns_set_data(edns, data);
+
+	return edns;
+}
+
+ldns_edns_option *
+ldns_edns_new_from_data(ldns_edns_option_code code, size_t size, const void *data)
+{
+	ldns_edns_option *edns;
+	edns = LDNS_MALLOC(ldns_edns_option);
+	if (!edns) {
+		return NULL;
+	}
+	edns->_data = LDNS_XMALLOC(uint8_t, size);
+	if (!edns->_data) {
+		LDNS_FREE(edns);
+		return NULL;
+	}
+
+	/* set the values */
+	ldns_edns_set_code(edns, code);
+	ldns_edns_set_size(edns, size);
+	memcpy(edns->_data, data, size);
+
+	return edns;
+}
+
+ldns_edns_option *
+ldns_edns_clone(ldns_edns_option *edns)
+{
+	ldns_edns_option *new_option;
+
+	assert(edns != NULL);
+
+	new_option = ldns_edns_new_from_data(ldns_edns_get_code(edns),
+		ldns_edns_get_size(edns),
+		ldns_edns_get_data(edns));
+
+	return new_option;
+}
+
+void
+ldns_edns_deep_free(ldns_edns_option *edns)
+{
+	if (edns) {
+		if (edns->_data) {
+			LDNS_FREE(edns->_data);
+		}
+		LDNS_FREE(edns);
+	}
+}
+
+void 
+ldns_edns_free(ldns_edns_option *edns)
+{
+	if (edns) {
+		LDNS_FREE(edns);
+	}
+}
+
+ldns_edns_option_list*
+ldns_edns_option_list_new()
+{
+	ldns_edns_option_list *option_list = LDNS_MALLOC(ldns_edns_option_list);
+	if(!option_list) {
+		return NULL;
+	}
+
+	option_list->_option_count = 0;
+	option_list->_option_capacity = 0;
+	option_list->_options_size = 0;
+	option_list->_options = NULL;
+	return option_list;
+}
+
+ldns_edns_option_list *
+ldns_edns_option_list_clone(ldns_edns_option_list *old_list)
+{
+	size_t i;
+	ldns_edns_option_list *new_list;
+
+	if (!old_list) {
+		return NULL;
+	}
+
+	new_list = ldns_edns_option_list_new();
+	if (!new_list) {
+		return NULL;
+	}
+
+	if (old_list->_option_count == 0) {
+		return new_list;
+	}
+
+	/* adding options also updates the total options size */
+	for (i = 0; i < old_list->_option_count; i++) {
+		ldns_edns_option *option = ldns_edns_clone(ldns_edns_option_list_get_option(old_list, i));
+		if (!ldns_edns_option_list_push(new_list, option)) {
+			ldns_edns_deep_free(option);
+			ldns_edns_option_list_deep_free(new_list);
+			return NULL;
+		}
+	}
+	return new_list;
+}
+
+void
+ldns_edns_option_list_free(ldns_edns_option_list *option_list)
+{
+	if (option_list) {
+		LDNS_FREE(option_list->_options);
+		LDNS_FREE(option_list);
+	}
+}
+
+void
+ldns_edns_option_list_deep_free(ldns_edns_option_list *option_list)
+{
+	size_t i;
+
+	if (option_list) {
+		for (i=0; i < ldns_edns_option_list_get_count(option_list); i++) {
+			ldns_edns_deep_free(ldns_edns_option_list_get_option(option_list, i));
+		}
+		ldns_edns_option_list_free(option_list);
+	}
+}
+
+size_t
+ldns_edns_option_list_get_count(const ldns_edns_option_list *option_list)
+{
+	if (option_list) {
+		return option_list->_option_count;
+	} else {
+		return 0;
+	}
+}
+
+ldns_edns_option *
+ldns_edns_option_list_get_option(const ldns_edns_option_list *option_list, size_t index)
+{
+	if (option_list && index < ldns_edns_option_list_get_count(option_list)) {
+		assert(option_list->_options[index]);
+		return option_list->_options[index];
+	} else {
+		return NULL;
+	}
+}
+
+size_t
+ldns_edns_option_list_get_options_size(const ldns_edns_option_list *option_list)
+{
+	if (option_list) {
+		return option_list->_options_size;
+	} else {
+		return 0;
+	}
+}
+
+
+ldns_edns_option *
+ldns_edns_option_list_set_option(ldns_edns_option_list *option_list,
+	ldns_edns_option *option, size_t index)
+{
+	ldns_edns_option* old;
+
+	assert(option_list != NULL);
+
+	if (index > ldns_edns_option_list_get_count(option_list)) {
+		return NULL;
+	}
+
+	if (option == NULL) {
+		return NULL;
+	}
+
+	old = ldns_edns_option_list_get_option(option_list, index);
+
+	/* shrink the total EDNS size if the old EDNS option exists */
+	if (old != NULL) {
+		option_list->_options_size -= (ldns_edns_get_size(old) + 4);
+	}
+
+	option_list->_options_size += (ldns_edns_get_size(option) + 4);
+
+	option_list->_options[index] = option;
+	return old;
+}
+
+bool
+ldns_edns_option_list_push(ldns_edns_option_list *option_list,
+	ldns_edns_option *option)
+{
+	size_t cap;
+	size_t option_count;
+
+	assert(option_list != NULL);
+
+	if (option == NULL) {
+		return false;
+	}
+
+	cap = option_list->_option_capacity;
+	option_count = ldns_edns_option_list_get_count(option_list);
+
+	/* verify we need to grow the array to fit the new option */
+	if (option_count+1 > cap) {
+		ldns_edns_option **new_list;
+
+		/* initialize the capacity if needed, otherwise grow by doubling */
+		if (cap == 0) {
+			cap = LDNS_OPTIONLIST_INIT; /* initial list size */
+		} else {
+			cap *= 2;
+		}
+
+		new_list = LDNS_XREALLOC(option_list->_options,
+			ldns_edns_option *, cap);
+
+		if (!new_list) {
+			return false;
+		}
+
+		option_list->_options = new_list;
+		option_list->_option_capacity = cap;
+	}
+
+	/* add the new option */
+	ldns_edns_option_list_set_option(option_list, option,
+		option_list->_option_count);
+	option_list->_option_count += 1;
+
+	return true;
+}
+
+ldns_edns_option *
+ldns_edns_option_list_pop(ldns_edns_option_list *option_list)
+{
+	ldns_edns_option* pop;
+	size_t count;
+	size_t cap;
+
+	assert(option_list != NULL);
+
+	cap = option_list->_option_capacity;
+	count = ldns_edns_option_list_get_count(option_list);
+
+	if (count == 0) {
+		return NULL;
+	}
+	/* get the last option from the list */
+	pop = ldns_edns_option_list_get_option(option_list, count-1);
+
+	/* shrink the array */
+	if (cap > LDNS_OPTIONLIST_INIT && count-1 <= cap/2) {
+		ldns_edns_option **new_list;
+
+		cap /= 2;
+
+		new_list = LDNS_XREALLOC(option_list->_options,
+			ldns_edns_option *, cap);
+		if (new_list) {
+			option_list->_options = new_list;
+		}
+		/* if the realloc fails, the capacity for the list remains unchanged */
+	}
+
+	/* shrink the total EDNS size of the options if the popped EDNS option exists */
+	if (pop != NULL) {
+		option_list->_options_size -= (ldns_edns_get_size(pop) + 4);
+	}
+
+	option_list->_option_count = count - 1;
+
+	return pop;
+}
+
+ldns_buffer *
+ldns_edns_option_list2wireformat_buffer(const ldns_edns_option_list *option_list)
+{
+	size_t i, list_size, options_size, option, size;
+	ldns_buffer* buffer;
+	ldns_edns_option *edns;
+	uint8_t* data = NULL;
+
+	if (!option_list) {
+		return NULL;
+	}
+
+	/* get the number of EDNS options in the list*/
+	list_size = ldns_edns_option_list_get_count(option_list);
+
+	/* create buffer the size of the total EDNS wireformat options */
+	options_size = ldns_edns_option_list_get_options_size(option_list);
+	buffer = ldns_buffer_new(options_size);
+	
+	if (!buffer) {
+		return NULL;
+	}
+
+	/* write individual serialized EDNS options to final buffer*/
+	for (i = 0; i < list_size; i++) {
+		edns = ldns_edns_option_list_get_option(option_list, i);
+
+		if (edns == NULL) {
+			/* this shouldn't be possible */
+			return NULL;
+		}
+
+		option = ldns_edns_get_code(edns);
+		size = ldns_edns_get_size(edns);
+		data = ldns_edns_get_data(edns);
+
+		/* make sure the option fits */
+		if (!(ldns_buffer_available(buffer, size + 4))) {
+			ldns_buffer_free(buffer);
+			return NULL;
+		}
+
+		ldns_buffer_write_u16(buffer, option);
+		ldns_buffer_write_u16(buffer, size);
+		ldns_buffer_write(buffer, data, size);
+	}
+
+	ldns_buffer_flip(buffer);
+
+	return buffer;
+}
diff --git a/contrib/ldns/error.c b/contrib/ldns/error.c
index 35ee5bdd5e24dc..e3fd121127890b 100644
--- a/contrib/ldns/error.c
+++ b/contrib/ldns/error.c
@@ -1,6 +1,6 @@
 /*
  * a error2str function to make sense of all the
- * error codes we have laying ardoun
+ * error codes we have laying around
  *
  * a Net::DNS like library for C
  * LibDNS Team @ NLnet Labs
@@ -36,7 +36,7 @@ ldns_lookup_table ldns_error_str[] = {
         { LDNS_STATUS_NETWORK_ERR, "Could not send or receive, because of network error" },
         { LDNS_STATUS_ADDRESS_ERR, "Could not start AXFR, because of address error" },
         { LDNS_STATUS_FILE_ERR, "Could not open the files" },
-        { LDNS_STATUS_UNKNOWN_INET, "Uknown address family" },
+        { LDNS_STATUS_UNKNOWN_INET, "Unknown address family" },
         { LDNS_STATUS_NOT_IMPL, "This function is not implemented (yet), please notify the developers - or not..." },
 	{ LDNS_STATUS_NULL, "Supplied value pointer null" },
         { LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, "Unknown cryptographic algorithm" },
@@ -157,6 +157,33 @@ ldns_lookup_table ldns_error_str[] = {
 		"X509_STORE_CTX_set0_dane() functions within OpenSSL >= 1.1.0 "
 		"to be able to verify the DANE-TA usage type." },
 #endif
+	{ LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE, "A ZONEMD with the same "
+		"<scheme> and hash algorithm occurred more than once." },
+	{ LDNS_STATUS_ZONEMD_UNKNOWN_SCHEME, "Unknown ZONEMD <scheme>" },
+	{ LDNS_STATUS_ZONEMD_UNKNOWN_HASH, "Unknown ZONEMD hash algorithm" },
+	{ LDNS_STATUS_ZONEMD_INVALID_SOA,
+		"Missing or invalid SOA to associate with ZONEMD RR" },
+	{ LDNS_STATUS_NO_ZONEMD,
+		"NSEC(3) RRs indicate that a ZONEMD exists, "
+	        "but it is not found in the zone" },
+	{ LDNS_STATUS_NO_VALID_ZONEMD,
+		"No ZONEMD matching the zone data was found" },
+	{ LDNS_STATUS_SYNTAX_SVCPARAM_KEY_ERR, "Syntax error in a key in "
+		"the ServiceParam rdata field of SVCB or HTTPS RR" },
+	{ LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR, "Syntax error in a value in "
+		"the ServiceParam rdata field of SVCB or HTTPS RR" },
+	{ LDNS_STATUS_RESERVED_SVCPARAM_KEY,
+		"key65535 is reserved and MUST NOT be used "
+		"in the ServiceParam rdata field of SVCB or HTTPS RR" },
+	{ LDNS_STATUS_NO_SVCPARAM_VALUE_EXPECTED,
+		"A value was found for a key that SHOULD not have a value "
+		"in the ServiceParam rdata field of SVCB or HTTPS RR" },
+	{ LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE,
+		"A key was found more than once "
+		"in the ServiceParam rdata field of SVCB or HTTPS RR" },
+	{ LDNS_STATUS_INVALID_SVCPARAM_VALUE,
+		"Invalid wireformat of a value "
+		"in the ServiceParam rdata field of SVCB or HTTPS RR" },
 	{ 0, NULL }
 };
 
diff --git a/contrib/ldns/examples/ldns-compare-zones.1 b/contrib/ldns/examples/ldns-compare-zones.1
new file mode 100644
index 00000000000000..5a4a579fb55df2
--- /dev/null
+++ b/contrib/ldns/examples/ldns-compare-zones.1
@@ -0,0 +1,71 @@
+.TH ldns-compare-zones 1 "17 Oct 2007"
+.SH NAME
+ldns-compare-zones \- read and compare two zonefiles and print differences
+.SH SYNOPSIS
+.B ldns-compare-zones
+.IR [-c]
+.IR [-U]
+.IR [-u]
+.IR [-i]
+.IR [-d]
+.IR [-z]
+.IR [-s]
+.IR ZONEFILE1
+.IR ZONEFILE2 
+.SH DESCRIPTION
+\fBldns-compare-zones\fR reads two DNS zone files and prints number of differences.
+.nf
+Output is formatted to:
+        +NUM_INS        \-NUM_DEL        ~NUM_CHG
+
+Except with the \fI-U\fR or \fI-u\fR option.  Then the output is formatted to:
+        +NUM_INS        \-NUM_DEL        ~NUM_CHG        =NUM_EQ
+
+.fi
+The major comparison is based on the owner name. If an owner name is present in zonefile 1, but not in zonefile 2, the resource records with this owner name are considered deleted, and counted as NUM_DEL. If an owner name is present in zonefile 2, but not in zonefile 1, the resource records with this owner name are considered inserted, and counted as NUM_INS. If an owner name is present in both, but there is a difference in the amount or content of the records, these are considered changed, and counted as NUM_CHG.
+.SH OPTIONS
+.TP
+\fB-c\fR
+Print resource records whose owner names are in both zone files, but with different resource records. (a.k.a. changed)
+.TP
+\fB-U\fR
+From resource records whose owner names are in both zone files, but with different resource records, print the unchanged records too (a.k.a. changed++).
+.TP
+\fB-u\fR
+Print resource records whose owner names are in both zone files, and which resource records are the same. (a.k.a. unchanged)
+.TP
+\fB-i\fR
+Print resource records whose owner names are present only in ZONEFILE2 (a.k.a. inserted)
+.TP
+\fB-d\fR
+Print resource records whose owner names are present only in ZONEFILE1 (a.k.a. deleted)
+.TP
+\fB-a\fR
+Print all changes (except unchanged). Specifying this option is the same as specifying \-c \-i
+and \-d.
+.TP
+\fB-z\fR
+Suppress zone sorting; this option is not recommended; it can cause records
+to be incorrectly marked as changed, depending of the nature of the changes.
+.TP
+\fB-s\fR
+Do not exclude the SOA record from the comparison.  The SOA record may
+then show up as changed due to a new serial number.  Off by default since
+you may be interested to know if (other zone apex elements) have changed.
+.TP
+\fB-e\fR
+Exit with status code 2 when zones differ.
+.TP
+\fB-h\fR
+Show usage and exit
+.TP
+\fB-v\fR
+Show the version and exit
+.SH AUTHOR
+Written by Ondřej Surý <ondrej@sury.org> for CZ.NIC, z.s.p.o. (czech domain registry)
+.SH REPORTING BUGS
+Report bugs to <ondrej@sury.org>.
+.SH COPYRIGHT
+Copyright (C) 2005 CZ.NIC, z.s.p.o.. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-compare-zones.c b/contrib/ldns/examples/ldns-compare-zones.c
new file mode 100644
index 00000000000000..750a8455aec548
--- /dev/null
+++ b/contrib/ldns/examples/ldns-compare-zones.c
@@ -0,0 +1,361 @@
+/*
+ * ldns-compare-zones compares two zone files
+ * 
+ * Written by Ondrej Sury in 2007
+ * 
+ * Modified a bit by NLnet Labs.
+ * 
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <time.h>
+
+#include <ldns/ldns.h>
+
+#include <errno.h>
+
+#define OP_INS '+'
+#define OP_DEL '-'
+#define OP_CHG '~'
+#define OP_EQ  '='
+
+static void 
+usage(char *prog)
+{
+	printf("Usage: %s [-v] [-i] [-d] [-c] [-u] [-s] [-e] "
+	       "<zonefile1> <zonefile2>\n", prog);
+	printf("       -i - print inserted\n");
+	printf("       -d - print deleted\n");
+	printf("       -c - print changed\n");
+	printf("       -u - print unchanged\n");
+	printf("       -U - print unchanged records in changed names\n");
+	printf("       -a - print all differences (-i -d -c)\n");
+	printf("       -s - do not exclude SOA record from comparison\n");
+	printf("       -z - do not sort zones\n");
+	printf("       -e - exit with status 2 on changed zones\n");
+	printf("       -h - show usage and exit\n");
+	printf("       -v - show the version and exit\n");
+}
+
+int 
+main(int argc, char **argv)
+{
+	char           *fn1, *fn2;
+	FILE           *fp1, *fp2;
+	ldns_zone      *z1, *z2;
+	ldns_status	s;
+	size_t		i      , j;
+	size_t		k      , l;
+	size_t		nc1    , nc2;
+	ldns_rr_list   *rrl1, *rrl2;
+	int		rr_cmp, rr_chg = 0;
+	ldns_rr        *rr1 = NULL, *rr2 = NULL, *rrx = NULL;
+	int		line_nr1 = 0, line_nr2 = 0;
+	size_t		rrc1   , rrc2;
+	size_t		num_ins = 0, num_del = 0, num_chg = 0, num_eq = 0;
+	int		c;
+	bool		opt_deleted = false, opt_inserted  = false;
+	bool            opt_changed = false, opt_unchanged = false, opt_Unchanged = false;
+        bool		sort = true, inc_soa = false;
+	bool		opt_exit_status = false;
+	char		op = 0;
+
+	while ((c = getopt(argc, argv, "ahvdicuUesz")) != -1) {
+		switch (c) {
+		case 'h':
+			usage(argv[0]);
+			exit(EXIT_SUCCESS);
+			break;
+		case 'v':
+			printf("%s version %s (ldns version %s)\n",
+				  argv[0],
+				  LDNS_VERSION,
+				  ldns_version());
+			exit(EXIT_SUCCESS);
+			break;
+		case 'e':
+			opt_exit_status = true;
+			break;
+		case 's':
+			inc_soa = true;
+			break;
+		case 'z':
+			sort = false;
+                        break;
+		case 'd':
+			opt_deleted = true;
+			break;
+		case 'i':
+			opt_inserted = true;
+			break;
+		case 'c':
+			opt_changed = true;
+			break;
+
+		case 'u':
+			opt_unchanged = true;
+			opt_Unchanged = true;
+			break;
+
+		case 'U':
+			opt_Unchanged = true;
+			opt_changed = true;
+			break;
+
+		case 'a':
+			opt_deleted = true;
+			opt_inserted = true;
+			opt_changed = true;
+			break;
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 2) {
+		argv -= optind;
+		usage(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+	fn1 = argv[0];
+	fp1 = fopen(fn1, "r");
+	if (!fp1) {
+		fprintf(stderr, "Unable to open %s: %s\n", fn1, strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+	/* Read first zone */
+	s = ldns_zone_new_frm_fp_l(&z1, fp1, NULL, 0, 
+						  LDNS_RR_CLASS_IN, &line_nr1);
+	if (s != LDNS_STATUS_OK) {
+		fclose(fp1);
+		fprintf(stderr, "%s: %s at line %d\n",
+			   fn1,
+			   ldns_get_errorstr_by_id(s),
+			   line_nr1);
+		exit(EXIT_FAILURE);
+	}
+	fclose(fp1);
+
+	fn2 = argv[1];
+	fp2 = fopen(fn2, "r");
+	if (!fp2) {
+		fprintf(stderr, "Unable to open %s: %s\n", fn2, strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+	/* Read second zone */
+	s = ldns_zone_new_frm_fp_l(&z2, fp2, NULL, 0,
+						  LDNS_RR_CLASS_IN, &line_nr2);
+	if (s != LDNS_STATUS_OK) {
+		ldns_zone_deep_free(z1);
+		fclose(fp2);
+		fprintf(stderr, "%s: %s at line %d\n",
+			   fn2,
+			   ldns_get_errorstr_by_id(s),
+			   line_nr2);
+		exit(EXIT_FAILURE);
+	}
+	fclose(fp2);
+
+	rrl1 = ldns_zone_rrs(z1);
+	rrc1 = ldns_rr_list_rr_count(rrl1);
+
+	rrl2 = ldns_zone_rrs(z2);
+	rrc2 = ldns_rr_list_rr_count(rrl2);
+
+        if (sort) {
+		/* canonicalize zone 1 */
+		ldns_rr2canonical(ldns_zone_soa(z1));
+                for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(z1)); i++) {
+                	ldns_rr2canonical(ldns_rr_list_rr(ldns_zone_rrs(z1), i));
+		}
+                /* sort zone 1 */
+                ldns_zone_sort(z1);
+		/* canonicalize zone 2 */
+		ldns_rr2canonical(ldns_zone_soa(z2));
+                for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(z2)); i++) {
+                	ldns_rr2canonical(ldns_rr_list_rr(ldns_zone_rrs(z2), i));
+		}
+                /* sort zone 2 */
+                ldns_zone_sort(z2);
+        }
+
+	if(inc_soa) {
+		ldns_rr_list* wsoa = ldns_rr_list_new();
+		ldns_rr_list_push_rr(wsoa, ldns_zone_soa(z1));
+		ldns_rr_list_cat(wsoa, rrl1);
+		rrl1 = wsoa;
+		rrc1 = ldns_rr_list_rr_count(rrl1);
+		wsoa = ldns_rr_list_new();
+		ldns_rr_list_push_rr(wsoa, ldns_zone_soa(z2));
+		ldns_rr_list_cat(wsoa, rrl2);
+		rrl2 = wsoa;
+		rrc2 = ldns_rr_list_rr_count(rrl2);
+		if(sort) {
+			ldns_rr_list_sort(rrl1);
+			ldns_rr_list_sort(rrl2);
+		}
+	}
+
+	/*
+	 * Walk through both zones. The previously seen resource record is
+	 * kept (in the variable rrx) so that we can recognize when we are
+	 * handling a new owner name. If the owner name changes, we have to
+	 * set the operator again.
+	 */
+	for (i = 0, j = 0; i < rrc1 || j < rrc2;) {
+		rr_cmp = 0;
+		if (i < rrc1 && j < rrc2) {
+			rr1 = ldns_rr_list_rr(rrl1, i);
+			rr2 = ldns_rr_list_rr(rrl2, j);
+			rr_cmp = ldns_rr_compare(rr1, rr2);
+
+			rr_chg = ldns_dname_compare(ldns_rr_owner(rr1),
+								   ldns_rr_owner(rr2));
+		} else if (i >= rrc1) {
+			/* we have reached the end of zone 1, so the current record
+			 * from zone 2 automatically sorts higher
+			 */
+			rr1 = NULL;
+			rr2 = ldns_rr_list_rr(rrl2, j);
+			rr_chg = rr_cmp = 1;
+		} else if (j >= rrc2) {
+			/* we have reached the end of zone 2, so the current record
+			 * from zone 1 automatically sorts lower
+			 */
+			rr1 = ldns_rr_list_rr(rrl1, i);
+			rr2 = NULL;
+			rr_chg = rr_cmp = -1;
+		}
+		if (rr_cmp < 0) {
+			if ((rrx != NULL) && (ldns_dname_compare(ldns_rr_owner(rr1), 
+											 ldns_rr_owner(rrx)
+											 ) != 0)) {
+				/* The owner name is different, forget previous rr */
+				rrx = NULL;
+			}
+			if (rrx == NULL) {
+				if (rr_chg == 0) {
+					num_chg++;
+					op = OP_CHG;
+				} else {
+					num_del++;
+					op = OP_DEL;
+				}
+				rrx = rr1;
+			}
+			if (((op == OP_DEL) && opt_deleted) ||
+			    ((op == OP_CHG) && opt_changed)) {
+				printf("%c-", op);
+				ldns_rr_print(stdout, rr1);
+			}
+			i++;
+		} else if (rr_cmp > 0) {
+			if ((rrx != NULL) && (ldns_dname_compare(ldns_rr_owner(rr2),
+											 ldns_rr_owner(rrx)
+											 ) != 0)) {
+				rrx = NULL;
+			}
+			if (rrx == NULL) {
+				if (rr_chg == 0) {
+					num_chg++;
+					op = OP_CHG;
+				} else {
+					num_ins++;
+					op = OP_INS;
+				}
+				/* remember this rr for it's name in the next iteration */
+				rrx = rr2;
+			}
+			if (((op == OP_INS) && opt_inserted) ||
+			    ((op == OP_CHG) && opt_changed)) {
+				printf("%c+", op);
+				ldns_rr_print(stdout, rr2);
+			}
+			j++;
+		} else {
+			if ((rrx != NULL) && (ldns_dname_compare(ldns_rr_owner(rr1),
+											 ldns_rr_owner(rrx)
+											 ) != 0)) {
+				rrx = NULL;
+			}
+			if (rrx == NULL) {
+				rrx = rr1;
+
+				/* Are all rrs with this name equal? */
+				for ( k = i + 1
+				    ; k < rrc1 &&
+				      ldns_dname_compare(ldns_rr_owner(rr1), 
+					                 ldns_rr_owner(ldns_rr_list_rr(rrl1, k))) == 0
+				    ; k++);
+                                
+
+				for ( l = j + 1
+				    ; l < rrc2 &&
+				      ldns_dname_compare(ldns_rr_owner(rr2), 
+					                 ldns_rr_owner(ldns_rr_list_rr(rrl2, l))) == 0
+				    ; l++);
+
+				if ((k - i) != (l - j)) {
+					op = OP_CHG;
+					num_chg++;
+				} else {
+					nc1 = k - i;
+					nc2 = l - j;
+					for ( k = i + 1, l = j + 1
+					    ; (k - i) < nc1 && (l - j) < nc2 &&
+							ldns_rr_compare(ldns_rr_list_rr(rrl1, k),
+							ldns_rr_list_rr(rrl2, l)) == 0
+					    ; k++, l++);
+					if ((k - i) < nc1) {
+						op = OP_CHG;
+						num_chg++;
+                                       } else {
+						op = OP_EQ;
+						num_eq++;
+					}
+				}
+			}
+			if (((op == OP_EQ ) && opt_unchanged) ||
+			    ((op == OP_CHG) && opt_Unchanged && opt_changed)) {
+				printf("%c=", op);
+				ldns_rr_print(stdout, rr1);
+			}
+			i++;
+			j++;
+		}
+	}
+
+	if (opt_unchanged || opt_Unchanged)
+		printf("\t%c%u\t%c%u\t%c%u\t%c%u\n", 
+			  OP_INS, 
+			  (unsigned int) num_ins, 
+			  OP_DEL,
+			  (unsigned int) num_del, 
+			  OP_CHG, 
+			  (unsigned int) num_chg,
+			  OP_EQ,
+			  (unsigned int) num_eq);
+	else
+		printf("\t%c%u\t%c%u\t%c%u\n", 
+			  OP_INS, 
+			  (unsigned int) num_ins, 
+			  OP_DEL,
+			  (unsigned int) num_del, 
+			  OP_CHG, 
+			  (unsigned int) num_chg);
+
+	/* Free resources */
+	if(inc_soa) {
+		ldns_rr_list_free(rrl1);
+		ldns_rr_list_free(rrl2);
+	}
+	ldns_zone_deep_free(z2);
+	ldns_zone_deep_free(z1);
+
+	return opt_exit_status && (num_ins || num_del || num_chg) ? 2 : 0;
+}
diff --git a/contrib/ldns/examples/ldns-dane.c b/contrib/ldns/examples/ldns-dane.c
new file mode 100644
index 00000000000000..58bdc2f7883282
--- /dev/null
+++ b/contrib/ldns/examples/ldns-dane.c
@@ -0,0 +1,2053 @@
+/*
+ * Verify or create TLS authentication with DANE (RFC6698)
+ *
+ * (c) NLnetLabs 2012
+ *
+ * See the file LICENSE for the license.
+ *
+ * wish list:
+ * - nicer reporting (tracing of evaluation process)
+ * - verbosity levels
+ * - STARTTLS support
+ */
+
+#include "config.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/types.h>
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#include <sys/time.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#include <ldns/ldns.h>
+
+#ifdef USE_DANE
+#ifdef HAVE_SSL
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#include <openssl/x509v3.h>
+
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
+
+#define LDNS_ERR(code, msg) do { if (code != LDNS_STATUS_OK) \
+					ldns_err(msg, code); } while (false)
+#define MEMERR(msg) do { fprintf(stderr, "memory error in %s\n", msg); \
+			 exit(EXIT_FAILURE); } while (false)
+#define BUFSIZE 16384
+
+/* Exit status on a PKIX validated connection but without TLSA records
+ * when the -T option was given:
+ */
+#define NO_TLSAS_EXIT_STATUS 2
+
+/* int verbosity = 3; */
+
+static void
+print_usage(const char* progname)
+{
+#ifdef USE_DANE_VERIFY
+	printf("Usage: %s [OPTIONS] verify <name> <port>\n", progname);
+	printf("   or: %s [OPTIONS] -t <tlsafile> verify\n", progname);
+	printf("\n\tVerify the TLS connection at <name>:<port> or"
+	       "\n\tuse TLSA record(s) from <tlsafile> to verify the\n"
+			"\tTLS service they reference.\n");
+	printf("\n   or: %s [OPTIONS] create <name> <port> [<usage> "
+#else
+	printf("Usage: %s [OPTIONS] create <name> <port> [<usage> "
+#endif
+			"[<selector> [<type>]]]\n", progname);
+	printf("\n\tUse the TLS connection(s) to <name> <port> "
+			"to create the TLSA\n\t"
+			"resource record(s) that would "
+			"authenticate the connection.\n");
+	printf("\n\t<usage>"
+			"\t\t0 | PKIX-TA  : CA constraint\n"
+			"\t\t\t1 | PKIX-EE  : Service certificate constraint\n"
+			"\t\t\t2 | DANE-TA  : Trust anchor assertion\n"
+			"\t\t\t3 | DANE-EE  : Domain-issued certificate "
+			"(default)\n");
+	printf("\n\t<selector>"
+			"\t0 | Cert     : Full certificate\n"
+			"\t\t\t1 | SPKI     : SubjectPublicKeyInfo "
+			"(default)\n");
+	printf("\n\t<type>"
+			"\t\t0 | Full     : No hash used\n"
+			"\t\t\t1 | SHA2-256 : SHA-256 (default)\n"
+			"\t\t\t2 | SHA2-512 : SHA-512\n");
+
+	printf("OPTIONS:\n");
+	printf("\t-h\t\tshow this text\n");
+	printf("\t-4\t\tTLS connect IPv4 only\n");
+	printf("\t-6\t\tTLS connect IPv6 only\n");
+	printf("\t-r <address>\t"
+	       "use resolver at <address> instead of local resolver\n");
+	printf("\t-a <address>\t"
+	       "don't resolve <name>, but connect to <address>(es)\n");
+	printf("\t-b\t\t"
+	       "print \"<name>. TYPE52 \\#<size> <hex data>\" form\n"
+	      );
+	printf("\t-c <certfile>\t"
+	       "verify or create TLSA records for the\n"
+	       "\t\t\tcertificate (chain) in <certfile>\n"
+	      );
+	printf("\t-d\t\tassume DNSSEC validity even when insecure or bogus\n");
+	printf("\t-f <CAfile>\tuse CAfile to validate\n");
+#if HAVE_DANE_CA_FILE
+	printf("\t\t\tDefault is %s\n", LDNS_DANE_CA_FILE);
+#endif
+	printf("\t-i\t\tinteract after connecting\n");
+	printf("\t-k <keyfile>\t"
+	       "use DNSKEY/DS rr(s) in <keyfile> to validate TLSAs\n"
+	       "\t\t\twhen signature chasing (i.e. -S)\n"
+	      );
+	printf("\t\t\tDefault is %s\n", LDNS_TRUST_ANCHOR_FILE);
+	printf("\t-n\t\tdo *not* verify server name in certificate\n");
+	printf("\t-o <offset>\t"
+	       "select <offset>th certificate from the end of\n"
+	       "\t\t\tthe validation chain. -1 means self-signed at end\n"
+	      );
+	printf("\t-p <CApath>\t"
+	       "use certificates in the <CApath> directory to validate\n"
+	      );
+#if HAVE_DANE_CA_PATH
+	printf("\t\t\tDefaults is %s\n", LDNS_DANE_CA_PATH);
+#endif
+	printf("\t-s\t\tassume PKIX validity\n");
+	printf("\t-S\t\tChase signature(s) to a known key\n");
+	printf("\t-t <tlsafile>\tdo not use DNS, "
+	       "but read TLSA record(s) from <tlsafile>\n"
+	      );
+	printf("\t-T\t\tReturn exit status 2 for PKIX validated connections\n"
+	       "\t\t\twithout (secure) TLSA records(s)\n");
+	printf("\t-u\t\tuse UDP transport instead of TCP\n");
+	printf("\t-v\t\tshow version and exit\n");
+	/* printf("\t-V [0-5]\tset verbosity level (default 3)\n"); */
+	exit(EXIT_SUCCESS);
+}
+
+static int
+dane_int_within_range(const char* arg, int max, const char* name)
+{
+	char* endptr; /* utility var for strtol usage */
+	int val = strtol(arg, &endptr, 10);
+
+	if ((val < 0 || val > max)
+			|| (errno != 0 && val == 0) /* out of range */
+			|| endptr == arg            /* no digits */
+			|| *endptr != '\0'          /* more chars */
+			) {
+		fprintf(stderr, "<%s> should be in range [0-%d]\n", name, max);
+		exit(EXIT_FAILURE);
+	}
+	return val;
+}
+
+struct dane_param_choice_struct {
+	const char* name;
+	int number;
+};
+typedef struct dane_param_choice_struct dane_param_choice;
+
+dane_param_choice dane_certificate_usage_table[] = {
+	{ "PKIX-TA"				,   0 },
+	{ "CA constraint"			,   0 },
+	{ "CA-constraint"			,   0 },
+	{ "PKIX-EE"				,   1 },
+	{ "Service certificate constraint"	,   1 },
+	{ "Service-certificate-constraint"	,   1 },
+	{ "DANE-TA"				,   2 },
+	{ "Trust anchor assertion"		,   2 },
+	{ "Trust-anchor-assertion"		,   2 },
+	{ "anchor"				,   2 },
+	{ "DANE-EE"				,   3 },
+	{ "Domain-issued certificate"		,   3 },
+	{ "Domain-issued-certificate"		,   3 },
+	{ "PrivCert"				, 255 },
+	{ NULL, -1 }
+};
+
+dane_param_choice dane_selector_table[] = {
+	{ "Cert"		,   0 },
+	{ "Full certificate"	,   0 },
+	{ "Full-certificate"	,   0 },
+	{ "certificate"		,   0 },
+	{ "SPKI"		,   1 },
+	{ "SubjectPublicKeyInfo",   1 },
+	{ "PublicKey"		,   1 },
+	{ "pubkey"		,   1 },
+	{ "key"			,   1 },
+	{ "PrivSel"		, 255 },
+	{ NULL, -1 }
+};
+
+dane_param_choice dane_matching_type_table[] = {
+	{ "Full"		,   0 },
+	{ "no-hash-used"	,   0 },
+	{ "no hash used"	,   0 },
+	{ "SHA2-256"		,   1 },
+	{ "sha256"		,   1 },
+	{ "sha-256"		,   1 },
+	{ "SHA2-512"		,   2 },
+	{ "sha512"		,   2 },
+	{ "sha-512"		,   2 },
+	{ "PrivMatch"		, 255 },
+	{ NULL, -1 }
+};
+
+static int
+dane_int_within_range_table(const char* arg, int max, const char* name,
+		dane_param_choice table[])
+{
+	dane_param_choice* t;
+
+	if (*arg) {
+		for (t = table; t->name; t++) {
+			if (strncasecmp(arg, t->name, strlen(arg)) == 0) {
+				return t->number;
+			}
+		}
+	}
+	return dane_int_within_range(arg, max, name);
+}
+
+static void
+ssl_err(const char* s)
+{
+	fprintf(stderr, "error: %s\n", s);
+	ERR_print_errors_fp(stderr);
+	exit(EXIT_FAILURE);
+}
+
+static void
+ldns_err(const char* s, ldns_status err)
+{
+	if (err == LDNS_STATUS_SSL_ERR) {
+		ssl_err(s);
+	} else {
+		fprintf(stderr, "%s: %s\n", s, ldns_get_errorstr_by_id(err));
+		exit(EXIT_FAILURE);
+	}
+}
+
+static ldns_status
+ssl_connect_and_get_cert_chain(
+		X509** cert, STACK_OF(X509)** extra_certs,
+	       	SSL* ssl, const char* name_str,
+		ldns_rdf* address, uint16_t port,
+		ldns_dane_transport transport)
+{
+	struct sockaddr_storage *a = NULL;
+	size_t a_len = 0;
+	int sock;
+	int r;
+
+	assert(cert != NULL);
+	assert(extra_certs != NULL);
+
+	a = ldns_rdf2native_sockaddr_storage(address, port, &a_len);
+	switch (transport) {
+	case LDNS_DANE_TRANSPORT_TCP:
+
+		sock = socket((int)((struct sockaddr*)a)->sa_family,
+				SOCK_STREAM, IPPROTO_TCP);
+		break;
+
+	case LDNS_DANE_TRANSPORT_UDP:
+
+		sock = socket((int)((struct sockaddr*)a)->sa_family,
+				SOCK_DGRAM, IPPROTO_UDP);
+		break;
+
+	case LDNS_DANE_TRANSPORT_SCTP:
+
+		sock = socket((int)((struct sockaddr*)a)->sa_family,
+				SOCK_STREAM, IPPROTO_SCTP);
+		break;
+
+	default:
+		LDNS_FREE(a);
+		return LDNS_STATUS_DANE_UNKNOWN_TRANSPORT;
+	}
+	if (sock == -1) {
+		LDNS_FREE(a);
+		return LDNS_STATUS_NETWORK_ERR;
+	}
+	if (connect(sock, (struct sockaddr*)a, (socklen_t)a_len) == -1) {
+		LDNS_FREE(a);
+		return LDNS_STATUS_NETWORK_ERR;
+	}
+	LDNS_FREE(a);
+	if (! SSL_clear(ssl)) {
+		close(sock);
+		fprintf(stderr, "SSL_clear\n");
+		return LDNS_STATUS_SSL_ERR;
+	}
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+	(void) SSL_set_tlsext_host_name(ssl, name_str);
+#endif
+	SSL_set_connect_state(ssl);
+	(void) SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
+	if (! SSL_set_fd(ssl, sock)) {
+		close(sock);
+		fprintf(stderr, "SSL_set_fd\n");
+		return LDNS_STATUS_SSL_ERR;
+	}
+	for (;;) {
+		ERR_clear_error();
+		if ((r = SSL_do_handshake(ssl)) == 1) {
+			break;
+		}
+		r = SSL_get_error(ssl, r);
+		if (r != SSL_ERROR_WANT_READ && r != SSL_ERROR_WANT_WRITE) {
+			fprintf(stderr, "handshaking SSL_get_error: %d\n", r);
+			return LDNS_STATUS_SSL_ERR;
+		}
+	}
+	*cert = SSL_get_peer_certificate(ssl);
+	*extra_certs = SSL_get_peer_cert_chain(ssl);
+
+	return LDNS_STATUS_OK;
+}
+
+
+#ifdef USE_DANE_VERIFY
+static void
+ssl_interact(SSL* ssl)
+{
+	fd_set rfds;
+	int maxfd;
+	int sock;
+	int r;
+
+	char buf[BUFSIZE];
+	char* bufptr;
+	int to_write;
+	int written;
+
+	sock = SSL_get_fd(ssl);
+	if (sock == -1) {
+		return;
+	}
+	maxfd = (STDIN_FILENO > sock ? STDIN_FILENO : sock) + 1;
+	for (;;) {
+#ifndef S_SPLINT_S
+		FD_ZERO(&rfds);
+#endif /* splint */
+		FD_SET(sock, &rfds);
+		FD_SET(STDIN_FILENO, &rfds);
+
+		r = select(maxfd, &rfds, NULL, NULL, NULL);
+		if (r == -1) {
+			perror("select");
+			break;
+		}
+		if (FD_ISSET(sock, &rfds)) {
+			to_write = SSL_read(ssl, buf, BUFSIZE);
+			if (to_write <= 0) {
+				r = SSL_get_error(ssl, to_write);
+				if (r != SSL_ERROR_ZERO_RETURN) {
+					fprintf(stderr,
+						"reading SSL_get_error:"
+						" %d\n", r);
+				}
+				break;
+			}
+			bufptr = buf;
+			while (to_write > 0) {
+				written = (int) fwrite(bufptr, 1, 
+						(size_t) to_write, stdout);
+				if (written == 0) {
+					perror("fwrite");
+					break;
+				}
+				to_write -= written;
+				bufptr += written;
+			}
+		} /* if (FD_ISSET(sock, &rfds)) */
+
+		if (FD_ISSET(STDIN_FILENO, &rfds)) {
+			to_write = (int) read(STDIN_FILENO, buf, BUFSIZE - 1);
+			if (to_write <= 0) {
+				if (to_write == -1) {
+					perror("read");
+				}
+				break;
+			}
+			if (buf[to_write - 1] == '\n') {
+				buf[to_write - 1] = '\r';
+				buf[to_write    ] = '\n';
+				to_write += 1;
+			}
+			bufptr = buf;
+			while (to_write > 0) {
+				written = SSL_write(ssl, bufptr, to_write);
+				if (written <= 0) {
+					r = SSL_get_error(ssl, to_write);
+					if (r != SSL_ERROR_ZERO_RETURN) {
+						fprintf(stderr,
+							"writing SSL_get_error"
+							": %d\n", r);
+					}
+					break;
+				}
+				to_write -= written;
+				bufptr += written;
+			}
+		} /* if (FD_ISSET(STDIN_FILENO, &rfds)) */
+
+	} /* for (;;) */
+}
+#endif /* USE_DANE_VERIFY */
+
+
+static ldns_rr_list*
+rr_list_filter_rr_type(ldns_rr_list* l, ldns_rr_type t)
+{
+	size_t i;
+	ldns_rr* rr;
+	ldns_rr_list* r = ldns_rr_list_new();
+
+	if (r == NULL) {
+		return r;
+	}
+	for (i = 0; i < ldns_rr_list_rr_count(l); i++) {
+		rr = ldns_rr_list_rr(l, i);
+		if (ldns_rr_get_type(rr) == t) {
+			if (! ldns_rr_list_push_rr(r, rr)) {
+				ldns_rr_list_free(r);
+				return NULL;
+			}
+		}
+	}
+	return r;
+}
+
+
+/* Return a copy of the list of tlsa records where the usage types
+ * "CA constraint" are replaced with "Trust anchor assertion" and the usage
+ * types "Service certificate constraint" are replaced with 
+ * "Domain-issued certificate".
+ *
+ * This to check what would happen if PKIX validation was successful always.
+ */
+static ldns_rr_list*
+dane_no_pkix_transform(const ldns_rr_list* tlas)
+{
+	size_t i;
+	ldns_rr* rr;
+	ldns_rr* new_rr;
+	ldns_rdf* rdf;
+	ldns_rr_list* r = ldns_rr_list_new();
+
+	if (r == NULL) {
+		return r;
+	}
+	for (i = 0; i < ldns_rr_list_rr_count(tlas); i++) {
+		rr = ldns_rr_list_rr(tlas, i);
+		if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_TLSA) {
+
+			new_rr = ldns_rr_clone(rr);
+			if (!new_rr) {
+				ldns_rr_list_deep_free(r);
+				return NULL;
+			}
+			switch(ldns_rdf2native_int8(ldns_rr_rdf(new_rr, 0))) {
+
+			case LDNS_TLSA_USAGE_CA_CONSTRAINT:
+
+				rdf = ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
+			(uint8_t) LDNS_TLSA_USAGE_TRUST_ANCHOR_ASSERTION);
+				if (! rdf) {
+					ldns_rr_free(new_rr);
+					ldns_rr_list_deep_free(r);
+					return NULL;
+				}
+				(void) ldns_rr_set_rdf(new_rr, rdf, 0);
+				break;
+
+
+			case LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT:
+
+				rdf = ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
+			(uint8_t) LDNS_TLSA_USAGE_DOMAIN_ISSUED_CERTIFICATE);
+				if (! rdf) {
+					ldns_rr_free(new_rr);
+					ldns_rr_list_deep_free(r);
+					return NULL;
+				}
+				(void) ldns_rr_set_rdf(new_rr, rdf, 0);
+				break;
+
+
+			default:
+				break;
+			}
+			if (! ldns_rr_list_push_rr(r, new_rr)) {
+				ldns_rr_free(new_rr);
+				ldns_rr_list_deep_free(r);
+				return NULL;
+			}
+		}
+	}
+	return r;
+}
+
+static void
+print_rr_as_TYPEXXX(FILE* out, ldns_rr* rr)
+{
+	size_t i, sz;
+	ldns_status s;
+	ldns_buffer* buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
+	char* str;
+
+	ldns_buffer_clear(buf);
+	s = ldns_rdf2buffer_str_dname(buf, ldns_rr_owner(rr));
+	LDNS_ERR(s, "could not ldns_rdf2buffer_str_dname");
+	ldns_buffer_printf(buf, "\t%d", ldns_rr_ttl(rr));
+	ldns_buffer_printf(buf, "\t");
+	s = ldns_rr_class2buffer_str(buf, ldns_rr_get_class(rr));
+	LDNS_ERR(s, "could not ldns_rr_class2buffer_str");
+	ldns_buffer_printf(buf, "\tTYPE%d", ldns_rr_get_type(rr));
+	sz = 0;
+	for (i = 0; i < ldns_rr_rd_count(rr); i++) {
+		 sz += ldns_rdf_size(ldns_rr_rdf(rr, i));
+	}
+	ldns_buffer_printf(buf, "\t\\# %d ", sz);
+	for (i = 0; i < ldns_rr_rd_count(rr); i++) {
+		s = ldns_rdf2buffer_str_hex(buf, ldns_rr_rdf(rr, i));
+		LDNS_ERR(s, "could not ldns_rdf2buffer_str_hex");
+	}
+	str = ldns_buffer_export2str(buf);
+	ldns_buffer_free(buf);
+	fprintf(out, "%s\n", str);
+	LDNS_FREE(str);
+}
+
+static void
+print_rr_list_as_TYPEXXX(FILE* out, ldns_rr_list* l)
+{
+	size_t i;
+
+	for (i = 0; i < ldns_rr_list_rr_count(l); i++) {
+		print_rr_as_TYPEXXX(out, ldns_rr_list_rr(l, i));
+	}
+}
+
+static ldns_status
+read_key_file(const char *filename, ldns_rr_list *keys)
+{
+	ldns_status status = LDNS_STATUS_ERR;
+	ldns_rr *rr;
+	FILE *fp;
+	uint32_t my_ttl = 0;
+	ldns_rdf *my_origin = NULL;
+	ldns_rdf *my_prev = NULL;
+	int line_nr;
+
+	if (!(fp = fopen(filename, "r"))) {
+		return LDNS_STATUS_FILE_ERR;
+	}
+	while (!feof(fp)) {
+		status = ldns_rr_new_frm_fp_l(&rr, fp, &my_ttl, &my_origin,
+				&my_prev, &line_nr);
+
+		if (status == LDNS_STATUS_OK) {
+
+			if (   ldns_rr_get_type(rr) == LDNS_RR_TYPE_DS
+			    || ldns_rr_get_type(rr) == LDNS_RR_TYPE_DNSKEY)
+
+				ldns_rr_list_push_rr(keys, rr);
+
+		} else if (   status == LDNS_STATUS_SYNTAX_EMPTY
+		           || status == LDNS_STATUS_SYNTAX_TTL
+		           || status == LDNS_STATUS_SYNTAX_ORIGIN
+		           || status == LDNS_STATUS_SYNTAX_INCLUDE)
+
+			status = LDNS_STATUS_OK;
+		else
+			break;
+	}
+	fclose(fp);
+	return status;
+}
+
+
+static ldns_status
+dane_setup_resolver(ldns_resolver** res, ldns_rdf* nameserver_addr,
+		ldns_rr_list* keys, bool dnssec_off)
+{
+	ldns_status s = LDNS_STATUS_OK;
+
+	assert(res != NULL);
+
+	if (nameserver_addr) {
+		*res = ldns_resolver_new();
+		if (*res) {
+			s = ldns_resolver_push_nameserver(*res, nameserver_addr);
+		} else {
+			s = LDNS_STATUS_MEM_ERR;
+		}
+	} else {
+	        s = ldns_resolver_new_frm_file(res, NULL);
+	}
+	if (s == LDNS_STATUS_OK) {
+		ldns_resolver_set_dnssec(*res, ! dnssec_off);
+
+		if (keys && ldns_rr_list_rr_count(keys) > 0) {
+			/* anchors must trigger signature chasing */
+			ldns_resolver_set_dnssec_anchors(*res, keys);
+			ldns_resolver_set_dnssec_cd(*res, true);
+		}
+	}
+	return s;
+}
+
+
+static ldns_status
+dane_query(ldns_rr_list** rrs, ldns_resolver* r,
+		ldns_rdf *name, ldns_rr_type t, ldns_rr_class c,
+		bool insecure_is_ok)
+{
+	ldns_pkt* p = NULL;
+	ldns_rr_list* keys = NULL;
+	ldns_rr_list* rrsigs  = NULL;
+	ldns_rdf* signame = NULL;
+	ldns_status s;
+
+	assert(rrs != NULL);
+
+	p = ldns_resolver_query(r, name, t, c, LDNS_RD);
+	if (! p) {
+		return LDNS_STATUS_MEM_ERR;
+	}
+	*rrs = ldns_pkt_rr_list_by_type(p, t, LDNS_SECTION_ANSWER);
+
+	if (! ldns_resolver_dnssec(r)) { /* DNSSEC explicitly disabled,
+					    anything goes */
+		ldns_pkt_free(p);
+		return LDNS_STATUS_OK;
+	}
+	if (ldns_rr_list_rr_count(*rrs) == 0) { /* assert(*rrs == NULL) */
+
+		if (ldns_pkt_get_rcode(p) == LDNS_RCODE_SERVFAIL) {
+
+			ldns_pkt_free(p);
+			return LDNS_STATUS_DANE_BOGUS;
+		} else {
+			ldns_pkt_free(p);
+			return LDNS_STATUS_OK;
+		}
+	}
+	/* We have answers and we have dnssec. */
+
+	if (! ldns_pkt_cd(p)) { /* we act as stub resolver (no sigchase) */
+
+		if (! ldns_pkt_ad(p)) { /* Not secure */
+
+			goto insecure;
+		}
+		ldns_pkt_free(p);
+		return LDNS_STATUS_OK;
+	}
+
+	/* sigchase */
+
+	/* TODO: handle cname reference check */
+
+	rrsigs = ldns_pkt_rr_list_by_type(p,
+			LDNS_RR_TYPE_RRSIG,
+			LDNS_SECTION_ANSWER);
+
+	if (! rrsigs || ldns_rr_list_rr_count(rrsigs) == 0) {
+		goto insecure;
+	}
+
+	signame = ldns_rr_rrsig_signame(ldns_rr_list_rr(rrsigs, 0));
+	if (! signame) {
+		s = LDNS_STATUS_ERR;
+		goto error;
+	}
+	/* First try with the keys we already have */
+	s = ldns_verify(*rrs, rrsigs, ldns_resolver_dnssec_anchors(r), NULL);
+	if (s == LDNS_STATUS_OK) {
+		goto cleanup;
+	}
+	/* Fetch the necessary keys and recheck */
+	keys = ldns_fetch_valid_domain_keys(r, signame,
+			ldns_resolver_dnssec_anchors(r), &s);
+
+	if (s != LDNS_STATUS_OK) {
+		goto error;
+	}
+	if (ldns_rr_list_rr_count(keys) == 0) { /* An insecure island */
+		goto insecure;
+	}
+	s = ldns_verify(*rrs, rrsigs, keys, NULL);
+	switch (s) {
+	case LDNS_STATUS_CRYPTO_BOGUS: goto bogus;
+	case LDNS_STATUS_OK          : goto cleanup;
+	default                      : break;
+	}
+insecure:
+	s = LDNS_STATUS_DANE_INSECURE;
+bogus:
+	if (! insecure_is_ok) {
+error:
+		ldns_rr_list_deep_free(*rrs);
+		*rrs = ldns_rr_list_new();
+	}
+cleanup:
+	if (keys) {
+		ldns_rr_list_deep_free(keys);
+	}
+	if (rrsigs) {
+		ldns_rr_list_deep_free(rrsigs);
+	}
+	ldns_pkt_free(p);
+	return s;
+}
+
+
+static ldns_rr_list*
+dane_lookup_addresses(ldns_resolver* res, ldns_rdf* dname,
+		int ai_family)
+{
+	ldns_status s;
+	ldns_rr_list *as = NULL;
+	ldns_rr_list *aaas = NULL;
+	ldns_rr_list *r = ldns_rr_list_new();
+
+	if (r == NULL) {
+		MEMERR("ldns_rr_list_new");
+	}
+	if (ai_family == AF_UNSPEC || ai_family == AF_INET) {
+
+		s = dane_query(&as, res,
+				dname, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN,
+			       	true);
+
+		if (s == LDNS_STATUS_DANE_INSECURE &&
+			ldns_rr_list_rr_count(as) > 0) {
+			fprintf(stderr, "Warning! Insecure IPv4 addresses. "
+					"Continuing with them...\n");
+
+		} else if (s == LDNS_STATUS_DANE_BOGUS ||
+				LDNS_STATUS_CRYPTO_BOGUS == s) {
+			fprintf(stderr, "Warning! Bogus IPv4 addresses. "
+					"Discarding...\n");
+			ldns_rr_list_deep_free(as);
+			as = ldns_rr_list_new();
+
+		} else if (s != LDNS_STATUS_OK) {
+			LDNS_ERR(s, "dane_query");
+
+		}
+		if (! ldns_rr_list_push_rr_list(r, as)) {
+			MEMERR("ldns_rr_list_push_rr_list");
+		}
+	}
+	if (ai_family == AF_UNSPEC || ai_family == AF_INET6) {
+
+		s = dane_query(&aaas, res,
+				dname, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN,
+			       	true);
+
+		if (s == LDNS_STATUS_DANE_INSECURE &&
+			ldns_rr_list_rr_count(aaas) > 0) {
+			fprintf(stderr, "Warning! Insecure IPv6 addresses. "
+					"Continuing with them...\n");
+
+		} else if (s == LDNS_STATUS_DANE_BOGUS ||
+				LDNS_STATUS_CRYPTO_BOGUS == s) {
+			fprintf(stderr, "Warning! Bogus IPv6 addresses. "
+					"Discarding...\n");
+			ldns_rr_list_deep_free(aaas);
+			aaas = ldns_rr_list_new();
+
+		} else if (s != LDNS_STATUS_OK) {
+			LDNS_ERR(s, "dane_query");
+
+		}
+		if (! ldns_rr_list_push_rr_list(r, aaas)) {
+			MEMERR("ldns_rr_list_push_rr_list");
+		}
+	}
+	return r;
+}
+
+static ldns_status
+dane_read_tlsas_from_file(ldns_rr_list** tlsas,
+		char* filename, ldns_rdf* origin)
+{
+	FILE* fp = NULL;
+	ldns_rr* rr = NULL;
+	ldns_rdf *my_origin = NULL;
+	ldns_rdf *my_prev = NULL;
+	ldns_rdf *origin_lc = NULL;
+	int line_nr;
+	ldns_status s = LDNS_STATUS_MEM_ERR;
+
+	assert(tlsas != NULL);
+	assert(filename != NULL);
+
+	if (strcmp(filename, "-") == 0) {
+		fp = stdin;
+	} else {
+		fp = fopen(filename, "r");
+		if (!fp) {
+			fprintf(stderr, "Unable to open %s: %s\n",
+					filename, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+	if (origin) {
+		my_origin = ldns_rdf_clone(origin);
+		if (! my_origin) {
+			goto error;
+		}
+		my_prev   = ldns_rdf_clone(origin);
+		if (! my_prev) {
+			goto error;
+		}
+		origin_lc = ldns_rdf_clone(origin);
+		if (! origin_lc) {
+			goto error;
+		}
+		ldns_dname2canonical(origin_lc);
+	}
+	*tlsas = ldns_rr_list_new();
+	if (! *tlsas) {
+		goto error;
+	}
+	while (! feof(fp)) {
+		s = ldns_rr_new_frm_fp_l(&rr, fp, NULL,
+				&my_origin, &my_prev, &line_nr);
+		if (s != LDNS_STATUS_OK) {
+			goto error;
+		}
+		if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_TLSA) {
+			ldns_dname2canonical(ldns_rr_owner(rr));
+			if (! origin || ldns_dname_compare(ldns_rr_owner(rr),
+						origin_lc) == 0) {
+				if (ldns_rr_list_push_rr(*tlsas, rr)) {
+					continue;
+				} else {
+					s = LDNS_STATUS_MEM_ERR;
+					goto error;
+				}
+			}
+		}
+		ldns_rr_free(rr);
+	}
+
+	ldns_rdf_deep_free(origin_lc);
+	ldns_rdf_deep_free(my_prev);
+	ldns_rdf_deep_free(my_origin);
+	fclose(fp);
+
+	return LDNS_STATUS_OK;
+
+error:
+	if (*tlsas) {
+		ldns_rr_list_deep_free(*tlsas);
+		*tlsas = NULL;
+	}
+	if (origin_lc) {
+		ldns_rdf_deep_free(origin_lc);
+	}
+	if (my_prev) {
+		ldns_rdf_deep_free(my_prev);
+	}
+	if (my_origin) {
+		ldns_rdf_deep_free(my_origin);
+	}
+	if (fp && fp != stdin) {
+		fclose(fp);
+	}
+	return s;
+}
+
+static bool
+dane_wildcard_label_cmp(uint8_t iw, const char* w, uint8_t il, const char* l)
+{
+	if (iw == 0) { /* End of match label */
+		if (il == 0) { /* And end in the to be matched label */
+			return true;
+		}
+		return false;
+	}
+	do {
+		if (*w == '*') {
+			if (iw == 1) { /* '*' is the last match char,
+					  remainder matches wildcard */
+				return true;
+			}
+			while (il > 0) { /* more to match? */
+
+				if (w[1] == *l) { /* Char after '*' matches.
+						   * Recursion for backtracking
+						   */
+					if (dane_wildcard_label_cmp(
+								iw - 1, w + 1,
+								il    , l)) {
+						return true;
+					}
+				}
+				l += 1;
+				il -= 1;
+			}
+		}
+		/* Skip up till next wildcard (if possible) */
+		while (il > 0 && iw > 0 && *w != '*' && *w == *l) {
+			w += 1;
+			l += 1;
+			il -= 1;
+			iw -= 1;
+		}
+	} while (iw > 0 && *w == '*' &&  /* More to match a next wildcard? */
+			(il > 0 || iw == 1));
+
+	return iw == 0 && il == 0;
+}
+
+static bool
+dane_label_matches_label(ldns_rdf* w, ldns_rdf* l)
+{
+	uint8_t iw;
+	uint8_t il;
+
+	iw = ldns_rdf_data(w)[0];
+	il = ldns_rdf_data(l)[0];
+	return dane_wildcard_label_cmp(
+			iw, (const char*)ldns_rdf_data(w) + 1,
+			il, (const char*)ldns_rdf_data(l) + 1);
+}
+
+static bool
+dane_name_matches_server_name(const char* name_str, ldns_rdf* server_name)
+{
+	ldns_rdf* name;
+	uint8_t nn, ns, i;
+	ldns_rdf* ln;
+	ldns_rdf* ls;
+	
+	name = ldns_dname_new_frm_str((const char*)name_str);
+	if (! name) {
+		LDNS_ERR(LDNS_STATUS_ERR, "ldns_dname_new_frm_str");
+	}
+	nn = ldns_dname_label_count(name);
+	ns = ldns_dname_label_count(server_name);
+	if (nn != ns) {
+		ldns_rdf_free(name);
+		return false;
+	}
+	ldns_dname2canonical(name);
+	for (i = 0; i < nn; i++) {
+		ln = ldns_dname_label(name, i);
+		if (! ln) {
+			return false;
+		}
+		ls = ldns_dname_label(server_name, i);
+		if (! ls) {
+			ldns_rdf_free(ln);
+			return false;
+		}
+		if (! dane_label_matches_label(ln, ls)) {
+			ldns_rdf_free(ln);
+			ldns_rdf_free(ls);
+			return false;
+		}
+		ldns_rdf_free(ln);
+		ldns_rdf_free(ls);
+	}
+	return true;
+}
+
+static bool
+dane_X509_any_subject_alt_name_matches_server_name(
+		X509 *cert, ldns_rdf* server_name)
+{
+	GENERAL_NAMES* names;
+	GENERAL_NAME*  name;
+	unsigned char* subject_alt_name_str = NULL;
+	int i, n;
+
+	names = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0 );
+	if (! names) { /* No subjectAltName extension */
+		return false;
+	}
+	n = sk_GENERAL_NAME_num(names);
+	for (i = 0; i < n; i++) {
+		name = sk_GENERAL_NAME_value(names, i);
+		if (name->type == GEN_DNS) {
+			(void) ASN1_STRING_to_UTF8(&subject_alt_name_str,
+					name->d.dNSName);
+			if (subject_alt_name_str) {
+				if (dane_name_matches_server_name((char*)
+							subject_alt_name_str,
+							server_name)) {
+					OPENSSL_free(subject_alt_name_str);
+					return true;
+				}
+				OPENSSL_free(subject_alt_name_str);
+			}
+		}
+	}
+	/* sk_GENERAL_NAMES_pop_free(names, sk_GENERAL_NAME_free); */
+	return false;
+}
+
+static bool
+dane_X509_subject_name_matches_server_name(X509 *cert, ldns_rdf* server_name)
+{
+	X509_NAME* subject_name;
+	int i;
+	X509_NAME_ENTRY* entry;
+	ASN1_STRING* entry_data;
+	unsigned char* subject_name_str = NULL;
+	bool r;
+ 
+	subject_name = X509_get_subject_name(cert);
+	if (! subject_name ) {
+		ssl_err("could not X509_get_subject_name");
+	}
+	i = X509_NAME_get_index_by_NID(subject_name, NID_commonName, -1);
+	entry = X509_NAME_get_entry(subject_name, i);
+	entry_data = X509_NAME_ENTRY_get_data(entry);
+	(void) ASN1_STRING_to_UTF8(&subject_name_str, entry_data);
+	if (subject_name_str) {
+		r = dane_name_matches_server_name(
+				(char*)subject_name_str, server_name);
+		OPENSSL_free(subject_name_str);
+		return r;
+	} else {
+		return false;
+	}
+}
+
+static bool
+dane_verify_server_name(X509* cert, ldns_rdf* server_name)
+{
+	ldns_rdf* server_name_lc;
+	bool r;
+	server_name_lc = ldns_rdf_clone(server_name);
+	if (! server_name_lc) {
+		LDNS_ERR(LDNS_STATUS_MEM_ERR, "ldns_rdf_clone");
+	}
+	ldns_dname2canonical(server_name_lc);
+	r = dane_X509_any_subject_alt_name_matches_server_name(
+			cert, server_name_lc) || 
+	    dane_X509_subject_name_matches_server_name(
+			cert, server_name_lc);
+	ldns_rdf_free(server_name_lc);
+	return r;
+}
+
+static void
+dane_create(ldns_rr_list* tlsas, ldns_rdf* tlsa_owner,
+		ldns_tlsa_certificate_usage certificate_usage, int offset,
+		ldns_tlsa_selector          selector,
+		ldns_tlsa_matching_type     matching_type,
+		X509* cert, STACK_OF(X509)* extra_certs,
+		X509_STORE* validate_store,
+		bool verify_server_name, ldns_rdf* name)
+{
+	ldns_status s;
+	X509* selected_cert;
+	ldns_rr* tlsa_rr;
+
+	if (verify_server_name && ! dane_verify_server_name(cert, name)) {
+		fprintf(stderr, "The certificate does not match the "
+				"server name\n");
+		exit(EXIT_FAILURE);
+	}
+
+	s = ldns_dane_select_certificate(&selected_cert,
+			cert, extra_certs, validate_store,
+			certificate_usage, offset);
+	LDNS_ERR(s, "could not select certificate");
+
+	s = ldns_dane_create_tlsa_rr(&tlsa_rr,
+			certificate_usage, selector, matching_type,
+			selected_cert);
+	LDNS_ERR(s, "could not create tlsa rr");
+
+	ldns_rr_set_owner(tlsa_rr, ldns_rdf_clone(tlsa_owner));
+			     
+	if (! ldns_rr_list_contains_rr(tlsas, tlsa_rr)) {
+		if (! ldns_rr_list_push_rr(tlsas, tlsa_rr)) {
+			MEMERR("ldns_rr_list_push_rr");
+		}
+	}
+}
+
+#if defined(USE_DANE_VERIFY) && ( OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL) )
+static bool
+dane_verify(ldns_rr_list* tlsas, ldns_rdf* address,
+		X509* cert, STACK_OF(X509)* extra_certs,
+		X509_STORE* validate_store,
+		bool verify_server_name, ldns_rdf* name,
+		bool assume_pkix_validity)
+{
+	ldns_status s;
+	char* address_str = NULL;
+
+	s = ldns_dane_verify(tlsas, cert, extra_certs, validate_store);
+	if (address) {
+		address_str = ldns_rdf2str(address);
+		fprintf(stdout, "%s", address_str ? address_str : "<address>");
+		free(address_str);
+	} else {
+		X509_NAME_print_ex_fp(stdout,
+				X509_get_subject_name(cert), 0, 0);
+	}
+	if (s == LDNS_STATUS_OK) {
+		if (verify_server_name &&
+				! dane_verify_server_name(cert, name)) {
+
+			fprintf(stdout, " did not dane-validate, because:"
+					" the certificate name did not match"
+					" the server name\n");
+			return false;
+		}
+		fprintf(stdout, " dane-validated successfully\n");
+		return true;
+	} else if (assume_pkix_validity &&
+			s == LDNS_STATUS_DANE_PKIX_DID_NOT_VALIDATE) {
+		fprintf(stdout, " dane-validated successfully,"
+				" because PKIX is assumed valid\n");
+		return true;
+	}
+	fprintf(stdout, " did not dane-validate, because: %s\n",
+			ldns_get_errorstr_by_id(s));
+	return false;
+}
+#endif /* defined(USE_DANE_VERIFY) && OPENSSL_VERSION_NUMBER < 0x10100000 */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000  && ! defined(HAVE_LIBRESSL)
+static int _ldns_tls_verify_always_ok(int ok, X509_STORE_CTX *ctx)
+{
+	(void)ok;
+	(void)ctx;
+	return 1;
+}
+#endif
+
+/**
+ * Return either an A or AAAA rdf, based on the given
+ * string. If it it not a valid ip address, return null.
+ *
+ * Caller receives ownership of returned rdf (if not null),
+ * and must free it.
+ */
+static inline ldns_rdf* rdf_addr_frm_str(const char* str) {
+	ldns_rdf *a = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_A, str);
+	if (!a) {
+		a = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_AAAA, str);
+	}
+	return a;
+}
+
+
+int
+main(int argc, char* const* argv)
+{
+	int c;
+	enum { UNDETERMINED, VERIFY, CREATE } mode = UNDETERMINED;
+
+	ldns_status   s;
+	size_t        i;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && ! defined(HAVE_LIBRESSL)
+	size_t        j, usable_tlsas = 0;
+# ifdef USE_DANE_VERIFY
+	X509_STORE_CTX *store_ctx = NULL;
+# endif /* USE_DANE_VERIFY */
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000 */
+
+	bool print_tlsa_as_type52   = false;
+	bool assume_dnssec_validity = false;
+	bool assume_pkix_validity   = false;
+	bool verify_server_name     = true;
+	bool interact               = false;
+
+#if HAVE_DANE_CA_FILE
+	const char* CAfile    = LDNS_DANE_CA_FILE;
+#else
+	const char* CAfile    = NULL;
+#endif
+#if HAVE_DANE_CA_PATH
+	const char* CApath    = LDNS_DANE_CA_PATH;
+#else
+	const char* CApath    = NULL;
+#endif
+	char* cert_file = NULL;
+	X509* cert                  = NULL;
+	STACK_OF(X509)* extra_certs = NULL;
+	
+	ldns_rr_list*  keys = ldns_rr_list_new();
+	size_t        nkeys = 0;
+	bool    do_sigchase = false;
+
+	ldns_rr_list* addresses = ldns_rr_list_new();
+	ldns_rr*      address_rr;
+	ldns_rdf*     address;
+
+	int           ai_family = AF_UNSPEC;
+	int           transport = LDNS_DANE_TRANSPORT_TCP;
+
+	char*         name_str = NULL;	/* suppress uninitialized warning */
+	ldns_rdf*     name;
+	uint16_t      port = 0;		/* suppress uninitialized warning */
+
+	ldns_resolver* res            = NULL;
+	ldns_rdf*      nameserver_rdf = NULL;
+	ldns_rdf*      tlsa_owner     = NULL;
+	char*          tlsa_owner_str = NULL;
+	ldns_rr_list*  tlsas          = NULL;
+	char*          tlsas_file     = NULL;
+
+	/* For extracting service port and transport from tla_owner. */
+	ldns_rdf*      port_rdf       = NULL;
+	char*          port_str       = NULL;
+	ldns_rdf*      transport_rdf  = NULL;
+	char*          transport_str  = NULL;
+
+	ldns_rr_list*  originals      = NULL; /* original tlsas (before
+					       * transform), but also used
+					       * as temporary.
+					       */
+
+	ldns_tlsa_certificate_usage certificate_usage = 666;
+	int                         offset            =  -1;
+	ldns_tlsa_selector          selector          = 666;
+	ldns_tlsa_matching_type     matching_type     = 666;
+	
+
+	X509_STORE *store  = NULL;
+
+	SSL_CTX* ctx = NULL;
+	SSL*     ssl = NULL;
+
+	int  no_tlsas_exit_status  = EXIT_SUCCESS;
+	int           exit_success = EXIT_SUCCESS; 
+
+	bool success = true;
+
+	if (! keys || ! addresses) {
+		MEMERR("ldns_rr_list_new");
+	}
+	while((c = getopt(argc, argv, "46a:bc:df:hik:no:p:r:sSt:TuvV:")) != -1){
+		switch(c) {
+		case 'h':
+			print_usage("ldns-dane");
+			break;
+		case '4':
+			ai_family = AF_INET;
+			break;
+		case '6':
+			ai_family = AF_INET6;
+			break;
+		case 'r':
+			if (nameserver_rdf) {
+				fprintf(stderr, "Can only specify -r once\n");
+				exit(EXIT_FAILURE);
+			}
+			nameserver_rdf = rdf_addr_frm_str(optarg);
+			if (!nameserver_rdf) {
+				fprintf(stderr,
+				        "Could not interpret address %s\n",
+				        optarg);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'a':
+			s = ldns_str2rdf_a(&address, optarg);
+			if (s == LDNS_STATUS_OK) {
+				address_rr = ldns_rr_new_frm_type(
+						LDNS_RR_TYPE_A);
+			} else {
+				s = ldns_str2rdf_aaaa(&address, optarg);
+				if (s == LDNS_STATUS_OK) {
+					address_rr = ldns_rr_new_frm_type(
+							LDNS_RR_TYPE_AAAA);
+				} else {
+					fprintf(stderr,
+						"Could not interpret address "
+						"%s\n",
+						optarg);
+					exit(EXIT_FAILURE);
+				}
+			}
+			(void) ldns_rr_a_set_address(address_rr, address);
+			for (i = 0; i < ldns_rr_list_rr_count(addresses); i++){
+				if (ldns_rdf_compare(address,
+				     ldns_rr_a_address(
+				      ldns_rr_list_rr(addresses, i))) == 0) {
+					break;
+				}
+			}
+			if (i >= ldns_rr_list_rr_count(addresses)) {
+				if (! ldns_rr_list_push_rr(addresses,
+							address_rr)) {
+					MEMERR("ldns_rr_list_push_rr");
+				}
+			}
+			break;
+		case 'b':
+			print_tlsa_as_type52 = true;
+			/* TODO: do it with output formats... maybe... */
+			break;
+		case 'c':
+			cert_file = optarg; /* checking in SSL stuff below */
+			break;
+		case 'd':
+			assume_dnssec_validity = true;
+			break;
+		case 'f':
+			CAfile = optarg;
+			break;
+		case 'i':
+			interact = true;
+			break;
+		case 'k':
+			s = read_key_file(optarg, keys);
+			if (s == LDNS_STATUS_FILE_ERR) {
+				fprintf(stderr, "Error opening %s: %s\n",
+						optarg, strerror(errno));
+			}
+			LDNS_ERR(s, "Could not parse key file");
+			if (ldns_rr_list_rr_count(keys) == nkeys) {
+				fprintf(stderr, "No keys found in file"
+						" %s\n", optarg);
+				exit(EXIT_FAILURE);
+			}
+			nkeys = ldns_rr_list_rr_count(keys);
+			break;
+		case 'n':
+			verify_server_name = false;
+			break;
+		case 'o':
+			offset = atoi(optarg); /* todo check if all numeric */
+			break;
+		case 'p':
+			CApath = optarg;
+			break;
+		case 's':
+			assume_pkix_validity = true;
+			break;
+		case 'S':
+			do_sigchase = true;
+			break;
+		case 't':
+			tlsas_file = optarg;
+			break;
+		case 'T':
+			no_tlsas_exit_status = NO_TLSAS_EXIT_STATUS;
+			break;
+		case 'u':
+			transport = LDNS_DANE_TRANSPORT_UDP;
+			break;
+		case 'v':
+			printf("ldns-dane version %s (ldns version %s)\n",
+					LDNS_VERSION, ldns_version());
+			exit(EXIT_SUCCESS);
+			break;
+/*		case 'V':
+			verbosity = atoi(optarg);
+			break;
+ */
+		}
+	}
+
+	/* Filter out given IPv4 addresses when -6 was given, 
+	 * and IPv6 addresses when -4 was given.
+	 */
+	if (ldns_rr_list_rr_count(addresses) > 0 &&
+			ai_family != AF_UNSPEC) {
+		originals = addresses;
+		addresses = rr_list_filter_rr_type(originals,
+				(ai_family == AF_INET
+				 ? LDNS_RR_TYPE_A : LDNS_RR_TYPE_AAAA));
+		ldns_rr_list_free(originals);
+		if (addresses == NULL) {
+			MEMERR("rr_list_filter_rr_type");
+		}
+		if (ldns_rr_list_rr_count(addresses) == 0) {
+			fprintf(stderr,
+				"No addresses of the specified type remain\n");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	if (do_sigchase) {
+		if (nkeys == 0) {
+			(void) read_key_file(LDNS_TRUST_ANCHOR_FILE, keys);
+			nkeys = ldns_rr_list_rr_count(keys);
+
+			if (nkeys == 0) {
+				fprintf(stderr, "Unable to chase "
+						"signature without keys.\n");
+				exit(EXIT_FAILURE);
+			}
+		}
+	} else {
+		keys = NULL;
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc == 0) {
+
+		print_usage("ldns-dane");
+	}
+	if (strncasecmp(*argv, "create", strlen(*argv)) == 0) {
+
+		mode = CREATE;
+		argc--;
+		argv++;
+
+#ifdef USE_DANE_VERIFY
+	} else if (strncasecmp(*argv, "verify", strlen(*argv)) == 0) {
+
+		mode = VERIFY;
+		argc--;
+		argv++;
+
+	} else {
+		fprintf(stderr, "Specify create or verify mode\n");
+#else
+	} else {
+		fprintf(stderr, "Specify create mode\n");
+#endif
+		exit(EXIT_FAILURE);
+	}
+
+#ifndef USE_DANE_VERIFY
+	(void)transport_str;
+	(void)transport_rdf;
+	(void)port_str;
+	(void)port_rdf;
+	(void)interact;
+#else
+	if (mode == VERIFY && argc == 0) {
+
+		if (! tlsas_file) {
+			fprintf(stderr, "ERROR! Nothing given to verify\n");
+			exit(EXIT_FAILURE);
+		}
+		s = dane_read_tlsas_from_file(&tlsas, tlsas_file, NULL);
+		LDNS_ERR(s, "could not read tlsas from file");
+
+		/* extract port, transport and hostname from TLSA owner name */
+
+		if (ldns_rr_list_rr_count(tlsas) == 0) {
+
+			fprintf(stderr, "ERROR! No TLSA records to extract "
+					"service port, transport and hostname"
+					"\n");
+			exit(EXIT_FAILURE);
+		}
+		tlsa_owner = ldns_rr_list_owner(tlsas);
+		if (ldns_dname_label_count(tlsa_owner) < 2) {
+			fprintf(stderr, "ERROR! To few labels in TLSA owner\n");
+			exit(EXIT_FAILURE);
+		}
+		do {
+			s = LDNS_STATUS_MEM_ERR;
+			port_rdf = ldns_dname_label(tlsa_owner, 0);
+			if (! port_rdf) {
+				break;
+			}
+			port_str = ldns_rdf2str(port_rdf);
+			if (! port_str) {
+				break;
+			}
+			if (*port_str != '_') {
+				fprintf(stderr, "ERROR! Badly formatted "
+						"service port label in the "
+						"TLSA owner name\n");
+				exit(EXIT_FAILURE);
+			}
+			if (port_str[strlen(port_str) - 1] == '.') {
+				port_str[strlen(port_str) - 1] = '\000';
+			}
+			port = (uint16_t) dane_int_within_range(
+					port_str + 1, 65535, "port");
+			s = LDNS_STATUS_OK;
+		} while (false);
+		LDNS_ERR(s, "could not extract service port from TLSA owner");
+
+		do {
+			s = LDNS_STATUS_MEM_ERR;
+			transport_rdf = ldns_dname_label(tlsa_owner, 1);
+			if (! transport_rdf) {
+				break;
+			}
+			transport_str = ldns_rdf2str(transport_rdf);
+			if (! transport_str) {
+				break;
+			}
+			if (transport_str[strlen(transport_str) - 1] == '.') {
+				transport_str[strlen(transport_str) - 1] =
+					'\000';
+			}
+			if (strcmp(transport_str, "_tcp") == 0) {
+
+				transport = LDNS_DANE_TRANSPORT_TCP;
+
+			} else if (strcmp(transport_str, "_udp") == 0) {
+
+				transport = LDNS_DANE_TRANSPORT_UDP;
+
+			} else if (strcmp(transport_str, "_sctp") == 0) {
+
+				transport = LDNS_DANE_TRANSPORT_SCTP;
+
+			} else {
+				fprintf(stderr, "ERROR! Badly formatted "
+						"transport label in the "
+						"TLSA owner name\n");
+				exit(EXIT_FAILURE);
+			}
+			s = LDNS_STATUS_OK;
+			break;
+		} while(false);
+		LDNS_ERR(s, "could not extract transport from TLSA owner");
+
+		tlsa_owner_str = ldns_rdf2str(tlsa_owner);
+		if (! tlsa_owner_str) {
+			MEMERR("ldns_rdf2str");
+		}
+		name = ldns_dname_clone_from(tlsa_owner, 2);
+		if (! name) {
+			MEMERR("ldns_dname_clone_from");
+		}
+		name_str = ldns_rdf2str(name);
+		if (! name_str) {
+			MEMERR("ldns_rdf2str");
+		}
+
+
+	} else 
+#endif /* USE_DANE_VERIFY */
+		if (argc < 2) {
+
+		print_usage("ldns-dane");
+
+	} else {
+		name_str = *argv++; argc--;
+		s = ldns_str2rdf_dname(&name, name_str);
+		LDNS_ERR(s, "could not ldns_str2rdf_dname");
+
+		port = (uint16_t)dane_int_within_range(*argv++, 65535, "port");
+		--argc;
+
+		s = ldns_dane_create_tlsa_owner(&tlsa_owner,
+				name, port, transport);
+		LDNS_ERR(s, "could not create TLSA owner name");
+		tlsa_owner_str = ldns_rdf2str(tlsa_owner);
+		if (! tlsa_owner_str) {
+			MEMERR("ldns_rdf2str");
+		}
+	}
+
+	switch (mode) {
+	case VERIFY:
+		if (argc > 0) {
+
+			print_usage("ldns-dane");
+		}
+		if (tlsas_file) {
+
+			s = dane_read_tlsas_from_file(&tlsas, tlsas_file,
+					tlsa_owner);
+			LDNS_ERR(s, "could not read tlas from file");
+		} else {
+			/* lookup tlsas */
+			s = dane_setup_resolver(&res, nameserver_rdf,
+			                        keys, assume_dnssec_validity);
+			LDNS_ERR(s, "could not dane_setup_resolver");
+			s = dane_query(&tlsas, res, tlsa_owner,
+					LDNS_RR_TYPE_TLSA, LDNS_RR_CLASS_IN,
+					false);
+			ldns_resolver_free(res);
+		}
+
+		if (s == LDNS_STATUS_DANE_INSECURE) {
+
+			fprintf(stderr, "Warning! TLSA records for %s "
+				"were found, but were insecure.\n"
+				"PKIX validation without DANE will be "
+				"performed. If you wish to perform DANE\n"
+				"even though the RR's are insecure, "
+				"use the -d option.\n", tlsa_owner_str);
+
+			exit_success = no_tlsas_exit_status;
+
+		} else if (s != LDNS_STATUS_OK) {
+
+			ldns_err("dane_query", s);
+
+		} else if (ldns_rr_list_rr_count(tlsas) == 0) {
+
+			fprintf(stderr, "Warning! No TLSA records for %s "
+				"were found.\n"
+				"PKIX validation without DANE will be "
+				"performed.\n", ldns_rdf2str(tlsa_owner));
+
+			exit_success = no_tlsas_exit_status;
+
+		} else if (assume_pkix_validity) { /* number of  tlsa's > 0 */
+			
+			/* transform type "CA constraint" to "Trust anchor
+			 * assertion" and "Service Certificate Constraint"
+			 * to "Domain Issues Certificate"
+			 */
+			originals = tlsas;
+			tlsas = dane_no_pkix_transform(originals);
+		}
+
+		break;
+
+	case CREATE:
+		if (argc > 0) {
+			certificate_usage = dane_int_within_range_table(
+					*argv++, 3, "certificate usage",
+					dane_certificate_usage_table);
+			argc--;
+		} else {
+			certificate_usage = LDNS_TLSA_USAGE_DANE_EE;
+		}
+		if (argc > 0) {
+			selector = dane_int_within_range_table(
+					*argv++, 1, "selector",
+					dane_selector_table);
+			argc--;
+		} else {
+			selector = LDNS_TLSA_SELECTOR_SPKI;
+		}
+		if (argc > 0) {
+			matching_type = dane_int_within_range_table(
+					*argv++, 2, "matching type",
+					dane_matching_type_table);
+
+			argc--;
+		} else {
+			matching_type = LDNS_TLSA_MATCHING_TYPE_SHA2_256;
+		}
+		if (argc > 0) {
+
+			print_usage("ldns-dane");
+		}
+		if ((certificate_usage == LDNS_TLSA_USAGE_CA_CONSTRAINT ||
+		     certificate_usage ==
+			     LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT) &&
+		     ! CAfile && ! CApath && ! assume_pkix_validity) {
+
+			fprintf(stderr,
+				"When using the \"CA constraint\" or "
+			        "\"Service certificate constraint\",\n"
+				"-f <CAfile> and/or -p <CApath> options "
+				"must be given to perform PKIX validation.\n\n"
+				"PKIX validation may be turned off "
+				"with the -s option. Note that with\n"
+				"\"CA constraint\" the verification process "
+				"should then end with a self-signed\n"
+				"certificate which must be present "
+				"in the server certificate chain.\n\n");
+
+			exit(EXIT_FAILURE);
+		}
+		tlsas = ldns_rr_list_new();
+		break;
+	default:
+		fprintf(stderr, "Unreachable code\n");
+		assert(0);
+	}
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+	/* ssl initialize */
+	SSL_load_error_strings();
+	SSL_library_init();
+#endif
+
+	/* ssl load validation store */
+	if (! assume_pkix_validity || CAfile || CApath) {
+		store = X509_STORE_new();
+		if (! store) {
+			ssl_err("could not X509_STORE_new");
+		}
+		if ((CAfile || CApath) && X509_STORE_load_locations(
+					store, CAfile, CApath) != 1) {
+			ssl_err("error loading CA certificates");
+		}
+	}
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+	ctx =  SSL_CTX_new(SSLv23_client_method());
+#else
+	ctx =  SSL_CTX_new(TLS_client_method());
+	if (ctx && SSL_CTX_dane_enable(ctx) <= 0) {
+		ssl_err("could not SSL_CTX_dane_enable");
+	}
+
+	/* Use TLSv1.0 or above for connection. */
+	long flags = 0;
+# ifdef SSL_OP_NO_SSLv2
+	flags |= SSL_OP_NO_SSLv2;
+# endif
+# ifdef SSL_OP_NO_SSLv3
+	flags |= SSL_OP_NO_SSLv3;
+# endif
+# ifdef SSL_OP_NO_COMPRESSION
+	flags |= SSL_OP_NO_COMPRESSION;
+# endif
+	SSL_CTX_set_options(ctx, flags);
+
+	if (CAfile || CApath) {
+		if (!SSL_CTX_load_verify_locations(ctx, CAfile, CApath))
+			ssl_err("could not set verify locations\n");
+
+	} else if (!SSL_CTX_set_default_verify_paths(ctx))
+		ssl_err("could not set default verify paths\n");
+#endif
+	if (! ctx) {
+		ssl_err("could not SSL_CTX_new");
+	}
+	if (cert_file &&
+	    SSL_CTX_use_certificate_chain_file(ctx, cert_file) != 1) {
+		ssl_err("error loading certificate");
+	}
+
+	if (cert_file) { /* ssl load certificate */
+
+		ssl = SSL_new(ctx);
+		if (! ssl) {
+			ssl_err("could not SSL_new");
+		}
+		cert = SSL_get_certificate(ssl);
+		if (! cert) {
+			ssl_err("could not SSL_get_certificate");
+		}
+#ifndef SSL_CTX_get_extra_chain_certs
+#ifndef S_SPLINT_S
+		extra_certs = ctx->extra_certs;
+#endif /* splint */
+#else
+		if(!SSL_CTX_get_extra_chain_certs(ctx, &extra_certs)) {
+			ssl_err("could not SSL_CTX_get_extra_chain_certs");
+		}
+#endif
+		switch (mode) {
+		case CREATE: dane_create(tlsas, tlsa_owner, certificate_usage,
+					     offset, selector, matching_type,
+					     cert, extra_certs, store,
+					     verify_server_name, name);
+			     break;
+#ifdef USE_DANE_VERIFY
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+		case VERIFY: if (! dane_verify(tlsas, NULL,
+			                       cert, extra_certs, store,
+					       verify_server_name, name,
+					       assume_pkix_validity)) {
+				     success = false;
+			     }
+			     break;
+#else /* OPENSSL_VERSION_NUMBER < 0x10100000 */
+		case VERIFY: 
+			     usable_tlsas = 0;
+			     SSL_set_connect_state(ssl);
+			     if (SSL_dane_enable(ssl, name_str) <= 0) {
+			     	ssl_err("could not SSL_dane_enable");
+			     }
+			     if (!verify_server_name) {
+			     	SSL_dane_set_flags(ssl, DANE_FLAG_NO_DANE_EE_NAMECHECKS);
+			     }
+			     for (j = 0; j < ldns_rr_list_rr_count(tlsas); j++) {
+			     	int ret;
+			     	ldns_rr *tlsa_rr = ldns_rr_list_rr(tlsas, j);
+
+			     	if (ldns_rr_get_type(tlsa_rr) != LDNS_RR_TYPE_TLSA) {
+			     		fprintf(stderr, "Skipping non TLSA RR: ");
+			     		ldns_rr_print(stderr, tlsa_rr);
+			     		fprintf(stderr, "\n");
+			     		continue;
+			     	}
+			     	if (ldns_rr_rd_count(tlsa_rr) != 4) {
+			     		fprintf(stderr, "Skipping TLSA with wrong rdata RR: ");
+			     		ldns_rr_print(stderr, tlsa_rr);
+			     		fprintf(stderr, "\n");
+			     		continue;
+			     	}
+			     	ret = SSL_dane_tlsa_add(ssl,
+			     			ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 0)),
+			     			ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 1)),
+			     			ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 2)),
+			     			ldns_rdf_data(ldns_rr_rdf(tlsa_rr, 3)),
+			     			ldns_rdf_size(ldns_rr_rdf(tlsa_rr, 3)));
+			     	if (ret < 0) {
+			     		ssl_err("could not SSL_dane_tlsa_add");
+			     	}
+			     	if (ret == 0) {
+			     		fprintf(stderr, "Skipping unusable TLSA RR: ");
+			     		ldns_rr_print(stderr, tlsa_rr);
+			     		fprintf(stderr, "\n");
+			     		continue;
+			     	}
+			     	usable_tlsas += 1;
+			     }
+			     if (!usable_tlsas) {
+			     	fprintf(stderr, "No usable TLSA records were found.\n"
+			     			"PKIX validation without DANE will be performed.\n");
+				exit_success = no_tlsas_exit_status;
+			     }
+			     if (!(store_ctx = X509_STORE_CTX_new())) {
+				     ssl_err("could not SSL_new");
+			     }
+			     if (!X509_STORE_CTX_init(store_ctx, store, cert, extra_certs)) {
+				     ssl_err("could not X509_STORE_CTX_init");
+			     }
+			     X509_STORE_CTX_set_default(store_ctx,
+					     SSL_is_server(ssl) ? "ssl_client" : "ssl_server");
+			     X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(store_ctx),
+					     SSL_get0_param(ssl));
+			     X509_STORE_CTX_set0_dane(store_ctx, SSL_get0_dane(ssl));
+			     X509_NAME_print_ex_fp(stdout,
+					     X509_get_subject_name(cert), 0, 0);
+			     if (X509_verify_cert(store_ctx)) {
+				fprintf(stdout, " %s-validated successfully\n",
+						  usable_tlsas 
+						? "dane" : "PKIX");
+			     } else {
+				fprintf(stdout, " did not dane-validate, because: %s\n",
+						X509_verify_cert_error_string(
+							X509_STORE_CTX_get_error(store_ctx)));
+				success = false;
+			     }
+			     if (store_ctx) {
+				     X509_STORE_CTX_free(store_ctx);
+			     }
+			     break;
+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000 */
+#endif /* ifdef USE_DANE_VERIFY */
+		default:     break; /* suppress warning */
+		}
+		SSL_free(ssl);
+
+	} else {/* No certificate file given, creation/validation via TLS. */
+
+		/* We need addresses to connect to */
+		if (ldns_rr_list_rr_count(addresses) == 0) {
+			s = dane_setup_resolver(&res, nameserver_rdf,
+			                        keys, assume_dnssec_validity);
+			LDNS_ERR(s, "could not dane_setup_resolver");
+			ldns_rr_list_free(addresses);
+			addresses =dane_lookup_addresses(res, name, ai_family);
+			ldns_resolver_free(res);
+		}
+		if (ldns_rr_list_rr_count(addresses) == 0) {
+			fprintf(stderr, "No addresses for %s\n", name_str);
+			exit(EXIT_FAILURE);
+		}
+
+		/* for all addresses, setup SSL and retrieve certificates */
+		for (i = 0; i < ldns_rr_list_rr_count(addresses); i++) {
+
+			ssl = SSL_new(ctx);
+			if (! ssl) {
+				ssl_err("could not SSL_new");
+			}
+			address = ldns_rr_a_address(
+					ldns_rr_list_rr(addresses, i));
+			assert(address != NULL);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000  && ! defined(HAVE_LIBRESSL)
+			if (mode == VERIFY) {
+				usable_tlsas = 0;
+				if (SSL_dane_enable(ssl, name_str) <= 0) {
+					ssl_err("could not SSL_dane_enable");
+				}
+				if (!verify_server_name) {
+					SSL_dane_set_flags(ssl, DANE_FLAG_NO_DANE_EE_NAMECHECKS);
+				}
+				for (j = 0; j < ldns_rr_list_rr_count(tlsas); j++) {
+					int ret;
+					ldns_rr *tlsa_rr = ldns_rr_list_rr(tlsas, j);
+
+					if (ldns_rr_get_type(tlsa_rr) != LDNS_RR_TYPE_TLSA) {
+						fprintf(stderr, "Skipping non TLSA RR: ");
+						ldns_rr_print(stderr, tlsa_rr);
+						fprintf(stderr, "\n");
+						continue;
+					}
+					if (ldns_rr_rd_count(tlsa_rr) != 4) {
+						fprintf(stderr, "Skipping TLSA with wrong rdata RR: ");
+						ldns_rr_print(stderr, tlsa_rr);
+						fprintf(stderr, "\n");
+						continue;
+					}
+					ret = SSL_dane_tlsa_add(ssl,
+							ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 0)) | (assume_pkix_validity ? 2 : 0),
+							ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 1)),
+							ldns_rdf2native_int8(ldns_rr_rdf(tlsa_rr, 2)),
+							ldns_rdf_data(ldns_rr_rdf(tlsa_rr, 3)),
+							ldns_rdf_size(ldns_rr_rdf(tlsa_rr, 3)));
+					if (ret < 0) {
+						ssl_err("could not SSL_dane_tlsa_add");
+					}
+					if (ret == 0) {
+						fprintf(stderr, "Skipping unusable TLSA RR: ");
+						ldns_rr_print(stderr, tlsa_rr);
+						fprintf(stderr, "\n");
+						continue;
+					}
+					usable_tlsas += 1;
+				}
+				if (!usable_tlsas) {
+					fprintf(stderr, "No usable TLSA records were found.\n"
+							"PKIX validation without DANE will be performed.\n");
+
+					exit_success = no_tlsas_exit_status;
+					if (assume_pkix_validity)
+						SSL_set_verify(ssl, SSL_VERIFY_PEER, _ldns_tls_verify_always_ok);
+				}
+			}
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000 */
+			s = ssl_connect_and_get_cert_chain(&cert, &extra_certs,
+					ssl, name_str, address,port, transport);
+			if (s == LDNS_STATUS_NETWORK_ERR) {
+				fprintf(stderr, "Could not connect to ");
+				ldns_rdf_print(stderr, address);
+				fprintf(stderr, " %d\n", (int) port);
+
+				/* All addresses should succeed */
+				success = false;
+				continue;
+			}
+			LDNS_ERR(s, "could not get cert chain from ssl");
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && ! defined(HAVE_LIBRESSL)
+
+			if (mode == VERIFY) {
+				char *address_str = ldns_rdf2str(address);
+				long verify_result = SSL_get_verify_result(ssl);
+
+				fprintf(stdout, "%s", address_str ? address_str : "<address>");
+				free(address_str);
+
+				if (verify_result == X509_V_OK) {
+					fprintf(stdout, " %s-validated successfully\n",
+							  usable_tlsas 
+							? "dane" : "PKIX");
+				} else {
+					fprintf(stdout, " did not dane-validate, because: %s\n",
+							X509_verify_cert_error_string(verify_result));
+					success = false;
+				}
+			}
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000 */
+			switch (mode) {
+			case CREATE: dane_create(tlsas, tlsa_owner,
+						     certificate_usage, offset,
+						     selector, matching_type,
+						     cert, extra_certs, store,
+						     verify_server_name, name);
+				     break;
+
+#ifdef USE_DANE_VERIFY
+			case VERIFY:
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+				     if (! dane_verify(tlsas, address,
+						cert, extra_certs, store,
+						verify_server_name, name,
+						assume_pkix_validity)) {
+					success = false;
+
+				     }
+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000 */
+				     if (success && interact) {
+					     ssl_interact(ssl);
+				     }
+				     break;
+#endif /* USE_DANE_VERIFY */
+
+			default:     break; /* suppress warning */
+			}
+			(void)SSL_shutdown(ssl);
+			SSL_free(ssl);
+		} /* end for all addresses */
+	} /* end No certification file */
+
+	if (mode == CREATE) {
+		if (print_tlsa_as_type52) {
+			print_rr_list_as_TYPEXXX(stdout, tlsas);
+		} else {
+			ldns_rr_list_print(stdout, tlsas);
+		}
+	}
+	ldns_rr_list_deep_free(tlsas);
+
+	/* cleanup */
+	SSL_CTX_free(ctx);
+
+	if (nameserver_rdf) {
+		ldns_rdf_deep_free(nameserver_rdf);
+	}
+	if (store) {
+		X509_STORE_free(store);
+	}
+	if (tlsa_owner_str) {
+		LDNS_FREE(tlsa_owner_str);
+	}
+	if (tlsa_owner) {
+		ldns_rdf_free(tlsa_owner);
+	}
+	if (addresses) {
+		ldns_rr_list_deep_free(addresses);
+	}
+	if (success) {
+		exit(exit_success);
+	} else {
+		exit(EXIT_FAILURE);
+	}
+}
+#else  /* HAVE_SSL */
+
+int
+main(int argc, char **argv)
+{
+	fprintf(stderr, "ldns-dane needs OpenSSL support, "
+			"which has not been compiled in\n");
+	return 1;
+}
+#endif /* HAVE_SSL */
+
+#else  /* USE_DANE */
+
+int
+main(int argc, char **argv)
+{
+	(void)argc;
+	(void)argv;
+
+	fprintf(stderr, "dane support was disabled with this build of ldns, "
+			"and has not been compiled in\n");
+	return 1;
+}
+
+#endif /* USE_DANE */
diff --git a/contrib/ldns/examples/ldns-dpa.1 b/contrib/ldns/examples/ldns-dpa.1
new file mode 100644
index 00000000000000..6ff9eb323d4e23
--- /dev/null
+++ b/contrib/ldns/examples/ldns-dpa.1
@@ -0,0 +1,151 @@
+.TH dpa 1 "1 Nov 2005"
+.SH NAME
+dpa \- DNS Packet Analyzer. Analyze DNS packets in ip trace files
+.SH SYNOPSIS
+.B dpa
+[
+.IR OPTION
+]
+.IR TRACEFILE 
+
+.SH DESCRIPTION
+\fBdpa\fR is used to analyze dns packets in trace files. It has 3 main options: count, filter, and count uniques (i.e. count all different occurrences).
+
+.SH OPTIONS
+.TP
+\fB-c\fR \fIexpressionlist\fR
+Count occurrences of matching expressions
+
+.TP
+\fB-f\fR \fIexpression\fR
+Filter: only process packets that match the expression
+
+.TP
+\fB-h\fR 
+Show usage
+
+.TP
+\fB-p\fR
+Show the total number of correct DNS packets, and percentage of \-u and
+\-c values  (of the total of matching on the \-f filter. if no filter is
+given, percentages are on all correct dns packets)
+
+.TP
+\fB-of\fR \fIfile\fR
+Write all packets that match the \-f flag to file, as pcap data.
+
+.TP
+\fB-ofh\fR \fIfile\fR
+Write all packets that match the \-f flag to file, in hexadecimal format,
+readable by drill.
+
+.TP
+\fB-s\fR
+Show possible match names
+
+.TP
+\fB-s\fR \fImatchname\fR
+show possible match operators and values for name
+
+.TP
+\fB-sf\fR
+Only evaluate packets (in representation format) that match the \-f filter.
+If no \-f was given, evaluate all correct dns packets.
+
+.TP
+\fB-u\fR \fImatchnamelist\fR
+Count every occurrence of every value of the matchname (for instance, count all packetsizes, see EXAMPLES in ldns-dpa(1) ).
+
+.TP
+\fB-ua\fR
+For every matchname in \-u, show the average value of all matches. Behaviour for match types that do not have an integer value is undefined.
+
+.TP
+\fB-uac\fR
+For every matchname in \-u, show the average number of times this value was encountered.
+
+.TP
+\fB-um\fR \fInumber\fR
+Only show the results from \-u for values that occurred more than <number> times.
+
+.TP
+\fB-v\fR \fIlevel\fR
+Set verbosity to level (1-5, 5 being the highest). Mostly used for debugging.
+
+.TP
+\fB-notip\fR \fIfile\fR
+Write packets that were not recognized as IP packets to file (as pcap data).
+
+.TP
+\fB-baddns\fR \fIfile\fR
+Write dns packets that were too mangled to parse to file (as pcap data).
+
+.TP
+\fB-version\fR
+Show version and exit
+
+.SH LIST AND MATCHES
+
+A <matchnamelist> is a comma separated list of match names (use \-s to see possible match names).
+A <expressionlist> is a comma separated list of expressions.
+
+An expression has the following form:
+<expr>: (<expr>)
+        <expr> | <expr>
+        <expr> & <expr>
+        <match>
+
+<match>:        <matchname> <operator> <value>
+
+<operator>:
+	=	equal to <value>
+	!=	not equal to <value>
+	>	greater than <value>
+	<	lesser than <value>
+	>=	greater than or equal to <value>
+	<=	lesser than or equal to <value>
+	~=	contains <value>
+
+See the \-s option for possible matchnames, operators and values.
+
+.SH EXAMPLES
+
+.TP
+ldns-dpa \-u packetsize \-p test.tr
+Count all different packetsizes in test.tr and show the percentages.
+
+.TP
+ldns-dpa \-f "edns=1&qr=0" \-of edns.tr test.tr
+Filter out all edns enable queries in test.tr and put them in edns.tr
+
+.TP
+ldns-dpa \-f edns=1 \-c tc=1 \-u rcode test.tr
+For all edns packets, count the number of truncated packets and all their rcodes in test.tr.
+
+.TP
+ldns-dpa \-c tc=1,qr=0,qr=1,opcode=QUERY test.tr
+For all packets, count the number of truncated packets, the number of packets with qr=0, the number of packets with qr=1 and the number of queries in test.tr.
+
+.TP
+ldns-dpa \-u packetsize \-ua test.tr
+Show all packet sizes and the average packet size per packet.
+
+.TP
+ldns-dpa \-u srcaddress \-uac test.tr
+Show all packet source addresses and the average number of packets sent from this address.
+
+.TP
+sudo tcpdump \-i eth0 \-s 0 \-U \-w \- port 53 | ldns-dpa \-f qr=0 \-sf
+Print all query packets seen on the specified interface.
+
+
+.SH AUTHOR
+Written by Jelte Jansen for NLnetLabs.
+
+.SH REPORTING BUGS
+Report bugs to <jelte@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-dpa.c b/contrib/ldns/examples/ldns-dpa.c
new file mode 100644
index 00000000000000..46d8f9ad7baa73
--- /dev/null
+++ b/contrib/ldns/examples/ldns-dpa.c
@@ -0,0 +1,2857 @@
+/*
+ * ldns-dpa inspects the (udp) DNS packets found in a pcap file
+ * and provides statistics about them
+ * 
+ * (C) NLnet Labs 2006 - 2008
+ *
+ * See the file LICENSE for the license
+ */
+#include "config.h"
+
+#include <ldns/ldns.h>
+
+#ifdef HAVE_PCAP_H
+#ifdef HAVE_LIBPCAP
+#include "ldns-dpa.h"
+
+#ifdef HAVE_NETINET_IP6_H
+#include <netinet/ip6.h>
+#endif
+#include <errno.h>
+
+#ifndef IP_OFFMASK
+#define IP_OFFMASK 0x1fff
+#endif
+
+int verbosity = 1;
+
+#define ETHER_HEADER_LENGTH 14
+#define UDP_HEADER_LENGTH 8
+#define IP6_HEADER_LENGTH 40
+
+/* some systems don't have this? */
+#ifndef ETHERTYPE_IPV6
+#define ETHERTYPE_IPV6 0x86dd
+#endif
+
+#define MAX_MATCHES 20
+#define MAX_OPERATORS 7
+
+
+/* global options */
+bool show_filter_matches = false;
+size_t total_nr_of_dns_packets = 0;
+size_t total_nr_of_filtered_packets = 0;
+size_t not_ip_packets = 0;
+size_t bad_dns_packets = 0;
+size_t arp_packets = 0;
+size_t udp_packets = 0;
+size_t tcp_packets = 0;
+size_t fragmented_packets = 0;
+size_t lost_packet_fragments = 0;
+FILE *hexdumpfile = NULL;
+pcap_dumper_t *dumper = NULL;
+pcap_dumper_t *not_ip_dump = NULL;
+pcap_dumper_t *bad_dns_dump = NULL;
+
+
+struct
+fragment_part {
+	uint16_t ip_id;
+	uint8_t data[65536];
+	size_t cur_len;
+};
+
+struct fragment_part *fragment_p;
+
+/* To add a match,
+ * - add it to the enum
+ * - add it to the table_matches const
+ * - add a handler to value_matches
+ * - tell in get_string_value() where in the packet the data lies
+ * - add to parser?
+ * - add to show_match_ function
+ */
+enum enum_match_ids {
+	MATCH_ID,
+	MATCH_OPCODE,
+	MATCH_RCODE,
+	MATCH_PACKETSIZE,
+	MATCH_QR,
+	MATCH_TC,
+	MATCH_AD,
+	MATCH_CD,
+	MATCH_RD,
+	MATCH_EDNS,
+	MATCH_EDNS_PACKETSIZE,
+	MATCH_DO,
+	MATCH_QUESTION_SIZE,
+	MATCH_ANSWER_SIZE,
+	MATCH_AUTHORITY_SIZE,
+	MATCH_ADDITIONAL_SIZE,
+	MATCH_SRC_ADDRESS,
+	MATCH_DST_ADDRESS,
+	MATCH_TIMESTAMP,
+	MATCH_QUERY,
+	MATCH_QTYPE,
+	MATCH_QNAME,
+	MATCH_ANSWER,
+	MATCH_AUTHORITY,
+	MATCH_ADDITIONAL,
+	MATCH_LAST
+};
+typedef enum enum_match_ids match_id;
+
+enum enum_counter_types {
+	TYPE_INT,
+	TYPE_BOOL,
+	TYPE_OPCODE,
+	TYPE_RCODE,
+	TYPE_STRING,
+	TYPE_TIMESTAMP,
+	TYPE_ADDRESS,
+	TYPE_RR,
+	TYPE_RR_TYPE,
+	TYPE_LAST
+};
+typedef enum enum_counter_types counter_type;
+
+const ldns_lookup_table lt_types[] = {
+	{TYPE_INT, "int" },
+	{TYPE_BOOL, "bool" },
+	{TYPE_OPCODE, "opcode" },
+	{TYPE_RCODE, "rcode" },
+	{TYPE_STRING, "string" },
+	{TYPE_TIMESTAMP, "timestamp" }, 
+	{TYPE_ADDRESS, "address" }, 
+	{TYPE_RR, "rr" },
+	{ 0, NULL }
+};
+
+enum enum_type_operators {
+	OP_EQUAL,
+	OP_NOTEQUAL,
+	OP_GREATER,
+	OP_LESSER,
+	OP_GREATEREQUAL,
+	OP_LESSEREQUAL,
+	OP_CONTAINS,
+	OP_LAST
+};
+typedef enum enum_type_operators type_operator;
+
+const ldns_lookup_table lt_operators[] = {
+	{ OP_EQUAL, "=" },
+	{ OP_NOTEQUAL, "!=" },
+	{ OP_GREATER, ">" },
+	{ OP_LESSER, "<" },
+	{ OP_GREATEREQUAL, ">=" },
+	{ OP_LESSEREQUAL, "<=" },
+	{ OP_CONTAINS, "~=" },
+	{ 0, NULL }
+};
+
+static const char *get_op_str(type_operator op) {
+	const ldns_lookup_table *lt;
+	lt = ldns_lookup_by_id((ldns_lookup_table *) lt_operators, op);
+	if (lt) {
+		return lt->name;
+	} else {
+		fprintf(stderr, "Unknown operator id: %u\n", op);
+		exit(1);
+	}
+}
+
+static type_operator
+get_op_id(char *op_str)
+{
+	const ldns_lookup_table *lt;
+	lt = ldns_lookup_by_name((ldns_lookup_table *) lt_operators, op_str);
+	if (lt) {
+		return (type_operator) lt->id;
+	} else {
+		fprintf(stderr, "Unknown operator: %s\n", op_str);
+		exit(1);
+	}
+}
+
+struct struct_type_operators {
+	counter_type type;
+	size_t operator_count;
+	type_operator operators[10];
+};
+typedef struct struct_type_operators type_operators;
+
+const type_operators const_type_operators[] = {
+	{ TYPE_INT, 6, { OP_EQUAL, OP_NOTEQUAL, OP_GREATER, OP_LESSER, OP_GREATEREQUAL, OP_LESSEREQUAL, 0, 0, 0, 0 } },
+	{ TYPE_BOOL, 2, { OP_EQUAL, OP_NOTEQUAL, 0, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_OPCODE, 2, { OP_EQUAL, OP_NOTEQUAL, 0, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_RCODE, 2, { OP_EQUAL, OP_NOTEQUAL, 0, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_STRING, 3, { OP_EQUAL, OP_NOTEQUAL, OP_CONTAINS, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_TIMESTAMP, 6, { OP_EQUAL, OP_NOTEQUAL, OP_GREATER, OP_LESSER, OP_GREATEREQUAL, OP_LESSEREQUAL, 0, 0, 0, 0 } },
+	{ TYPE_ADDRESS, 3, { OP_EQUAL, OP_NOTEQUAL, OP_CONTAINS, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_RR, 3, { OP_EQUAL, OP_NOTEQUAL, OP_CONTAINS, 0, 0, 0, 0, 0, 0, 0} },
+	{ TYPE_RR_TYPE, 6, { OP_EQUAL, OP_NOTEQUAL, OP_GREATER, OP_LESSER, OP_GREATEREQUAL, OP_LESSEREQUAL, 0, 0, 0, 0 } },
+	{ 0, 0, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 } }
+};
+
+const type_operators *
+get_type_operators(counter_type type) {
+	const type_operators *to = const_type_operators;
+	while (to) {
+		if (to->type == type) {
+			return to;
+		}
+		to++;
+	}
+	return NULL;
+}
+
+struct struct_match_table {
+	match_id id;
+	const char *name;
+	const char *description;
+	const counter_type type;
+};
+typedef struct struct_match_table match_table;
+
+/* order of entries has been changed after gprof analysis, and reasoning
+ * about the uses of -u arguments
+ */
+const match_table matches[] = {
+	{ MATCH_QUERY, "query", "String representation of the query RR", TYPE_RR },
+	{ MATCH_QTYPE, "qtype", "RR Type of the question RR, if present", TYPE_RR_TYPE },
+	{ MATCH_QNAME, "qname", "Owner name of the question RR, if present", TYPE_STRING },
+	{ MATCH_SRC_ADDRESS, "srcaddress", "address the packet was sent from", TYPE_ADDRESS },
+	{ MATCH_TIMESTAMP, "timestamp", "time the packet was sent", TYPE_TIMESTAMP },
+	{ MATCH_DST_ADDRESS, "dstaddress", "address the packet was sent to", TYPE_ADDRESS },
+	{ MATCH_EDNS_PACKETSIZE, "edns-packetsize", "packets size specified in edns rr", TYPE_INT },
+	{ MATCH_ID, "id", "id of the packet", TYPE_INT },
+	{ MATCH_OPCODE, "opcode", "opcode of packet (rfc1035)", TYPE_OPCODE },
+	{ MATCH_RCODE, "rcode", "response code of packet", TYPE_RCODE },
+	{ MATCH_PACKETSIZE, "packetsize", "size of packet in bytes", TYPE_INT },
+	{ MATCH_QR, "qr", "value of qr bit", TYPE_BOOL },
+	{ MATCH_TC, "tc", "value of tc bit", TYPE_BOOL },
+	{ MATCH_AD, "ad", "value of ad bit", TYPE_BOOL },
+	{ MATCH_CD, "cd", "value of cd bit", TYPE_BOOL },
+	{ MATCH_RD, "rd", "value of rd bit", TYPE_BOOL },
+	{ MATCH_EDNS, "edns", "existence of edns rr", TYPE_BOOL },
+	{ MATCH_DO, "do", "value of do bit", TYPE_BOOL },
+	{ MATCH_QUESTION_SIZE, "questionsize", "number of rrs in the question section", TYPE_INT },
+	{ MATCH_ANSWER_SIZE, "answersize", "number of rrs in the answer section", TYPE_INT },
+	{ MATCH_AUTHORITY_SIZE, "authoritysize", "number of rrs in the authority section", TYPE_INT },
+	{ MATCH_ADDITIONAL_SIZE, "additionalsize", "number of rrs in the additional section", TYPE_INT },
+	{ MATCH_ANSWER, "answer", "String representation of the answer RRs", TYPE_RR },
+	{ MATCH_AUTHORITY, "authority", "String representation of the authority RRs", TYPE_RR },
+	{ MATCH_ADDITIONAL, "additional", "String representation of the additional RRs", TYPE_RR },
+	{ 0, NULL , NULL, TYPE_INT}
+};
+
+enum enum_match_expression_operators {
+	MATCH_EXPR_OR,
+	MATCH_EXPR_AND,
+	MATCH_EXPR_LEAF
+};
+typedef enum enum_match_expression_operators match_expression_operator;
+
+struct struct_match_operation {
+	match_id id;
+	type_operator operator;
+	char *value;
+};
+typedef struct struct_match_operation match_operation;
+
+typedef struct struct_match_expression match_expression;
+struct struct_match_expression {
+	/* and or or, or leaf (in which case there are no subtrees, but only a match_table */
+	match_expression_operator op;
+	match_expression *left;
+	match_expression *right;
+	match_operation *match;
+	size_t count;
+};
+
+typedef struct struct_match_counters match_counters;
+struct struct_match_counters {
+/*
+	match_expression **counter;
+	size_t size;
+*/
+	match_expression *match;
+	match_counters *left;
+	match_counters *right;
+};
+
+match_table *
+get_match_by_name(char *name) {
+	match_table *mt = (match_table *) matches;
+	if (name) {
+		while (mt->name != NULL) {
+			if (strcasecmp(name, mt->name) == 0) {
+				return mt;
+			}
+			mt++;
+		}
+	}
+	return NULL;
+}
+
+static match_table *
+get_match_by_id(match_id id) {
+	match_table *mt = (match_table *) matches;
+
+	while (mt->name != NULL) {
+		if (mt->id == id) {
+			return mt;
+		}
+		mt++;
+	}
+	return NULL;
+}
+
+static const char *
+get_match_name_str(match_id id) {
+	match_table *mt = get_match_by_id(id);
+	if (mt) {
+		return mt->name;
+	} else {
+		fprintf(stderr, "Unknown match id: %u\n", id);
+		exit(1);
+		return "Unknown match id";
+	}
+}
+
+static void
+print_match_operation(FILE *output, match_operation *mc)
+{
+	match_table *mt = NULL;
+	ldns_lookup_table *lt;
+	struct timeval time;
+	time_t time_tt;
+	int value;
+	size_t pos;
+	char *tmp, *tmp2;
+
+	if (mc) {
+		mt = get_match_by_id(mc->id);
+
+		if (mt) {
+			fprintf(output, "%s %s ",mt->name, get_op_str(mc->operator));
+			
+			switch (mt->type) {
+				case TYPE_INT:
+				case TYPE_STRING:
+				case TYPE_ADDRESS:
+				case TYPE_RR:
+					fprintf(output, "'%s'", mc->value);
+					break;
+				case TYPE_BOOL:
+					if (strncmp(mc->value, "1", 2) == 0) {
+						fprintf(output,"'true'");
+					} else {
+						fprintf(output,"'false'");
+					}
+					break;
+				case TYPE_OPCODE:
+					value = atoi(mc->value);
+					lt = ldns_lookup_by_id(ldns_opcodes, value);
+					if (lt) {
+						fprintf(output, "%s", lt->name);
+					} else {
+						fprintf(output, "%s", mc->value);
+					}
+					break;
+				case TYPE_RCODE:
+					value = atoi(mc->value);
+					lt = ldns_lookup_by_id(ldns_rcodes, value);
+					if (lt) {
+						fprintf(output, "%s", lt->name);
+					} else {
+						fprintf(output, "%s", mc->value);
+					}
+					break;
+				case TYPE_TIMESTAMP:
+#ifndef S_SPLINT_S
+					time.tv_sec = (long int) atol(mc->value);
+#endif
+					time_tt = (time_t)time.tv_sec;
+					tmp = ctime(&time_tt);
+					tmp2 = malloc(strlen(tmp) + 1);
+					for (pos = 0; pos < strlen(tmp); pos++) {
+						if (tmp[pos] == '\n') {
+							tmp2[pos] = '\0';
+						} else {
+							tmp2[pos] = tmp[pos];
+						}
+					}
+					tmp2[pos] = '\0';
+					fprintf(output, "%s", tmp2);
+					free(tmp2);
+					break;
+				default:
+				fprintf(output, "'%s'", mc->value);
+			}
+
+		} else {
+			fprintf(output, "%u %s '%s'", mc->id, get_op_str(mc->operator), mc->value);
+		}
+	} else {
+		fprintf(output, "(nil)");
+	}
+}
+
+static void
+print_match_expression(FILE *output, match_expression *expr)
+{
+	if (expr) {
+		switch (expr->op) {
+			case MATCH_EXPR_OR:
+				fprintf(output, "(");
+				print_match_expression(output, expr->left);
+				fprintf(output, " | ");
+				print_match_expression(output, expr->right);
+				fprintf(output, ")");
+				break;
+			case MATCH_EXPR_AND:
+				fprintf(output, "(");
+				print_match_expression(output, expr->left);
+				fprintf(output, " & ");
+				print_match_expression(output, expr->right);
+				fprintf(output, ")");
+				break;
+			case MATCH_EXPR_LEAF:
+				print_match_operation(output, expr->match);
+				break;
+			default:
+/*
+				fprintf(output, "ERROR PRINTING MATCH: unknown op: %u\n", expr->op);
+				exit(1);
+*/
+				fprintf(output, "(");
+if (expr->left) {
+	print_match_expression(output, expr->left);
+}
+				fprintf(output, " ? ");
+if (expr->right) {
+	print_match_expression(output, expr->right);
+}
+				fprintf(output, ") _");
+if (expr->match) {
+	print_match_operation(output, expr->match);				
+}
+fprintf(output, "_");
+		}
+	} else {
+		printf("(nil)");
+	}			
+}
+
+static void
+print_counters(FILE *output, match_counters *counters, bool show_percentages, size_t total, int count_minimum)
+{
+	double percentage;
+
+	if (!counters || !output) {
+		return;
+	}
+
+	if (counters->left) {
+		print_counters(output, counters->left, show_percentages, total, count_minimum);
+	}
+	if (counters->match) {
+		if (count_minimum < (int) counters->match->count) {
+			print_match_expression(output, counters->match);
+			printf(": %u", (unsigned int) counters->match->count);
+			if (show_percentages) {
+				percentage = (double) counters->match->count / (double) total * 100.0;
+				printf(" (%.2f%%)", percentage);
+			}
+			printf("\n");
+		}
+	}
+	if (counters->right) {
+		print_counters(output, counters->right, show_percentages, total, count_minimum);
+	}
+	
+	return;	
+}
+
+static void
+ldns_pkt2file_hex(FILE *fp, const ldns_pkt *pkt)
+{
+	uint8_t *wire;
+	size_t size, i;
+	ldns_status status;
+	
+	status = ldns_pkt2wire(&wire, pkt, &size);
+	
+	if (status != LDNS_STATUS_OK) {
+		fprintf(stderr, "Unable to convert packet: error code %u", status);
+		return;
+	}
+	
+	fprintf(fp, "; 0");
+	for (i = 1; i < 20; i++) {
+		fprintf(fp, " %2u", (unsigned int) i);
+	}
+	fprintf(fp, "\n");
+	fprintf(fp, ";--");
+	for (i = 1; i < 20; i++) {
+		fprintf(fp, " --");
+	}
+	fprintf(fp, "\n");
+	for (i = 0; i < size; i++) {
+		if (i % 20 == 0 && i > 0) {
+			fprintf(fp, "\t; %4u-%4u\n", (unsigned int) i-19, (unsigned int) i);
+		}
+		fprintf(fp, " %02x", (unsigned int)wire[i]);
+	}
+	fprintf(fp, "\n\n");
+}
+
+/*
+ * Calculate the total for all match operations with the same id as this one
+ * (if they are 'under' this one in the tree, which should be the case in
+ * the unique counter tree
+ */
+static size_t
+calculate_total_value(match_counters *counters, match_operation *cur)
+{
+	size_t result = 0;
+	
+	if (!counters) {
+		return 0;
+	}
+	
+	if (counters->match->match->id == cur->id) {
+		result = (size_t) atol(counters->match->match->value) * counters->match->count;
+	}
+	
+	if (counters->left) {
+		result += calculate_total_value(counters->left, cur);
+	}
+	if (counters->right) {
+		result += calculate_total_value(counters->right, cur);
+	}
+	
+	return result;
+}
+
+static size_t
+calculate_total_count_matches(match_counters *counters, match_operation *cur)
+{
+	size_t result = 0;
+	
+	if (!counters) {
+		return 0;
+	}
+	
+	if (counters->match->match->id == cur->id) {
+		result = 1;
+	}
+	
+	if (counters->left) {
+		/* In some cases, you don't want the number of actual
+		   counted matches, for instance when calculating the
+		   average number of queries per second. In this case
+		   you want the number of seconds */
+		if (cur->id == MATCH_TIMESTAMP) {
+			result += (size_t) abs((int) (atol(counters->match->match->value) - atol(counters->left->match->match->value))) - 1;
+		}
+		result += calculate_total_count_matches(counters->left, cur);
+	}
+	if (counters->right) {
+		if (cur->id == MATCH_TIMESTAMP) {
+			result += (size_t) abs((int) (atol(counters->right->match->match->value) - atol(counters->match->match->value))) - 1;
+		}
+		result += calculate_total_count_matches(counters->right, cur);
+	}
+	
+	return result;
+}
+
+/**
+ * Returns true if there is a previous match operation with the given type
+ * in the counters structure
+ */
+static bool
+has_previous_match(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return false;
+	}
+	
+	if (counters->left) {
+		if (counters->left->match->match->id == cur->id) {
+			return true;
+		} else if (has_previous_match(counters->left, cur)) {
+			return true;
+		} else if (counters->left->right) {
+			if (counters->left->right->match->match->id == cur->id) {
+				return true;
+			} else if (has_previous_match(counters->left->right, cur)) {
+				return true;
+			}
+		}
+	}
+	return false;
+}
+
+/**
+ * Returns true if there is a later match operation with the given type
+ * in the counters structure
+ */
+static bool
+has_next_match(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return false;
+	}
+	
+	if (counters->right) {
+		if (counters->right->match->match->id == cur->id) {
+			return true;
+		} else if (has_next_match(counters->right, cur)) {
+			return true;
+		} else if (counters->right->left) {
+			if (counters->right->left->match->match->id == cur->id) {
+				return true;
+			} else if (has_next_match(counters->right->left, cur)) {
+				return true;
+			}
+		}
+	}
+	return false;
+}
+
+/**
+ * Returns the first match with the same type at *cur in
+ * the counter list, or NULL if it is not found
+ */
+static match_expression *
+get_first_match_expression(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return NULL;
+	}
+	
+	if (has_previous_match(counters, cur)) {
+		return get_first_match_expression(counters->left, cur);
+	} else if (counters->match->match->id == cur->id) {
+		return counters->match;
+	} else if (counters->right) {
+		return get_first_match_expression(counters->right, cur);
+	} else {
+		return NULL;
+	}
+}
+
+/**
+ * Returns the second match expression with the same type at *cur in
+ * the counter list, or NULL if it is not found
+ */
+static match_expression *
+get_second_match_expression(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return NULL;
+	}
+	
+	if (has_previous_match(counters, cur)) {
+		if (has_previous_match(counters->left, cur)) {
+			return get_second_match_expression(counters->left, cur);
+		} else {
+			return counters->left->match;
+		}
+/*
+	} else if (counters->match->match->id == cur->id) {
+		return counters->match->match->value;
+*/	} else if (counters->right) {
+		return get_first_match_expression(counters->right, cur);
+	} else {
+		return NULL;
+	}
+}
+
+/**
+ * Returns the last match expression with the same type at *cur in
+ * the counter list, or NULL if it is not found
+ */
+static match_expression *
+get_last_match_expression(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return NULL;
+	}
+	
+	if (has_next_match(counters, cur)) {
+		return get_last_match_expression(counters->right, cur);
+	} else if (counters->match->match->id == cur->id) {
+		return counters->match;
+	} else if (counters->left) {
+		return get_last_match_expression(counters->left, cur);
+	} else {
+		return NULL;
+	}
+}
+
+/**
+ * Returns the last but one match expression with the same type at *cur in
+ * the counter list, or NULL if it is not found
+ */
+static match_expression *
+get_last_but_one_match_expression(match_counters *counters, match_operation *cur)
+{
+	if (!counters) {
+		return NULL;
+	}
+	
+	if (has_next_match(counters, cur)) {
+		if (has_next_match(counters->right, cur)) {
+			return get_last_but_one_match_expression(counters->right, cur);
+		} else {
+			return counters->match;
+		}
+/*
+	} else if (counters->match->match->id == cur->id) {
+		return counters->match->match->value;
+*/	} else if (counters->left) {
+		return get_last_match_expression(counters->right, cur);
+	} else {
+		return NULL;
+	}
+}
+
+static size_t
+get_first_count(match_counters *counters, match_operation *cur)
+{
+	match_expression *o = get_first_match_expression(counters, cur);
+	if (o) {
+		return o->count;
+	} else {
+		return 0;
+	}
+}
+
+static size_t
+get_last_count(match_counters *counters, match_operation *cur)
+{
+	match_expression *o = get_last_match_expression(counters, cur);
+	if (o) {
+		return o->count;
+	} else {
+		return 0;
+	}
+}
+
+
+static size_t
+calculate_total_count(match_counters *counters, match_operation *cur)
+{
+	size_t result = 0;
+	
+	if (!counters) {
+		return 0;
+	}
+	
+	if (counters->match->match->id == cur->id) {
+		result = counters->match->count;
+	}
+	
+	if (counters->left) {
+		result += calculate_total_count(counters->left, cur);
+	}
+	if (counters->right) {
+		result += calculate_total_count(counters->right, cur);
+	}
+	
+	return result;
+}
+
+static void
+print_counter_averages(FILE *output, match_counters *counters, match_operation *cur)
+{
+	size_t total_value;
+	size_t total_count;
+	match_table *mt;
+	
+	if (!counters || !output) {
+		return;
+	}
+	
+	if (!cur) {
+		cur = counters->match->match;
+		mt = get_match_by_id(cur->id);
+		total_value = calculate_total_value(counters, cur);
+		total_count = calculate_total_count(counters, cur);
+		printf("Average for %s: (%u / %u) %.02f\n", mt->name, (unsigned int) total_value, (unsigned int) total_count, (float) total_value / (float) total_count);
+		if (counters->left) {
+			print_counter_averages(output, counters->left, cur);
+		}
+		if (counters->right) {
+			print_counter_averages(output, counters->right, cur);
+		}
+	} else {
+		if (counters->left) {
+			if (counters->left->match->match->id != cur->id) {
+				print_counter_averages(output, counters->left, NULL);
+			}
+		}
+		if (counters->right) {
+			if (counters->right->match->match->id != cur->id) {
+				print_counter_averages(output, counters->right, NULL);
+			}
+		}
+	}
+	
+	return;	
+}
+
+static void
+print_counter_average_count(FILE *output, match_counters *counters, match_operation *cur, bool remove_first_last)
+{
+	size_t total_matches;
+	size_t total_count;
+	match_table *mt;
+	
+	if (!counters || !output) {
+		return;
+	}
+	
+	if (!cur) {
+		cur = counters->match->match;
+		mt = get_match_by_id(cur->id);
+		total_matches = calculate_total_count_matches(counters, cur);
+		total_count = calculate_total_count(counters, cur);
+		/* Remove the first and last for instance for timestamp average counts (half seconds drag down the average) */
+		if (remove_first_last) {
+			total_count -= get_first_count(counters, cur);
+			total_count -= get_last_count(counters, cur);	
+			printf("Removing first count from average: %u\n", (unsigned int) get_first_count(counters,cur));
+			printf("Removing last count from average: %u\n", (unsigned int) get_last_count(counters,cur));
+			/* in the case where we count the differences between match values too
+			 * (like with timestamps) we need to subtract from the match count too
+			 */
+			if (cur->id == MATCH_TIMESTAMP) {
+				if (get_first_match_expression(counters, cur) && get_second_match_expression(counters, cur)) {
+					total_matches -= atol(get_second_match_expression(counters, cur)->match->value) - atol(get_first_match_expression(counters, cur)->match->value);
+				}
+				if (get_last_match_expression(counters, cur) && get_last_but_one_match_expression(counters, cur)) {
+					total_matches -= atol(get_last_match_expression(counters, cur)->match->value) - atol(get_last_but_one_match_expression(counters, cur)->match->value);
+				}
+			} else {
+				total_matches -= 2;
+			}
+		}
+		printf("Average count for %s: (%u / %u) %.02f\n", mt->name, (unsigned int) total_count, (unsigned int) total_matches, (float) total_count / (float) total_matches);
+		if (counters->left) {
+			print_counter_averages(output, counters->left, cur);
+		}
+		if (counters->right) {
+			print_counter_averages(output, counters->right, cur);
+		}
+	} else {
+		if (counters->left) {
+			if (counters->left->match->match->id != cur->id) {
+				print_counter_averages(output, counters->left, NULL);
+			}
+		}
+		if (counters->right) {
+			if (counters->right->match->match->id != cur->id) {
+				print_counter_averages(output, counters->right, NULL);
+			}
+		}
+	}
+	
+	return;	
+}
+
+static bool
+match_int(type_operator operator,
+          char *value,
+	  char *mvalue)
+{
+	int a, b;
+
+	if (!value || !mvalue) {
+		return false;
+	}
+
+	a = atoi(value);
+	b = atoi(mvalue);
+
+	switch (operator) {
+		case OP_EQUAL:
+			return a == b;
+			break;
+		case OP_NOTEQUAL:
+			return a != b;
+			break;
+		case OP_GREATER:
+			return a > b;
+			break;
+		case OP_LESSER:
+			return a < b;
+			break;
+		case OP_GREATEREQUAL:
+			return a >= b;
+			break;
+		case OP_LESSEREQUAL:
+			return a <= b;
+			break;
+		default:
+			fprintf(stderr, "Unknown operator: %u\n", operator);
+			exit(2);
+	}
+}
+
+static bool
+match_opcode(type_operator operator,
+             char *value,
+             char *mvalue)
+{
+	ldns_pkt_opcode a, b;
+	int i;
+	ldns_lookup_table *lt;
+
+	/* try parse name first, then parse as int */
+	lt = ldns_lookup_by_name(ldns_opcodes, value);
+	if (lt) {
+		a = lt->id;
+	} else {
+		i = atoi(value);
+		if (i >= 0 && isdigit((unsigned char)value[0])) {
+			lt = ldns_lookup_by_id(ldns_opcodes, i);
+			if (lt) {
+				a = lt->id;
+			} else {
+				fprintf(stderr, "Unknown opcode: %s\n", value);
+				exit(1);
+				return false;
+			}
+		} else {
+			fprintf(stderr, "Unknown opcode: %s\n", value);
+			exit(1);
+			return false;
+		}
+	}
+
+	lt = ldns_lookup_by_name(ldns_opcodes, mvalue);
+	if (lt) {
+		b = lt->id;
+	} else {
+		i = atoi(mvalue);
+		if (i >= 0 && isdigit((unsigned char)mvalue[0])) {
+			lt = ldns_lookup_by_id(ldns_opcodes, i);
+			if (lt) {
+				b = lt->id;
+			} else {
+				fprintf(stderr, "Unknown opcode: %s\n", mvalue);
+				exit(1);
+				return false;
+			}
+		} else {
+			fprintf(stderr, "Unknown opcode: %s\n", mvalue);
+			exit(1);
+			return false;
+		}
+	}
+
+	switch(operator) {
+		case OP_EQUAL:
+			return a == b;
+			break;
+		case OP_NOTEQUAL:
+			return a != b;
+			break;
+		default:
+			fprintf(stderr, "Error bad operator for opcode: %s\n", get_op_str(operator));
+			return false;
+			break;
+	}
+}
+
+static bool
+match_str(type_operator operator,
+          char *value,
+          char *mvalue)
+{
+	char *valuedup, *mvaluedup;
+	size_t i;
+	bool result;
+	
+	if (operator == OP_CONTAINS) {
+		/* strcasestr is not C89 
+		return strcasestr(value, mvalue) != 0;
+		*/
+		valuedup = strdup(value);
+		mvaluedup = strdup(mvalue);
+		for (i = 0; i < strlen(valuedup); i++) {
+			valuedup[i] = tolower((unsigned char)valuedup[i]);
+		}
+		for (i = 0; i < strlen(mvaluedup); i++) {
+			mvaluedup[i] = tolower((unsigned char)mvaluedup[i]);
+		}
+		result = strstr(valuedup, mvaluedup) != 0;
+		free(valuedup);
+		free(mvaluedup);
+		return result;
+	} else if (operator == OP_EQUAL) {
+		return strcmp(value, mvalue) == 0;
+	} else {
+		return strcmp(value, mvalue) != 0;
+	}	
+}
+
+static bool
+match_rr_type(type_operator operator,
+              char *value,
+	      char *mvalue)
+{
+	ldns_rr_type a,b;
+	
+	a = ldns_get_rr_type_by_name(value);
+	b = ldns_get_rr_type_by_name(mvalue);
+	
+	switch (operator) {
+		case OP_EQUAL:
+			return a == b;
+			break;
+		case OP_NOTEQUAL:
+			return a != b;
+			break;
+		case OP_GREATER:
+			return a > b;
+			break;
+		case OP_LESSER:
+			return a < b;
+			break;
+		case OP_GREATEREQUAL:
+			return a >= b;
+			break;
+		case OP_LESSEREQUAL:
+			return a <= b;
+			break;
+		default:
+			fprintf(stderr, "Unknown operator: %u\n", operator);
+			exit(2);
+	}
+}
+
+static bool
+match_rcode(type_operator operator,
+             char *value,
+             char *mvalue)
+{
+	int a, b;
+	int i;
+	ldns_lookup_table *lt;
+
+	/* try parse name first, then parse as int */
+	lt = ldns_lookup_by_name(ldns_rcodes, value);
+	if (lt) {
+		a = lt->id;
+	} else {
+		i = atoi(value);
+		if (i >= 0 && isdigit((unsigned char)value[0])) {
+			lt = ldns_lookup_by_id(ldns_rcodes, i);
+			if (lt) {
+				a = lt->id;
+			} else {
+				fprintf(stderr, "Unknown rcode: %s\n", value);
+				exit(1);
+				return false;
+			}
+		} else {
+			fprintf(stderr, "Unknown rcode: %s\n", value);
+			exit(1);
+			return false;
+		}
+	}
+
+	lt = ldns_lookup_by_name(ldns_rcodes, mvalue);
+	if (lt) {
+		b = lt->id;
+	} else {
+		i = atoi(mvalue);
+		if (i >= 0 && isdigit((unsigned char)mvalue[0])) {
+			lt = ldns_lookup_by_id(ldns_rcodes, i);
+			if (lt) {
+				b = lt->id;
+			} else {
+				fprintf(stderr, "Unknown rcode: %s\n", mvalue);
+				exit(1);
+				return false;
+			}
+		} else {
+			fprintf(stderr, "Unknown rcode: %s\n", mvalue);
+			exit(1);
+			return false;
+		}
+	}
+
+	switch(operator) {
+		case OP_EQUAL:
+			return a == b;
+			break;
+		case OP_NOTEQUAL:
+			return a != b;
+			break;
+		default:
+			fprintf(stderr, "Error bad operator for rcode: %s\n", get_op_str(operator));
+			return false;
+			break;
+	}
+}
+
+static bool
+value_matches(match_id id,
+        type_operator operator,
+        char *value,
+        char *mvalue)
+{
+	int result;
+
+	if (verbosity >= 5) {
+		printf("Match %s: %s %s %s: ", get_match_name_str(id), value, get_op_str(operator), mvalue);
+	}
+	switch(id) {
+		case MATCH_OPCODE:
+			result = match_opcode(operator, value, mvalue);
+			break;
+		case MATCH_RCODE:
+			result = match_rcode(operator, value, mvalue);
+			break;
+		case MATCH_ID:
+		case MATCH_QR:
+		case MATCH_TC:
+		case MATCH_AD:
+		case MATCH_CD:
+		case MATCH_RD:
+		case MATCH_DO:
+		case MATCH_PACKETSIZE:
+		case MATCH_EDNS:
+		case MATCH_EDNS_PACKETSIZE:
+		case MATCH_QUESTION_SIZE:
+		case MATCH_ANSWER_SIZE:
+		case MATCH_AUTHORITY_SIZE:
+		case MATCH_ADDITIONAL_SIZE:
+		case MATCH_TIMESTAMP:
+			result = match_int(operator, value, mvalue);
+			break;
+		case MATCH_QUERY:
+		case MATCH_QNAME:
+		case MATCH_ANSWER:
+		case MATCH_AUTHORITY:
+		case MATCH_ADDITIONAL:
+			result = match_str(operator, value, mvalue);
+			break;
+		case MATCH_SRC_ADDRESS:
+		case MATCH_DST_ADDRESS:
+			result = match_str(operator, value, mvalue);
+			break;
+		case MATCH_QTYPE:
+			result = match_rr_type(operator, value, mvalue);
+			break;
+		default:
+			fprintf(stderr, "Error: value_matches() for operator %s not implemented yet.\n", get_op_str((type_operator) id));
+			exit(3);
+	}
+	if (verbosity >= 5) {
+		if (result) {
+			printf("true\n");
+		} else {
+			printf("false\n");
+		}
+	}
+	return result;
+}
+
+static char *
+get_string_value(match_id id, ldns_pkt *pkt, ldns_rdf *src_addr, ldns_rdf *dst_addr)
+{
+	char *val;
+	match_table *mt;
+	size_t valsize = 100;
+
+	val = malloc(valsize);
+	memset(val, 0, valsize);
+
+	switch(id) {
+		case MATCH_QR:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_qr(pkt));
+			break;
+		case MATCH_ID:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_id(pkt));
+			break;
+		case MATCH_OPCODE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_get_opcode(pkt));
+			break;
+		case MATCH_RCODE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_get_rcode(pkt));
+			break;
+		case MATCH_PACKETSIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_size(pkt));
+			break;
+		case MATCH_TC:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_tc(pkt));
+			break;
+		case MATCH_AD:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_ad(pkt));
+			break;
+		case MATCH_CD:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_cd(pkt));
+			break;
+		case MATCH_RD:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_rd(pkt));
+			break;
+		case MATCH_EDNS:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_edns(pkt));
+			break;
+		case MATCH_EDNS_PACKETSIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_edns_udp_size(pkt));
+			break;
+		case MATCH_DO:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_edns_do(pkt));
+			break;
+		case MATCH_QUESTION_SIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_qdcount(pkt));
+			break;
+		case MATCH_ANSWER_SIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_ancount(pkt));
+			break;
+		case MATCH_AUTHORITY_SIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_nscount(pkt));
+			break;
+		case MATCH_ADDITIONAL_SIZE:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_arcount(pkt));
+			break;
+		case MATCH_SRC_ADDRESS:
+			free(val);
+			val = ldns_rdf2str(src_addr);
+			break;
+		case MATCH_DST_ADDRESS:
+			free(val);
+			val = ldns_rdf2str(dst_addr);
+			break;
+		case MATCH_TIMESTAMP:
+			snprintf(val, valsize, "%u", (unsigned int) ldns_pkt_timestamp(pkt).tv_sec);
+			break;
+		case MATCH_QUERY:
+			if (ldns_pkt_qdcount(pkt) > 0) {
+				free(val);
+				val = ldns_rr2str(ldns_rr_list_rr(ldns_pkt_question(pkt), 0));
+				/* replace \n for nicer printing later */
+				if (strchr(val, '\n')) {
+					*(strchr(val, '\n')) = '\0';
+				}
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		case MATCH_QNAME:
+			if (ldns_pkt_qdcount(pkt) > 0) {
+				free(val);
+				val = ldns_rdf2str(ldns_rr_owner(ldns_rr_list_rr(ldns_pkt_question(pkt), 0)));
+				/* replace \n for nicer printing later */
+				if (strchr(val, '\n')) {
+					*(strchr(val, '\n')) = '\0';
+				}
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		case MATCH_QTYPE:
+			if (ldns_pkt_qdcount(pkt) > 0) {
+				free(val);
+				val = ldns_rr_type2str(ldns_rr_get_type(ldns_rr_list_rr(ldns_pkt_question(pkt), 0)));
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		case MATCH_ANSWER:
+			if (ldns_pkt_ancount(pkt) > 0) {
+				free(val);
+				val = ldns_rr_list2str(ldns_pkt_answer(pkt));
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		case MATCH_AUTHORITY:
+			if (ldns_pkt_nscount(pkt) > 0) {
+				free(val);
+				val = ldns_rr_list2str(ldns_pkt_authority(pkt));
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		case MATCH_ADDITIONAL:
+			if (ldns_pkt_arcount(pkt) > 0) {
+				free(val);
+				val = ldns_rr_list2str(ldns_pkt_additional(pkt));
+			} else {
+				val[0] = '\0';
+			}
+			break;
+		default:
+			mt = get_match_by_id(id);
+			if (!mt) {
+				printf("ERROR UNKNOWN MATCH_TABLE ID %u\n", id);
+				exit(1);
+			}
+			printf("Matcher for %s not implemented yet\n", mt->name);
+			exit(1);
+			return NULL;
+	}
+
+	return val;
+}
+
+static bool
+match_packet_to_operation(ldns_pkt *pkt, ldns_rdf *src_addr, ldns_rdf *dst_addr, match_operation *operation)
+{
+	bool result;
+	char *val;
+
+	if (!pkt || !operation) {
+		return false;
+	} else {
+		val = get_string_value(operation->id, pkt, src_addr, dst_addr);
+		if (!val) {
+			return false;
+		}
+		result = value_matches(operation->id, operation->operator, val, operation->value);
+		free(val);
+		return result;
+	}
+}
+
+static int
+match_operation_compare(const void *a, const void *b)
+{
+	match_operation *moa, *mob;
+	match_table *mt;
+	long ia, ib;
+
+	if (!a) {
+		return 1;
+	} else if (!b) {
+		return -1;
+	} else {
+		moa = (match_operation *) a;
+		mob = (match_operation *) b;
+
+		if (moa->id < mob->id) {
+			return -1;
+		} else if (moa->id > mob->id) {
+			return 1;
+		} else {
+			if (moa->operator < mob->operator) {
+				return -1;
+			} else if (moa->operator > mob->operator) {
+				return 1;
+			} else {
+				mt = get_match_by_id(moa->id);
+				if (mt) {
+					switch (mt->type) {
+						case TYPE_INT:
+						case TYPE_TIMESTAMP:
+						case TYPE_BOOL:
+						case TYPE_OPCODE:
+						case TYPE_RCODE:
+							ia = atol(moa->value);
+							ib = atol(mob->value);
+							return ia - ib;
+							break;
+						case TYPE_STRING:
+						case TYPE_ADDRESS:
+						case TYPE_RR:
+						default:
+							return strcmp(moa->value, mob->value);
+							break;
+					}
+				} else {
+					return strcmp(moa->value, mob->value);
+				}
+			}
+		}
+	}
+}
+
+static int
+match_expression_compare(const void *a, const void *b)
+{
+	match_expression *mea, *meb;
+	
+	if (!a) {
+		return 1;
+	} else if (!b) {
+		return -1;
+	} else {
+		mea = (match_expression *) a;
+		meb = (match_expression *) b;
+		
+		if (mea->op < meb->op) {
+			return -1;
+		} else if (mea->op > meb->op) {
+			return 1;
+		} else {
+			switch(mea->op) {
+				case MATCH_EXPR_AND:
+				case MATCH_EXPR_OR:
+					if (match_expression_compare(mea->left, meb->left) < 0) {
+						return -1;
+					} else if (match_expression_compare(mea->left, meb->left) > 0) {
+						return 1;
+					} else {
+						return match_expression_compare(mea->right, meb->right);
+					}
+					break;
+				case MATCH_EXPR_LEAF:
+					return match_operation_compare(mea->match, meb->match);
+					break;
+				default:
+					fprintf(stderr, "Unknown Match Expression logic operator: %u\n", mea->op);
+					exit(1);
+			}
+		}
+	}
+}
+
+/**
+ * If count is true, and the counter is found, its count is increased by 1
+ */
+static int
+add_match_counter(match_counters *counters,
+		  match_expression *expr,
+                  bool count)
+{
+	int cmp;
+	match_counters *new;
+
+	if (!counters || !expr) {
+		return -1;
+	} else {
+		if (counters->match) {
+			cmp = match_expression_compare(counters->match, 
+			                               expr);
+			if (cmp > 0) {
+				if (counters->left) {
+					return add_match_counter(counters->left,
+					                         expr,
+					                         count);
+				} else {
+					new = malloc(sizeof(match_counters));
+					new->left = NULL;
+					new->right = NULL;
+					new->match = expr;
+					counters->left = new;
+					return 0;
+				}
+			} else if (cmp < 0) {
+				if (counters->right) {
+					return add_match_counter(counters->right,
+					                         expr,
+					                         count);
+				} else {
+					new = malloc(sizeof(match_counters));
+					new->left = NULL;
+					new->right = NULL;
+					new->match = expr;
+					counters->right = new;
+					return 0;
+				}
+			} else  {
+				/* already there? */
+				if (count) {
+					counters->match->count++;
+				}
+				return 1;
+			}
+		} else {
+			/* shouldn't happen but anyway */
+			counters->match = expr;
+		}
+	}
+	return 0;
+}
+
+static bool
+match_dns_packet_to_expr(ldns_pkt *pkt, ldns_rdf *src_addr, ldns_rdf *dst_addr, match_expression *expr)
+{
+	bool result;
+
+	if (!pkt || !expr) {
+		return false;
+	}
+	
+	switch(expr->op) {
+		case MATCH_EXPR_OR:
+			result = (match_dns_packet_to_expr(pkt, src_addr, dst_addr, expr->left) ||
+			       match_dns_packet_to_expr(pkt, src_addr, dst_addr, expr->right));
+			break;
+		case MATCH_EXPR_AND:
+			result = (match_dns_packet_to_expr(pkt, src_addr, dst_addr, expr->left) &&
+			       match_dns_packet_to_expr(pkt, src_addr, dst_addr, expr->right));
+			break;
+		case MATCH_EXPR_LEAF:
+			result = match_packet_to_operation(pkt, src_addr, dst_addr, expr->match);
+			break;
+		default:
+			fprintf(stderr, "Error, unknown expression operator %u\n", expr->op);
+			fprintf(stderr, "full expression:\n");
+			print_match_expression(stderr, expr);
+			fprintf(stderr, "\n");
+			exit(1);
+	}
+
+	if (result) {
+		if (verbosity >= 5) {
+			printf("Found Match:\n");
+			print_match_expression(stdout, expr);
+			printf("\nCount now %u\n", (unsigned int) expr->count);
+		}
+		expr->count++;
+	}
+
+	return result;
+}
+
+static void
+free_match_operation(match_operation *operation)
+{
+	if (operation) {
+		if (operation->value) {
+			free(operation->value);
+		}
+		free(operation);
+	}
+}
+
+static void
+free_match_expression(match_expression *expr)
+{
+	if (expr) {
+		switch(expr->op) {
+			case MATCH_EXPR_OR:
+			case MATCH_EXPR_AND:
+				free_match_expression(expr->left);
+				free_match_expression(expr->right);
+				break;
+			case MATCH_EXPR_LEAF:
+				free_match_operation(expr->match);
+				break;
+		}
+		free(expr);
+	}
+}
+
+static void
+free_counters(match_counters *counters)
+{
+	if (counters) {
+		if (counters->left) {
+			free_counters(counters->left);
+		}
+		if (counters->match) {
+			free_match_expression(counters->match);
+		}
+		if (counters->right) {
+			free_counters(counters->right);
+		}
+		free(counters);
+	}
+}
+
+static void
+match_pkt_counters(ldns_pkt *pkt, ldns_rdf *src_addr, ldns_rdf *dst_addr, match_counters *counts)
+{
+	if (counts->left) {
+		match_pkt_counters(pkt, src_addr, dst_addr, counts->left);
+	}
+	if (counts->match) {
+		if (match_dns_packet_to_expr(pkt, src_addr, dst_addr, counts->match)) {
+/*
+			counts->match->count++;
+*/
+		}
+	}
+	if (counts->right) {
+		match_pkt_counters(pkt, src_addr, dst_addr, counts->right);
+	}	
+}
+
+static void
+match_pkt_uniques(ldns_pkt *pkt, ldns_rdf *src_addr, ldns_rdf *dst_addr, match_counters *uniques, match_id unique_ids[], size_t unique_id_count)
+{
+	match_expression *me;
+	size_t i;
+	match_operation *mo;
+	int add_result;
+	
+	for (i = 0; i < unique_id_count; i++) {
+		mo = malloc(sizeof(match_operation));
+		mo->id = unique_ids[i];
+		mo->operator = OP_EQUAL;
+		mo->value = get_string_value(mo->id, pkt, src_addr, dst_addr);
+
+		me = malloc(sizeof(match_expression));
+		me->op = MATCH_EXPR_LEAF;
+		me->left = NULL;
+		me->right = NULL;
+		me->match = mo;
+		me->count = 1;
+
+		add_result = add_match_counter(uniques, me, true);
+		/* if result=1 it was already found, so delete new one */
+		if (add_result == 1) {
+			free_match_expression(me);
+		}
+	}
+
+#if 0
+	size_t i, j;
+	bool found;
+	match_expression *me;
+	match_operation *mo;
+
+	/* get the value, match uniques for that, if not match, add new */
+	/* all unique values should be MATCH_EXPR_LEAF */
+		found = false;
+		for (j = 0; j < uniques->size; j++) {
+			if (uniques->counter[j]->match->id == unique_ids[i]) {
+				if (match_dns_packet_to_expr(pkt, src_addr, dst_addr, uniques->counter[j])) {
+					found = true;
+				}
+			}
+		}
+		if (!found) {
+			mo = malloc(sizeof(match_operation));
+			mo->id = unique_ids[i];
+			mo->operator = OP_EQUAL;
+			mo->value = get_string_value(mo->id, pkt, src_addr, dst_addr);
+
+			me = malloc(sizeof(match_expression));
+			me->match = mo;
+			me->op = MATCH_EXPR_LEAF;
+			me->left = NULL;
+			me->right = NULL;
+			me->count = 1;
+
+			add_counter(uniques, me);
+		}
+	}
+#endif
+}
+
+static match_expression *
+parse_match_expression(char *string)
+{
+	match_expression *expr;
+	size_t i,j;
+	size_t leftstart, leftend = 0;
+	char *left_str, *op = NULL, *val;
+	match_table *mt;
+	match_operation *mo = NULL;
+	const type_operators *tos;
+	match_expression *result;
+	ldns_lookup_table *lt = NULL;
+
+	/* remove whitespace */
+	char *str = calloc(1, strlen(string) + 1);
+
+	j = 0;
+	for (i = 0; i < strlen(string); i++) {
+		if(!isspace((unsigned char)string[i])) {
+			str[j] = string[i];
+			j++;
+		}
+	}
+	str[j] = '\0';
+	
+	expr = malloc(sizeof(match_expression));
+	expr->left = NULL;
+	expr->right = NULL;
+	expr->match = NULL;
+	expr->count = 0;
+	leftstart = 0;
+	for (i = 0; i < strlen(str); i++) {
+		if (str[i] == '&') {
+			expr->op = MATCH_EXPR_AND;
+			if (!expr->left) {
+				left_str = malloc(leftend - leftstart + 2);
+				strncpy(left_str, &str[leftstart], leftend-leftstart+1);
+				left_str[leftend - leftstart + 1] = '\0';
+				expr->left = parse_match_expression(left_str);
+				free(left_str);
+			}
+			expr->right = parse_match_expression(&str[i+1]);
+			if (expr->left && expr->right) {
+				result = expr;
+				goto done;
+			} else {
+				result = NULL;
+				goto done;
+			}
+		} else if (str[i] == '|') {
+			expr->op = MATCH_EXPR_OR;
+			if (!expr->left) {
+				left_str = malloc(leftend - leftstart + 2);
+				strncpy(left_str, &str[leftstart], leftend-leftstart+1);
+				left_str[leftend - leftstart + 1] = '\0';
+				expr->left = parse_match_expression(left_str);
+				free(left_str);
+			}
+			expr->right = parse_match_expression(&str[i+1]);
+			expr->count = 0;
+			if (expr->left && expr->right) {
+				result = expr;
+				goto done;
+			} else {
+				result = NULL;
+				goto done;
+			}
+		} else if (str[i] == '(') {
+			leftstart = i + 1;
+			j = 1;
+			while (j > 0) {
+				i++;
+				if (i > strlen(str)) {
+					printf("parse error: no closing bracket: %s\n", str);
+					printf("                                 ");
+					for (j = 0; j < leftstart - 1; j++) {
+						printf(" ");	
+					}
+					printf("^\n");
+					result = NULL;
+					goto done;
+				}
+				if (str[i] == ')') {
+					j--;
+				} else if (str[i] == '(') {
+					j++;
+				} else {
+				}
+			}
+			leftend = i-1;
+			left_str = malloc(leftend - leftstart + 1);
+			strncpy(left_str, &str[leftstart], leftend - leftstart + 1);
+			expr->left = parse_match_expression(left_str);
+			free(left_str);
+			if (i >= strlen(str)-1) {
+				result = expr->left;
+				free_match_expression(expr);
+				goto done;
+			}
+		} else if (str[i] == ')') {
+			printf("parse error: ) without (\n");
+			result = NULL;
+			goto done;
+		} else {
+			leftend = i;
+		}
+	}
+	
+	/* no operators or hooks left, expr should be of the form
+	   <name><operator><value> now */
+	for (i = 0; i < strlen(str); i++) {
+		if (str[i] == '=' ||
+		    str[i] == '>' ||
+		    str[i] == '<' ||
+		    str[i] == '!' ||
+		    str[i] == '~'
+		   ) {
+		 	leftend = i-1;
+			op = malloc(3);
+			j = 0;
+			op[j] = str[i];
+			i++;
+			j++;
+			
+			if (i > strlen(str)) {
+				printf("parse error no right hand side: %s\n", str);
+				result = NULL;
+				goto done;
+			}
+			if (str[i] == '=' ||
+			    str[i] == '>' ||
+			    str[i] == '<' ||
+			    str[i] == '!' ||
+			    str[i] == '~'
+			   ) {
+			   	op[j] = str[i];
+				i++;
+			   	j++;
+				if (i > strlen(str)) {
+					printf("parse error no right hand side: %s\n", str);
+					result = NULL;
+					if (op)
+						free(op);
+					goto done;
+				}
+			}
+			op[j] = '\0';
+			left_str = malloc(leftend - leftstart + 2);
+			strncpy(left_str, &str[leftstart], leftend - leftstart + 1);
+			left_str[leftend - leftstart + 1] = '\0';
+			mt = get_match_by_name(left_str);
+			if (!mt) {
+				printf("parse error: unknown match name: %s\n", left_str);
+				if (op)
+					free(op);
+				result = NULL;
+				goto done;
+			} else {
+				/* check if operator is allowed */
+				tos = get_type_operators(mt->type);
+				for (j = 0; j < tos->operator_count; j++) {
+					if (get_op_id(op) == tos->operators[j]) {
+						if (mo)
+							free(mo);
+						mo = malloc(sizeof(match_operation));
+						mo->id = mt->id;
+						mo->operator = get_op_id(op);
+						switch (mt->type) {
+							case TYPE_BOOL:
+								val = malloc(2);
+								if (strncmp(&str[i], "true", 5) == 0 ||
+								    strncmp(&str[i], "TRUE", 5) == 0 ||
+								    strncmp(&str[i], "True", 5) == 0 ||
+								    strncmp(&str[i], "1", 2) == 0
+								) {
+									val[0] = '1';
+									val[1] = '\0';
+								} else if (strncmp(&str[i], "false", 5) == 0 ||
+								    strncmp(&str[i], "FALSE", 5) == 0 ||
+								    strncmp(&str[i], "False", 5) == 0 ||
+								    strncmp(&str[i], "0", 2) == 0
+								) {
+
+									val[0] = '0';
+								} else {
+									fprintf(stderr, "Bad value for bool: %s\n", &str[i]);
+									exit(EXIT_FAILURE);
+								}
+								val[1] = '\0';
+								break;
+							case TYPE_RR:
+								/* convert first so we have the same strings for the same rrs in match_ later */
+								/*
+								qrr = ldns_rr_new_frm_str(&str[i], LDNS_DEFAULT_TTL, NULL);
+								if (!qrr) {
+									fprintf(stderr, "Bad value for RR: %s\n", &str[i]);
+									exit(EXIT_FAILURE);
+								}
+								val = ldns_rr2str(qrr);
+								*/
+								/* remove \n for readability */
+								/*
+								if (strchr(val, '\n')) {
+									*(strchr(val, '\n')) = '\0';
+								}
+								ldns_rr_free(qrr);
+								*/
+								val = strdup(&str[i]);
+								break;
+							case TYPE_OPCODE:
+								lt = ldns_lookup_by_name(ldns_opcodes, &str[i]);
+								if (lt) {
+									val = malloc(4);
+									snprintf(val, 3, "%u", (unsigned int) lt->id);
+								} else {
+									val = strdup(&str[i]);
+								}
+								break;
+							case TYPE_RCODE:
+								lt = ldns_lookup_by_name(ldns_rcodes, &str[i]);
+								if (lt) {
+									val = malloc(4);
+									snprintf(val, 3, "%u", (unsigned int) lt->id);
+								} else {
+									val = strdup(&str[i]);
+								}
+								break;
+							default:
+								val = strdup(&str[i]);
+								break;
+						}
+						mo->value = val;
+					}
+				}
+				if (!mo) {
+					printf("parse error: operator %s not allowed for match %s\n", op, left_str);
+					result = NULL;
+					if (op)
+						free(op);
+					goto done;
+				}
+			}
+			free(left_str);
+			free(op);
+			expr->match = mo;
+			expr->op = MATCH_EXPR_LEAF;
+			result = expr;
+			goto done;
+		}
+	}
+
+	result = NULL;
+	
+	done:
+	free(str);
+	if (!result) {
+		free_match_expression(expr);
+	}
+	return result;
+	
+}
+/* end of matches and counts */
+void 
+usage(FILE *output)
+{
+	fprintf(output, "Usage: ldns-dpa [OPTIONS] <pcap file>\n");
+	fprintf(output, "Options:\n");
+	fprintf(output, "\t-c <exprlist>:\tCount occurrences of matching expressions\n");
+	fprintf(output, "\t-f <expression>:\tFilter occurrences of matching expressions\n");
+	fprintf(output, "\t-h:\t\tshow this help\n");
+	fprintf(output, "\t-p:\t\tshow percentage of -u and -c values (of the total of\n\t\t\tmatching on the -f filter. if no filter is given,\n\t\t\tpercentages are on all correct dns packets)\n");
+	fprintf(output, "\t-of <file>:\tWrite pcap packets that match the -f flag to file\n");
+	fprintf(output, "\t-ofh <file>:\tWrite pcap packets that match the -f flag to file\n\t\tin a hexadecimal format readable by drill\n");
+	fprintf(output, "\t-s:\t\tshow possible match names\n");
+	fprintf(output, "\t-s <matchname>:\tshow possible match operators and values for <name>\n");
+	fprintf(output, "\t-sf:\t\tPrint packet that match -f. If no -f is given, print\n\t\t\tall dns packets\n");
+	fprintf(output, "\t-u <matchnamelist>:\tCount all occurrences of matchname\n");
+	fprintf(output, "\t-ua:\t\tShow average value of every -u matchname\n");
+	fprintf(output, "\t-uac:\t\tShow average count of every -u matchname\n");
+	fprintf(output, "\t-um <number>:\tOnly show -u results that occurred more than number times\n");
+	fprintf(output, "\t-v <level>:\tbe more verbose\n");
+	fprintf(output, "\t-notip <file>:\tDump pcap packets that were not recognized as\n\t\t\tIP packets to file\n");
+	fprintf(output, "\t-baddns <file>:\tDump mangled dns packets to file\n");
+	fprintf(output, "\t-version:\tShow the version and exit\n");
+	fprintf(output, "\n");
+	fprintf(output, "The filename '-' stands for stdin or stdout, so you can use \"-of -\" if you want to pipe the output to another process\n");
+	fprintf(output, "\n");
+	fprintf(output, "A <list> is a comma separated list of items\n");
+	fprintf(output, "\n");
+	fprintf(output, "An expression has the following form:\n");
+	fprintf(output, "<expr>:\t(<expr>)\n");
+	fprintf(output, "\t<expr> | <expr>\n");
+	fprintf(output, "\t<expr> & <expr>\n");
+	fprintf(output, "\t<match>\n");
+	fprintf(output, "\n");
+	fprintf(output, "<match>:\t<matchname> <operator> <value>\n");
+	fprintf(output, "\n");
+	fprintf(output, "See the -s option for possible matchnames, operators and values.\n");
+}
+
+void
+show_match_names(char *name)
+{
+	size_t j;
+	match_table *mt;
+	ldns_lookup_table *lt;
+	const type_operators *tos;
+	char *str;
+	size_t i;
+	
+	if (name) {
+		mt = get_match_by_name(name);
+		if (mt) {
+			printf("%s:\n", mt->name);
+			printf("\t%s.\n", mt->description);
+			printf("\toperators: ");
+			printf("\t");
+			tos = get_type_operators(mt->type);
+			if (tos)  {
+				for (j = 0; j < tos->operator_count; j++) {
+					printf("%s ", get_op_str(tos->operators[j]));
+/*
+					lt = ldns_lookup_by_id((ldns_lookup_table *) lt_operators, tos->operators[j]);
+					if (lt) {
+						printf("%s ", lt->name);
+					} else {
+						printf("? ");
+					}
+*/
+				}
+			} else {
+				printf("unknown type");
+			}
+			
+			printf("\n");
+			printf("\tValues:\n");
+			switch (mt->type) {
+				case TYPE_INT:
+					printf("\t\t<Integer>\n");
+					break;
+				case TYPE_BOOL:
+					printf("\t\t0\n");
+					printf("\t\t1\n");
+					printf("\t\ttrue\n");
+					printf("\t\tfalse\n");
+					break;
+				case TYPE_OPCODE:
+					printf("\t\t<Integer>\n");
+					lt = ldns_opcodes;
+					while (lt->name != NULL) {
+						printf("\t\t%s\n", lt->name);
+						lt++;
+					}
+					break;
+				case TYPE_RCODE:
+					printf("\t\t<Integer>\n");
+					lt = ldns_rcodes;
+					while (lt->name != NULL) {
+						printf("\t\t%s\n", lt->name);
+						lt++;
+					}
+					break;
+				case TYPE_STRING:
+					printf("\t\t<String>\n");
+					break;
+				case TYPE_TIMESTAMP:
+					printf("\t\t<Integer> (seconds since epoch)\n");
+					break;
+				case TYPE_ADDRESS:
+					printf("\t\t<IP address>\n");
+					break;
+				case TYPE_RR:
+					printf("\t\t<Resource Record>\n");
+					break;
+				default:
+					break;
+			}
+		} else {
+			printf("Unknown match name: %s\n", name);
+		}
+	} else {
+		mt = (match_table *) matches;
+		while (mt->name != NULL) {
+			str = (char *) mt->name;
+			printf("%s:", str);
+			i = strlen(str) + 1;
+			while (i < 24) {
+				printf(" ");
+				i++;
+			}
+			printf("%s\n", mt->description);
+			mt++;
+		}
+	}
+}
+
+int
+handle_ether_packet(const u_char *data, struct pcap_pkthdr cur_hdr, match_counters *count, match_expression *match_expr, match_counters *uniques, match_id unique_ids[], size_t unique_id_count)
+{
+	struct ether_header *eptr;
+	struct ip *iptr;
+	struct ip6_hdr *ip6_hdr;
+	int ip_hdr_size;
+	uint8_t protocol;
+	size_t data_offset = 0;
+	ldns_rdf *src_addr = NULL, *dst_addr = NULL;
+	uint8_t *ap;
+	char *astr;
+	bpf_u_int32 len = cur_hdr.caplen;
+	struct timeval timestamp;
+	uint16_t ip_flags;
+	uint16_t ip_len;
+	uint16_t ip_id;
+	uint16_t ip_f_offset;
+	const u_char *newdata = NULL;
+/*
+printf("timeval: %u ; %u\n", cur_hdr.ts.tv_sec, cur_hdr.ts.tv_usec);
+*/
+	
+	uint8_t *dnspkt;
+	
+	ldns_pkt *pkt;
+	ldns_status status;
+	
+	/* lets start with the ether header... */
+	eptr = (struct ether_header *) data;
+	/* Do a couple of checks to see what packet type we have..*/
+	if (ntohs (eptr->ether_type) == ETHERTYPE_IP)
+	{
+		if (verbosity >= 5) {
+			printf("Ethernet type hex:%x dec:%u is an IP packet\n",
+				(unsigned int) ntohs(eptr->ether_type),
+				(unsigned int) ntohs(eptr->ether_type));
+		}
+
+		data_offset = ETHER_HEADER_LENGTH;
+		iptr = (struct ip *) (data + data_offset);
+		/*
+		printf("IP_OFF: %u (%04x) %04x %04x (%d) (%d)\n", iptr->ip_off, iptr->ip_off, IP_MF, IP_DF, iptr->ip_off & 0x4000, iptr->ip_off & 0x2000);
+		*/
+		ip_flags = ldns_read_uint16(&(iptr->ip_off));
+		ip_id = ldns_read_uint16(&(iptr->ip_id));
+		ip_len = ldns_read_uint16(&(iptr->ip_len));
+		ip_f_offset = (ip_flags & IP_OFFMASK)*8;
+		if (ip_flags & IP_MF && ip_f_offset == 0) {
+			/*printf("First Frag id %u len\n", ip_id, ip_len);*/
+			fragment_p->ip_id = ip_id;
+			memset(fragment_p->data, 0, 65535);
+			memcpy(fragment_p->data, iptr, ip_len);
+			fragment_p->cur_len = ip_len + 20;
+/*
+				for (ip_len = 0; ip_len < fragment_p->cur_len; ip_len++) {
+					if (ip_len > 0 && ip_len % 20 == 0) {
+						printf("\t; %u - %u\n", ip_len - 19, ip_len);
+					}
+					printf("%02x ", fragment_p->data[ip_len]);
+				}
+				printf("\t; ??? - %u\n", ip_len);
+*/
+			return 0;
+		} else
+		if (ip_flags & IP_MF && ip_f_offset != 0) {
+			/*printf("Next frag\n");*/
+			if (ip_id == fragment_p->ip_id) {
+				/*printf("add fragment to current id %u len %u offset %u\n", ip_id, ip_len, ip_f_offset);*/
+				memcpy(fragment_p->data + (ip_f_offset) + 20, data+data_offset+20, ip_len - (iptr->ip_hl)*4);
+				/*printf("COPIED %u\n", ip_len);*/
+				fragment_p->cur_len = fragment_p->cur_len + ip_len - 20;
+				/*printf("cur len now %u\n", fragment_p->cur_len);*/
+/*
+				for (ip_len = 0; ip_len < fragment_p->cur_len; ip_len++) {
+					if (ip_len > 0 && ip_len % 20 == 0) {
+						printf("\t; %u - %u\n", ip_len - 19, ip_len);
+					}
+					printf("%02x ", fragment_p->data[ip_len]);
+				}
+				printf("\t; ??? - %u\n", ip_len);
+*/
+				return 0;
+			} else {
+				/*printf("Lost fragment %u\n", iptr->ip_id);*/
+				lost_packet_fragments++;
+				return 1;
+			}
+		} else
+		if (!(ip_flags & IP_MF) && ip_f_offset != 0) {
+			/*printf("Last frag\n");*/
+			if (ip_id == fragment_p->ip_id) {
+				/*printf("add fragment to current id %u len %u offset %u\n", ip_id, ip_len, ip_f_offset);*/
+				memcpy(fragment_p->data + ip_f_offset + 20, data+data_offset+20, ip_len - 20);
+				fragment_p->cur_len = fragment_p->cur_len + ip_len - 20;
+				iptr = (struct ip *) fragment_p->data;
+				newdata = malloc(fragment_p->cur_len + data_offset);
+				if (!newdata) {
+					printf("Malloc failed, out of mem?\n");
+					exit(4);
+				}
+				memcpy((char *) newdata, data, data_offset);
+				memcpy((char *) newdata+data_offset, fragment_p->data, fragment_p->cur_len);
+				iptr->ip_len = (u_short) ldns_read_uint16(&(fragment_p->cur_len));
+				iptr->ip_off = 0;
+				len = (bpf_u_int32) fragment_p->cur_len;
+				cur_hdr.caplen = len;
+				fragment_p->ip_id = 0;
+				fragmented_packets++;
+/*
+				for (ip_len = 0; ip_len < fragment_p->cur_len; ip_len++) {
+					if (ip_len > 0 && ip_len % 20 == 0) {
+						printf("\t; %u - %u\n", ip_len - 19, ip_len);
+					}
+					printf("%02x ", fragment_p->data[ip_len]);
+				}
+				printf("\t; ??? - %u\n", ip_len);
+*/
+			} else {
+				/*printf("Lost fragment %u\n", iptr->ip_id);*/
+				lost_packet_fragments++;
+				return 1;
+			}
+		} else {
+			newdata = data;
+		}
+/*
+		if (iptr->ip_off & 0x0040) {
+			printf("Don't fragment\n");
+		}
+*/
+
+			/* in_addr portability woes, going manual for now */
+			/* ipv4 */
+			ap = (uint8_t *) &(iptr->ip_src);
+			astr = malloc(INET_ADDRSTRLEN);
+			if (inet_ntop(AF_INET, ap, astr, INET_ADDRSTRLEN)) {
+				if (ldns_str2rdf_a(&src_addr, astr) == LDNS_STATUS_OK) {
+					
+				}
+			}
+			free(astr);
+			ap = (uint8_t *) &(iptr->ip_dst);
+			astr = malloc(INET_ADDRSTRLEN);
+			if (inet_ntop(AF_INET, ap, astr, INET_ADDRSTRLEN)) {
+				if (ldns_str2rdf_a(&dst_addr, astr) == LDNS_STATUS_OK) {
+					
+				}
+			}
+			free(astr);
+
+			ip_hdr_size = (int) iptr->ip_hl * 4;
+			protocol = (uint8_t) iptr->ip_p;
+			
+			data_offset += ip_hdr_size;
+
+			if (protocol == IPPROTO_UDP) {
+				udp_packets++;
+				data_offset += UDP_HEADER_LENGTH;
+				
+				dnspkt = (uint8_t *) (newdata + data_offset);
+
+				/*printf("packet starts at byte %u\n", data_offset);*/
+
+				/*printf("Len: %u\n", len);*/
+
+				status = ldns_wire2pkt(&pkt, dnspkt, len - data_offset);
+
+				if (status != LDNS_STATUS_OK) {
+					if (verbosity >= 3) {
+						printf("No dns packet: %s\n", ldns_get_errorstr_by_id(status));
+					}
+					if (verbosity >= 5) {
+						for (ip_len = 0; ip_len < len - data_offset; ip_len++) {
+							if (ip_len > 0 && ip_len % 20 == 0) {
+								printf("\t; %u - %u\n", (unsigned int) ip_len - 19, (unsigned int) ip_len);
+							}
+							printf("%02x ", (unsigned int) dnspkt[ip_len]);
+						}
+						printf("\t; ??? - %u\n", (unsigned int) ip_len);
+						
+					}
+					bad_dns_packets++;
+					if (bad_dns_dump) {
+						pcap_dump((u_char *)bad_dns_dump, &cur_hdr, newdata);
+					}
+				} else {
+					timestamp.tv_sec = cur_hdr.ts.tv_sec;
+					timestamp.tv_usec = cur_hdr.ts.tv_usec;
+					ldns_pkt_set_timestamp(pkt, timestamp);
+				
+					if (verbosity >= 4) {
+						printf("DNS packet\n");
+						ldns_pkt_print(stdout, pkt);
+						printf("\n\n");
+					}
+
+					total_nr_of_dns_packets++;
+
+					if (match_expr) {
+						if (match_dns_packet_to_expr(pkt, src_addr, dst_addr, match_expr)) {
+							/* if outputfile write */
+							if (dumper) {
+								pcap_dump((u_char *)dumper, &cur_hdr, data);
+							}
+							if (hexdumpfile) {
+								fprintf(hexdumpfile, ";; %u\n", (unsigned int) total_nr_of_dns_packets);
+								ldns_pkt2file_hex(hexdumpfile, pkt);
+							}
+							if (show_filter_matches) {
+								printf(";; From: ");
+								ldns_rdf_print(stdout, src_addr);
+								printf("\n");
+								printf(";; To:   ");
+								ldns_rdf_print(stdout, dst_addr);
+								printf("\n");
+								ldns_pkt_print(stdout, pkt);
+								printf("------------------------------------------------------------\n\n");
+							}
+						} else {
+							ldns_pkt_free(pkt);
+							ldns_rdf_deep_free(src_addr);
+							ldns_rdf_deep_free(dst_addr);
+							if (newdata && newdata != data)
+								free((void *)newdata);
+							return 0;
+						}
+					} else {
+						if (dumper) {
+							pcap_dump((u_char *)dumper, &cur_hdr, data);
+						}
+						if (hexdumpfile) {
+							fprintf(hexdumpfile, ";; %u\n", (unsigned int) total_nr_of_dns_packets);
+							ldns_pkt2file_hex(hexdumpfile, pkt);
+						}
+						if (show_filter_matches) {
+							printf(";; From: ");
+							ldns_rdf_print(stdout, src_addr);
+							printf("\n");
+							printf(";; To:   ");
+							ldns_rdf_print(stdout, dst_addr);
+							printf("\n");
+							ldns_pkt_print(stdout, pkt);
+							printf("------------------------------------------------------------\n\n");
+						}
+					}
+
+					/* General counters here */
+					total_nr_of_filtered_packets++;
+
+					match_pkt_counters(pkt, src_addr, dst_addr, count);
+					match_pkt_uniques(pkt, src_addr, dst_addr, uniques, unique_ids, unique_id_count);
+
+					ldns_pkt_free(pkt);
+					pkt = NULL;
+				}
+				ldns_rdf_deep_free(src_addr);
+				ldns_rdf_deep_free(dst_addr);
+
+			} else if (protocol == IPPROTO_TCP) {
+				/* tcp packets are skipped */
+				tcp_packets++;
+			}
+			if (newdata && newdata != data) {
+				free((void *)newdata);
+				newdata = NULL;
+			}
+	/* don't have a define for ethertype ipv6 */
+	} else 	if (ntohs (eptr->ether_type) == ETHERTYPE_IPV6) {
+		/*printf("IPv6!\n");*/
+
+
+		/* copied from ipv4, move this to function? */
+
+		data_offset = ETHER_HEADER_LENGTH;
+		ip6_hdr = (struct ip6_hdr *) (data + data_offset);
+
+		newdata = data;
+		
+		/* in_addr portability woes, going manual for now */
+		/* ipv6 */
+		ap = (uint8_t *) &(ip6_hdr->ip6_src);
+		astr = malloc(INET6_ADDRSTRLEN);
+		if (inet_ntop(AF_INET6, ap, astr, INET6_ADDRSTRLEN)) {
+			if (ldns_str2rdf_aaaa(&src_addr, astr) == LDNS_STATUS_OK) {
+				
+			}
+		}
+		free(astr);
+		ap = (uint8_t *) &(ip6_hdr->ip6_dst);
+		astr = malloc(INET6_ADDRSTRLEN);
+		if (inet_ntop(AF_INET6, ap, astr, INET6_ADDRSTRLEN)) {
+			if (ldns_str2rdf_aaaa(&dst_addr, astr) == LDNS_STATUS_OK) {
+				
+			}
+		}
+		free(astr);
+
+		ip_hdr_size = IP6_HEADER_LENGTH;
+		protocol = (uint8_t) ip6_hdr->ip6_ctlun.ip6_un1.ip6_un1_nxt;
+		
+		data_offset += ip_hdr_size;
+
+		if (protocol == IPPROTO_UDP) {
+			udp_packets++;
+			/*printf("V6 UDP!\n");*/
+			data_offset += UDP_HEADER_LENGTH;
+			
+			dnspkt = (uint8_t *) (newdata + data_offset);
+
+			/*printf("Len: %u\n", len);*/
+
+			status = ldns_wire2pkt(&pkt, dnspkt, len - data_offset);
+
+			if (status != LDNS_STATUS_OK) {
+				if (verbosity >= 3) {
+					printf("No dns packet: %s\n", ldns_get_errorstr_by_id(status));
+				}
+				bad_dns_packets++;
+				if (bad_dns_dump) {
+					pcap_dump((u_char *)bad_dns_dump, &cur_hdr, newdata);
+				}
+			} else {
+				timestamp.tv_sec = cur_hdr.ts.tv_sec;
+				timestamp.tv_usec = cur_hdr.ts.tv_usec;
+				ldns_pkt_set_timestamp(pkt, timestamp);
+			
+				if (verbosity >= 4) {
+					printf("DNS packet\n");
+					ldns_pkt_print(stdout, pkt);
+					printf("\n\n");
+				}
+
+				total_nr_of_dns_packets++;
+
+				if (match_expr) {
+					if (match_dns_packet_to_expr(pkt, src_addr, dst_addr, match_expr)) {
+						/* if outputfile write */
+						if (dumper) {
+							pcap_dump((u_char *)dumper, &cur_hdr, data);
+						}
+						if (show_filter_matches) {
+							printf(";; From: ");
+							ldns_rdf_print(stdout, src_addr);
+							printf("\n");
+							printf(";; To:   ");
+							ldns_rdf_print(stdout, dst_addr);
+							printf("\n");
+							ldns_pkt_print(stdout, pkt);
+							printf("------------------------------------------------------------\n\n");
+						}
+					} else {
+						ldns_pkt_free(pkt);
+						ldns_rdf_deep_free(src_addr);
+						ldns_rdf_deep_free(dst_addr);
+						return 0;
+					}
+				} else {
+					if (show_filter_matches) {
+						printf(";; From: ");
+						ldns_rdf_print(stdout, src_addr);
+						printf("\n");
+						printf(";; To:   ");
+						ldns_rdf_print(stdout, dst_addr);
+						printf("\n");
+						ldns_pkt_print(stdout, pkt);
+						printf("------------------------------------------------------------\n\n");
+					}
+				}
+
+				/* General counters here */
+				total_nr_of_filtered_packets++;
+
+				match_pkt_counters(pkt, src_addr, dst_addr, count);
+				match_pkt_uniques(pkt, src_addr, dst_addr, uniques, unique_ids, unique_id_count);
+
+				ldns_pkt_free(pkt);
+				pkt = NULL;
+			}
+			ldns_rdf_deep_free(src_addr);
+			ldns_rdf_deep_free(dst_addr);
+
+		} else if (protocol == IPPROTO_TCP) {
+			/* tcp packets are skipped */
+			tcp_packets++;
+		} else {
+			printf("ipv6 unknown next header type: %u\n", (unsigned int) protocol);
+		}
+
+
+
+	} else  if (ntohs (eptr->ether_type) == ETHERTYPE_ARP) {
+		if (verbosity >= 5) {
+			printf("Ethernet type hex:%x dec:%u is an ARP packet\n",
+				(unsigned int) ntohs(eptr->ether_type),
+				(unsigned int) ntohs(eptr->ether_type));
+		}
+		arp_packets++;
+	} else {
+		printf("Ethernet type %x not IP\n", (unsigned int) ntohs(eptr->ether_type));
+		if (verbosity >= 5) {
+			printf("Ethernet type %x not IP\n", (unsigned int) ntohs(eptr->ether_type));
+		}
+		not_ip_packets++;
+		if (not_ip_dump) {
+			pcap_dump((u_char *)not_ip_dump, &cur_hdr, data);
+		}
+	}
+
+	return 0;
+}
+
+bool
+parse_match_list(match_counters *counters, char *string)
+{
+	size_t i;
+	match_expression *expr;
+/*	match_counter *mc;*/
+	size_t lastpos = 0;
+	char *substring;
+
+	/*printf("Parsing match list: '%s'\n", string);*/
+
+	for (i = 0; i < strlen(string); i++) {
+		if (string[i] == ',') {
+			if (i<2) {
+				fprintf(stderr, "Matchlist cannot start with ,\n");
+				return false;
+			} else {
+				substring = malloc(strlen(string)+1);
+				strncpy(substring, &string[lastpos], i - lastpos + 1);
+				substring[i - lastpos] = '\0';
+				expr = parse_match_expression(substring);
+				free(substring);
+				if (!expr) {
+					return false;
+				}
+				/*
+				if (expr->op != MATCH_EXPR_LEAF) {
+					fprintf(stderr, "Matchlist can only contain <match>, not a logic expression\n");
+					return false;
+				}
+				*/
+				add_match_counter(counters, expr, false);
+				lastpos = i+1;
+			}
+		}
+	}
+	substring = malloc(strlen(string) + 1);
+	strncpy(substring, &string[lastpos], i - lastpos + 1);
+	substring[i - lastpos] = '\0';
+	expr = parse_match_expression(substring);
+
+	if (!expr) {
+		fprintf(stderr, "Bad match: %s\n", substring);
+		free(substring);
+		return false;
+	}
+	free(substring);
+	/*
+	if (expr->op != MATCH_EXPR_LEAF) {
+		fprintf(stderr, "Matchlist can only contain <match>, not a logic expression\n");
+		return false;
+	}
+	*/
+	add_match_counter(counters, expr, false);
+	return true;
+}
+
+bool
+parse_uniques(match_id ids[], size_t *count, char *string)
+{
+	size_t i, j, lastpos;
+	char *str, *strpart;
+	match_table *mt;
+
+	/*printf("Parsing unique counts: '%s'\n", string);*/
+	str = calloc(1, strlen(string) + 1);
+	j = 0;
+	for (i = 0; i < strlen(string); i++) {
+		if (!isspace((unsigned char)string[i])) {
+			str[j] = string[i];
+			j++;
+		}
+	}
+	str[j] = '\0';
+
+	lastpos = 0;
+	for (i = 0; i <= strlen(str); i++) {
+		if (str[i] == ',' || i >= strlen(str)) {
+			if (!(strpart = malloc(i - lastpos + 1))) {
+				free(str);
+				return false;
+			}
+			strncpy(strpart, &str[lastpos], i - lastpos);
+			strpart[i - lastpos] = '\0';
+			if ((mt = get_match_by_name(strpart))) {
+				ids[*count] = mt->id;
+				*count = *count + 1;
+			} else {
+				printf("Error parsing match list; unknown match name: %s\n", strpart);
+				free(strpart);
+				free(str);
+				return false;
+			}
+			free(strpart);
+			lastpos = i + 1;
+		}
+	}
+	if (i > lastpos) {
+		strpart = malloc(i - lastpos + 1);
+		strncpy(strpart, &str[lastpos], i - lastpos);
+		strpart[i - lastpos] = '\0';
+		if ((mt = get_match_by_name(strpart))) {
+			ids[*count] = mt->id;
+			*count = *count + 1;
+		} else {
+			printf("Error parsing match list; unknown match name: %s\n", strpart);
+			return false;
+		}
+		free(strpart);
+	}
+	free(str);
+	return true;
+}
+
+int main(int argc, char *argv[]) {
+
+	int i;
+	int status = EXIT_SUCCESS;
+	match_counters *count = malloc(sizeof(match_counters));
+	const char *inputfile = NULL;
+	char errbuf[PCAP_ERRBUF_SIZE];
+	pcap_t *pc = NULL;
+	const u_char *cur;
+	struct pcap_pkthdr cur_hdr;
+	match_expression *expr = NULL;
+	match_id unique_ids[MAX_MATCHES];
+	size_t unique_id_count = 0; /* number of unique counters */
+	match_counters *uniques = malloc(sizeof(match_counters));
+	char *dumpfile = NULL;
+	char *hexdumpfilename = NULL;
+	char *not_ip_dumpfile = NULL;
+	char *bad_dns_dumpfile = NULL;
+
+	bool show_percentages = false;
+	bool show_averages = false;
+	bool show_average_count = false;
+	int unique_minimum = 0;
+
+	count->left = NULL;
+	count->match = NULL;
+	count->right = NULL;
+	uniques->left = NULL;
+	uniques->match = NULL;
+	uniques->right = NULL;
+
+	fragment_p = malloc(sizeof(struct fragment_part));
+	fragment_p->ip_id = 0;
+	fragment_p->cur_len = 0;
+
+	for (i = 1; i < argc; i++) {
+
+		if (strncmp(argv[i], "-baddns", 8) == 0) {
+			if (i + 1 < argc) {
+				bad_dns_dumpfile = argv[i + 1];
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strncmp(argv[i], "-notip", 7) == 0) {
+			if (i + 1 < argc) {
+				not_ip_dumpfile = argv[i + 1];
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strncmp(argv[i], "-c", 3) == 0) {
+			if (i + 1 < argc) {
+				if (!parse_match_list(count, argv[i + 1])) {
+					status = EXIT_FAILURE;
+					goto exit;
+				}
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else 	if (strncmp(argv[i], "-f", 3) == 0) {
+			if (i + 1 < argc) {
+				if (expr || strchr(argv[i+1], ',')) {
+					fprintf(stderr, "You can only specify 1 filter expression.\n");
+					status = EXIT_FAILURE;
+					goto exit;
+				}
+				expr = parse_match_expression(argv[i + 1]);
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strncmp(argv[i], "-h", 3) == 0) {
+			usage(stdout);
+			status = EXIT_SUCCESS;
+			goto exit;
+		} else if (strncmp(argv[i], "-p", 3) == 0) {
+			show_percentages = true;
+		} else if (strncmp(argv[i], "-of", 4) == 0) {
+			if (i + 1 < argc) {
+				dumpfile = argv[i + 1];
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strncmp(argv[i], "-ofh", 5) == 0) {
+			if (i + 1 < argc) {
+				hexdumpfilename = argv[i + 1];
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strncmp(argv[i], "-s", 3) == 0) {
+			if (i + 1 < argc) {
+				show_match_names(argv[i + 1]);
+			} else {
+				show_match_names(NULL);
+			}
+			status = EXIT_SUCCESS;
+			goto exit;
+		} else if (strncmp(argv[i], "-sf", 4) == 0) {
+			show_filter_matches = true;
+		} else if (strncmp(argv[i], "-u", 3) == 0) {
+			if (i + 1 < argc) {
+				if (!parse_uniques(unique_ids, &unique_id_count, argv[i + 1])) {
+					status = EXIT_FAILURE;
+					goto exit;
+				}
+				i++;
+			} else {
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strcmp("-ua", argv[i]) == 0) {
+			show_averages = true;
+		} else if (strcmp("-uac", argv[i]) == 0) {
+			show_average_count = true;
+		} else if (strcmp("-um", argv[i]) == 0) {
+			if (i + 1 < argc) {
+				unique_minimum = atoi(argv[i+1]);
+				i++;
+			} else {
+				fprintf(stderr, "-um requires an argument");
+				usage(stderr);
+				status = EXIT_FAILURE;
+				goto exit;
+			}
+		} else if (strcmp("-v", argv[i]) == 0) {
+			i++;
+			if (i < argc) {
+				verbosity = atoi(argv[i]);
+			}
+		} else if (strcmp("-version", argv[i]) == 0) {
+			printf("dns packet analyzer, version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+			goto exit;
+		} else {
+			if (inputfile) {
+				fprintf(stderr, "You can only specify 1 input file\n");
+				exit(1);
+			}
+			inputfile = argv[i];
+		}
+	}
+
+	if (!inputfile) {
+		inputfile = "-";
+	}
+
+	if (verbosity >= 5) {
+		printf("Filter:\n");
+		print_match_expression(stdout, expr);
+		printf("\n\n");
+	}
+
+	pc = pcap_open_offline(inputfile, errbuf);
+	
+	if (!pc) {
+		if (errno != 0) {
+			printf("Error opening pcap file %s: %s\n", inputfile, errbuf);
+			exit(1);
+		} else {
+			goto showresult;
+		}
+	}
+
+	if (dumpfile) {
+	        dumper = pcap_dump_open(pc, dumpfile);
+
+		if (!dumper) {
+			printf("Error opening pcap dump file %s: %s\n", dumpfile, errbuf);
+			exit(1);
+		}
+	}
+
+	if (hexdumpfilename) {
+		if (strncmp(hexdumpfilename, "-", 2) != 0) {
+			printf("hexdump is file\n");
+		        hexdumpfile = fopen(hexdumpfilename, "w");
+		} else {
+			printf("hexdump is stdout\n");
+			hexdumpfile = stdout;
+		}
+
+		if (!hexdumpfile) {
+			printf("Error opening hex dump file %s: %s\n", hexdumpfilename, strerror(errno));
+			exit(1);
+		}
+	}
+
+	if (not_ip_dumpfile) {
+		not_ip_dump = pcap_dump_open(pc, not_ip_dumpfile);
+		if (!not_ip_dump) {
+			printf("Error opening pcap dump file NOT_IP: %s\n",  errbuf);
+		}
+	}
+	if (bad_dns_dumpfile) {
+		bad_dns_dump = pcap_dump_open(pc, bad_dns_dumpfile);
+		if (!bad_dns_dump) {
+			printf("Error opening pcap dump file NOT_IP: %s\n",  errbuf);
+		}
+	}
+	
+	while ((cur = pcap_next(pc, &cur_hdr))) {
+		if (verbosity >= 5) {
+			printf("\n\n\n[PKT_HDR] caplen: %u \tlen: %u\n", (unsigned int)cur_hdr.caplen, (unsigned int)cur_hdr.len);
+		}
+		handle_ether_packet(cur, cur_hdr, count, expr, uniques, unique_ids, unique_id_count);
+	}
+
+	if (not_ip_dump) {
+		pcap_dump_close(not_ip_dump);
+	}
+
+	if (bad_dns_dump) {
+		pcap_dump_close(bad_dns_dump);
+	}
+
+	if (dumper) {
+		pcap_dump_close(dumper);
+	}
+	
+	if (hexdumpfile && hexdumpfile != stdout) {
+		fclose(hexdumpfile);
+	}
+
+	pcap_close(pc);
+	
+	showresult:
+	if (show_percentages) {
+		fprintf(stdout, "Packets that are not IP: %u\n", (unsigned int) not_ip_packets);
+		fprintf(stdout, "bad dns packets: %u\n", (unsigned int) bad_dns_packets);
+		fprintf(stdout, "arp packets: %u\n", (unsigned int) arp_packets);
+		fprintf(stdout, "udp packets: %u\n", (unsigned int) udp_packets);
+		fprintf(stdout, "tcp packets (skipped): %u\n", (unsigned int) tcp_packets);
+		fprintf(stdout, "reassembled fragmented packets: %u\n", (unsigned int) fragmented_packets);
+		fprintf(stdout, "packet fragments lost: %u\n", (unsigned int) lost_packet_fragments);
+		fprintf(stdout, "Total number of DNS packets: %u\n", (unsigned int) total_nr_of_dns_packets);
+		fprintf(stdout, "Total number of DNS packets after filter: %u\n", (unsigned int) total_nr_of_filtered_packets);
+	}
+	if (count->match) {
+		print_counters(stdout, count, show_percentages, total_nr_of_filtered_packets, 0);
+	}
+	if (uniques->match) {
+		print_counters(stdout, uniques, show_percentages, total_nr_of_filtered_packets, unique_minimum);
+		if (show_averages) {
+			print_counter_averages(stdout, uniques, NULL);
+		}
+		if (show_average_count) {
+			print_counter_average_count(stdout, uniques, NULL, true);
+		}
+	}
+
+	exit:
+
+	free_match_expression(expr);
+	free_counters(count);
+	free_counters(uniques);
+
+	return status;
+}
+
+#else
+int main(void) {
+	fprintf(stderr, "ldns-dpa was not built because there is no pcap library on this system, or there was no pcap header file at compilation time. Please install pcap and rebuild.\n");
+	return 1;
+}
+#endif
+#else
+int main(void) {
+	fprintf(stderr, "ldns-dpa was not built because there is no pcap library on this system, or there was no pcap header file at compilation time. Please install pcap and rebuild.\n");
+	return 1;
+}
+#endif
+
+
diff --git a/contrib/ldns/examples/ldns-gen-zone.c b/contrib/ldns/examples/ldns-gen-zone.c
new file mode 100644
index 00000000000000..9050f67bf44f76
--- /dev/null
+++ b/contrib/ldns/examples/ldns-gen-zone.c
@@ -0,0 +1,307 @@
+/*
+ * Reads a zone file from disk and prints it to stdout, one RR per line.
+ * Adds artificial DS records and RRs.
+ * For the purpose of generating a test zone file
+ *
+ * (c) SIDN 2010/2011 - Marco Davids/Miek Gieben
+ *
+ * See the LICENSE file for the license
+ */
+
+#include "config.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <ldns/ldns.h>
+#include <errno.h>
+
+#define NUM_DS 4                /* maximum of 4 DS records per delegation */
+#define ALGO 8			/* Algorithm to use for fake DS records - RSASHA256 - RFC5702  */
+#define DIGESTTYPE 2		/* Digest type to use for fake DS records - SHA-256 - RFC 4509 */
+
+
+/**
+ * Usage function.
+ *
+ */
+static void
+usage(FILE *fp, char *prog) {
+        fprintf(fp, "\n\nUsage: %s [-hsv] [-ap NUM] [-o ORIGIN] [<zonefile>]\n", prog);
+        fprintf(fp, "\tReads a zonefile and add some artificial NS RRsets and DS records.\n");
+        fprintf(fp, "\tIf no zonefile is given, the zone is read from stdin.\n");
+        fprintf(fp, "\t-a <NUM> add NUM artificial delegations (NS RRSets) to output.\n");
+        fprintf(fp, "\t-p <NUM> add NUM percent of DS RRset's to the NS RRsets (1-%d RR's per DS RRset).\n", NUM_DS);
+        fprintf(fp, "\t-o ORIGIN sets an $ORIGIN, which can be handy if the one in the zonefile is set to @.\n");
+        fprintf(fp, "\t-s if input zone file is already sorted and canonicalized (ie all lowercase),\n\t   use this option to speed things up while inserting DS records.\n");
+        fprintf(fp, "\t-h show this text.\n");
+        fprintf(fp, "\t-v shows the version and exits.\n");
+        fprintf(fp, "\nif no file is given standard input is read.\n\n");
+}
+
+/**
+ * Insert the DS records, return the amount added.
+ *
+ */
+static int
+insert_ds(ldns_rdf *dsowner, uint32_t ttl)
+{
+        int d, dsrand;
+        int keytag = 0;
+        char *dsownerstr;
+        char digeststr[70];
+
+        /**
+         * Average the amount of DS records per delegation a little.
+         */
+        dsrand = 1+rand() % NUM_DS;
+        for(d = 0; d < dsrand; d++) {
+                keytag = 1+rand() % 65535;
+                /**
+                 * Dynamic hashes method below is still too slow... 20% slower than a fixed string...
+                 *
+                 * We assume RAND_MAX is 32 bit, http://www.gnu.org/s/libc/manual/html_node/ISO-Random.html
+                 * 2147483647 or 0x7FFFFFFF
+                 */
+                snprintf(digeststr, 65,
+                        "%08x%08x%08x%08x%08x%08x%08x%08x",
+                        (unsigned) rand()%RAND_MAX, (unsigned) rand()%RAND_MAX, (unsigned) rand()%RAND_MAX,
+                        (unsigned) rand()%RAND_MAX, (unsigned) rand()%RAND_MAX, (unsigned) rand()%RAND_MAX,
+                        (unsigned) rand()%RAND_MAX, (unsigned) rand()%RAND_MAX);
+                dsownerstr = ldns_rdf2str(dsowner);
+                fprintf(stdout, "%s\t%u\tIN\tDS\t%d %d %d %s\n", dsownerstr, (unsigned) ttl, keytag, ALGO, DIGESTTYPE, digeststr);
+        }
+        return dsrand;
+}
+
+int
+main(int argc, char **argv) {
+        char *filename, *rrstr, *ownerstr;
+        const char *classtypestr1 = "IN NS ns1.example.com.";
+        const char *classtypestr2 = "IN NS ns2.example.com.";
+        const size_t classtypelen = strlen(classtypestr1);
+        /* Simply because this was developed by SIDN and we don't use xn-- for .nl :-) */
+        const char *punystr = "xn--fake-rr";
+        const size_t punylen = strlen(punystr);
+        size_t rrstrlen, ownerlen;
+        FILE *fp;
+        int c, nsrand;
+        uint32_t ttl;
+        int counta,countd,countr;
+        ldns_zone *z;
+        ldns_rdf *origin = NULL;
+        int line_nr = 0;
+        int addrrs = 0;
+        int dsperc = 0;
+        bool canonicalize = true;
+        bool sort = true;
+        bool do_ds = false;
+        ldns_status s;
+        size_t i;
+        ldns_rr_list *rrset_list;
+        ldns_rdf *owner;
+        ldns_rr_type cur_rr_type;
+        ldns_rr *cur_rr;
+        ldns_status status;
+
+        counta = countd = countr = 0;
+
+        /**
+         * Set some random seed.
+         */
+        srand((unsigned int)time(NULL));
+
+        /**
+         * Commandline options.
+         */
+        while ((c = getopt(argc, argv, "a:p:shvo:")) != -1) {
+                switch (c) {
+        	    case 'a':
+                        addrrs = atoi(optarg);
+                        if (addrrs <= 0) {
+                                fprintf(stderr, "error\n");
+                                exit(EXIT_FAILURE);
+                        }
+                        break;
+                case 'o':
+                        origin = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, optarg);
+                        if (!origin) {
+                                fprintf(stderr, "error: creating origin from -o %s failed.\n", optarg);
+                                exit(EXIT_FAILURE);
+                        }
+                        break;
+                case 'p':
+                        dsperc = atoi(optarg);
+                        if (dsperc < 0 || dsperc > 100) {
+                                fprintf(stderr, "error: percentage of signed delegations must be between [0-100].\n");
+                                exit(EXIT_FAILURE);
+                        }
+                        do_ds = true;
+                        break;
+                case 's':
+                        sort = false;
+                        canonicalize = false;
+                        break;
+                case 'h':
+                        usage(stdout, argv[0]);
+                        exit(EXIT_SUCCESS);
+                case 'v':
+                        fprintf(stdout, "ldns-gen-zone version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+                        exit(EXIT_SUCCESS);
+                default:
+                        fprintf(stderr, "\nTry -h for more information.\n\n");
+                        exit(EXIT_FAILURE);
+	        }
+        }
+        argc -= optind;
+        argv += optind;
+
+        /**
+         * Read zone.
+         */
+        if (argc == 0) {
+                fp = stdin;
+        } else {
+                filename = argv[0];
+                fp = fopen(filename, "r");
+                if (!fp) {
+	                fprintf(stderr, "Unable to open %s: %s\n", filename, strerror (errno));
+                	exit(EXIT_FAILURE);
+	        }
+        }
+        s = ldns_zone_new_frm_fp_l(&z, fp, origin, 0, LDNS_RR_CLASS_IN, &line_nr);
+        if (s != LDNS_STATUS_OK) {
+                fprintf(stderr, "%s at line %d\n", ldns_get_errorstr_by_id(s), line_nr);
+                exit(EXIT_FAILURE);
+        }
+        if (!ldns_zone_soa(z)) {
+                fprintf(stderr, "No zone data seen\n");
+                exit(EXIT_FAILURE);
+        }
+
+        ttl = ldns_rr_ttl(ldns_zone_soa(z));
+        if (!origin) {
+                origin = ldns_rr_owner(ldns_zone_soa(z));
+                // Check for root (.) origin here TODO(MG)
+        }
+        ownerstr = ldns_rdf2str(origin);
+        if (!ownerstr) {
+                fprintf(stderr, "ldns_rdf2str(origin) failed\n");
+                exit(EXIT_FAILURE);
+        }
+        ownerlen = strlen(ownerstr);
+
+        ldns_rr_print(stdout, ldns_zone_soa(z));
+
+        if (addrrs > 0) {
+                while (addrrs > counta) {
+                        counta++;
+                        rrstrlen = punylen + ownerlen + classtypelen + 4;
+                        rrstrlen *= 2; /* estimate */
+                        rrstr = (char*)malloc(rrstrlen);
+                        if (!rrstr) {
+                                fprintf(stderr, "malloc() failed: Out of memory\n");
+                                exit(EXIT_FAILURE);
+                        }
+                        (void)snprintf(rrstr, rrstrlen, "%s%d.%s %u %s", punystr, counta,
+                                ownerstr, (unsigned) ttl, classtypestr1);
+                        status = ldns_rr_new_frm_str(&cur_rr, rrstr, 0, NULL, NULL);
+                        if (status == LDNS_STATUS_OK) {
+                                ldns_rr_print(stdout, cur_rr);
+                                ldns_rr_free(cur_rr);
+                        } else {
+                                fprintf(stderr, "ldns_rr_new_frm_str() failed\n");
+                                exit(EXIT_FAILURE);
+                        }
+
+                        (void)snprintf(rrstr, rrstrlen, "%s%d.%s %u %s", punystr, counta,
+                                ownerstr, (unsigned) ttl, classtypestr2);
+                        status = ldns_rr_new_frm_str(&cur_rr, rrstr, 0, NULL, NULL);
+                        if (status == LDNS_STATUS_OK) {
+                                ldns_rr_print(stdout, cur_rr);
+                        } else {
+                                fprintf(stderr, "ldns_rr_new_frm_str() failed\n");
+                                exit(EXIT_FAILURE);
+                        }
+
+                        free(rrstr);
+
+                        /* may we add a DS record as well? */
+                        if (do_ds) {
+                                /*
+                                 * Per definition this may not be the same as the origin, so no
+                                 * check required same for NS check - so the only thing left is some
+                                 * randomization.
+                                 */
+                                nsrand = rand() % 100;
+                                if (nsrand < dsperc) {
+                                        owner = ldns_rr_owner(cur_rr);
+                                        ttl = ldns_rr_ttl(cur_rr);
+                                        countd += insert_ds(owner, ttl);
+                                }
+                        }
+                        ldns_rr_free(cur_rr);
+                }
+        }
+
+        if (!do_ds) {
+                ldns_rr_list_print(stdout, ldns_zone_rrs(z));
+        } else {
+                /*
+                * We use dns_rr_list_pop_rrset and that requires a sorted list weird things may happen
+                * if the -s option was used on unsorted, non-canonicalized input
+                */
+                if (canonicalize) {
+                        ldns_rr2canonical(ldns_zone_soa(z));
+                        for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(z)); i++) {
+                                ldns_rr2canonical(ldns_rr_list_rr(ldns_zone_rrs(z), i));
+                        }
+                }
+
+                if (sort) {
+                        ldns_zone_sort(z);
+                }
+
+                /* Work on a per RRset basis for DS records - weird things will happen if the -s option
+                 * was used in combination with an unsorted zone file
+                 */
+                while((rrset_list = ldns_rr_list_pop_rrset(ldns_zone_rrs(z)))) {
+                        owner = ldns_rr_list_owner(rrset_list);
+                        cur_rr_type = ldns_rr_list_type(rrset_list);
+                        /**
+                         * Print them...
+                         */
+                        cur_rr = ldns_rr_list_pop_rr(rrset_list);
+                        while (cur_rr) {
+                                ttl = ldns_rr_ttl(cur_rr);
+                                fprintf(stdout, "%s", ldns_rr2str(cur_rr));
+                                cur_rr = ldns_rr_list_pop_rr(rrset_list);
+                        }
+                        /*
+                         * And all the way at the end a DS record if
+                         * we are dealing with an NS rrset
+                         */
+                        nsrand = rand() % 100;
+                        if (nsrand == 0) {
+                                nsrand = 100;
+                        }
+
+                        if ((cur_rr_type == LDNS_RR_TYPE_NS) &&
+                                (ldns_rdf_compare(owner, origin) != 0) && (nsrand < dsperc)) {
+                                /**
+                                 * No DS records for the $ORIGIN, only for delegations, obey dsperc.
+                                 */
+                                countr++;
+                                countd += insert_ds(owner, ttl);
+                        }
+                        ldns_rr_list_free(rrset_list);
+                        ldns_rdf_free(owner);
+                }
+        }
+
+        /**
+         * And done...
+         */
+        fclose(fp);
+        fprintf(stdout, ";; Added %d DS records (percentage was %d) to %d NS RRset's (from input-zone: %d, from added: %d)\n;; lines in original input-zone: %d\n",
+                countd, dsperc, counta + countr, countr, counta, line_nr);
+        exit(EXIT_SUCCESS);
+}
diff --git a/contrib/ldns/examples/ldns-key2ds.c b/contrib/ldns/examples/ldns-key2ds.c
new file mode 100644
index 00000000000000..898755dd3944a1
--- /dev/null
+++ b/contrib/ldns/examples/ldns-key2ds.c
@@ -0,0 +1,205 @@
+/*
+ * key2ds transforms a public key into its DS
+ * It (currently) prints out the public key
+ *
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+
+#include <ldns/ldns.h>
+
+#include <errno.h>
+
+static void
+usage(FILE *fp, char *prog) {
+	fprintf(fp, "%s [-fn] [-1|-2] keyfile\n", prog);
+	fprintf(fp, "  Generate a DS RR from the DNSKEYS in keyfile\n");
+	fprintf(fp, "  The following file will be created: ");
+	fprintf(fp, "K<name>+<alg>+<id>.ds\n");
+	fprintf(fp, "  The base name (K<name>+<alg>+<id> will be printed to stdout\n");
+	fprintf(fp, "Options:\n");
+	fprintf(fp, "  -f: ignore SEP flag (i.e. make DS records for any key)\n");
+	fprintf(fp, "  -n: do not write DS records to file(s) but to stdout\n");
+	fprintf(fp, "  (default) use similar hash to the key algorithm.\n");
+	fprintf(fp, "  -1: use SHA1 for the DS hash\n");
+	fprintf(fp, "  -2: use SHA256 for the DS hash\n");
+#ifdef USE_GOST
+	fprintf(fp, "  -g: use GOST for the DS hash\n");
+#endif
+#ifdef USE_ECDSA
+	fprintf(fp, "  -4: use SHA384 for the DS hash\n");
+#endif
+}
+
+static int
+is_suitable_dnskey(ldns_rr *rr, int sep_only)
+{
+	if (!rr || ldns_rr_get_type(rr) != LDNS_RR_TYPE_DNSKEY) {
+		return 0;
+	}
+	return !sep_only ||
+	        (ldns_rdf2native_int16(ldns_rr_dnskey_flags(rr)) &
+	        LDNS_KEY_SEP_KEY);
+}
+
+static ldns_hash
+suitable_hash(ldns_signing_algorithm algorithm)
+{
+	switch (algorithm) {
+	case LDNS_SIGN_RSASHA256:
+	case LDNS_SIGN_RSASHA512:
+		return LDNS_SHA256;
+	case LDNS_SIGN_ECC_GOST:
+#ifdef USE_GOST
+		return LDNS_HASH_GOST;
+#else
+		return LDNS_SHA256;
+#endif
+#ifdef USE_ECDSA
+	case LDNS_SIGN_ECDSAP256SHA256:
+		return LDNS_SHA256;
+	case LDNS_SIGN_ECDSAP384SHA384:
+		return LDNS_SHA384;
+#endif
+#ifdef USE_ED25519
+	case LDNS_SIGN_ED25519:
+		return LDNS_SHA256;
+#endif
+#ifdef USE_ED448
+	case LDNS_SIGN_ED448:
+		return LDNS_SHA256;
+#endif
+	default: break;
+	}
+	return LDNS_SHA1;
+}
+
+int
+main(int argc, char *argv[])
+{
+	FILE *keyfp, *dsfp;
+	char *keyname;
+	char *dsname;
+	char *owner;
+	ldns_rr *k, *ds;
+	ldns_signing_algorithm alg;
+	ldns_hash h;
+	int similar_hash=1;
+	char *program = argv[0];
+	int nofile = 0;
+	ldns_rdf *origin = NULL;
+	ldns_status result = LDNS_STATUS_OK;
+	int sep_only = 1;
+
+	h = LDNS_SHA1;
+
+	argv++, argc--;
+	while (argc && argv[0][0] == '-') {
+		if (strcmp(argv[0], "-1") == 0) {
+			h = LDNS_SHA1;
+			similar_hash = 0;
+		}
+		if (strcmp(argv[0], "-2") == 0) {
+			h = LDNS_SHA256;
+			similar_hash = 0;
+		}
+#ifdef USE_GOST
+		if (strcmp(argv[0], "-g") == 0) {
+			if(!ldns_key_EVP_load_gost_id()) {
+				fprintf(stderr, "error: libcrypto does not provide GOST\n");
+				exit(EXIT_FAILURE);
+			}
+			h = LDNS_HASH_GOST;
+			similar_hash = 0;
+		}
+#endif
+#ifdef USE_ECDSA
+		if (strcmp(argv[0], "-4") == 0) {
+			h = LDNS_SHA384;
+			similar_hash = 0;
+		}
+#endif
+		if (strcmp(argv[0], "-f") == 0) {
+			sep_only = 0;
+		}
+		if (strcmp(argv[0], "-n") == 0) {
+			nofile=1;
+		}
+		argv++, argc--;
+	}
+
+	if (argc != 1) {
+		usage(stderr, program);
+		exit(EXIT_FAILURE);
+	}
+	keyname = strdup(argv[0]);
+
+	keyfp = fopen(keyname, "r");
+	if (!keyfp) {
+		fprintf(stderr, "Failed to open public key file %s: %s\n", keyname,
+				strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+	while (result == LDNS_STATUS_OK) {
+		result = ldns_rr_new_frm_fp(&k, keyfp, 0, &origin, NULL);
+		while (result == LDNS_STATUS_SYNTAX_ORIGIN ||
+			result == LDNS_STATUS_SYNTAX_TTL ||
+			(result == LDNS_STATUS_OK && !is_suitable_dnskey(k, sep_only))
+		) {
+			if (result == LDNS_STATUS_OK) {
+				ldns_rr_free(k);
+			}
+			result = ldns_rr_new_frm_fp(&k, keyfp, 0, &origin, NULL);
+		}
+		if (result == LDNS_STATUS_SYNTAX_EMPTY) {
+			/* we're done */
+			break;
+		}
+		if (result != LDNS_STATUS_OK) {
+			fprintf(stderr, "Could not read public key from file %s: %s\n", keyname, ldns_get_errorstr_by_id(result));
+			exit(EXIT_FAILURE);
+		}
+
+		owner = ldns_rdf2str(ldns_rr_owner(k));
+		alg = ldns_rdf2native_int8(ldns_rr_dnskey_algorithm(k));
+		if(similar_hash)
+			h = suitable_hash(alg);
+
+		ds = ldns_key_rr2ds(k, h);
+		if (!ds) {
+			fprintf(stderr, "Conversion to a DS RR failed\n");
+			ldns_rr_free(k);
+			free(owner);
+			exit(EXIT_FAILURE);
+		}
+
+		/* print the public key RR to .key */
+		dsname = LDNS_XMALLOC(char, strlen(owner) + 16);
+		snprintf(dsname, strlen(owner) + 15, "K%s+%03u+%05u.ds", owner, alg, (unsigned int) ldns_calc_keytag(k));
+
+		if (nofile)
+			ldns_rr_print(stdout,ds);
+		else {
+			dsfp = fopen(dsname, "w");
+			if (!dsfp) {
+				fprintf(stderr, "Unable to open %s: %s\n", dsname, strerror(errno));
+				exit(EXIT_FAILURE);
+			} else {
+				ldns_rr_print(dsfp, ds);
+				fclose(dsfp);
+				fprintf(stdout, "K%s+%03u+%05u\n", owner, alg, (unsigned int) ldns_calc_keytag(k)); 
+			}
+		}
+
+		ldns_rr_free(ds);
+		ldns_rr_free(k);
+		free(owner);
+		LDNS_FREE(dsname);
+	}
+	fclose(keyfp);
+	free(keyname);
+	exit(EXIT_SUCCESS);
+}
diff --git a/contrib/ldns/examples/ldns-keyfetcher.c b/contrib/ldns/examples/ldns-keyfetcher.c
new file mode 100644
index 00000000000000..2f48e7afd83a42
--- /dev/null
+++ b/contrib/ldns/examples/ldns-keyfetcher.c
@@ -0,0 +1,737 @@
+/*
+ * ldns-keyfetcher retrieves the DNSKEYS for a certain domain
+ * It traces the authoritative nameservers down from the root
+ * And uses TCP, to minimize spoofing danger.
+ *
+ * (c) NLnet Labs, 2006 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <ldns/ldns.h>
+#include <errno.h>
+
+int verbosity = 0;
+/* 0=use both ip4 and ip6 (default). 1=ip4only. 2=ip6only. */
+uint8_t address_family = 0;
+bool store_in_file = false;
+
+static void
+usage(FILE *fp, char *prog) {
+	fprintf(fp, "%s domain\n", prog);
+	fprintf(fp, "  retrieve the dnskeys for a domain\n");
+	fprintf(fp, "Options:\n");
+	fprintf(fp, "-4\t\tUse IPv4 only\n");
+	fprintf(fp, "-6\t\tUse IPv6 only\n");
+	fprintf(fp, "-h\t\tShow this help\n");
+	fprintf(fp, "-i\t\tInsecurer mode; don't do checks, just query for the keys\n");
+	fprintf(fp, "-r <file>\tUse file to read root hints from\n");
+	fprintf(fp, "-s\t\tDon't print the keys but store them in files\n\t\tcalled K<file>.+<alg>.+<keytag>.key\n");
+	fprintf(fp, "-v <int>\tVerbosity level (0-5, not verbose-very verbose)\n");
+}
+
+static ldns_rr_list *
+retrieve_dnskeys(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
+		ldns_rr_class c, ldns_rr_list *dns_root)
+{
+	ldns_resolver *res;
+	ldns_pkt *p;
+	ldns_rr_list *new_nss_a;
+	ldns_rr_list *new_nss_aaaa;
+	ldns_rr_list *new_nss;
+	ldns_rr_list *ns_addr;
+	ldns_rr_list *ns_addr2;
+	uint16_t loop_count;
+	ldns_rdf *pop; 
+	ldns_status status;
+	size_t i;
+
+	size_t nss_i;
+	ldns_rr_list *answer_list = NULL;
+	ldns_rr_list *authority_list = NULL;
+	
+	size_t last_nameserver_count;
+	ldns_rdf **last_nameservers;
+
+	loop_count = 0;
+	new_nss_a = NULL;
+	new_nss_aaaa = NULL;
+	new_nss = NULL;
+	ns_addr = NULL;
+	ns_addr2 = NULL;
+	p = ldns_pkt_new();
+	res = ldns_resolver_new();
+	
+	if (!p || !res) {
+                fprintf(stderr, "Memory allocation failed");
+                return NULL;
+        }
+
+	if (verbosity >= 2) {
+		printf("Finding dnskey data for zone: ");
+		ldns_rdf_print(stdout, name);
+		printf("\n\n");
+	}
+
+	/* transfer some properties of local_res to res,
+	 * because they were given on the command line */
+	ldns_resolver_set_ip6(res, 
+			ldns_resolver_ip6(local_res));
+	ldns_resolver_set_port(res, 
+			ldns_resolver_port(local_res));
+	ldns_resolver_set_debug(res, 
+			ldns_resolver_debug(local_res));
+	ldns_resolver_set_dnssec(res, 
+			ldns_resolver_dnssec(local_res));
+	ldns_resolver_set_fail(res, 
+			ldns_resolver_fail(local_res));
+	ldns_resolver_set_usevc(res, 
+			ldns_resolver_usevc(local_res));
+	ldns_resolver_set_random(res, 
+			ldns_resolver_random(local_res));
+	ldns_resolver_set_recursive(res, false);
+
+	/* setup the root nameserver in the new resolver */
+	status = ldns_resolver_push_nameserver_rr_list(res, dns_root);
+	if (status != LDNS_STATUS_OK) {
+		fprintf(stderr, "Error setting root nameservers in resolver: %s\n", ldns_get_errorstr_by_id(status));
+		return NULL;
+	}
+
+	ldns_pkt_free(p);
+	status = ldns_resolver_send(&p, res, name, t, c, 0);
+	if (status != LDNS_STATUS_OK) {
+		fprintf(stderr, "Error querying root servers: %s\n", ldns_get_errorstr_by_id(status));
+		return NULL;
+	}
+
+	if (ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+		printf("Error in packet:\n");
+		ldns_pkt_print(stdout, p);
+		return NULL;
+	}
+
+	if (verbosity >= 4) {
+		ldns_pkt_print(stdout, p);
+		printf("\n\n");
+	}
+
+	/* from now on, use TCP */
+	ldns_resolver_set_usevc(res, true);
+
+	while(status == LDNS_STATUS_OK && 
+	      ldns_pkt_reply_type(p) == LDNS_PACKET_REFERRAL) {
+
+		if (verbosity >= 3) {
+			printf("This is a delegation!\n\n");
+		}
+		if (address_family == 0 || address_family == 1) {
+			new_nss_a = ldns_pkt_rr_list_by_type(p,
+					LDNS_RR_TYPE_A, LDNS_SECTION_ADDITIONAL);
+		} else {
+			new_nss_a = ldns_rr_list_new();
+		}
+		if (address_family == 0 || address_family == 2) {
+			new_nss_aaaa = ldns_pkt_rr_list_by_type(p,
+					LDNS_RR_TYPE_AAAA, LDNS_SECTION_ADDITIONAL);
+		} else {
+			new_nss_aaaa = ldns_rr_list_new();
+		}
+		new_nss = ldns_pkt_rr_list_by_type(p,
+				LDNS_RR_TYPE_NS, LDNS_SECTION_AUTHORITY);
+
+		/* remove the old nameserver from the resolver */
+		while((pop = ldns_resolver_pop_nameserver(res))) { ldns_rdf_deep_free(pop); }
+
+		/* also check for new_nss emptiness */
+
+		if (!new_nss_aaaa && !new_nss_a) {
+			/* 
+			 * no nameserver found!!! 
+			 * try to resolve the names we do got 
+			 */
+			if (verbosity >= 3) {
+				printf("Did not get address record for nameserver, doing separate query.\n");
+			}
+			ns_addr = ldns_rr_list_new();
+			for(i = 0; (size_t) i < ldns_rr_list_rr_count(new_nss); i++) {
+				/* get the name of the nameserver */
+				pop = ldns_rr_rdf(ldns_rr_list_rr(new_nss, i), 0);
+				if (!pop) {
+					break;
+				}
+
+				/* retrieve it's addresses */
+				ns_addr2 = ldns_get_rr_list_addr_by_name(local_res, pop, c, 0);
+				if (!ldns_rr_list_cat(ns_addr, ns_addr2)) {
+					fprintf(stderr, "Internal error adding nameserver address.\n");
+					exit(EXIT_FAILURE);
+				}
+				ldns_rr_list_free(ns_addr2);
+			}
+
+			if (ns_addr) {
+				if (ldns_resolver_push_nameserver_rr_list(res, ns_addr) != 
+						LDNS_STATUS_OK) {
+					fprintf(stderr, "Error adding new nameservers");
+					ldns_pkt_free(p); 
+					return NULL;
+				}
+				ldns_rr_list_deep_free(ns_addr);
+			} else {
+				ldns_rr_list_print(stdout, ns_addr);
+				fprintf(stderr, "Could not find the nameserver ip addr; abort");
+				ldns_pkt_free(p);
+				return NULL;
+			}
+		}
+
+		/* normally, the first working ns is used, but we need all now, so do it one by one
+		 * if the answer is null, take it from the next resolver
+		 * if the answer is not, compare it to that of the next resolver
+		 * error if different, continue if the same
+		 * if answer list null and no resolvers left die.
+		 */
+
+		ldns_rr_list_deep_free(answer_list);
+		ldns_rr_list_deep_free(authority_list);
+		answer_list = NULL;
+		authority_list = NULL;
+		for (nss_i = 0; nss_i < ldns_rr_list_rr_count(new_nss_aaaa); nss_i++) {
+			while((pop = ldns_resolver_pop_nameserver(res))) { ldns_rdf_deep_free(pop); }
+
+			status = ldns_resolver_push_nameserver(res, ldns_rr_rdf(ldns_rr_list_rr(new_nss_aaaa, nss_i), 0));
+			if (status != LDNS_STATUS_OK) {
+				fprintf(stderr, "Error adding nameserver to resolver: %s\n", ldns_get_errorstr_by_id(status));
+			}
+			
+			if (verbosity >= 1) {
+				fprintf(stdout, "Querying nameserver: ");
+				ldns_rdf_print(stdout, ldns_rr_owner(ldns_rr_list_rr(new_nss_aaaa, nss_i)));
+				fprintf(stdout, " (");
+				ldns_rdf_print(stdout, ldns_rr_rdf(ldns_rr_list_rr(new_nss_aaaa, nss_i), 0));
+				fprintf(stdout, ")\n");
+			}
+			status = ldns_resolver_push_nameserver(res, ldns_rr_rdf(ldns_rr_list_rr(new_nss_aaaa, nss_i), 0));
+			if (status != LDNS_STATUS_OK) {
+				fprintf(stderr, "Error adding nameserver to resolver: %s\n", ldns_get_errorstr_by_id(status));
+			}
+
+			ldns_pkt_free(p);
+			status = ldns_resolver_send(&p, res, name, t, c, 0);
+			if (status == LDNS_STATUS_OK && p) {
+				if (ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+					printf("Error in packet:\n");
+					ldns_pkt_print(stdout, p);
+					return NULL;
+				}
+
+				if (verbosity >= 4) {
+					ldns_pkt_print(stdout, p);
+					printf("\n\n");
+				}
+
+				if (answer_list) {
+					if (verbosity >= 2) {
+						printf("Comparing answer list of answer to previous\n\n");
+					}
+					ldns_rr_list_sort(ldns_pkt_answer(p));
+					ldns_rr_list_sort(answer_list);
+					if (ldns_rr_list_compare(answer_list, ldns_pkt_answer(p)) != 0) {
+						fprintf(stderr, "ERROR: different answer answer from nameserver\n");
+						fprintf(stderr, "\nI had (from previous servers):\n");
+						ldns_rr_list_print(stderr, answer_list);
+						fprintf(stderr, "\nI received (from nameserver at ");
+						ldns_rdf_print(stderr, ldns_resolver_nameservers(res)[0]);
+						fprintf(stderr, "):\n");
+						ldns_rr_list_print(stderr, ldns_pkt_answer(p));
+						exit(EXIT_FAILURE);
+					}
+				} else {
+					answer_list = ldns_rr_list_clone(ldns_pkt_answer(p));
+					ldns_rr_list_sort(answer_list);
+					if (verbosity >= 2) {
+						printf("First answer list for this set, nothing to compare with\n\n");
+					}
+				}
+				if (authority_list) {
+					if (verbosity >= 2) {
+						printf("Comparing authority list of answer to previous\n\n");
+					}
+					ldns_rr_list_sort(ldns_pkt_authority(p));
+					ldns_rr_list_sort(authority_list);
+					if (ldns_rr_list_compare(authority_list, ldns_pkt_authority(p)) != 0) {
+						fprintf(stderr, "ERROR: different authority answer from nameserver\n");
+						fprintf(stderr, "\nI had (from previous servers):\n");
+						ldns_rr_list_print(stderr, authority_list);
+						fprintf(stderr, "\nI received (from nameserver at ");
+						ldns_rdf_print(stderr, ldns_resolver_nameservers(res)[0]);
+						fprintf(stderr, "):\n");
+						ldns_rr_list_print(stderr, ldns_pkt_authority(p));
+						exit(EXIT_FAILURE);
+					}
+				} else {
+					authority_list = ldns_rr_list_clone(ldns_pkt_authority(p));
+					ldns_rr_list_sort(authority_list);
+					if (verbosity >= 2) {
+						printf("First authority list for this set, nothing to compare with\n\n");
+					}
+					if (verbosity >= 3) {
+						printf("NS RRset:\n");
+						ldns_rr_list_print(stdout, authority_list);
+						printf("\n");
+					}
+				}
+			}
+		}
+
+		ldns_rr_list_deep_free(answer_list);
+		ldns_rr_list_deep_free(authority_list);
+		answer_list = NULL;
+		authority_list = NULL;
+		for (nss_i = 0; nss_i < ldns_rr_list_rr_count(new_nss_a); nss_i++) {
+
+			while((pop = ldns_resolver_pop_nameserver(res))) {ldns_rdf_deep_free(pop); }
+
+			if (verbosity >= 1) {
+				fprintf(stdout, "Querying nameserver: ");
+				ldns_rdf_print(stdout, ldns_rr_owner(ldns_rr_list_rr(new_nss_a, nss_i)));
+				fprintf(stdout, " (");
+				ldns_rdf_print(stdout, ldns_rr_rdf(ldns_rr_list_rr(new_nss_a, nss_i), 0));
+				fprintf(stdout, ")\n");
+			}
+			status = ldns_resolver_push_nameserver(res, ldns_rr_rdf(ldns_rr_list_rr(new_nss_a, nss_i), 0));
+			if (status != LDNS_STATUS_OK) {
+				fprintf(stderr, "Error adding nameserver to resolver: %s\n", ldns_get_errorstr_by_id(status));
+			}
+			
+			ldns_pkt_free(p);
+			status = ldns_resolver_send(&p, res, name, t, c, 0);
+
+			if (status == LDNS_STATUS_OK) {
+				if (ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+					printf("Error in packet:\n");
+					ldns_pkt_print(stdout, p);
+					return NULL;
+				}
+
+				if (verbosity >= 4) {
+					ldns_pkt_print(stdout, p);
+					printf("\n\n");
+				}
+
+				if (answer_list) {
+					if (verbosity >= 2) {
+						printf("Comparing answer list of answer to previous\n\n");
+					}
+					ldns_rr_list_sort(ldns_pkt_answer(p));
+					ldns_rr_list_sort(answer_list);
+					if (ldns_rr_list_compare(answer_list, ldns_pkt_answer(p)) != 0) {
+						fprintf(stderr, "ERROR: different answer answer from nameserver\n");
+						fprintf(stderr, "\nI had (from previous servers):\n");
+						ldns_rr_list_print(stderr, answer_list);
+						fprintf(stderr, "\nI received (from nameserver at ");
+						ldns_rdf_print(stderr, ldns_resolver_nameservers(res)[0]);
+						fprintf(stderr, "):\n");
+						ldns_rr_list_print(stderr, ldns_pkt_answer(p));
+						exit(EXIT_FAILURE);
+					}
+				} else {
+					if (verbosity >= 2) {
+						printf("First answer list for this set, nothing to compare with\n\n");
+					}
+					answer_list = ldns_rr_list_clone(ldns_pkt_answer(p));
+					ldns_rr_list_sort(answer_list);
+				}
+				if (authority_list) {
+					if (verbosity >= 2) {
+						printf("Comparing authority list of answer to previous\n\n");
+					}
+					ldns_rr_list_sort(ldns_pkt_authority(p));
+					ldns_rr_list_sort(authority_list);
+					if (ldns_rr_list_compare(authority_list, ldns_pkt_authority(p)) != 0) {
+						fprintf(stderr, "ERROR: different authority answer from nameserver\n");
+						fprintf(stderr, "\nI had (from previous servers):\n");
+						ldns_rr_list_print(stderr, authority_list);
+						fprintf(stderr, "\nI received (from nameserver at ");
+						ldns_rdf_print(stderr, ldns_resolver_nameservers(res)[0]);
+						fprintf(stderr, "):\n");
+						ldns_rr_list_print(stderr, ldns_pkt_authority(p));
+						exit(EXIT_FAILURE);
+					}
+				} else {
+					if (verbosity >= 2) {
+						printf("First authority list for this set, nothing to compare with\n\n");
+					}
+					authority_list = ldns_rr_list_clone(ldns_pkt_authority(p));
+					ldns_rr_list_sort(authority_list);
+					if (verbosity >= 3) {
+						printf("NS RRset:\n");
+						ldns_rr_list_print(stdout, authority_list);
+						printf("\n");
+					}
+				}
+			}
+		}
+		ldns_rr_list_deep_free(authority_list);
+		authority_list = NULL;
+		
+		if (loop_count++ > 20) {
+			/* unlikely that we are doing something useful */
+			fprintf(stderr, "Looks like we are looping");
+			ldns_pkt_free(p); 
+			return NULL;
+		}
+		
+		ldns_pkt_free(p);
+
+		if (verbosity >= 3) {
+			fprintf(stdout, "This level ok. Continuing to next.\n\n");
+		}
+
+		status = ldns_resolver_send(&p, res, name, t, c, 0);
+		
+		if (status != LDNS_STATUS_OK) {
+			fprintf(stderr, "Error querying root servers: %s\n", ldns_get_errorstr_by_id(status));
+			return NULL;
+		}
+
+		if (ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+			printf("Error in packet:\n");
+			ldns_pkt_print(stdout, p);
+			return NULL;
+		}
+
+		if (verbosity >= 4) {
+			ldns_pkt_print(stdout, p);
+			printf("\n\n");
+		}
+
+
+		ldns_rr_list_deep_free(new_nss_aaaa);
+		ldns_rr_list_deep_free(new_nss_a);
+		ldns_rr_list_deep_free(new_nss);
+		new_nss_aaaa = NULL;
+		new_nss_a = NULL;
+		ns_addr = NULL;
+	}
+
+	ldns_rr_list_deep_free(answer_list);
+	answer_list = NULL;
+	/* clone the nameserver list, we are going to handle them one by one */
+	last_nameserver_count = 0;
+	last_nameservers = LDNS_XMALLOC(ldns_rdf *, ldns_resolver_nameserver_count(res));
+
+	pop = NULL;
+	while((pop = ldns_resolver_pop_nameserver(res))) { 
+		last_nameservers[last_nameserver_count] = pop;
+		last_nameserver_count++;
+	}
+
+	for (nss_i = 0; nss_i < last_nameserver_count; nss_i++) {
+		/* remove previous nameserver */
+		while((pop = ldns_resolver_pop_nameserver(res))) { ldns_rdf_deep_free(pop); }
+
+		if (verbosity >= 1) {
+			printf("Querying nameserver: ");
+			ldns_rdf_print(stdout, last_nameservers[nss_i]);
+			printf("\n");
+		}
+		status = ldns_resolver_push_nameserver(res, last_nameservers[nss_i]);
+		if (status != LDNS_STATUS_OK) {
+			fprintf(stderr, "Error adding nameserver to resolver: %s\n", ldns_get_errorstr_by_id(status));
+		}
+
+		ldns_pkt_free(p);
+		status = ldns_resolver_send(&p, res, name, t, c, 0);
+
+		if (!p) {
+			fprintf(stderr, "no packet received\n");
+			LDNS_FREE(last_nameservers);
+			return NULL;
+		}
+
+		if (status == LDNS_STATUS_RES_NO_NS) {
+			fprintf(stderr, "Error: nameserver at ");
+			ldns_rdf_print(stderr, last_nameservers[nss_i]);
+			fprintf(stderr, " not responding. Unable to check RRset here, aborting.\n");
+			LDNS_FREE(last_nameservers);
+			return NULL;
+		}
+
+		if (ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+			printf("Error in packet:\n");
+			ldns_pkt_print(stdout, p);
+			LDNS_FREE(last_nameservers);
+			return NULL;
+		}
+
+		if (answer_list) {
+			if (verbosity >= 2) {
+				printf("1Comparing answer rr list of answer to previous\n");
+			}
+			ldns_rr_list_sort(ldns_pkt_answer(p));
+			ldns_rr_list_sort(answer_list);
+			if (ldns_rr_list_compare(answer_list, ldns_pkt_answer(p)) != 0) {
+				printf("ERROR: different answer section in response from nameserver\n");
+				fprintf(stderr, "\nI had:\n");
+				ldns_rr_list_print(stderr, answer_list);
+				fprintf(stderr, "\nI received (from nameserver at ");
+				ldns_rdf_print(stderr, ldns_resolver_nameservers(res)[0]);
+				fprintf(stderr, "):\n");
+				ldns_rr_list_print(stderr, ldns_pkt_answer(p));
+				exit(EXIT_FAILURE);
+			}
+		} else {
+			if (verbosity >= 2) {
+				printf("First answer rr list for this set, nothing to compare with\n");
+			}
+			answer_list = ldns_rr_list_clone(ldns_pkt_answer(p));
+			if (verbosity >= 3) {
+				printf("DNSKEY RRset:\n");
+				ldns_rr_list_print(stdout, answer_list);
+			}
+		}
+
+	}
+
+	for (nss_i = 0; nss_i < last_nameserver_count; nss_i++) {
+		ldns_rdf_deep_free(last_nameservers[nss_i]);
+	}
+	LDNS_FREE(last_nameservers);
+	ldns_resolver_deep_free(res);
+	ldns_pkt_free(p);
+	return answer_list;
+}
+
+
+/*
+ * The file with the given path should contain a list of NS RRs
+ * for the root zone and A records for those NS RRs.
+ * Read them, check them, and append the a records to the rr list given.
+ */
+static ldns_rr_list *
+read_root_hints(const char *filename)
+{
+	FILE *fp = NULL;
+	int line_nr = 0;
+	ldns_zone *z;
+	ldns_status status;
+	ldns_rr_list *addresses = NULL;
+	ldns_rr *rr;
+	size_t i;
+
+	fp = fopen(filename, "r");
+	if (!fp) {
+		fprintf(stderr, "Unable to open %s for reading: %s\n", filename, strerror(errno));
+		return NULL;
+	}
+
+	status = ldns_zone_new_frm_fp_l(&z, fp, NULL, 0, 0, &line_nr);
+	fclose(fp);
+	if (status != LDNS_STATUS_OK) {
+		fprintf(stderr, "Error reading root hints file: %s\n", ldns_get_errorstr_by_id(status));
+		return NULL;
+	} else {
+		addresses = ldns_rr_list_new();
+		for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(z)); i++) { 
+			rr = ldns_rr_list_rr(ldns_zone_rrs(z), i);
+			if ((address_family == 0 || address_family == 1) &&
+			    ldns_rr_get_type(rr) == LDNS_RR_TYPE_A ) {
+				ldns_rr_list_push_rr(addresses, ldns_rr_clone(rr));
+			}
+			if ((address_family == 0 || address_family == 2) &&
+			    ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
+				ldns_rr_list_push_rr(addresses, ldns_rr_clone(rr));
+			}
+		}
+		ldns_zone_deep_free(z);
+		return addresses;
+	}
+}
+
+
+int
+main(int argc, char *argv[])
+{
+	ldns_resolver *res;
+	ldns_rdf *ns;
+	ldns_rdf *domain;
+	ldns_rr_list *l = NULL;
+
+	ldns_rr_list *dns_root = NULL;
+	const char *root_file = "/etc/named.root";
+
+	ldns_status status;
+	
+	int i;
+
+	char *domain_str;
+	char *outputfile_str;
+	ldns_buffer *outputfile_buffer;
+	FILE *outputfile;
+	ldns_rr *k;
+	
+	bool insecure = false;
+	ldns_pkt *pkt;
+
+	domain = NULL;
+	res = NULL;
+
+	if (argc < 2) {
+		usage(stdout, argv[0]);
+		exit(EXIT_FAILURE);
+	} else {
+		for (i = 1; i < argc; i++) {
+			if (strncmp("-4", argv[i], 3) == 0) {
+				if (address_family != 0) {
+					fprintf(stderr, "Options -4 and -6 cannot be specified at the same time\n");
+					exit(EXIT_FAILURE);
+				}
+				address_family = 1;
+			} else if (strncmp("-6", argv[i], 3) == 0) {
+				if (address_family != 0) {
+					fprintf(stderr, "Options -4 and -6 cannot be specified at the same time\n");
+					exit(EXIT_FAILURE);
+				}
+				address_family = 2;
+			} else if (strncmp("-h", argv[i], 3) == 0) {
+				usage(stdout, argv[0]);
+				exit(EXIT_SUCCESS);
+			} else if (strncmp("-i", argv[i], 2) == 0) {
+				insecure = true;
+			} else if (strncmp("-r", argv[i], 2) == 0) {
+				if (strlen(argv[i]) > 2) {
+					root_file = argv[i]+2;
+				} else if (i+1 >= argc) {
+					usage(stdout, argv[0]);
+					exit(EXIT_FAILURE);
+				} else {
+					root_file = argv[i+1];
+					i++;
+				}
+			} else if (strncmp("-s", argv[i], 3) == 0) {
+				store_in_file = true;
+			} else if (strncmp("-v", argv[i], 2) == 0) {
+				if (strlen(argv[i]) > 2) {
+					verbosity = atoi(argv[i]+2);
+				} else if (i+1 > argc) {
+					usage(stdout, argv[0]);
+					exit(EXIT_FAILURE);
+				} else {
+					verbosity = atoi(argv[i+1]);
+					i++;
+				}
+			} else {
+				/* create a rdf from the command line arg */
+				if (domain) {
+					fprintf(stdout, "You can only specify one domain at a time\n");
+					exit(EXIT_FAILURE);
+				}
+
+				domain = ldns_dname_new_frm_str(argv[i]);
+			}
+
+		}
+		if (!domain) {
+			usage(stdout, argv[0]);
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	dns_root = read_root_hints(root_file);
+	if (!dns_root) {
+		fprintf(stderr, "cannot read the root hints file\n");
+		exit(EXIT_FAILURE);
+	}
+
+	/* create a new resolver from /etc/resolv.conf */
+	status = ldns_resolver_new_frm_file(&res, NULL);
+
+	if (status != LDNS_STATUS_OK) {
+		fprintf(stderr, "Warning: Unable to create stub resolver from /etc/resolv.conf:\n");
+		fprintf(stderr, "%s\n", ldns_get_errorstr_by_id(status));
+		fprintf(stderr, "defaulting to nameserver at 127.0.0.1 for separate nameserver name lookups\n");
+		do {
+			res = ldns_resolver_new();
+			if (res) {
+				ns = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_A,
+						"127.0.0.1");
+				if (ns) {
+					status = ldns_resolver_push_nameserver(
+							res, ns);
+					if (status == LDNS_STATUS_OK) {
+						break;
+					}
+					ldns_rdf_deep_free(ns);
+				}
+				ldns_resolver_free(res);
+			}
+			fprintf(stderr, "Unable to create stub resolver: %s\n",
+					ldns_get_errorstr_by_id(status));
+			exit(EXIT_FAILURE);
+
+		} while (false);
+		ldns_rdf_deep_free(ns);
+	}
+
+	ldns_resolver_set_ip6(res, address_family);
+
+	if (insecure) {
+		pkt = ldns_resolver_query(res, domain, LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN, LDNS_RD);
+		if (pkt) {
+		l = ldns_pkt_rr_list_by_type(pkt, LDNS_RR_TYPE_DNSKEY, LDNS_SECTION_ANY_NOQUESTION);
+		}
+	} else {
+		l = retrieve_dnskeys(res, domain, LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN, dns_root);
+	}
+	
+	/* separator for result data and verbosity data */
+	if (verbosity > 0) {
+		fprintf(stdout, "; ---------------------------\n");
+		fprintf(stdout, "; Got the following keys:\n");
+	}
+	if (l) {
+		if (store_in_file) {
+			/* create filename:
+			 * K<domain>.+<alg>.+<id>.key
+			 */
+			for (i = 0; (size_t) i < ldns_rr_list_rr_count(l); i++) {
+				k = ldns_rr_list_rr(l, (size_t) i);
+				
+				outputfile_buffer = ldns_buffer_new(300);
+				domain_str = ldns_rdf2str(ldns_rr_owner(k));
+				ldns_buffer_printf(outputfile_buffer, "K%s+%03u+%05u.key", domain_str, ldns_rdf2native_int8(ldns_rr_rdf(k, 2)),
+					(unsigned int) ldns_calc_keytag(k));
+				outputfile_str = ldns_buffer_export(outputfile_buffer);
+				
+				if (verbosity >= 1) {
+					fprintf(stdout, "Writing key to file %s\n", outputfile_str);
+				}
+				
+				outputfile = fopen(outputfile_str, "w");
+				if (!outputfile) {
+					fprintf(stderr, "Error writing key to file %s: %s\n", outputfile_str, strerror(errno));
+				} else {
+					ldns_rr_print(outputfile, k);
+					fclose(outputfile);
+				}
+				
+				LDNS_FREE(domain_str);
+				LDNS_FREE(outputfile_str);
+				LDNS_FREE(outputfile_buffer);
+			}
+		} else {
+			ldns_rr_list_print(stdout, l);
+		}
+	} else {
+		fprintf(stderr, "no answer packet received, stub resolver config:\n");
+		ldns_resolver_print(stderr, res);
+	}
+
+	ldns_rdf_deep_free(domain);
+	ldns_resolver_deep_free(res);
+	ldns_rr_list_deep_free(l);
+	ldns_rr_list_deep_free(dns_root);
+	return EXIT_SUCCESS;
+}
diff --git a/contrib/ldns/examples/ldns-keygen.1 b/contrib/ldns/examples/ldns-keygen.1
new file mode 100644
index 00000000000000..4bb9fec2dd7075
--- /dev/null
+++ b/contrib/ldns/examples/ldns-keygen.1
@@ -0,0 +1,69 @@
+.TH ldns-keygen 1 "27 May 2008"
+.SH NAME
+ldns-keygen \- generate a DNSSEC key pair
+.SH SYNOPSIS
+.B ldns-keygen 
+[
+.IR OPTION
+]
+.IR DOMAIN 
+
+.SH DESCRIPTION
+\fBldns-keygen\fR is used to generate a private/public keypair. When run, it
+will create 3 files; a .key file with the public DNSKEY, a .private
+file with the private keydata and a .ds with the DS record of the
+DNSKEY record.
+
+\fBldns-keygen\fR can also be used to create symmetric keys (for TSIG) by
+selecting the appropriate algorithm: \%\fIhmac-md5.sig-alg.reg.int\fR,
+\%\fIhmac-sha1\fR, \%\fIhmac-sha224\fR, \%\fIhmac-sha256\fR, \%\fIhmac-sha384\fR or \%\fIhmac-sha512\fR.
+In that case no DS record will be created and no .ds file.
+
+\fBldns-keygen\fR prints the basename for the key files:
+K<name>+<alg>+<id>
+
+.SH OPTIONS
+.TP
+\fB-a \fI<algorithm>\fR 
+Create a key with this algorithm. Specifying 'list' here gives a list of supported algorithms.
+Several alias names are also accepted (from older versions and other software),
+the list gives names from the RFC.  Also the plain algo number is accepted.
+
+.TP
+\fB-b \fI<bits>\fR 
+Use this many bits for the key length.
+
+.TP
+\fB-k\fR 
+When given, generate a key signing key. This just sets the flag field to
+257 instead of 256 in the DNSKEY RR in the .key file.
+
+.TP
+\fB-r \fIdevice\fR
+Make ldns-keygen use this file to seed the random generator with. This will
+default to /dev/random.
+
+.TP
+\fB-s\fR
+ldns-keygen will create symbolic links named \fB.private\fR to
+the new generated private key, \fB.key\fR to the public DNSKEY
+and \fB.ds\fR to the file containing DS record data.
+
+.TP
+\fB-f\fR
+force symlinks to be overwritten if they exist.
+
+.TP
+\fB-v\fR
+Show the version and exit
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005-2008 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-keygen.c b/contrib/ldns/examples/ldns-keygen.c
new file mode 100644
index 00000000000000..2f690b69822303
--- /dev/null
+++ b/contrib/ldns/examples/ldns-keygen.c
@@ -0,0 +1,471 @@
+/*
+ * keygen is a small programs that generate a dnskey and private key
+ * for a particular domain.
+ *
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+
+#include <ldns/ldns.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <unistd.h>
+
+#ifdef HAVE_SSL
+static void
+usage(FILE *fp, char *prog) {
+	fprintf(fp, "%s -a <algorithm> [-b bits] [-r /dev/random] [-s] [-f] [-v] domain\n",
+		   prog);
+	fprintf(fp, "  generate a new key pair for domain\n");
+	fprintf(fp, "  -a <alg>\tuse the specified algorithm (-a list to");
+	fprintf(fp, " show a list)\n");
+	fprintf(fp, "  -k\t\tset the flags to 257; key signing key\n");
+	fprintf(fp, "  -b <bits>\tspecify the keylength\n");
+	fprintf(fp, "  -r <random>\tspecify a random device (defaults to /dev/random)\n");
+	fprintf(fp, "\t\tto seed the random generator with\n");
+	fprintf(fp, "  -s\t\tcreate additional symlinks with constant names\n");
+	fprintf(fp, "  -f\t\tforce override of existing symlinks\n");
+	fprintf(fp, "  -v\t\tshow the version and exit\n");
+	fprintf(fp, "  The following files will be created:\n");
+	fprintf(fp, "    K<name>+<alg>+<id>.key\tPublic key in RR format\n");
+	fprintf(fp, "    K<name>+<alg>+<id>.private\tPrivate key in key format\n");
+	fprintf(fp, "    K<name>+<alg>+<id>.ds\tDS in RR format (only for DNSSEC KSK keys)\n");
+	fprintf(fp, "  The base name (K<name>+<alg>+<id> will be printed to stdout\n");
+}
+
+static void
+show_algorithms(FILE *out)
+{
+	ldns_lookup_table *lt = ldns_signing_algorithms;
+	fprintf(out, "Possible algorithms:\n");
+
+	while (lt->name) {
+		fprintf(out, "%s\n", lt->name);
+		lt++;
+	}
+}
+
+static int
+remove_symlink(const char *symlink_name)
+{
+	int result;
+
+	if ((result = unlink(symlink_name)) == -1) {
+		if (errno == ENOENT) {
+			/* it's OK if the link simply didn't exist */
+			result = 0;
+		} else {
+			/* error if unlink fail */
+			fprintf(stderr, "Can't delete symlink %s: %s\n", symlink_name, strerror(errno));
+		}
+	}
+	return result;
+}
+
+static int
+create_symlink(const char *symlink_destination, const char *symlink_name)
+{
+	int result = 0;
+
+	if (!symlink_name)
+		return result;  /* no arg "-s" at all */
+
+	if ((result = symlink(symlink_destination, symlink_name)) == -1) {
+		fprintf(stderr, "Unable to create symlink %s -> %s: %s\n", symlink_name, symlink_destination, strerror(errno));
+	}
+	return result;
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c;
+	int fd;
+	char *prog;
+
+	/* default key size */
+	uint16_t def_bits = 1024;
+	uint16_t bits = def_bits;
+	bool had_bits = false;
+	bool ksk;
+
+	FILE *file;
+	FILE *random;
+	char *filename;
+	char *owner;
+	bool symlink_create;
+	bool symlink_override;
+
+	ldns_signing_algorithm algorithm;
+	ldns_rdf *domain;
+	ldns_rr *pubkey;
+	ldns_key *key;
+	ldns_rr *ds;
+
+	prog = strdup(argv[0]);
+	algorithm = 0;
+	random = NULL;
+	ksk = false; /* don't create a ksk per default */
+	symlink_create = false;
+	symlink_override = false;
+
+	while ((c = getopt(argc, argv, "a:kb:r:sfv")) != -1) {
+		switch (c) {
+		case 'a':
+			if (algorithm != 0) {
+				fprintf(stderr, "The -a argument can only be used once\n");
+				exit(1);
+			}
+			if (strncmp(optarg, "list", 5) == 0) {
+				show_algorithms(stdout);
+				exit(EXIT_SUCCESS);
+			}
+			algorithm = ldns_get_signing_algorithm_by_name(optarg);
+			if (algorithm == 0) {
+				fprintf(stderr, "Algorithm %s not found\n", optarg);
+				show_algorithms(stderr);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'b':
+			bits = (uint16_t) atoi(optarg);
+			if (bits == 0) {
+				fprintf(stderr, "%s: %s %d", prog, "Can not parse the -b argument, setting it to the default\n", (int) def_bits);
+				bits = def_bits;
+			} else
+				had_bits = true;
+			break;
+		case 'k':
+			ksk = true;
+			break;
+		case 'r':
+			random = fopen(optarg, "r");
+			if (!random) {
+				fprintf(stderr, "Cannot open random file %s: %s\n", optarg, strerror(errno));
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 's':
+			symlink_create = true;
+			break;
+		case 'f':
+			symlink_override = true;
+			break;
+		case 'v':
+			printf("DNSSEC key generator version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+			exit(EXIT_SUCCESS);
+			break;
+		default:
+			usage(stderr, prog);
+			exit(EXIT_FAILURE);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (algorithm == 0) {
+		printf("Please use the -a argument to provide an algorithm\n");
+		exit(1);
+	}
+
+	if (argc != 1) {
+		usage(stderr, prog);
+		exit(EXIT_FAILURE);
+	}
+	free(prog);
+
+	/* check whether key size is within RFC boundaries */
+	switch (algorithm) {
+	case LDNS_SIGN_RSAMD5:
+	case LDNS_SIGN_RSASHA1:
+	case LDNS_SIGN_RSASHA1_NSEC3:
+	case LDNS_SIGN_RSASHA256:
+	case LDNS_SIGN_RSASHA512:
+		if (bits < 512 || bits > 4096) {
+			fprintf(stderr, "For RSA, the key size must be between ");
+			fprintf(stderr, " 512 and 4096 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+#ifdef USE_DSA
+	case LDNS_SIGN_DSA:
+	case LDNS_SIGN_DSA_NSEC3:
+		if (bits < 512 || bits > 1024) {
+			fprintf(stderr, "For DSA, the key size must be between ");
+			fprintf(stderr, " 512 and 1024 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+#endif /* USE_DSA */
+#ifdef USE_GOST
+	case LDNS_SIGN_ECC_GOST:
+		if(!ldns_key_EVP_load_gost_id()) {
+			fprintf(stderr, "error: libcrypto does not provide GOST\n");
+			exit(EXIT_FAILURE);
+		}
+		break;
+#endif
+#ifdef USE_ECDSA
+	case LDNS_SIGN_ECDSAP256SHA256:
+	case LDNS_SIGN_ECDSAP384SHA384:
+		break;
+#endif
+	case LDNS_SIGN_HMACMD5:
+		if (!had_bits) {
+			bits = 512;
+		} else if (bits < 1 || bits > 512) {
+			fprintf(stderr, "For hmac-md5, the key size must be ");
+			fprintf(stderr, "between 1 and 512 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+	case LDNS_SIGN_HMACSHA1:
+		if (!had_bits) {
+			bits = 160;
+		} else if (bits < 1 || bits > 160) {
+			fprintf(stderr, "For hmac-sha1, the key size must be ");
+			fprintf(stderr, "between 1 and 160 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+
+	case LDNS_SIGN_HMACSHA224:
+		if (!had_bits) {
+			bits = 224;
+		} else if (bits < 1 || bits > 224) {
+			fprintf(stderr, "For hmac-sha224, the key size must be ");
+			fprintf(stderr, "between 1 and 224 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+
+	case LDNS_SIGN_HMACSHA256:
+		if (!had_bits) {
+			bits = 256;
+		} else if (bits < 1 || bits > 256) {
+			fprintf(stderr, "For hmac-sha256, the key size must be ");
+			fprintf(stderr, "between 1 and 256 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+
+	case LDNS_SIGN_HMACSHA384:
+		if (!had_bits) {
+			bits = 384;
+		} else if (bits < 1 || bits > 384) {
+			fprintf(stderr, "For hmac-sha384, the key size must be ");
+			fprintf(stderr, "between 1 and 384 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+
+	case LDNS_SIGN_HMACSHA512:
+		if (!had_bits) {
+			bits = 512;
+		} else if (bits < 1 || bits > 512) {
+			fprintf(stderr, "For hmac-sha512, the key size must be ");
+			fprintf(stderr, "between 1 and 512 bits. Aborting.\n");
+			exit(1);
+		}
+		break;
+	default:
+		break;
+	}
+
+	if (!random) {
+		random = fopen("/dev/random", "r");
+		if (!random) {
+			fprintf(stderr, "Cannot open random file %s: %s\n", optarg, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	(void)ldns_init_random(random, (unsigned int) bits/8);
+	fclose(random);
+
+	/* create an rdf from the domain name */
+	domain = ldns_dname_new_frm_str(argv[0]);
+
+	/* generate a new key */
+	key = ldns_key_new_frm_algorithm(algorithm, bits);
+	if(!key) {
+		fprintf(stderr, "cannot generate key of algorithm %s\n",
+			ldns_pkt_algorithm2str((ldns_algorithm)algorithm));
+		exit(EXIT_FAILURE);
+	}
+
+	/* set the owner name in the key - this is a /separate/ step */
+	ldns_key_set_pubkey_owner(key, domain);
+
+	/* ksk flag */
+	if (ksk) {
+		ldns_key_set_flags(key, ldns_key_flags(key) + 1);
+	}
+
+	/* create the public from the ldns_key */
+	pubkey = ldns_key2rr(key);
+	if (!pubkey) {
+		fprintf(stderr, "Could not extract the public key from the key structure...");
+		ldns_key_deep_free(key);
+		exit(EXIT_FAILURE);
+	}
+	owner = ldns_rdf2str(ldns_rr_owner(pubkey));
+
+	/* calculate and set the keytag */
+	ldns_key_set_keytag(key, ldns_calc_keytag(pubkey));
+
+	/* build the DS record */
+	switch (algorithm) {
+#ifdef USE_ECDSA
+	case LDNS_SIGN_ECDSAP384SHA384:
+		ds = ldns_key_rr2ds(pubkey, LDNS_SHA384);
+		break;
+	case LDNS_SIGN_ECDSAP256SHA256:
+#endif
+#ifdef USE_ED25519
+	case LDNS_SIGN_ED25519:
+#endif
+#ifdef USE_ED448
+	case LDNS_SIGN_ED448:
+#endif
+	case LDNS_SIGN_RSASHA256:
+	case LDNS_SIGN_RSASHA512:
+		ds = ldns_key_rr2ds(pubkey, LDNS_SHA256);
+		break;
+	case LDNS_SIGN_ECC_GOST:
+#ifdef USE_GOST
+		ds = ldns_key_rr2ds(pubkey, LDNS_HASH_GOST);
+#else
+		ds = ldns_key_rr2ds(pubkey, LDNS_SHA256);
+#endif
+		break;
+	default:
+		ds = ldns_key_rr2ds(pubkey, LDNS_SHA1);
+		break;
+	}
+
+	/* maybe a symlinks should be removed */
+	if (symlink_create && symlink_override) {
+		if (remove_symlink(".key") != 0) {
+			exit(EXIT_FAILURE);
+		}
+		if (remove_symlink(".private") != 0) {
+			exit(EXIT_FAILURE);
+		}
+		if (remove_symlink(".ds") != 0) {
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	/* print the public key RR to .key */
+	filename = LDNS_XMALLOC(char, strlen(owner) + 17);
+	snprintf(filename, strlen(owner) + 16, "K%s+%03u+%05u.key", owner, algorithm, (unsigned int) ldns_key_keytag(key));
+	file = fopen(filename, "w");
+	if (!file) {
+		fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
+		ldns_key_deep_free(key);
+		free(owner);
+		ldns_rr_free(pubkey);
+		ldns_rr_free(ds);
+		LDNS_FREE(filename);
+		exit(EXIT_FAILURE);
+	} else {
+		/* temporarily set question so that TTL is not printed */
+		ldns_rr_set_question(pubkey, true);
+		ldns_rr_print(file, pubkey);
+		ldns_rr_set_question(pubkey, false);
+		fclose(file);
+		if (symlink_create) {
+			if (create_symlink(filename, ".key") != 0) {
+				goto silentfail;
+			}
+		}
+		LDNS_FREE(filename);
+	}
+
+	/* print the priv key to stderr */
+	filename = LDNS_XMALLOC(char, strlen(owner) + 21);
+	snprintf(filename, strlen(owner) + 20, "K%s+%03u+%05u.private", owner, algorithm, (unsigned int) ldns_key_keytag(key));
+	/* use open() here to prevent creating world-readable private keys (CVE-2014-3209)*/
+	fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
+	if (fd < 0) {
+		goto fail;
+	}
+
+	file = fdopen(fd, "w");
+	if (!file) {
+		goto fail;
+	}
+
+	ldns_key_print(file, key);
+	fclose(file);
+	if (symlink_create) {
+		if (create_symlink(filename, ".private") != 0) {
+			goto silentfail;
+		}
+	}
+	LDNS_FREE(filename);
+
+	/* print the DS to .ds */
+	if (ksk && algorithm != LDNS_SIGN_HMACMD5 &&
+		algorithm != LDNS_SIGN_HMACSHA1 &&
+		algorithm != LDNS_SIGN_HMACSHA224 &&
+		algorithm != LDNS_SIGN_HMACSHA256 &&
+		algorithm != LDNS_SIGN_HMACSHA384 &&
+		algorithm != LDNS_SIGN_HMACSHA512) {
+		filename = LDNS_XMALLOC(char, strlen(owner) + 16);
+		snprintf(filename, strlen(owner) + 15, "K%s+%03u+%05u.ds", owner, algorithm, (unsigned int) ldns_key_keytag(key));
+		file = fopen(filename, "w");
+		if (!file) {
+			fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
+			ldns_key_deep_free(key);
+			free(owner);
+			ldns_rr_free(pubkey);
+			ldns_rr_free(ds);
+			LDNS_FREE(filename);
+			exit(EXIT_FAILURE);
+		} else {
+			/* temporarily set question so that TTL is not printed */
+			ldns_rr_set_question(ds, true);
+			ldns_rr_print(file, ds);
+			ldns_rr_set_question(ds, false);
+			fclose(file);
+			if (symlink_create) {
+				if (create_symlink(filename, ".ds") != 0) {
+					goto silentfail;
+				}
+			}
+			LDNS_FREE(filename);
+		}
+	}
+
+	fprintf(stdout, "K%s+%03u+%05u\n", owner, algorithm, (unsigned int) ldns_key_keytag(key));
+	ldns_key_deep_free(key);
+	free(owner);
+	ldns_rr_free(pubkey);
+	ldns_rr_free(ds);
+	exit(EXIT_SUCCESS);
+
+fail:
+	fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
+silentfail:
+	ldns_key_deep_free(key);
+	free(owner);
+	ldns_rr_free(pubkey);
+	ldns_rr_free(ds);
+	LDNS_FREE(filename);
+	exit(EXIT_FAILURE);
+}
+#else
+int
+main(int argc, char **argv)
+{
+	fprintf(stderr, "ldns-keygen needs OpenSSL support, which has not been compiled in\n");
+	return 1;
+}
+#endif /* HAVE_SSL */
diff --git a/contrib/ldns/examples/ldns-notify.1 b/contrib/ldns/examples/ldns-notify.1
new file mode 100644
index 00000000000000..c7fbb6f70922e6
--- /dev/null
+++ b/contrib/ldns/examples/ldns-notify.1
@@ -0,0 +1,70 @@
+.TH ldns-notify 1 "9 Jan 2007"
+.SH NAME
+ldns-notify \- notify DNS servers that updates are available
+.SH SYNOPSIS
+.B ldns-notify
+[options]
+\-z zone
+.IR servers 
+
+.SH DESCRIPTION
+
+\fBldns-notify\fR sends a NOTIFY message to DNS servers. This tells them
+that an updated zone is available at the master servers. It can perform
+TSIG signatures and it can add a SOA serial number of the updated zone.
+If a server already has that serial number it will disregard the message.
+
+.SH OPTIONS
+.TP
+\fB-z zone\fR
+The zone that is updated.
+
+.TP
+\fB-I address\fR
+Source IP to send query from.
+
+.TP
+\fB-h\fR
+Show usage and exit
+
+.TP
+\fB-v\fR
+Show the version and exit
+
+.TP
+\fB-s serial\fR
+Append a SOA record indicating the serial number of the updated zone.
+
+.TP
+\fB-p port\fR
+Use port as destination port (default the DNS port 53) for the UDP packets.
+
+.TP
+\fB-y key:data[:algo] \fR
+Use the given TSIG key and base64-data, and optionally an algorithm to sign
+the NOTIFY. The algorithm defaults to hmac-md5.sig-alg.reg.int.
+
+.TP
+\fB-d\fR
+Print verbose debug information. The query that is sent and the query
+that is received.
+
+.TP
+\fB-r num\fR
+Specify the maximum number of retries before notify gives up trying to
+send the UDP packet.
+
+.SH EXIT CODE
+The program exits with a 0 exit code if all servers replied an 
+acknowledgement to the notify message, and a failure exit code otherwise. 
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-notify.c b/contrib/ldns/examples/ldns-notify.c
new file mode 100644
index 00000000000000..bfd1238475ec78
--- /dev/null
+++ b/contrib/ldns/examples/ldns-notify.c
@@ -0,0 +1,402 @@
+/* 
+ * ldns-notify.c - ldns-notify(8)
+ * 
+ * Copyright (c) 2001-2008, NLnet Labs, All right reserved
+ *
+ * See LICENSE for the license
+ *
+ * send a notify packet to a server
+ */
+
+#include "config.h"
+
+/* ldns */
+#include <ldns/ldns.h>
+
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#include <errno.h>
+
+static int verbose = 1;
+static int max_num_retry = 15; /* times to try */
+
+static void
+usage(void)
+{
+	fprintf(stderr, "usage: ldns-notify [other options] -z zone <servers>\n");
+	fprintf(stderr, "Ldns notify utility\n\n");
+	fprintf(stderr, " Supported options:\n");
+	fprintf(stderr, "\t-z zone\t\tThe zone\n");
+	fprintf(stderr, "\t-I <address>\tsource address to query from\n");
+	fprintf(stderr, "\t-s version\tSOA version number to include\n");
+	fprintf(stderr, "\t-y <name:key[:algo]>\tspecify named base64 tsig key"
+	                ", and optional an\n\t\t\t"
+	                "algorithm (defaults to hmac-md5.sig-alg.reg.int)\n");
+	fprintf(stderr, "\t-p port\t\tport to use to send to\n");
+	fprintf(stderr, "\t-v\t\tPrint version information\n");
+	fprintf(stderr, "\t-d\t\tPrint verbose debug information\n");
+	fprintf(stderr, "\t-r num\t\tmax number of retries (%d)\n", 
+		max_num_retry);
+	fprintf(stderr, "\t-h\t\tPrint this help information\n\n");
+	fprintf(stderr, "Report bugs to <ldns-team@nlnetlabs.nl>\n");
+	exit(1);
+}
+
+static void
+version(void)
+{
+        fprintf(stderr, "%s version %s\n", PACKAGE_NAME, PACKAGE_VERSION);
+        fprintf(stderr, "Written by NLnet Labs.\n\n");
+        fprintf(stderr,
+                "Copyright (C) 2001-2008 NLnet Labs.  This is free software.\n"
+                "There is NO warranty; not even for MERCHANTABILITY or FITNESS\n"
+                "FOR A PARTICULAR PURPOSE.\n");
+        exit(0);
+}
+
+static void
+notify_host(int s, struct addrinfo* res, uint8_t* wire, size_t wiresize,
+	const char* addrstr)
+{
+	int timeout_retry = 5; /* seconds */
+	int num_retry = max_num_retry;
+#ifndef S_SPLINT_S
+	fd_set rfds;
+#endif
+	struct timeval tv;
+	int retval = 0;
+	ssize_t received = 0;
+	int got_ack = 0;
+	socklen_t addrlen = 0;
+	uint8_t replybuf[2048];
+	ldns_status status;
+	ldns_pkt* pkt = NULL;
+	
+	while(!got_ack) {
+		/* send it */
+		if(sendto(s, (void*)wire, wiresize, 0, 
+			res->ai_addr, res->ai_addrlen) == -1) {
+			printf("warning: send to %s failed: %s\n",
+				addrstr, strerror(errno));
+#ifndef USE_WINSOCK
+			close(s);
+#else
+			closesocket(s);
+#endif
+			return;
+		}
+
+		/* wait for ACK packet */
+#ifndef S_SPLINT_S
+		FD_ZERO(&rfds);
+		FD_SET(s, &rfds);
+		tv.tv_sec = timeout_retry; /* seconds */
+#endif
+		tv.tv_usec = 0; /* microseconds */
+		retval = select(s + 1, &rfds, NULL, NULL, &tv);
+		if (retval == -1) {
+			printf("error waiting for reply from %s: %s\n",
+				addrstr, strerror(errno));
+#ifndef USE_WINSOCK
+			close(s);
+#else
+			closesocket(s);
+#endif
+			return;
+		}
+		if(retval == 0) {
+			num_retry--;
+			if(num_retry == 0) {
+				printf("error: failed to send notify to %s.\n",
+					addrstr);
+				exit(1);
+			}
+			printf("timeout (%d s) expired, retry notify to %s.\n",
+				timeout_retry, addrstr);
+		}
+		if (retval == 1) {
+			got_ack = 1;
+		}
+	}
+
+	/* got reply */
+	addrlen = res->ai_addrlen;
+	received = recvfrom(s, (void*)replybuf, sizeof(replybuf), 0,
+		res->ai_addr, &addrlen);
+	res->ai_addrlen = addrlen;
+
+#ifndef USE_WINSOCK
+	close(s);
+#else
+	closesocket(s);
+#endif
+	if (received == -1) {
+		printf("recv %s failed: %s\n", addrstr, strerror(errno));
+		return;
+	}
+
+	/* check reply */
+	status = ldns_wire2pkt(&pkt, replybuf, (size_t)received);
+	if(status != LDNS_STATUS_OK) {
+		ssize_t i;
+		printf("Could not parse reply packet: %s\n",
+			ldns_get_errorstr_by_id(status));
+		if (verbose > 1) {
+			printf("hexdump of reply: ");
+			for(i=0; i<received; i++)
+				printf("%02x", (unsigned)replybuf[i]);
+			printf("\n");
+		}
+		exit(1);
+	}
+
+	if(verbose) {
+		ssize_t i;
+		printf("# reply from %s:\n", addrstr);
+		ldns_pkt_print(stdout, pkt);
+		if (verbose > 1) {
+			printf("hexdump of reply: ");
+			for(i=0; i<received; i++)
+				printf("%02x", (unsigned)replybuf[i]);
+			printf("\n");
+		}
+	}
+	ldns_pkt_free(pkt);
+}
+
+int
+main(int argc, char **argv)
+{
+	int c;
+	int i;
+
+	/* LDNS types */
+	ldns_pkt *notify;
+	ldns_rr *question;
+	ldns_rdf *ldns_zone_name = NULL;
+	ldns_status status;
+	const char *zone_name = NULL;
+	int include_soa = 0;
+	uint32_t soa_version = 0;
+	int do_hexdump = 1;
+	uint8_t *wire = NULL;
+	size_t wiresize = 0;
+	const char *port = "53";
+	char *tsig_sep;
+	const char *tsig_name = NULL, *tsig_data = NULL, *tsig_algo = NULL;
+	int error;
+	struct addrinfo from_hints, *from0 = NULL;
+
+	srandom(time(NULL) ^ getpid());
+
+        while ((c = getopt(argc, argv, "vhdp:r:s:y:z:I:")) != -1) {
+                switch (c) {
+                case 'd':
+			verbose++;
+			break;
+                case 'p':
+			port = optarg;
+			break;
+                case 'r':
+			max_num_retry = atoi(optarg);
+			break;
+                case 's':
+			include_soa = 1;
+			soa_version = (uint32_t)atoi(optarg);
+			break;
+                case 'y':
+			if (!(tsig_sep = strchr(optarg, ':'))) {
+				printf("TSIG argument is not in form "
+					"<name:key[:algo]> %s\n", optarg);
+				exit(1);
+			}
+			tsig_name = optarg;
+			*tsig_sep++ = '\0';
+			tsig_data = tsig_sep;
+			if ((tsig_sep = strchr(tsig_sep, ':'))) {
+				*tsig_sep++ = '\0';
+				tsig_algo = tsig_sep;
+			} else {
+				tsig_algo = "hmac-md5.sig-alg.reg.int.";
+			}
+			/* With dig TSIG keys are also specified with -y,
+			 * but format with drill is: -y <name:key[:algo]>
+			 *             and with dig: -y [hmac:]name:key
+			 *
+			 * When we detect an unknown tsig algorithm in algo,
+			 * but a known algorithm in name, we cane assume dig
+			 * order was used.
+			 *
+			 * Following if statement is to anticipate and correct
+			 * dig order
+			 */
+			if (strcasecmp(tsig_algo, "hmac-md5.sig-alg.reg.int")&&
+			    strcasecmp(tsig_algo, "hmac-md5")                &&
+			    strcasecmp(tsig_algo, "hmac-sha1")               &&
+			    strcasecmp(tsig_algo, "hmac-sha256")             &&
+			    strcasecmp(tsig_algo, "hmac-sha384")             &&
+			    strcasecmp(tsig_algo, "hmac-sha512")             &&
+			    ! (strcasecmp(tsig_name, "hmac-md5.sig-alg.reg.int")
+			    && strcasecmp(tsig_name, "hmac-md5")
+			    && strcasecmp(tsig_name, "hmac-sha1")
+			    && strcasecmp(tsig_name, "hmac-sha256")
+			    && strcasecmp(tsig_name, "hmac-sha384")
+			    && strcasecmp(tsig_name, "hmac-sha512"))) {
+
+				/* Roll options */
+				const char *tmp_tsig_algo = tsig_name;
+				tsig_name = tsig_data;
+				tsig_data = tsig_algo;
+				tsig_algo = tmp_tsig_algo;
+			}	
+			printf("Sign with name: %s, data: %s, algorithm: %s\n"
+			      , tsig_name, tsig_data, tsig_algo);
+			break;
+                case 'z':
+			zone_name = optarg;
+			ldns_zone_name = ldns_dname_new_frm_str(zone_name);
+			if(!ldns_zone_name) {
+				printf("cannot parse zone name: %s\n", 
+					zone_name);
+				exit(1);
+			}
+                        break;
+		case 'I':
+			memset(&from_hints, 0, sizeof(from_hints));
+			from_hints.ai_family = AF_UNSPEC;
+			from_hints.ai_socktype = SOCK_DGRAM;
+			from_hints.ai_protocol = IPPROTO_UDP;
+			from_hints.ai_flags = AI_NUMERICHOST;
+			error = getaddrinfo(optarg, 0, &from_hints, &from0);
+			if (error) {
+				printf("bad address: %s: %s\n", optarg,
+					gai_strerror(error));
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'v':
+			version();
+			/* fallthrough */
+                case 'h':
+                case '?':
+                default:
+                        usage();
+                }
+        }
+        argc -= optind;
+        argv += optind;
+
+        if (argc == 0 || zone_name == NULL) {
+                usage();
+        }
+
+	notify = ldns_pkt_new();
+	question = ldns_rr_new();
+
+	if (!notify || !question) {
+		/* bail out */
+		printf("error: cannot create ldns types\n");
+		exit(1);
+	}
+
+	/* create the rr for inside the pkt */
+	ldns_rr_set_class(question, LDNS_RR_CLASS_IN);
+	ldns_rr_set_owner(question, ldns_zone_name);
+	ldns_rr_set_type(question, LDNS_RR_TYPE_SOA);
+	ldns_rr_set_question(question, true);
+	ldns_pkt_set_opcode(notify, LDNS_PACKET_NOTIFY);
+	ldns_pkt_push_rr(notify, LDNS_SECTION_QUESTION, question);
+	ldns_pkt_set_aa(notify, true);
+	ldns_pkt_set_random_id(notify);
+	if(include_soa) {
+		char buf[10240];
+		ldns_rr *soa_rr=NULL;
+		ldns_rdf *prev=NULL;
+		snprintf(buf, sizeof(buf), "%s 3600 IN SOA . . %u 0 0 0 0",
+			zone_name, (unsigned)soa_version);
+		/*printf("Adding soa %s\n", buf);*/
+		status = ldns_rr_new_frm_str(&soa_rr, buf, 3600, NULL, &prev);
+		if(status != LDNS_STATUS_OK) {
+			printf("Error adding SOA version: %s\n",
+				ldns_get_errorstr_by_id(status));
+		}
+		ldns_pkt_push_rr(notify, LDNS_SECTION_ANSWER, soa_rr);
+	}
+
+	if(tsig_name && tsig_data) {
+#ifdef HAVE_SSL
+		status = ldns_pkt_tsig_sign(notify, tsig_name,
+			tsig_data, 300, tsig_algo, NULL);
+		if(status != LDNS_STATUS_OK) {
+			printf("Error TSIG sign query: %s\n",
+				ldns_get_errorstr_by_id(status));
+		}
+#else
+	fprintf(stderr, "Warning: TSIG needs OpenSSL support, which has not been compiled in, TSIG skipped\n");
+#endif
+	}
+
+	if(verbose) {
+		printf("# Sending packet:\n");
+		ldns_pkt_print(stdout, notify);
+
+	}
+
+	status = ldns_pkt2wire(&wire, notify, &wiresize);
+	if (status) {
+		printf("Error converting notify packet to hex: %s\n",
+				ldns_get_errorstr_by_id(status));
+	} else if(wiresize == 0) {
+		printf("Error converting notify packet to hex.\n");
+		exit(1);
+	}
+	if(do_hexdump && verbose > 1) {
+		printf("Hexdump of notify packet:\n");
+		for(i=0; i<(int)wiresize; i++)
+			printf("%02x", (unsigned)wire[i]);
+		printf("\n");
+	}
+
+	for(i=0; i<argc; i++)
+	{
+		struct addrinfo hints, *res0, *ai_res;
+		int default_family = AF_UNSPEC;
+
+		if(verbose)
+			printf("# sending to %s\n", argv[i]);
+		memset(&hints, 0, sizeof(hints));
+		hints.ai_family = default_family;
+		/* if(strchr(argv[i], ':')) hints.ai_family = AF_INET6; */
+		hints.ai_socktype = SOCK_DGRAM;
+		hints.ai_protocol = IPPROTO_UDP;
+		error = getaddrinfo(argv[i], port, &hints, &res0);
+		if (error) {
+			printf("skipping bad address: %s: %s\n", argv[i],
+				gai_strerror(error));
+			continue;
+		}
+		for (ai_res = res0; ai_res; ai_res = ai_res->ai_next) {
+			int s;
+
+			if (from0 && ai_res->ai_family != from0->ai_family)
+				continue;
+
+		        s = socket(ai_res->ai_family, ai_res->ai_socktype, 
+				ai_res->ai_protocol);
+			if(s == -1)
+				continue;
+			if (from0 && bind(s, from0->ai_addr, from0->ai_addrlen)) {
+				perror("Could not bind to source IP");
+				exit(EXIT_FAILURE);
+			}
+			/* send the notify */
+			notify_host(s, ai_res, wire, wiresize, argv[i]);
+		}
+		freeaddrinfo(res0);
+	}
+
+	ldns_pkt_free(notify);
+	free(wire);
+        return 0;
+}
diff --git a/contrib/ldns/examples/ldns-nsec3-hash.c b/contrib/ldns/examples/ldns-nsec3-hash.c
new file mode 100644
index 00000000000000..f9325d3bd52561
--- /dev/null
+++ b/contrib/ldns/examples/ldns-nsec3-hash.c
@@ -0,0 +1,132 @@
+/*
+ * ldns-signzone signs a zone file
+ * 
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <errno.h>
+
+#include <time.h>
+
+#include <ldns/ldns.h>
+#include <ldns/keys.h>
+
+#ifdef HAVE_SSL
+#include <openssl/conf.h>
+#include <openssl/engine.h>
+#endif /* HAVE_SSL */
+
+#define MAX_FILENAME_LEN 250
+int verbosity = 1;
+
+static void
+usage(FILE *fp, const char *prog) {
+	fprintf(fp, "%s [OPTIONS] <domain name>\n", prog);
+	fprintf(fp, "  prints the NSEC3 hash of the given domain name\n");
+	fprintf(fp, "-a [algorithm] hashing algorithm\n");
+	fprintf(fp, "-t [number] number of hash iterations\n");
+	fprintf(fp, "-s [string] salt\n");
+}
+
+int
+main(int argc, char *argv[])
+{
+	ldns_rdf *dname, *hashed_dname;
+	uint8_t nsec3_algorithm = 1;
+	size_t nsec3_iterations_cmd = 1;
+	uint16_t nsec3_iterations = 1;
+	uint8_t nsec3_salt_length = 0;
+	uint8_t *nsec3_salt = NULL;
+	
+	char *prog = strdup(argv[0]);
+
+	int c;
+	while ((c = getopt(argc, argv, "a:s:t:")) != -1) {
+		switch (c) {
+		case 'a':
+			nsec3_algorithm = (uint8_t) atoi(optarg);
+			break;
+		case 's':
+			if (strlen(optarg) % 2 != 0) {
+				fprintf(stderr, "Salt value is not valid hex data, not a multiple of 2 characters\n");
+				exit(EXIT_FAILURE);
+			}
+			if (strlen(optarg) > 512) {
+				fprintf(stderr, "Salt too long\n");
+				exit(EXIT_FAILURE);
+			}
+			if (nsec3_salt) LDNS_FREE(nsec3_salt);
+			nsec3_salt_length = (uint8_t) (strlen(optarg) / 2);
+			nsec3_salt = LDNS_XMALLOC(uint8_t, nsec3_salt_length);
+			for (c = 0; c < (int) strlen(optarg); c += 2) {
+				if (isxdigit((int) optarg[c]) && isxdigit((int) optarg[c+1])) {
+					nsec3_salt[c/2] = (uint8_t) ldns_hexdigit_to_int(optarg[c]) * 16 +
+						ldns_hexdigit_to_int(optarg[c+1]);
+				} else {
+					fprintf(stderr, "Salt value is not valid hex data.\n");
+					exit(EXIT_FAILURE);
+				}
+			}
+
+			break;
+		case 't':
+			nsec3_iterations_cmd = (size_t) atol(optarg);
+			if (nsec3_iterations_cmd > LDNS_NSEC3_MAX_ITERATIONS) {
+				fprintf(stderr, "Iterations count can not exceed %u, quitting\n", LDNS_NSEC3_MAX_ITERATIONS);
+				exit(EXIT_FAILURE);
+			}
+			nsec3_iterations = (uint16_t) nsec3_iterations_cmd;
+			break;
+		default:
+			usage(stderr, prog);
+			exit(EXIT_SUCCESS);
+		}
+	}
+	
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		printf("Error: not enough arguments\n");
+		usage(stdout, prog);
+		exit(EXIT_FAILURE);
+	} else {
+		dname = ldns_dname_new_frm_str(argv[0]);
+		if (!dname) {
+			free(prog);
+			if (nsec3_salt) free(nsec3_salt);
+			fprintf(stderr,
+			        "Error: unable to parse domain name\n");
+			return EXIT_FAILURE;
+		}
+		hashed_dname = ldns_nsec3_hash_name(dname,
+		                                    nsec3_algorithm,
+		                                    nsec3_iterations,
+		                                    nsec3_salt_length,
+		                                    nsec3_salt);
+		if (!hashed_dname) {
+			free(prog);
+			if (nsec3_salt) free(nsec3_salt);
+			fprintf(stderr,
+			        "Error creating NSEC3 hash\n");
+			return EXIT_FAILURE;
+		}
+		ldns_rdf_print(stdout, hashed_dname);
+		printf("\n");
+		ldns_rdf_deep_free(dname);
+		ldns_rdf_deep_free(hashed_dname);
+	}
+
+	if (nsec3_salt) {
+		free(nsec3_salt);
+	}
+
+	free(prog);
+	
+	return EXIT_SUCCESS;
+}
diff --git a/contrib/ldns/examples/ldns-read-zone.1 b/contrib/ldns/examples/ldns-read-zone.1
new file mode 100644
index 00000000000000..18c9f6dbf69dc5
--- /dev/null
+++ b/contrib/ldns/examples/ldns-read-zone.1
@@ -0,0 +1,113 @@
+.TH ldns-read-zone 1 "30 May 2005"
+.SH NAME
+ldns-read-zone \- read a zonefile and print it
+.SH SYNOPSIS
+.B ldns-read-zone 
+.IR ZONEFILE 
+
+.SH DESCRIPTION
+
+\fBldns-read-zone\fR reads a DNS zone file and prints it. The output has 1
+resource record per line, and no pretty-printing makeup.
+
+.SH OPTIONS
+.TP
+\fB-0\fR
+Print a (null) for the RRSIG inception, expiry and key data. This option
+can be used when comparing different signing systems that use the same
+DNSKEYs for signing but would have a slightly different timings/jitter.
+
+.TP
+\fB-b\fR
+Include Bubble Babble encoding of DS's.
+
+.TP
+\fB-c\fR
+Canonicalize all resource records in the zone before printing
+
+.TP
+\fB-d\fR
+Only print DNSSEC data from the zone. This option skips every record
+that is not of type NSEC, NSEC3 or RRSIG. DNSKEY and DS records are not
+printed.
+
+.TP
+\fB-e\fR \fIRR type\fR
+Do not print RRs of the given \fIrr type\fR.
+This option may be given multiple times.
+\fB-e\fR is not meant to be used together with \fB-E\fR.
+
+.TP
+\fB-E\fR \fIRR type\fR
+Print only RRs of the given \fIrr type\fR.
+This option may be given multiple times.
+\fB-E\fR is not meant to be used together with \fB-e\fR.
+
+.TP
+\fB-h\fR
+Show usage and exit
+
+.TP
+\fB-n\fR
+Do not print the SOA record
+
+.TP
+\fB-p\fR
+Pad the SOA serial number with spaces so the number and the spaces together
+take ten characters. This is useful for in file serial number increments.
+
+.TP
+\fB-s\fR
+Strip DNSSEC data from the zone. This option skips every record
+that is of type NSEC, NSEC3 or RRSIG. DNSKEY and DS records are still
+printed.
+
+.TP
+\fB-S\fR \fI[[+|0]number | YYYYMMDDxx | unixtime ]\fR
+Set serial number to the given \fInumber\fR, or when preceded by a sign,
+offset the existing number with it. When giving the literal strings
+\fIYYYYMMDDxx\fR or \fIunixtime\fR, the serial number is tried to be reset
+in datecounter or in unixtime format respectively. Though is the updated serial
+number is smaller than the original one, the original one is simply
+increased by one.
+
+When updating a serial number, records of type NSEC, NSEC3, RRSIG and DNSKEY
+will be skipped when printing the zone.
+
+.TP
+\fB-u\fR \fIRR type\fR
+Mark \fIRR type\fR for printing in unknown type format.
+
+\fB-u\fR is not meant to be used together with \fB-U\fR.
+
+.TP
+\fB-U\fR \fIRR type\fR
+Mark \fIRR type\fR for \fBnot\fR printing in unknown type format.
+
+The first occurrence of the \fB-U\fR option marks all RR types for printing
+in unknown type format except for the given \fIRR type\fR.
+Subsequent \fB-U\fR options will clear the mark for those \fIRR type\fRs too,
+so that only the given \fIRR type\fRs will be printed in the presentation 
+format specific for those \fIRR type\fRs.
+
+\fB-U\fR is not meant to be used together with \fB-u\fR.
+
+.TP
+\fB-v\fR
+Show the version and exit
+
+.TP
+\fB-z\fR
+Sort the zone before printing (this implies \-c)
+
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-read-zone.c b/contrib/ldns/examples/ldns-read-zone.c
new file mode 100644
index 00000000000000..2a1bc99a32cb0d
--- /dev/null
+++ b/contrib/ldns/examples/ldns-read-zone.c
@@ -0,0 +1,307 @@
+/*
+ * read a zone file from disk and prints it, one RR per line
+ *
+ * (c) NLnetLabs 2005-2008
+ *
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <ldns/ldns.h>
+#include <ldns/host2str.h>
+
+#include <errno.h>
+
+static void print_usage(const char* progname)
+{
+	printf("Usage: %s [OPTIONS] <zonefile>\n", progname);
+	printf("\tReads the zonefile and prints it.\n");
+	printf("\tThe RR count of the zone is printed to stderr.\n");
+	printf("\t-0 zeroize timestamps and signature in RRSIG records.\n");
+	printf("\t-b include Bubble Babble encoding of DS's.\n");
+	printf("\t-c canonicalize all rrs in the zone.\n");
+	printf("\t-d only show DNSSEC data from the zone\n");
+	printf("\t-e <rr type>\n");
+	printf("\t\tDo not print RRs of the given <rr type>.\n");
+	printf("\t\tThis option may be given multiple times.\n");
+	printf("\t\t-e is not meant to be used together with -E.\n");
+	printf("\t-E <rr type>\n");
+	printf("\t\tPrint only RRs of the given <rr type>.\n");
+	printf("\t\tThis option may be given multiple times.\n");
+	printf("\t\t-E is not meant to be used together with -e.\n");
+	printf("\t-h show this text\n");
+	printf("\t-n do not print the SOA record\n");
+	printf("\t-p prepend SOA serial with spaces so"
+		" it takes exactly ten characters.\n");
+	printf("\t-s strip DNSSEC data from the zone\n");
+	printf("\t-S [[+|-]<number> | YYYYMMDDxx | "
+			" unixtime ]\n"
+		"\t\tSet serial number to <number> or,"
+			" when preceded by a sign,\n"
+		"\t\toffset the existing number with "
+			"<number>.  With YYYYMMDDxx\n"
+		"\t\tthe serial is formatted as a datecounter"
+			", and with unixtime as\n"
+		"\t\tthe number of seconds since 1-1-1970."
+			"  However, on serial\n"
+		"\t\tnumber decrease, +1 is used in stead"
+			".  (implies -s)\n");
+	printf("\t-u <rr type>\n");
+	printf("\t\tMark <rr type> for printing in unknown type format.\n");
+	printf("\t\tThis option may be given multiple times.\n");
+	printf("\t\t-u is not meant to be used together with -U.\n");
+	printf("\t-U <rr type>\n");
+	printf("\t\tMark <rr type> for not printing in unknown type format.\n");
+	printf("\t\tThis option may be given multiple times.\n");
+	printf(
+	"\t\tThe first occurrence of the -U option marks all RR types for"
+	"\n\t\tprinting in unknown type format except for the given <rr type>."
+	"\n\t\tSubsequent -U options will clear the mark for those <rr type>s"
+	"\n\t\ttoo, so that only the given <rr type>s will be printed in the"
+	"\n\t\tpresentation format specific for those <rr type>s.\n");
+	printf("\t\t-U is not meant to be used together with -u.\n");
+	printf("\t-v shows the version and exits\n");
+	printf("\t-z sort the zone (implies -c).\n");
+	printf("\nif no file is given standard input is read\n");
+	exit(EXIT_SUCCESS);
+}
+
+static void exclude_type(ldns_rdf **show_types, ldns_rr_type t)
+{
+	ldns_status s;
+
+	assert(show_types != NULL);
+
+	if (! *show_types && LDNS_STATUS_OK !=
+			(s = ldns_rdf_bitmap_known_rr_types(show_types)))
+		goto fail;
+
+	s =  ldns_nsec_bitmap_clear_type(*show_types, t);
+	if (s == LDNS_STATUS_OK)
+		return;
+fail:
+	fprintf(stderr, "Cannot exclude rr type %s: %s\n"
+	              , ldns_rr_descript(t)->_name
+		      , ldns_get_errorstr_by_id(s));
+	exit(EXIT_FAILURE);
+}
+
+static void include_type(ldns_rdf **show_types, ldns_rr_type t)
+{
+	ldns_status s;
+
+	assert(show_types != NULL);
+
+	if (! *show_types && LDNS_STATUS_OK !=
+			(s = ldns_rdf_bitmap_known_rr_types_space(show_types)))
+		goto fail;
+
+	s =  ldns_nsec_bitmap_set_type(*show_types, t);
+	if (s == LDNS_STATUS_OK)
+		return;
+fail:
+	fprintf(stderr, "Cannot exclude all rr types except %s: %s\n"
+	              , ldns_rr_descript(t)->_name
+		      , ldns_get_errorstr_by_id(s));
+	exit(EXIT_FAILURE);
+}
+
+int
+main(int argc, char **argv)
+{
+	char *filename;
+	FILE *fp;
+	ldns_zone *z;
+	int line_nr = 0;
+	int c;
+	bool canonicalize = false;
+	bool sort = false;
+	bool print_soa = true;
+	ldns_status s;
+	size_t i;
+	ldns_rr_list *stripped_list;
+	ldns_rr *cur_rr;
+	ldns_output_format_storage fmt_storage;
+	ldns_output_format* fmt = ldns_output_format_init(&fmt_storage);
+	ldns_rdf *show_types = NULL;
+
+	ldns_soa_serial_increment_func_t soa_serial_increment_func = NULL;
+	int soa_serial_increment_func_data = 0;
+
+        while ((c = getopt(argc, argv, "0bcde:E:hnpsS:u:U:vz")) != -1) {
+                switch(c) {
+			case '0':
+				fmt->flags |= LDNS_FMT_ZEROIZE_RRSIGS;
+				break;
+			case 'b':
+				fmt->flags |= 
+					( LDNS_COMMENT_BUBBLEBABBLE |
+					  LDNS_COMMENT_FLAGS        );
+				break;
+                	case 'c':
+                		canonicalize = true;
+                		break;
+                	case 'd':
+				include_type(&show_types, LDNS_RR_TYPE_RRSIG);
+				include_type(&show_types, LDNS_RR_TYPE_NSEC);
+				include_type(&show_types, LDNS_RR_TYPE_NSEC3);
+				break;
+			case 'e':
+				exclude_type(&show_types, 
+					ldns_get_rr_type_by_name(optarg));
+				break;
+			case 'E':
+				include_type(&show_types, 
+					ldns_get_rr_type_by_name(optarg));
+				break;
+			case 'h':
+				print_usage("ldns-read-zone");
+				break;
+			case 'n':
+				print_soa = false;
+				break;
+			case 'p':
+				fmt->flags |= LDNS_FMT_PAD_SOA_SERIAL;
+				break;
+			case 's':
+			case 'S':
+				exclude_type(&show_types, LDNS_RR_TYPE_RRSIG);
+				exclude_type(&show_types, LDNS_RR_TYPE_NSEC);
+				exclude_type(&show_types, LDNS_RR_TYPE_NSEC3);
+				if (c == 's') break;
+				if (*optarg == '+' || *optarg == '-') {
+					soa_serial_increment_func_data =
+						atoi(optarg);
+					soa_serial_increment_func =
+						ldns_soa_serial_increment_by;
+				} else if (! strtok(optarg, "0123456789")) {
+					soa_serial_increment_func_data =
+						atoi(optarg);
+					soa_serial_increment_func =
+						ldns_soa_serial_identity;
+				} else if (!strcasecmp(optarg, "YYYYMMDDxx")){
+					soa_serial_increment_func =
+						ldns_soa_serial_datecounter;
+				} else if (!strcasecmp(optarg, "unixtime")){
+					soa_serial_increment_func =
+						ldns_soa_serial_unixtime;
+				} else {
+					fprintf(stderr, "-S expects a number "
+						"optionally preceded by a "
+						"+ or - sign to indicate an "
+						"offset, or the text YYYYMM"
+						"DDxx or unixtime\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+			case 'u':
+				s = ldns_output_format_set_type(fmt,
+					ldns_get_rr_type_by_name(optarg));
+				if (s != LDNS_STATUS_OK) {
+					fprintf( stderr
+					       , "Cannot set rr type %s "
+					         "in output format to "
+						 "print as unknown type: %s\n"
+					       , ldns_rr_descript(
+					       ldns_get_rr_type_by_name(optarg)
+						       )->_name
+					       , ldns_get_errorstr_by_id(s)
+					       );
+					exit(EXIT_FAILURE);
+				}
+				break;
+			case 'U':
+				s = ldns_output_format_clear_type(fmt,
+					ldns_get_rr_type_by_name(optarg));
+				if (s != LDNS_STATUS_OK) {
+					fprintf( stderr
+					       , "Cannot set rr type %s "
+					         "in output format to not "
+						 "print as unknown type: %s\n"
+					       , ldns_rr_descript(
+					       ldns_get_rr_type_by_name(optarg)
+						       )->_name
+					       , ldns_get_errorstr_by_id(s)
+					       );
+					exit(EXIT_FAILURE);
+				}
+				break;
+			case 'v':
+				printf("read zone version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+				exit(EXIT_SUCCESS);
+				break;
+                        case 'z':
+                		canonicalize = true;
+                                sort = true;
+                                break;
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (argc == 0) {
+		fp = stdin;
+	} else {
+		filename = argv[0];
+
+		fp = fopen(filename, "r");
+		if (!fp) {
+			fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+	
+	s = ldns_zone_new_frm_fp_l(&z, fp, NULL, 0, LDNS_RR_CLASS_IN, &line_nr);
+
+	fclose(fp);
+	if (s != LDNS_STATUS_OK) {
+		fprintf(stderr, "%s at line %d\n", 
+				ldns_get_errorstr_by_id(s),
+				line_nr);
+                exit(EXIT_FAILURE);
+	}
+
+	if (show_types) {
+		if (print_soa)
+			print_soa = ldns_nsec_bitmap_covers_type(show_types,
+					LDNS_RR_TYPE_SOA);
+		stripped_list = ldns_rr_list_new();
+		while ((cur_rr = ldns_rr_list_pop_rr(ldns_zone_rrs(z))))
+			if (ldns_nsec_bitmap_covers_type(show_types,
+						ldns_rr_get_type(cur_rr)))
+				ldns_rr_list_push_rr(stripped_list, cur_rr);
+			else
+				ldns_rr_free(cur_rr);
+		ldns_rr_list_free(ldns_zone_rrs(z));
+		ldns_zone_set_rrs(z, stripped_list);
+	}
+
+	if (canonicalize) {
+		ldns_rr2canonical(ldns_zone_soa(z));
+		for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(z)); i++) {
+			ldns_rr2canonical(ldns_rr_list_rr(ldns_zone_rrs(z), i));
+		}
+	}
+	if (sort) {
+		ldns_zone_sort(z);
+	}
+
+	if (print_soa && ldns_zone_soa(z)) {
+		if (soa_serial_increment_func) {
+			ldns_rr_soa_increment_func_int(
+					ldns_zone_soa(z)
+				, soa_serial_increment_func
+				, soa_serial_increment_func_data
+				);
+		}
+		ldns_rr_print_fmt(stdout, fmt, ldns_zone_soa(z));
+	}
+	ldns_rr_list_print_fmt(stdout, fmt, ldns_zone_rrs(z));
+
+	ldns_zone_deep_free(z);
+
+        exit(EXIT_SUCCESS);
+}
diff --git a/contrib/ldns/examples/ldns-resolver.1 b/contrib/ldns/examples/ldns-resolver.1
new file mode 100644
index 00000000000000..2392606881f5dc
--- /dev/null
+++ b/contrib/ldns/examples/ldns-resolver.1
@@ -0,0 +1,26 @@
+.TH ldns-resolver 1 "27 Apr 2005"
+.SH NAME
+ldns-resolver \- tries to create a resolver from a resolv.conf file.
+.SH SYNOPSIS
+.B ldns-resolver
+.IR file 
+
+.SH DESCRIPTION
+\fBldns-resolver\fR tries to create a resolver from a resolv.conf file.
+This is only useful to test the library for robustness with input data.
+
+.SH OPTIONS
+\fBldns-resolver\fR takes a filename of the resolv.conf file as input.
+For example \fIldns-resolver /etc/resolv.conf\fR will show if the file can
+be parsed successfully.
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-resolver.c b/contrib/ldns/examples/ldns-resolver.c
new file mode 100644
index 00000000000000..6f5f0625ae20a6
--- /dev/null
+++ b/contrib/ldns/examples/ldns-resolver.c
@@ -0,0 +1,47 @@
+/*
+ * ldns-resolver tries to create a resolver structure from /dev/urandom
+ * this is only useful to test the library for robustness with input data
+ *
+ * (c) NLnet Labs 2006 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include "errno.h"
+
+#include <ldns/ldns.h>
+
+int
+main(int argc, char **argv) {
+
+	ldns_resolver *r;
+	int line = 1;
+	FILE *rand;
+	ldns_status s;
+
+	if (argc != 2 || strncmp(argv[1], "-h", 3) == 0) {
+		printf("Usage: ldns-resolver <file>\n");
+		printf("Tries to create a stub resolver structure from the given file.\n");
+		exit(EXIT_FAILURE);
+	}
+	
+	if (!(rand = fopen(argv[1], "r"))) {
+		printf("Error opening %s: %s\n", argv[1], strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+	printf("Trying to read from %s\n", argv[1]);
+	s = ldns_resolver_new_frm_fp_l(&r, rand, &line);
+	if (s != LDNS_STATUS_OK) {
+		printf("Failed: %s at line %d\n", ldns_get_errorstr_by_id(s), line);
+		exit(EXIT_FAILURE);
+	} else {
+		printf("Success\n");
+		ldns_resolver_print(stdout, r);
+		ldns_resolver_deep_free(r);
+	}
+
+	fclose(rand);
+
+	return EXIT_SUCCESS;
+}
diff --git a/contrib/ldns/examples/ldns-rrsig.1 b/contrib/ldns/examples/ldns-rrsig.1
new file mode 100644
index 00000000000000..d64b9f3ba4d907
--- /dev/null
+++ b/contrib/ldns/examples/ldns-rrsig.1
@@ -0,0 +1,30 @@
+.TH ldns-rrsig 1 "27 Apr 2005"
+.SH NAME
+ldns-rrsig \- print out the inception and expiration dates in human
+readable form
+.SH SYNOPSIS
+.B ldns-rrsig 
+.IR domain
+[ 
+.IR type 
+]
+
+.SH DESCRIPTION
+\fBldns-rrsig\fR is used to print the expiration and inception date of
+a RRSIG. The first argument is a domain name. \fBldns-rrsig\fR will
+query the authoritative servers for that domain to get a list of RRSIGs.
+It will then print out the inception and expiration dates for the RRSIG
+covering the SOA record.
+.PP
+If the second argument \fBtype\fR is given the RRSIG covering that type will be shown.
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-rrsig.c b/contrib/ldns/examples/ldns-rrsig.c
new file mode 100644
index 00000000000000..9b7aac4376344b
--- /dev/null
+++ b/contrib/ldns/examples/ldns-rrsig.c
@@ -0,0 +1,219 @@
+/*
+ * ldns-rrsig prints out the inception and expiration dates in a more readable 
+ * way than the normal RRSIG presentation format
+ *
+ * for a particularly domain
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+
+#include <ldns/ldns.h>
+
+static int
+usage(FILE *fp, char *prog) {
+	fprintf(fp, "%s domain [type]\n", prog);
+	fprintf(fp, "  print out the inception and expiration dates\n");
+	fprintf(fp, "  in a more human readable form\n");
+	fprintf(fp, "  <type>\tquery for RRSIG(<type>), defaults to SOA\n");
+	return 0;
+}
+
+int
+main(int argc, char *argv[])
+{
+	ldns_resolver *res;
+	ldns_resolver *localres;
+	ldns_rdf *domain;
+	ldns_pkt *p;
+	ldns_rr_list *rrsig;
+	ldns_rr_list *rrsig_type;
+	ldns_rr_list *ns;
+	ldns_rr_list *ns_ip;
+	uint8_t i, j;
+	ldns_rr_type t;
+	const char * type_name;
+	struct tm incep, expir;
+	char incep_buf[26];
+	char expir_buf[26];
+	ldns_status s;
+	time_t now = time(NULL);
+	
+	p = NULL;
+	rrsig = NULL;
+	rrsig_type = NULL;
+	domain = NULL;
+
+	/* option parsing */
+	
+	if (argc < 2) {
+		usage(stdout, argv[0]);
+		exit(EXIT_FAILURE);
+	} else {
+		/* create a rdf from the command line arg */
+		domain = ldns_dname_new_frm_str(argv[1]);
+		if (!domain) {
+			usage(stdout, argv[0]);
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	if (argc == 3) {
+		/* optional type arg */
+		type_name = argv[2];
+		t = ldns_rdf2rr_type(
+			ldns_rdf_new_frm_str(LDNS_RDF_TYPE_TYPE, type_name));
+		if (t == 0) {
+			fprintf(stderr, " *** %s is not a valid RR type\n", type_name);
+			exit(EXIT_FAILURE);
+		}
+	} else {
+		t = LDNS_RR_TYPE_SOA; 
+		type_name = "SOA";
+	}
+
+	/* create a new resolver from /etc/resolv.conf */
+	s = ldns_resolver_new_frm_file(&localres, NULL);
+	if (s != LDNS_STATUS_OK) {
+		exit(EXIT_FAILURE);
+	}
+
+	/* first get the nameserver of the domain in question */
+	p = ldns_resolver_query(localres, domain, LDNS_RR_TYPE_NS,
+				LDNS_RR_CLASS_IN, LDNS_RD);
+	if (!p) {
+		fprintf(stderr," *** Could not find any nameserver for %s", argv[1]);
+		ldns_resolver_deep_free(localres);
+		exit(EXIT_FAILURE);
+	}
+	ns = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_NS, LDNS_SECTION_ANSWER);
+
+	if (!ns) {
+		fprintf(stderr," *** Could not find any nameserver for %s", argv[1]);
+		ldns_pkt_free(p);
+		ldns_resolver_deep_free(localres);
+		exit(EXIT_FAILURE);
+	}
+
+	/* use our local resolver to resolv the names in the for usage in our
+	 * new resolver */
+	res = ldns_resolver_new();
+	if (!res) {
+		ldns_pkt_free(p);
+		ldns_resolver_deep_free(localres);
+		ldns_rr_list_deep_free(ns);
+		exit(EXIT_FAILURE);
+	}
+	for(i = 0; i < ldns_rr_list_rr_count(ns); i++) {
+		ns_ip = ldns_get_rr_list_addr_by_name(localres,
+			ldns_rr_ns_nsdname(ldns_rr_list_rr(ns, i)),
+			LDNS_RR_CLASS_IN, LDNS_RD);
+		/* add these to new resolver */
+		for(j = 0; j < ldns_rr_list_rr_count(ns_ip); j++) {
+			if (ldns_resolver_push_nameserver(res,
+				ldns_rr_a_address(ldns_rr_list_rr(ns_ip, j))) != LDNS_STATUS_OK) {
+				printf("Error adding nameserver to resolver\n");
+                		ldns_pkt_free(p);
+                		ldns_resolver_deep_free(res);
+                                ldns_resolver_deep_free(localres);
+                		ldns_rr_list_deep_free(ns);
+				exit(EXIT_FAILURE);
+			}
+		}
+       		ldns_rr_list_deep_free(ns_ip);
+
+	}
+
+	/* enable DNSSEC */
+	ldns_resolver_set_dnssec(res, true);
+	/* also set CD, we want EVERYTHING! */
+	ldns_resolver_set_dnssec_cd(res, true);
+
+	/* use the resolver to send it a query for the soa
+	 * records of the domain given on the command line
+	 */
+	ldns_pkt_free(p);
+	p = ldns_resolver_query(res, domain, LDNS_RR_TYPE_RRSIG, LDNS_RR_CLASS_IN, LDNS_RD);
+
+	ldns_rdf_deep_free(domain);
+	
+        if (!p)  {
+		ldns_resolver_deep_free(localres);
+    		ldns_rr_list_deep_free(ns);
+		exit(EXIT_FAILURE);
+        } else {
+		/* retrieve the RRSIG records from the answer section of that
+		 * packet
+		 */
+		rrsig = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER);
+		if (!rrsig) {
+			fprintf(stderr, 
+					" *** invalid answer name %s after RRSIG query for %s\n",
+					argv[1], argv[1]);
+                        ldns_pkt_free(p);
+                        ldns_resolver_deep_free(res);
+        		ldns_rr_list_deep_free(ns);
+			exit(EXIT_FAILURE);
+		} else {
+			rrsig_type = ldns_rr_list_new();
+
+			for(i = 0; i < ldns_rr_list_rr_count(rrsig); i++) {
+				if (ldns_rdf2rr_type(
+					ldns_rr_rrsig_typecovered(
+					ldns_rr_list_rr(rrsig, i))) == t) {
+					ldns_rr_list_push_rr(rrsig_type,
+						ldns_rr_list_rr(rrsig, i));
+				}
+			}
+			if (ldns_rr_list_rr_count(rrsig_type) == 0) {
+				fprintf(stderr, " *** No RRSIG(%s) type found\n",
+					type_name);
+                		ldns_resolver_deep_free(localres);
+                		ldns_resolver_deep_free(res);
+                		ldns_pkt_free(p);
+                		ldns_rr_list_deep_free(ns);
+                		ldns_rr_list_free(rrsig);
+                		ldns_rr_list_deep_free(rrsig_type);
+				exit(EXIT_FAILURE);
+			}
+			
+			for(i = 0; i < ldns_rr_list_rr_count(rrsig_type); i++) {
+				memset(&incep, 0, sizeof(incep));
+				if (ldns_serial_arithmetics_gmtime_r(
+						ldns_rdf2native_time_t(
+						ldns_rr_rrsig_inception(
+						ldns_rr_list_rr(rrsig_type, i))),
+					       	now, &incep
+					)
+				    && asctime_r(&incep, incep_buf)) {
+					incep_buf[24] = '\0';
+				} else {
+					incep_buf[0] = '\0';
+				}
+				memset(&expir, 0, sizeof(expir));
+				if (ldns_serial_arithmetics_gmtime_r(
+						ldns_rdf2native_time_t(
+						ldns_rr_rrsig_expiration(
+						ldns_rr_list_rr(rrsig_type, i))),
+					       	now, &expir
+					)
+				    && asctime_r(&expir, expir_buf)) {
+					expir_buf[24] = '\0';
+				} else {
+					expir_buf[0] = '\0';
+				}
+
+				fprintf(stdout, "%s RRSIG(%s):  %s - %s\n",
+					argv[1], type_name, incep_buf, expir_buf);
+			}
+                        ldns_rr_list_free(rrsig);
+                        ldns_rr_list_deep_free(rrsig_type);
+		}
+        }
+        ldns_pkt_free(p);
+        ldns_resolver_deep_free(localres);
+        ldns_resolver_deep_free(res);
+        ldns_rr_list_deep_free(ns);
+        return 0;
+}
diff --git a/contrib/ldns/examples/ldns-signzone.1 b/contrib/ldns/examples/ldns-signzone.1
new file mode 100644
index 00000000000000..68f9f77376a235
--- /dev/null
+++ b/contrib/ldns/examples/ldns-signzone.1
@@ -0,0 +1,194 @@
+.TH ldns-signzone 1 "13 March 2018"
+.SH NAME
+ldns-signzone \- sign a zonefile with DNSSEC data
+.SH SYNOPSIS
+.B ldns-signzone 
+[
+.IR OPTIONS
+]
+.IR ZONEFILE 
+.IR
+KEY 
+[KEY 
+[KEY] ...
+]
+
+.SH DESCRIPTION
+
+\fBldns-signzone\fR is used to generate a DNSSEC signed zone. When run it
+will create a new zonefile that contains RRSIG and NSEC resource records, as
+specified in RFC 4033, RFC 4034 and RFC 4035.
+
+Keys must be specified by their base name (i.e. without .private). If
+the DNSKEY that belongs to the key in the .private file is not present
+in the zone, it will be read from the file <base name>.key. If that
+file does not exist, the DNSKEY value will be generated from the
+private key.
+
+Multiple keys can be specified, Key Signing Keys are used as such when
+they are either already present in the zone, or specified in a .key
+file, and have the KSK bit set.
+
+.SH OPTIONS
+.TP
+\fB-b\fR
+Augments the zone and the RR's with extra comment texts for a more readable
+layout, easier to debug. DS records will have a bubblebabble version of
+the data in the comment text, NSEC3 records will have the unhashed owner names
+in the comment text.
+
+Without this option, only DNSKEY RR's will have their Key Tag annotated in
+the comment text.
+
+.TP
+\fB-d\fR
+Normally, if the DNSKEY RR for a key that is used to sign the zone is
+not found in the zone file, it will be read from .key, or derived from
+the private key (in that order). This option turns that feature off,
+so that only the signatures are added to the zone.
+
+.TP
+\fB-e\fR \fIdate\fR
+Set expiration date of the signatures to this date, the format can be
+YYYYMMDD[hhmmss], or a timestamp.
+
+.TP
+\fB-f\fR \fIfile\fR
+Use this file to store the signed zone in (default <originalfile>.signed)
+
+.TP
+\fB-i\fR \fIdate\fR
+Set inception date of the signatures to this date, the format can be
+YYYYMMDD[hhmmss], or a timestamp.
+
+.TP
+\fB-o\fR \fIorigin\fR
+Use this as the origin of the zone
+
+.TP
+\fB-u\fR
+set SOA serial to the number of seconds since 1-1-1970
+
+.TP
+\fB-v\fR
+Print the version and exit
+
+.TP
+\fB-z\fR \fI[scheme:]hash\fR
+Calculate the zone's digest and add those as ZONEMD RRs. The (optional)
+`scheme' must be `simple` (or 1) and `hash' should be `sha384' (or 1) or
+`sha512' (or 2).  This option can be given more than once.
+
+.TP
+\fB-Z\fR
+Allow ZONEMDs to be added without signing
+
+.TP
+\fB-A\fR
+Sign the DNSKEY record with all keys.  By default it is signed with a
+minimal number of keys, to keep the response size for the DNSKEY query
+small, and only the SEP keys that are passed are used.  If there are no
+SEP keys, the DNSKEY RRset is signed with the non\-SEP keys.  This option
+turns off the default and all keys are used to sign the DNSKEY RRset.
+
+.TP
+\fB-U\fR
+Sign with every unique algorithm in the provided keys.  The DNSKEY set
+is signed with all the SEP keys, plus all the non\-SEP keys that have an
+algorithm that was not presen in the SEP key set.
+
+.TP
+\fB-E\fR \fIname\fR
+Use the EVP cryptographic engine with the given name for signing. This
+can have some extra options; see ENGINE OPTIONS for more information.
+
+.TP
+\fB-K\fR \fIalgorithm-id,key-id\fR
+
+Use the key `key-id' as the signing key for algorithm `algorithm-id' as
+a Key Signing Key (KSK). This option is used when you use an OpenSSL engine,
+see ENGINE OPTIONS for more information.
+
+.TP
+\fB-k\fR \fIalgorithm-id,key-id\fR
+Use the key `key-id' as the signing key for algorithm `algorithm-id' as
+a Zone Signing Key (ZSK). This option is used when you use an OpenSSL
+engine, see ENGINE OPTIONS for more information.
+
+.TP
+\fB-n\fR
+Use NSEC3 instead of NSEC.
+
+.TP
+If you use NSEC3, you can specify the following extra options:
+
+.TP
+\fB-a\fR \fIalgorithm\fR
+Algorithm used to create the hashed NSEC3 owner names
+
+.TP
+\fB-p\fR
+Opt-out. All NSEC3 records in the zone will have the Opt-out flag set. After signing, you can add insecure delegations to the signed zone.
+
+.TP
+\fB-s\fR \fIstring\fR
+Salt
+
+.TP
+\fB-t\fR \fInumber\fR
+Number of hash iterations
+
+.SH ENGINE OPTIONS
+You can modify the possible engines, if supported, by setting an
+OpenSSL configuration file. This is done through the environment
+variable OPENSSL_CONF.
+
+The key options (\-k and \-K) work as follows: you specify a DNSSEC
+algorithm (using its symbolic name, for instance, RSASHA256
+or its numeric identifier, for instance, 8), followed by a comma
+and a key identifier (white space is not allowed between the
+algorithm and the comma and between the comma and the key identifier).
+
+The key identifier can be any of the following:
+
+    <id>
+    <slot>:<id>
+    id_<id>
+    slot_<slot>-id_<id>
+    label_<label>
+    slot_<slot>-label_<label>
+
+Where '<id>' is the PKCS #11 key identifier in hexadecimal
+notation, '<label>' is the PKCS #11 human-readable label, and '<slot>'
+is the slot number where the token is present.
+
+More recent versions of OpenSSL engines may support
+the PKCS #11 URI scheme (RFC 7512),
+please consult your engine's documentation.
+
+If not already present, a DNSKEY RR is generated from the key
+data, and added to the zone.
+
+.SH EXAMPLES
+
+.TP
+ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+005+12273
+Sign the zone in the file 'nlnetlabs.nl' with the key in the
+files 'Knlnetlabs.nl.+005+12273.private'. If the DNSKEY is not present
+in the zone, use the key in the
+file 'Knlnetlabs.nl.+005+12273.key'. If that is not present, generate
+one with default values from 'Knlnetlabs.nl.+005+12273.private'.
+
+
+.SH AUTHORS
+Written by the ldns team as an example for ldns usage.
+.br
+Portions of engine support by Vadim Penzin <vadim@penzin.net>. 
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2005-2008 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-signzone.c b/contrib/ldns/examples/ldns-signzone.c
new file mode 100644
index 00000000000000..9425833e53b69a
--- /dev/null
+++ b/contrib/ldns/examples/ldns-signzone.c
@@ -0,0 +1,1146 @@
+/*
+ * ldns-signzone signs a zone file
+ * 
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include <stdio.h>
+
+#include "config.h"
+
+#ifdef HAVE_SSL
+
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <errno.h>
+
+#include <time.h>
+
+#include <ldns/ldns.h>
+#include <ldns/keys.h>
+
+#include <openssl/conf.h>
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+#include <openssl/err.h>
+
+#define MAX_FILENAME_LEN 250
+
+char *prog;
+int verbosity = 1;
+
+static void
+usage(FILE *fp, const char *prog) {
+	fprintf(fp, "%s [OPTIONS] zonefile key [key [key]]\n", prog);
+	fprintf(fp, "  signs the zone with the given key(s)\n");
+	fprintf(fp, "  -b\t\tuse layout in signed zone and print comments DNSSEC records\n");
+	fprintf(fp, "  -d\t\tused keys are not added to the zone\n");
+	fprintf(fp, "  -e <date>\texpiration date\n");
+	fprintf(fp, "  -f <file>\toutput zone to file (default <name>.signed)\n");
+	fprintf(fp, "  -i <date>\tinception date\n");
+	fprintf(fp, "  -o <domain>\torigin for the zone\n");
+	fprintf(fp, "  -u\t\tset SOA serial to the number of seconds since 1-1-1970\n");
+	fprintf(fp, "  -v\t\tprint version and exit\n");
+	fprintf(fp, "  -z <[scheme:]hash>\tAdd ZONEMD resource record\n");
+	fprintf(fp, "\t\t<scheme> should be \"simple\" (or 1)\n");
+	fprintf(fp, "\t\t<hash> should be \"sha384\" or \"sha512\" (or 1 or 2)\n");
+	fprintf(fp, "\t\tthis option can be given more than once\n");
+	fprintf(fp, "  -Z\t\tAllow ZONEMDs to be added without signing\n");
+	fprintf(fp, "  -A\t\tsign DNSKEY with all keys instead of minimal\n");
+	fprintf(fp, "  -U\t\tSign with every unique algorithm in the provided keys\n");
+#ifndef OPENSSL_NO_ENGINE
+	fprintf(fp, "  -E <name>\tuse <name> as the crypto engine for signing\n");
+	fprintf(fp, "           \tThis can have a lot of extra options, see the manual page for more info\n");
+	fprintf(fp, "  -k <algorithm>,<key>\tuse `key' with `algorithm' from engine as ZSK\n");
+	fprintf(fp, "  -K <algorithm>,<key>\tuse `key' with `algorithm' from engine as KSK\n");
+#endif
+	fprintf(fp, "  -n\t\tuse NSEC3 instead of NSEC.\n");
+	fprintf(fp, "\t\tIf you use NSEC3, you can specify the following extra options:\n");
+	fprintf(fp, "\t\t-a [algorithm] hashing algorithm\n");
+	fprintf(fp, "\t\t-t [number] number of hash iterations\n");
+	fprintf(fp, "\t\t-s [string] salt\n");
+	fprintf(fp, "\t\t-p set the opt-out flag on all nsec3 rrs\n");
+	fprintf(fp, "\n");
+	fprintf(fp, "  keys must be specified by their base name (usually K<name>+<alg>+<id>),\n");
+	fprintf(fp, "  i.e. WITHOUT the .private extension.\n");
+	fprintf(fp, "  If the public part of the key is not present in the zone, the DNSKEY RR\n");
+	fprintf(fp, "  will be read from the file called <base name>.key. If that does not exist,\n");
+	fprintf(fp, "  a default DNSKEY will be generated from the private key and added to the zone.\n");
+	fprintf(fp, "  A date can be a timestamp (seconds since the epoch), or of\n  the form <YYYYMMdd[hhmmss]>\n");
+#ifndef OPENSSL_NO_ENGINE
+	fprintf(fp, "  For -k or -K, the algorithm can be specified as an integer or a symbolic name:" );
+
+#define __LIST(x) fprintf ( fp, " %3d: %-15s", LDNS_SIGN_ ## x, # x )
+
+	fprintf ( fp, "\n " );
+	__LIST ( RSAMD5 );
+#ifdef USE_DSA
+	__LIST ( DSA );
+#endif
+	__LIST ( RSASHA1 );
+	fprintf ( fp, "\n " );
+#ifdef USE_DSA
+	__LIST ( DSA_NSEC3 );
+#endif
+	__LIST ( RSASHA1_NSEC3 );
+	__LIST ( RSASHA256 );
+	fprintf ( fp, "\n " );
+	__LIST ( RSASHA512 );
+	__LIST ( ECC_GOST );
+	__LIST ( ECDSAP256SHA256 );
+	fprintf ( fp, "\n " );
+	__LIST ( ECDSAP384SHA384 );
+
+#ifdef USE_ED25519
+	__LIST ( ED25519 );
+#endif
+
+#ifdef USE_ED448
+	__LIST ( ED448 );
+#endif
+	fprintf ( fp, "\n" );
+
+#undef __LIST
+#endif
+}
+
+static void check_tm(struct tm tm)
+{
+	if (tm.tm_year < 70) {
+		fprintf(stderr, "You cannot specify dates before 1970\n");
+		exit(EXIT_FAILURE);
+	}
+	if (tm.tm_mon < 0 || tm.tm_mon > 11) {
+		fprintf(stderr, "The month must be in the range 1 to 12\n");
+		exit(EXIT_FAILURE);
+	}
+	if (tm.tm_mday < 1 || tm.tm_mday > 31) {
+		fprintf(stderr, "The day must be in the range 1 to 31\n");
+		exit(EXIT_FAILURE);
+	}
+	
+	if (tm.tm_hour < 0 || tm.tm_hour > 23) {
+		fprintf(stderr, "The hour must be in the range 0-23\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if (tm.tm_min < 0 || tm.tm_min > 59) {
+		fprintf(stderr, "The minute must be in the range 0-59\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if (tm.tm_sec < 0 || tm.tm_sec > 59) {
+		fprintf(stderr, "The second must be in the range 0-59\n");
+		exit(EXIT_FAILURE);
+	}
+
+}
+
+/*
+ * if the ttls are different, make them equal
+ * if one of the ttls equals LDNS_DEFAULT_TTL, that one is changed
+ * otherwise, rr2 will get the ttl of rr1
+ * 
+ * prints a warning if a non-default TTL is changed
+ */
+static void
+equalize_ttls(ldns_rr *rr1, ldns_rr *rr2, uint32_t default_ttl)
+{
+	uint32_t ttl1, ttl2;
+	
+	ttl1 = ldns_rr_ttl(rr1);
+	ttl2 = ldns_rr_ttl(rr2);
+	
+	if (ttl1 != ttl2) {
+		if (ttl1 == default_ttl) {
+			ldns_rr_set_ttl(rr1, ttl2);
+		} else if (ttl2 == default_ttl) {
+			ldns_rr_set_ttl(rr2, ttl1);
+		} else {
+			ldns_rr_set_ttl(rr2, ttl1);
+			fprintf(stderr, 
+			        "warning: changing non-default TTL %u to %u\n",
+			        (unsigned int) ttl2, (unsigned int)  ttl1);
+		}
+	}
+}
+
+static void
+equalize_ttls_rr_list(ldns_rr_list *rr_list, ldns_rr *rr, uint32_t default_ttl)
+{
+	size_t i;
+	ldns_rr *cur_rr;
+	
+	for (i = 0; i < ldns_rr_list_rr_count(rr_list); i++) {
+		cur_rr = ldns_rr_list_rr(rr_list, i);
+		if (ldns_rr_compare_no_rdata(cur_rr, rr) == 0) {
+			equalize_ttls(cur_rr, rr, default_ttl);
+		}
+	}
+}
+
+static ldns_rr *
+find_key_in_zone(ldns_rr *pubkey_gen, ldns_zone *zone) {
+	size_t key_i;
+	ldns_rr *pubkey;
+	
+	for (key_i = 0;
+		key_i < ldns_rr_list_rr_count(ldns_zone_rrs(zone));
+		key_i++) {
+		pubkey = ldns_rr_list_rr(ldns_zone_rrs(zone), key_i);
+		if (ldns_rr_get_type(pubkey) == LDNS_RR_TYPE_DNSKEY &&
+			(ldns_calc_keytag(pubkey)
+				==
+				ldns_calc_keytag(pubkey_gen) ||
+					 /* KSK has gen-keytag + 1 */
+					 ldns_calc_keytag(pubkey)
+					 ==
+					 ldns_calc_keytag(pubkey_gen) + 1) 
+			   ) {
+				if (verbosity >= 2) {
+					fprintf(stderr, "Found it in the zone!\n");
+				}
+				return pubkey;
+		}
+	}
+	return NULL;
+}
+
+static ldns_rr *
+find_key_in_file(const char *keyfile_name_base, ldns_key* ATTR_UNUSED(key),
+	uint32_t zone_ttl)
+{
+	char *keyfile_name;
+	FILE *keyfile;
+	int line_nr;
+	uint32_t default_ttl = zone_ttl;
+
+	ldns_rr *pubkey = NULL;
+	keyfile_name = LDNS_XMALLOC(char,
+	                            strlen(keyfile_name_base) + 5);
+	snprintf(keyfile_name,
+		 strlen(keyfile_name_base) + 5,
+		 "%s.key",
+		 keyfile_name_base);
+	if (verbosity >= 2) {
+		fprintf(stderr, "Trying to read %s\n", keyfile_name);
+	}
+	keyfile = fopen(keyfile_name, "r");
+	line_nr = 0;
+	if (keyfile) {
+		if (ldns_rr_new_frm_fp_l(&pubkey,
+					 keyfile,
+					 &default_ttl,
+					 NULL,
+					 NULL,
+					 &line_nr) ==
+		    LDNS_STATUS_OK) {
+			if (verbosity >= 2) {
+				printf("Key found in file: %s\n", keyfile_name);
+			}
+		}
+		fclose(keyfile);
+	}
+	LDNS_FREE(keyfile_name);
+	return pubkey;
+}
+
+/* this function tries to find the specified keys either in the zone that
+ * has been read, or in a <basename>.key file. If the key is not found,
+ * a public key is generated, and it is assumed the key is a ZSK
+ * 
+ * if add_keys is true; the DNSKEYs are added to the zone prior to signing
+ * if it is false, they are not added.
+ * Even if keys are not added, the function is still needed, to check
+ * whether keys of which we only have key data are KSKs or ZSKS
+ */
+static void
+find_or_create_pubkey(const char *keyfile_name_base, ldns_key *key, ldns_zone *orig_zone, bool add_keys, uint32_t default_ttl) {
+	ldns_rr *pubkey_gen, *pubkey;
+	int key_in_zone;
+	
+	if (default_ttl == LDNS_DEFAULT_TTL) {
+		default_ttl = ldns_rr_ttl(ldns_zone_soa(orig_zone));
+	}
+
+	if (!ldns_key_pubkey_owner(key)) {
+		ldns_key_set_pubkey_owner(key, ldns_rdf_clone(ldns_rr_owner(ldns_zone_soa(orig_zone))));
+	}
+
+	/* find the public key in the zone, or in a
+	 * separate file
+	 * we 'generate' one anyway, 
+	 * then match that to any present in the zone,
+	 * if it matches, we drop our own. If not,
+	 * we try to see if there is a .key file present.
+	 * If not, we use our own generated one, with
+	 * some default values 
+	 *
+	 * Even if -d (do-not-add-keys) is specified, 
+	 * we still need to do this, because we need
+	 * to have any key flags that are set this way
+	 */
+	pubkey_gen = ldns_key2rr(key);
+	ldns_rr_set_ttl(pubkey_gen, default_ttl);
+
+	if (verbosity >= 2) {
+		fprintf(stderr,
+			   "Looking for key with keytag %u or %u\n",
+			   (unsigned int) ldns_calc_keytag(pubkey_gen),
+			   (unsigned int) ldns_calc_keytag(pubkey_gen)+1
+			   );
+	}
+
+	pubkey = find_key_in_zone(pubkey_gen, orig_zone);
+	key_in_zone = 1;
+	if (!pubkey) {
+		key_in_zone = 0;
+		/* it was not in the zone, try to read a .key file */
+		pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
+		if (!pubkey && !(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
+			/* maybe it is a ksk? */
+			ldns_key_set_keytag(key, ldns_key_keytag(key) + 1);
+			pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
+			if (!pubkey) {
+				/* ok, no file, set back to ZSK */
+				ldns_key_set_keytag(key, ldns_key_keytag(key) - 1);
+			}
+		}
+		if(pubkey && ldns_dname_compare(ldns_rr_owner(pubkey), ldns_rr_owner(ldns_zone_soa(orig_zone))) != 0) {
+			fprintf(stderr, "Error %s.key has wrong name: %s\n",
+				keyfile_name_base, ldns_rdf2str(ldns_rr_owner(pubkey)));
+			exit(EXIT_FAILURE); /* leak rdf2str, but we exit */
+		}
+	}
+	
+	if (!pubkey) {
+		/* okay, no public key found,
+		   just use our generated one */
+		pubkey = pubkey_gen;
+		if (verbosity >= 2) {
+			fprintf(stderr, "Not in zone, no .key file, generating ZSK DNSKEY from private key data\n");
+		}
+	} else {
+		ldns_rr_free(pubkey_gen);
+	}
+	ldns_key_set_flags(key, ldns_rdf2native_int16(ldns_rr_rdf(pubkey, 0)));
+	ldns_key_set_keytag(key, ldns_calc_keytag(pubkey));
+	
+	if (add_keys && !key_in_zone) {
+		equalize_ttls_rr_list(ldns_zone_rrs(orig_zone), pubkey, default_ttl);
+		ldns_zone_push_rr(orig_zone, pubkey);
+	}
+}
+
+#ifndef OPENSSL_NO_ENGINE
+/*
+ * For keys coming from the engine (-k or -K), parse algorithm specification.
+ */
+static enum ldns_enum_signing_algorithm
+parse_algspec ( const char * const p )
+{
+	if ( p == NULL )
+		return 0;
+
+	if ( isdigit ( (const unsigned char)*p ) ) {
+		const char *nptr = NULL;
+		const long id = strtol ( p, (char **) &nptr, 10 );
+		return id > 0 && nptr != NULL && *nptr == ',' ? id : 0;
+	}
+
+#define __MATCH(x)							\
+	if ( !memcmp ( # x, p, sizeof ( # x ) - 1 )			\
+	     && p [ sizeof ( # x ) - 1 ] == ',' ) {			\
+		return LDNS_SIGN_ ## x;					\
+	}
+
+	__MATCH ( RSAMD5 );
+	__MATCH ( RSASHA1 );
+#ifdef USE_DSA
+	__MATCH ( DSA );
+#endif
+	__MATCH ( RSASHA1_NSEC3 );
+	__MATCH ( RSASHA256 );
+	__MATCH ( RSASHA512 );
+#ifdef USE_DSA
+	__MATCH ( DSA_NSEC3 );
+#endif
+	__MATCH ( ECC_GOST );
+	__MATCH ( ECDSAP256SHA256 );
+	__MATCH ( ECDSAP384SHA384 );
+
+#ifdef USE_ED25519
+	__MATCH ( ED25519 );
+#endif
+
+#ifdef USE_ED448
+	__MATCH ( ED448 );
+#endif
+
+#undef __MATCH
+
+	return 0;
+}
+
+/*
+ * For keys coming from the engine (-k or -K), parse key specification
+ * in the form of <algorithm>,<key-id>. No whitespace is allowed
+ * between <algorithm> and the comma, and between the comma and
+ * <key-id>. <key-id> format is specific to the engine at hand, i.e.
+ * it can be the old OpenSC syntax or a PKCS #11 URI as defined in RFC 7512
+ * and (partially) supported by OpenSC (as of 20180312).
+ */
+static const char *
+parse_keyspec ( const char * const p,
+		enum ldns_enum_signing_algorithm * const algorithm,
+		const char ** const id )
+{
+	const char * const comma = strchr ( p, ',' );
+
+	if ( comma == NULL || !(*algorithm = parse_algspec ( p )) )
+		return NULL;
+	return comma [ 1 ] ? *id = comma + 1 : NULL;
+}
+
+/*
+ * Load a key from the engine.
+ */
+static ldns_key *
+load_key ( const char * const p, ENGINE * const e )
+{
+	enum ldns_enum_signing_algorithm alg = 0;
+	const char *id = NULL;
+	ldns_status status = LDNS_STATUS_ERR;
+	ldns_key *key = NULL;
+
+	/* Parse key specification. */
+	if ( parse_keyspec ( p, &alg, &id ) == NULL ) {
+		fprintf ( stderr,
+			  "Failed to parse key specification `%s'.\n",
+			  p );
+		usage ( stderr, prog );
+		exit ( EXIT_FAILURE );
+	}
+
+	/* Validate that the algorithm can be used for signing. */
+	switch ( alg ) {
+	case LDNS_SIGN_RSAMD5:
+	case LDNS_SIGN_RSASHA1:
+	case LDNS_SIGN_RSASHA1_NSEC3:
+	case LDNS_SIGN_RSASHA256:
+	case LDNS_SIGN_RSASHA512:
+#ifdef USE_DSA
+	case LDNS_SIGN_DSA:
+	case LDNS_SIGN_DSA_NSEC3:
+#endif
+	case LDNS_SIGN_ECC_GOST:
+#ifdef USE_ECDSA
+	case LDNS_SIGN_ECDSAP256SHA256:
+	case LDNS_SIGN_ECDSAP384SHA384:
+#endif
+		break;
+	default:
+		fprintf ( stderr,
+			  "Algorithm %d cannot be used for signing.\n",
+			  alg );
+		usage ( stderr, prog );
+		exit ( EXIT_FAILURE );
+	}
+
+	printf ( "Engine key id: %s, algo %d\n", id, alg );
+
+	/* Attempt to load the key from the engine. */
+	status = ldns_key_new_frm_engine (
+			&key, e, (char *) id, (ldns_algorithm)alg );
+	if ( status != LDNS_STATUS_OK ) {
+		ERR_print_errors_fp ( stderr );
+		exit ( EXIT_FAILURE );
+	}
+
+	return key;
+}
+
+/*
+ * For keys coming from the engine (-k or -K), set key parameters
+ * and determine whether the key is listed in the zone file.
+ */
+static void
+post_process_engine_key ( ldns_key_list * const keys,
+			  ldns_key * const key,
+			  ldns_zone * const zone,
+			  const bool add_keys,
+			  const uint32_t ttl,
+			  const uint32_t inception,
+			  const uint32_t expiration )
+{
+	if ( key == NULL ) return;
+
+	if ( expiration ) ldns_key_set_expiration ( key, expiration );
+
+	if ( inception ) ldns_key_set_inception ( key, inception );
+
+	ldns_key_list_push_key ( keys, key );
+	find_or_create_pubkey ( "", key, zone, add_keys, ttl );
+}
+
+/*
+ * Initialize OpenSSL, for versions 1.1 and newer. 
+ */
+static ENGINE *
+init_openssl_engine ( const char * const id )
+{
+	ENGINE *e = NULL;
+
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
+        ERR_load_crypto_strings();
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL) || !defined(HAVE_OPENSSL_INIT_CRYPTO)
+        OpenSSL_add_all_algorithms();
+#else
+	if ( !OPENSSL_init_crypto ( OPENSSL_INIT_LOAD_CONFIG, NULL ) ) {
+		fprintf ( stderr, "OPENSSL_init_crypto(3) failed.\n" );
+		ERR_print_errors_fp ( stderr );
+		exit ( EXIT_FAILURE );
+	}
+#endif
+
+	if ( (e = ENGINE_by_id ( id )) == NULL ) {
+		fprintf ( stderr, "ENGINE_by_id(3) failed.\n" );
+		ERR_print_errors_fp ( stderr );
+		exit ( EXIT_FAILURE );
+	}
+
+	if (  !ENGINE_set_default_DSA ( e ) ) {
+		fprintf ( stderr, "ENGINE_set_default_DSA(3) failed.\n" );
+		ERR_print_errors_fp ( stderr );
+		exit ( EXIT_FAILURE );
+	}
+
+	if (  !ENGINE_set_default_RSA ( e ) ) {
+		fprintf ( stderr, "ENGINE_set_default_RSA(3) failed.\n" );
+		ERR_print_errors_fp ( stderr );
+		exit ( EXIT_FAILURE );
+	}
+
+	return e;
+}
+
+/*
+ * De-initialize OpenSSL, for versions 1.1 and newer.
+ *
+ * All of that is not strictly necessary because the process exits
+ * anyway, however, when an engine is used, this is the only hope
+ * of letting the engine's driver know that the program terminates
+ * (for the fear that the driver's reference counting may go awry, etc.)
+ * Still, there is no guarantee that this function helps...
+ */
+static void
+shutdown_openssl ( ENGINE * const e )
+{
+	if ( e != NULL ) {
+#ifdef HAVE_ENGINE_FREE
+		ENGINE_free ( e );
+#endif
+#ifdef HAVE_ENGINE_CLEANUP
+		ENGINE_cleanup ();
+#endif
+	}
+
+#ifdef HAVE_CONF_MODULES_UNLOAD
+	CONF_modules_unload ( 1 );
+#endif
+#ifdef HAVE_EVP_CLEANUP
+	EVP_cleanup ();
+#endif
+#ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+	CRYPTO_cleanup_all_ex_data ();
+#endif
+#ifdef HAVE_ERR_FREE_STRINGS
+	ERR_free_strings ();
+#endif
+}
+#endif
+
+int str2zonemd_signflag(const char *str, const char **reason)
+{
+	char *colon;
+
+	static const char *reasons[] = {
+	      "Unknown <scheme>, should be \"simple\""
+	    , "Syntax error in <hash>, should be \"sha384\" or \"sha512\""
+	    , "Unknown <hash>, should be \"sha384\" or \"sha512\""
+	};
+
+	if (!str)
+		return LDNS_STATUS_NULL;
+
+	if ((colon = strchr(str, ':'))) {
+		if ((colon - str != 1 || str[0] != '1')
+		&&  (colon - str != 6 || strncasecmp(str, "simple", 6))) {
+			if (reason) *reason = reasons[0];
+			return 0;
+		}
+
+		if (strchr(colon + 1, ':')) {
+			if (reason) *reason = reasons[1];
+			return 0;
+		}
+		return str2zonemd_signflag(colon + 1, reason);
+	}
+	if (!strcasecmp(str, "1") || !strcasecmp(str, "sha384"))
+		return LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384;
+	if (!strcasecmp(str, "2") || !strcasecmp(str, "sha512"))
+		return LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512;
+
+	if (reason) *reason = reasons[2];
+	return 0;
+}
+
+int
+main(int argc, char *argv[])
+{
+	const char *zonefile_name;
+	FILE *zonefile = NULL;
+	int line_nr = 0;
+	int c;
+	int argi;
+#ifndef OPENSSL_NO_ENGINE
+	ENGINE *engine = NULL;
+#endif
+	ldns_zone *orig_zone;
+	ldns_rr_list *orig_rrs = NULL;
+	ldns_rr *orig_soa = NULL;
+	ldns_dnssec_zone *signed_zone;
+
+	char *keyfile_name_base;
+	char *keyfile_name = NULL;
+	FILE *keyfile = NULL;
+	ldns_key *key = NULL;
+#ifndef OPENSSL_NO_ENGINE
+	ldns_key *eng_ksk = NULL; /* KSK specified with -K */
+	ldns_key *eng_zsk = NULL; /* ZSK specified with -k */
+#endif
+	ldns_key_list *keys;
+	ldns_status s;
+	size_t i;
+	ldns_rr_list *added_rrs;
+
+	char *outputfile_name = NULL;
+	FILE *outputfile;
+	
+	bool use_nsec3 = false;
+	int signflags = 0;
+	bool unixtime_serial = false;
+
+	/* Add the given keys to the zone if they are not yet present */
+	bool add_keys = true;
+	uint8_t nsec3_algorithm = 1;
+	uint8_t nsec3_flags = 0;
+	size_t nsec3_iterations_cmd = 1;
+	uint16_t nsec3_iterations = 1;
+	uint8_t nsec3_salt_length = 0;
+	uint8_t *nsec3_salt = NULL;
+	
+	/* we need to know the origin before reading ksk's,
+	 * so keep an array of filenames until we know it
+	 */
+	struct tm tm;
+	uint32_t inception;
+	uint32_t expiration;
+	ldns_rdf *origin = NULL;
+	uint32_t ttl = LDNS_DEFAULT_TTL;
+	ldns_rr_class class = LDNS_RR_CLASS_IN;	
+	
+	ldns_status result;
+
+	ldns_output_format_storage fmt_st;
+	ldns_output_format* fmt = ldns_output_format_init(&fmt_st);
+
+	/* For parson zone digest parameters */
+	int flag;
+	const char *reason = NULL;
+
+	prog = strdup(argv[0]);
+	inception = 0;
+	expiration = 0;
+	
+	keys = ldns_key_list_new();
+
+	while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:uvz:ZAUE:K:")) != -1) {
+		switch (c) {
+		case 'a':
+			nsec3_algorithm = (uint8_t) atoi(optarg);
+			if (nsec3_algorithm != 1) {
+				fprintf(stderr, "Bad NSEC3 algorithm, only RSASHA1 allowed\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'b':
+			ldns_output_format_set(fmt, LDNS_COMMENT_FLAGS
+						  | LDNS_COMMENT_LAYOUT      
+						  | LDNS_COMMENT_NSEC3_CHAIN
+						  | LDNS_COMMENT_BUBBLEBABBLE);
+			break;
+		case 'd':
+			add_keys = false;
+			break;
+		case 'e':
+			/* try to parse YYYYMMDD first,
+			 * if that doesn't work, it
+			 * should be a timestamp (seconds since epoch)
+			 */
+			memset(&tm, 0, sizeof(tm));
+
+			if (strlen(optarg) == 8 &&
+			    sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
+			    ) {
+			   	tm.tm_year -= 1900;
+			   	tm.tm_mon--;
+			   	check_tm(tm);
+				expiration = 
+					(uint32_t) ldns_mktime_from_utc(&tm);
+			} else if (strlen(optarg) == 14 &&
+					 sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
+					 ) {
+			   	tm.tm_year -= 1900;
+			   	tm.tm_mon--;
+			   	check_tm(tm);
+				expiration = 
+					(uint32_t) ldns_mktime_from_utc(&tm);
+			} else {
+				expiration = (uint32_t) atol(optarg);
+			}
+			break;
+		case 'f':
+			outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN + 1);
+			strncpy(outputfile_name, optarg, MAX_FILENAME_LEN);
+			break;
+		case 'i':
+			memset(&tm, 0, sizeof(tm));
+
+			if (strlen(optarg) == 8 &&
+			    sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
+			    ) {
+			   	tm.tm_year -= 1900;
+			   	tm.tm_mon--;
+			   	check_tm(tm);
+				inception = 
+					(uint32_t) ldns_mktime_from_utc(&tm);
+			} else if (strlen(optarg) == 14 &&
+					 sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
+					 ) {
+			   	tm.tm_year -= 1900;
+			   	tm.tm_mon--;
+			   	check_tm(tm);
+				inception = 
+					(uint32_t) ldns_mktime_from_utc(&tm);
+			} else {
+				inception = (uint32_t) atol(optarg);
+			}
+			break;
+		case 'n':
+			use_nsec3 = true;
+			break;
+		case 'o':
+			if (ldns_str2rdf_dname(&origin, optarg) != LDNS_STATUS_OK) {
+				fprintf(stderr, "Bad origin, not a correct domain name\n");
+				usage(stderr, prog);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'p':
+			nsec3_flags = nsec3_flags | LDNS_NSEC3_VARS_OPTOUT_MASK;
+			break;
+		case 'u':
+			unixtime_serial = true;
+			break;
+		case 'v':
+			printf("zone signer version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+			exit(EXIT_SUCCESS);
+			break;
+		case 'z':
+			flag = str2zonemd_signflag(optarg, &reason);
+			if (flag)
+				signflags |= flag;
+			else {
+				fprintf( stderr
+				       , "%s\nwith zone digest parameters:"
+				         " \"%s\"\n"
+				       , reason, optarg);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		case 'Z':
+			signflags |= LDNS_SIGN_NO_KEYS_NO_NSECS;
+			break;
+		case 'A':
+			signflags |= LDNS_SIGN_DNSKEY_WITH_ZSK;
+			break;
+		case 'E':
+#ifndef OPENSSL_NO_ENGINE
+			engine = init_openssl_engine ( optarg );
+			break;
+#else
+			/* fallthrough */
+#endif
+		case 'k':
+#ifndef OPENSSL_NO_ENGINE
+			eng_zsk = load_key ( optarg, engine );
+			break;
+#else
+			/* fallthrough */
+#endif
+		case 'K':
+#ifndef OPENSSL_NO_ENGINE
+			eng_ksk = load_key ( optarg, engine );
+			/* I apologize for that, there is no API. */
+			eng_ksk -> _extra.dnssec.flags |= LDNS_KEY_SEP_KEY;
+#else
+			fprintf(stderr, "%s compiled without engine support\n"
+			              , prog);
+			exit(EXIT_FAILURE);
+#endif
+			break;
+		case 'U':
+			signflags |= LDNS_SIGN_WITH_ALL_ALGORITHMS;
+			break;
+		case 's':
+			if (strlen(optarg) % 2 != 0) {
+				fprintf(stderr, "Salt value is not valid hex data, not a multiple of 2 characters\n");
+				exit(EXIT_FAILURE);
+			}
+			nsec3_salt_length = (uint8_t) strlen(optarg) / 2;
+			nsec3_salt = LDNS_XMALLOC(uint8_t, nsec3_salt_length);
+			for (c = 0; c < (int) strlen(optarg); c += 2) {
+				if (isxdigit((int) optarg[c]) && isxdigit((int) optarg[c+1])) {
+					nsec3_salt[c/2] = (uint8_t) ldns_hexdigit_to_int(optarg[c]) * 16 +
+						ldns_hexdigit_to_int(optarg[c+1]);
+				} else {
+					fprintf(stderr, "Salt value is not valid hex data.\n");
+					exit(EXIT_FAILURE);
+				}
+			}
+
+			break;
+		case 't':
+			nsec3_iterations_cmd = (size_t) atol(optarg);
+			if (nsec3_iterations_cmd > LDNS_NSEC3_MAX_ITERATIONS) {
+				fprintf(stderr, "Iterations count can not exceed %u, quitting\n", LDNS_NSEC3_MAX_ITERATIONS);
+				exit(EXIT_FAILURE);
+			}
+			nsec3_iterations = (uint16_t) nsec3_iterations_cmd;
+			break;
+		default:
+			usage(stderr, prog);
+			exit(EXIT_SUCCESS);
+		}
+	}
+	
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		printf("Error: not enough arguments\n");
+		usage(stdout, prog);
+		exit(EXIT_FAILURE);
+	} else {
+		zonefile_name = argv[0];
+	}
+
+	/* read zonefile first to find origin if not specified */
+	
+	if (strncmp(zonefile_name, "-", 2) == 0) {
+		s = ldns_zone_new_frm_fp_l(&orig_zone,
+					   stdin,
+					   origin,
+					   ttl,
+					   class,
+					   &line_nr);
+			if (s != LDNS_STATUS_OK) {
+				fprintf(stderr, "Zone not read, error: %s at stdin line %d\n", 
+					   ldns_get_errorstr_by_id(s),
+					   line_nr);
+				exit(EXIT_FAILURE);
+			} else {
+				orig_soa = ldns_zone_soa(orig_zone);
+				if (!orig_soa) {
+					fprintf(stderr,
+						   "Error reading zonefile: missing SOA record\n");
+					exit(EXIT_FAILURE);
+				}
+				orig_rrs = ldns_zone_rrs(orig_zone);
+				if (!orig_rrs) {
+					fprintf(stderr,
+						   "Error reading zonefile: no resource records\n");
+					exit(EXIT_FAILURE);
+				}
+			}
+	} else {
+		zonefile = fopen(zonefile_name, "r");
+		
+		if (!zonefile) {
+			fprintf(stderr,
+				   "Error: unable to read %s (%s)\n",
+				   zonefile_name,
+				   strerror(errno));
+			exit(EXIT_FAILURE);
+		} else {
+			s = ldns_zone_new_frm_fp_l(&orig_zone,
+			                           zonefile,
+			                           origin,
+			                           ttl,
+			                           class,
+			                           &line_nr);
+			if (s != LDNS_STATUS_OK) {
+				fprintf(stderr, "Zone not read, error: %s at %s line %d\n", 
+					   ldns_get_errorstr_by_id(s), 
+					   zonefile_name, line_nr);
+				exit(EXIT_FAILURE);
+			} else {
+				orig_soa = ldns_zone_soa(orig_zone);
+				if (!orig_soa) {
+					fprintf(stderr,
+						   "Error reading zonefile: missing SOA record\n");
+					exit(EXIT_FAILURE);
+				}
+				orig_rrs = ldns_zone_rrs(orig_zone);
+				if (!orig_rrs) {
+					fprintf(stderr,
+						   "Error reading zonefile: no resource records\n");
+					exit(EXIT_FAILURE);
+				}
+			}
+			fclose(zonefile);
+		}
+	}
+
+	/* read the ZSKs */
+	argi = 1;
+	while (argi < argc) {
+		keyfile_name_base = argv[argi];
+		keyfile_name = LDNS_XMALLOC(char, strlen(keyfile_name_base) + 9);
+		snprintf(keyfile_name,
+			    strlen(keyfile_name_base) + 9,
+			    "%s.private",
+			    keyfile_name_base);
+		keyfile = fopen(keyfile_name, "r");
+		line_nr = 0;
+		if (!keyfile) {
+			fprintf(stderr,
+				   "Error: unable to read %s: %s\n",
+				   keyfile_name,
+				   strerror(errno));
+		} else {
+			s = ldns_key_new_frm_fp_l(&key, keyfile, &line_nr);
+			fclose(keyfile);
+			if (s == LDNS_STATUS_OK) {
+				/* set times in key? they will end up
+				   in the rrsigs
+				*/
+				if (expiration != 0) {
+					ldns_key_set_expiration(key, expiration);
+				}
+				if (inception != 0) {
+					ldns_key_set_inception(key, inception);
+				}
+
+				LDNS_FREE(keyfile_name);
+				
+				ldns_key_list_push_key(keys, key);
+			} else {
+				fprintf(stderr, "Error reading key from %s at line %d: %s\n", argv[argi], line_nr, ldns_get_errorstr_by_id(s));
+			}
+		}
+		/* and, if not unset by -p, find or create the corresponding DNSKEY record */
+		if (key) {
+			find_or_create_pubkey(keyfile_name_base, key,
+			                      orig_zone, add_keys, ttl);
+		}
+		argi++;
+	}
+
+#ifndef OPENSSL_NO_ENGINE
+       /*
+	* The user may have loaded a KSK and a ZSK from the engine.
+	* Since these keys carry no meta-information which is
+	* relevant to DNS (origin, TTL, etc), and because that
+	* information becomes known only after the command line
+	* and the zone file are parsed completely, the program
+	* needs to post-process these keys before they become usable.
+	*/
+
+	/* The engine's KSK. */
+	post_process_engine_key ( keys,
+				  eng_ksk,
+				  orig_zone,
+				  add_keys,
+				  ttl,
+				  inception,
+				  expiration );
+
+	/* The engine's ZSK. */
+	post_process_engine_key ( keys,
+				  eng_zsk,
+				  orig_zone,
+				  add_keys,
+				  ttl,
+				  inception,
+				  expiration );
+#endif
+	if (ldns_key_list_key_count(keys) < 1 
+	&&  !(signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)) {
+			
+		fprintf(stderr, "Error: no keys to sign with. Aborting.\n\n");
+		usage(stderr, prog);
+		exit(EXIT_FAILURE);
+	}
+
+	signed_zone = ldns_dnssec_zone_new();
+	if (unixtime_serial) {
+		ldns_rr_soa_increment_func_int(ldns_zone_soa(orig_zone),
+			ldns_soa_serial_unixtime, 0);
+	}
+	if (ldns_dnssec_zone_add_rr(signed_zone, ldns_zone_soa(orig_zone)) !=
+	    LDNS_STATUS_OK) {
+		fprintf(stderr,
+		  "Error adding SOA to dnssec zone, skipping record\n");
+	}
+	
+	for (i = 0;
+	     i < ldns_rr_list_rr_count(ldns_zone_rrs(orig_zone));
+	     i++) {
+		if (ldns_dnssec_zone_add_rr(signed_zone, 
+		         ldns_rr_list_rr(ldns_zone_rrs(orig_zone), 
+		         i)) !=
+		    LDNS_STATUS_OK) {
+			fprintf(stderr,
+			        "Error adding RR to dnssec zone");
+			fprintf(stderr, ", skipping record:\n");
+			ldns_rr_print(stderr, 
+			  ldns_rr_list_rr(ldns_zone_rrs(orig_zone), i));
+		}
+	}
+	/* list to store newly created rrs, so we can free them later */
+	added_rrs = ldns_rr_list_new();
+
+	if (use_nsec3) {
+		if (verbosity < 1)
+			; /* pass */
+
+		else if (nsec3_iterations > 500)
+			fprintf(stderr, "Warning! NSEC3 iterations larger than "
+			    "500 may cause validating resolvers to return "
+			    "SERVFAIL!\n"
+			    "See: https://datatracker.ietf.org/doc/html/"
+			    "draft-hardaker-dnsop-nsec3-guidance-03#section-4\n");
+
+		else if (nsec3_iterations > 100)
+			fprintf(stderr, "Warning! NSEC3 iterations larger than "
+			    "100 may cause validating resolvers to return "
+			    "insecure responses!\n"
+			    "See: https://datatracker.ietf.org/doc/html/"
+			    "draft-hardaker-dnsop-nsec3-guidance-03#section-4\n");
+
+		result = ldns_dnssec_zone_sign_nsec3_flg_mkmap(signed_zone,
+			added_rrs,
+			keys,
+			ldns_dnssec_default_replace_signatures,
+			NULL,
+			nsec3_algorithm,
+			nsec3_flags,
+			nsec3_iterations,
+			nsec3_salt_length,
+			nsec3_salt,
+			signflags,
+			&fmt_st.hashmap);
+	} else {
+		result = ldns_dnssec_zone_sign_flg(signed_zone,
+				added_rrs,
+				keys,
+				ldns_dnssec_default_replace_signatures,
+				NULL,
+				signflags);
+	}
+	if (result != LDNS_STATUS_OK) {
+		fprintf(stderr, "Error signing zone: %s\n",
+			   ldns_get_errorstr_by_id(result));
+	}
+
+	if (!outputfile_name) {
+		outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN);
+		snprintf(outputfile_name, MAX_FILENAME_LEN, "%s.signed", zonefile_name);
+	}
+
+	if (signed_zone) {
+		if (strncmp(outputfile_name, "-", 2) == 0) {
+			ldns_dnssec_zone_print(stdout, signed_zone);
+		} else {
+			outputfile = fopen(outputfile_name, "w");
+			if (!outputfile) {
+				fprintf(stderr, "Unable to open %s for writing: %s\n",
+					   outputfile_name, strerror(errno));
+			} else {
+				ldns_dnssec_zone_print_fmt(
+						outputfile, fmt, signed_zone);
+				fclose(outputfile);
+			}
+		}
+	} else {
+		fprintf(stderr, "Error signing zone.\n");
+
+#ifdef HAVE_SSL
+		if (ERR_peek_error()) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_LIBRESSL)
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
+			ERR_load_crypto_strings();
+#endif
+#endif
+			ERR_print_errors_fp(stderr);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_LIBRESSL)
+#ifdef HAVE_ERR_FREE_STRINGS
+			ERR_free_strings ();
+#endif
+#endif
+		}
+#endif
+		exit(EXIT_FAILURE);
+	}
+	
+	ldns_key_list_free(keys);
+	/* since the ldns_rr records are pointed to in both the ldns_zone
+	 * and the ldns_dnssec_zone, we can either deep_free the
+	 * dnssec_zone and 'shallow' free the original zone and added
+	 * records, or the other way around
+	 */
+	ldns_dnssec_zone_free(signed_zone);
+	ldns_zone_deep_free(orig_zone);
+	ldns_rr_list_deep_free(added_rrs);
+	ldns_rdf_deep_free(origin);
+	LDNS_FREE(outputfile_name);
+
+#ifndef OPENSSL_NO_ENGINE
+	shutdown_openssl ( engine );
+#else
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+	CRYPTO_cleanup_all_ex_data ();
+#endif
+#endif
+#endif
+
+	free(prog);
+	exit(EXIT_SUCCESS);
+}
+
+#else /* !HAVE_SSL */
+int
+main(int argc __attribute__((unused)),
+     char **argv __attribute__((unused)))
+{
+       fprintf(stderr, "ldns-signzone needs OpenSSL support, which has not been compiled in\n");
+       return 1;
+}
+#endif /* HAVE_SSL */
diff --git a/contrib/ldns/examples/ldns-test-edns.c b/contrib/ldns/examples/ldns-test-edns.c
new file mode 100644
index 00000000000000..8a0372d6204409
--- /dev/null
+++ b/contrib/ldns/examples/ldns-test-edns.c
@@ -0,0 +1,264 @@
+/*
+ * ldns-test-edns tries to get DNSKEY and RRSIG from an IP address.
+ * This can be used to test if a DNS cache supports DNSSEC (caching RRSIGs),
+ * i.e. for automatic configuration utilities or when you get a new DNS cache
+ * from DHCP and wonder if your local validator could use that as a cache.
+ *
+ * (c) NLnet Labs 2010
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include "errno.h"
+#include <ldns/ldns.h>
+
+/** print error details */
+static int verb = 1;
+
+static struct sockaddr_in6* cast_sockaddr_storage2sockaddr_in6(
+		struct sockaddr_storage* s)
+{
+	return (struct sockaddr_in6*)s;
+}
+
+static struct sockaddr_in* cast_sockaddr_storage2sockaddr_in(
+		struct sockaddr_storage* s)
+{
+	return (struct sockaddr_in*)s;
+}
+
+/** parse IP address */
+static int
+convert_addr(char* str, int p, struct sockaddr_storage* addr, socklen_t* len)
+{
+#ifdef AF_INET6
+	if(strchr(str, ':')) {
+		*len = (socklen_t)sizeof(struct sockaddr_in6);
+		cast_sockaddr_storage2sockaddr_in6(addr)->sin6_family =
+			AF_INET6;
+		cast_sockaddr_storage2sockaddr_in6(addr)->sin6_port =
+			htons((uint16_t)p);
+		if(inet_pton(AF_INET6, str,
+			&((struct sockaddr_in6*)addr)->sin6_addr) == 1)
+			return 1;
+	} else {
+#endif
+		*len = (socklen_t)sizeof(struct sockaddr_in);
+#ifndef S_SPLINT_S
+		cast_sockaddr_storage2sockaddr_in(addr)->sin_family =
+			AF_INET;
+#endif
+		cast_sockaddr_storage2sockaddr_in(addr)->sin_port =
+			htons((uint16_t)p);
+		if(inet_pton(AF_INET, str,
+			&((struct sockaddr_in*)addr)->sin_addr) == 1)
+			return 1;
+#ifdef AF_INET6
+	}
+#endif
+	if(verb) printf("error: cannot parse IP address %s\n", str);
+	return 0;
+}
+
+/** create a query to test */
+static ldns_buffer*
+make_query(const char* nm, int tp)
+{
+	/* with EDNS DO and CDFLAG */
+	ldns_buffer* b = ldns_buffer_new(512);
+	ldns_pkt* p;
+	ldns_status s;
+	if(!b) {
+		if(verb) printf("error: out of memory\n");
+		return NULL;
+	}
+
+	s = ldns_pkt_query_new_frm_str(&p, nm, tp, LDNS_RR_CLASS_IN,
+		(uint16_t)(LDNS_RD|LDNS_CD));
+	if(s != LDNS_STATUS_OK) {
+		if(verb) printf("error: %s\n", ldns_get_errorstr_by_id(s));
+		ldns_buffer_free(b);
+		return NULL;
+	}
+	if(!p) {
+		if(verb) printf("error: out of memory\n");
+		ldns_buffer_free(b);
+		return NULL;
+	}
+
+	ldns_pkt_set_edns_do(p, 1);
+	ldns_pkt_set_edns_udp_size(p, 4096);
+	ldns_pkt_set_id(p, ldns_get_random());
+	if( (s=ldns_pkt2buffer_wire(b, p)) != LDNS_STATUS_OK) {
+		if(verb) printf("error: %s\n", ldns_get_errorstr_by_id(s));
+		ldns_pkt_free(p);
+		ldns_buffer_free(b);
+		return NULL;
+	}
+	ldns_pkt_free(p);
+
+	return b;
+}
+
+/** try 3 times to get an EDNS reply from the server, exponential backoff */
+static int
+get_packet(struct sockaddr_storage* addr, socklen_t len, const char* nm,
+	int tp, uint8_t **wire, size_t* wlen)
+{
+	struct timeval t;
+	ldns_buffer* qbin;
+	ldns_status s;
+	int tries = 0;
+
+	memset(&t, 0, sizeof(t));
+	t.tv_usec = 100 * 1000; /* 100 milliseconds (then 200, 400, 800) */
+
+	qbin = make_query(nm, tp);
+	if(!qbin)
+		return 0;
+	while(tries < 4) {
+		tries ++;
+		s = ldns_udp_send(wire, qbin, addr, len, t, wlen);
+		if(s != LDNS_STATUS_NETWORK_ERR) {
+			break;
+		}
+		t.tv_usec *= 2;
+		if(t.tv_usec > 1000*1000) {
+			t.tv_usec -= 1000*1000;
+			t.tv_sec += 1;
+		}
+	}
+	ldns_buffer_free(qbin);
+	if(tries == 4) {
+		if(verb) printf("timeout\n");
+		return 0;
+	}
+	if(s != LDNS_STATUS_OK) {
+		if(verb) printf("error: %s\n", ldns_get_errorstr_by_id(s));
+		return 0;
+	}
+	return 1;
+}
+
+/** test if type is present in returned packet */
+static int
+check_type_in_answer(ldns_pkt* p, int t)
+{
+	ldns_rr_list *l = ldns_pkt_rr_list_by_type(p, t, LDNS_SECTION_ANSWER);
+	if(!l) {
+		char* s = ldns_rr_type2str(t);
+		if(verb) printf("no DNSSEC %s\n", s?s:"(out of memory)");
+		LDNS_FREE(s);
+		return 0;
+	}
+	ldns_rr_list_deep_free(l);
+	return 1;
+}
+
+/** check the packet and make sure that EDNS and DO and the type and RRSIG */
+static int
+check_packet(uint8_t* wire, size_t len, int tp)
+{
+	ldns_pkt *p = NULL;
+	ldns_status s;
+	if( (s=ldns_wire2pkt(&p, wire, len)) != LDNS_STATUS_OK) {
+		if(verb) printf("error: %s\n", ldns_get_errorstr_by_id(s));
+		goto failed;
+	}
+	if(!p) {
+		if(verb) printf("error: out of memory\n");
+		goto failed;
+	}
+
+	/* does DNS work? */
+	if(ldns_pkt_get_rcode(p) != LDNS_RCODE_NOERROR) {
+		char* r = ldns_pkt_rcode2str(ldns_pkt_get_rcode(p));
+		if(verb) printf("no answer, %s\n", r?r:"(out of memory)");
+		LDNS_FREE(r);
+		goto failed;
+	}
+
+	/* test EDNS0 presence, of OPT record */
+	/* LDNS forgets during pkt parse, but we test the ARCOUNT;
+	 * 0 additional means no EDNS(on the wire), and after parsing the
+	 * same additional RRs as before means no EDNS OPT */
+	if(LDNS_ARCOUNT(wire) == 0 ||
+		ldns_pkt_arcount(p) == LDNS_ARCOUNT(wire)) {
+		if(verb) printf("no EDNS\n");
+		goto failed;
+	}
+
+	/* test if the type, RRSIG present */
+	if(!check_type_in_answer(p, tp) ||
+	   !check_type_in_answer(p, LDNS_RR_TYPE_RRSIG)) {
+		goto failed;
+	}
+	
+	LDNS_FREE(wire);
+	ldns_pkt_free(p);
+	return 1;
+failed:
+	LDNS_FREE(wire);
+	ldns_pkt_free(p);
+	return 0;
+}
+
+/** check EDNS at this IP and port */
+static int
+check_edns_ip(char* ip, int port, int info)
+{
+	struct sockaddr_storage addr;
+	socklen_t len = 0;
+	uint8_t* wire;
+	size_t wlen;
+	memset(&addr, 0, sizeof(addr));
+	if(verb) printf("%s ", ip);
+	if(!convert_addr(ip, port, &addr, &len))
+		return 2;
+	/* try to send 3 times to the IP address, test root key */
+	if(!get_packet(&addr, len, ".", LDNS_RR_TYPE_DNSKEY, &wire, &wlen))
+		return 2;
+	if(!check_packet(wire, wlen, LDNS_RR_TYPE_DNSKEY))
+		return 1;
+	/* check support for caching type DS for chains of trust */
+	if(!get_packet(&addr, len, "se.", LDNS_RR_TYPE_DS, &wire, &wlen))
+		return 2;
+	if(!check_packet(wire, wlen, LDNS_RR_TYPE_DS))
+		return 1;
+	if(verb) printf("OK\n");
+	if(info) printf(" %s", ip);
+	return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+	int i, r=0, info=0, ok=0;
+#ifdef USE_WINSOCK
+	WSADATA wsa_data;
+	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
+		printf("WSAStartup failed\n"); exit(1);
+	}
+#endif
+	if (argc < 2 || strncmp(argv[1], "-h", 3) == 0) {
+		printf("Usage: ldns-test-edns [-i] {ip address}\n");
+		printf("Tests if the DNS cache at IP address supports EDNS.\n");
+		printf("if it works, print IP address OK.\n");
+		printf("-i: print IPs that are OK or print 'off'.\n");
+		printf("exit value, last IP is 0:OK, 1:fail, 2:net error.\n");
+		exit(1);
+	}
+	if(strcmp(argv[1], "-i") == 0) {
+		info = 1;
+		verb = 0;
+	}
+
+	for(i=1+info; i<argc; i++) {
+		r = check_edns_ip(argv[i], LDNS_PORT, info);
+		if(r == 0)
+			ok++;
+	}
+	if(info && !ok)
+		printf("off\n");
+	return r;
+}
diff --git a/contrib/ldns/examples/ldns-testns.1 b/contrib/ldns/examples/ldns-testns.1
new file mode 100644
index 00000000000000..e21bcf08a90225
--- /dev/null
+++ b/contrib/ldns/examples/ldns-testns.1
@@ -0,0 +1,131 @@
+.TH ldns-testns 1 "14 Dec 2006"
+.SH NAME
+ldns-testns \- simple fake nameserver tool
+.SH SYNOPSIS
+.B ldns-testns
+[
+.IR OPTION
+]
+.IR datafile
+
+.SH DESCRIPTION
+\fBldns-testns\fR can be used to provide answers to DNS queries for
+testing.  The answers are premade, and can be tailored to testing
+needs. The answers can be wildly invalid or unparsable.
+
+This program is a debugging aid. It is not efficient, especially
+with a long config file, but it can give any reply to any query.
+This can help the developer pre-script replies for queries.
+
+It listens to IP4 UDP and TCP by default.
+You can specify a packet RR by RR with header flags to return.
+
+ldns-testns is not meant for production use.
+
+.SH OPTIONS
+.TP
+\fB-r\fR
+Listens to a random port. The port number is printed to stdout.
+
+.TP
+\fB-p\fR \fIport\fR
+Listens to the specified port.
+
+.TP
+\fB-f\fR \fInum\fR
+Forks this number of additional instances that serve the same ports and
+same datafile. They do not exit; printed is 'forked pid: <num>' and you
+have to kill them yourself.
+
+.TP
+\fB-v\fR
+Outputs more debug information. It is possible to give this option multiple 
+times to increase verbosity level.
+
+.TP
+\fB-6\fR
+Bind to IP6 address instead of IP4. Use together with -p. 
+
+.TP
+\fBdatafile\fR
+The data file is read on start up. It contains queries and the packets 
+that should be sent in answer to those queries. The data file format is
+explained below.
+
+.SH DATA FILE FORMAT
+The data file format has ';' to denote comment. A number of entries
+are processed first to last. The first matching entry is used to answer
+the query with. This is a line based format. DNS resource records
+are entered in zone-file format.
+
+You can use $ORIGIN and $TTL directives. Zone file '(' and ')' to span
+multiple lines are not allowed.
+
+$ORIGIN origin
+$TTL default_ttl
+
+ENTRY_BEGIN
+
+; first give MATCH lines, that say what queries are matched
+; by this entry.
+; 'opcode' makes the query match the opcode from the reply
+; if you leave it out, any opcode matches this entry.
+; 'qtype' makes the query match the qtype from the reply
+; 'qname' makes the query match the qname from the reply
+; 'serial=1023' makes the query match if ixfr serial is 1023.
+
+MATCH [opcode] [qtype] [qname] [serial=<value>]
+MATCH [UDP|TCP]
+MATCH ...
+
+; Then the REPLY header is specified.
+
+REPLY opcode, rcode or flags.
+        (opcode)  QUERY IQUERY STATUS NOTIFY UPDATE
+        (rcode)   NOERROR FORMERR SERVFAIL NXDOMAIN NOTIMPL YXDOMAIN
+                        YXRRSET NXRRSET NOTAUTH NOTZONE
+        (flags)   QR AA TC RD CD RA AD
+
+REPLY ...
+
+; any additional actions to do.         
+
+ADJUST copy_id  ; 'copy_id' copies the ID from the query to the answer.
+
+; 'sleep=10' sleeps for 10 seconds before giving the answer (TCP is open)
+
+ADJUST [sleep=<num>]    ; sleep before giving any reply
+ADJUST [packet_sleep=<num>]  ; sleep before this packet in sequence
+
+SECTION QUESTION
+<RRs, one per line>    ; the RRcount is determined automatically.
+
+SECTION ANSWER
+<RRs, one per line>
+
+SECTION AUTHORITY
+<RRs, one per line>
+
+SECTION ADDITIONAL
+<RRs, one per line>
+
+EXTRA_PACKET            ; follow with SECTION, REPLY for more packets.
+HEX_ANSWER_BEGIN        ; follow with hex data
+                        ; this replaces any answer packet constructed
+                        ; with the SECTION keywords (only SECTION QUERY
+                        ; is used to match queries). If the data cannot
+                        ; be parsed, ADJUST rules for the answer packet
+                        ; are ignored
+
+HEX_ANSWER_END
+
+ENTRY_END
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage, and for testing purposes.
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+.SH COPYRIGHT
+Copyright (C) 2006-2008 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-testns.c b/contrib/ldns/examples/ldns-testns.c
new file mode 100644
index 00000000000000..f1b9c7228d241c
--- /dev/null
+++ b/contrib/ldns/examples/ldns-testns.c
@@ -0,0 +1,629 @@
+/*
+ * ldns-testns. Light-weight DNS daemon, gives canned replies.
+ *
+ * Tiny dns server, that responds with specially crafted replies
+ * to requests. For testing dns software.
+ *
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+/*
+ * This program is a debugging aid. It can is not efficient, especially
+ * with a long config file, but it can give any reply to any query.
+ * This can help the developer pre-script replies for queries.
+ *
+ * It listens to IP4 UDP and TCP by default.
+ * You can specify a packet RR by RR with header flags to return.
+ *
+ * Missing features:
+ *		- matching content different from reply content.
+ *		- find way to adjust mangled packets?
+ */
+
+/*
+	The data file format is as follows:
+	
+	; comment.
+	; a number of entries, these are processed first to last.
+	; a line based format.
+
+	$ORIGIN origin
+	$TTL default_ttl
+
+	ENTRY_BEGIN
+	; first give MATCH lines, that say what queries are matched
+	; by this entry.
+	; 'opcode' makes the query match the opcode from the reply
+	; if you leave it out, any opcode matches this entry.
+	; 'qtype' makes the query match the qtype from the reply
+	; 'qname' makes the query match the qname from the reply
+	; 'serial=1023' makes the query match if ixfr serial is 1023. 
+	MATCH [opcode] [qtype] [qname] [serial=<value>]
+	MATCH [UDP|TCP]
+	MATCH ...
+	; Then the REPLY header is specified.
+	REPLY opcode, rcode or flags.
+		(opcode)  QUERY IQUERY STATUS NOTIFY UPDATE
+		(rcode)   NOERROR FORMERR SERVFAIL NXDOMAIN NOTIMPL YXDOMAIN
+		 		YXRRSET NXRRSET NOTAUTH NOTZONE
+		(flags)   QR AA TC RD CD RA AD
+	REPLY ...
+	; any additional actions to do.
+	; 'copy_id' copies the ID from the query to the answer.
+	ADJUST copy_id
+	; 'sleep=10' sleeps for 10 seconds before giving the answer (TCP is open)
+	ADJUST [sleep=<num>]    ; sleep before giving any reply
+	ADJUST [packet_sleep=<num>]  ; sleep before this packet in sequence
+	SECTION QUESTION
+	<RRs, one per line>    ; the RRcount is determined automatically.
+	SECTION ANSWER
+	<RRs, one per line>
+	SECTION AUTHORITY
+	<RRs, one per line>
+	SECTION ADDITIONAL
+	<RRs, one per line>
+	EXTRA_PACKET		; follow with SECTION, REPLY for more packets.
+	HEX_ANSWER_BEGIN	; follow with hex data
+				; this replaces any answer packet constructed
+				; with the SECTION keywords (only SECTION QUERY
+				; is used to match queries). If the data cannot
+				; be parsed, ADJUST rules for the answer packet
+				; are ignored
+	HEX_ANSWER_END
+	ENTRY_END
+*/
+
+/* Example data file:
+$ORIGIN nlnetlabs.nl
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH qname
+REPLY NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www.nlnetlabs.nl.	IN	A
+SECTION ANSWER
+www.nlnetlabs.nl.	IN	A	195.169.215.155
+SECTION AUTHORITY
+nlnetlabs.nl.		IN	NS	www.nlnetlabs.nl.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH qname
+REPLY NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www2.nlnetlabs.nl.	IN	A
+HEX_ANSWER_BEGIN
+; 0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19
+;-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
+ 00 bf 81 80 00 01 00 01 00 02 00 02 03 77 77 77 0b 6b 61 6e	;	   1-  20
+ 61 72 69 65 70 69 65 74 03 63 6f 6d 00 00 01 00 01 03 77 77	;	  21-  40
+ 77 0b 6b 61 6e 61 72 69 65 70 69 65 74 03 63 6f 6d 00 00 01	;	  41-  60
+ 00 01 00 01 50 8b 00 04 52 5e ed 32 0b 6b 61 6e 61 72 69 65	;	  61-  80
+ 70 69 65 74 03 63 6f 6d 00 00 02 00 01 00 01 50 8b 00 11 03	;	  81- 100
+ 6e 73 31 08 68 65 78 6f 6e 2d 69 73 02 6e 6c 00 0b 6b 61 6e	;	 101- 120
+ 61 72 69 65 70 69 65 74 03 63 6f 6d 00 00 02 00 01 00 01 50	;	 121- 140
+ 8b 00 11 03 6e 73 32 08 68 65 78 6f 6e 2d 69 73 02 6e 6c 00	;	 141- 160
+ 03 6e 73 31 08 68 65 78 6f 6e 2d 69 73 02 6e 6c 00 00 01 00	;	 161- 180
+ 01 00 00 46 53 00 04 52 5e ed 02 03 6e 73 32 08 68 65 78 6f	;	 181- 200
+ 6e 2d 69 73 02 6e 6c 00 00 01 00 01 00 00 46 53 00 04 d4 cc	;	 201- 220
+ db 5b
+HEX_ANSWER_END
+ENTRY_END
+
+
+*/
+
+struct sockaddr_storage;
+#include "config.h"
+#include <ldns/ldns.h>
+#include "ldns-testpkts.h"
+
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#ifdef HAVE_SYS_TIME_H
+#include <sys/time.h>
+#endif
+#ifdef HAVE_SYS_SELECT_H
+#include <sys/select.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_UDP_H
+#include <netinet/udp.h>
+#endif
+#ifdef HAVE_NETINET_IGMP_H
+#include <netinet/igmp.h>
+#endif
+#include <errno.h>
+#include <signal.h>
+
+#ifdef HAVE_TARGETCONDITIONALS_H
+#include <TargetConditionals.h>
+#endif
+
+#if defined(TARGET_OS_TV) || defined(TARGET_OS_WATCH)
+#undef HAVE_FORK
+#endif
+
+#define INBUF_SIZE 4096         /* max size for incoming queries */
+#define DEFAULT_PORT 53		/* default if no -p port is specified */
+#define CONN_BACKLOG 256	/* connections queued up for tcp */
+static const char* prog_name = "ldns-testns";
+static FILE* logfile = 0;
+static int do_verbose = 0;
+
+static void usage(void)
+{
+	printf("Usage: %s [options] <datafile>\n", prog_name);
+	printf("  -r	listens on random port. Port number is printed.\n");
+	printf("  -p	listens on the specified port, default %d.\n", DEFAULT_PORT);
+	printf("  -f	forks given number extra instances, default none.\n");
+	printf("  -v	more verbose, prints queries, answers and matching.\n");
+	printf("  -6	listen on IP6 any address, instead of IP4 any address.\n");
+	printf("The program answers queries with canned replies from the datafile.\n");
+	exit(EXIT_FAILURE);
+}
+
+static void log_msg(const char* msg, ...)
+{
+	va_list args;
+	va_start(args, msg);
+	vfprintf(logfile, msg, args);
+	fflush(logfile);
+	va_end(args);
+}
+
+static void error(const char* msg, ...)
+{
+	va_list args;
+	va_start(args, msg);
+	fprintf(logfile, "%s error: ", prog_name);
+	vfprintf(logfile, msg, args);
+	fprintf(logfile, "\n");
+	fflush(logfile);
+	va_end(args);
+	exit(EXIT_FAILURE);
+}
+
+void verbose(int lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);
+void verbose(int ATTR_UNUSED(lvl), const char* msg, ...)
+{
+	va_list args;
+	va_start(args, msg);
+	if(do_verbose)
+		vfprintf(logfile, msg, args);
+	fflush(logfile);
+	va_end(args);
+}
+
+static int bind_port(int sock, int port, int fam)
+{
+    struct sockaddr_in addr;
+#if defined(AF_INET6) && defined(HAVE_GETADDRINFO)
+    if(fam == AF_INET6) {
+    	struct sockaddr_in6 addr6;
+	memset(&addr6, 0, sizeof(addr6));
+	addr6.sin6_family = AF_INET6;
+    	addr6.sin6_port = (in_port_t)htons((uint16_t)port);
+#  if HAVE_DECL_IN6ADDR_ANY
+	addr6.sin6_addr = in6addr_any;
+#  else
+	memset(&addr6.sin6_addr, 0, sizeof(addr6.sin6_addr));
+#  endif
+    	return bind(sock, (struct sockaddr *)&addr6, (socklen_t) sizeof(addr6));
+    }
+#endif
+
+#ifndef S_SPLINT_S
+    addr.sin_family = AF_INET;
+#endif
+    addr.sin_port = (in_port_t)htons((uint16_t)port);
+    addr.sin_addr.s_addr = INADDR_ANY;
+    return bind(sock, (struct sockaddr *)&addr, (socklen_t) sizeof(addr));
+}
+
+struct handle_udp_userdata {
+	int udp_sock;
+	struct sockaddr_storage addr_him;
+	socklen_t hislen;
+};
+static void
+send_udp(uint8_t* buf, size_t len, void* data)
+{
+	struct handle_udp_userdata *userdata = (struct handle_udp_userdata*)data;
+	/* udp send reply */
+	ssize_t nb;
+	nb = sendto(userdata->udp_sock, (void*)buf, len, 0, 
+		(struct sockaddr*)&userdata->addr_him, userdata->hislen);
+	if(nb == -1)
+		log_msg("sendto(): %s\n", strerror(errno));
+	else if((size_t)nb != len)
+		log_msg("sendto(): only sent %d of %d octets.\n", 
+			(int)nb, (int)len);
+}
+
+static void
+handle_udp(int udp_sock, struct entry* entries, int *count)
+{
+	ssize_t nb;
+	uint8_t inbuf[INBUF_SIZE];
+	struct handle_udp_userdata userdata;
+	userdata.udp_sock = udp_sock;
+
+	userdata.hislen = (socklen_t)sizeof(userdata.addr_him);
+	/* udp recv */
+	nb = recvfrom(udp_sock, (void*)inbuf, INBUF_SIZE, 0, 
+		(struct sockaddr*)&userdata.addr_him, &userdata.hislen);
+	if (nb < 1) {
+#ifndef USE_WINSOCK
+		log_msg("recvfrom(): %s\n", strerror(errno));
+#else
+		if(WSAGetLastError() != WSAEINPROGRESS &&
+			WSAGetLastError() != WSAECONNRESET &&
+			WSAGetLastError()!= WSAEWOULDBLOCK)
+			log_msg("recvfrom(): %d\n", WSAGetLastError());
+#endif
+		return;
+	}
+	handle_query(inbuf, nb, entries, count, transport_udp, send_udp, 
+		&userdata, do_verbose?logfile:0);
+}
+
+static int
+read_n_bytes(int sock, uint8_t* buf, size_t sz)
+{
+	size_t count = 0;
+	while(count < sz) {
+		ssize_t nb = recv(sock, (void*)(buf+count), sz-count, 0);
+		if(nb < 0) {
+			log_msg("recv(): %s\n", strerror(errno));
+			return -1;
+		} else if(nb == 0) {
+			log_msg("recv: remote end closed the channel\n");
+			return sz-count;
+		}
+		count += nb;
+	}
+	return 0;
+}
+
+static void
+write_n_bytes(int sock, uint8_t* buf, size_t sz)
+{
+	size_t count = 0;
+	while(count < sz) {
+		ssize_t nb = send(sock, (void*)(buf+count), sz-count, 0);
+		if(nb < 0) {
+			log_msg("send(): %s\n", strerror(errno));
+			return;
+		}
+		count += nb;
+	}
+}
+
+struct handle_tcp_userdata {
+	int s;
+};
+static void
+send_tcp(uint8_t* buf, size_t len, void* data)
+{
+	struct handle_tcp_userdata *userdata = (struct handle_tcp_userdata*)data;
+	uint16_t tcplen;
+	/* tcp send reply */
+	tcplen = htons(len);
+	write_n_bytes(userdata->s, (uint8_t*)&tcplen, sizeof(tcplen));
+	write_n_bytes(userdata->s, buf, len);
+}
+
+static void
+handle_tcp(int tcp_sock, struct entry* entries, int *count)
+{
+	int s;
+	struct sockaddr_storage addr_him;
+	socklen_t hislen;
+	uint8_t inbuf[INBUF_SIZE];
+	uint16_t tcplen = 0;
+	struct handle_tcp_userdata userdata;
+
+	/* accept */
+	hislen = (socklen_t)sizeof(addr_him);
+	if((s = accept(tcp_sock, (struct sockaddr*)&addr_him, &hislen)) < 0) {
+		log_msg("accept(): %s\n", strerror(errno));
+		return;
+	}
+	userdata.s = s;
+
+	while(1) {
+		/* tcp recv */
+		if (read_n_bytes(s, (uint8_t*)&tcplen, sizeof(tcplen))) {
+#ifndef USE_WINSOCK
+			close(s);
+#else
+			closesocket(s);
+#endif
+			return;
+		}
+		tcplen = ntohs(tcplen);
+		if(tcplen >= INBUF_SIZE) {
+			log_msg("query %d bytes too large, buffer %d bytes.\n",
+				tcplen, INBUF_SIZE);
+#ifndef USE_WINSOCK
+			close(s);
+#else
+			closesocket(s);
+#endif
+			return;
+		}
+		if (read_n_bytes(s, inbuf, tcplen)) {
+#ifndef USE_WINSOCK
+			close(s);
+#else
+			closesocket(s);
+#endif
+			return;
+		}
+
+		handle_query(inbuf, (ssize_t) tcplen, entries, count, transport_tcp, 
+			send_tcp, &userdata, do_verbose?logfile:0);
+
+		/* another query straight away? */
+		if(1) {
+			fd_set rset;
+			struct timeval tv;
+			int ret;
+			FD_ZERO(&rset);
+			FD_SET(s, &rset);
+			tv.tv_sec = 0;
+			tv.tv_usec = 100*1000;
+			ret = select(s+1, &rset, NULL, NULL, &tv);
+			if(ret < 0) {
+				error("select(): %s\n", strerror(errno));
+			}
+			if(ret == 0) {
+				/* timeout */
+				break;
+			}
+		}
+	}
+#ifndef USE_WINSOCK
+	close(s);
+#else
+	closesocket(s);
+#endif
+
+}
+
+/** shared by the service and main routine (forked and threaded) */
+static int udp_sock, tcp_sock;
+static struct entry* entries;
+
+/** 
+ * Test DNS server service, uses global udpsock, tcpsock, reply entries 
+ * The signature is kept void so the function can be used as a thread function.
+ */
+static void
+service(void)
+{
+	fd_set rset, wset, eset;
+	int count;
+	int maxfd;
+
+	/* service */
+	count = 0;
+	while (1) {
+#ifndef S_SPLINT_S
+		FD_ZERO(&rset);
+		FD_ZERO(&wset);
+		FD_ZERO(&eset);
+		FD_SET(udp_sock, &rset);
+		FD_SET(tcp_sock, &rset);
+#endif
+		maxfd = udp_sock;
+		if(tcp_sock > maxfd)
+			maxfd = tcp_sock;
+		if(select(maxfd+1, &rset, &wset, &eset, NULL) < 0) {
+			error("select(): %s\n", strerror(errno));
+		}
+		if(FD_ISSET(udp_sock, &rset)) {
+			handle_udp(udp_sock, entries, &count);
+		}
+		if(FD_ISSET(tcp_sock, &rset)) {
+			handle_tcp(tcp_sock, entries, &count);
+		}
+	}
+}
+
+static void
+forkit(int number)
+{
+	int i;
+	for(i=0; i<number; i++)
+	{
+#if !defined(HAVE_FORK) || !defined(HAVE_FORK_AVAILABLE)
+#ifndef USE_WINSOCK
+		log_msg("fork() not available.\n");
+		exit(1);
+#else /* USE_WINSOCK */
+		DWORD tid;
+		HANDLE id = CreateThread(NULL, 0, 
+			(LPTHREAD_START_ROUTINE)service, NULL,
+			0, &tid);
+		if(id == NULL) {
+			log_msg("error CreateThread: %d\n", GetLastError());
+			return;
+		}
+		log_msg("thread id: %d\n", (int)tid);
+#endif /* USE_WINSOCK */
+#else /* HAVE_FORK */
+		pid_t pid = fork();
+		if(pid == (pid_t) -1) {
+			log_msg("error forking: %s\n", strerror(errno));
+			return;
+		}
+		if(pid == 0)
+			return; /* child starts serving */
+		log_msg("forked pid: %d\n", (int)pid);
+#endif /* HAVE_FORK */
+	}
+}
+
+int
+main(int argc, char **argv)
+{
+	/* arguments */
+	int c;
+	int port = DEFAULT_PORT;
+	const char* datafile;
+	int forknum = 0;
+
+	/* network */
+	int fam = AF_INET;
+	bool random_port_success;
+
+#ifdef USE_WINSOCK
+	WSADATA wsa_data;
+#endif
+	
+	/* parse arguments */
+	srandom(time(NULL) ^ getpid());
+	logfile = stdout;
+	prog_name = argv[0];
+	log_msg("%s: start\n", prog_name);
+	while((c = getopt(argc, argv, "6f:p:rv")) != -1) {
+		switch(c) {
+		case '6':
+#ifdef AF_INET6
+			fam = AF_INET6;
+#else
+			log_msg("cannot -6: no IP6 available\n");
+			exit(1);
+#endif
+			break;
+		case 'r':
+                	port = 0;
+                	break;
+		case 'f':
+                	forknum = atoi(optarg);
+			if(forknum < 1)
+				error("invalid forkno %s, give number", optarg);
+                	break;
+		case 'p':
+			port = atoi(optarg);
+			if (port < 1) {
+				error("Invalid port %s, use a number.", optarg);
+			}
+			break;
+		case 'v':
+			do_verbose++;
+			break;
+		default:
+			usage();
+			break;
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if(argc == 0 || argc > 1)
+		usage();
+	
+	datafile = argv[0];
+	log_msg("Reading datafile %s\n", datafile);
+	entries = read_datafile(datafile, 0);
+
+#ifdef SIGPIPE
+        (void)signal(SIGPIPE, SIG_IGN);
+#endif
+#ifdef USE_WINSOCK
+	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0)
+		error("WSAStartup failed\n");
+#endif
+	
+	if((udp_sock = socket(fam, SOCK_DGRAM, 0)) < 0) {
+		error("udp socket(): %s\n", strerror(errno));
+	}
+	if((tcp_sock = socket(fam, SOCK_STREAM, 0)) < 0) {
+		error("tcp socket(): %s\n", strerror(errno));
+	}
+	c = 1;
+	if(setsockopt(tcp_sock, SOL_SOCKET, SO_REUSEADDR, (void*)&c, (socklen_t) sizeof(int)) < 0) {
+		error("setsockopt(SO_REUSEADDR): %s\n", strerror(errno));
+	}
+
+	/* bind ip4 */
+	if (port > 0) {
+		if (bind_port(udp_sock, port, fam)) {
+			error("cannot bind(): %s\n", strerror(errno));
+		}
+		if (bind_port(tcp_sock, port, fam)) {
+			error("cannot bind(): %s\n", strerror(errno));
+		}
+		if (listen(tcp_sock, CONN_BACKLOG) < 0) {
+			error("listen(): %s\n", strerror(errno));
+		}
+	} else {
+		random_port_success = false;
+		while (!random_port_success) {
+			port = (random() % 64510) + 1025;
+			log_msg("trying to bind to port %d\n", port);
+			random_port_success = true;
+			if (bind_port(udp_sock, port, fam)) {
+#ifdef EADDRINUSE
+				if (errno != EADDRINUSE) {
+#elif defined(USE_WINSOCK)
+				if (WSAGetLastError() != WSAEADDRINUSE) {
+#else
+				if (1) {
+#endif
+					perror("bind()");
+					return -1;
+				} else {
+					random_port_success = false;
+				}
+			}
+			if (random_port_success) {
+				if (bind_port(tcp_sock, port, fam)) {
+#ifdef EADDRINUSE
+					if (errno != EADDRINUSE) {
+#elif defined(USE_WINSOCK)
+					if (WSAGetLastError()!=WSAEADDRINUSE){
+#else
+					if (1) {
+#endif
+						perror("bind()");
+						return -1;
+					} else {
+						random_port_success = false;
+					}
+				}
+			}
+			if (random_port_success) {
+				if (listen(tcp_sock, CONN_BACKLOG) < 0) {
+					error("listen(): %s\n", strerror(errno));
+				}
+			}
+		
+		}
+	}
+	log_msg("Listening on port %d\n", port);
+
+	/* forky! */
+	if(forknum > 0)
+		forkit(forknum);
+
+	service();
+
+        return 0;
+}
diff --git a/contrib/ldns/examples/ldns-testpkts.c b/contrib/ldns/examples/ldns-testpkts.c
new file mode 100644
index 00000000000000..05a54c583888aa
--- /dev/null
+++ b/contrib/ldns/examples/ldns-testpkts.c
@@ -0,0 +1,950 @@
+/*
+ * ldns-testpkts. Data file parse for test packets, and query matching.
+ *
+ * Data storage for specially crafted replies for testing purposes.
+ *
+ * (c) NLnet Labs, 2005, 2006, 2007, 2008
+ * See the file LICENSE for the license
+ */
+
+/**
+ * \file
+ * This is a debugging aid. It is not efficient, especially
+ * with a long config file, but it can give any reply to any query.
+ * This can help the developer pre-script replies for queries.
+ *
+ * You can specify a packet RR by RR with header flags to return.
+ *
+ * Missing features:
+ *		- matching content different from reply content.
+ *		- find way to adjust mangled packets?
+ */
+
+#include "config.h"
+struct sockaddr_storage;
+#include <ldns/ldns.h>
+#include <errno.h>
+#include "ldns-testpkts.h"
+
+/** max line length */
+#define MAX_LINE   10240	
+/** string to show in warnings and errors */
+static const char* prog_name = "ldns-testpkts";
+
+/** logging routine, provided by caller */
+void verbose(int lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);
+
+/** print error and exit */
+static void error(const char* msg, ...) __attribute__((noreturn));
+static void error(const char* msg, ...)
+{
+	va_list args;
+	va_start(args, msg);
+	fprintf(stderr, "%s error: ", prog_name);
+	vfprintf(stderr, msg, args);
+	fprintf(stderr, "\n");
+	fflush(stderr);
+	va_end(args);
+	exit(EXIT_FAILURE);
+}
+
+/** return if string is empty or comment */
+static bool isendline(char c)
+{
+	if(c == ';' || c == '#' 
+		|| c == '\n' || c == 0)
+		return true;
+	return false;
+}
+
+/** true if the string starts with the keyword given. Moves the str ahead. 
+ * @param str: before keyword, afterwards after keyword and spaces.
+ * @param keyword: the keyword to match
+ * @return: true if keyword present. False otherwise, and str unchanged.
+*/
+static bool str_keyword(char** str, const char* keyword)
+{
+	size_t len = strlen(keyword);
+	assert(str && keyword);
+	if(strncmp(*str, keyword, len) != 0)
+		return false;
+	*str += len;
+	while(isspace((int)**str))
+		(*str)++;
+	return true;
+}
+
+/** Add reply packet to entry */
+static struct reply_packet*
+entry_add_reply(struct entry* entry) 
+{
+	struct reply_packet* pkt = (struct reply_packet*)malloc(
+		sizeof(struct reply_packet));
+	struct reply_packet ** p = &entry->reply_list;
+	pkt->next = NULL;
+	pkt->packet_sleep = 0;
+	pkt->reply = ldns_pkt_new();
+	pkt->reply_from_hex = NULL;
+	/* link at end */
+	while(*p)
+		p = &((*p)->next);
+	*p = pkt;
+	return pkt;
+}
+
+/** parse MATCH line */
+static void matchline(char* line, struct entry* e)
+{
+	char* parse = line;
+	while(*parse) {
+		if(isendline(*parse)) 
+			return;
+		if(str_keyword(&parse, "opcode")) {
+			e->match_opcode = true;
+		} else if(str_keyword(&parse, "qtype")) {
+			e->match_qtype = true;
+		} else if(str_keyword(&parse, "qname")) {
+			e->match_qname = true;
+		} else if(str_keyword(&parse, "subdomain")) {
+			e->match_subdomain = true;
+		} else if(str_keyword(&parse, "all")) {
+			e->match_all = true;
+		} else if(str_keyword(&parse, "ttl")) {
+			e->match_ttl = true;
+		} else if(str_keyword(&parse, "DO")) {
+			e->match_do = true;
+		} else if(str_keyword(&parse, "noedns")) {
+			e->match_noedns = true;
+		} else if(str_keyword(&parse, "ednsdata")) {
+			e->match_ednsdata_raw = true;
+		} else if(str_keyword(&parse, "UDP")) {
+			e->match_transport = transport_udp;
+		} else if(str_keyword(&parse, "TCP")) {
+			e->match_transport = transport_tcp;
+		} else if(str_keyword(&parse, "serial")) {
+			e->match_serial = true;
+			if(*parse != '=' && *parse != ':')
+				error("expected = or : in MATCH: %s", line);
+			parse++;
+			e->ixfr_soa_serial = (uint32_t)strtol(parse, (char**)&parse, 10);
+			while(isspace((int)*parse)) 
+				parse++;
+		} else {
+			error("could not parse MATCH: '%s'", parse);
+		}
+	}
+}
+
+/** parse REPLY line */
+static void replyline(char* line, ldns_pkt *reply)
+{
+	char* parse = line;
+	while(*parse) {
+		if(isendline(*parse)) 
+			return;
+			/* opcodes */
+		if(str_keyword(&parse, "QUERY")) {
+			ldns_pkt_set_opcode(reply, LDNS_PACKET_QUERY);
+		} else if(str_keyword(&parse, "IQUERY")) {
+			ldns_pkt_set_opcode(reply, LDNS_PACKET_IQUERY);
+		} else if(str_keyword(&parse, "STATUS")) {
+			ldns_pkt_set_opcode(reply, LDNS_PACKET_STATUS);
+		} else if(str_keyword(&parse, "NOTIFY")) {
+			ldns_pkt_set_opcode(reply, LDNS_PACKET_NOTIFY);
+		} else if(str_keyword(&parse, "UPDATE")) {
+			ldns_pkt_set_opcode(reply, LDNS_PACKET_UPDATE);
+			/* rcodes */
+		} else if(str_keyword(&parse, "NOERROR")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NOERROR);
+		} else if(str_keyword(&parse, "FORMERR")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_FORMERR);
+		} else if(str_keyword(&parse, "SERVFAIL")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_SERVFAIL);
+		} else if(str_keyword(&parse, "NXDOMAIN")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NXDOMAIN);
+		} else if(str_keyword(&parse, "NOTIMPL")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NOTIMPL);
+		} else if(str_keyword(&parse, "REFUSED")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_REFUSED);
+		} else if(str_keyword(&parse, "YXDOMAIN")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_YXDOMAIN);
+		} else if(str_keyword(&parse, "YXRRSET")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_YXRRSET);
+		} else if(str_keyword(&parse, "NXRRSET")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NXRRSET);
+		} else if(str_keyword(&parse, "NOTAUTH")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NOTAUTH);
+		} else if(str_keyword(&parse, "NOTZONE")) {
+			ldns_pkt_set_rcode(reply, LDNS_RCODE_NOTZONE);
+			/* flags */
+		} else if(str_keyword(&parse, "QR")) {
+			ldns_pkt_set_qr(reply, true);
+		} else if(str_keyword(&parse, "AA")) {
+			ldns_pkt_set_aa(reply, true);
+		} else if(str_keyword(&parse, "TC")) {
+			ldns_pkt_set_tc(reply, true);
+		} else if(str_keyword(&parse, "RD")) {
+			ldns_pkt_set_rd(reply, true);
+		} else if(str_keyword(&parse, "CD")) {
+			ldns_pkt_set_cd(reply, true);
+		} else if(str_keyword(&parse, "RA")) {
+			ldns_pkt_set_ra(reply, true);
+		} else if(str_keyword(&parse, "AD")) {
+			ldns_pkt_set_ad(reply, true);
+		} else if(str_keyword(&parse, "DO")) {
+			ldns_pkt_set_edns_udp_size(reply, 4096);
+			ldns_pkt_set_edns_do(reply, true);
+		} else {
+			error("could not parse REPLY: '%s'", parse);
+		}
+	}
+}
+
+/** parse ADJUST line */
+static void adjustline(char* line, struct entry* e, 
+	struct reply_packet* pkt)
+{
+	char* parse = line;
+	while(*parse) {
+		if(isendline(*parse)) 
+			return;
+		if(str_keyword(&parse, "copy_id")) {
+			e->copy_id = true;
+		} else if(str_keyword(&parse, "copy_query")) {
+			e->copy_query = true;
+		} else if(str_keyword(&parse, "sleep=")) {
+			e->sleeptime = (unsigned int) strtol(parse, (char**)&parse, 10);
+			while(isspace((int)*parse)) 
+				parse++;
+		} else if(str_keyword(&parse, "packet_sleep=")) {
+			pkt->packet_sleep = (unsigned int) strtol(parse, (char**)&parse, 10);
+			while(isspace((int)*parse)) 
+				parse++;
+		} else {
+			error("could not parse ADJUST: '%s'", parse);
+		}
+	}
+}
+
+/** create new entry */
+static struct entry* new_entry(void)
+{
+	struct entry* e = LDNS_MALLOC(struct entry);
+	memset(e, 0, sizeof(*e));
+	e->match_opcode = false;
+	e->match_qtype = false;
+	e->match_qname = false;
+	e->match_subdomain = false;
+	e->match_all = false;
+	e->match_ttl = false;
+	e->match_do = false;
+	e->match_noedns = false;
+	e->match_serial = false;
+	e->ixfr_soa_serial = 0;
+	e->match_transport = transport_any;
+	e->reply_list = NULL;
+	e->copy_id = false;
+	e->copy_query = false;
+	e->sleeptime = 0;
+	e->next = NULL;
+	return e;
+}
+
+/**
+ * Converts a hex string to binary data
+ * @param hexstr: string of hex.
+ * @param len: is the length of the string
+ * @param buf: is the buffer to store the result in
+ * @param offset: is the starting position in the result buffer
+ * @param buf_len: is the length of buf.
+ * @return This function returns the length of the result
+ */
+static size_t
+hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)
+{
+	char c;
+	int i; 
+	uint8_t int8 = 0;
+	int sec = 0;
+	size_t bufpos = 0;
+	
+	if (len % 2 != 0) {
+		return 0;
+	}
+
+	for (i=0; i<len; i++) {
+		c = hexstr[i];
+
+		/* case insensitive, skip spaces */
+		if (c != ' ') {
+			if (c >= '0' && c <= '9') {
+				int8 += c & 0x0f;  
+			} else if (c >= 'a' && c <= 'z') {
+				int8 += (c & 0x0f) + 9;   
+			} else if (c >= 'A' && c <= 'Z') {
+				int8 += (c & 0x0f) + 9;   
+			} else {
+				return 0;
+			}
+			 
+			if (sec == 0) {
+				int8 = int8 << 4;
+				sec = 1;
+			} else {
+				if (bufpos + offset + 1 <= buf_len) {
+					buf[bufpos+offset] = int8;
+					int8 = 0;
+					sec = 0; 
+					bufpos++;
+				} else {
+					fprintf(stderr, "Buffer too small in hexstr2bin");
+				}
+			}
+		}
+        }
+        return bufpos;
+}
+
+/** convert hex buffer to binary buffer */
+static ldns_buffer *
+data_buffer2wire(ldns_buffer *data_buffer)
+{
+	ldns_buffer *wire_buffer = NULL;
+	int c;
+	
+	/* stat hack
+	 * 0 = normal
+	 * 1 = comment (skip to end of line)
+	 * 2 = unprintable character found, read binary data directly
+	 */
+	size_t data_buf_pos = 0;
+	int state = 0;
+	uint8_t *hexbuf;
+	int hexbufpos = 0;
+	size_t wirelen;
+	uint8_t *data_wire = (uint8_t *) ldns_buffer_begin(data_buffer);
+	uint8_t *wire = LDNS_XMALLOC(uint8_t, LDNS_MAX_PACKETLEN);
+	
+	hexbuf = LDNS_XMALLOC(uint8_t, LDNS_MAX_PACKETLEN);
+	for (data_buf_pos = 0; data_buf_pos < ldns_buffer_position(data_buffer); data_buf_pos++) {
+		c = (int) data_wire[data_buf_pos];
+		
+		if (state < 2 && !isascii(c)) {
+			/*verbose("non ascii character found in file: (%d) switching to raw mode\n", c);*/
+			state = 2;
+		}
+		switch (state) {
+			case 0:
+				if (	(c >= '0' && c <= '9') ||
+					(c >= 'a' && c <= 'f') ||
+					(c >= 'A' && c <= 'F') )
+				{
+					if (hexbufpos >= LDNS_MAX_PACKETLEN) {
+						error("buffer overflow");
+						LDNS_FREE(hexbuf);
+						return 0;
+
+					}
+					hexbuf[hexbufpos] = (uint8_t) c;
+					hexbufpos++;
+				} else if (c == ';') {
+					state = 1;
+				} else if (c == ' ' || c == '\t' || c == '\n') {
+					/* skip whitespace */
+				} 
+				break;
+			case 1:
+				if (c == '\n' || c == EOF) {
+					state = 0;
+				}
+				break;
+			case 2:
+				if (hexbufpos >= LDNS_MAX_PACKETLEN) {
+					error("buffer overflow");
+					LDNS_FREE(hexbuf);
+					return 0;
+				}
+				hexbuf[hexbufpos] = (uint8_t) c;
+				hexbufpos++;
+				break;
+		}
+	}
+
+	if (hexbufpos >= LDNS_MAX_PACKETLEN) {
+		/*verbose("packet size reached\n");*/
+	}
+	
+	/* lenient mode: length must be multiple of 2 */
+	if (hexbufpos % 2 != 0) {
+		if (hexbufpos >= LDNS_MAX_PACKETLEN) {
+			error("buffer overflow");
+			LDNS_FREE(hexbuf);
+			return 0;
+		}
+		hexbuf[hexbufpos] = (uint8_t) '0';
+		hexbufpos++;
+	}
+
+	if (state < 2) {
+		wirelen = hexstr2bin((char *) hexbuf, hexbufpos, wire, 0, LDNS_MAX_PACKETLEN);
+		wire_buffer = ldns_buffer_new(wirelen);
+		ldns_buffer_new_frm_data(wire_buffer, wire, wirelen);
+	} else {
+		error("Incomplete hex data, not at byte boundary\n");
+	}
+	LDNS_FREE(wire);
+	LDNS_FREE(hexbuf);
+	return wire_buffer;
+}	
+
+/** parse ORIGIN */
+static void 
+get_origin(const char* name, int lineno, ldns_rdf** origin, char* parse)
+{
+	/* snip off rest of the text so as to make the parse work in ldns */
+	char* end;
+	char store;
+	ldns_status status;
+
+	ldns_rdf_free(*origin);
+	*origin = NULL;
+
+	end=parse;
+	while(!isspace((int)*end) && !isendline(*end))
+		end++;
+	store = *end;
+	*end = 0;
+	verbose(3, "parsing '%s'\n", parse);
+	status = ldns_str2rdf_dname(origin, parse);
+	*end = store;
+	if (status != LDNS_STATUS_OK)
+		error("%s line %d:\n\t%s: %s", name, lineno,
+		ldns_get_errorstr_by_id(status), parse);
+}
+
+/* Reads one entry from file. Returns entry or NULL on error. */
+struct entry*
+read_entry(FILE* in, const char* name, int *lineno, uint32_t* default_ttl, 
+	ldns_rdf** origin, ldns_rdf** prev_rr, int skip_whitespace)
+{
+	struct entry* current = NULL;
+	char line[MAX_LINE];
+	char* parse;
+	ldns_pkt_section add_section = LDNS_SECTION_QUESTION;
+	struct reply_packet *cur_reply = NULL;
+	bool reading_hex = false;
+	bool reading_hex_ednsdata = false;
+	ldns_buffer* hex_data_buffer = NULL;
+	ldns_buffer* hex_ednsdata_buffer = NULL;
+
+	while(fgets(line, (int)sizeof(line), in) != NULL) {
+		line[MAX_LINE-1] = 0;
+		parse = line;
+		(*lineno) ++;
+		
+		while(isspace((int)*parse))
+			parse++;
+		/* test for keywords */
+		if(isendline(*parse))
+			continue; /* skip comment and empty lines */
+		if(str_keyword(&parse, "ENTRY_BEGIN")) {
+			if(current) {
+				error("%s line %d: previous entry does not ENTRY_END", 
+					name, *lineno);
+			}
+			current = new_entry();
+			current->lineno = *lineno;
+			cur_reply = entry_add_reply(current);
+			continue;
+		} else if(str_keyword(&parse, "$ORIGIN")) {
+			get_origin(name, *lineno, origin, parse);
+			continue;
+		} else if(str_keyword(&parse, "$TTL")) {
+			*default_ttl = (uint32_t)atoi(parse);
+			continue;
+		}
+
+		/* working inside an entry */
+		if(!current) {
+			error("%s line %d: expected ENTRY_BEGIN but got %s", 
+				name, *lineno, line);
+		}
+		if(str_keyword(&parse, "MATCH")) {
+			matchline(parse, current);
+		} else if(str_keyword(&parse, "REPLY")) {
+			replyline(parse, cur_reply->reply);
+		} else if(str_keyword(&parse, "ADJUST")) {
+			adjustline(parse, current, cur_reply);
+		} else if(str_keyword(&parse, "EXTRA_PACKET")) {
+			cur_reply = entry_add_reply(current);
+		} else if(str_keyword(&parse, "SECTION")) {
+			if(str_keyword(&parse, "QUESTION"))
+				add_section = LDNS_SECTION_QUESTION;
+			else if(str_keyword(&parse, "ANSWER"))
+				add_section = LDNS_SECTION_ANSWER;
+			else if(str_keyword(&parse, "AUTHORITY"))
+				add_section = LDNS_SECTION_AUTHORITY;
+			else if(str_keyword(&parse, "ADDITIONAL"))
+				add_section = LDNS_SECTION_ADDITIONAL;
+			else error("%s line %d: bad section %s", name, *lineno, parse);
+		} else if(str_keyword(&parse, "HEX_ANSWER_BEGIN")) {
+			hex_data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
+			reading_hex = true;
+		} else if(str_keyword(&parse, "HEX_ANSWER_END")) {
+			if (!reading_hex) {
+				error("%s line %d: HEX_ANSWER_END read but no HEX_ANSWER_BEGIN keyword seen", name, *lineno);
+			}
+			reading_hex = false;
+			cur_reply->reply_from_hex = data_buffer2wire(hex_data_buffer);
+			ldns_buffer_free(hex_data_buffer);
+			hex_data_buffer = NULL;
+		} else if(reading_hex) {
+			ldns_buffer_printf(hex_data_buffer, line);
+		} else if(str_keyword(&parse, "HEX_EDNSDATA_BEGIN")) {
+			hex_ednsdata_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
+			reading_hex_ednsdata = true;
+		} else if(str_keyword(&parse, "HEX_EDNSDATA_END")) {
+			if (!reading_hex_ednsdata) {
+				error("%s line %d: HEX_EDNSDATA_END read but no"
+					"HEX_EDNSDATA_BEGIN keyword seen", name, *lineno);
+			}
+			reading_hex_ednsdata = false;
+			cur_reply->raw_ednsdata = data_buffer2wire(hex_ednsdata_buffer);
+			ldns_buffer_free(hex_ednsdata_buffer);
+			hex_ednsdata_buffer = NULL;
+		} else if(reading_hex_ednsdata) {
+			ldns_buffer_printf(hex_ednsdata_buffer, line);
+		} else if(str_keyword(&parse, "ENTRY_END")) {
+			if (hex_data_buffer)
+				ldns_buffer_free(hex_data_buffer);
+			return current;
+		} else {
+			/* it must be a RR, parse and add to packet. */
+			ldns_rr* n = NULL;
+			ldns_status status;
+			char* rrstr = line;
+			if (skip_whitespace)
+				rrstr = parse;
+			if(add_section == LDNS_SECTION_QUESTION)
+				status = ldns_rr_new_question_frm_str(
+					&n, rrstr, *origin, prev_rr);
+			else status = ldns_rr_new_frm_str(&n, rrstr,
+				*default_ttl, *origin, prev_rr);
+			if(status != LDNS_STATUS_OK)
+				error("%s line %d:\n\t%s: %s", name, *lineno,
+					ldns_get_errorstr_by_id(status), rrstr);
+			ldns_pkt_push_rr(cur_reply->reply, add_section, n);
+		}
+
+	}
+	if (reading_hex) {
+		error("%s: End of file reached while still reading hex, "
+			"missing HEX_ANSWER_END\n", name);
+	}
+	if(current) {
+		error("%s: End of file reached while reading entry. "
+			"missing ENTRY_END\n", name);
+	}
+	return 0;
+}
+
+/* reads the canned reply file and returns a list of structs */
+struct entry* 
+read_datafile(const char* name, int skip_whitespace)
+{
+	struct entry* list = NULL;
+	struct entry* last = NULL;
+	struct entry* current = NULL;
+	FILE *in;
+	int lineno = 0;
+	uint32_t default_ttl = 0;
+	ldns_rdf* origin = NULL;
+	ldns_rdf* prev_rr = NULL;
+	int entry_num = 0;
+
+	if((in=fopen(name, "r")) == NULL) {
+		error("could not open file %s: %s", name, strerror(errno));
+	}
+
+	while((current = read_entry(in, name, &lineno, &default_ttl, 
+		&origin, &prev_rr, skip_whitespace)))
+	{
+		if(last)
+			last->next = current;
+		else	list = current;
+		last = current;
+		entry_num ++;
+	}
+	verbose(1, "%s: Read %d entries\n", prog_name, entry_num);
+
+	fclose(in);
+	ldns_rdf_deep_free(origin);
+	ldns_rdf_deep_free(prev_rr);
+	return list;
+}
+
+/** get qtype from rr */
+static ldns_rr_type get_qtype(ldns_pkt* p)
+{
+	if(!ldns_rr_list_rr(ldns_pkt_question(p), 0))
+		return 0;
+	return ldns_rr_get_type(ldns_rr_list_rr(ldns_pkt_question(p), 0));
+}
+
+/** returns owner from rr */
+static ldns_rdf* get_owner(ldns_pkt* p)
+{
+	if(!ldns_rr_list_rr(ldns_pkt_question(p), 0))
+		return NULL;
+	return ldns_rr_owner(ldns_rr_list_rr(ldns_pkt_question(p), 0));
+}
+
+/** get authority section SOA serial value */
+static uint32_t get_serial(ldns_pkt* p)
+{
+	ldns_rr *rr = ldns_rr_list_rr(ldns_pkt_authority(p), 0);
+	ldns_rdf *rdf;
+	uint32_t val;
+	if(!rr) return 0;
+	rdf = ldns_rr_rdf(rr, 2);
+	if(!rdf) return 0;
+	val = ldns_rdf2native_int32(rdf);
+	verbose(3, "found serial %u in msg. ", (int)val);
+	return val;
+}
+
+/** match two rr lists */
+static int
+match_list(ldns_rr_list* q, ldns_rr_list *p, bool mttl)
+{
+	size_t i;
+	if(ldns_rr_list_rr_count(q) != ldns_rr_list_rr_count(p))
+		return 0;
+	for(i=0; i<ldns_rr_list_rr_count(q); i++)
+	{
+		if(ldns_rr_compare(ldns_rr_list_rr(q, i), 
+			ldns_rr_list_rr(p, i)) != 0) {
+			verbose(3, "rr %d different", (int)i);
+			return 0;
+		}
+		if(mttl && ldns_rr_ttl(ldns_rr_list_rr(q, i)) !=
+			ldns_rr_ttl(ldns_rr_list_rr(p, i))) {
+			verbose(3, "rr %d ttl different", (int)i);
+			return 0;
+		}
+	}
+	return 1;
+}
+
+/** compare two booleans */
+static int
+cmp_bool(int x, int y)
+{
+	if(!x && !y) return 0;
+	if(x && y) return 0;
+	if(!x) return -1;
+	return 1;
+}
+
+/** match all of the packet */
+static int
+match_all(ldns_pkt* q, ldns_pkt* p, bool mttl)
+{
+	if(ldns_pkt_get_opcode(q) != ldns_pkt_get_opcode(p)) 
+	{ verbose(3, "allmatch: opcode different"); return 0;}
+	if(ldns_pkt_get_rcode(q) != ldns_pkt_get_rcode(p))
+	{ verbose(3, "allmatch: rcode different"); return 0;}
+	if(ldns_pkt_id(q) != ldns_pkt_id(p))
+	{ verbose(3, "allmatch: id different"); return 0;}
+	if(cmp_bool(ldns_pkt_qr(q), ldns_pkt_qr(p)) != 0)
+	{ verbose(3, "allmatch: qr different"); return 0;}
+	if(cmp_bool(ldns_pkt_aa(q), ldns_pkt_aa(p)) != 0)
+	{ verbose(3, "allmatch: aa different"); return 0;}
+	if(cmp_bool(ldns_pkt_tc(q), ldns_pkt_tc(p)) != 0)
+	{ verbose(3, "allmatch: tc different"); return 0;}
+	if(cmp_bool(ldns_pkt_rd(q), ldns_pkt_rd(p)) != 0)
+	{ verbose(3, "allmatch: rd different"); return 0;}
+	if(cmp_bool(ldns_pkt_cd(q), ldns_pkt_cd(p)) != 0)
+	{ verbose(3, "allmatch: cd different"); return 0;}
+	if(cmp_bool(ldns_pkt_ra(q), ldns_pkt_ra(p)) != 0)
+	{ verbose(3, "allmatch: ra different"); return 0;}
+	if(cmp_bool(ldns_pkt_ad(q), ldns_pkt_ad(p)) != 0)
+	{ verbose(3, "allmatch: ad different"); return 0;}
+	if(ldns_pkt_qdcount(q) != ldns_pkt_qdcount(p))
+	{ verbose(3, "allmatch: qdcount different"); return 0;}
+	if(ldns_pkt_ancount(q) != ldns_pkt_ancount(p))
+	{ verbose(3, "allmatch: ancount different"); return 0;}
+	if(ldns_pkt_nscount(q) != ldns_pkt_nscount(p))
+	{ verbose(3, "allmatch: nscount different"); return 0;}
+	if(ldns_pkt_arcount(q) != ldns_pkt_arcount(p))
+	{ verbose(3, "allmatch: arcount different"); return 0;}
+	if(!match_list(ldns_pkt_question(q), ldns_pkt_question(p), 0))
+	{ verbose(3, "allmatch: qd section different"); return 0;}
+	if(!match_list(ldns_pkt_answer(q), ldns_pkt_answer(p), mttl))
+	{ verbose(3, "allmatch: an section different"); return 0;}
+	if(!match_list(ldns_pkt_authority(q), ldns_pkt_authority(p), mttl))
+	{ verbose(3, "allmatch: ar section different"); return 0;}
+	if(!match_list(ldns_pkt_additional(q), ldns_pkt_additional(p), mttl)) 
+	{ verbose(3, "allmatch: ns section different"); return 0;}
+	return 1;
+}
+
+/** Convert to hexstring and call verbose(), prepend with header */
+static void
+verbose_hex(int lvl, uint8_t *data, size_t datalen, const char *header)
+{
+	verbose(lvl, "%s", header);
+	while (datalen-- > 0) {
+		verbose(lvl, " %02x", (unsigned int)*data++);
+	}
+	verbose(lvl, "\n");
+}
+
+/** Match q edns data to p raw edns data */
+static int
+match_ednsdata(ldns_pkt* q, struct reply_packet* p)
+{
+	size_t qdlen, pdlen;
+	uint8_t *qd, *pd;
+	if(!ldns_pkt_edns(q) || !ldns_pkt_edns_data(q)) {
+		verbose(3, "No EDNS data\n");
+		return 0;
+	}
+	qdlen = ldns_rdf_size(ldns_pkt_edns_data(q));
+	pdlen = ldns_buffer_limit(p->raw_ednsdata);
+	qd = ldns_rdf_data(ldns_pkt_edns_data(q));
+	pd = ldns_buffer_begin(p->raw_ednsdata);
+	if( qdlen == pdlen && 0 == memcmp(qd, pd, qdlen) ) return 1;
+	verbose(3, "EDNS data does not match.\n");
+	verbose_hex(3, qd, qdlen, "q:");
+	verbose_hex(3, pd, pdlen, "p:");
+	return 0;
+}
+
+/* finds entry in list, or returns NULL */
+struct entry* 
+find_match(struct entry* entries, ldns_pkt* query_pkt,
+	enum transport_type transport)
+{
+	struct entry* p = entries;
+	ldns_pkt* reply = NULL;
+	for(p=entries; p; p=p->next) {
+		verbose(3, "comparepkt: ");
+		reply = p->reply_list->reply;
+		if(p->match_opcode && ldns_pkt_get_opcode(query_pkt) != 
+			ldns_pkt_get_opcode(reply)) {
+			verbose(3, "bad opcode\n");
+			continue;
+		}
+		if(p->match_qtype && get_qtype(query_pkt) != get_qtype(reply)) {
+			verbose(3, "bad qtype\n");
+			continue;
+		}
+		if(p->match_qname) {
+			if(!get_owner(query_pkt) || !get_owner(reply) ||
+				ldns_dname_compare(
+				get_owner(query_pkt), get_owner(reply)) != 0) {
+				verbose(3, "bad qname\n");
+				continue;
+			}
+		}
+		if(p->match_subdomain) {
+			if(!get_owner(query_pkt) || !get_owner(reply) ||
+				(ldns_dname_compare(get_owner(query_pkt), 
+				get_owner(reply)) != 0 &&
+				!ldns_dname_is_subdomain(
+				get_owner(query_pkt), get_owner(reply))))
+			{
+				verbose(3, "bad subdomain\n");
+				continue;
+			}
+		}
+		if(p->match_serial && get_serial(query_pkt) != p->ixfr_soa_serial) {
+				verbose(3, "bad serial\n");
+				continue;
+		}
+		if(p->match_do && !ldns_pkt_edns_do(query_pkt)) {
+			verbose(3, "no DO bit set\n");
+			continue;
+		}
+		if(p->match_noedns && ldns_pkt_edns(query_pkt)) {
+			verbose(3, "bad; EDNS OPT present\n");
+			continue;
+		}
+		if(p->match_ednsdata_raw && 
+				!match_ednsdata(query_pkt, p->reply_list)) {
+			verbose(3, "bad EDNS data match.\n");
+			continue;
+		}
+		if(p->match_transport != transport_any && p->match_transport != transport) {
+			verbose(3, "bad transport\n");
+			continue;
+		}
+		if(p->match_all && !match_all(query_pkt, reply, p->match_ttl)) {
+			verbose(3, "bad allmatch\n");
+			continue;
+		}
+		verbose(3, "match!\n");
+		return p;
+	}
+	return NULL;
+}
+
+void
+adjust_packet(struct entry* match, ldns_pkt* answer_pkt, ldns_pkt* query_pkt)
+{
+	/* copy & adjust packet */
+	if(match->copy_id)
+		ldns_pkt_set_id(answer_pkt, ldns_pkt_id(query_pkt));
+	if(match->copy_query) {
+		ldns_rr_list* list = ldns_pkt_get_section_clone(query_pkt,
+			LDNS_SECTION_QUESTION);
+		ldns_rr_list_deep_free(ldns_pkt_question(answer_pkt));
+		ldns_pkt_set_question(answer_pkt, list);
+	}
+	if(match->sleeptime > 0) {
+		verbose(3, "sleeping for %d seconds\n", match->sleeptime);
+#ifdef HAVE_SLEEP
+		sleep(match->sleeptime);
+#else
+		Sleep(match->sleeptime * 1000);
+#endif
+	}
+}
+
+/*
+ * Parses data buffer to a query, finds the correct answer 
+ * and calls the given function for every packet to send.
+ */
+void
+handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
+	enum transport_type transport, void (*sendfunc)(uint8_t*, size_t, void*),
+	void* userdata, FILE* verbose_out)
+{
+	ldns_status status;
+	ldns_pkt *query_pkt = NULL;
+	ldns_pkt *answer_pkt = NULL;
+	struct reply_packet *p;
+	ldns_rr *query_rr = NULL;
+	uint8_t *outbuf = NULL;
+	size_t answer_size = 0;
+	struct entry* entry = NULL;
+	ldns_rdf *stop_command = ldns_dname_new_frm_str("server.stop.");
+
+	status = ldns_wire2pkt(&query_pkt, inbuf, (size_t)inlen);
+	if (status != LDNS_STATUS_OK) {
+		verbose(1, "Got bad packet: %s\n", ldns_get_errorstr_by_id(status));
+		ldns_rdf_deep_free(stop_command);
+		return;
+	}
+	
+	query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
+	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count), (int)ldns_pkt_id(query_pkt), 
+		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
+	if(verbose_out) ldns_rr_print(verbose_out, query_rr);
+	if(verbose_out) ldns_pkt_print(verbose_out, query_pkt);
+
+	if (ldns_rr_get_type(query_rr) == LDNS_RR_TYPE_TXT &&
+	    ldns_rr_get_class(query_rr) == LDNS_RR_CLASS_CH &&
+	    ldns_dname_compare(ldns_rr_owner(query_rr), stop_command) == 0) {
+		exit(0);
+        }
+	
+	/* fill up answer packet */
+	entry = find_match(entries, query_pkt, transport);
+	if(!entry || !entry->reply_list) {
+		verbose(1, "no answer packet for this query, no reply.\n");
+		ldns_pkt_free(query_pkt);
+		ldns_rdf_deep_free(stop_command);
+		return;
+	}
+	for(p = entry->reply_list; p; p = p->next)
+	{
+		verbose(3, "Answer pkt:\n");
+		if (p->reply_from_hex) {
+			/* try to parse the hex packet, if it can be
+			 * parsed, we can use adjust rules. if not,
+			 * send packet literally */
+			status = ldns_buffer2pkt_wire(&answer_pkt, p->reply_from_hex);
+			if (status == LDNS_STATUS_OK) {
+				adjust_packet(entry, answer_pkt, query_pkt);
+				if(verbose_out) ldns_pkt_print(verbose_out, answer_pkt);
+				status = ldns_pkt2wire(&outbuf, answer_pkt, &answer_size);
+				verbose(2, "Answer packet size: %u bytes.\n", (unsigned int)answer_size);
+				if (status != LDNS_STATUS_OK) {
+					verbose(1, "Error creating answer: %s\n", ldns_get_errorstr_by_id(status));
+					ldns_pkt_free(query_pkt);
+					ldns_rdf_deep_free(stop_command);
+					return;
+				}
+				ldns_pkt_free(answer_pkt);
+				answer_pkt = NULL;
+			} else {
+				verbose(3, "Could not parse hex data (%s), sending hex data directly.\n", ldns_get_errorstr_by_id(status));
+				/* still try to adjust ID */
+				answer_size = ldns_buffer_capacity(p->reply_from_hex);
+				outbuf = LDNS_XMALLOC(uint8_t, answer_size);
+				memcpy(outbuf, ldns_buffer_begin(p->reply_from_hex), answer_size);
+				if(entry->copy_id) {
+					ldns_write_uint16(outbuf, 
+						ldns_pkt_id(query_pkt));
+				}
+			}
+		} else {
+			answer_pkt = ldns_pkt_clone(p->reply);
+			adjust_packet(entry, answer_pkt, query_pkt);
+			if(verbose_out) ldns_pkt_print(verbose_out, answer_pkt);
+			status = ldns_pkt2wire(&outbuf, answer_pkt, &answer_size);
+			verbose(1, "Answer packet size: %u bytes.\n", (unsigned int)answer_size);
+			if (status != LDNS_STATUS_OK) {
+				verbose(1, "Error creating answer: %s\n", ldns_get_errorstr_by_id(status));
+				ldns_pkt_free(query_pkt);
+				ldns_rdf_deep_free(stop_command);
+				return;
+			}
+			ldns_pkt_free(answer_pkt);
+			answer_pkt = NULL;
+		}
+		if(p->packet_sleep) {
+			verbose(3, "sleeping for next packet %d secs\n", 
+				p->packet_sleep);
+#ifdef HAVE_SLEEP
+			sleep(p->packet_sleep);
+#else
+			Sleep(p->packet_sleep * 1000);
+#endif
+			verbose(3, "wakeup for next packet "
+				"(slept %d secs)\n", p->packet_sleep);
+		}
+		sendfunc(outbuf, answer_size, userdata);
+		LDNS_FREE(outbuf);
+		outbuf = NULL;
+		answer_size = 0;
+	}
+	ldns_pkt_free(query_pkt);
+	ldns_rdf_deep_free(stop_command);
+}
+
+/** delete the list of reply packets */
+static void delete_replylist(struct reply_packet* replist)
+{
+	struct reply_packet *p=replist, *np;
+	while(p) {
+		np = p->next;
+		ldns_pkt_free(p->reply);
+		ldns_buffer_free(p->reply_from_hex);
+		free(p);
+		p=np;
+	}
+}
+
+void delete_entry(struct entry* list)
+{
+	struct entry *p=list, *np;
+	while(p) {
+		np = p->next;
+		delete_replylist(p->reply_list);
+		free(p);
+		p = np;
+	}
+}
diff --git a/contrib/ldns/examples/ldns-verify-zone.1.in b/contrib/ldns/examples/ldns-verify-zone.1.in
new file mode 100644
index 00000000000000..c37cb7912a118e
--- /dev/null
+++ b/contrib/ldns/examples/ldns-verify-zone.1.in
@@ -0,0 +1,115 @@
+.TH ldns-verifyzone 1 "27 May 2008"
+.SH NAME
+ldns-verify-zone \- read a DNSSEC signed zone and verify it.
+.SH SYNOPSIS
+.B ldns-verify-zone 
+.IR ZONEFILE 
+
+.SH DESCRIPTION
+
+\fBldns-verify-zone\fR reads a DNS zone file and verifies it. 
+
+RRSIG resource records are checked against the DNSKEY set at the zone apex.
+
+Each name is checked for an NSEC(3), if appropriate.
+
+If ZONEMD resource records are present, one of them needs to match the zone content.
+
+.SH OPTIONS
+.TP
+\fB-h\fR
+Show usage and exit
+
+.TP
+\fB-a\fR
+Apex only, check only the zone apex
+
+.TP
+\fB-e\fR \fIperiod\fR
+Signatures may not expire within this period.
+Default no period is used.
+
+.TP
+\fB-i\fR \fIperiod\fR
+Signatures must have been valid at least this long.
+Default signatures should just be valid now.
+
+.TP
+\fB-k\fR \fIfile\fR
+A file that contains a trusted DNSKEY or DS rr.
+This option may be given more than once.
+
+Alternatively, if \fB-k\fR is not specified, and a default trust anchor
+(@LDNS_TRUST_ANCHOR_FILE@) exists and contains a valid DNSKEY or DS record,
+it will be used as the trust anchor.
+.TP
+\fB-p\fR \fI[0-100]\fR
+Only check this percentage of the zone.
+Which names to check is determined randomly.
+Defaults to 100.
+
+.TP
+\fB-S\fR
+Chase signature(s) to a known key.
+The network may be accessed to validate the zone's DNSKEYs. (implies \-k)
+
+.TP
+\fB-t\fR \fIYYYYMMDDhhmmss | [+|-]offset\fR
+Set the validation time either by an absolute time value or as an offset in seconds from the current time.
+
+.TP
+\fB-v\fR
+Show the version and exit
+
+.TP
+\fB-V\fR \fInumber\fR
+Set the verbosity level (default 3):
+
+ 0: Be silent
+ 1: Print result, and any errors
+ 2: Same as 1 for now
+ 3: Print result, any errors, and the names that are
+    being checked
+ 4: Same as 3 for now
+ 5: Print the zone after it has been read, the result, 
+    any errors, and the names that are being checked
+
+.TP
+\fB-Z\fR
+Requires a valid ZONEMD RR to be present. When given once, this option will
+permit verifying only the ZONEMD RR of an unsigned zone. When given more than
+once, the zone needs to be validly DNSSEC signed as well.
+
+.TP
+\fB-ZZZ\fR
+When three times a \fB-Z\fR option is given, the ZONEMD RR to be verified is
+considered "detached" and does not need to have valid signatures.
+
+.LP
+\fIperiod\fRs are given in ISO 8601 duration format:
+.RS
+P[n]Y[n]M[n]DT[n]H[n]M[n]S
+.RE
+.LP
+If no file is given standard input is read.
+
+.SH "FILES"
+.TP
+@LDNS_TRUST_ANCHOR_FILE@
+The file from which trusted keys are loaded for signature chasing,
+when no \fB-k\fR option is given.
+
+.SH "SEE ALSO"
+.LP
+unbound-anchor(8)
+
+.SH AUTHOR
+Written by the ldns team as an example for ldns usage.
+
+.SH REPORTING BUGS
+Report bugs to <ldns-team@nlnetlabs.nl>. 
+
+.SH COPYRIGHT
+Copyright (C) 2008 NLnet Labs. This is free software. There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.
diff --git a/contrib/ldns/examples/ldns-verify-zone.c b/contrib/ldns/examples/ldns-verify-zone.c
new file mode 100644
index 00000000000000..ac076cd1afe7b3
--- /dev/null
+++ b/contrib/ldns/examples/ldns-verify-zone.c
@@ -0,0 +1,977 @@
+/*
+ * read a zone file from disk and prints it, one RR per line
+ *
+ * (c) NLnetLabs 2008
+ *
+ * See the file LICENSE for the license
+ *
+ * Missing from the checks: empty non-terminals
+ */
+
+#include "config.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/time.h>
+
+#include <ldns/ldns.h>
+
+#include <errno.h>
+
+#ifdef HAVE_SSL
+#include <openssl/err.h>
+
+static int verbosity = 3;
+static time_t check_time = 0;
+static int32_t inception_offset = 0;
+static int32_t expiration_offset = 0;
+static bool do_sigchase = false;
+static bool no_nomatch_msg = false;
+
+static FILE* myout;
+static FILE* myerr;
+
+static void
+update_error(ldns_status* result, ldns_status status)
+{
+	if (status != LDNS_STATUS_OK) {
+		if (*result == LDNS_STATUS_OK || *result == LDNS_STATUS_ERR || 
+		    (  *result == LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY 
+		     && status != LDNS_STATUS_ERR 
+		    )) {
+			*result = status;
+		}
+	}
+}
+
+static void
+print_type(FILE* stream, ldns_rr_type type)
+{
+	const ldns_rr_descriptor *descriptor  = ldns_rr_descript(type);
+
+	if (descriptor && descriptor->_name) {
+		fprintf(stream, "%s", descriptor->_name);
+	} else {
+		fprintf(stream, "TYPE%u", type);
+	}
+}
+
+static ldns_status
+read_key_file(const char *filename, ldns_rr_list *keys)
+{
+	ldns_status status = LDNS_STATUS_ERR;
+	ldns_rr *rr;
+	FILE *fp;
+	uint32_t my_ttl = 0;
+	ldns_rdf *my_origin = NULL;
+	ldns_rdf *my_prev = NULL;
+	int line_nr;
+
+	if (!(fp = fopen(filename, "r"))) {
+		return LDNS_STATUS_FILE_ERR;
+	}
+	while (!feof(fp)) {
+		status = ldns_rr_new_frm_fp_l(&rr, fp, &my_ttl, &my_origin,
+				&my_prev, &line_nr);
+
+		if (status == LDNS_STATUS_OK) {
+
+			if (   ldns_rr_get_type(rr) == LDNS_RR_TYPE_DS
+			    || ldns_rr_get_type(rr) == LDNS_RR_TYPE_DNSKEY)
+
+				ldns_rr_list_push_rr(keys, rr);
+
+		} else if (   status == LDNS_STATUS_SYNTAX_EMPTY
+		           || status == LDNS_STATUS_SYNTAX_TTL
+		           || status == LDNS_STATUS_SYNTAX_ORIGIN
+		           || status == LDNS_STATUS_SYNTAX_INCLUDE)
+
+			status = LDNS_STATUS_OK;
+		else
+			break;
+	}
+	fclose(fp);
+	return status;
+}
+
+
+
+static void
+print_rr_error(FILE* stream, ldns_rr* rr, const char* msg)
+{
+	if (verbosity > 0) {
+		fprintf(stream, "Error: %s for ", msg);
+		ldns_rdf_print(stream, ldns_rr_owner(rr));
+		fprintf(stream, "\t");
+		print_type(stream, ldns_rr_get_type(rr));
+		fprintf(stream, "\n");
+	}
+}
+
+static void
+print_rr_status_error(FILE* stream, ldns_rr* rr, ldns_status status)
+{
+	if (status != LDNS_STATUS_OK) {
+		print_rr_error(stream, rr, ldns_get_errorstr_by_id(status));
+		if (verbosity > 0 && status == LDNS_STATUS_SSL_ERR) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+			ERR_load_crypto_strings();
+#endif
+			ERR_print_errors_fp(stream);
+		}
+	}
+}
+
+static void
+print_rrs_status_error(FILE* stream, ldns_rr_list* rrs, ldns_status status,
+		ldns_dnssec_rrs* cur_sig)
+{
+	if (status != LDNS_STATUS_OK) {
+		if (ldns_rr_list_rr_count(rrs) > 0) {
+			print_rr_status_error(stream, ldns_rr_list_rr(rrs, 0),
+					status);
+		} else if (verbosity > 0) {
+			fprintf(stream, "Error: %s for <unknown>\n",
+					ldns_get_errorstr_by_id(status));
+		}
+		if (verbosity >= 4) {
+			fprintf(stream, "RRSet:\n");
+			ldns_rr_list_print(stream, rrs);
+			fprintf(stream, "Signature:\n");
+			ldns_rr_print(stream, cur_sig->rr);
+			fprintf(stream, "\n");
+		}
+	}
+}
+
+static ldns_status
+rrsig_check_time_margins(ldns_rr* rrsig
+#if 0 /* Passing those as arguments becomes sensible when 
+       * rrsig_check_time_margins will be added to the library.
+       */
+	,time_t check_time, int32_t inception_offset, int32_t expiration_offset
+#endif
+	)
+{
+	int32_t inception, expiration;
+
+	inception  = ldns_rdf2native_int32(ldns_rr_rrsig_inception (rrsig));
+	expiration = ldns_rdf2native_int32(ldns_rr_rrsig_expiration(rrsig));
+
+	if (((int32_t) (check_time - inception_offset))  - inception  < 0) {
+		return LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED_WITHIN_MARGIN;
+	}
+	if (expiration - ((int32_t) (check_time + expiration_offset)) < 0) {
+		return LDNS_STATUS_CRYPTO_SIG_EXPIRED_WITHIN_MARGIN;
+	}
+	return LDNS_STATUS_OK;
+}
+
+static ldns_status
+verify_rrs(ldns_rr_list* rrset_rrs, ldns_dnssec_rrs* cur_sig,
+		ldns_rr_list* keys)
+{
+	ldns_status status, result = LDNS_STATUS_OK;
+	ldns_dnssec_rrs *cur_sig_bak = cur_sig;
+
+	/* A single valid signature validates the RRset */
+	while (cur_sig) {
+		if (ldns_verify_rrsig_keylist_time( rrset_rrs, cur_sig->rr
+		                                  , keys, check_time, NULL)
+		||  rrsig_check_time_margins(cur_sig->rr))
+			cur_sig = cur_sig->next;
+		else
+			return LDNS_STATUS_OK;
+	}
+	/* Without any valid signature, do print all errors.  */
+	for (cur_sig = cur_sig_bak; cur_sig; cur_sig = cur_sig->next) {
+		status = ldns_verify_rrsig_keylist_time(rrset_rrs,
+		    cur_sig->rr, keys, check_time, NULL);
+		status = status ? status 
+		       : rrsig_check_time_margins(cur_sig->rr);
+		if (!status)
+			; /* pass */
+		else if (!no_nomatch_msg || status !=
+		    LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY)
+			print_rrs_status_error(
+			    myerr, rrset_rrs, status, cur_sig);
+		update_error(&result, status);
+	}
+	return result;
+}
+
+static ldns_status
+verify_dnssec_rrset(ldns_rdf *zone_name, ldns_rdf *name,
+		ldns_dnssec_rrsets *rrset, ldns_rr_list *keys) 
+{
+	ldns_rr_list *rrset_rrs;
+	ldns_dnssec_rrs *cur_rr, *cur_sig;
+	ldns_status status;
+
+	if (!rrset->rrs) return LDNS_STATUS_OK;
+
+	rrset_rrs = ldns_rr_list_new();
+	cur_rr = rrset->rrs;
+	while(cur_rr && cur_rr->rr) {
+		ldns_rr_list_push_rr(rrset_rrs, cur_rr->rr);
+		cur_rr = cur_rr->next;
+	}
+	cur_sig = rrset->signatures;
+	if (cur_sig) {
+		status = verify_rrs(rrset_rrs, cur_sig, keys);
+
+	} else /* delegations may be unsigned (on opt out...) */
+	       if (rrset->type != LDNS_RR_TYPE_NS || 
+			       ldns_dname_compare(name, zone_name) == 0) {
+		
+		print_rr_error(myerr, rrset->rrs->rr, "no signatures");
+		status = LDNS_STATUS_CRYPTO_NO_RRSIG;
+	} else {
+		status = LDNS_STATUS_OK;
+	}
+	ldns_rr_list_free(rrset_rrs);
+
+	return status;
+}
+
+static ldns_status
+verify_single_rr(ldns_rr *rr, ldns_dnssec_rrs *signature_rrs,
+		ldns_rr_list *keys)
+{
+	ldns_rr_list *rrset_rrs;
+	ldns_status status;
+
+	rrset_rrs = ldns_rr_list_new();
+	ldns_rr_list_push_rr(rrset_rrs, rr);
+
+	status = verify_rrs(rrset_rrs, signature_rrs, keys);
+
+	ldns_rr_list_free(rrset_rrs);
+
+	return status;
+}
+
+static ldns_status
+verify_next_hashed_name(ldns_dnssec_zone* zone, ldns_dnssec_name *name)
+{
+	ldns_rbnode_t *next_node;
+	ldns_dnssec_name *next_name;
+	int cmp;
+	char *next_owner_str;
+	ldns_rdf *next_owner_dname;
+
+	assert(name->hashed_name != NULL);
+
+	next_node = ldns_rbtree_search(zone->hashed_names, name->hashed_name);
+	assert(next_node != NULL);
+	do {
+		next_node = ldns_rbtree_next(next_node);
+		if (next_node == LDNS_RBTREE_NULL) {
+			next_node = ldns_rbtree_first(zone->hashed_names);
+		}
+		next_name = (ldns_dnssec_name *) next_node->data;
+	} while (! next_name->nsec);
+
+	next_owner_str = ldns_rdf2str(ldns_nsec3_next_owner(name->nsec));
+	next_owner_dname = ldns_dname_new_frm_str(next_owner_str);
+	cmp = ldns_dname_compare(next_owner_dname, next_name->hashed_name);
+	ldns_rdf_deep_free(next_owner_dname);
+	LDNS_FREE(next_owner_str);
+	if (cmp != 0) {
+		if (verbosity > 0) {
+			fprintf(myerr, "Error: The NSEC3 record for ");
+			ldns_rdf_print(stdout, name->name);
+			fprintf(myerr, " points to the wrong next hashed owner"
+					" name\n\tshould point to ");
+			ldns_rdf_print(myerr, next_name->name);
+			fprintf(myerr, ", whose hashed name is ");
+			ldns_rdf_print(myerr, next_name->hashed_name);
+			fprintf(myerr, "\n");
+		}
+		return LDNS_STATUS_ERR;
+	} else {
+		return LDNS_STATUS_OK;
+	}
+}
+
+static bool zone_is_nsec3_optout(ldns_dnssec_zone* zone)
+{
+	static int remember = -1;
+	
+	if (remember == -1) {
+		remember = ldns_dnssec_zone_is_nsec3_optout(zone) ? 1 : 0;
+	}
+	return remember == 1;
+}
+
+static ldns_status
+verify_nsec(ldns_dnssec_zone* zone, ldns_rbnode_t *cur_node,
+		ldns_rr_list *keys)
+{
+	ldns_rbnode_t *next_node;
+	ldns_dnssec_name *name, *next_name;
+	ldns_status status, result;
+	result = LDNS_STATUS_OK;
+
+	name = (ldns_dnssec_name *) cur_node->data;
+	if (name->nsec) {
+		if (name->nsec_signatures) {
+			status = verify_single_rr(name->nsec,
+					name->nsec_signatures, keys);
+
+			update_error(&result, status);
+		} else {
+			if (verbosity > 0) {
+				fprintf(myerr,
+					"Error: the NSEC(3) record of ");
+				ldns_rdf_print(myerr, name->name);
+				fprintf(myerr, " has no signatures\n");
+			}
+			update_error(&result, LDNS_STATUS_ERR);
+		}
+		/* check whether the NSEC record points to the right name */
+		switch (ldns_rr_get_type(name->nsec)) {
+			case LDNS_RR_TYPE_NSEC:
+				/* simply try next name */
+				next_node = ldns_rbtree_next(cur_node);
+				if (next_node == LDNS_RBTREE_NULL) {
+					next_node = ldns_rbtree_first(
+							zone->names);
+				}
+				next_node = ldns_dnssec_name_node_next_nonglue(
+						next_node);
+				if (!next_node) {
+					next_node =
+					    ldns_dnssec_name_node_next_nonglue(
+						ldns_rbtree_first(zone->names));
+				}
+				next_name = (ldns_dnssec_name*)next_node->data;
+				if (ldns_dname_compare(next_name->name,
+							ldns_rr_rdf(name->nsec,
+								0)) != 0) {
+					if (verbosity > 0) {
+						fprintf(myerr, "Error: the "
+							"NSEC record for ");
+						ldns_rdf_print(myerr,
+								name->name);
+						fprintf(myerr, " points to "
+							"the wrong "
+							"next owner name\n");
+					}
+					if (verbosity >= 4) {
+						fprintf(myerr, "\t: ");
+						ldns_rdf_print(myerr,
+							ldns_rr_rdf(
+								name->nsec,
+								0));
+						fprintf(myerr, " i.s.o. ");
+						ldns_rdf_print(myerr,
+							next_name->name);
+						fprintf(myerr, ".\n");
+					}
+					update_error(&result,
+							LDNS_STATUS_ERR);
+				}
+				break;
+			case LDNS_RR_TYPE_NSEC3:
+				/* find the hashed next name in the tree */
+				/* this is expensive, do we need to add 
+				 * support for this in the structs?
+				 * (ie. pointer to next hashed name?)
+				 */
+				status = verify_next_hashed_name(zone, name);
+				update_error(&result, status);
+				break;
+			default:
+				break;
+		}
+	} else {
+		if (zone_is_nsec3_optout(zone) &&
+		    (ldns_dnssec_name_is_glue(name) ||
+		     (    ldns_dnssec_rrsets_contains_type(name->rrsets,
+							   LDNS_RR_TYPE_NS)
+		      && !ldns_dnssec_rrsets_contains_type(name->rrsets,
+							   LDNS_RR_TYPE_DS)))) {
+			/* ok, no problem, but we need to remember to check
+			 * whether the chain does not actually point to this
+			 * name later */
+		} else {
+			if (verbosity > 0) {
+				fprintf(myerr,
+					"Error: there is no NSEC(3) for ");
+				ldns_rdf_print(myerr, name->name);
+				fprintf(myerr, "\n");
+			}
+			update_error(&result, LDNS_STATUS_ERR);
+		}
+	}
+	return result;
+}
+
+static ldns_status
+verify_dnssec_name(ldns_rdf *zone_name, ldns_dnssec_zone* zone,
+		ldns_rbnode_t *cur_node, ldns_rr_list *keys,
+		bool detached_zonemd)
+{
+	ldns_status result = LDNS_STATUS_OK;
+	ldns_status status;
+	ldns_dnssec_rrsets *cur_rrset;
+	ldns_dnssec_name *name;
+	int on_delegation_point;
+	/* for NSEC chain checks */
+
+	name = (ldns_dnssec_name *) cur_node->data;
+	if (verbosity >= 5) {
+		fprintf(myout, "Checking: ");
+		ldns_rdf_print(myout, name->name);
+		fprintf(myout, "\n");
+	}
+
+	if (ldns_dnssec_name_is_glue(name)) {
+		/* glue */
+		cur_rrset = name->rrsets;
+		while (cur_rrset) {
+			if (cur_rrset->signatures) {
+				if (verbosity > 0) {
+					fprintf(myerr, "Error: ");
+					ldns_rdf_print(myerr, name->name);
+					fprintf(myerr, "\t");
+					print_type(myerr, cur_rrset->type);
+					fprintf(myerr, " has signature(s),"
+							" but is occluded"
+							" (or glue)\n");
+				}
+				result = LDNS_STATUS_ERR;
+			}
+			cur_rrset = cur_rrset->next;
+		}
+		if (name->nsec) {
+			if (verbosity > 0) {
+				fprintf(myerr, "Error: ");
+				ldns_rdf_print(myerr, name->name);
+				fprintf(myerr, " has an NSEC(3),"
+						" but is occluded"
+						" (or glue)\n");
+			}
+			result = LDNS_STATUS_ERR;
+		}
+	} else {
+		/* not glue, do real verify */
+
+		on_delegation_point =
+			    ldns_dnssec_rrsets_contains_type(name->rrsets,
+					LDNS_RR_TYPE_NS)
+			&& !ldns_dnssec_rrsets_contains_type(name->rrsets,
+					LDNS_RR_TYPE_SOA);
+		cur_rrset = name->rrsets;
+		while(cur_rrset) {
+
+			/* Do not check occluded rrsets
+			 * on the delegation point
+			 */
+			if ((on_delegation_point && 
+			     (cur_rrset->type == LDNS_RR_TYPE_NS ||
+			      cur_rrset->type == LDNS_RR_TYPE_DS)) ||
+			    (!on_delegation_point &&
+			     cur_rrset->type != LDNS_RR_TYPE_RRSIG &&
+			     cur_rrset->type != LDNS_RR_TYPE_NSEC &&
+
+			     (   cur_rrset->type != LDNS_RR_TYPE_ZONEMD
+			     || !detached_zonemd || cur_rrset->signatures))) {
+
+				status = verify_dnssec_rrset(zone_name,
+						name->name, cur_rrset, keys);
+				update_error(&result, status);
+			}
+			cur_rrset = cur_rrset->next;
+		}
+		status = verify_nsec(zone, cur_node, keys);
+		update_error(&result, status);
+	}
+	return result;
+}
+
+static void
+add_keys_with_matching_ds(ldns_dnssec_rrsets* from_keys, ldns_rr_list *dss,
+		ldns_rr_list *to_keys)
+{
+	size_t i;
+	ldns_rr* ds_rr;
+	ldns_dnssec_rrs *cur_key;
+
+	for (i = 0; i < ldns_rr_list_rr_count(dss); i++) {
+
+		if (ldns_rr_get_type(ds_rr = ldns_rr_list_rr(dss, i)) 
+				== LDNS_RR_TYPE_DS) {
+
+			for (cur_key = from_keys->rrs; cur_key;
+					cur_key = cur_key->next ) {
+
+				if (ldns_rr_compare_ds(cur_key->rr, ds_rr)) {
+					ldns_rr_list_push_rr(to_keys,
+							cur_key->rr);
+					break;
+				}
+			}
+		}
+	}
+}
+
+static ldns_resolver *p_ldns_new_res(ldns_resolver** new_res, ldns_status *s)
+{
+	assert(new_res && s);
+	if (!(*s = ldns_resolver_new_frm_file(new_res, NULL))) {
+		ldns_resolver_set_dnssec(*new_res, 1);
+		ldns_resolver_set_dnssec_cd(*new_res, 1);
+		return *new_res;
+	}
+	ldns_resolver_free(*new_res);
+	return (*new_res = NULL);
+}
+
+static ldns_status
+sigchase(ldns_resolver* res, ldns_rdf *zone_name, ldns_dnssec_rrsets *zonekeys,
+		ldns_rr_list *keys)
+{
+	ldns_dnssec_rrs* cur_key;
+	ldns_status status;
+	ldns_resolver* new_res = NULL;
+	ldns_rdf* parent_name = NULL;
+	ldns_rr_list* parent_keys = NULL;
+	ldns_rr_list* ds_keys = NULL;
+
+	add_keys_with_matching_ds(zonekeys, keys, keys);
+
+	/* First try to authenticate the keys offline.
+	 * When do_sigchase is given validation may continue lookup up
+	 * keys online. Reporting the failure of the offline validation
+	 * should then be suppressed.
+	 */
+	no_nomatch_msg = do_sigchase;
+	status = verify_dnssec_rrset(zone_name, zone_name, zonekeys, keys);
+	no_nomatch_msg = false;
+
+	/* Continue online on validation failure when the -S option was given.
+	 */
+	if (  !do_sigchase
+	    || status != LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY
+	    || ldns_dname_label_count(zone_name) == 0 ) {
+		if (verbosity > 0) {
+			fprintf(myerr, "Cannot chase the root: %s\n"
+			             , ldns_get_errorstr_by_id(status));
+		}
+
+	} else if (!res && !(res = p_ldns_new_res(&new_res, &status))) {
+		if (verbosity > 0) {
+			fprintf(myerr, "Could not create resolver: %s\n"
+			             , ldns_get_errorstr_by_id(status));
+		}
+	} else if (!(parent_name = ldns_dname_left_chop(zone_name))) {
+		status = LDNS_STATUS_MEM_ERR;
+
+	/*
+	 * Use the (authenticated) keys of the parent zone ...
+	 */
+	} else if (!(parent_keys = ldns_fetch_valid_domain_keys(res,
+				parent_name, keys, &status))) {
+		if (verbosity > 0) {
+			fprintf(myerr,
+				"Could not get valid DNSKEY RRset to "
+				"validate domain's DS: %s\n",
+				ldns_get_errorstr_by_id(status)
+				);
+		}
+	/*
+	 * ... to validate the DS for the zone ...
+	 */
+	} else if (!(ds_keys = ldns_validate_domain_ds(res, zone_name,
+				parent_keys))) {
+		status = LDNS_STATUS_CRYPTO_NO_TRUSTED_DS;
+		if (verbosity > 0) {
+			fprintf(myerr,
+				"Could not get valid DS RRset for domain: %s\n",
+				ldns_get_errorstr_by_id(status)
+				);
+		}
+	} else {
+		/*
+		 * ... to use it to add the KSK to the trusted keys ...
+		 */
+		add_keys_with_matching_ds(zonekeys, ds_keys, keys);
+
+		/*
+		 * ... to validate all zonekeys ...
+		 */
+		status = verify_dnssec_rrset(zone_name, zone_name,
+				zonekeys, keys);
+	}
+	/*
+	 * ... so they can all be added to our list of trusted keys.
+	 */
+	ldns_resolver_deep_free(new_res);
+	ldns_rdf_deep_free(parent_name);
+	ldns_rr_list_free(parent_keys);
+	ldns_rr_list_free(ds_keys);
+
+	if (status == LDNS_STATUS_OK)
+		for (cur_key = zonekeys->rrs; cur_key; cur_key = cur_key->next)
+			ldns_rr_list_push_rr(keys, cur_key->rr);
+	return status;
+}
+
+static ldns_status
+verify_dnssec_zone(ldns_dnssec_zone *dnssec_zone, ldns_rdf *zone_name,
+		ldns_rr_list *keys, bool apexonly, int percentage,
+		bool detached_zonemd) 
+{
+	ldns_rbnode_t *cur_node;
+	ldns_dnssec_rrsets *cur_key_rrset;
+	ldns_dnssec_rrs *cur_key;
+	ldns_status status;
+	ldns_status result = LDNS_STATUS_OK;
+
+	cur_key_rrset = ldns_dnssec_zone_find_rrset(dnssec_zone, zone_name,
+			LDNS_RR_TYPE_DNSKEY);
+	if (!cur_key_rrset || !cur_key_rrset->rrs) {
+		if (verbosity > 0) {
+			fprintf(myerr,
+				"Error: No DNSKEY records at zone apex\n");
+		}
+		result = LDNS_STATUS_ERR;
+	} else {
+		/* are keys given with -k to use for validation? */
+		if (ldns_rr_list_rr_count(keys) > 0) {
+			if ((result = sigchase(NULL, zone_name, cur_key_rrset,
+							keys)))
+				goto error;
+		} else
+			for (cur_key = cur_key_rrset->rrs; cur_key;
+					cur_key = cur_key->next) 
+				ldns_rr_list_push_rr(keys, cur_key->rr);
+
+		cur_node = ldns_rbtree_first(dnssec_zone->names);
+		if (cur_node == LDNS_RBTREE_NULL) {
+			if (verbosity > 0) {
+				fprintf(myerr, "Error: Empty zone?\n");
+			}
+			result = LDNS_STATUS_ERR;
+		}
+		if (apexonly) {
+			/*
+			 * In this case, only the first node in the treewalk
+			 * below should be checked.
+			 */
+			assert( cur_node->data == dnssec_zone->soa );
+			/* 
+			 * Although the percentage option doesn't make sense
+			 * here, we set it to 100 to force the first node to 
+			 * be checked.
+			 */
+			percentage = 100;
+		}
+		while (cur_node != LDNS_RBTREE_NULL) {
+			/* should we check this one? saves calls to random. */
+			if (percentage == 100 
+			    || ((random() % 100) >= 100 - percentage)) {
+				status = verify_dnssec_name(zone_name,
+						dnssec_zone, cur_node, keys,
+						detached_zonemd);
+				update_error(&result, status);
+				if (apexonly)
+					break;
+			}
+			cur_node = ldns_rbtree_next(cur_node);
+		}
+	}
+error:
+	ldns_rr_list_free(keys);
+	return result;
+}
+
+static void print_usage(FILE *out, const char *progname)
+{
+	fprintf(out, "Usage: %s [OPTIONS] <zonefile>\n", progname);
+	fprintf(out, "\tReads the zonefile and checks for DNSSEC errors.\n");
+	fprintf(out, "\nIt checks whether NSEC(3)s are present, "
+	       "and verifies all signatures\n");
+	fprintf(out, "It also checks the NSEC(3) chain, but it "
+	       "will error on opted-out delegations\n");
+	fprintf(out, "It also checks whether ZONEMDs are present, and if so, "
+	       "needs one of them to match the zone's data.\n");
+	fprintf(out, "\nOPTIONS:\n");
+	fprintf(out, "\t-h\t\tshow this text\n");
+	fprintf(out, "\t-a\t\tapex only, check only the zone apex\n");
+	fprintf(out, "\t-e <period>\tsignatures may not expire "
+	       "within this period.\n\t\t\t"
+	       "(default no period is used)\n");
+	fprintf(out, "\t-i <period>\tsignatures must have been "
+	       "valid at least this long.\n\t\t\t"
+	       "(default signatures should just be valid now)\n");
+	fprintf(out, "\t-k <file>\tspecify a file that contains a "
+	       "trusted DNSKEY or DS rr.\n\t\t\t"
+	       "This option may be given more than once.\n"
+	       "\t\t\tDefault is %s\n", LDNS_TRUST_ANCHOR_FILE);
+	fprintf(out, "\t-p [0-100]\tonly checks this percentage of "
+	       "the zone.\n\t\t\tDefaults to 100\n");
+	fprintf(out, "\t-S\t\tchase signature(s) to a known key. "
+	       "The network may be\n\t\t\taccessed to "
+	       "validate the zone's DNSKEYs. (implies -k)\n");
+	fprintf(out, "\t-t YYYYMMDDhhmmss | [+|-]offset\n\t\t\t"
+	       "set the validation time either by an "
+	       "absolute time\n\t\t\tvalue or as an "
+	       "offset in seconds from <now>.\n\t\t\t"
+	       "For data that came from the network (while "
+	       "chasing),\n\t\t\tsystem time will be used "
+	       "for validating it regardless.\n");
+	fprintf(out, "\t-v\t\tshows the version and exits\n");
+	fprintf(out, "\t-V [0-5]\tset verbosity level (default 3)\n");
+	fprintf(out, "\t-Z\t\tRequires a valid ZONEMD RR to be present.\n");
+	fprintf(out, "\t\t\tWhen given once, this option will permit verifying"
+	       "\n\t\t\tjust the ZONEMD RR of an unsigned zone. When given "
+	       "\n\t\t\tmore than once, the zone needs to be validly DNSSEC"
+	       "\n\t\t\tsigned as well. With three times a -Z option (-ZZZ)"
+	       "\n\t\t\ta ZONEMD RR without signatures is allowed.");
+	fprintf(out, "\n<period>s are given in ISO 8601 duration format: "
+	       "P[n]Y[n]M[n]DT[n]H[n]M[n]S\n");
+	fprintf(out, "\nif no file is given standard input is read\n");
+}
+
+int
+main(int argc, char **argv)
+{
+	char *filename;
+	FILE *fp;
+	int line_nr = 0;
+	int c;
+	ldns_status s;
+	ldns_dnssec_zone *dnssec_zone = NULL;
+	ldns_status result = LDNS_STATUS_ERR;
+	bool apexonly = false;
+	int percentage = 100;
+	struct tm tm;
+	ldns_duration_type *duration;
+	ldns_rr_list *keys = ldns_rr_list_new();
+	size_t nkeys = 0;
+	const char *progname = argv[0];
+	int zonemd_required = 0;
+	ldns_dnssec_rrsets *zonemd_rrset;
+
+	check_time = ldns_time(NULL);
+	myout = stdout;
+	myerr = stderr;
+
+	while ((c = getopt(argc, argv, "ae:hi:k:vV:p:St:Z")) != -1) {
+		switch(c) {
+                case 'a':
+                        apexonly = true;
+                        break;
+		case 'h':
+			print_usage(stdout, progname);
+			exit(EXIT_SUCCESS);
+			break;
+		case 'e':
+		case 'i':
+			duration = ldns_duration_create_from_string(optarg);
+			if (!duration) {
+				if (verbosity > 0) {
+					fprintf(myerr,
+						"<period> should be in ISO "
+						"8601 duration format: "
+						"P[n]Y[n]M[n]DT[n]H[n]M[n]S\n"
+						);
+				}
+                                exit(EXIT_FAILURE);
+			}
+			if (c == 'e')
+				expiration_offset =
+					ldns_duration2time(duration);
+			else
+				inception_offset =
+					ldns_duration2time(duration);
+			break;
+		case 'k':
+			s = read_key_file(optarg, keys);
+			if (s == LDNS_STATUS_FILE_ERR) {
+				if (verbosity > 0) {
+					fprintf(myerr,
+						"Error opening %s: %s\n",
+						optarg, strerror(errno));
+				}
+			}
+			if (s != LDNS_STATUS_OK) {
+				if (verbosity > 0) {
+					fprintf(myerr,
+						"Could not parse key file "
+						"%s: %s\n",optarg,
+						ldns_get_errorstr_by_id(s));
+				}
+                                exit(EXIT_FAILURE);
+			}
+			if (ldns_rr_list_rr_count(keys) == nkeys) {
+				if (verbosity > 0) {
+					fprintf(myerr,
+						"No keys found in file %s\n",
+						optarg);
+				}
+				exit(EXIT_FAILURE);
+			}
+			nkeys = ldns_rr_list_rr_count(keys);
+			break;
+                case 'p':
+                        percentage = atoi(optarg);
+                        if (percentage < 0 || percentage > 100) {
+				if (verbosity > 0) {
+	                        	fprintf(myerr,
+						"percentage needs to fall "
+						"between 0..100\n");
+				}
+                                exit(EXIT_FAILURE);
+                        }
+                        srandom(time(NULL) ^ getpid());
+                        break;
+		case 'S':
+			do_sigchase = true;
+			/* may chase */
+			break;
+		case 't':
+			if (strlen(optarg) == 14 &&
+			    sscanf(optarg, "%4d%2d%2d%2d%2d%2d",
+				    &tm.tm_year, &tm.tm_mon,
+				    &tm.tm_mday, &tm.tm_hour,
+				    &tm.tm_min , &tm.tm_sec ) == 6) {
+
+				tm.tm_year -= 1900;
+				tm.tm_mon--;
+				check_time = ldns_mktime_from_utc(&tm);
+			}
+			else  {
+				check_time += atoi(optarg);
+			}
+			break;
+		case 'v':
+			printf("verify-zone version %s (ldns version %s)\n",
+					LDNS_VERSION, ldns_version());
+			exit(EXIT_SUCCESS);
+			break;
+		case 'V':
+			verbosity = atoi(optarg);
+			break;
+		case 'Z':
+			zonemd_required += 1;
+			break;
+		}
+	}
+	if (do_sigchase && nkeys == 0) {
+		(void) read_key_file(LDNS_TRUST_ANCHOR_FILE, keys);
+		nkeys = ldns_rr_list_rr_count(keys);
+
+		if (nkeys == 0) {
+			if (verbosity > 0) {
+				fprintf(myerr, "Unable to chase "
+						"signature without keys.\n");
+			}
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc == 0) {
+		fp = stdin;
+	} else if (argc == 1) {
+		filename = argv[0];
+
+		fp = fopen(filename, "r");
+		if (!fp) {
+			if (verbosity > 0) {
+				fprintf(myerr, "Unable to open %s: %s\n",
+					filename, strerror(errno));
+			}
+			exit(EXIT_FAILURE);
+		}
+	} else {
+		print_usage(stderr, progname);
+		exit(EXIT_FAILURE);
+	}
+
+	s = ldns_dnssec_zone_new_frm_fp_l(&dnssec_zone, fp, NULL, 0,
+			LDNS_RR_CLASS_IN, &line_nr);
+	if (s != LDNS_STATUS_OK) {
+		if (verbosity > 0) {
+			fprintf(myerr, "%s at line %d\n",
+				ldns_get_errorstr_by_id(s), line_nr);
+		}
+                exit(EXIT_FAILURE);
+	}
+	if (!dnssec_zone->soa) {
+		if (verbosity > 0) {
+			fprintf(myerr,
+				"; Error: no SOA in the zone\n");
+		}
+		exit(EXIT_FAILURE);
+	}
+
+	result = ldns_dnssec_zone_mark_glue(dnssec_zone);
+	if (result != LDNS_STATUS_OK) {
+		if (verbosity > 0) {
+			fprintf(myerr,
+				"There were errors identifying the "
+				"glue in the zone\n");
+		}
+	}
+	if (verbosity >= 5) {
+		ldns_dnssec_zone_print(myout, dnssec_zone);
+	}
+	zonemd_rrset = ldns_dnssec_zone_find_rrset(dnssec_zone,
+				dnssec_zone->soa->name, LDNS_RR_TYPE_ZONEMD);
+
+	if (zonemd_required == 1
+	&&  !ldns_dnssec_zone_find_rrset(dnssec_zone,
+			       	dnssec_zone->soa->name, LDNS_RR_TYPE_DNSKEY))
+		result = LDNS_STATUS_OK;
+	else
+		result = verify_dnssec_zone(dnssec_zone,
+				dnssec_zone->soa->name, keys, apexonly,
+				percentage, zonemd_required > 2);
+
+	if (zonemd_rrset) {
+		ldns_status zonemd_result
+		    = ldns_dnssec_zone_verify_zonemd(dnssec_zone);
+		
+		if (zonemd_result)
+			fprintf( myerr, "Could not validate zone digest: %s\n"
+			       , ldns_get_errorstr_by_id(zonemd_result));
+
+		else if (verbosity > 3)
+			fprintf( myout
+			       , "Zone digest matched the zone content\n");
+
+		if (zonemd_result)
+			result = zonemd_result;
+
+	} else if (zonemd_required)
+		result = LDNS_STATUS_NO_ZONEMD;
+
+	if (result == LDNS_STATUS_OK) {
+		if (verbosity >= 3) {
+			fprintf(myout, "Zone is verified and complete\n");
+		}
+	} else if (verbosity > 0)
+		fprintf(myerr, "There were errors in the zone\n");
+
+	ldns_dnssec_zone_deep_free(dnssec_zone);
+	fclose(fp);
+	exit(result);
+}
+
+#else
+
+int
+main(int argc, char **argv)
+{
+	fprintf(stderr, "ldns-verify-zone needs OpenSSL support, "
+			"which has not been compiled in\n");
+	return 1;
+}
+#endif /* HAVE_SSL */
+
diff --git a/contrib/ldns/examples/ldns-walk.c b/contrib/ldns/examples/ldns-walk.c
new file mode 100644
index 00000000000000..3710098adb76c0
--- /dev/null
+++ b/contrib/ldns/examples/ldns-walk.c
@@ -0,0 +1,668 @@
+/*
+ * ldns-walk uses educated guesses and NSEC data to retrieve the
+ * contents of a dnssec signed zone
+ *
+ * (c) NLnet Labs, 2005 - 2008
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+
+#include <ldns/ldns.h>
+
+int verbosity = 0;
+
+static int
+usage(FILE *fp, char *prog) {
+	fprintf(fp, "%s [options] domain\n", prog);
+	fprintf(fp, "  print out the owner names for domain and the record types for those names\n");
+	fprintf(fp, "OPTIONS:\n");
+	fprintf(fp, "-4\t\tonly use IPv4\n");
+	fprintf(fp, "-6\t\tonly use IPv6\n");
+	fprintf(fp, "-f\t\tfull; get all rrsets instead of only a list of names and types\n");
+	fprintf(fp, "-s <name>\t\tStart from this name\n");
+	fprintf(fp, "-v <verbosity>\t\tVerbosity level [1-5]\n");
+	fprintf(fp, "-version\tShow version and exit\n");
+	fprintf(fp, "@<nameserver>\t\tUse this nameserver\n");
+	return 0;
+}
+
+static ldns_rdf *
+create_dname_plus_1(ldns_rdf *dname)
+{
+	uint8_t *wire;
+	ldns_rdf *newdname;
+	uint8_t labellen;
+	size_t pos;
+	ldns_status status;
+	size_t i;
+	
+	ldns_dname2canonical(dname);
+	labellen = ldns_rdf_data(dname)[0];
+	if (verbosity >= 3) {
+                printf("Create +e for ");
+                ldns_rdf_print(stdout, dname);
+                printf("\n");
+	}
+	if (labellen < 63) {
+		wire = malloc(ldns_rdf_size(dname) + 1);
+		if (!wire) {
+			fprintf(stderr, "Malloc error: out of memory?\n");
+			exit(127);
+		}
+		wire[0] = labellen + 1;
+		memcpy(&wire[1], ldns_rdf_data(dname) + 1, labellen);
+		memcpy(&wire[labellen+1], ldns_rdf_data(dname) + labellen, ldns_rdf_size(dname) - labellen);
+		wire[labellen+1] = (uint8_t) '\000';
+		pos = 0;
+		status = ldns_wire2dname(&newdname, wire, ldns_rdf_size(dname) + 1, &pos);
+		free(wire);
+	} else {
+		wire = malloc(ldns_rdf_size(dname));
+		if (!wire) {
+			fprintf(stderr, "Malloc error: out of memory?\n");
+			exit(127);
+		}
+		wire[0] = labellen;
+		memcpy(&wire[1], ldns_rdf_data(dname) + 1, labellen);
+		memcpy(&wire[labellen], ldns_rdf_data(dname) + labellen, ldns_rdf_size(dname) - labellen);
+		i = labellen;
+		while (wire[i] == 255) {
+			if (i == 0) {
+				printf("Error, don't know how to add 1 to a label with maximum length and all values on 255\n");
+				exit(9);
+			} else {
+				i--;
+			}
+		}
+		wire[i] = wire[i] + 1;
+		pos = 0;
+		status = ldns_wire2dname(&newdname, wire, ldns_rdf_size(dname) + 1, &pos);
+		free(wire);
+	}
+	if (verbosity >= 3) {
+		printf("result: ");
+		ldns_rdf_print(stdout, newdname);
+		printf("\n");
+	}
+
+	if (status != LDNS_STATUS_OK) {
+	  printf("Error: %s\n", ldns_get_errorstr_by_id(status));
+	  exit(10);
+        }
+	
+	return newdname;
+}
+
+static ldns_rdf *
+create_plus_1_dname(ldns_rdf *dname)
+{
+	ldns_rdf *label;
+	ldns_status status;
+	
+	if (verbosity >= 3) {
+	  printf("Creating n+e for: ");
+	  ldns_rdf_print(stdout, dname);
+	  printf("\n");
+        }
+	
+	ldns_dname2canonical(dname);
+	status = ldns_str2rdf_dname(&label, "\\000");
+	if (status != LDNS_STATUS_OK) {
+		printf("error creating \\000 dname: %s\n\n", ldns_get_errorstr_by_id(status));
+		exit(2);
+	}
+	status = ldns_dname_cat(label, dname);
+	if (status != LDNS_STATUS_OK) {
+		printf("error catting \\000 dname: %s\n\n", ldns_get_errorstr_by_id(status));
+		exit(3);
+	}
+	return label;
+}
+
+static void 
+query_type_bitmaps(ldns_resolver *res, 
+                   uint16_t res_flags,
+                   const ldns_rdf *name,
+                   const ldns_rdf *rdf)
+{
+	/* Note: this code is duplicated in higher.c in 
+	 * ldns_nsec_type_check() function
+	 */
+	uint8_t window_block_nr;
+	uint8_t bitmap_length;
+	uint16_t type;
+	uint16_t pos = 0;
+	uint16_t bit_pos;
+	uint8_t *data = ldns_rdf_data(rdf);
+	
+	ldns_pkt *answer_pkt;
+	char *errstr;
+	
+	if (verbosity >= 3) {
+		printf("Getting Resource Records covered by NSEC at ");
+		ldns_rdf_print(stdout, name);
+		printf("\n");
+	}
+	
+	while(pos < ldns_rdf_size(rdf)) {
+		window_block_nr = data[pos];
+		bitmap_length = data[pos + 1];
+		pos += 2;
+		
+		for (bit_pos = 0; bit_pos < (bitmap_length) * 8; bit_pos++) {
+			if (ldns_get_bit(&data[pos], bit_pos)) {
+				type = 256 * (uint16_t) window_block_nr + bit_pos;
+				/* skip nsec and rrsig */
+				if (type != LDNS_RR_TYPE_NSEC &&
+				    type != LDNS_RR_TYPE_RRSIG) {
+				    if (verbosity >=  3) {
+						printf("querying for:\n");
+						ldns_rdf_print(stdout, name);
+						printf(" type %u\n", (unsigned int) type);
+					}
+					answer_pkt = ldns_resolver_query(res, name, type,
+					                                 LDNS_RR_CLASS_IN,
+					                                 res_flags);
+					if (answer_pkt) {
+						if (verbosity >= 5) {
+							ldns_pkt_print(stdout, answer_pkt);
+						}
+						/* hmm, this does not give us the right records
+						 * when asking for type NS above the delegation
+						 * (or, in fact, when the delegated zone is 
+						 * served by this server either)
+						 * do we need to special case NS like NSEC?
+						 * or can we fix the query or the answer reading?
+						 * ...
+						 */
+						ldns_rr_list_print(stdout,
+						                   ldns_pkt_answer(answer_pkt));
+						ldns_pkt_free(answer_pkt);
+					} else {
+						printf("Query error, bailing out\n");
+						printf("Failed at ");
+						ldns_rdf_print(stdout, name);
+						errstr = ldns_rr_type2str(type);
+						printf(" %s\n", errstr);
+						free(errstr);
+						exit(1);
+					}
+				}
+			}
+		}
+		pos += (uint16_t) bitmap_length;
+	}
+}
+
+
+int
+main(int argc, char *argv[])
+{
+	ldns_status status;
+
+	ldns_resolver *res;
+	ldns_rdf *domain = NULL;
+	ldns_pkt *p;
+	ldns_rr *soa;
+	ldns_rr_list *rrlist;
+	ldns_rr_list *rrlist2;
+	ldns_rr_list *nsec_sigs = NULL;
+	ldns_rdf *soa_p1;
+	ldns_rdf *next_dname;
+	ldns_rdf *last_dname;
+	ldns_rdf *last_dname_p;
+	ldns_rdf *startpoint = NULL;
+	ldns_rr *nsec_rr = NULL;
+	const char* arg_domain = NULL;
+	int full = 0;
+
+	char *serv = NULL;
+	ldns_rdf *serv_rdf;
+	ldns_resolver *cmdline_res;
+	ldns_rr_list *cmdline_rr_list;
+	ldns_rdf *cmdline_dname;
+
+	uint8_t fam = LDNS_RESOLV_INETANY;
+	int result = 0;
+	int i;
+	char *arg_end_ptr = NULL;
+	size_t j;
+
+	p = NULL;
+	rrlist = NULL;
+	rrlist2 = NULL;
+	soa = NULL;
+	domain = NULL;
+	
+	if (argc < 2) {
+		usage(stdout, argv[0]);
+		exit(EXIT_FAILURE);
+	} else {
+		for (i = 1; i < argc; i++) {
+			if (strncmp(argv[i], "-4", 3) == 0) {
+                        	if (fam != LDNS_RESOLV_INETANY) {
+                                	fprintf(stderr, "You can only specify one of -4 or -6\n");
+                                	exit(1);
+                        	}
+                        	fam = LDNS_RESOLV_INET;
+			} else if (strncmp(argv[i], "-6", 3) == 0) {
+                        	if (fam != LDNS_RESOLV_INETANY) {
+                                	fprintf(stderr, "You can only specify one of -4 or -6\n");
+                                	exit(1);
+                        	}
+                        	fam = LDNS_RESOLV_INET6;
+			} else if (strncmp(argv[i], "-f", 3) == 0) {
+				full = true;
+			} else if (strncmp(argv[i], "-s", 3) == 0) {
+				if (i + 1 < argc) {
+					if (ldns_str2rdf_dname(&startpoint, argv[i + 1]) != LDNS_STATUS_OK) {
+						printf("Bad start point name: %s\n", argv[i + 1]);
+						exit(1);
+					}
+				} else {
+					printf("Missing argument for -s\n");
+					exit(1);
+				}
+				i++;
+			} else if (strncmp(argv[i], "-v", 3) == 0) {
+				if (i + 1 < argc) {
+					verbosity = strtol(argv[i+1], &arg_end_ptr, 10);
+					if (*arg_end_ptr != '\0') {
+						printf("Bad argument for -v: %s\n", argv[i+1]);
+						exit(1);
+					}
+				} else {
+					printf("Missing argument for -v\n");
+					exit(1);
+				}
+				i++;
+			} else if (strcmp("-version", argv[i]) == 0) {
+				printf("dns zone walker, version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+				goto exit;
+			} else {
+                        	if (argv[i][0] == '@') {
+					if (strlen(argv[i]) == 1) {
+						if (i + 1 < argc) {
+							serv = argv[i + 1];
+							i++;
+						} else {
+							printf("Missing argument for -s\n");
+							exit(1);
+						}
+					} else {
+						serv = argv[i] + 1;
+					}
+                        	} else {
+					if (i < argc) {
+						if (!domain) {
+							/* create a rdf from the command line arg */
+							arg_domain = argv[i];
+							domain = ldns_dname_new_frm_str(arg_domain);
+							if (!domain) {
+								usage(stdout, argv[0]);
+								exit(1);
+							}
+						} else {
+							printf("One domain at a time please\n");
+							exit(1);
+						}
+					} else {
+						printf("No domain given to walk\n");
+						exit(1);
+					}
+				}
+			}
+		}
+	}
+	if (!domain) {
+		printf("Missing argument\n");
+		exit(1);
+	}
+
+
+	/* create a new resolver from /etc/resolv.conf */
+	if(!serv) {
+		if (ldns_resolver_new_frm_file(&res, NULL) != LDNS_STATUS_OK) {
+			fprintf(stderr, "%s", "Could not create resolver obj");
+			result = EXIT_FAILURE;
+			goto exit;
+		}
+	} else {
+		res = ldns_resolver_new();
+		if (!res || strlen(serv) <= 0) {
+			result = EXIT_FAILURE;
+			goto exit;
+		}
+		/* add the nameserver */
+		serv_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_A, serv);
+        	if (!serv_rdf) {
+			/* maybe ip6 */
+			serv_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_AAAA, serv);
+		}
+		if (!serv_rdf) {
+			/* try to resolv the name if possible */
+			status = ldns_resolver_new_frm_file(&cmdline_res, NULL);
+			
+			if (status != LDNS_STATUS_OK) {
+				fprintf(stderr, "%s", "@server ip could not be converted");
+				result = EXIT_FAILURE;
+				goto exit;
+			}
+
+			cmdline_dname = ldns_dname_new_frm_str(serv);
+			cmdline_rr_list = ldns_get_rr_list_addr_by_name(
+						cmdline_res, 
+						cmdline_dname,
+						LDNS_RR_CLASS_IN,
+						0);
+			ldns_rdf_deep_free(cmdline_dname);
+                        ldns_resolver_deep_free(cmdline_res);
+			if (!cmdline_rr_list) {
+				fprintf(stderr, "%s %s", "could not find any address for the name: ", serv);
+				result = EXIT_FAILURE;
+				goto exit;
+			} else {
+				if (ldns_resolver_push_nameserver_rr_list(
+						res, 
+						cmdline_rr_list
+					) != LDNS_STATUS_OK) {
+					fprintf(stderr, "%s", "pushing nameserver");
+					result = EXIT_FAILURE;
+					ldns_rr_list_deep_free(cmdline_rr_list);
+					goto exit;
+				}
+                                ldns_rr_list_deep_free(cmdline_rr_list);
+			}
+		} else {
+			if (ldns_resolver_push_nameserver(res, serv_rdf) != LDNS_STATUS_OK) {
+				fprintf(stderr, "%s", "pushing nameserver");
+				result = EXIT_FAILURE;
+				goto exit;
+			} else {
+				ldns_rdf_deep_free(serv_rdf);
+			}
+		}
+
+	}
+
+	ldns_resolver_set_dnssec(res, true);
+	ldns_resolver_set_dnssec_cd(res, true);
+	ldns_resolver_set_ip6(res, fam);	
+
+	if (!res) {
+		exit(2);
+	}
+
+	/* use the resolver to send it a query for the soa
+	 * records of the domain given on the command line
+	 */
+	if (verbosity >= 3) {
+		printf("\nQuerying for: ");
+		ldns_rdf_print(stdout, domain);
+		printf("\n");
+	}
+	p = ldns_resolver_query(res, domain, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN, LDNS_RD);
+	soa = NULL;
+	if (verbosity >= 5) {
+		if (p) {
+			ldns_pkt_print(stdout, p);
+		} else {
+			fprintf(stdout, "No Packet Received from ldns_resolver_query()\n");
+		}
+	}
+
+        if (!p)  {
+		exit(3);
+        } else {
+		/* retrieve the MX records from the answer section of that
+		 * packet
+		 */
+		rrlist = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_SOA, LDNS_SECTION_ANSWER);
+		if (!rrlist || ldns_rr_list_rr_count(rrlist) != 1) {
+			if (rrlist) {
+				printf(" *** > 1 SOA: %u\n", (unsigned int) ldns_rr_list_rr_count(rrlist));
+			} else {
+				printf(" *** No rrlist...\b");
+			}
+			/* TODO: conversion memory */
+			fprintf(stderr, 
+					" *** invalid answer name after SOA query for %s\n",
+					arg_domain);
+			ldns_pkt_print(stdout, p);
+			ldns_pkt_free(p);
+			ldns_resolver_deep_free(res);
+			exit(4);
+		} else {
+			soa = ldns_rr_clone(ldns_rr_list_rr(rrlist, 0));
+			ldns_rr_list_deep_free(rrlist);
+			rrlist = NULL;
+			/* check if zone contains DNSSEC data */
+			rrlist = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER);
+			if (!rrlist) {
+				printf("No DNSSEC data received; either the zone is not secured or you should query it directly (with @nameserver)\n");
+				ldns_pkt_free(p);
+				ldns_resolver_deep_free(res);
+				exit(5);
+			}
+			ldns_rr_list_deep_free(rrlist);
+		}
+        }
+
+	/* add \001 to soa */
+	status = ldns_str2rdf_dname(&soa_p1, "\\000");
+	if (status != LDNS_STATUS_OK) {
+		printf("error: %s\n", ldns_get_errorstr_by_id(status));
+	}
+	if (!soa) {
+		printf("Error getting SOA\n");
+		exit(1);
+	}
+
+	if (startpoint) {
+		last_dname = startpoint;
+		last_dname_p = create_dname_plus_1(last_dname);
+	} else {
+		last_dname = ldns_rdf_clone(domain);
+		if (ldns_dname_cat(soa_p1, last_dname) != LDNS_STATUS_OK) {
+			printf("Error concatenating dnames\n");
+			exit(EXIT_FAILURE);
+		}
+		last_dname_p = ldns_rdf_clone(soa_p1);
+	}
+
+	if (!full) {
+		ldns_rdf_print(stdout, ldns_rr_owner(soa));
+		printf("\t");
+	}
+	
+	next_dname = NULL;
+	while (!next_dname || ldns_rdf_compare(next_dname, domain) != 0) {
+		if (p) {
+			ldns_pkt_free(p);
+			p = NULL;
+		}
+		if (verbosity >= 4) {
+			printf("Querying for: ");
+			ldns_rdf_print(stdout, last_dname_p);
+			printf("\n");
+		}
+		p = ldns_resolver_query(res, last_dname_p, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN, LDNS_RD);
+		if (verbosity >= 5) {
+			if (p) {
+				ldns_pkt_print(stdout, p);
+			} else {
+				fprintf(stdout, "No Packet Received from ldns_resolver_query()\n");
+			}
+		}
+
+		if (next_dname) {
+			ldns_rdf_deep_free(next_dname);
+			ldns_rr_free(nsec_rr);
+			next_dname = NULL;
+			nsec_rr = NULL;
+		}
+
+		if (!p)  {
+			fprintf(stderr, "Error trying to resolve: ");
+			ldns_rdf_print(stderr, last_dname_p);
+			fprintf(stderr, "\n");
+			while (!p) {
+				if (verbosity >= 3) {
+					printf("Querying for: ");
+					ldns_rdf_print(stdout, last_dname_p);
+					printf("\n");
+				}
+				p = ldns_resolver_query(res, last_dname_p, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN, LDNS_RD);
+				/* TODO: make a general option for this (something like ignore_rtt)? */
+				for (j = 0; j < ldns_resolver_nameserver_count(res); j++) {
+					if (ldns_resolver_nameserver_rtt(res, j) != 0) {
+						ldns_resolver_set_nameserver_rtt(res, j, LDNS_RESOLV_RTT_MIN);
+					}
+				}
+				if (verbosity >= 5) {
+					if (p) {
+						ldns_pkt_print(stdout, p);
+					} else {
+						fprintf(stdout, "No Packet Received from ldns_resolver_query()\n");
+					}
+				}
+			}
+		}
+
+		/* if the current name is an empty non-terminal, bind returns
+		 * SERVFAIL on the plus1-query...
+		 * so requery with only the last dname
+		 */
+		if (ldns_pkt_get_rcode(p) == LDNS_RCODE_SERVFAIL) {
+			ldns_pkt_free(p);
+			p = NULL;
+			if (verbosity >= 3) {
+				printf("Querying for: ");
+				ldns_rdf_print(stdout, last_dname);
+				printf("\n");
+			}
+			p = ldns_resolver_query(res, last_dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN, LDNS_RD);
+			if (verbosity >= 5) {
+				if (p) {
+					ldns_pkt_print(stdout, p);
+				} else {
+					fprintf(stdout, "No Packet Received from ldns_resolver_query()\n");
+				}
+			}
+
+			if (!p) {
+				exit(51);
+			}
+			rrlist = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_NSEC, LDNS_SECTION_AUTHORITY);
+			rrlist2 = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_NSEC, LDNS_SECTION_ANSWER);
+		} else {
+			rrlist = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_NSEC, LDNS_SECTION_AUTHORITY);
+			rrlist2 = ldns_pkt_rr_list_by_type(p, LDNS_RR_TYPE_NSEC, LDNS_SECTION_ANSWER);
+		}
+	if (rrlist && rrlist2) {
+		ldns_rr_list_cat(rrlist, rrlist2);
+	} else if (rrlist2) {
+		rrlist = rrlist2;
+	}
+
+	if (!rrlist || ldns_rr_list_rr_count(rrlist) < 1) {
+		if (!rrlist) {
+			fflush(stdout);
+			fprintf(stderr, "Zone does not seem to be DNSSEC secured,"
+			                "or it uses NSEC3.\n");
+			fflush(stderr);
+			goto exit;
+		}
+	} else {
+		/* find correct nsec */
+		next_dname = NULL;
+		for (j = 0; j < ldns_rr_list_rr_count(rrlist); j++) {
+			if (ldns_nsec_covers_name(ldns_rr_list_rr(rrlist, j), last_dname_p)) {
+				if (verbosity >= 3) {
+					printf("The domain name: ");
+					ldns_rdf_print(stdout, last_dname_p);
+					printf("\nis covered by NSEC: ");
+					ldns_rr_print(stdout, ldns_rr_list_rr(rrlist, j));
+				}
+				next_dname = ldns_rdf_clone(ldns_rr_rdf(ldns_rr_list_rr(rrlist, j), 0));
+				nsec_rr = ldns_rr_clone(ldns_rr_list_rr(rrlist, j));
+				nsec_sigs = ldns_dnssec_pkt_get_rrsigs_for_name_and_type(p, ldns_rr_owner(nsec_rr), LDNS_RR_TYPE_NSEC);
+			} else {
+				if (verbosity >= 4) {
+					printf("\n");
+					ldns_rdf_print(stdout, last_dname_p);
+					printf("\nNOT covered by NSEC: ");
+					ldns_rr_print(stdout, ldns_rr_list_rr(rrlist, j));
+					printf("\n");
+				}
+			}
+		}
+		if (!next_dname) {
+			printf("Error no nsec for ");
+			ldns_rdf_print(stdout, last_dname);
+			printf("\n");
+			exit(1);
+		}
+		ldns_rr_list_deep_free(rrlist);
+	}
+	if (!next_dname) {
+		/* apparently the zone also has prepended data (i.e. a.example and www.a.example, 
+ 		 * The www comes after the a but before a\\000, so we need to make another name (\\000.a)
+		 */
+		if (last_dname_p) {
+			ldns_rdf_deep_free(last_dname_p);
+		}
+		last_dname_p = create_plus_1_dname(last_dname);
+	} else {
+		if (last_dname) {
+			if (ldns_rdf_compare(last_dname, next_dname) == 0) {
+				printf("\n\nNext dname is the same as current, this would loop forever. This is a problem that usually occurs when walking through a caching forwarder. Try using the authoritative nameserver to walk (with @nameserver).\n");
+				exit(2);
+			}
+			ldns_rdf_deep_free(last_dname);
+		}
+		last_dname = ldns_rdf_clone(next_dname);
+		if (last_dname_p) {
+			ldns_rdf_deep_free(last_dname_p);
+		}
+		last_dname_p = create_dname_plus_1(last_dname);
+		if (!full) {
+			ldns_rdf_print(stdout, ldns_rr_owner(nsec_rr));
+			printf(" ");
+			ldns_rdf_print(stdout, ldns_rr_rdf(nsec_rr, 1));
+			printf("\n");
+		} else {
+			/* ok, so now we know all the types present at this name,
+			 * query for those one by one (...)
+			 */
+			query_type_bitmaps(res, LDNS_RD, ldns_rr_owner(nsec_rr),
+			                   ldns_rr_rdf(nsec_rr, 1));
+			/* print this nsec and its signatures too */
+			ldns_rr_print(stdout, nsec_rr);
+			if (nsec_sigs) {
+				ldns_rr_list_print(stdout, nsec_sigs);
+				ldns_rr_list_free(nsec_sigs);
+				nsec_sigs = NULL;
+			}
+		}
+	}
+
+	}
+
+	ldns_rdf_deep_free(domain);
+	ldns_rdf_deep_free(soa_p1);
+	ldns_rdf_deep_free(last_dname_p);
+	ldns_rdf_deep_free(last_dname);
+	ldns_rdf_deep_free(next_dname);
+	ldns_rr_free(nsec_rr);
+	ldns_pkt_free(p);
+
+	ldns_rr_free(soa);
+
+	printf("\n\n");
+	ldns_resolver_deep_free(res);
+
+	exit:
+	return result;
+}
diff --git a/contrib/ldns/examples/ldns-zsplit.c b/contrib/ldns/examples/ldns-zsplit.c
new file mode 100644
index 00000000000000..618a57b03f7d7d
--- /dev/null
+++ b/contrib/ldns/examples/ldns-zsplit.c
@@ -0,0 +1,273 @@
+/*
+ * read a zone from disk and split it up:
+ *
+ * zone: SOA a b c d e f g h i j k l 
+ * becomes:
+ * zone1: SOA a b c d e f
+ * zone2: SOA f g h i k l
+ *
+ * ldns-catzone removes the last name and put
+ * the zone back together.
+ *
+ * This way you can incremental sign a zone
+ *
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <errno.h>
+#include <ldns/ldns.h>
+
+#define DEFAULT_SPLIT 	1000
+#define FILE_SIZE 	255
+#define SPLIT_MAX 	999 
+#define NO_SPLIT 	0
+#define INTENT_TO_SPLIT 1
+#define SPLIT_NOW	2
+
+static void
+usage(FILE *f, char *progname)
+{
+		fprintf(f, "Usage: %s [OPTIONS] <zonefile> [keys]\n", progname);
+		fprintf(f, "  Cut a zone file into pieces, each part is put in a file\n");
+		fprintf(f, "  named: '<zonefile>.NNN'. Where NNN is a integer ranging 000 to 999.\n");
+		fprintf(f, "  If key files are given they are inserted in each part.\n");
+		fprintf(f, "  The original SOA is also included in each part, making them correct DNS\n");
+		fprintf(f, "  (mini) zones.\n");
+		fprintf(f, "  This utility can be used to parallel sign a large zone.\n");
+		fprintf(f, "  To make it work the original zone needs to be canonical ordered.\n");
+		fprintf(f, "\nOPTIONS:\n");
+		fprintf(f, "  -n NUMBER\tsplit after this many RRs\n");
+		fprintf(f, "  -o ORIGIN\tuse this as initial origin, for zones starting with @\n");
+		fprintf(f, "  -z\t\tsort the zone prior to splitting. The current ldns zone\n");
+		fprintf(f, "  \t\timplementation makes this unusable for large zones.\n");
+		fprintf(f, "  -v\t\tshow version number and exit\n");
+}
+
+
+/* key the keys from the cmd line */
+static ldns_rr_list *
+open_keyfiles(char **files, uint16_t filec) 
+{
+	uint16_t i;
+	ldns_rr_list *pubkeys;
+	ldns_rr *k;
+	FILE *kfp;
+
+ 	pubkeys = ldns_rr_list_new();
+	
+	for (i = 0; i < filec; i++) {
+		if (!(kfp = fopen(files[i], "r"))) {
+			fprintf(stderr, "Error opening key file %s: %s\n", files[i], strerror(errno));
+			return NULL;
+		}
+		if (ldns_rr_new_frm_fp(&k, kfp, NULL, NULL, NULL) != LDNS_STATUS_OK) {
+			fprintf(stderr, "Error parsing the key file %s: %s\n", files[i], strerror(errno));
+			ldns_rr_list_deep_free(pubkeys);
+			return NULL;
+		}
+		fclose(kfp);
+		ldns_rr_list_push_rr(pubkeys, k);
+	}
+	return pubkeys;
+}
+
+/* open a new zone file with the correct suffix */
+static FILE *
+open_newfile(char *basename, ldns_zone *z, size_t counter, ldns_rr_list *keys)
+{
+	char filename[FILE_SIZE];
+	FILE *fp;
+
+	if (counter > SPLIT_MAX)  {
+		fprintf(stderr, "Maximum split count reached %u\n", (unsigned int) counter);
+		return NULL;
+	}
+
+	snprintf(filename, FILE_SIZE, "%s.%03u", basename, (unsigned int) counter);
+
+	if (!(fp = fopen(filename, "w"))) {
+		fprintf(stderr, "Cannot open zone %s: %s\n", filename, strerror(errno));
+		return NULL;
+	} else {
+		fprintf(stderr, "%s\n", filename);
+	}
+	ldns_rr_print(fp, ldns_zone_soa(z));
+	if (keys) {
+		ldns_rr_list_print(fp, keys);
+
+	}
+	return fp;
+}
+
+int
+main(int argc, char **argv)
+{
+	char *progname;
+	FILE *fp;
+	ldns_zone *z;
+	ldns_rr_list *zrrs;
+	ldns_rdf *lastname;
+	int c; 
+	int line_nr;
+	size_t split;
+	size_t i;
+	int splitting;
+	int compare;
+	size_t file_counter;
+	ldns_rdf *origin;
+	ldns_rdf *current_rdf;
+	ldns_rr *current_rr;
+	ldns_rr_list *last_rrset;
+	ldns_rr_list *pubkeys;
+	bool sort;
+	ldns_status s;
+
+	progname = strdup(argv[0]);
+	split = 0;
+	splitting = NO_SPLIT; 
+	file_counter = 0;
+	lastname = NULL;
+	origin = NULL;
+	last_rrset = ldns_rr_list_new();
+	sort = false;
+
+	while ((c = getopt(argc, argv, "n:o:zv")) != -1) {
+		switch(c) {
+			case 'n':
+				split = (size_t)atoi(optarg);
+				if (split == 0) {
+					fprintf(stderr, "-n want a integer\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+			case 'o':
+				origin = ldns_dname_new_frm_str(strdup(optarg));
+				if (!origin) {
+					fprintf(stderr, "Cannot convert the origin %s to a domainname\n", optarg);
+					exit(EXIT_FAILURE);
+				}
+				break;
+			case 'v':
+				printf("zone file splitter version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
+				exit(EXIT_SUCCESS);
+				break;
+			case 'z':
+				sort = true;
+				break;
+			default:
+				fprintf(stderr, "Unrecognized option\n");
+				usage(stdout, progname);
+				exit(EXIT_FAILURE);
+		}
+	}
+	if (split == 0) {
+		split = DEFAULT_SPLIT;
+	}
+	
+	argc -= optind;
+	argv += optind;
+
+	if (argc < 1) {
+		usage(stdout, progname);
+		exit(EXIT_FAILURE);
+	}
+
+	if (!(fp = fopen(argv[0], "r"))) {
+		fprintf(stderr, "Unable to open %s: %s\n", argv[0], strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+	/* get the keys */
+	pubkeys = open_keyfiles(argv + 1, (uint16_t) argc - 1);
+	
+	/* suck in the entire zone ... */
+	if (!origin) {
+		origin = ldns_dname_new_frm_str(".");
+	}
+	
+	s = ldns_zone_new_frm_fp_l(&z, fp, origin, 0, LDNS_RR_CLASS_IN, &line_nr);
+	fclose(fp);
+
+	if (s != LDNS_STATUS_OK) {
+		fprintf(stderr, "Zone file %s could not be parsed correctly: %s at line %d\n", 
+				argv[0],
+				ldns_get_errorstr_by_id(s),
+				line_nr);
+		exit(EXIT_FAILURE);
+	}
+	/* these kind of things can kill you... */
+	if (sort) {
+		ldns_zone_sort(z);
+	}
+
+	zrrs = ldns_zone_rrs(z);
+	if (ldns_rr_list_rr_count(zrrs) / split > SPLIT_MAX) {
+		fprintf(stderr, "The zone is too large for the used -n value: %u\n", (unsigned int) split);
+		exit(EXIT_FAILURE);
+	}
+	
+	
+	/* Setup */
+	if (!(fp = open_newfile(argv[0], z, file_counter, pubkeys))) {
+			exit(EXIT_FAILURE);
+	}
+
+	for(i = 0; i < ldns_rr_list_rr_count(zrrs); i++) {
+	
+		current_rr = ldns_rr_list_rr(zrrs, i);
+		current_rdf = ldns_rr_owner(current_rr);
+
+		compare = ldns_dname_compare(current_rdf, lastname);
+
+		if (compare == 0) {
+			ldns_rr_list_push_rr(last_rrset, current_rr);
+		} 
+
+		if (i > 0 && (i % split) == 0) {
+			splitting = INTENT_TO_SPLIT;
+		}
+
+		if (splitting == INTENT_TO_SPLIT) { 
+			if (compare != 0) {
+				splitting = SPLIT_NOW;
+			} 
+		}
+
+		if (splitting == SPLIT_NOW) {
+			fclose(fp);
+
+			lastname = NULL;
+			splitting = NO_SPLIT;
+			file_counter++;
+			if (!(fp = open_newfile(argv[0], z, file_counter, pubkeys))) {
+				exit(EXIT_FAILURE);
+			}
+
+			/* insert the last RRset in the new file */
+			ldns_rr_list_print(fp, last_rrset);
+
+			/* print the current rr */
+			ldns_rr_print(fp, current_rr); 
+
+			/* remove them */
+			ldns_rr_list_free(last_rrset); 
+			last_rrset = ldns_rr_list_new();
+			/* add the current RR */
+			ldns_rr_list_push_rr(last_rrset, current_rr);
+			continue;
+		}
+		if (splitting == NO_SPLIT || splitting == INTENT_TO_SPLIT) {
+			ldns_rr_print(fp, current_rr); 
+		}
+		if (compare != 0) {
+			/* remove them and then add the current one */
+			ldns_rr_list_free(last_rrset); 
+			last_rrset = ldns_rr_list_new();
+			ldns_rr_list_push_rr(last_rrset, current_rr);
+		}
+		lastname = current_rdf;
+	}
+	fclose(fp); 
+        exit(EXIT_SUCCESS);
+}
diff --git a/contrib/ldns/examples/ldnsd.c b/contrib/ldns/examples/ldnsd.c
new file mode 100644
index 00000000000000..e39c4283e22170
--- /dev/null
+++ b/contrib/ldns/examples/ldnsd.c
@@ -0,0 +1,245 @@
+/*
+ * ldnsd. Light-weight DNS daemon
+ *
+ * Tiny dns server to show how a real one could be built.
+ *
+ * (c) NLnet Labs, 2005
+ * See the file LICENSE for the license
+ */
+
+#include "config.h"
+#include <ldns/ldns.h>
+
+#ifdef HAVE_SYS_SOCKET_H
+#  include <sys/socket.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#  include <arpa/inet.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#  include <netinet/in.h>
+#endif
+#ifdef HAVE_NETINET_UDP_H
+#  include <netinet/udp.h>
+#endif
+#ifdef HAVE_NETINET_IGMP_H
+#  include <netinet/igmp.h>
+#endif
+
+#include <errno.h>
+
+#define INBUF_SIZE 4096
+
+static void usage(FILE *output)
+{
+	fprintf(output, "Usage: ldnsd <address> <port> <zone> <zonefile>\n");
+	fprintf(output, "Listens on the specified port and answers queries for the given zone\n");
+	fprintf(output, "This is NOT a full-fledged authoritative nameserver!\n");
+}
+
+static int udp_bind(int sock, int port, const char *my_address)
+{
+    struct sockaddr_in addr;
+    in_addr_t maddr = INADDR_ANY;
+
+    if (my_address) {
+#ifdef AF_INET6
+        if (inet_pton(AF_INET6, my_address, &maddr) < 1) {
+#else
+	if (0) {
+#endif
+            if (inet_pton(AF_INET, my_address, &maddr) < 1) {
+                return -2;
+            }
+        }
+    }
+
+#ifndef S_SPLINT_S
+    addr.sin_family = AF_INET;
+#endif
+    addr.sin_port = (in_port_t) htons((uint16_t)port);
+    addr.sin_addr.s_addr = maddr;
+    return bind(sock, (struct sockaddr *)&addr, (socklen_t) sizeof(addr));
+}
+
+/* this will probably be moved to a better place in the library itself */
+static ldns_rr_list *
+get_rrset(const ldns_zone *zone, const ldns_rdf *owner_name, const ldns_rr_type qtype, const ldns_rr_class qclass)
+{
+	uint16_t i;
+	ldns_rr_list *rrlist = ldns_rr_list_new();
+	ldns_rr *cur_rr;
+	if (!zone || !owner_name) {
+		fprintf(stderr, "Warning: get_rrset called with NULL zone or owner name\n");
+		return rrlist;
+	}
+	
+	for (i = 0; i < ldns_zone_rr_count(zone); i++) {
+		cur_rr = ldns_rr_list_rr(ldns_zone_rrs(zone), i);
+		if (ldns_dname_compare(ldns_rr_owner(cur_rr), owner_name) == 0 &&
+		    ldns_rr_get_class(cur_rr) == qclass &&
+		    ldns_rr_get_type(cur_rr) == qtype
+		   ) {
+			ldns_rr_list_push_rr(rrlist, ldns_rr_clone(cur_rr));
+		}
+	}
+	
+	printf("Found rrset of %u rrs\n", (unsigned int) ldns_rr_list_rr_count(rrlist));
+	
+	return rrlist;
+}
+
+int
+main(int argc, char **argv)
+{
+	/* arguments */
+	int port;
+	const char *zone_file;
+
+	/* network */
+	int sock;
+	ssize_t nb;
+	struct sockaddr addr_me;
+	struct sockaddr addr_him;
+	socklen_t hislen = (socklen_t) sizeof(addr_him);
+	uint8_t inbuf[INBUF_SIZE];
+	uint8_t *outbuf;
+
+	/* dns */
+	ldns_status status;
+	ldns_pkt *query_pkt;
+	ldns_pkt *answer_pkt;
+	size_t answer_size;
+	ldns_rr *query_rr;
+	ldns_rr_list *answer_qr;
+	ldns_rr_list *answer_an;
+	ldns_rr_list *answer_ns;
+	ldns_rr_list *answer_ad;
+	ldns_rdf *origin = NULL;
+	
+	/* zone */
+	ldns_zone *zone;
+	int line_nr;
+	FILE *zone_fp;
+	
+	/* use this to listen on specified interfaces later? */
+	char *my_address = NULL;
+		
+	if (argc < 5) {
+		usage(stderr);
+		exit(EXIT_FAILURE);
+	} else {
+	    my_address = argv[1];
+		port = atoi(argv[2]);
+		if (port < 1) {
+			usage(stderr);
+			exit(EXIT_FAILURE);
+		}
+		if (ldns_str2rdf_dname(&origin, argv[3]) != LDNS_STATUS_OK) {
+			fprintf(stderr, "Bad origin, not a correct domain name\n");
+			usage(stderr);
+			exit(EXIT_FAILURE);
+		}
+		zone_file = argv[4];
+	}
+	
+	printf("Reading zone file %s\n", zone_file);
+	zone_fp = fopen(zone_file, "r");
+	if (!zone_fp) {
+		fprintf(stderr, "Unable to open %s: %s\n", zone_file, strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+	
+	line_nr = 0;
+	status = ldns_zone_new_frm_fp_l(&zone, zone_fp, origin, 0, LDNS_RR_CLASS_IN, &line_nr);
+
+	if (status != LDNS_STATUS_OK) {
+		printf("Zone reader failed, aborting\n");
+		exit(EXIT_FAILURE);
+	} else {
+		printf("Read %u resource records in zone file\n", (unsigned int) ldns_zone_rr_count(zone));
+	}
+	fclose(zone_fp);
+
+	printf("Listening on port %d\n", port);
+	sock =  socket(AF_INET, SOCK_DGRAM, 0);
+	if (sock < 0) {
+		fprintf(stderr, "%s: socket(): %s\n", argv[0], strerror(errno));
+		exit(1);
+	}
+	memset(&addr_me, 0, sizeof(addr_me));
+
+	/* bind: try all ports in that range */
+	if (udp_bind(sock, port, my_address)) {
+		fprintf(stderr, "%s: cannot bind(): %s\n", argv[0], strerror(errno));
+		exit(errno);
+	}
+
+	/* Done. Now receive */
+	while (1) {
+		nb = recvfrom(sock, (void*)inbuf, INBUF_SIZE, 0, 
+			&addr_him, &hislen);
+		if (nb < 1) {
+			fprintf(stderr, "%s: recvfrom(): %s\n",
+			argv[0], strerror(errno));
+			exit(1);
+		}
+
+		/*
+		show(inbuf, nb, nn, hp, sp, ip, bp);
+		*/
+		printf("Got query of %u bytes\n", (unsigned int) nb);
+		status = ldns_wire2pkt(&query_pkt, inbuf, (size_t) nb);
+		if (status != LDNS_STATUS_OK) {
+			printf("Got bad packet: %s\n", ldns_get_errorstr_by_id(status));
+		} else {
+			ldns_pkt_print(stdout, query_pkt);
+		}
+
+		query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
+		printf("QUERY RR: \n");
+		ldns_rr_print(stdout, query_rr);
+		
+		answer_qr = ldns_rr_list_new();
+		ldns_rr_list_push_rr(answer_qr, ldns_rr_clone(query_rr));
+
+		answer_an = get_rrset(zone, ldns_rr_owner(query_rr), ldns_rr_get_type(query_rr), ldns_rr_get_class(query_rr));
+		answer_pkt = ldns_pkt_new();
+		answer_ns = ldns_rr_list_new();
+		answer_ad = ldns_rr_list_new();
+		
+		ldns_pkt_set_qr(answer_pkt, 1);
+		ldns_pkt_set_aa(answer_pkt, 1);
+		ldns_pkt_set_id(answer_pkt, ldns_pkt_id(query_pkt));
+
+		ldns_pkt_push_rr_list(answer_pkt, LDNS_SECTION_QUESTION, answer_qr);
+		ldns_pkt_push_rr_list(answer_pkt, LDNS_SECTION_ANSWER, answer_an);
+		ldns_pkt_push_rr_list(answer_pkt, LDNS_SECTION_AUTHORITY, answer_ns);
+		ldns_pkt_push_rr_list(answer_pkt, LDNS_SECTION_ADDITIONAL, answer_ad);
+
+		status = ldns_pkt2wire(&outbuf, answer_pkt, &answer_size);
+		
+		printf("Answer packet size: %u bytes.\n", (unsigned int) answer_size);
+		if (status != LDNS_STATUS_OK) {
+			printf("Error creating answer: %s\n", ldns_get_errorstr_by_id(status));
+		} else {
+			(void) sendto(sock, (void*)outbuf, answer_size, 0, 
+				&addr_him, hislen);
+		}
+		
+		ldns_pkt_free(query_pkt);
+		ldns_pkt_free(answer_pkt);
+		LDNS_FREE(outbuf);
+		ldns_rr_list_free(answer_qr);
+		ldns_rr_list_free(answer_an);
+		ldns_rr_list_free(answer_ns);
+		ldns_rr_list_free(answer_ad);
+	}
+	
+	/* No cleanup because of the infinite loop
+	 *
+	 * ldns_rdf_deep_free(origin);
+	 * ldns_zone_deep_free(zone);
+	 * return 0;
+	 */
+}
diff --git a/contrib/ldns/host2str.c b/contrib/ldns/host2str.c
index 747d54310cf984..7282db9ee2efed 100644
--- a/contrib/ldns/host2str.c
+++ b/contrib/ldns/host2str.c
@@ -28,6 +28,14 @@
 #include <time.h>
 #include <sys/time.h>
 
+#ifdef HAVE_SSL
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#ifdef USE_DSA
+#include <openssl/dsa.h>
+#endif
+#endif
+
 #ifndef INET_ADDRSTRLEN
 #define INET_ADDRSTRLEN 16
 #endif
@@ -35,6 +43,10 @@
 #define INET6_ADDRSTRLEN 46
 #endif
 
+/* Internal helper function */
+ldns_edns_option_list*
+pkt_edns_data2edns_option_list(const ldns_rdf *edns_data);
+
 /* lookup tables for standard DNS stuff  */
 
 /* Taken from RFC 2535, section 7.  */
@@ -46,29 +58,28 @@ ldns_lookup_table ldns_algorithms[] = {
         { LDNS_RSASHA1, "RSASHA1" },
         { LDNS_DSA_NSEC3, "DSA-NSEC3-SHA1" },
         { LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
-#ifdef USE_SHA2
 	{ LDNS_RSASHA256, "RSASHA256"},
 	{ LDNS_RSASHA512, "RSASHA512"},
-#endif
-#ifdef USE_GOST
 	{ LDNS_ECC_GOST, "ECC-GOST"},
-#endif
-#ifdef USE_ECDSA
         { LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
         { LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
-#endif
-#ifdef USE_ED25519
 	{ LDNS_ED25519, "ED25519"},
-#endif
-#ifdef USE_ED448
 	{ LDNS_ED448, "ED448"},
-#endif
         { LDNS_INDIRECT, "INDIRECT" },
         { LDNS_PRIVATEDNS, "PRIVATEDNS" },
         { LDNS_PRIVATEOID, "PRIVATEOID" },
         { 0, NULL }
 };
 
+/* Hashing algorithms used in the DS record */
+ldns_lookup_table ldns_hashes[] = {
+        {LDNS_SHA1     , "SHA1" },      /* RFC 4034 */
+        {LDNS_SHA256   , "SHA256" },    /* RFC 4509 */
+        {LDNS_HASH_GOST, "HASH-GOST" }, /* RFC 5933 */
+        {LDNS_SHA384   , "SHA384" },    /* RFC 6605 */
+        { 0, NULL }
+};
+
 /* Taken from RFC 4398  */
 ldns_lookup_table ldns_cert_algorithms[] = {
         { LDNS_CERT_PKIX, "PKIX" },
@@ -406,7 +417,7 @@ ldns_rdf2buffer_str_time(ldns_buffer *output, const ldns_rdf *rdf)
 	char date_buf[16];
 
 	memset(&tm, 0, sizeof(tm));
-	if (ldns_serial_arithmitics_gmtime_r(ldns_rdf2native_int32(rdf), time(NULL), &tm)
+	if (ldns_serial_arithmetics_gmtime_r(ldns_rdf2native_int32(rdf), time(NULL), &tm)
 	    && strftime(date_buf, 15, "%Y%m%d%H%M%S", &tm)) {
 		ldns_buffer_printf(output, "%s", date_buf);
 	}
@@ -475,9 +486,18 @@ ldns_rdf2buffer_str_str(ldns_buffer *output, const ldns_rdf *rdf)
 ldns_status
 ldns_rdf2buffer_str_b64(ldns_buffer *output, const ldns_rdf *rdf)
 {
-	size_t size = ldns_b64_ntop_calculate_size(ldns_rdf_size(rdf));
-	char *b64 = LDNS_XMALLOC(char, size);
-	if(!b64) return LDNS_STATUS_MEM_ERR;
+	size_t size;
+	char *b64;
+
+	if (ldns_rdf_size(rdf) == 0) {
+		ldns_buffer_printf(output, "0");
+		return ldns_buffer_status(output);
+	} else
+		size = ldns_b64_ntop_calculate_size(ldns_rdf_size(rdf));
+
+	if (!(b64 = LDNS_XMALLOC(char, size)))
+		return LDNS_STATUS_MEM_ERR;
+
 	if (ldns_b64_ntop(ldns_rdf_data(rdf), ldns_rdf_size(rdf), b64, size)) {
 		ldns_buffer_printf(output, "%s", b64);
 	}
@@ -692,8 +712,8 @@ ldns_rdf2buffer_str_loc(ldns_buffer *output, const ldns_rdf *rdf)
 	uint32_t longitude;
 	uint32_t latitude;
 	uint32_t altitude;
-	char northerness;
-	char easterness;
+	char latitude_hemisphere;
+	char longitude_hemisphere;
 	uint32_t h;
 	uint32_t m;
 	double s;
@@ -717,10 +737,10 @@ ldns_rdf2buffer_str_loc(ldns_buffer *output, const ldns_rdf *rdf)
 		altitude = ldns_read_uint32(&ldns_rdf_data(rdf)[12]);
 
 		if (latitude > equator) {
-			northerness = 'N';
+			latitude_hemisphere = 'N';
 			latitude = latitude - equator;
 		} else {
-			northerness = 'S';
+			latitude_hemisphere = 'S';
 			latitude = equator - latitude;
 		}
 		h = latitude / (1000 * 60 * 60);
@@ -729,13 +749,13 @@ ldns_rdf2buffer_str_loc(ldns_buffer *output, const ldns_rdf *rdf)
 		latitude = latitude % (1000 * 60);
 		s = (double) latitude / 1000.0;
 		ldns_buffer_printf(output, "%02u %02u %0.3f %c ",
-			h, m, s, northerness);
+			h, m, s, latitude_hemisphere);
 
 		if (longitude > equator) {
-			easterness = 'E';
+			longitude_hemisphere = 'E';
 			longitude = longitude - equator;
 		} else {
-			easterness = 'W';
+			longitude_hemisphere = 'W';
 			longitude = equator - longitude;
 		}
 		h = longitude / (1000 * 60 * 60);
@@ -744,8 +764,7 @@ ldns_rdf2buffer_str_loc(ldns_buffer *output, const ldns_rdf *rdf)
 		longitude = longitude % (1000 * 60);
 		s = (double) longitude / (1000.0);
 		ldns_buffer_printf(output, "%02u %02u %0.3f %c ",
-			h, m, s, easterness);
-
+			h, m, s, longitude_hemisphere);
 
 		s = ((double) altitude) / 100;
 		s -= 100000;
@@ -834,6 +853,8 @@ ldns_rdf2buffer_str_wks(ldns_buffer *output, const ldns_rdf *rdf)
 			endservent();
 #endif
 		}
+		/* exit from loop before integer overflow */
+		if(current_service == 65535) { break; }
 	}
 	return ldns_buffer_status(output);
 }
@@ -1085,12 +1106,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
 			/* no gateway */
 			break;
 		case 1:
-			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);
-                        if(!gateway_data)
-                                return LDNS_STATUS_MEM_ERR;
 			if (ldns_rdf_size(rdf) < offset + LDNS_IP4ADDRLEN) {
 				return LDNS_STATUS_ERR;
 			}
+			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);
+                        if(!gateway_data)
+                                return LDNS_STATUS_MEM_ERR;
 			memcpy(gateway_data, &data[offset], LDNS_IP4ADDRLEN);
 			gateway = ldns_rdf_new(LDNS_RDF_TYPE_A,
 					LDNS_IP4ADDRLEN , gateway_data);
@@ -1101,12 +1122,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
                         }
 			break;
 		case 2:
-			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);
-                        if(!gateway_data)
-                                return LDNS_STATUS_MEM_ERR;
 			if (ldns_rdf_size(rdf) < offset + LDNS_IP6ADDRLEN) {
 				return LDNS_STATUS_ERR;
 			}
+			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);
+                        if(!gateway_data)
+                                return LDNS_STATUS_MEM_ERR;
 			memcpy(gateway_data, &data[offset], LDNS_IP6ADDRLEN);
 			offset += LDNS_IP6ADDRLEN;
 			gateway =
@@ -1129,6 +1150,7 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
 	}
 
 	if (ldns_rdf_size(rdf) <= offset) {
+                ldns_rdf_deep_free(gateway);
 		return LDNS_STATUS_ERR;
 	}
 	public_key_size = ldns_rdf_size(rdf) - offset;
@@ -1263,7 +1285,7 @@ ldns_rdf2buffer_str_hip(ldns_buffer *output, const ldns_rdf *rdf)
 
 		ldns_buffer_printf(output, "%02x", (int) *data);
 	}
-	ldns_buffer_write_u8(output, (uint8_t) ' ');
+	ldns_buffer_write_char(output, (uint8_t) ' ');
 
 	if (ldns_buffer_reserve(output,
 				ldns_b64_ntop_calculate_size(pk_size))) {
@@ -1281,6 +1303,319 @@ ldns_rdf2buffer_str_hip(ldns_buffer *output, const ldns_rdf *rdf)
 	return ldns_buffer_status(output);
 }
 
+/* implementation mimicked from ldns_rdf2buffer_str_ipseckey */
+ldns_status
+ldns_rdf2buffer_str_amtrelay(ldns_buffer *output, const ldns_rdf *rdf)
+{
+	/* wire format from
+	 * draft-ietf-mboned-driad-amt-discovery Section 4.2  
+	 */
+	uint8_t *data = ldns_rdf_data(rdf);
+	uint8_t precedence;
+	uint8_t discovery_optional;
+	uint8_t relay_type;
+
+	ldns_rdf *relay = NULL;
+	uint8_t *relay_data;
+
+	size_t offset = 0;
+	ldns_status status;
+
+	if (ldns_rdf_size(rdf) < 2) {
+		return LDNS_STATUS_WIRE_RDATA_ERR;
+	}
+	precedence = data[0];
+	discovery_optional = ((data[1] & 0x80) >> 7);
+	relay_type = data[1] & 0x7F;
+	offset = 2;
+
+	switch (relay_type) {
+		case 0:
+			/* no relay */
+			break;
+		case 1:
+			if (ldns_rdf_size(rdf) < offset + LDNS_IP4ADDRLEN) {
+				return LDNS_STATUS_ERR;
+			}
+			relay_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);
+                        if(!relay_data)
+                                return LDNS_STATUS_MEM_ERR;
+			memcpy(relay_data, &data[offset], LDNS_IP4ADDRLEN);
+			relay = ldns_rdf_new(LDNS_RDF_TYPE_A,
+					LDNS_IP4ADDRLEN , relay_data);
+			offset += LDNS_IP4ADDRLEN;
+                        if(!relay) {
+                                LDNS_FREE(relay_data);
+                                return LDNS_STATUS_MEM_ERR;
+                        }
+			break;
+		case 2:
+			if (ldns_rdf_size(rdf) < offset + LDNS_IP6ADDRLEN) {
+				return LDNS_STATUS_ERR;
+			}
+			relay_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);
+                        if(!relay_data)
+                                return LDNS_STATUS_MEM_ERR;
+			memcpy(relay_data, &data[offset], LDNS_IP6ADDRLEN);
+			offset += LDNS_IP6ADDRLEN;
+			relay =
+				ldns_rdf_new(LDNS_RDF_TYPE_AAAA,
+						LDNS_IP6ADDRLEN, relay_data);
+                        if(!relay) {
+                                LDNS_FREE(relay_data);
+                                return LDNS_STATUS_MEM_ERR;
+                        }
+			break;
+		case 3:
+			status = ldns_wire2dname(&relay, data,
+					ldns_rdf_size(rdf), &offset);
+                        if(status != LDNS_STATUS_OK)
+                                return status;
+			break;
+		default:
+			/* error? */
+			break;
+	}
+
+	if (ldns_rdf_size(rdf) != offset) {
+                ldns_rdf_deep_free(relay);
+		return LDNS_STATUS_ERR;
+	}
+	ldns_buffer_printf(output, "%u %u %u ",
+			precedence, discovery_optional, relay_type);
+	if (relay)
+	  	(void) ldns_rdf2buffer_str(output, relay);
+
+	ldns_rdf_deep_free(relay);
+	return ldns_buffer_status(output);
+}
+
+#ifdef RRTYPE_SVCB_HTTPS
+ldns_status svcparam_key2buffer_str(ldns_buffer *output, uint16_t key);
+
+static ldns_status
+svcparam_mandatory2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	if (sz % 2)
+		return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+	svcparam_key2buffer_str(output, ldns_read_uint16(data));
+	for (data += 2, sz -= 2; sz; data += 2, sz -= 2) {
+		ldns_buffer_write_char(output, ',');
+		svcparam_key2buffer_str(output, ldns_read_uint16(data));
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_alpn2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	uint8_t *eod = data + sz, *dp;
+	bool quote = false;
+	size_t i;
+
+	for (dp = data; dp < eod && !quote; dp += 1 + *dp) {
+		if (dp + 1 + *dp > eod)
+			return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+		for (i = 0; i < *dp; i++)
+			if (isspace(dp[i + 1]))
+				break;
+		quote = i < *dp;
+	}
+	if (quote)
+		ldns_buffer_write_char(output, '"');
+	while (data < eod) {
+		uint8_t *eot = data + 1 + *data;
+
+		if (eot > eod)
+			return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+		if (eod - data < (int)sz)
+			ldns_buffer_write_char(output, ',');
+
+		for (data += 1; data < eot; data += 1) {
+			uint8_t ch = *data;
+
+			if (isprint(ch) || ch == '\t') {
+				if (ch == '"' ||  ch == ',' || ch == '\\')
+					ldns_buffer_write_char(output, '\\');
+				ldns_buffer_write_char(output, ch);
+			} else
+				ldns_buffer_printf(output, "\\%03u"
+				                         , (unsigned)ch);
+		}
+	}
+	if (quote)
+		ldns_buffer_write_char(output, '"');
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_port2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	if (sz != 2)
+		return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+	ldns_buffer_printf(output, "%d", (int)ldns_read_uint16(data));
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_ipv4hint2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	char str[INET_ADDRSTRLEN];
+
+	if (sz % 4 || !inet_ntop(AF_INET, data, str, INET_ADDRSTRLEN))
+		return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+	ldns_buffer_write_chars(output, str);
+
+	for (data += 4, sz -= 4; sz ; data += 4, sz -= 4 ) {
+		ldns_buffer_write_char(output, ',');
+		if (!inet_ntop(AF_INET, data, str, INET_ADDRSTRLEN))
+			return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+		ldns_buffer_write_chars(output, str);
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_ech2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	size_t str_sz = ldns_b64_ntop_calculate_size(sz);
+	int written;
+
+	if (!ldns_buffer_reserve(output, str_sz))
+		return LDNS_STATUS_MEM_ERR;
+
+	written = ldns_b64_ntop( data, sz
+	                       , (char *)ldns_buffer_current(output), str_sz);
+	if (written > 0)
+		ldns_buffer_skip(output, written);
+	else
+		return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_ipv6hint2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	char str[INET6_ADDRSTRLEN];
+
+	if (sz % 16 || !inet_ntop(AF_INET6, data, str, INET6_ADDRSTRLEN))
+		return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+	ldns_buffer_write_chars(output, str);
+
+	for (data += 16, sz -= 16; sz ; data += 16, sz -= 16) {
+		ldns_buffer_write_char(output, ',');
+		if (!inet_ntop(AF_INET6, data, str, INET6_ADDRSTRLEN))
+			return LDNS_STATUS_INVALID_SVCPARAM_VALUE;
+
+		ldns_buffer_write_chars(output, str);
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+svcparam_value2buffer_str(ldns_buffer *output, size_t sz, uint8_t *data)
+{
+	uint8_t *eod = data + sz, *dp;
+	bool quote = false;
+
+	for (dp = data; dp < eod && !isspace(*dp); dp++)
+		; /* pass */
+
+	if ((quote = dp < eod))
+		ldns_buffer_write_char(output, '"');
+
+	for (dp = data; dp < eod; dp++) {
+		uint8_t ch = *dp;
+
+		if (isprint(ch) || ch == '\t') {
+			if (ch == '"' ||  ch == '\\')
+				ldns_buffer_write_char(output, '\\');
+			ldns_buffer_write_char(output, ch);
+		} else
+			ldns_buffer_printf(output, "\\%03u", (unsigned)ch);
+	}
+	if (quote)
+		ldns_buffer_write_char(output, '"');
+	return ldns_buffer_status(output);
+}
+
+ldns_status
+ldns_rdf2buffer_str_svcparams(ldns_buffer *output, const ldns_rdf *rdf)
+{
+	uint8_t    *data, *dp, *next_dp = NULL;
+	size_t      sz;
+	ldns_status st;
+
+	if (!output)
+		return LDNS_STATUS_NULL;
+
+	if (!rdf || !(data = ldns_rdf_data(rdf)) || !(sz = ldns_rdf_size(rdf)))
+		/* No svcparams is just fine. Just nothing to print. */
+		return LDNS_STATUS_OK;
+	
+	for (dp = data; dp + 4 <= data + sz; dp = next_dp) {
+		ldns_svcparam_key key    = ldns_read_uint16(dp);
+		uint16_t          val_sz = ldns_read_uint16(dp + 2);
+
+		if ((next_dp = dp + 4 + val_sz) > data + sz)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+
+		if (dp > data)
+			ldns_buffer_write_char(output, ' ');
+
+		if ((st = svcparam_key2buffer_str(output, key)))
+			return st;
+
+		if (val_sz == 0)
+			continue;
+		dp += 4;
+		ldns_buffer_write_char(output, '=');
+		switch (key) {
+		case LDNS_SVCPARAM_KEY_MANDATORY:
+			st = svcparam_mandatory2buffer_str(output, val_sz, dp);
+			break;
+		case LDNS_SVCPARAM_KEY_ALPN:
+			st = svcparam_alpn2buffer_str(output, val_sz, dp);
+			break;
+		case LDNS_SVCPARAM_KEY_NO_DEFAULT_ALPN:
+			return LDNS_STATUS_NO_SVCPARAM_VALUE_EXPECTED;
+		case LDNS_SVCPARAM_KEY_PORT:
+			st = svcparam_port2buffer_str(output, val_sz, dp);
+			break;
+		case LDNS_SVCPARAM_KEY_IPV4HINT:
+			st = svcparam_ipv4hint2buffer_str(output, val_sz, dp);
+			break;
+		case LDNS_SVCPARAM_KEY_ECH:
+			st = svcparam_ech2buffer_str(output, val_sz, dp);
+			break;
+		case LDNS_SVCPARAM_KEY_IPV6HINT:
+			st = svcparam_ipv6hint2buffer_str(output, val_sz, dp);
+			break;
+		default:
+			st = svcparam_value2buffer_str(output, val_sz, dp);
+			break;
+		}
+		if (st)
+			return st;
+	}
+	return ldns_buffer_status(output);
+}
+#else	/* #ifdef RRTYPE_SVCB_HTTPS */
+ldns_status
+ldns_rdf2buffer_str_svcparams(ldns_buffer *output, const ldns_rdf *rdf)
+{
+	(void)output; (void)rdf;
+	return LDNS_STATUS_NOT_IMPL;
+}
+#endif	/* #ifdef RRTYPE_SVCB_HTTPS */
+
 static ldns_status
 ldns_rdf2buffer_str_fmt(ldns_buffer *buffer,
 		const ldns_output_format* fmt, const ldns_rdf *rdf)
@@ -1396,6 +1731,12 @@ ldns_rdf2buffer_str_fmt(ldns_buffer *buffer,
 		case LDNS_RDF_TYPE_LONG_STR:
 			res = ldns_rdf2buffer_str_long_str(buffer, rdf);
 			break;
+		case LDNS_RDF_TYPE_AMTRELAY:
+			res = ldns_rdf2buffer_str_amtrelay(buffer, rdf);
+			break;
+		case LDNS_RDF_TYPE_SVCPARAMS:
+			res = ldns_rdf2buffer_str_svcparams(buffer, rdf);
+			break;
 		}
 	} else {
 		/** This will write mangled RRs */
@@ -1475,45 +1816,50 @@ ldns_rr2buffer_str_fmt(ldns_buffer *output,
 		fmt_st = (ldns_output_format_storage*)
 			  ldns_output_format_default;
 	}
-	if (!rr) {
-		if (LDNS_COMMENT_NULLS & fmt_st->flags) {
-			ldns_buffer_printf(output, "; (null)\n");
+	if (!(fmt_st->flags & LDNS_FMT_SHORT)) {
+		if (!rr) {
+			if (LDNS_COMMENT_NULLS & fmt_st->flags) {
+				ldns_buffer_printf(output, "; (null)\n");
+			}
+			return ldns_buffer_status(output);
+		}
+		if (ldns_rr_owner(rr)) {
+			status = ldns_rdf2buffer_str_dname(output, ldns_rr_owner(rr));
+		}
+		if (status != LDNS_STATUS_OK) {
+			return status;
 		}
-		return ldns_buffer_status(output);
-	}
-	if (ldns_rr_owner(rr)) {
-		status = ldns_rdf2buffer_str_dname(output, ldns_rr_owner(rr));
-	}
-	if (status != LDNS_STATUS_OK) {
-		return status;
-	}
 
-	/* TTL should NOT be printed if it is a question */
-	if (!ldns_rr_is_question(rr)) {
-		ldns_buffer_printf(output, "\t%d", ldns_rr_ttl(rr));
-	}
+		/* TTL should NOT be printed if it is a question */
+		if (!ldns_rr_is_question(rr)) {
+			ldns_buffer_printf(output, "\t%u", (unsigned)ldns_rr_ttl(rr));
+		}
 
-	ldns_buffer_printf(output, "\t");
-	status = ldns_rr_class2buffer_str(output, ldns_rr_get_class(rr));
-	if (status != LDNS_STATUS_OK) {
-		return status;
-	}
-	ldns_buffer_printf(output, "\t");
+		ldns_buffer_printf(output, "\t");
+		status = ldns_rr_class2buffer_str(output, ldns_rr_get_class(rr));
+		if (status != LDNS_STATUS_OK) {
+			return status;
+		}
+		ldns_buffer_printf(output, "\t");
 
-	if (ldns_output_format_covers_type(fmt, ldns_rr_get_type(rr))) {
-		return ldns_rr2buffer_str_rfc3597(output, rr);
-	}
-	status = ldns_rr_type2buffer_str(output, ldns_rr_get_type(rr));
-	if (status != LDNS_STATUS_OK) {
-		return status;
-	}
+		if (ldns_output_format_covers_type(fmt, ldns_rr_get_type(rr))) {
+			return ldns_rr2buffer_str_rfc3597(output, rr);
+		}
+		status = ldns_rr_type2buffer_str(output, ldns_rr_get_type(rr));
+		if (status != LDNS_STATUS_OK) {
+			return status;
+		}
 
-	if (ldns_rr_rd_count(rr) > 0) {
-		ldns_buffer_printf(output, "\t");
-	} else if (!ldns_rr_is_question(rr)) {
-		ldns_buffer_printf(output, "\t\\# 0");
-	}
+		if (ldns_rr_rd_count(rr) > 0) {
+			ldns_buffer_printf(output, "\t");
+		} else if (!ldns_rr_is_question(rr)) {
+			ldns_buffer_printf(output, "\t\\# 0");
+		}
+	} else if (ldns_rr_rd_count(rr) == 0) {
+		/* assert(fmt_st->flags & LDNS_FMT_SHORT); */
 
+		ldns_buffer_printf(output, "# 0");
+	}
 	for (i = 0; i < ldns_rr_rd_count(rr); i++) {
 		/* ldns_rdf2buffer_str handles NULL input fine! */
 		if ((fmt_st->flags & LDNS_FMT_ZEROIZE_RRSIGS) &&
@@ -1649,7 +1995,7 @@ ldns_rr2buffer_str_fmt(ldns_buffer *output,
 							   node->data
 							));
 					}
-					ldns_rdf_free(key);
+					ldns_rdf_deep_free(key);
 				}
 				key = ldns_b32_ext2dname(
 						ldns_nsec3_next_owner(rr));
@@ -1667,7 +2013,7 @@ ldns_rr2buffer_str_fmt(ldns_buffer *output,
 							   node->data
 							));
 					}
-					ldns_rdf_free(key);
+					ldns_rdf_deep_free(key);
 				}
 			}
 			ldns_buffer_printf(output, "}");
@@ -1760,52 +2106,631 @@ ldns_pktheader2buffer_str(ldns_buffer *output, const ldns_pkt *pkt)
 	return ldns_buffer_status(output);
 }
 
-ldns_status
-ldns_pkt2buffer_str_fmt(ldns_buffer *output, 
-		const ldns_output_format *fmt, const ldns_pkt *pkt)
-{
-	uint16_t i;
-	ldns_status status = LDNS_STATUS_OK;
-	char *tmp;
-	struct timeval time;
-	time_t time_tt;
 
-	if (!pkt) {
-		ldns_buffer_printf(output, "null");
-		return LDNS_STATUS_OK;
+/* print EDNS option data in the Dig format: 76 61 6c 69 ... */
+static void
+ldns_edns_hex_data2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t j;
+	for (j = 0; j < len; j++) {
+		ldns_buffer_printf(output, " %02x", data[j]);
 	}
+}
 
-	if (ldns_buffer_status_ok(output)) {
-		status = ldns_pktheader2buffer_str(output, pkt);
-		if (status != LDNS_STATUS_OK) {
-			return status;
-		}
+static ldns_status
+ldns_edns_llq2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	/* LLQ constants */
+	const char* llq_errors[] = {"NO-ERROR", "SERV-FULL", "STATIC",
+		"FORMAT-ERR", "NO-SUCH-LLQ", "BAD-VERS", "UNKNOWN_ERR"};
+	const unsigned int llq_errors_num = 7;
+	const char* llq_opcodes[] = {"LLQ-SETUP", "LLQ-REFRESH", "LLQ-EVENT"};
+	const unsigned int llq_opcodes_num = 3;
 
-		ldns_buffer_printf(output, "\n");
+	uint16_t version, llq_opcode, error_code;
+	uint64_t llq_id;
+	uint32_t lease_life; /* Requested or granted life of LLQ, in seconds */
 
-		ldns_buffer_printf(output, ";; QUESTION SECTION:\n;; ");
+	ldns_buffer_printf(output, "; Long-Lived Query:");
 
+	/* read the record */
+	if(len != 18) {
+		ldns_buffer_printf(output, " malformed LLQ ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
 
-		for (i = 0; i < ldns_pkt_qdcount(pkt); i++) {
-			status = ldns_rr2buffer_str_fmt(output, fmt,
-				       ldns_rr_list_rr(
-					       ldns_pkt_question(pkt), i));
-			if (status != LDNS_STATUS_OK) {
-				return status;
-			}
-		}
-		ldns_buffer_printf(output, "\n");
+		return ldns_buffer_status(output);
+	}
+	version = ldns_read_uint16(data);
+	llq_opcode = ldns_read_uint16(data+2);
+	error_code = ldns_read_uint16(data+4);
+	memmove(&llq_id, data+6, sizeof(uint64_t));
+	lease_life = ldns_read_uint32(data+14);
 
-		ldns_buffer_printf(output, ";; ANSWER SECTION:\n");
-		for (i = 0; i < ldns_pkt_ancount(pkt); i++) {
-			status = ldns_rr2buffer_str_fmt(output, fmt,
-				       ldns_rr_list_rr(
-					       ldns_pkt_answer(pkt), i));
-			if (status != LDNS_STATUS_OK) {
-				return status;
-			}
+	/* print option field entires */
+	ldns_buffer_printf(output, "v%d ", (int)version);
 
-		}
+	if(llq_opcode < llq_opcodes_num) {
+		ldns_buffer_printf(output, "%s", llq_opcodes[llq_opcode]);
+	} else {
+		ldns_buffer_printf(output, "opcode %d", (int)llq_opcode);
+	}
+
+	if(error_code < llq_errors_num)
+		ldns_buffer_printf(output, " %s", llq_errors[error_code]);
+	else {
+		ldns_buffer_printf(output, " error %d", (int)error_code);
+	}
+
+#ifndef USE_WINSOCK
+	ldns_buffer_printf(output, " id %llx lease-life %lu",
+		(unsigned long long)llq_id, (unsigned long)lease_life);
+#else
+	ldns_buffer_printf(output, " id %I64x lease-life %lu",
+		(unsigned long long)llq_id, (unsigned long)lease_life);
+#endif
+	return ldns_buffer_status(output);
+}
+
+
+static ldns_status
+ldns_edns_ul2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	uint32_t lease;
+
+	ldns_buffer_printf(output, "; Update Lease:");
+
+	if(len != 4) {
+		ldns_buffer_printf(output, " malformed UL ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+		return ldns_buffer_status(output);
+	}
+	lease = ldns_read_uint32(data);
+	ldns_buffer_printf(output, "lease %lu", (unsigned long)lease);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_nsid2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i, printed=0;
+
+	ldns_buffer_printf(output, "; NSID:");
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	/* print the human-readable text string */
+	for(i = 0; i < len; i++) {
+		if(isprint((unsigned char)data[i]) || data[i] == '\t') {
+			if(!printed) {
+				ldns_buffer_printf(output, " (");
+				printed = 1;
+			}
+			ldns_buffer_printf(output, "%c", (char)data[i]);
+		}
+	}
+	if(printed)
+		ldns_buffer_printf(output, ")");
+	return ldns_buffer_status(output);
+}
+
+
+static ldns_status
+ldns_edns_dau2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i;
+	ldns_lookup_table *lt;
+
+	ldns_buffer_printf(output, "; DNSSEC Algorithm Understood (DAU):");
+
+	for(i = 0; i <len; i++) {
+		lt = ldns_lookup_by_id(ldns_algorithms, data[i]);
+		if (lt && lt->name) {
+			ldns_buffer_printf(output, " %s", lt->name);
+		} else {
+			ldns_buffer_printf(output, " ALG%u", data[i]);
+		}
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_dhu2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i;
+	ldns_lookup_table *lt;
+
+	ldns_buffer_printf(output, "; DS Hash Understood (DHU):");
+
+	for(i = 0; i < len; i++) {
+		lt = ldns_lookup_by_id(ldns_hashes, data[i]);
+		if (lt && lt->name) {
+			ldns_buffer_printf(output, " %s", lt->name);
+		} else {
+			ldns_buffer_printf(output, " ALG%u", data[i]);
+		}
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_d3u2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i;
+
+	ldns_buffer_printf(output, "; NSEC3 Hash Understood (N3U):");
+
+	for(i=0; i<len; i++) {
+		if(data[i] == 1) {
+			ldns_buffer_printf(output, " SHA1");
+		} else {
+			ldns_buffer_printf(output, " %d", (int)data[i]);
+		}
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_subnet2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	uint16_t family;
+	uint8_t source, scope;
+	if(len < 4) {
+		ldns_buffer_printf(output, "malformed subnet ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+		return ldns_buffer_status(output);
+	}
+	family = ldns_read_uint16(data);
+	source = data[2];
+	scope = data[3];
+	if(family == 1) {
+		/* IPv4 */
+		char buf[64];
+		uint8_t ip4[4];
+		memset(ip4, 0, sizeof(ip4));
+		if(len-4 > 4) {
+			ldns_buffer_printf(output, "trailingdata:");
+			ldns_edns_hex_data2buffer_str(output, data+4+4, len-4-4);
+			ldns_buffer_printf(output, " ");
+			len = 4+4;
+		}
+		memmove(ip4, data+4, len-4);
+		if(!inet_ntop(AF_INET, ip4, buf, (socklen_t) sizeof(buf))) {
+			ldns_buffer_printf(output, "ip4ntoperror ");
+			ldns_edns_hex_data2buffer_str(output, data+4+4, len-4-4);
+		} else {
+			ldns_buffer_printf(output, "%s", buf);
+		}
+	} else if(family == 2) {
+		/* IPv6 */
+		char buf[64];
+		uint8_t ip6[16];
+		memset(ip6, 0, sizeof(ip6));
+		if(len-4 > 16) {
+			ldns_buffer_printf(output, "trailingdata:");
+			ldns_edns_hex_data2buffer_str(output, data+4+16, len-4-16);
+			ldns_buffer_printf(output, " ");
+			len = 4+16;
+		}
+		memmove(ip6, data+4, len-4);
+#ifdef AF_INET6
+		if(!inet_ntop(AF_INET6, ip6, buf, (socklen_t) sizeof(buf))) {
+			ldns_buffer_printf(output, "ip6ntoperror ");
+			ldns_edns_hex_data2buffer_str(output, data+4+4, len-4-4);
+		} else {
+			ldns_buffer_printf(output, "%s", buf);
+		}
+#else
+		ldns_edns_hex_data2buffer_str(output,  data+4+4, len-4-4);
+#endif
+	} else {
+		/* unknown */
+		ldns_buffer_printf(output, "family %d ", (int)family);
+		ldns_edns_hex_data2buffer_str(output, data, len);
+	}
+	ldns_buffer_printf(output, "/%d scope /%d", (int)source, (int)scope);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_expire2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+
+	ldns_buffer_printf(output, "; EXPIRE:");
+
+	if (!(len == 0) || len == 4) {
+		ldns_buffer_printf(output, "malformed expire ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	// TODO can this output be more accurate?
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	return ldns_buffer_status(output);
+}
+
+
+static ldns_status
+ldns_edns_cookie2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	ldns_buffer_printf(output, "; COOKIE:");
+
+	/* the size of an EDNS cookie is restricted by RFC 7873 */
+	if (!(len == 8 || (len >= 16 && len < 40))) {
+		ldns_buffer_printf(output, "malformed cookie ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+	}
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_keepalive2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	uint16_t timeout;
+
+	ldns_buffer_printf(output, "; KEEPALIVE:");
+
+	if(!(len == 0 || len == 2)) {
+		ldns_buffer_printf(output, "malformed keepalive ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	if(len == 0) {
+		ldns_buffer_printf(output, "no timeout value (only valid for client option)");
+	} else {
+		timeout = ldns_read_uint16(data);
+		ldns_buffer_printf(output, "timeout value in units of 100ms %u", (int)timeout);
+	}
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_padding2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	ldns_buffer_printf(output, "; PADDING: ");
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_chain2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	ldns_rdf** temp = NULL;
+
+	ldns_buffer_printf(output, "; CHAIN: ");
+
+	if (ldns_str2rdf_dname(temp, (char*) data) != LDNS_STATUS_OK) {
+		ldns_buffer_printf(output, "malformed chain ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	ldns_characters2buffer_str(output, len, data);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_key_tag2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i;
+
+	ldns_buffer_printf(output, "; KEY TAG: ");
+
+	if(len < 2 || len % 2 != 0) {
+		ldns_buffer_printf(output, "malformed key tag ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	for (i = 0; i < len; i += 2) {
+		uint16_t tag = ldns_read_uint16(data);
+
+		ldns_buffer_printf(output, " %hu", tag);
+	}
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_ede2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	size_t i;
+	uint16_t ede;
+	ldns_buffer_printf(output, "; EDE:");
+
+	if(len < 2) {
+		ldns_buffer_printf(output, "malformed ede ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	ede = ldns_read_uint16(data);
+
+	switch (ede) {
+	case LDNS_EDE_OTHER:
+		ldns_buffer_printf(output, " 0 (Other): ");
+		break;
+	case LDNS_EDE_UNSUPPORTED_DNSKEY_ALG:
+		ldns_buffer_printf(output, " 1 (Unsupported DNSKEY Algorithm)");
+		break;
+	case LDNS_EDE_UNSUPPORTED_DS_DIGEST:
+		ldns_buffer_printf(output, " 2 (Unsupported DS Digest type)");
+		break;
+	case LDNS_EDE_STALE_ANSWER:
+		ldns_buffer_printf(output, " 3 (Stale Answer)");
+		break;
+	case LDNS_EDE_FORGED_ANSWER:
+		ldns_buffer_printf(output, " 4 (Forged Answer)");
+		break;
+	case LDNS_EDE_DNSSEC_INDETERMINATE:
+		ldns_buffer_printf(output, " 5 (DNSSEC Indeterminate)");
+		break;
+	case LDNS_EDE_DNSSEC_BOGUS:
+		ldns_buffer_printf(output, " 6 (DNSSEC Bogus)");
+		break;
+	case LDNS_EDE_SIGNATURE_EXPIRED:
+		ldns_buffer_printf(output, " 7 (Signature Expired)");
+		break;
+	case LDNS_EDE_SIGNATURE_NOT_YET_VALID:
+		ldns_buffer_printf(output, " 8 (Signature Not Yet Valid)");
+		break;
+	case LDNS_EDE_DNSKEY_MISSING:
+		ldns_buffer_printf(output, " 9 (DNSKEY Missing)");
+		break;
+	case LDNS_EDE_RRSIGS_MISSING:
+		ldns_buffer_printf(output, " 10 (RRSIGs Missing)");
+		break;
+	case LDNS_EDE_NO_ZONE_KEY_BIT_SET:
+		ldns_buffer_printf(output, " 11 (No Zone Key Bit Set)");
+		break;
+	case LDNS_EDE_NSEC_MISSING:
+		ldns_buffer_printf(output, " 12 (NSEC Missing)");
+		break;
+	case LDNS_EDE_CACHED_ERROR:
+		ldns_buffer_printf(output, " 13 (Cached Error)");
+		break;
+	case LDNS_EDE_NOT_READY:
+		ldns_buffer_printf(output, " 14 (Not Ready)");
+		break;
+	case LDNS_EDE_BLOCKED:
+		ldns_buffer_printf(output, " 15 (Blocked)");
+		break;
+	case LDNS_EDE_CENSORED:
+		ldns_buffer_printf(output, " 16 (Censored)");
+		break;
+	case LDNS_EDE_FILTERED:
+		ldns_buffer_printf(output, " 17 (Filtered)");
+		break;
+	case LDNS_EDE_PROHIBITED:
+		ldns_buffer_printf(output, " 18 (Prohibited)");
+		break;
+	case LDNS_EDE_STALE_NXDOMAIN_ANSWER:
+		ldns_buffer_printf(output, " 19 (NXDOMAIN Answer)");
+		break;
+	case LDNS_EDE_NOT_AUTHORITATIVE:
+		ldns_buffer_printf(output, " 20 (Not Authoritative)");
+		break;
+	case LDNS_EDE_NOT_SUPPORTED:
+		ldns_buffer_printf(output, " 21 (Not Supported)");
+		break;
+	case LDNS_EDE_NO_REACHABLE_AUTHORITY:
+		ldns_buffer_printf(output, " 22 (No Reachable Authority)");
+		break;
+	case LDNS_EDE_NETWORK_ERROR:
+		ldns_buffer_printf(output, " 23 (Network Error)");
+		break;
+	case LDNS_EDE_INVALID_DATA:
+		ldns_buffer_printf(output, " 24 (Invalid Data)");
+		break;
+	case LDNS_EDE_SIGNATURE_EXPIRED_BEFORE_VALID:
+		ldns_buffer_printf(output, " 25 (Signature Expired Before Valid)");
+		break;
+	case LDNS_EDE_TOO_EARLY:
+		ldns_buffer_printf(output, " 26 (Too Early)");
+		break;
+	default:
+		ldns_buffer_printf(output, " %02x", data[0]);
+		ldns_buffer_printf(output, " %02x", data[1]);
+		break;
+	}
+
+	/* skip the EDE code in the output */
+	data += 2;
+	len -= 2;
+
+	if (len > 2) {
+		/* format the hex bytes */
+		ldns_buffer_printf(output, ":");
+		for (i = 0; i < len; i++) {
+			ldns_buffer_printf(output, " %02x", data[i]);
+		}
+
+		/* format the human-readable string */
+		ldns_buffer_printf(output, " (");
+		ldns_characters2buffer_str(output, len, data);
+		ldns_buffer_printf(output, ")");
+	}
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_client_tag2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	ldns_buffer_printf(output, "; CLIENT-TAG:");
+
+	if (len > 2) {
+		ldns_buffer_printf(output, "malformed client-tag ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	return ldns_buffer_status(output);
+}
+
+static ldns_status
+ldns_edns_server_tag2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
+{
+	ldns_buffer_printf(output, "; SERVER-TAG:");
+
+	if (len > 2) {
+		ldns_buffer_printf(output, "malformed server-tag ");
+		ldns_edns_hex_data2buffer_str(output, data, len);
+
+		return ldns_buffer_status(output);
+	}
+
+	ldns_edns_hex_data2buffer_str(output, data, len);
+
+	return ldns_buffer_status(output);
+}
+
+ldns_status
+ldns_edns_option_list2buffer_str(ldns_buffer *output, ldns_edns_option_list* edns_list)
+{
+	size_t count = ldns_edns_option_list_get_count(edns_list);
+	size_t i, size;
+	uint8_t* data;
+
+	for (i = 0; i < count; i++) {
+		ldns_edns_option_code code;
+		ldns_edns_option* edns = ldns_edns_option_list_get_option(edns_list, i);
+
+		if (!edns) {
+			break;
+		}
+
+		code = ldns_edns_get_code(edns);
+		size = ldns_edns_get_size(edns);
+		data = ldns_edns_get_data(edns);
+
+		switch(code) {
+		case LDNS_EDNS_LLQ:
+			ldns_edns_llq2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_UL:
+			ldns_edns_ul2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_NSID:
+			ldns_edns_nsid2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_DAU:
+			ldns_edns_dau2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_DHU:
+			ldns_edns_dhu2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_N3U:
+			ldns_edns_d3u2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_CLIENT_SUBNET:
+			ldns_edns_subnet2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_EXPIRE:
+			ldns_edns_expire2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_COOKIE:
+			ldns_edns_cookie2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_KEEPALIVE:
+			ldns_edns_keepalive2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_PADDING:
+			ldns_edns_padding2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_CHAIN:
+			ldns_edns_chain2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_KEY_TAG:
+			ldns_edns_key_tag2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_EDE:
+			ldns_edns_ede2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_CLIENT_TAG:
+			ldns_edns_client_tag2buffer_str(output, data, size);
+			break;
+		case LDNS_EDNS_SERVER_TAG:
+			ldns_edns_server_tag2buffer_str(output, data, size);
+			break;
+		default:
+			ldns_buffer_printf(output, "; OPT=%d:", code);
+			ldns_edns_hex_data2buffer_str(output, data, size);
+			break;
+		}
+		ldns_buffer_printf(output, "\n");
+	}
+
+	return ldns_buffer_status(output);
+}
+
+
+ldns_status
+ldns_pkt2buffer_str_fmt(ldns_buffer *output, 
+		const ldns_output_format *fmt, const ldns_pkt *pkt)
+{
+	uint16_t i;
+	ldns_status status = LDNS_STATUS_OK;
+	char *tmp;
+	struct timeval time;
+	time_t time_tt;
+	int short_fmt = fmt && (fmt->flags & LDNS_FMT_SHORT);
+
+	if (!pkt) {
+		ldns_buffer_printf(output, "null");
+		return LDNS_STATUS_OK;
+	}
+
+	if (!ldns_buffer_status_ok(output)) {
+		return ldns_buffer_status(output);
+	}
+
+	if (!short_fmt) {
+		status = ldns_pktheader2buffer_str(output, pkt);
+		if (status != LDNS_STATUS_OK) {
+			return status;
+		}
+
+		ldns_buffer_printf(output, "\n");
+
+		ldns_buffer_printf(output, ";; QUESTION SECTION:\n;; ");
+
+
+		for (i = 0; i < ldns_pkt_qdcount(pkt); i++) {
+			status = ldns_rr2buffer_str_fmt(output, fmt,
+				       ldns_rr_list_rr(
+					       ldns_pkt_question(pkt), i));
+			if (status != LDNS_STATUS_OK) {
+				return status;
+			}
+		}
+		ldns_buffer_printf(output, "\n");
+
+		ldns_buffer_printf(output, ";; ANSWER SECTION:\n");
+	}
+	for (i = 0; i < ldns_pkt_ancount(pkt); i++) {
+		status = ldns_rr2buffer_str_fmt(output, fmt,
+			       ldns_rr_list_rr(
+				       ldns_pkt_answer(pkt), i));
+		if (status != LDNS_STATUS_OK) {
+			return status;
+		}
+	}
+	if (!short_fmt) {
 		ldns_buffer_printf(output, "\n");
 
 		ldns_buffer_printf(output, ";; AUTHORITY SECTION:\n");
@@ -1831,7 +2756,7 @@ ldns_pkt2buffer_str_fmt(ldns_buffer *output,
 
 		}
 		ldns_buffer_printf(output, "\n");
-		/* add some futher fields */
+		/* add some further fields */
 		ldns_buffer_printf(output, ";; Query time: %d msec\n",
 				ldns_pkt_querytime(pkt));
 		if (ldns_pkt_edns(pkt)) {
@@ -1850,11 +2775,20 @@ ldns_pkt2buffer_str_fmt(ldns_buffer *output,
 			ldns_buffer_printf(output, " ; udp: %u\n",
 					   ldns_pkt_edns_udp_size(pkt));
 
-			if (ldns_pkt_edns_data(pkt)) {
-				ldns_buffer_printf(output, ";; Data: ");
-				(void)ldns_rdf2buffer_str(output,
-							  ldns_pkt_edns_data(pkt));
-				ldns_buffer_printf(output, "\n");
+			if (pkt->_edns_list)
+				ldns_edns_option_list2buffer_str(output, pkt->_edns_list);
+
+			else if (ldns_pkt_edns_data(pkt)) {
+				ldns_edns_option_list* edns_list;
+				/* parse the EDNS data into separate EDNS options
+				 * and add them to the list */
+				if ((edns_list = pkt_edns_data2edns_option_list(ldns_pkt_edns_data(pkt)))) {
+					ldns_edns_option_list2buffer_str(output, edns_list);
+					ldns_edns_option_list_deep_free(edns_list);
+				} else {
+					ldns_buffer_printf(output, ";; Data: ");
+					(void)ldns_rdf2buffer_str(output, ldns_pkt_edns_data(pkt));
+				}
 			}
 		}
 		if (ldns_pkt_tsig(pkt)) {
@@ -1875,8 +2809,6 @@ ldns_pkt2buffer_str_fmt(ldns_buffer *output,
 
 		ldns_buffer_printf(output, ";; MSG SIZE  rcvd: %d\n",
 				(int)ldns_pkt_size(pkt));
-	} else {
-		return ldns_buffer_status(output);
 	}
 	return status;
 }
@@ -1929,6 +2861,63 @@ ldns_gost_key2buffer_str(ldns_buffer *output, EVP_PKEY *p)
 }
 #endif
 
+#if defined(HAVE_SSL) && defined(USE_ED25519)
+static ldns_status
+ldns_ed25519_key2buffer_str(ldns_buffer *output, EVP_PKEY *p)
+{
+	unsigned char* pp = NULL;
+	int ret;
+	ldns_rdf *b64_bignum;
+	ldns_status status;
+
+	ldns_buffer_printf(output, "PrivateKey: ");
+
+	ret = i2d_PrivateKey(p, &pp);
+	/* 16 byte asn (302e020100300506032b657004220420) + 32byte key */
+	if(ret != 16 + 32) {
+		OPENSSL_free(pp);
+		return LDNS_STATUS_ERR;
+	}
+	b64_bignum = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
+		(size_t)ret-16, pp+16);
+	status = ldns_rdf2buffer_str(output, b64_bignum);
+
+	ldns_rdf_deep_free(b64_bignum);
+	OPENSSL_free(pp);
+	ldns_buffer_printf(output, "\n");
+	return status;
+}
+#endif
+
+#if defined(HAVE_SSL) && defined(USE_ED448)
+static ldns_status
+ldns_ed448_key2buffer_str(ldns_buffer *output, EVP_PKEY *p)
+{
+	unsigned char* pp = NULL;
+	int ret;
+	ldns_rdf *b64_bignum;
+	ldns_status status;
+
+	ldns_buffer_printf(output, "PrivateKey: ");
+
+	ret = i2d_PrivateKey(p, &pp);
+	/* some-ASN + 57byte key */
+	if(ret != 16 + 57) {
+		OPENSSL_free(pp);
+		return LDNS_STATUS_ERR;
+	}
+	b64_bignum = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
+		(size_t)ret-16, pp+16);
+	status = ldns_rdf2buffer_str(output, b64_bignum);
+
+	ldns_rdf_deep_free(b64_bignum);
+	OPENSSL_free(pp);
+	ldns_buffer_printf(output, "\n");
+	return status;
+}
+#endif
+
+#if defined(HAVE_SSL)
 /** print one b64 encoded bignum to a line in the keybuffer */
 static int
 ldns_print_bignum_b64_line(ldns_buffer* output, const char* label, const BIGNUM* num)
@@ -1958,6 +2947,7 @@ ldns_print_bignum_b64_line(ldns_buffer* output, const char* label, const BIGNUM*
 	LDNS_FREE(bignumbuf);
 	return 1;
 }
+#endif
 
 ldns_status
 ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
@@ -1966,7 +2956,9 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 	unsigned char  *bignum;
 #ifdef HAVE_SSL
 	RSA *rsa;
+#ifdef USE_DSA
 	DSA *dsa;
+#endif /* USE_DSA */
 #endif /* HAVE_SSL */
 
 	if (!k) {
@@ -2040,7 +3032,7 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 					const BIGNUM *n=NULL, *e=NULL, *d=NULL,
 						*p=NULL, *q=NULL, *dmp1=NULL,
 						*dmq1=NULL, *iqmp=NULL;
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 					n = rsa->n;
 					e = rsa->e;
 					d = rsa->d;
@@ -2076,6 +3068,7 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 
 				RSA_free(rsa);
 				break;
+#ifdef USE_DSA
 			case LDNS_SIGN_DSA:
 			case LDNS_SIGN_DSA_NSEC3:
 				dsa = ldns_key_dsa_key(k);
@@ -2092,7 +3085,7 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 				if(1) {
 					const BIGNUM *p=NULL, *q=NULL, *g=NULL,
 						*priv_key=NULL, *pub_key=NULL;
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 #ifndef S_SPLINT_S
 					p = dsa->p;
 					q = dsa->q;
@@ -2116,6 +3109,7 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 						goto error;
 				}
 				break;
+#endif /* USE_DSA */
 			case LDNS_SIGN_ECC_GOST:
 				/* no format defined, use blob */
 #if defined(HAVE_SSL) && defined(USE_GOST)
@@ -2160,16 +3154,9 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 				ldns_buffer_printf(output, "Algorithm: %d (", ldns_key_algorithm(k));
                                 status=ldns_algorithm2buffer_str(output, (ldns_algorithm)ldns_key_algorithm(k));
 				ldns_buffer_printf(output, ")\n");
-				if(k->_key.key) {
-                                        EC_KEY* ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
-                                        const BIGNUM* b = EC_KEY_get0_private_key(ec);
-					if(!ldns_print_bignum_b64_line(output, "PrivateKey", b))
-						goto error;
-                                        /* down reference count in EC_KEY
-                                         * its still assigned to the PKEY */
-                                        EC_KEY_free(ec);
-				}
-				ldns_buffer_printf(output, "\n");
+				if (status) break;
+				status = ldns_ed25519_key2buffer_str(output,
+					k->_key.key);
 				break;
 #endif /* USE_ED25519 */
 #ifdef USE_ED448
@@ -2178,16 +3165,9 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 				ldns_buffer_printf(output, "Algorithm: %d (", ldns_key_algorithm(k));
                                 status=ldns_algorithm2buffer_str(output, (ldns_algorithm)ldns_key_algorithm(k));
 				ldns_buffer_printf(output, ")\n");
-				if(k->_key.key) {
-                                        EC_KEY* ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
-                                        const BIGNUM* b = EC_KEY_get0_private_key(ec);
-					if(!ldns_print_bignum_b64_line(output, "PrivateKey", b))
-						goto error;
-                                        /* down reference count in EC_KEY
-                                         * its still assigned to the PKEY */
-                                        EC_KEY_free(ec);
-				}
-				ldns_buffer_printf(output, "\n");
+				if (status) break;
+				status = ldns_ed448_key2buffer_str(output,
+					k->_key.key);
 				break;
 #endif /* USE_ED448 */
 			case LDNS_SIGN_HMACMD5:
@@ -2254,7 +3234,7 @@ ldns_buffer2str(ldns_buffer *buffer)
 		if (!ldns_buffer_reserve(buffer, 1)) {
 			return NULL;
 		}
-		ldns_buffer_write_u8(buffer, (uint8_t) '\0');
+		ldns_buffer_write_char(buffer, (uint8_t) '\0');
 		if (!ldns_buffer_set_capacity(buffer, ldns_buffer_position(buffer))) {
 			return NULL;
 		}
@@ -2277,7 +3257,7 @@ ldns_buffer_export2str(ldns_buffer *buffer)
 	if (! ldns_buffer_reserve(buffer, 1)) {
 		return NULL;
 	}
-	ldns_buffer_write_u8(buffer, 0);
+	ldns_buffer_write_char(buffer, 0);
 
 	/* reallocate memory to the size of the string and export */
 	ldns_buffer_set_capacity(buffer, ldns_buffer_position(buffer));
diff --git a/contrib/ldns/host2wire.c b/contrib/ldns/host2wire.c
index 4d8aa30f2d85ca..d1539214796dee 100644
--- a/contrib/ldns/host2wire.c
+++ b/contrib/ldns/host2wire.c
@@ -67,17 +67,27 @@ ldns_dname2buffer_wire_compress(ldns_buffer *buffer, const ldns_rdf *name, ldns_
 	{
 		/* Not found. Write cache entry, take off first label, write it, */
 		/* try again with the rest of the name. */
-		node = LDNS_MALLOC(ldns_rbnode_t);
-		if(!node)
-		{
-			return LDNS_STATUS_MEM_ERR;
-		}
 		if (ldns_buffer_position(buffer) < 16384) {
-			node->key = ldns_rdf_clone(name);
+			ldns_rdf *key;
+
+			node = LDNS_MALLOC(ldns_rbnode_t);
+			if(!node)
+			{
+				return LDNS_STATUS_MEM_ERR;
+			}
+
+			key = ldns_rdf_clone(name);
+			if (!key) {
+				LDNS_FREE(node);
+				return LDNS_STATUS_MEM_ERR;
+			}
+			node->key = key;
 			node->data = (void *) (intptr_t) ldns_buffer_position(buffer);
 			if(!ldns_rbtree_insert(compression_data,node))
 			{
 				/* fprintf(stderr,"Name not found but now it's there?\n"); */
+				ldns_rdf_deep_free(key);
+				LDNS_FREE(node);
 			}
 		}
 		label = ldns_dname_label(name, 0);
@@ -364,6 +374,20 @@ compression_node_free(ldns_rbnode_t *node, void *arg)
 
 ldns_status
 ldns_pkt2buffer_wire(ldns_buffer *buffer, const ldns_pkt *packet)
+{
+	ldns_status status;
+	ldns_rbtree_t *compression_data = ldns_rbtree_create((int (*)(const void *, const void *))ldns_dname_compare);
+
+	status = ldns_pkt2buffer_wire_compress(buffer, packet, compression_data);
+
+	ldns_traverse_postorder(compression_data,compression_node_free,NULL);
+	ldns_rbtree_free(compression_data);
+
+	return status;
+}
+
+ldns_status
+ldns_pkt2buffer_wire_compress(ldns_buffer *buffer, const ldns_pkt *packet, ldns_rbtree_t *compression_data)
 {
 	ldns_rr_list *rr_list;
 	uint16_t i;
@@ -372,8 +396,9 @@ ldns_pkt2buffer_wire(ldns_buffer *buffer, const ldns_pkt *packet)
 	ldns_rr *edns_rr;
 	uint8_t edata[4];
 
-	ldns_rbtree_t *compression_data = ldns_rbtree_create((int (*)(const void *, const void *))ldns_dname_compare);
-	
+	ldns_buffer *edns_buf = NULL;
+	ldns_rdf    *edns_rdf = NULL;
+
 	(void) ldns_hdr2buffer_wire(buffer, packet);
 
 	rr_list = ldns_pkt_question(packet);
@@ -418,11 +443,22 @@ ldns_pkt2buffer_wire(ldns_buffer *buffer, const ldns_pkt *packet)
 		ldns_write_uint16(&edata[2], ldns_pkt_edns_z(packet));
 		ldns_rr_set_ttl(edns_rr, ldns_read_uint32(edata));
 		/* don't forget to add the edns rdata (if any) */
-		if (packet->_edns_data)
-			ldns_rr_push_rdf (edns_rr, packet->_edns_data);
+		if ((edns_buf = ldns_edns_option_list2wireformat_buffer(packet->_edns_list))) {
+			edns_rdf = ldns_rdf_new( LDNS_RDF_TYPE_UNKNOWN
+			                       , ldns_buffer_limit(edns_buf)
+			                       , ldns_buffer_export(edns_buf));
+			ldns_buffer_free(edns_buf);
+		}
+		if (edns_rdf)
+			ldns_rr_push_rdf(edns_rr, edns_rdf);
+		else if (packet->_edns_data)
+			ldns_rr_push_rdf(edns_rr, packet->_edns_data);
 		(void)ldns_rr2buffer_wire_compress(buffer, edns_rr, LDNS_SECTION_ADDITIONAL, compression_data);
-		/* take the edns rdata back out of the rr before we free rr */
-		if (packet->_edns_data)
+		/* if the rdata of the OPT came from packet->_edns_data
+		 * we need to take it back out of the edns_rr before we free it
+		 * so packet->_edns_data doesn't get freed
+		 */
+		if (!edns_rdf && packet->_edns_data)
 			(void)ldns_rr_pop_rdf (edns_rr);
 		ldns_rr_free(edns_rr);
 	}
@@ -433,9 +469,6 @@ ldns_pkt2buffer_wire(ldns_buffer *buffer, const ldns_pkt *packet)
 		                           ldns_pkt_tsig(packet), LDNS_SECTION_ADDITIONAL, compression_data);
 	}
 
-	ldns_traverse_postorder(compression_data,compression_node_free,NULL);
-	ldns_rbtree_free(compression_data);
-
 	return LDNS_STATUS_OK;
 }
 
diff --git a/contrib/ldns/install-sh b/contrib/ldns/install-sh
index 59990a10492675..ec298b53740270 100755
--- a/contrib/ldns/install-sh
+++ b/contrib/ldns/install-sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2014-09-12.12; # UTC
+scriptversion=2020-11-14.01; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -69,6 +69,11 @@ posix_mkdir=
 # Desired mode of installed file.
 mode=0755
 
+# Create dirs (including intermediate dirs) using mode 755.
+# This is like GNU 'install' as of coreutils 8.32 (2020).
+mkdir_umask=22
+
+backupsuffix=
 chgrpcmd=
 chmodcmd=$chmodprog
 chowncmd=
@@ -99,18 +104,28 @@ Options:
      --version  display version info and exit.
 
   -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
+  -C            install only if different (preserve data modification time)
   -d            create directories instead of installing files.
   -g GROUP      $chgrpprog installed files to GROUP.
   -m MODE       $chmodprog installed files to MODE.
   -o USER       $chownprog installed files to USER.
+  -p            pass -p to $cpprog.
   -s            $stripprog installed files.
+  -S SUFFIX     attempt to back up existing files, with suffix SUFFIX.
   -t DIRECTORY  install into DIRECTORY.
   -T            report an error if DSTFILE is a directory.
 
 Environment variables override the default commands:
   CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
   RMPROG STRIPPROG
+
+By default, rm is invoked with -f; when overridden with RMPROG,
+it's up to you to specify -f if you want it.
+
+If -S is not specified, no backups are attempted.
+
+Email bug reports to bug-automake@gnu.org.
+Automake home page: https://www.gnu.org/software/automake/
 "
 
 while test $# -ne 0; do
@@ -137,8 +152,13 @@ while test $# -ne 0; do
     -o) chowncmd="$chownprog $2"
         shift;;
 
+    -p) cpprog="$cpprog -p";;
+
     -s) stripcmd=$stripprog;;
 
+    -S) backupsuffix="$2"
+        shift;;
+
     -t)
         is_target_a_directory=always
         dst_arg=$2
@@ -255,6 +275,10 @@ do
     dstdir=$dst
     test -d "$dstdir"
     dstdir_status=$?
+    # Don't chown directories that already exist.
+    if test $dstdir_status = 0; then
+      chowncmd=""
+    fi
   else
 
     # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
@@ -271,15 +295,18 @@ do
     fi
     dst=$dst_arg
 
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
+    # If destination is a directory, append the input filename.
     if test -d "$dst"; then
       if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
       dstdir=$dst
-      dst=$dstdir/`basename "$src"`
+      dstbase=`basename "$src"`
+      case $dst in
+	*/) dst=$dst$dstbase;;
+	*)  dst=$dst/$dstbase;;
+      esac
       dstdir_status=0
     else
       dstdir=`dirname "$dst"`
@@ -288,27 +315,16 @@ do
     fi
   fi
 
+  case $dstdir in
+    */) dstdirslash=$dstdir;;
+    *)  dstdirslash=$dstdir/;;
+  esac
+
   obsolete_mkdir_used=false
 
   if test $dstdir_status != 0; then
     case $posix_mkdir in
       '')
-        # Create intermediate dirs using mode 755 as modified by the umask.
-        # This is like FreeBSD 'install' as of 1997-10-28.
-        umask=`umask`
-        case $stripcmd.$umask in
-          # Optimize common cases.
-          *[2367][2367]) mkdir_umask=$umask;;
-          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-          *[0-7])
-            mkdir_umask=`expr $umask + 22 \
-              - $umask % 100 % 40 + $umask % 20 \
-              - $umask % 10 % 4 + $umask % 2
-            `;;
-          *) mkdir_umask=$umask,go-w;;
-        esac
-
         # With -d, create the new directory with the user-specified mode.
         # Otherwise, rely on $mkdir_umask.
         if test -n "$dir_arg"; then
@@ -318,50 +334,49 @@ do
         fi
 
         posix_mkdir=false
-        case $umask in
-          *[123567][0-7][0-7])
-            # POSIX mkdir -p sets u+wx bits regardless of umask, which
-            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-            ;;
-          *)
-            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # lower collision chance
-            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # that nobody tries to guess the $tmpdir name.
-            if (umask $mkdir_umask &&
-                $mkdirprog $mkdir_mode "$tmpdir" &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
-            then
-              if test -z "$dir_arg" || {
-                   # Check for POSIX incompatibilities with -m.
-                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-                   # other-writable bit of parent directory when it shouldn't.
-                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   test_tmpdir="$tmpdir/a"
-                   ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
-                   case $ls_ld_tmpdir in
-                     d????-?r-*) different_mode=700;;
-                     d????-?--*) different_mode=755;;
-                     *) false;;
-                   esac &&
-                   $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
-                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-                   }
-                 }
-              then posix_mkdir=:
-              fi
-              rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
-            else
-              # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
-            fi
-            trap '' 0;;
-        esac;;
+	# The $RANDOM variable is not portable (e.g., dash).  Use it
+	# here however when possible just to lower collision chance.
+	tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+
+	trap '
+	  ret=$?
+	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null
+	  exit $ret
+	' 0
+
+	# Because "mkdir -p" follows existing symlinks and we likely work
+	# directly in world-writeable /tmp, make sure that the '$tmpdir'
+	# directory is successfully created first before we actually test
+	# 'mkdir -p'.
+	if (umask $mkdir_umask &&
+	    $mkdirprog $mkdir_mode "$tmpdir" &&
+	    exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
+	then
+	  if test -z "$dir_arg" || {
+	       # Check for POSIX incompatibilities with -m.
+	       # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+	       # other-writable bit of parent directory when it shouldn't.
+	       # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+	       test_tmpdir="$tmpdir/a"
+	       ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
+	       case $ls_ld_tmpdir in
+		 d????-?r-*) different_mode=700;;
+		 d????-?--*) different_mode=755;;
+		 *) false;;
+	       esac &&
+	       $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
+		 ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
+		 test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+	       }
+	     }
+	  then posix_mkdir=:
+	  fi
+	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
+	else
+	  # Remove any dirs left behind by ancient mkdir implementations.
+	  rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
+	fi
+	trap '' 0;;
     esac
 
     if
@@ -372,7 +387,7 @@ do
     then :
     else
 
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
+      # mkdir does not conform to POSIX,
       # or it failed possibly due to a race condition.  Create the
       # directory the slow way, step by step, checking for races as we go.
 
@@ -401,7 +416,7 @@ do
           prefixes=
         else
           if $posix_mkdir; then
-            (umask=$mkdir_umask &&
+            (umask $mkdir_umask &&
              $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
             # Don't fail if two instances are running concurrently.
             test -d "$prefix" || exit 1
@@ -434,14 +449,25 @@ do
   else
 
     # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
+    dsttmp=${dstdirslash}_inst.$$_
+    rmtmp=${dstdirslash}_rm.$$_
 
     # Trap to clean up those temp files at exit.
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
 
     # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask &&
+     { test -z "$stripcmd" || {
+	 # Create $dsttmp read-write so that cp doesn't create it read-only,
+	 # which would cause strip to fail.
+	 if test -z "$doit"; then
+	   : >"$dsttmp" # No need to fork-exec 'touch'.
+	 else
+	   $doit touch "$dsttmp"
+	 fi
+       }
+     } &&
+     $doit_exec $cpprog "$src" "$dsttmp") &&
 
     # and set any options; do chmod last to preserve setuid bits.
     #
@@ -467,6 +493,13 @@ do
     then
       rm -f "$dsttmp"
     else
+      # If $backupsuffix is set, and the file being installed
+      # already exists, attempt a backup.  Don't worry if it fails,
+      # e.g., if mv doesn't support -f.
+      if test -n "$backupsuffix" && test -f "$dst"; then
+        $doit $mvcmd -f "$dst" "$dst$backupsuffix" 2>/dev/null
+      fi
+
       # Rename the file to the real destination.
       $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
 
@@ -481,9 +514,9 @@ do
         # file should still install successfully.
         {
           test ! -f "$dst" ||
-          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          $doit $rmcmd "$dst" 2>/dev/null ||
           { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+            { $doit $rmcmd "$rmtmp" 2>/dev/null; :; }
           } ||
           { echo "$0: cannot unlink or rename $dst" >&2
             (exit 1); exit 1
@@ -500,9 +533,9 @@ do
 done
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:
diff --git a/contrib/ldns/keys.c b/contrib/ldns/keys.c
index 31208cb3a43fc7..78bea9721c4c9d 100644
--- a/contrib/ldns/keys.c
+++ b/contrib/ldns/keys.c
@@ -15,9 +15,17 @@
 #include <ldns/ldns.h>
 
 #ifdef HAVE_SSL
+#include <openssl/ui.h>
 #include <openssl/ssl.h>
-#include <openssl/engine.h>
 #include <openssl/rand.h>
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#ifdef USE_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
 #endif /* HAVE_SSL */
 
 ldns_lookup_table ldns_signing_algorithms[] = {
@@ -76,7 +84,7 @@ ldns_key_new(void)
 	if (!newkey) {
 		return NULL;
 	} else {
-		/* some defaults - not sure wether to do this */
+		/* some defaults - not sure whether to do this */
 		ldns_key_set_use(newkey, true);
 		ldns_key_set_flags(newkey, LDNS_KEY_ZONE_KEY);
 		ldns_key_set_origttl(newkey, 0);
@@ -99,7 +107,7 @@ ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
 	return ldns_key_new_frm_fp_l(k, fp, NULL);
 }
 
-#ifdef HAVE_SSL
+#if defined(HAVE_SSL) && !defined(OPENSSL_NO_ENGINE)
 ldns_status
 ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
 {
@@ -300,34 +308,36 @@ ldns_key_new_frm_fp_ecdsa_l(FILE* fp, ldns_algorithm alg, int* line_nr)
 
 #ifdef USE_ED25519
 /** turn private key buffer into EC_KEY structure */
-static EC_KEY*
+static EVP_PKEY*
 ldns_ed25519_priv_raw(uint8_t* pkey, int plen)
 {
 	const unsigned char* pp;
 	uint8_t buf[256];
 	int buflen = 0;
-	uint8_t pre[] = {0x30, 0x32, 0x02, 0x01, 0x01, 0x04, 0x20};
-	int pre_len = 7;
-	uint8_t post[] = {0xa0, 0x0b, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04,
-		0x01, 0xda, 0x47, 0x0f, 0x01};
-	int post_len = 13;
-	int i;
-	/* ASN looks like this for ED25519
+	uint8_t pre[] = {0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,
+		0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20};
+	int pre_len = 16;
+	/* ASN looks like this for ED25519 public key
+	 * 302a300506032b6570032100 <32byteskey>
+	 * for ED25519 private key
+	 * 302e020100300506032b657004220420 <32bytes>
+	 *
+	 * for X25519 this was
 	 * 30320201010420 <32byteskey>
 	 * andparameters a00b06092b06010401da470f01
 	 * (noparameters, preamble is 30250201010420).
 	 * the key is reversed (little endian).
 	 */
-	buflen = pre_len + plen + post_len;
+	buflen = pre_len + plen;
 	if((size_t)buflen > sizeof(buf))
 		return NULL;
 	memmove(buf, pre, pre_len);
-	/* reverse the pkey into the buf */
-	for(i=0; i<plen; i++)
-		buf[pre_len+i] = pkey[plen-1-i];
-	memmove(buf+pre_len+plen, post, post_len);
+	memmove(buf+pre_len, pkey, plen);
+	/* reverse the pkey into the buf - key is not reversed it seems */
+	/* for(i=0; i<plen; i++)
+		buf[pre_len+i] = pkey[plen-1-i]; */
 	pp = buf;
-	return d2i_ECPrivateKey(NULL, &pp, buflen);
+	return d2i_PrivateKey(NID_ED25519, NULL, &pp, buflen);
 }
 
 /** read ED25519 private key */
@@ -337,7 +347,6 @@ ldns_key_new_frm_fp_ed25519_l(FILE* fp, int* line_nr)
 	char token[16384];
         ldns_rdf* b64rdf = NULL;
         EVP_PKEY* evp_key;
-        EC_KEY* ec;
 	if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n",
 		sizeof(token), line_nr) == -1)
 		return NULL;
@@ -348,67 +357,39 @@ ldns_key_new_frm_fp_ed25519_l(FILE* fp, int* line_nr)
 	 * from the private part, which others, EC_KEY_set_private_key,
 	 * and o2i methods, do not do */
 	/* for that the private key has to be encoded in ASN1 notation
-	 * with a X25519 prefix on it */
+	 * with a ED25519 prefix on it */
 
-	ec = ldns_ed25519_priv_raw(ldns_rdf_data(b64rdf),
+	evp_key = ldns_ed25519_priv_raw(ldns_rdf_data(b64rdf),
 		(int)ldns_rdf_size(b64rdf));
 	ldns_rdf_deep_free(b64rdf);
-	if(!ec) return NULL;
-	if(EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)) != NID_X25519) {
-		/* wrong group, bad asn conversion */
-                EC_KEY_free(ec);
-		return NULL;
-	}
-
-        evp_key = EVP_PKEY_new();
-        if(!evp_key) {
-                EC_KEY_free(ec);
-                return NULL;
-        }
-        if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
-		EVP_PKEY_free(evp_key);
-                EC_KEY_free(ec);
-                return NULL;
-	}
         return evp_key;
 }
 #endif
 
 #ifdef USE_ED448
 /** turn private key buffer into EC_KEY structure */
-static EC_KEY*
+static EVP_PKEY*
 ldns_ed448_priv_raw(uint8_t* pkey, int plen)
 {
 	const unsigned char* pp;
 	uint8_t buf[256];
 	int buflen = 0;
-	uint8_t pre[] = {0x30, 0x4b, 0x02, 0x01, 0x01, 0x04, 0x39};
-	int pre_len = 7;
-	uint8_t post[] = {0xa0, 0x0b, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04,
-		0x01, 0xda, 0x47, 0x0f, 0x02};
-	int post_len = 13;
-	int i;
-	/* ASN looks like this for ED25519
-	 * And for ED448, the parameters are ...02 instead of ...01
-	 * For ED25519 it was:
-	 * 30320201010420 <32byteskey>
-	 * andparameters a00b06092b06010401da470f01
-	 * (noparameters, preamble is 30250201010420).
+	uint8_t pre[] = {0x30, 0x47, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x71, 0x04, 0x3b, 0x04, 0x39};
+	int pre_len = 16;
+	/* ASN looks like this for ED448
+	 * 3047020100300506032b6571043b0439 <57bytekey>
 	 * the key is reversed (little endian).
-	 *
-	 * For ED448 the key is 57 bytes, and that changes lengths.
-	 * 304b0201010439 <57bytekey> a00b06092b06010401da470f02
 	 */
-	buflen = pre_len + plen + post_len;
+	buflen = pre_len + plen;
 	if((size_t)buflen > sizeof(buf))
 		return NULL;
 	memmove(buf, pre, pre_len);
-	/* reverse the pkey into the buf */
-	for(i=0; i<plen; i++)
-		buf[pre_len+i] = pkey[plen-1-i];
-	memmove(buf+pre_len+plen, post, post_len);
+	memmove(buf+pre_len, pkey, plen);
+	/* reverse the pkey into the buf - key is not reversed it seems */
+	/* for(i=0; i<plen; i++)
+		buf[pre_len+i] = pkey[plen-1-i]; */
 	pp = buf;
-	return d2i_ECPrivateKey(NULL, &pp, buflen);
+	return d2i_PrivateKey(NID_ED448, NULL, &pp, buflen);
 }
 
 /** read ED448 private key */
@@ -418,7 +399,6 @@ ldns_key_new_frm_fp_ed448_l(FILE* fp, int* line_nr)
 	char token[16384];
         ldns_rdf* b64rdf = NULL;
         EVP_PKEY* evp_key;
-        EC_KEY* ec;
 	if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n", 
 		sizeof(token), line_nr) == -1)
 		return NULL;
@@ -426,26 +406,9 @@ ldns_key_new_frm_fp_ed448_l(FILE* fp, int* line_nr)
 		return NULL;
 
 	/* convert private key into ASN notation and then convert that */
-	ec = ldns_ed448_priv_raw(ldns_rdf_data(b64rdf),
+	evp_key = ldns_ed448_priv_raw(ldns_rdf_data(b64rdf),
 		(int)ldns_rdf_size(b64rdf));
 	ldns_rdf_deep_free(b64rdf);
-	if(!ec) return NULL;
-	if(EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)) != NID_X448) {
-		/* wrong group, bad asn conversion */
-                EC_KEY_free(ec);
-		return NULL;
-	}
-
-        evp_key = EVP_PKEY_new();
-        if(!evp_key) {
-                EC_KEY_free(ec);
-                return NULL;
-        }
-        if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
-		EVP_PKEY_free(evp_key);
-                EC_KEY_free(ec);
-                return NULL;
-	}
 	return evp_key;
 }
 #endif
@@ -813,7 +776,7 @@ ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
 	}
 
 	/* I could use functions again, but that seems an overkill,
-	 * allthough this also looks tedious
+	 * although this also looks tedious
 	 */
 
 	/* Modules, rsa->n */
@@ -898,7 +861,7 @@ ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
 	}
 #endif /* splint */
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 # ifndef S_SPLINT_S
 	rsa->n = n;
 	rsa->e = e;
@@ -942,6 +905,7 @@ ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
 	return NULL;
 }
 
+#ifdef USE_DSA
 DSA *
 ldns_key_new_frm_fp_dsa(FILE *f)
 {
@@ -1018,7 +982,7 @@ ldns_key_new_frm_fp_dsa_l(FILE *f, ATTR_UNUSED(int *line_nr))
 	}
 #endif /* splint */
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 # ifndef S_SPLINT_S
 	dsa->p = p;
 	dsa->q = q;
@@ -1052,6 +1016,7 @@ ldns_key_new_frm_fp_dsa_l(FILE *f, ATTR_UNUSED(int *line_nr))
 	BN_free(pub_key);
 	return NULL;
 }
+#endif /* USE_DSA */
 
 unsigned char *
 ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
@@ -1065,24 +1030,18 @@ ldns_key_new_frm_fp_hmac_l( FILE *f
 			  , size_t *hmac_size
 			  )
 {
-	size_t i, bufsz;
+	size_t bufsz;
 	char d[LDNS_MAX_LINELEN];
 	unsigned char *buf = NULL;
 
-	if (ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
-		goto error;
-	}
-	bufsz = ldns_b64_ntop_calculate_size(strlen(d));
-	buf = LDNS_XMALLOC(unsigned char, bufsz);
-	i = (size_t) ldns_b64_pton((const char*)d, buf, bufsz);
-
-	*hmac_size = i;
+	*hmac_size = ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n",
+	                                      LDNS_MAX_LINELEN, line_nr) == -1
+	           ? 0
+		   : (buf = LDNS_XMALLOC( unsigned char, (bufsz =
+	                    ldns_b64_ntop_calculate_size(strlen(d))))) == NULL
+		   ? 0
+	           : (size_t) ldns_b64_pton((const char*)d, buf, bufsz);
 	return buf;
-
-	error:
-	LDNS_FREE(buf);
-	*hmac_size = 0;
-	return NULL;
 }
 #endif /* HAVE_SSL */
 
@@ -1192,9 +1151,9 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
 #endif /* HAVE_EVP_PKEY_KEYGEN */
 #endif /* HAVE_SSL */
 			break;
+#ifdef USE_DSA
 		case LDNS_SIGN_DSA:
 		case LDNS_SIGN_DSA_NSEC3:
-#ifdef USE_DSA
 #ifdef HAVE_SSL
 # if OPENSSL_VERSION_NUMBER < 0x00908000L
 			d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL);
@@ -1314,7 +1273,7 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
 #ifdef USE_ED25519
 		case LDNS_SIGN_ED25519:
 #ifdef HAVE_EVP_PKEY_KEYGEN
-			ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
+			ctx = EVP_PKEY_CTX_new_id(NID_ED25519, NULL);
 			if(!ctx) {
 				ldns_key_free(k);
 				return NULL;
@@ -1324,12 +1283,6 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
 				EVP_PKEY_CTX_free(ctx);
 				return NULL;
 			}
-			if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx,
-				NID_X25519) <= 0) {
-				ldns_key_free(k);
-				EVP_PKEY_CTX_free(ctx);
-				return NULL;
-			}
 			if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
 				ldns_key_free(k);
 				EVP_PKEY_CTX_free(ctx);
@@ -1342,7 +1295,7 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
 #ifdef USE_ED448
 		case LDNS_SIGN_ED448:
 #ifdef HAVE_EVP_PKEY_KEYGEN
-			ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
+			ctx = EVP_PKEY_CTX_new_id(NID_ED448, NULL);
 			if(!ctx) {
 				ldns_key_free(k);
 				return NULL;
@@ -1352,12 +1305,6 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
 				EVP_PKEY_CTX_free(ctx);
 				return NULL;
 			}
-			if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx,
-				NID_X448) <= 0) {
-				ldns_key_free(k);
-				EVP_PKEY_CTX_free(ctx);
-				return NULL;
-			}
 			if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
 				ldns_key_free(k);
 				EVP_PKEY_CTX_free(ctx);
@@ -1499,7 +1446,7 @@ ldns_key_set_keytag(ldns_key *k, uint16_t tag)
 size_t
 ldns_key_list_key_count(const ldns_key_list *key_list)
 {
-	        return key_list->_key_count;
+	return key_list ? key_list->_key_count : 0;
 }       
 
 ldns_key *
@@ -1713,7 +1660,7 @@ ldns_key_rsa2bin(unsigned char *data, RSA *k, uint16_t *size)
 	if (!k) {
 		return false;
 	}
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 	n = k->n;
 	e = k->e;
 #else
@@ -1809,6 +1756,46 @@ ldns_key_gost2bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
 	return true;
 }
 #endif /* USE_GOST */
+
+#ifdef USE_ED25519
+static bool
+ldns_key_ed255192bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
+{
+	int i;
+	unsigned char* pp = NULL;
+	if(i2d_PUBKEY(k, &pp) != 12 + 32) {
+		/* expect 12 byte(ASN header) and 32 byte(pubkey) */
+		free(pp);
+		return false;
+	}
+	/* omit ASN header */
+	for(i=0; i<32; i++)
+		data[i] = pp[i+12];
+	free(pp);
+	*size = 32;
+	return true;
+}
+#endif /* USE_ED25519 */
+
+#ifdef USE_ED448
+static bool
+ldns_key_ed4482bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
+{
+	int i;
+	unsigned char* pp = NULL;
+	if(i2d_PUBKEY(k, &pp) != 12 + 57) {
+		/* expect 12 byte(ASN header) and 57 byte(pubkey) */
+		free(pp);
+		return false;
+	}
+	/* omit ASN header */
+	for(i=0; i<57; i++)
+		data[i] = pp[i+12];
+	free(pp);
+	*size = 57;
+	return true;
+}
+#endif /* USE_ED448 */
 #endif /* splint */
 #endif /* HAVE_SSL */
 
@@ -1893,10 +1880,10 @@ ldns_key2rr(const ldns_key *k)
 #endif
 			size++;
 			break;
+#ifdef USE_DSA
 		case LDNS_SIGN_DSA:
 			ldns_rr_push_rdf(pubkey,
 					ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA));
-#ifdef USE_DSA
 #ifdef HAVE_SSL
 			dsa = ldns_key_dsa_key(k);
 			if (dsa) {
@@ -1916,10 +1903,10 @@ ldns_key2rr(const ldns_key *k)
 #endif /* HAVE_SSL */
 #endif /* USE_DSA */
 			break;
+#ifdef USE_DSA
 		case LDNS_SIGN_DSA_NSEC3:
 			ldns_rr_push_rdf(pubkey,
 					ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3));
-#ifdef USE_DSA
 #ifdef HAVE_SSL
 			dsa = ldns_key_dsa_key(k);
 			if (dsa) {
@@ -1999,18 +1986,16 @@ ldns_key2rr(const ldns_key *k)
                 case LDNS_SIGN_ED25519:
 			ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
 				LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
-                        bin = NULL;
-                        ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
-                        EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
-                        size = (uint16_t)i2o_ECPublicKey(ec, NULL);
-                        if(!i2o_ECPublicKey(ec, &bin)) {
-                                EC_KEY_free(ec);
+			bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
+			if (!bin) {
                                 ldns_rr_free(pubkey);
-                                return NULL;
+				return NULL;
                         }
-                        /* down the reference count for ec, its still assigned
-                         * to the pkey */
-                        EC_KEY_free(ec);
+			if (!ldns_key_ed255192bin(bin, k->_key.key, &size)) {
+		                LDNS_FREE(bin);
+                                ldns_rr_free(pubkey);
+				return NULL;
+			}
 			internal_data = 1;
 			break;
 #endif
@@ -2018,18 +2003,16 @@ ldns_key2rr(const ldns_key *k)
                 case LDNS_SIGN_ED448:
 			ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
 				LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
-                        bin = NULL;
-                        ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
-                        EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
-                        size = (uint16_t)i2o_ECPublicKey(ec, NULL);
-                        if(!i2o_ECPublicKey(ec, &bin)) {
-                                EC_KEY_free(ec);
+			bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
+			if (!bin) {
                                 ldns_rr_free(pubkey);
-                                return NULL;
+				return NULL;
                         }
-                        /* down the reference count for ec, its still assigned
-                         * to the pkey */
-                        EC_KEY_free(ec);
+			if (!ldns_key_ed4482bin(bin, k->_key.key, &size)) {
+		                LDNS_FREE(bin);
+                                ldns_rr_free(pubkey);
+				return NULL;
+			}
 			internal_data = 1;
 			break;
 #endif
@@ -2184,7 +2167,9 @@ ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char* name)
         ldns_lookup_table aliases[] = {
                 /* from bind dnssec-keygen */
                 {LDNS_SIGN_HMACMD5, "HMAC-MD5"},
+#ifdef USE_DSA
                 {LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"},
+#endif /* USE_DSA */
                 {LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"},
                 /* old ldns usage, now RFC names */
 #ifdef USE_DSA
diff --git a/contrib/ldns/ldns/buffer.h b/contrib/ldns/ldns/buffer.h
index f49a550bbd15a5..79ae0f5cc15e2d 100644
--- a/contrib/ldns/ldns/buffer.h
+++ b/contrib/ldns/ldns/buffer.h
@@ -399,6 +399,22 @@ ldns_buffer_write_string(ldns_buffer *buffer, const char *str)
 	ldns_buffer_write(buffer, str, strlen(str));
 }
 
+/**
+ * copies the given (null-delimited) string to the current position at the buffer
+ * increasing the capacity if necessary
+ * \param[in] buffer the buffer
+ * \param[in] str the string to write
+ */
+INLINE void
+ldns_buffer_write_chars(ldns_buffer *buffer, const char *str)
+{
+	if (!ldns_buffer_reserve(buffer, strlen(str)))
+		buffer->_status = LDNS_STATUS_MEM_ERR;
+	else
+		ldns_buffer_write_string(buffer, str);
+}
+
+
 /**
  * writes the given byte of data at the given position in the buffer
  * \param[in] buffer the buffer
@@ -424,6 +440,21 @@ ldns_buffer_write_u8(ldns_buffer *buffer, uint8_t data)
 	buffer->_position += sizeof(data);
 }
 
+/**
+ * writes the given byte of data at the current position in the buffer
+ * increasing the capacity if necessary
+ * \param[in] buffer the buffer
+ * \param[in] data the 8 bits to write
+ */
+INLINE void
+ldns_buffer_write_char(ldns_buffer *buffer, uint8_t data)
+{
+	if (!ldns_buffer_reserve(buffer, sizeof(data)))
+		buffer->_status = LDNS_STATUS_MEM_ERR;
+	else
+		ldns_buffer_write_u8(buffer, data);
+}
+
 /**
  * writes the given 2 byte integer at the given position in the buffer
  * \param[in] buffer the buffer
diff --git a/contrib/ldns/ldns/common.h b/contrib/ldns/ldns/common.h
index 9abd9b9396e0cf..27f858dd9eb3c4 100644
--- a/contrib/ldns/ldns/common.h
+++ b/contrib/ldns/ldns/common.h
@@ -27,6 +27,9 @@
 #define LDNS_BUILD_CONFIG_USE_DANE         1
 #define LDNS_BUILD_CONFIG_HAVE_B32_PTON    0
 #define LDNS_BUILD_CONFIG_HAVE_B32_NTOP    0
+#define LDNS_BUILD_CONFIG_USE_DSA          1
+#define LDNS_BUILD_CONFIG_USE_ED25519      1
+#define LDNS_BUILD_CONFIG_USE_ED448        1
 
 /*
  * HAVE_STDBOOL_H is not available when distributed as a library, but no build 
diff --git a/contrib/ldns/ldns/common.h.in b/contrib/ldns/ldns/common.h.in
index 805eb8bf42c7a1..db559608b06c93 100644
--- a/contrib/ldns/ldns/common.h.in
+++ b/contrib/ldns/ldns/common.h.in
@@ -27,6 +27,9 @@
 #define LDNS_BUILD_CONFIG_USE_DANE         @ldns_build_config_use_dane@
 #define LDNS_BUILD_CONFIG_HAVE_B32_PTON    @ldns_build_config_have_b32_pton@
 #define LDNS_BUILD_CONFIG_HAVE_B32_NTOP    @ldns_build_config_have_b32_ntop@
+#define LDNS_BUILD_CONFIG_USE_DSA          @ldns_build_config_use_dsa@
+#define LDNS_BUILD_CONFIG_USE_ED25519      @ldns_build_config_use_ed25519@
+#define LDNS_BUILD_CONFIG_USE_ED448        @ldns_build_config_use_ed448@
 
 /*
  * HAVE_STDBOOL_H is not available when distributed as a library, but no build 
diff --git a/contrib/ldns/ldns/config.h b/contrib/ldns/ldns/config.h
index 4fdcf01607d263..3ac94403296f2c 100644
--- a/contrib/ldns/ldns/config.h
+++ b/contrib/ldns/ldns/config.h
@@ -31,6 +31,15 @@
 /* Define to 1 if you have the `calloc' function. */
 #define HAVE_CALLOC 1
 
+/* Define to 1 if you have the `CONF_modules_unload' function. */
+#define HAVE_CONF_MODULES_UNLOAD 1
+
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
+/* #undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA */
+
+/* Define to 1 if you have the `CRYPTO_memcmp' function. */
+#define HAVE_CRYPTO_MEMCMP 1
+
 /* Define to 1 if you have the `ctime_r' function. */
 #define HAVE_CTIME_R 1
 
@@ -40,17 +49,21 @@
 /* Is a CAPATH given at configure time */
 #define HAVE_DANE_CA_PATH 0
 
-/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
+/* Define to 1 if you have the declaration of `EVP_PKEY_base_id', and to 0 if
+   you don't. */
+#define HAVE_DECL_EVP_PKEY_BASE_ID 1
+
+/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
    don't. */
-#define HAVE_DECL_NID_SECP384R1 1
+#define HAVE_DECL_NID_ED25519 1
 
-/* Define to 1 if you have the declaration of `NID_X25519', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
    don't. */
-/* #undef HAVE_DECL_NID_X25519 */
+#define HAVE_DECL_NID_ED448 1
 
-/* Define to 1 if you have the declaration of `NID_X448', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
-/* #undef HAVE_DECL_NID_X448 */
+#define HAVE_DECL_NID_SECP384R1 1
 
 /* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
    if you don't. */
@@ -80,8 +93,20 @@
 /* Define to 1 if you have the `endservent' function. */
 #define HAVE_ENDSERVENT 1
 
-/* Define to 1 if you have the `ENGINE_load_cryptodev' function. */
-#define HAVE_ENGINE_LOAD_CRYPTODEV 1
+/* Define to 1 if you have the `ENGINE_cleanup' function. */
+/* #undef HAVE_ENGINE_CLEANUP */
+
+/* Define to 1 if you have the `ENGINE_free' function. */
+#define HAVE_ENGINE_FREE 1
+
+/* Define to 1 if you have the `ERR_free_strings' function. */
+/* #undef HAVE_ERR_FREE_STRINGS */
+
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
+/* #undef HAVE_ERR_LOAD_CRYPTO_STRINGS */
+
+/* Define to 1 if you have the `EVP_cleanup' function. */
+/* #undef HAVE_EVP_CLEANUP */
 
 /* Define to 1 if you have the `EVP_dss1' function. */
 /* #undef HAVE_EVP_DSS1 */
@@ -89,9 +114,12 @@
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #define HAVE_EVP_MD_CTX_NEW 1
 
-/* Define to 1 if you have the `EVP_PKEY_base_id' function. */
+/* Define to 1 if you have the EVP_PKEY_base_id function or macro. */
 #define HAVE_EVP_PKEY_BASE_ID 1
 
+/* Define to 1 if you have the `EVP_PKEY_get_base_id' function. */
+/* #undef HAVE_EVP_PKEY_GET_BASE_ID */
+
 /* Define to 1 if you have the `EVP_PKEY_keygen' function. */
 #define HAVE_EVP_PKEY_KEYGEN 1
 
@@ -110,6 +138,9 @@
 /* Define to 1 if you have the `fork' function. */
 #define HAVE_FORK 1
 
+/* if fork is available for compile */
+#define HAVE_FORK_AVAILABLE 1
+
 /* Whether getaddrinfo is available */
 #define HAVE_GETADDRINFO 1
 
@@ -119,9 +150,6 @@
 /* Define to 1 if you have the `gmtime_r' function. */
 #define HAVE_GMTIME_R 1
 
-/* If you have HMAC_Update */
-#define HAVE_HMAC_UPDATE 1
-
 /* Define to 1 if you have the `inet_aton' function. */
 #define HAVE_INET_ATON 1
 
@@ -152,19 +180,15 @@
 /* Define to 1 if you have the `localtime_r' function. */
 #define HAVE_LOCALTIME_R 1
 
-/* Define to 1 if your system has a GNU libc compatible `malloc' function, and
-   to 0 otherwise. */
-#define HAVE_MALLOC 1
-
 /* Define to 1 if you have the `memmove' function. */
 #define HAVE_MEMMOVE 1
 
-/* Define to 1 if you have the <memory.h> header file. */
-#define HAVE_MEMORY_H 1
-
 /* Define to 1 if you have the `memset' function. */
 #define HAVE_MEMSET 1
 
+/* Define to 1 if you have the <minix/config.h> header file. */
+/* #undef HAVE_MINIX_CONFIG_H */
+
 /* Define to 1 if you have the <netdb.h> header file. */
 #define HAVE_NETDB_H 1
 
@@ -198,9 +222,24 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 /* #undef HAVE_NET_IF_H */
 
+/* Define to 1 if you have the <openssl/conf.h> header file. */
+#define HAVE_OPENSSL_CONF_H 1
+
+/* Define to 1 if you have the <openssl/engine.h> header file. */
+#define HAVE_OPENSSL_ENGINE_H 1
+
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #define HAVE_OPENSSL_ERR_H 1
 
+/* Define to 1 if you have the <openssl/evp.h> header file. */
+#define HAVE_OPENSSL_EVP_H 1
+
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#define HAVE_OPENSSL_INIT_CRYPTO 1
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+/* #undef HAVE_OPENSSL_INIT_SSL */
+
 /* Define to 1 if you have the <openssl/rand.h> header file. */
 #define HAVE_OPENSSL_RAND_H 1
 
@@ -219,10 +258,6 @@
 /* Define to 1 if you have the `random' function. */
 #define HAVE_RANDOM 1
 
-/* Define to 1 if your system has a GNU libc compatible `realloc' function,
-   and to 0 otherwise. */
-#define HAVE_REALLOC 1
-
 /* Define to 1 if you have the `sleep' function. */
 #define HAVE_SLEEP 1
 
@@ -241,6 +276,9 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #define HAVE_STDINT_H 1
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#define HAVE_STDIO_H 1
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1
 
@@ -274,6 +312,9 @@
 /* define if you have sys/types.h */
 #define HAVE_SYS_TYPES_H 1
 
+/* Define to 1 if you have the <TargetConditionals.h> header file. */
+/* #undef HAVE_TARGETCONDITIONALS_H */
+
 /* Define to 1 if you have the `timegm' function. */
 #define HAVE_TIMEGM 1
 
@@ -289,6 +330,9 @@
 /* Define to 1 if you have the <vfork.h> header file. */
 /* #undef HAVE_VFORK_H */
 
+/* Define to 1 if you have the <wchar.h> header file. */
+#define HAVE_WCHAR_H 1
+
 /* Define to 1 if you have the <winsock2.h> header file. */
 /* #undef HAVE_WINSOCK2_H */
 
@@ -320,7 +364,7 @@
 #define PACKAGE_NAME "ldns"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "ldns 1.7.0"
+#define PACKAGE_STRING "ldns 1.8.3"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libdns"
@@ -329,11 +373,17 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.7.0"
+#define PACKAGE_VERSION "1.8.3"
+
+/* Define this to enable RR type AMTRELAY. */
+/* #undef RRTYPE_AMTRELAY */
 
 /* Define this to enable RR type AVC. */
 /* #undef RRTYPE_AVC */
 
+/* Define this to enable RR type DOA. */
+/* #undef RRTYPE_DOA */
+
 /* Define this to enable RR type NINFO. */
 /* #undef RRTYPE_NINFO */
 
@@ -343,13 +393,18 @@
 /* Define this to enable RR type RKEY. */
 /* #undef RRTYPE_RKEY */
 
+/* Define this to enable RR types SVCB and HTTPS. */
+#define RRTYPE_SVCB_HTTPS /**/
+
 /* Define this to enable RR type TA. */
 /* #undef RRTYPE_TA */
 
 /* The size of `time_t', as computed by sizeof. */
 #define SIZEOF_TIME_T 8
 
-/* Define to 1 if you have the ANSI C header files. */
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
+   required in a freestanding environment). This macro is provided for
+   backward compatibility; new code need not use it. */
 #define STDC_HEADERS 1
 
 /* Define this to enable messages to stderr. */
@@ -374,10 +429,10 @@
 #define USE_ECDSA 1
 
 /* Define this to enable ED25519 support. */
-/* #undef USE_ED25519 */
+#define USE_ED25519 1
 
 /* Define this to enable ED448 support. */
-/* #undef USE_ED448 */
+#define USE_ED448 1
 
 /* Define this to enable GOST support. */
 /* #undef USE_GOST */
@@ -389,21 +444,87 @@
 #ifndef _ALL_SOURCE
 # define _ALL_SOURCE 1
 #endif
+/* Enable general extensions on macOS.  */
+#ifndef _DARWIN_C_SOURCE
+# define _DARWIN_C_SOURCE 1
+#endif
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# define __EXTENSIONS__ 1
+#endif
 /* Enable GNU extensions on systems that have them.  */
 #ifndef _GNU_SOURCE
 # define _GNU_SOURCE 1
 #endif
-/* Enable threading extensions on Solaris.  */
+/* Enable X/Open compliant socket functions that do not require linking
+   with -lxnet on HP-UX 11.11.  */
+#ifndef _HPUX_ALT_XOPEN_SOCKET_API
+# define _HPUX_ALT_XOPEN_SOCKET_API 1
+#endif
+/* Identify the host operating system as Minix.
+   This macro does not affect the system headers' behavior.
+   A future release of Autoconf may stop defining this macro.  */
+#ifndef _MINIX
+/* # undef _MINIX */
+#endif
+/* Enable general extensions on NetBSD.
+   Enable NetBSD compatibility extensions on Minix.  */
+#ifndef _NETBSD_SOURCE
+# define _NETBSD_SOURCE 1
+#endif
+/* Enable OpenBSD compatibility extensions on NetBSD.
+   Oddly enough, this does nothing on OpenBSD.  */
+#ifndef _OPENBSD_SOURCE
+# define _OPENBSD_SOURCE 1
+#endif
+/* Define to 1 if needed for POSIX-compatible behavior.  */
+#ifndef _POSIX_SOURCE
+/* # undef _POSIX_SOURCE */
+#endif
+/* Define to 2 if needed for POSIX-compatible behavior.  */
+#ifndef _POSIX_1_SOURCE
+/* # undef _POSIX_1_SOURCE */
+#endif
+/* Enable POSIX-compatible threading on Solaris.  */
 #ifndef _POSIX_PTHREAD_SEMANTICS
 # define _POSIX_PTHREAD_SEMANTICS 1
 #endif
+/* Enable extensions specified by ISO/IEC TS 18661-5:2014.  */
+#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
+# define __STDC_WANT_IEC_60559_ATTRIBS_EXT__ 1
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-1:2014.  */
+#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
+# define __STDC_WANT_IEC_60559_BFP_EXT__ 1
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-2:2015.  */
+#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
+# define __STDC_WANT_IEC_60559_DFP_EXT__ 1
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
+#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
+# define __STDC_WANT_IEC_60559_FUNCS_EXT__ 1
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
+#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
+# define __STDC_WANT_IEC_60559_TYPES_EXT__ 1
+#endif
+/* Enable extensions specified by ISO/IEC TR 24731-2:2010.  */
+#ifndef __STDC_WANT_LIB_EXT2__
+# define __STDC_WANT_LIB_EXT2__ 1
+#endif
+/* Enable extensions specified by ISO/IEC 24747:2009.  */
+#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
+# define __STDC_WANT_MATH_SPEC_FUNCS__ 1
+#endif
 /* Enable extensions on HP NonStop.  */
 #ifndef _TANDEM_SOURCE
 # define _TANDEM_SOURCE 1
 #endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# define __EXTENSIONS__ 1
+/* Enable X/Open extensions.  Define to 500 only if necessary
+   to make mbstate_t available.  */
+#ifndef _XOPEN_SOURCE
+/* # undef _XOPEN_SOURCE */
 #endif
 
 
@@ -425,18 +546,8 @@
 # endif
 #endif
 
-/* Define to 1 if on MINIX. */
-/* #undef _MINIX */
-
 /* Enable for compile on Minix */
-/* #undef _NETBSD_SOURCE */
-
-/* Define to 2 if the system does not provide POSIX.1 features except with
-   this defined. */
-/* #undef _POSIX_1_SOURCE */
-
-/* Define to 1 if you need to in order for `stat' and other things to work. */
-/* #undef _POSIX_SOURCE */
+#define _NETBSD_SOURCE 1
 
 /* Define to empty if `const' does not conform to ANSI C. */
 /* #undef const */
@@ -468,15 +579,9 @@
 /* Define to `size_t' if <sys/types.h> does not define. */
 /* #undef intptr_t */
 
-/* Define to rpl_malloc if the replacement function should be used. */
-/* #undef malloc */
-
-/* Define to `int' if <sys/types.h> does not define. */
+/* Define as a signed integer type capable of holding a process identifier. */
 /* #undef pid_t */
 
-/* Define to rpl_realloc if the replacement function should be used. */
-/* #undef realloc */
-
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 /* #undef size_t */
 
@@ -645,10 +750,10 @@ size_t strlcpy(char *dst, const char *src, size_t siz);
 
 #ifdef USE_WINSOCK
 #define SOCK_INVALID INVALID_SOCKET
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {closesocket(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {closesocket(_s); _s = -1;} } while(0)
 #else
 #define SOCK_INVALID -1
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {close(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s); _s = -1;} } while(0)
 #endif
 
 #ifdef __cplusplus
diff --git a/contrib/ldns/ldns/config.h.in b/contrib/ldns/ldns/config.h.in
index dcf5488ee751a6..a459fe53e50149 100644
--- a/contrib/ldns/ldns/config.h.in
+++ b/contrib/ldns/ldns/config.h.in
@@ -30,6 +30,15 @@
 /* Define to 1 if you have the `calloc' function. */
 #undef HAVE_CALLOC
 
+/* Define to 1 if you have the `CONF_modules_unload' function. */
+#undef HAVE_CONF_MODULES_UNLOAD
+
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
+#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
+
+/* Define to 1 if you have the `CRYPTO_memcmp' function. */
+#undef HAVE_CRYPTO_MEMCMP
+
 /* Define to 1 if you have the `ctime_r' function. */
 #undef HAVE_CTIME_R
 
@@ -39,17 +48,21 @@
 /* Is a CAPATH given at configure time */
 #undef HAVE_DANE_CA_PATH
 
-/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
+/* Define to 1 if you have the declaration of `EVP_PKEY_base_id', and to 0 if
+   you don't. */
+#undef HAVE_DECL_EVP_PKEY_BASE_ID
+
+/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
    don't. */
-#undef HAVE_DECL_NID_SECP384R1
+#undef HAVE_DECL_NID_ED25519
 
-/* Define to 1 if you have the declaration of `NID_X25519', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
    don't. */
-#undef HAVE_DECL_NID_X25519
+#undef HAVE_DECL_NID_ED448
 
-/* Define to 1 if you have the declaration of `NID_X448', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
-#undef HAVE_DECL_NID_X448
+#undef HAVE_DECL_NID_SECP384R1
 
 /* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
    if you don't. */
@@ -79,8 +92,20 @@
 /* Define to 1 if you have the `endservent' function. */
 #undef HAVE_ENDSERVENT
 
-/* Define to 1 if you have the `ENGINE_load_cryptodev' function. */
-#undef HAVE_ENGINE_LOAD_CRYPTODEV
+/* Define to 1 if you have the `ENGINE_cleanup' function. */
+#undef HAVE_ENGINE_CLEANUP
+
+/* Define to 1 if you have the `ENGINE_free' function. */
+#undef HAVE_ENGINE_FREE
+
+/* Define to 1 if you have the `ERR_free_strings' function. */
+#undef HAVE_ERR_FREE_STRINGS
+
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
+#undef HAVE_ERR_LOAD_CRYPTO_STRINGS
+
+/* Define to 1 if you have the `EVP_cleanup' function. */
+#undef HAVE_EVP_CLEANUP
 
 /* Define to 1 if you have the `EVP_dss1' function. */
 #undef HAVE_EVP_DSS1
@@ -88,9 +113,12 @@
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #undef HAVE_EVP_MD_CTX_NEW
 
-/* Define to 1 if you have the `EVP_PKEY_base_id' function. */
+/* Define to 1 if you have the EVP_PKEY_base_id function or macro. */
 #undef HAVE_EVP_PKEY_BASE_ID
 
+/* Define to 1 if you have the `EVP_PKEY_get_base_id' function. */
+#undef HAVE_EVP_PKEY_GET_BASE_ID
+
 /* Define to 1 if you have the `EVP_PKEY_keygen' function. */
 #undef HAVE_EVP_PKEY_KEYGEN
 
@@ -109,6 +137,9 @@
 /* Define to 1 if you have the `fork' function. */
 #undef HAVE_FORK
 
+/* if fork is available for compile */
+#undef HAVE_FORK_AVAILABLE
+
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
@@ -118,9 +149,6 @@
 /* Define to 1 if you have the `gmtime_r' function. */
 #undef HAVE_GMTIME_R
 
-/* If you have HMAC_Update */
-#undef HAVE_HMAC_UPDATE
-
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
@@ -151,19 +179,15 @@
 /* Define to 1 if you have the `localtime_r' function. */
 #undef HAVE_LOCALTIME_R
 
-/* Define to 1 if your system has a GNU libc compatible `malloc' function, and
-   to 0 otherwise. */
-#undef HAVE_MALLOC
-
 /* Define to 1 if you have the `memmove' function. */
 #undef HAVE_MEMMOVE
 
-/* Define to 1 if you have the <memory.h> header file. */
-#undef HAVE_MEMORY_H
-
 /* Define to 1 if you have the `memset' function. */
 #undef HAVE_MEMSET
 
+/* Define to 1 if you have the <minix/config.h> header file. */
+#undef HAVE_MINIX_CONFIG_H
+
 /* Define to 1 if you have the <netdb.h> header file. */
 #undef HAVE_NETDB_H
 
@@ -197,9 +221,24 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #undef HAVE_NET_IF_H
 
+/* Define to 1 if you have the <openssl/conf.h> header file. */
+#undef HAVE_OPENSSL_CONF_H
+
+/* Define to 1 if you have the <openssl/engine.h> header file. */
+#undef HAVE_OPENSSL_ENGINE_H
+
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
+/* Define to 1 if you have the <openssl/evp.h> header file. */
+#undef HAVE_OPENSSL_EVP_H
+
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#undef HAVE_OPENSSL_INIT_CRYPTO
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+#undef HAVE_OPENSSL_INIT_SSL
+
 /* Define to 1 if you have the <openssl/rand.h> header file. */
 #undef HAVE_OPENSSL_RAND_H
 
@@ -218,10 +257,6 @@
 /* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
-/* Define to 1 if your system has a GNU libc compatible `realloc' function,
-   and to 0 otherwise. */
-#undef HAVE_REALLOC
-
 /* Define to 1 if you have the `sleep' function. */
 #undef HAVE_SLEEP
 
@@ -240,6 +275,9 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#undef HAVE_STDIO_H
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
@@ -273,6 +311,9 @@
 /* define if you have sys/types.h */
 #undef HAVE_SYS_TYPES_H
 
+/* Define to 1 if you have the <TargetConditionals.h> header file. */
+#undef HAVE_TARGETCONDITIONALS_H
+
 /* Define to 1 if you have the `timegm' function. */
 #undef HAVE_TIMEGM
 
@@ -288,6 +329,9 @@
 /* Define to 1 if you have the <vfork.h> header file. */
 #undef HAVE_VFORK_H
 
+/* Define to 1 if you have the <wchar.h> header file. */
+#undef HAVE_WCHAR_H
+
 /* Define to 1 if you have the <winsock2.h> header file. */
 #undef HAVE_WINSOCK2_H
 
@@ -330,9 +374,15 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
+/* Define this to enable RR type AMTRELAY. */
+#undef RRTYPE_AMTRELAY
+
 /* Define this to enable RR type AVC. */
 #undef RRTYPE_AVC
 
+/* Define this to enable RR type DOA. */
+#undef RRTYPE_DOA
+
 /* Define this to enable RR type NINFO. */
 #undef RRTYPE_NINFO
 
@@ -342,13 +392,18 @@
 /* Define this to enable RR type RKEY. */
 #undef RRTYPE_RKEY
 
+/* Define this to enable RR types SVCB and HTTPS. */
+#undef RRTYPE_SVCB_HTTPS
+
 /* Define this to enable RR type TA. */
 #undef RRTYPE_TA
 
 /* The size of `time_t', as computed by sizeof. */
 #undef SIZEOF_TIME_T
 
-/* Define to 1 if you have the ANSI C header files. */
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
+   required in a freestanding environment). This macro is provided for
+   backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
 
 /* Define this to enable messages to stderr. */
@@ -388,21 +443,87 @@
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
+/* Enable general extensions on macOS.  */
+#ifndef _DARWIN_C_SOURCE
+# undef _DARWIN_C_SOURCE
+#endif
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# undef __EXTENSIONS__
+#endif
 /* Enable GNU extensions on systems that have them.  */
 #ifndef _GNU_SOURCE
 # undef _GNU_SOURCE
 #endif
-/* Enable threading extensions on Solaris.  */
+/* Enable X/Open compliant socket functions that do not require linking
+   with -lxnet on HP-UX 11.11.  */
+#ifndef _HPUX_ALT_XOPEN_SOCKET_API
+# undef _HPUX_ALT_XOPEN_SOCKET_API
+#endif
+/* Identify the host operating system as Minix.
+   This macro does not affect the system headers' behavior.
+   A future release of Autoconf may stop defining this macro.  */
+#ifndef _MINIX
+# undef _MINIX
+#endif
+/* Enable general extensions on NetBSD.
+   Enable NetBSD compatibility extensions on Minix.  */
+#ifndef _NETBSD_SOURCE
+# undef _NETBSD_SOURCE
+#endif
+/* Enable OpenBSD compatibility extensions on NetBSD.
+   Oddly enough, this does nothing on OpenBSD.  */
+#ifndef _OPENBSD_SOURCE
+# undef _OPENBSD_SOURCE
+#endif
+/* Define to 1 if needed for POSIX-compatible behavior.  */
+#ifndef _POSIX_SOURCE
+# undef _POSIX_SOURCE
+#endif
+/* Define to 2 if needed for POSIX-compatible behavior.  */
+#ifndef _POSIX_1_SOURCE
+# undef _POSIX_1_SOURCE
+#endif
+/* Enable POSIX-compatible threading on Solaris.  */
 #ifndef _POSIX_PTHREAD_SEMANTICS
 # undef _POSIX_PTHREAD_SEMANTICS
 #endif
+/* Enable extensions specified by ISO/IEC TS 18661-5:2014.  */
+#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
+# undef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-1:2014.  */
+#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
+# undef __STDC_WANT_IEC_60559_BFP_EXT__
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-2:2015.  */
+#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
+# undef __STDC_WANT_IEC_60559_DFP_EXT__
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
+#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
+# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
+#endif
+/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
+#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
+# undef __STDC_WANT_IEC_60559_TYPES_EXT__
+#endif
+/* Enable extensions specified by ISO/IEC TR 24731-2:2010.  */
+#ifndef __STDC_WANT_LIB_EXT2__
+# undef __STDC_WANT_LIB_EXT2__
+#endif
+/* Enable extensions specified by ISO/IEC 24747:2009.  */
+#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
+# undef __STDC_WANT_MATH_SPEC_FUNCS__
+#endif
 /* Enable extensions on HP NonStop.  */
 #ifndef _TANDEM_SOURCE
 # undef _TANDEM_SOURCE
 #endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
+/* Enable X/Open extensions.  Define to 500 only if necessary
+   to make mbstate_t available.  */
+#ifndef _XOPEN_SOURCE
+# undef _XOPEN_SOURCE
 #endif
 
 
@@ -424,19 +545,9 @@
 # endif
 #endif
 
-/* Define to 1 if on MINIX. */
-#undef _MINIX
-
 /* Enable for compile on Minix */
 #undef _NETBSD_SOURCE
 
-/* Define to 2 if the system does not provide POSIX.1 features except with
-   this defined. */
-#undef _POSIX_1_SOURCE
-
-/* Define to 1 if you need to in order for `stat' and other things to work. */
-#undef _POSIX_SOURCE
-
 /* Define to empty if `const' does not conform to ANSI C. */
 #undef const
 
@@ -467,15 +578,9 @@
 /* Define to `size_t' if <sys/types.h> does not define. */
 #undef intptr_t
 
-/* Define to rpl_malloc if the replacement function should be used. */
-#undef malloc
-
-/* Define to `int' if <sys/types.h> does not define. */
+/* Define as a signed integer type capable of holding a process identifier. */
 #undef pid_t
 
-/* Define to rpl_realloc if the replacement function should be used. */
-#undef realloc
-
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t
 
@@ -644,10 +749,10 @@ size_t strlcpy(char *dst, const char *src, size_t siz);
 
 #ifdef USE_WINSOCK
 #define SOCK_INVALID INVALID_SOCKET
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {closesocket(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {closesocket(_s); _s = -1;} } while(0)
 #else
 #define SOCK_INVALID -1
-#define close_socket(_s) do { if (_s > SOCK_INVALID) {close(_s); _s = SOCK_INVALID;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s); _s = -1;} } while(0)
 #endif
 
 #ifdef __cplusplus
diff --git a/contrib/ldns/ldns/dane.h b/contrib/ldns/ldns/dane.h
index 142afb8d21b544..b5366e0e5ccdc1 100644
--- a/contrib/ldns/ldns/dane.h
+++ b/contrib/ldns/ldns/dane.h
@@ -43,7 +43,7 @@ enum ldns_enum_tlsa_certificate_usage
 	/** CA constraint */
 	LDNS_TLSA_USAGE_PKIX_TA				=   0,
 	LDNS_TLSA_USAGE_CA_CONSTRAINT			=   0,
-	/** Sevice certificate constraint */
+	/** Service certificate constraint */
 	LDNS_TLSA_USAGE_PKIX_EE				=   1,
 	LDNS_TLSA_USAGE_SERVICE_CERTIFICATE_CONSTRAINT	=   1,
 	/** Trust anchor assertion */
@@ -122,7 +122,7 @@ typedef enum ldns_enum_dane_transport ldns_dane_transport;
  *
  * \param[out] tlsa_owner The created dname.
  * \param[in] name The dname that should be prefixed.
- * \param[in] port The service port number for wich the name should be created.
+ * \param[in] port The service port number for which the name should be created.
  * \param[in] transport The transport for which the name should be created.
  * \return LDNS_STATUS_OK on success or an error code otherwise.
  */
diff --git a/contrib/ldns/ldns/dname.h b/contrib/ldns/ldns/dname.h
index 494ef28544c276..b76e823d738a14 100644
--- a/contrib/ldns/ldns/dname.h
+++ b/contrib/ldns/ldns/dname.h
@@ -134,7 +134,7 @@ ldns_rdf *ldns_dname_new_frm_data(uint16_t size, const void *data);
 void ldns_dname2canonical(const ldns_rdf *rdf);
 
 /**
- * test wether the name sub falls under parent (i.e. is a subdomain
+ * test whether the name sub falls under parent (i.e. is a subdomain
  * of parent). This function will return false if the given dnames are
  * equal.
  * \param[in] sub the name to test
diff --git a/contrib/ldns/ldns/dnssec.h b/contrib/ldns/ldns/dnssec.h
index 41691b63e73213..6ce305aeb7544d 100644
--- a/contrib/ldns/ldns/dnssec.h
+++ b/contrib/ldns/ldns/dnssec.h
@@ -355,7 +355,7 @@ uint8_t ldns_nsec3_salt_length(const ldns_rr *nsec3_rr);
 /**
  * Returns the salt bytes used in the given NSEC3 RR
  * \param[in] *nsec3_rr The RR to read from
- * \return The salt in bytes, this is alloced, so you need to free it
+ * \return The salt in bytes, this is alloc'ed, so you need to free it
  */
 uint8_t *ldns_nsec3_salt_data(const ldns_rr *nsec3_rr);
 
@@ -556,56 +556,6 @@ ldns_status
 ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
         const ldns_rdf *sig_rdf);
 
-/**
- * Converts the ECDSA signature from ASN1 representation (as
- * used by OpenSSL) to raw signature data as used in DNS
- * This routine is only present if ldns is compiled with ED25519 support.
- *
- * \param[in] sig The signature in ASN1 format
- * \param[in] sig_len The length of the signature
- * \return a new rdf with the signature
- */
-ldns_rdf *
-ldns_convert_ed25519_rrsig_asn12rdf(const ldns_buffer *sig, long sig_len);
-
-/**
- * Converts the RRSIG signature RDF (from DNS) to a buffer with the
- * signature in ASN1 format as openssl uses it.
- * This routine is only present if ldns is compiled with ED25519 support.
- *
- * \param[out] target_buffer buffer to place the signature data in ASN1.
- * \param[in] sig_rdf The signature rdf to convert
- * \return LDNS_STATUS_OK on success, error code otherwise
- */
-ldns_status
-ldns_convert_ed25519_rrsig_rdf2asn1(ldns_buffer *target_buffer,
-        const ldns_rdf *sig_rdf);
-
-/**
- * Converts the ECDSA signature from ASN1 representation (as
- * used by OpenSSL) to raw signature data as used in DNS
- * This routine is only present if ldns is compiled with ED448 support.
- *
- * \param[in] sig The signature in ASN1 format
- * \param[in] sig_len The length of the signature
- * \return a new rdf with the signature
- */
-ldns_rdf *
-ldns_convert_ed448_rrsig_asn12rdf(const ldns_buffer *sig, long sig_len);
-
-/**
- * Converts the RRSIG signature RDF (from DNS) to a buffer with the
- * signature in ASN1 format as openssl uses it.
- * This routine is only present if ldns is compiled with ED448 support.
- *
- * \param[out] target_buffer buffer to place the signature data in ASN1.
- * \param[in] sig_rdf The signature rdf to convert
- * \return LDNS_STATUS_OK on success, error code otherwise
- */
-ldns_status
-ldns_convert_ed448_rrsig_rdf2asn1(ldns_buffer *target_buffer,
-        const ldns_rdf *sig_rdf);
-
 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
 #ifdef __cplusplus
diff --git a/contrib/ldns/ldns/dnssec_sign.h b/contrib/ldns/ldns/dnssec_sign.h
index a88a46affab139..4523811f1aadba 100644
--- a/contrib/ldns/ldns/dnssec_sign.h
+++ b/contrib/ldns/ldns/dnssec_sign.h
@@ -12,8 +12,11 @@ extern "C" {
 /* sign functions */
 
 /** Sign flag that makes DNSKEY type signed by all keys, not only by SEP keys*/
-#define LDNS_SIGN_DNSKEY_WITH_ZSK 1
-#define LDNS_SIGN_WITH_ALL_ALGORITHMS 2 
+#define LDNS_SIGN_DNSKEY_WITH_ZSK            1
+#define LDNS_SIGN_WITH_ALL_ALGORITHMS        2 
+#define LDNS_SIGN_NO_KEYS_NO_NSECS           4
+#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384  8
+#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 16
 
 /**
  * Create an empty RRSIG RR (i.e. without the actual signature data)
@@ -46,9 +49,10 @@ ldns_rr_list *ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys);
 #if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * Sign a buffer with the DSA key (hash with SHA1)
- * \param[in] to_sign buffer with the data
- * \param[in] key the key to use
- * \return a ldns_rdf with the signed data
+ *
+ * \param[in] to_sign The ldns_buffer containing raw data that is to be signed
+ * \param[in] key The DSA key structure to sign with
+ * \return a ldns_rdf for the RRSIG ldns_rr
  */
 ldns_rdf *ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key);
 
@@ -109,7 +113,7 @@ ldns_dnssec_zone_mark_and_get_glue(
  * be taken into account separately.
  *
  * \param[in] zone the zone in which to mark the names
- * \return LDNS_STATUS_OK on succesful completion
+ * \return LDNS_STATUS_OK on successful completion, an error code otherwise
  */
 ldns_status
 ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone);
diff --git a/contrib/ldns/ldns/dnssec_verify.h b/contrib/ldns/ldns/dnssec_verify.h
index 26e3272b5d7c75..0ce6ec99d2fcbf 100644
--- a/contrib/ldns/ldns/dnssec_verify.h
+++ b/contrib/ldns/ldns/dnssec_verify.h
@@ -592,7 +592,7 @@ ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
  * \param[in] packet_qtype The original query RR type
  * \param[in] packet_nodata True if the providing packet had an empty ANSWER
  *                          section
- * \param[in] match On match, the given (reference to a) pointer will be set 
+ * \param[out] match On match, the given (reference to a) pointer will be set 
  *                  to point to the matching nsec resource record.
  * \return LDNS_STATUS_OK if the NSEC3 RRs deny the existence, error code
  *                        containing the reason they do not otherwise
@@ -692,7 +692,7 @@ ldns_status ldns_verify_rrsig_keylist_notime(const ldns_rr_list *rrset,
  * \param[in] rrset the rrset
  * \param[in] rrsig the rrsig to verify
  * \param[in] key the key to use
- * \return status message wether verification succeeded.
+ * \return status message whether verification succeeded.
  */
 ldns_status ldns_verify_rrsig(ldns_rr_list *rrset,
 						ldns_rr *rrsig,
@@ -705,7 +705,7 @@ ldns_status ldns_verify_rrsig(ldns_rr_list *rrset,
  * \param[in] rrsig the rrsig to verify
  * \param[in] key the key to use
  * \param[in] check_time the time for which the validation is performed
- * \return status message wether verification succeeded.
+ * \return status message whether verification succeeded.
  */
 ldns_status ldns_verify_rrsig_time(
 		ldns_rr_list *rrset, ldns_rr *rrsig, 
diff --git a/contrib/ldns/ldns/dnssec_zone.h b/contrib/ldns/ldns/dnssec_zone.h
index e97ea30c6008ea..156e3910232785 100644
--- a/contrib/ldns/ldns/dnssec_zone.h
+++ b/contrib/ldns/ldns/dnssec_zone.h
@@ -53,7 +53,7 @@ struct ldns_struct_dnssec_name
 	 * Usually, the name is a pointer to the owner name of the first rr for
 	 * this name, but sometimes there is no actual data to point to, 
 	 * for instance in
-	 * names representing empty nonterminals. If so, set alloced to true to
+	 * names representing empty nonterminals. If so, set name_alloced to true to
 	 * indicate that this data must also be freed when the name is freed
 	 */
 	bool name_alloced;
@@ -93,7 +93,7 @@ struct ldns_struct_dnssec_zone {
 	ldns_dnssec_name *soa;
 	/** tree of ldns_dnssec_names */
 	ldns_rbtree_t *names;
-	/** tree of ldns_dnssec_names by nsec3 hashes (when applicible) */
+	/** tree of ldns_dnssec_names by nsec3 hashes (when applicable) */
 	ldns_rbtree_t *hashed_names;
 	/** points to the first added NSEC3 rr whose parameters will be 
 	 *  assumed for all subsequent NSEC3 rr's and which will be used
@@ -204,7 +204,7 @@ ldns_status ldns_dnssec_rrsets_set_type(ldns_dnssec_rrsets *rrsets,
 ldns_status ldns_dnssec_rrsets_add_rr(ldns_dnssec_rrsets *rrsets, ldns_rr *rr);
 
 /**
- * Print the given list of rrsets to the fiven file descriptor
+ * Print the given list of rrsets to the given file descriptor
  * 
  * \param[in] out the file descriptor to print to
  * \param[in] rrsets the list of RRsets to print
@@ -215,7 +215,7 @@ void ldns_dnssec_rrsets_print(FILE *out,
 		bool follow);
 
 /**
- * Print the given list of rrsets to the fiven file descriptor
+ * Print the given list of rrsets to the given file descriptor
  * 
  * \param[in] out the file descriptor to print to
  * \param[in] fmt the format of the textual representation
@@ -297,12 +297,12 @@ void ldns_dnssec_name_set_nsec(ldns_dnssec_name *name, ldns_rr *nsec);
 
 /**
  * Compares the domain names of the two arguments in their
- * canonical ordening.
+ * canonical ordering.
  * 
  * \param[in] a The first dnssec_name to compare
  * \param[in] b The second dnssec_name to compare
  * \return -1 if the domain name of a comes before that of b in canonical
- *            ordening, 1 if it is the other way around, and 0 if they are
+ *            ordering, 1 if it is the other way around, and 0 if they are
  *            equal
  */
 int ldns_dnssec_name_cmp(const void *a, const void *b);
@@ -476,6 +476,8 @@ ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone);
  */
 bool ldns_dnssec_zone_is_nsec3_optout(const ldns_dnssec_zone* zone);
 
+ldns_status ldns_dnssec_zone_verify_zonemd(ldns_dnssec_zone *zone);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/contrib/ldns/ldns/edns.h b/contrib/ldns/ldns/edns.h
new file mode 100644
index 00000000000000..594fda22f788d2
--- /dev/null
+++ b/contrib/ldns/ldns/edns.h
@@ -0,0 +1,272 @@
+/*
+ * edns.h
+ *
+ *
+ * a Net::DNS like library for C
+ *
+ * (c) NLnet Labs, 2004-2022
+ *
+ * See the file LICENSE for the license
+ */
+
+#ifndef LDNS_EDNS_H
+#define LDNS_EDNS_H
+
+#include <ldns/common.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+
+/**
+ * EDNS option codes
+ */
+enum ldns_enum_edns_option
+{
+	LDNS_EDNS_LLQ = 1, /* RFC8764 */
+	LDNS_EDNS_UL = 2, /* http://files.dns-sd.org/draft-sekar-dns-ul.txt */
+	LDNS_EDNS_NSID = 3, /* RFC5001 */
+	/* 4 draft-cheshire-edns0-owner-option */
+	LDNS_EDNS_DAU = 5, /* RFC6975 */
+	LDNS_EDNS_DHU = 6, /* RFC6975 */
+	LDNS_EDNS_N3U = 7, /* RFC6975 */
+	LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
+	LDNS_EDNS_EXPIRE = 9, /* RFC7314 */
+	LDNS_EDNS_COOKIE = 10, /* RFC7873 */
+	LDNS_EDNS_KEEPALIVE = 11, /* RFC7828*/
+	LDNS_EDNS_PADDING = 12, /* RFC7830 */
+	LDNS_EDNS_CHAIN = 13, /* RFC7901 */
+	LDNS_EDNS_KEY_TAG = 14, /* RFC8145 */
+	LDNS_EDNS_EDE = 15, /* RFC8914 */
+	LDNS_EDNS_CLIENT_TAG = 16, /* draft-bellis-dnsop-edns-tags-01 */
+	LDNS_EDNS_SERVER_TAG = 17 /* draft-bellis-dnsop-edns-tags-01 */
+};
+typedef enum ldns_enum_edns_option ldns_edns_option_code;
+
+/**
+ * Extended DNS Error (RFC 8914) codes
+ */
+enum ldns_edns_enum_ede_code
+{
+	LDNS_EDE_OTHER = 0,
+	LDNS_EDE_UNSUPPORTED_DNSKEY_ALG = 1,
+	LDNS_EDE_UNSUPPORTED_DS_DIGEST = 2,
+	LDNS_EDE_STALE_ANSWER = 3,
+	LDNS_EDE_FORGED_ANSWER = 4,
+	LDNS_EDE_DNSSEC_INDETERMINATE = 5,
+	LDNS_EDE_DNSSEC_BOGUS = 6,
+	LDNS_EDE_SIGNATURE_EXPIRED = 7,
+	LDNS_EDE_SIGNATURE_NOT_YET_VALID = 8,
+	LDNS_EDE_DNSKEY_MISSING = 9,
+	LDNS_EDE_RRSIGS_MISSING = 10,
+	LDNS_EDE_NO_ZONE_KEY_BIT_SET = 11,
+	LDNS_EDE_NSEC_MISSING = 12,
+	LDNS_EDE_CACHED_ERROR = 13,
+	LDNS_EDE_NOT_READY = 14,
+	LDNS_EDE_BLOCKED = 15,
+	LDNS_EDE_CENSORED = 16,
+	LDNS_EDE_FILTERED = 17,
+	LDNS_EDE_PROHIBITED = 18,
+	LDNS_EDE_STALE_NXDOMAIN_ANSWER = 19,
+	LDNS_EDE_NOT_AUTHORITATIVE = 20,
+	LDNS_EDE_NOT_SUPPORTED = 21,
+	LDNS_EDE_NO_REACHABLE_AUTHORITY = 22,
+	LDNS_EDE_NETWORK_ERROR = 23,
+	LDNS_EDE_INVALID_DATA = 24,
+	LDNS_EDE_SIGNATURE_EXPIRED_BEFORE_VALID = 25,
+	LDNS_EDE_TOO_EARLY = 26
+};
+typedef enum ldns_edns_enum_ede_code ldns_edns_ede_code;
+
+/**
+ * The struct that stores an ordered EDNS option.
+ * An EDNS option is structed as follows:
+  +0 (MSB)                            +1 (LSB)
+     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+  0: |                          OPTION-CODE                          |
+     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+  2: |                         OPTION-LENGTH                         |
+     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+  4: |                                                               |
+     /                          OPTION-DATA                          /
+     /                                                               /
+     +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+ */
+struct ldns_struct_edns_option {
+	ldns_edns_option_code _code;
+	size_t                _size;
+	void                 *_data;
+};
+typedef struct ldns_struct_edns_option ldns_edns_option;
+
+
+/* 
+ * Array structure to store multiple EDNS options
+ */
+struct ldns_struct_edns_option_list
+{
+	size_t _option_count; /* the number of EDNS options in the list */
+   size_t _option_capacity; /* the amount of options that fit into the list */
+	size_t _options_size; /* the total size of the options serialized */
+	ldns_edns_option **_options;
+};
+typedef struct ldns_struct_edns_option_list ldns_edns_option_list;
+
+/*
+ * Access functions 
+ * do this as functions to get type checking
+ */
+
+/**
+ * returns the size of the EDNS data.
+ * \param[in] *edns the EDNS struct to read from
+ * \return uint16_t with the size
+ */
+size_t ldns_edns_get_size(const ldns_edns_option *edns);
+
+/**
+ * returns the option code of the EDNS data.
+ * \param[in] *edns the EDNS struct to read from
+ * \return uint16_t with the size
+ */
+ldns_edns_option_code ldns_edns_get_code(const ldns_edns_option *edns);
+
+/**
+ * returns the EDNS option data.
+ * \param[in] *edns the EDNS option to read from
+ * \return uint8_t* pointer to the EDNS option's data
+ */
+uint8_t *ldns_edns_get_data(const ldns_edns_option *edns);
+
+
+/**
+ * serialise the EDNS option into wireformat.
+ * \param[in] *edns the EDNS option to read from
+ * \return ldns_buffer* the buffer containing the data
+ */
+ldns_buffer *ldns_edns_get_wireformat_buffer(const ldns_edns_option *edns);
+
+/* Constructors and destructors*/
+
+/**
+ * allocates a new EDNS structure and fills it. This function *DOES NOT* copy
+ * the contents from the data parameter.
+ * \param[in] code the EDNS code
+ * \param[in] size size of the buffer
+ * \param[in] data pointer to the buffer to be assigned
+ * \return the new EDNS structure or NULL on failure
+ */
+ldns_edns_option *ldns_edns_new(ldns_edns_option_code code, size_t size, void *data);
+
+/**
+ * allocates a new EDNS structure and fills it. This function *DOES* copy
+ * the contents from the data parameter.
+ * \param[in] code the EDNS code
+ * \param[in] size size of the buffer
+ * \param[in] data pointer to the buffer to be assigned
+ * \return the new EDNS structure or NULL on failure
+ */
+ldns_edns_option *ldns_edns_new_from_data(ldns_edns_option_code code, size_t size, const void *data);
+
+/**
+ * clone an EDNS option
+ * \param[in] edns the EDNS option
+ * \return the new EDNS structure
+ */
+ldns_edns_option *ldns_edns_clone(ldns_edns_option *edns);
+
+/**
+ * free the EDNS option. Use deep_free if the _data member is allocated.
+ * \param[in] edns the EDNS option to free
+ */
+void ldns_edns_deep_free(ldns_edns_option *edns);
+void ldns_edns_free(ldns_edns_option *edns);
+
+/**
+ * allocates space for a new list of EDNS options
+ * \return the new EDNS option list or NULL on failure
+ */
+ldns_edns_option_list* ldns_edns_option_list_new(void);
+
+/**
+ * clone the EDNS options list and it's contents
+ * \param[in] options_list  the EDNS options_list to read from
+ * \return the new EDNS option list
+ */
+ldns_edns_option_list *ldns_edns_option_list_clone(ldns_edns_option_list *options_list);
+
+/**
+ * free the EDNS option list. Use deep_free to free the options options
+ * in the list as well.
+ * \param[in] options_list the EDNS option to free
+ */
+void ldns_edns_option_list_free(ldns_edns_option_list *options_list);
+void ldns_edns_option_list_deep_free(ldns_edns_option_list *options_list);
+
+/* edns_option_list functions */
+
+/**
+ * returns the number of options in the EDNS options list.
+ * \param[in] options_list  the EDNS options_list to read from
+ * \return the number of EDNS options
+ */
+size_t ldns_edns_option_list_get_count(const ldns_edns_option_list *options_list);
+
+/**
+ * returns the EDNS option as the specified index in the list of EDNS options.
+ * \param[in] options_list  the EDNS options_list to read from
+ * \param[in] index         the location of the EDNS option to get in the list
+ * \return the EDNS option located at the index or NULL on failure
+ */
+ldns_edns_option* ldns_edns_option_list_get_option(const ldns_edns_option_list *options_list,
+	size_t index);
+
+
+/**
+ * returns the total size of all the individual EDNS options in the EDNS list.
+ * \param[in] options_list  the EDNS options_list to read from
+ * \return the total size of the options combined
+ */
+size_t ldns_edns_option_list_get_options_size(const ldns_edns_option_list *options_list);
+
+/**
+ * adds an EDNS option to the list of options at the specified index. Also
+ * returns the option that was previously at that index.
+ * \param[in] options_list  the EDNS options_list to add to
+ * \param[in] option        the EDNS option to add to the list
+ * \param[in] index         the index in the list where to set the option
+ * \return the EDNS option previously located at the index
+ */
+ldns_edns_option *ldns_edns_option_list_set_option(ldns_edns_option_list *options_list,
+	ldns_edns_option *option, size_t index);
+
+/**
+ * adds an EDNS option at the end of the list of options.
+ * \param[in] options_list  the EDNS options_list to add to
+ * \param[in] option        the (non-NULL) EDNS option to add to the list
+ * \return true on success and false of failure
+ */
+bool ldns_edns_option_list_push(ldns_edns_option_list *options_list,
+	ldns_edns_option *option);
+
+/**
+ * removes and returns the EDNS option at the end of the list of options.
+ * \param[in] options_list  the EDNS options_list to add to
+ * \return the EDNS option at the end of the list, or NULL on failure
+ */
+ldns_edns_option* ldns_edns_option_list_pop(ldns_edns_option_list *options_list);
+
+/**
+ * serializes all the EDNS options into a single wireformat buffer
+ * \param[in] option_list  the EDNS options_list to combine into one wireformat
+ * \return the filled buffer or NULL on failure
+ */
+ldns_buffer *ldns_edns_option_list2wireformat_buffer(const ldns_edns_option_list *option_list);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LDNS_EDNS_H */
diff --git a/contrib/ldns/ldns/error.h b/contrib/ldns/ldns/error.h
index 15f49a28e153e8..2429b7703dfaba 100644
--- a/contrib/ldns/ldns/error.h
+++ b/contrib/ldns/ldns/error.h
@@ -129,7 +129,19 @@ enum ldns_enum_status {
 	LDNS_STATUS_RDATA_OVERFLOW,
 	LDNS_STATUS_SYNTAX_SUPERFLUOUS_TEXT_ERR,
 	LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW,
-	LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA
+	LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA,
+	LDNS_STATUS_ZONEMD_DOUBLE_OCCURRENCE,
+	LDNS_STATUS_ZONEMD_UNKNOWN_SCHEME,
+	LDNS_STATUS_ZONEMD_UNKNOWN_HASH,
+	LDNS_STATUS_ZONEMD_INVALID_SOA,
+	LDNS_STATUS_NO_ZONEMD,
+	LDNS_STATUS_NO_VALID_ZONEMD,
+	LDNS_STATUS_SYNTAX_SVCPARAM_KEY_ERR,
+	LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR,
+	LDNS_STATUS_RESERVED_SVCPARAM_KEY,
+	LDNS_STATUS_NO_SVCPARAM_VALUE_EXPECTED,
+	LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE,
+	LDNS_STATUS_INVALID_SVCPARAM_VALUE
 };
 typedef enum ldns_enum_status ldns_status;
 
diff --git a/contrib/ldns/ldns/host2str.h b/contrib/ldns/ldns/host2str.h
index 325c562f5f49ec..79f5561a945108 100644
--- a/contrib/ldns/ldns/host2str.h
+++ b/contrib/ldns/ldns/host2str.h
@@ -65,6 +65,8 @@ extern "C" {
 #define LDNS_FMT_ZEROIZE_RRSIGS		(1 <<  9)
 #define LDNS_FMT_PAD_SOA_SERIAL		(1 << 10)
 #define LDNS_FMT_RFC3597		(1 << 11)	/* yes */
+/** Prints only answer section of packets and only rdata of RRs **/
+#define LDNS_FMT_SHORT			(1 << 12)
 
 #define LDNS_FMT_FLAGS_WITH_DATA			    2
 
@@ -76,11 +78,11 @@ extern "C" {
 /**
  * Output format specifier
  *
- * Determines how Packets, Resource Records and Resource record data fiels are
+ * Determines how Packets, Resource Records and Resource record data field are
  * formatted when printing or converting to string.
  * Currently it is only used to specify what aspects of a Resource Record are
  * annotated in the comment section of the textual representation the record.
- * This is speciefed with flags and potential exra data (such as for example
+ * This is specified with flags and potential extra data (such as for example
  * a lookup map of hashes to real names for annotation NSEC3 records).
  */
 struct ldns_struct_output_format
@@ -110,7 +112,7 @@ typedef struct ldns_struct_output_format_storage ldns_output_format_storage;
  */
 extern const ldns_output_format *ldns_output_format_nocomments;
 /**
- * Standard output format record that annotated only DNSKEY RR's with commenti
+ * Standard output format record that annotated only DNSKEY RR's with comment
  * text.
  */
 extern const ldns_output_format *ldns_output_format_onlykeyids;
@@ -513,6 +515,17 @@ ldns_status ldns_rr2buffer_str_fmt(ldns_buffer *output,
  */
 ldns_status ldns_pkt2buffer_str(ldns_buffer *output, const ldns_pkt *pkt);
 
+/**
+ * Converts the list of EDNS options to presentation
+ * format (as char *) and appends it to the given buffer
+ *
+ * \param[in] output pointer to the buffer to append the data to
+ * \param[in] edns_list the list of EDNS options
+ * \return status
+ */
+ldns_status ldns_edns_option_list2buffer_str(ldns_buffer *output,
+        ldns_edns_option_list* edns_list);
+
 /**
  * Converts the data in the DNS packet to presentation
  * format (as char *) and appends it to the given buffer
@@ -636,6 +649,25 @@ ldns_status ldns_rdf2buffer_str_long_str(ldns_buffer *output,
 ldns_status ldns_rdf2buffer_str_hip(ldns_buffer *output,
 		const ldns_rdf *rdf);
 
+/** 
+ * Converts an LDNS_RDF_TYPE_AMTRELAY rdata element to presentation format for
+ * the precedence, D-bit, type and relay and adds it to the output buffer 
+ * \param[in] *rdf The rdata to convert
+ * \param[in] *output The buffer to add the data to
+ * \return LDNS_STATUS_OK on success, and error status on failure
+ */
+ldns_status ldns_rdf2buffer_str_amtrelay(ldns_buffer *output,
+		const ldns_rdf *rdf);
+
+/** 
+ * Converts an LDNS_RDF_TYPE_SVCPARAMS rdata element to presentation format.
+ * \param[in] *rdf The rdata to convert
+ * \param[in] *output The buffer to add the data to
+ * \return LDNS_STATUS_OK on success, and error status on failure
+ */
+ldns_status ldns_rdf2buffer_str_svcparams(ldns_buffer *output,
+		const ldns_rdf *rdf);
+
 /**
  * Converts the data in the rdata field to presentation format and
  * returns that as a char *.
diff --git a/contrib/ldns/ldns/host2wire.h b/contrib/ldns/ldns/host2wire.h
index 94693cda36666e..4378f3366ff37f 100644
--- a/contrib/ldns/ldns/host2wire.h
+++ b/contrib/ldns/ldns/host2wire.h
@@ -130,7 +130,7 @@ ldns_status ldns_rrsig2buffer_wire(ldns_buffer *output, const ldns_rr *sigrr);
  * Converts an rr's rdata to wireformat, while excluding
  * the ownername and all the stuff before the rdata.
  * This is needed in DNSSEC keytag calculation, the ds
- * calcalution from the key and maybe elsewhere.
+ * calculation from the key and maybe elsewhere.
  *
  * \param[out] *output buffer where to put the result
  * \param[in] *rr rr to operate on
@@ -146,6 +146,15 @@ ldns_status ldns_rr_rdata2buffer_wire(ldns_buffer *output, const ldns_rr *rr);
  */
 ldns_status ldns_pkt2buffer_wire(ldns_buffer *output, const ldns_pkt *pkt);
 
+/**
+ * Copies the packet data to the buffer in wire format
+ * \param[out] *output buffer to append the result to
+ * \param[in] *pkt packet to convert
+ * \param[out] *compression_data data structure holding state for compression
+ * \return ldns_status
+ */
+ldns_status ldns_pkt2buffer_wire_compress(ldns_buffer *output, const ldns_pkt *pkt, ldns_rbtree_t *compression_data);
+
 /**
  * Copies the rr_list data to the buffer in wire format
  * \param[out] *output buffer to append the result to
@@ -187,6 +196,10 @@ ldns_status ldns_rr2wire(uint8_t **dest, const ldns_rr *rr, int section, size_t
  * given packet in that array. The result_size value contains the
  * length of the array, if it succeeds, and 0 otherwise (in which case
  * the function also returns NULL)
+ *
+ * \param[out] dest pointer to the array of bytes to be created
+ * \param[in] p the packet to convert
+ * \param[out] size the size of the converted result
  */
 ldns_status ldns_pkt2wire(uint8_t **dest, const ldns_pkt *p, size_t *size);
 
diff --git a/contrib/ldns/ldns/keys.h b/contrib/ldns/ldns/keys.h
index df4bb22b2650f1..847825e533ff88 100644
--- a/contrib/ldns/ldns/keys.h
+++ b/contrib/ldns/ldns/keys.h
@@ -55,16 +55,8 @@ enum ldns_enum_algorithm
         LDNS_ECC_GOST           = 12,  /* RFC 5933 */
         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
-#ifdef USE_ED25519
-	/* this ifdef is internal to ldns, because we do not want to export
-	 * the symbol.  Users can define it if they want access,
-	 * the feature is not fully implemented at this time and openssl
-	 * does not support it fully either (also for ED448). */
-	LDNS_ED25519		= 15,  /* draft-ietf-curdle-dnskey-ed25519 */
-#endif
-#ifdef USE_ED448
-	LDNS_ED448		= 16,  /* draft-ietf-curdle-dnskey-ed448 */
-#endif
+	LDNS_ED25519		= 15,  /* RFC 8080 */
+	LDNS_ED448		= 16,  /* RFC 8080 */
         LDNS_INDIRECT           = 252,
         LDNS_PRIVATEDNS         = 253,
         LDNS_PRIVATEOID         = 254
@@ -90,20 +82,24 @@ enum ldns_enum_signing_algorithm
 {
 	LDNS_SIGN_RSAMD5	 = LDNS_RSAMD5,
 	LDNS_SIGN_RSASHA1	 = LDNS_RSASHA1,
+#if LDNS_BUILD_CONFIG_USE_DSA
 	LDNS_SIGN_DSA		 = LDNS_DSA,
+#endif /* LDNS_BUILD_CONFIG_USE_DSA */
 	LDNS_SIGN_RSASHA1_NSEC3  = LDNS_RSASHA1_NSEC3,
 	LDNS_SIGN_RSASHA256	 = LDNS_RSASHA256,
 	LDNS_SIGN_RSASHA512	 = LDNS_RSASHA512,
+#if LDNS_BUILD_CONFIG_USE_DSA
 	LDNS_SIGN_DSA_NSEC3	 = LDNS_DSA_NSEC3,
+#endif /* LDNS_BUILD_CONFIG_USE_DSA */
 	LDNS_SIGN_ECC_GOST       = LDNS_ECC_GOST,
         LDNS_SIGN_ECDSAP256SHA256 = LDNS_ECDSAP256SHA256,
         LDNS_SIGN_ECDSAP384SHA384 = LDNS_ECDSAP384SHA384,
-#ifdef USE_ED25519
+#if LDNS_BUILD_CONFIG_USE_ED25519
 	LDNS_SIGN_ED25519	 = LDNS_ED25519,
-#endif
-#ifdef USE_ED448
+#endif /* LDNS_BUILD_CONFIG_USE_ED25519 */
+#if LDNS_BUILD_CONFIG_USE_ED448
 	LDNS_SIGN_ED448		 = LDNS_ED448,
-#endif
+#endif /* LDNS_BUILD_CONFIG_USE_ED448 */
 	LDNS_SIGN_HMACMD5	 = 157,	/* not official! This type is for TSIG, not DNSSEC */
 	LDNS_SIGN_HMACSHA1	 = 158,	/* not official! This type is for TSIG, not DNSSEC */
 	LDNS_SIGN_HMACSHA256 = 159,  /* ditto */
@@ -231,8 +227,14 @@ ldns_status ldns_key_new_frm_fp_l(ldns_key **k, FILE *fp, int *line_nr);
 /**
  * Read the key with the given id from the given engine and store it
  * in the given ldns_key structure. The algorithm type is set
+ * 
+ * \param[out] key the new ldns_key structure
+ * \param[in] e the engine from which to read the key
+ * \param[in] key_id the id of the key with which to lookup the key in the engine
+ * \param[in] a the algorithm to set for this key
+ * \return an error or LDNS_STATUS_OK
  */
-ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm);
+ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm a);
 
 
 /**
@@ -242,9 +244,7 @@ ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldn
  * \return NULL on failure otherwise a RSA structure
  */
 RSA *ldns_key_new_frm_fp_rsa(FILE *fp);
-#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
-#if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * frm_fp helper function. This function parses the
  * remainder of the (RSA) priv. key file generated from bind9
@@ -253,9 +253,9 @@ RSA *ldns_key_new_frm_fp_rsa(FILE *fp);
  * \return NULL on failure otherwise a RSA structure
  */
 RSA *ldns_key_new_frm_fp_rsa_l(FILE *fp, int *line_nr);
-#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
-#if LDNS_BUILD_CONFIG_HAVE_SSL
+
+# if LDNS_BUILD_CONFIG_USE_DSA
 /**
  * frm_fp helper function. This function parses the
  * remainder of the (DSA) priv. key file
@@ -263,9 +263,7 @@ RSA *ldns_key_new_frm_fp_rsa_l(FILE *fp, int *line_nr);
  * \return NULL on failure otherwise a RSA structure
  */
 DSA *ldns_key_new_frm_fp_dsa(FILE *fp);
-#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
-#if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * frm_fp helper function. This function parses the
  * remainder of the (DSA) priv. key file
@@ -274,9 +272,8 @@ DSA *ldns_key_new_frm_fp_dsa(FILE *fp);
  * \return NULL on failure otherwise a RSA structure
  */
 DSA *ldns_key_new_frm_fp_dsa_l(FILE *fp, int *line_nr);
-#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
+# endif /* LDNS_BUILD_CONFIG_USE_DSA */
 
-#if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * frm_fp helper function. This function parses the
  * remainder of the (HMAC-MD5) key file
@@ -286,9 +283,7 @@ DSA *ldns_key_new_frm_fp_dsa_l(FILE *fp, int *line_nr);
  * \return NULL on failure otherwise a newly allocated char buffer
  */
 unsigned char *ldns_key_new_frm_fp_hmac(FILE *fp, size_t *hmac_size);
-#endif
 
-#if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * frm_fp helper function. This function parses the
  * remainder of the (HMAC-MD5) key file
@@ -301,13 +296,14 @@ unsigned char *ldns_key_new_frm_fp_hmac(FILE *fp, size_t *hmac_size);
 unsigned char *ldns_key_new_frm_fp_hmac_l(FILE *fp, int *line_nr, size_t *hmac_size);
 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
-/* acces write functions */
+/* access write functions */
 /**
  * Set the key's algorithm
  * \param[in] k the key
  * \param[in] l the algorithm
  */
 void ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l);
+
 #if LDNS_BUILD_CONFIG_HAVE_SSL
 /**
  * Set the key's evp key
@@ -324,6 +320,7 @@ void ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e);
  */
 void ldns_key_set_rsa_key(ldns_key *k, RSA *r);
 
+# if LDNS_BUILD_CONFIG_USE_DSA
 /**
  * Set the key's dsa data
  * The dsa data should be freed by the user.
@@ -331,6 +328,7 @@ void ldns_key_set_rsa_key(ldns_key *k, RSA *r);
  * \param[in] d the dsa data
  */
 void ldns_key_set_dsa_key(ldns_key *k, DSA *d);
+# endif /* LDNS_BUILD_CONFIG_USE_DSA */
 
 /**
  * Assign the key's rsa data
@@ -340,6 +338,7 @@ void ldns_key_set_dsa_key(ldns_key *k, DSA *d);
  */
 void ldns_key_assign_rsa_key(ldns_key *k, RSA *r);
 
+# if LDNS_BUILD_CONFIG_USE_DSA
 /**
  * Assign the key's dsa data
  * The dsa data will be freed automatically when the key is freed.
@@ -347,6 +346,7 @@ void ldns_key_assign_rsa_key(ldns_key *k, RSA *r);
  * \param[in] d the dsa data
  */
 void ldns_key_assign_dsa_key(ldns_key *k, DSA *d);
+# endif /* LDNS_BUILD_CONFIG_USE_DSA */
 
 /** 
  * Get the PKEY id for GOST, loads GOST into openssl as a side effect.
@@ -423,7 +423,7 @@ void ldns_key_set_flags(ldns_key *k, uint16_t flags);
 /**
  * Set the keylist's key count to count
  * \param[in] key the key
- * \param[in] count the cuont
+ * \param[in] count the count
  */
 void ldns_key_list_set_key_count(ldns_key_list *key, size_t count);
 
@@ -463,13 +463,13 @@ RSA *ldns_key_rsa_key(const ldns_key *k);
  * \return the RSA * structure in the key
  */
 EVP_PKEY *ldns_key_evp_key(const ldns_key *k);
-#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
+# if LDNS_BUILD_CONFIG_USE_DSA
 /**
  * returns the (openssl) DSA struct contained in the key
  */
-#if LDNS_BUILD_CONFIG_HAVE_SSL
 DSA *ldns_key_dsa_key(const ldns_key *k);
+# endif /* LDNS_BUILD_CONFIG_USE_DSA */
 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
 
 /**
@@ -523,7 +523,7 @@ uint32_t ldns_key_inception(const ldns_key *k);
 /**
  * return the key's expiration date
  * \param[in] k the key
- * \return the experiration date
+ * \return the expiration date
  */
 uint32_t ldns_key_expiration(const ldns_key *k);
 /**
diff --git a/contrib/ldns/ldns/ldns.h b/contrib/ldns/ldns/ldns.h
index 60663ef95c7f3f..9b0bc066b0fcf0 100644
--- a/contrib/ldns/ldns/ldns.h
+++ b/contrib/ldns/ldns/ldns.h
@@ -101,6 +101,7 @@ Or you can just use the menu above to browse through the API docs.
 #include <ldns/dnssec_verify.h>
 #include <ldns/dnssec_sign.h>
 #include <ldns/duration.h>
+#include <ldns/edns.h>
 #include <ldns/error.h>
 #include <ldns/higher.h>
 #include <ldns/host2str.h>
diff --git a/contrib/ldns/ldns/net.h b/contrib/ldns/ldns/net.h
index fbf5b360782130..0fbf1544d5e923 100644
--- a/contrib/ldns/ldns/net.h
+++ b/contrib/ldns/ldns/net.h
@@ -30,7 +30,7 @@ extern "C" {
  */
 
 /**
- * Sends a buffer to an ip using udp and return the respons as a ldns_pkt
+ * Sends a buffer to an ip using udp and return the response as a ldns_pkt
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
@@ -48,7 +48,20 @@ ldns_status ldns_udp_send(uint8_t **result, ldns_buffer *qbin, const struct sock
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
  * \param[in] timeout *unused*, was the timeout value for the network
- * \return the socket used
+ * \return the socket used or -1 on failure
+ */
+int ldns_udp_bgsend2(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Send an udp query and don't wait for an answer but return
+ * the socket
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_udp_bgsend2 instead of this function.
+ * \param[in] qbin the ldns_buffer to be send
+ * \param[in] to the ip addr to send to
+ * \param[in] tolen length of the ip addr
+ * \param[in] timeout *unused*, was the timeout value for the network
+ * \return the socket used or 0 on failure
  */
 int ldns_udp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
@@ -59,12 +72,25 @@ int ldns_udp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, sockle
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
  * \param[in] timeout the timeout value for the connect attempt
- * \return the socket used
+ * \return the socket used or -1 on failure
+ */
+int ldns_tcp_bgsend2(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Send an tcp query and don't wait for an answer but return
+ * the socket
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_tcp_bgsend2 instead of this function.
+ * \param[in] qbin the ldns_buffer to be send
+ * \param[in] to the ip addr to send to
+ * \param[in] tolen length of the ip addr
+ * \param[in] timeout the timeout value for the connect attempt
+ * \return the socket used or 0 on failure
  */
 int ldns_tcp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
 /**
- * Sends a buffer to an ip using tcp and return the respons as a ldns_pkt
+ * Sends a buffer to an ip using tcp and return the response as a ldns_pkt
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] to the ip addr to send to
@@ -104,7 +130,18 @@ ldns_status ldns_send_buffer(ldns_pkt **pkt, ldns_resolver *r, ldns_buffer *qb,
  * \param[in] to ip and family
  * \param[in] tolen length of to
  * \param[in] timeout timeout for the connect attempt
- * \return a socket descriptor
+ * \return a socket descriptor or -1 on failure
+ */
+int ldns_tcp_connect2(const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Create a tcp socket to the specified address
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_tcp_connect2 instead of this function.
+ * \param[in] to ip and family
+ * \param[in] tolen length of to
+ * \param[in] timeout timeout for the connect attempt
+ * \return a socket descriptor or 0 on failure
  */
 int ldns_tcp_connect(const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
@@ -112,7 +149,17 @@ int ldns_tcp_connect(const struct sockaddr_storage *to, socklen_t tolen, struct
  * Create a udp socket to the specified address
  * \param[in] to ip and family
  * \param[in] timeout *unused*, was timeout for the socket
- * \return a socket descriptor
+ * \return a socket descriptor or -1 on failure
+ */
+int ldns_udp_connect2(const struct sockaddr_storage *to, struct timeval timeout);
+
+/**
+ * Create a udp socket to the specified address
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_udp_connect2 instead of this function.
+ * \param[in] to ip and family
+ * \param[in] timeout *unused*, was timeout for the socket
+ * \return a socket descriptor or 0 on failure
  */
 int ldns_udp_connect(const struct sockaddr_storage *to, struct timeval timeout);
 
@@ -186,7 +233,7 @@ struct sockaddr_storage * ldns_rdf2native_sockaddr_storage(const ldns_rdf *rd, u
  * returns an rdf with the sockaddr info. works for ip4 and ip6
  * \param[in] sock the struct sockaddr_storage to convert
  * \param[in] port what port was used. When NULL this is not set
- * \return ldns_rdf* wth the address
+ * \return ldns_rdf* with the address
  */
 ldns_rdf * ldns_sockaddr_storage2rdf(const struct sockaddr_storage *sock, uint16_t *port);
 
@@ -194,7 +241,7 @@ ldns_rdf * ldns_sockaddr_storage2rdf(const struct sockaddr_storage *sock, uint16
  * Prepares the resolver for an axfr query
  * The query is sent and the answers can be read with ldns_axfr_next
  * \param[in] resolver the resolver to use
- * \param[in] domain the domain to exfr
+ * \param[in] domain the domain to axfr
  * \param[in] c the class to use
  * \return ldns_status the status of the transfer
  */
diff --git a/contrib/ldns/ldns/net.h.in b/contrib/ldns/ldns/net.h.in
index 9faf3a7dead531..8503f1c933912e 100644
--- a/contrib/ldns/ldns/net.h.in
+++ b/contrib/ldns/ldns/net.h.in
@@ -30,7 +30,7 @@ extern "C" {
  */
 
 /**
- * Sends a buffer to an ip using udp and return the respons as a ldns_pkt
+ * Sends a buffer to an ip using udp and return the response as a ldns_pkt
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
@@ -48,7 +48,20 @@ ldns_status ldns_udp_send(uint8_t **result, ldns_buffer *qbin, const struct sock
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
  * \param[in] timeout *unused*, was the timeout value for the network
- * \return the socket used
+ * \return the socket used or -1 on failure
+ */
+int ldns_udp_bgsend2(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Send an udp query and don't wait for an answer but return
+ * the socket
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_udp_bgsend2 instead of this function.
+ * \param[in] qbin the ldns_buffer to be send
+ * \param[in] to the ip addr to send to
+ * \param[in] tolen length of the ip addr
+ * \param[in] timeout *unused*, was the timeout value for the network
+ * \return the socket used or 0 on failure
  */
 int ldns_udp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
@@ -59,12 +72,25 @@ int ldns_udp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, sockle
  * \param[in] to the ip addr to send to
  * \param[in] tolen length of the ip addr
  * \param[in] timeout the timeout value for the connect attempt
- * \return the socket used
+ * \return the socket used or -1 on failure
+ */
+int ldns_tcp_bgsend2(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Send an tcp query and don't wait for an answer but return
+ * the socket
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_tcp_bgsend2 instead of this function.
+ * \param[in] qbin the ldns_buffer to be send
+ * \param[in] to the ip addr to send to
+ * \param[in] tolen length of the ip addr
+ * \param[in] timeout the timeout value for the connect attempt
+ * \return the socket used or 0 on failure
  */
 int ldns_tcp_bgsend(ldns_buffer *qbin, const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
 /**
- * Sends a buffer to an ip using tcp and return the respons as a ldns_pkt
+ * Sends a buffer to an ip using tcp and return the response as a ldns_pkt
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] qbin the ldns_buffer to be send
  * \param[in] to the ip addr to send to
@@ -104,7 +130,18 @@ ldns_status ldns_send_buffer(ldns_pkt **pkt, ldns_resolver *r, ldns_buffer *qb,
  * \param[in] to ip and family
  * \param[in] tolen length of to
  * \param[in] timeout timeout for the connect attempt
- * \return a socket descriptor
+ * \return a socket descriptor or -1 on failure
+ */
+int ldns_tcp_connect2(const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
+
+/**
+ * Create a tcp socket to the specified address
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_tcp_connect2 instead of this function.
+ * \param[in] to ip and family
+ * \param[in] tolen length of to
+ * \param[in] timeout timeout for the connect attempt
+ * \return a socket descriptor or 0 on failure
  */
 int ldns_tcp_connect(const struct sockaddr_storage *to, socklen_t tolen, struct timeval timeout);
 
@@ -112,7 +149,17 @@ int ldns_tcp_connect(const struct sockaddr_storage *to, socklen_t tolen, struct
  * Create a udp socket to the specified address
  * \param[in] to ip and family
  * \param[in] timeout *unused*, was timeout for the socket
- * \return a socket descriptor
+ * \return a socket descriptor or -1 on failure
+ */
+int ldns_udp_connect2(const struct sockaddr_storage *to, struct timeval timeout);
+
+/**
+ * Create a udp socket to the specified address
+ * This function has the flaw that it returns 0 on failure, but 0 could be a
+ * valid socket.  Please use ldns_udp_connect2 instead of this function.
+ * \param[in] to ip and family
+ * \param[in] timeout *unused*, was timeout for the socket
+ * \return a socket descriptor or 0 on failure
  */
 int ldns_udp_connect(const struct sockaddr_storage *to, struct timeval timeout);
 
@@ -186,7 +233,7 @@ struct sockaddr_storage * ldns_rdf2native_sockaddr_storage(const ldns_rdf *rd, u
  * returns an rdf with the sockaddr info. works for ip4 and ip6
  * \param[in] sock the struct sockaddr_storage to convert
  * \param[in] port what port was used. When NULL this is not set
- * \return ldns_rdf* wth the address
+ * \return ldns_rdf* with the address
  */
 ldns_rdf * ldns_sockaddr_storage2rdf(const struct sockaddr_storage *sock, uint16_t *port);
 
@@ -194,7 +241,7 @@ ldns_rdf * ldns_sockaddr_storage2rdf(const struct sockaddr_storage *sock, uint16
  * Prepares the resolver for an axfr query
  * The query is sent and the answers can be read with ldns_axfr_next
  * \param[in] resolver the resolver to use
- * \param[in] domain the domain to exfr
+ * \param[in] domain the domain to axfr
  * \param[in] c the class to use
  * \return ldns_status the status of the transfer
  */
diff --git a/contrib/ldns/ldns/packet.h b/contrib/ldns/ldns/packet.h
index e29941936638aa..2c60609fc07af6 100644
--- a/contrib/ldns/ldns/packet.h
+++ b/contrib/ldns/ldns/packet.h
@@ -35,6 +35,7 @@
 #include <ldns/error.h>
 #include <ldns/common.h>
 #include <ldns/rr.h>
+#include <ldns/edns.h>
 #include <sys/time.h>
 
 #ifdef __cplusplus
@@ -251,12 +252,14 @@ struct ldns_struct_pkt
 	uint8_t _edns_extended_rcode;
 	/** EDNS Version */
 	uint8_t _edns_version;
-        /* OPT pseudo-RR presence flag */
-        uint8_t _edns_present;
+	/* OPT pseudo-RR presence flag */
+	uint8_t _edns_present;
 	/** Reserved EDNS data bits */
 	uint16_t _edns_z;
 	/** Arbitrary EDNS rdata */
 	ldns_rdf *_edns_data;
+	/** Structed EDNS data */
+	ldns_edns_option_list *_edns_list;
 	/**  Question section */
 	ldns_rr_list	*_question;
 	/**  Answer section */
@@ -355,9 +358,9 @@ bool ldns_pkt_ad(const ldns_pkt *p);
  */
 ldns_pkt_opcode ldns_pkt_get_opcode(const ldns_pkt *p);
 /**
- * Return the packet's respons code
+ * Return the packet's response code
  * \param[in] p the packet
- * \return the respons code
+ * \return the response code
  */
 ldns_pkt_rcode ldns_pkt_get_rcode(const ldns_pkt *p);
 /**
@@ -586,7 +589,7 @@ void ldns_pkt_set_ad(ldns_pkt *p, bool b);
  */
 void ldns_pkt_set_opcode(ldns_pkt *p, ldns_pkt_opcode c);
 /**
- * Set the packet's respons code
+ * Set the packet's response code
  * \param[in] p the packet
  * \param[in] c the rcode
  */
@@ -687,7 +690,7 @@ uint8_t ldns_pkt_edns_version(const ldns_pkt *packet);
  */
 uint16_t ldns_pkt_edns_z(const ldns_pkt *packet);
 /**
- * return the packet's edns data
+ * return the packet's EDNS data
  * \param[in] packet the packet
  * \return the data
  */
@@ -706,6 +709,18 @@ bool ldns_pkt_edns_do(const ldns_pkt *packet);
  */
 void ldns_pkt_set_edns_do(ldns_pkt *packet, bool value);
 
+/**
+ * return the packet's EDNS header bits that are unassigned.
+ */
+uint16_t ldns_pkt_edns_unassigned(const ldns_pkt *packet);
+
+/**
+ * Set the packet's EDNS header bits that are unassigned.
+ * \param[in] packet the packet
+ * \param[in] value the value
+ */
+void ldns_pkt_set_edns_unassigned(ldns_pkt *packet, uint16_t value);
+
 /**
  * returns true if this packet needs and EDNS rr to be sent.
  * At the moment the only reason is an expected packet
@@ -717,6 +732,16 @@ void ldns_pkt_set_edns_do(ldns_pkt *packet, bool value);
  */
 bool ldns_pkt_edns(const ldns_pkt *packet);
 
+/**
+ * Returns a list of structured EDNS options. The list will be automatically
+ * freed when the packet is freed. The option list can be manipulated and
+ * will be used when converting the packet to wireformat with ldns_pkt2wire.
+ *
+ * \param[in] packet the packet which contains the EDNS data
+ * \return the list of EDNS options
+ */
+ldns_edns_option_list* ldns_pkt_edns_get_option_list(ldns_pkt *packet);
+
 /**
  * Set the packet's edns udp size
  * \param[in] packet the packet
@@ -742,12 +767,20 @@ void ldns_pkt_set_edns_version(ldns_pkt *packet, uint8_t v);
  */
 void ldns_pkt_set_edns_z(ldns_pkt *packet, uint16_t z);
 /**
- * Set the packet's edns data
+ * Set the packet's EDNS data
  * \param[in] packet the packet
  * \param[in] data the data
  */
 void ldns_pkt_set_edns_data(ldns_pkt *packet, ldns_rdf *data);
 
+/**
+ * Set the packet's structured EDNS data. Once an edns_option_list is set 
+ * (or get), the option list will be used for converting into wireformat. 
+ * \param[in] packet the packet
+ * \param[in] list the options list that will create the data
+ */
+void ldns_pkt_set_edns_option_list(ldns_pkt *packet, ldns_edns_option_list *list);
+
 /**
  * allocates and initializes a ldns_pkt structure.
  * \return pointer to the new packet
@@ -837,7 +870,7 @@ void ldns_pkt_set_answer(ldns_pkt *p, ldns_rr_list *rr);
 void ldns_pkt_set_question(ldns_pkt *p, ldns_rr_list *rr);
 
 /**
- * directly set the auhority section
+ * directly set the authority section
  * \param[in] p packet to operate on
  * \param[in] rr rrlist to set
  */
diff --git a/contrib/ldns/ldns/parse.h b/contrib/ldns/ldns/parse.h
index 0e9034c3414ea8..ba7edf5679d84e 100644
--- a/contrib/ldns/ldns/parse.h
+++ b/contrib/ldns/ldns/parse.h
@@ -69,6 +69,32 @@ ssize_t ldns_fget_token(FILE *f, char *token, const char *delim, size_t limit);
  */
 ssize_t ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *line_nr);
 
+/** 
+ * returns a token/char from the stream f.
+ * This function deals with ( and ) in the stream,
+ * and ignores when it finds them.
+ * \param[in] *f the file to read from
+ * \param[out] **token this should be a reference to a string buffer in which
+ *                     the token is put. A new buffer will be allocated when
+ *                     *token is NULL and fixed is false. If the buffer is too
+ *                     small to hold the token, the buffer is reallocated with
+ *                     double the size (of limit).
+ *                     If fixed is true, the string buffer may not be NULL
+ *                     and limit must be set to the buffer size. In that case
+ *                     no reallocations will be done.
+ * \param[in,out] *limit reference to the size of the token buffer. Will be
+ *                       reset to the new limit of the token buffer if the
+ *                       buffer is reallocated.
+ * \param [in] fixed If fixed is false, the token buffer is allowed to grow
+ *                   when needed (by way of reallocation). If true, the token
+ *                   buffer will not be resized.
+ * \param[in] *delim chars at which the parsing should stop
+ * \param[in] line_nr pointer to an integer containing the current line number (for debugging purposes)
+ * \return LDNS_STATUS_OK on success, LDNS_STATUS_SYNTAX_EMPTY when no token
+ *         was read and an error otherwise.
+ */
+ldns_status ldns_fget_token_l_st(FILE *f, char **token, size_t *limit, bool fixed, const char *delim, int *line_nr);
+
 /**
  * returns a token/char from the buffer b.
  * This function deals with ( and ) in the buffer,
@@ -86,9 +112,9 @@ ssize_t ldns_bget_token(ldns_buffer *b, char *token, const char *delim, size_t l
  * after the keyword + k_del until we hit d_del
  * \param[in] f file pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimeter 
+ * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
- * \param[in] d_del the data delimeter
+ * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \return the number of character read
  */
@@ -99,9 +125,9 @@ ssize_t ldns_fget_keyword_data(FILE *f, const char *keyword, const char *k_del,
  * after the keyword + k_del until we hit d_del
  * \param[in] f file pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimeter 
+ * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
- * \param[in] d_del the data delimeter
+ * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \param[in] line_nr pointer to an integer containing the current line number (for
 debugging purposes)
@@ -114,9 +140,9 @@ ssize_t ldns_fget_keyword_data_l(FILE *f, const char *keyword, const char *k_del
  * after the keyword + k_del until we hit d_del
  * \param[in] b buffer pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimeter 
+ * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
- * \param[in] d_del the data delimeter
+ * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \return the number of character read
  */
diff --git a/contrib/ldns/ldns/radix.h b/contrib/ldns/ldns/radix.h
index ec70565a3cab0a..4cb42b48ba9d1c 100644
--- a/contrib/ldns/ldns/radix.h
+++ b/contrib/ldns/ldns/radix.h
@@ -154,7 +154,7 @@ ldns_radix_node_t* ldns_radix_search(ldns_radix_t* tree, const uint8_t* key,
  * @param tree: tree to insert to.
  * @param key:  key.
  * @param len:  length of key.
- * @param result: the radix node with the exact or closest match. NULL if
+ * @param[out] result: the radix node with the exact or closest match. NULL if
  *                the key is smaller than the smallest key in the tree.
  * @return 1 if exact match, 0 otherwise.
  *
@@ -198,7 +198,7 @@ ldns_radix_node_t* ldns_radix_prev(ldns_radix_node_t* node);
  * Split radix tree intwo.
  * @param tree1: one tree.
  * @param num: number of elements to split off.
- * @param tree2: another tree.
+ * @param[out] tree2: another tree.
  * @return: status.
  *
  */
diff --git a/contrib/ldns/ldns/rbtree.h b/contrib/ldns/ldns/rbtree.h
index 0747a8e5b87b11..4cfaf382978ae7 100644
--- a/contrib/ldns/ldns/rbtree.h
+++ b/contrib/ldns/ldns/rbtree.h
@@ -151,7 +151,7 @@ ldns_rbnode_t *ldns_rbtree_search(ldns_rbtree_t *rbtree, const void *key);
  * Find, but match does not have to be exact.
  * @param rbtree: tree to find in.
  * @param key: key to find position of.
- * @param result: set to the exact node if present, otherwise to element that
+ * @param[out] result: set to the exact node if present, otherwise to element that
  *   precedes the position of key in the tree. NULL if no smaller element.
  * @return: true if exact match in result. Else result points to <= element,
  * or NULL if key is smaller than the smallest key.
diff --git a/contrib/ldns/ldns/rdata.h b/contrib/ldns/ldns/rdata.h
index 981dd94a048479..c8a0396cfd153f 100644
--- a/contrib/ldns/ldns/rdata.h
+++ b/contrib/ldns/ldns/rdata.h
@@ -139,6 +139,12 @@ enum ldns_enum_rdf_type
 	LDNS_RDF_TYPE_SELECTOR,
 	LDNS_RDF_TYPE_MATCHING_TYPE,
 
+	/** draft-ietf-mboned-driad-amt-discovery **/
+	LDNS_RDF_TYPE_AMTRELAY,
+
+	/** draft-ietf-dnsop-svcb-https **/
+	LDNS_RDF_TYPE_SVCPARAMS,
+
 	/* Aliases */
 	LDNS_RDF_TYPE_BITMAP = LDNS_RDF_TYPE_NSEC
 };
@@ -162,7 +168,23 @@ enum ldns_enum_cert_algorithm
 };
 typedef enum ldns_enum_cert_algorithm ldns_cert_algorithm;
 
-
+/**
+ * keys types in SVCPARAMS rdata fields
+ */
+enum ldns_enum_svcparam_key
+{
+	LDNS_SVCPARAM_KEY_MANDATORY		= 0,
+	LDNS_SVCPARAM_KEY_ALPN			= 1,
+	LDNS_SVCPARAM_KEY_NO_DEFAULT_ALPN	= 2,
+	LDNS_SVCPARAM_KEY_PORT			= 3,
+	LDNS_SVCPARAM_KEY_IPV4HINT		= 4,
+	LDNS_SVCPARAM_KEY_ECH			= 5,
+	LDNS_SVCPARAM_KEY_IPV6HINT		= 6,
+        LDNS_SVCPARAM_KEY_DOHPATH               = 7,
+	LDNS_SVCPARAM_KEY_LAST_KEY		= 7,
+	LDNS_SVCPARAM_KEY_RESERVED		= 65535
+};
+typedef	enum ldns_enum_svcparam_key ldns_svcparam_key;
 
 /**
  * Resource record data field.
@@ -240,7 +262,7 @@ uint8_t *ldns_rdf_data(const ldns_rdf *rd);
 /**
  * allocates a new rdf structure and fills it.
  * This function DOES NOT copy the contents from
- * the buffer, unlinke ldns_rdf_new_frm_data()
+ * the buffer, unlike ldns_rdf_new_frm_data()
  * \param[in] type type of the rdf
  * \param[in] size size of the buffer
  * \param[in] data pointer to the buffer to be copied
@@ -251,7 +273,7 @@ ldns_rdf *ldns_rdf_new(ldns_rdf_type type, size_t size, void *data);
 /**
  * allocates a new rdf structure and fills it.
  * This function _does_ copy the contents from
- * the buffer, unlinke ldns_rdf_new()
+ * the buffer, unlike ldns_rdf_new()
  * \param[in] type type of the rdf
  * \param[in] size size of the buffer
  * \param[in] data pointer to the buffer to be copied
diff --git a/contrib/ldns/ldns/resolver.h b/contrib/ldns/ldns/resolver.h
index 84128dfecfba2e..e8459db7a3e07c 100644
--- a/contrib/ldns/ldns/resolver.h
+++ b/contrib/ldns/ldns/resolver.h
@@ -250,7 +250,7 @@ bool ldns_resolver_dnssec_cd(const ldns_resolver *r);
 /**
  * Get the resolver's DNSSEC anchors
  * \param[in] r the resolver
- * \return an rr_list containg trusted DNSSEC anchors
+ * \return an rr_list containing trusted DNSSEC anchors
  */
 ldns_rr_list * ldns_resolver_dnssec_anchors(const ldns_resolver *r);
 /**
@@ -730,7 +730,7 @@ ldns_status ldns_resolver_new_frm_fp_l(ldns_resolver **r, FILE *fp, int *line_nr
 ldns_status ldns_resolver_new_frm_file(ldns_resolver **r, const char *filename);
 
 /**
- * Frees the allocated space for this resolver. Only frees the resolver pionter! You should probably be using _deep_free.
+ * Frees the allocated space for this resolver. Only frees the resolver pointer! You should probably be using _deep_free.
  * \param res resolver to free
  */
 void ldns_resolver_free(ldns_resolver *res);
@@ -766,7 +766,7 @@ bool ldns_axfr_complete(const ldns_resolver *resolver);
 
 /**
  * Returns a pointer to the last ldns_pkt that was sent by the server in the AXFR transfer
- * uasable for instance to get the error code on failure
+ * usable for instance to get the error code on failure
  * \param[in] res the resolver that was used in the axfr transfer
  * \return ldns_pkt the last packet sent
  */
diff --git a/contrib/ldns/ldns/rr.h b/contrib/ldns/ldns/rr.h
index 5c53f8293f8fa3..44d54121f4d5a5 100644
--- a/contrib/ldns/ldns/rr.h
+++ b/contrib/ldns/ldns/rr.h
@@ -36,9 +36,6 @@ extern "C" {
 /** The bytes TTL, CLASS and length use up in an rr */
 #define LDNS_RR_OVERHEAD	10
 
-/* The first fields are contiguous and can be referenced instantly */
-#define LDNS_RDATA_FIELD_DESCRIPTORS_COMMON 259
-
 
 
 /**
@@ -159,7 +156,7 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_DNAME = 39,
 	/**  dnsind-kitchen-sink-02.txt */
 	LDNS_RR_TYPE_SINK = 40,
-	/**  Pseudo OPT record... */
+	/**  OPT record RFC 6891 */
 	LDNS_RR_TYPE_OPT = 41,
 	/**  RFC3123 */
 	LDNS_RR_TYPE_APL = 42,
@@ -180,7 +177,7 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_NSEC3PARAM = 51, /* RFC 5155 */
 	LDNS_RR_TYPE_NSEC3PARAMS = 51,
 	LDNS_RR_TYPE_TLSA = 52, /* RFC 6698 */
-	LDNS_RR_TYPE_SMIMEA = 53, /* draft-ietf-dane-smime */
+	LDNS_RR_TYPE_SMIMEA = 53, /* RFC 8162 */
 
 	LDNS_RR_TYPE_HIP = 55, /* RFC 5205 */
 
@@ -194,6 +191,9 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_CDNSKEY = 60, /* RFC 7344 */
 	LDNS_RR_TYPE_OPENPGPKEY = 61, /* RFC 7929 */
 	LDNS_RR_TYPE_CSYNC = 62, /* RFC 7477 */
+	LDNS_RR_TYPE_ZONEMD = 63, /* draft-ietf-dnsop-dns-zone-digest */
+	LDNS_RR_TYPE_SVCB = 64, /* draft-ietf-dnsop-svcb-https */
+	LDNS_RR_TYPE_HTTPS = 65, /* draft-ietf-dnsop-svcb-https */
 
 	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */
 
@@ -223,6 +223,10 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_URI = 256, /* RFC 7553 */
 	LDNS_RR_TYPE_CAA = 257, /* RFC 6844 */
 	LDNS_RR_TYPE_AVC = 258, /* Cisco's DNS-AS RR, see www.dns-as.org */
+	LDNS_RR_TYPE_DOA = 259, /* draft-durand-doa-over-dns */
+
+	/** draft-ietf-mboned-driad-amt-discovery **/
+	LDNS_RR_TYPE_AMTRELAY = 260,
 
 	/** DNSSEC Trust Authorities */
 	LDNS_RR_TYPE_TA = 32768,
@@ -238,6 +242,9 @@ enum ldns_enum_rr_type
 };
 typedef enum ldns_enum_rr_type ldns_rr_type;
 
+/* The first fields are contiguous and can be referenced instantly */
+#define LDNS_RDATA_FIELD_DESCRIPTORS_COMMON (LDNS_RR_TYPE_AMTRELAY + 1)
+
 /**
  * Resource Record
  *
@@ -520,7 +527,7 @@ void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class);
  * \param[in] *rr the rr to operate on
  * \param[in] *f the rdf to set
  * \param[in] position the position the set the rdf
- * \return  the old value in the rr, NULL on failyre
+ * \return  the old value in the rr, NULL on failure
  */
 ldns_rdf* ldns_rr_set_rdf(ldns_rr *rr, const ldns_rdf *f, size_t position);
 
@@ -810,7 +817,7 @@ int ldns_rr_compare_wire(const ldns_buffer *rr1_buf, const ldns_buffer *rr2_buf)
 bool ldns_rr_compare_ds(const ldns_rr *rr1, const ldns_rr *rr2);
 
 /**
- * compares two rr listss.
+ * compares two rr lists.
  * \param[in] rrl1 the first one
  * \param[in] rrl2 the second one
  * \return 0 if equal
diff --git a/contrib/ldns/ldns/rr_functions.h b/contrib/ldns/ldns/rr_functions.h
index 09a28dd7f8796b..5a84d40b1358ea 100644
--- a/contrib/ldns/ldns/rr_functions.h
+++ b/contrib/ldns/ldns/rr_functions.h
@@ -121,9 +121,9 @@ bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f);
  */
 ldns_rdf* ldns_rr_rrsig_expiration(const ldns_rr *r);
 /**
- * sets the expireation date of a LDNS_RR_TYPE_RRSIG rr
+ * sets the expiration date of a LDNS_RR_TYPE_RRSIG rr
  * \param[in] r the rr to use
- * \param[in] f the expireation date to set
+ * \param[in] f the expiration date to set
  * \return true on success, false otherwise
  */
 bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f);
diff --git a/contrib/ldns/ldns/sha1.h b/contrib/ldns/ldns/sha1.h
index d5b1082e670f4a..bc98411209651f 100644
--- a/contrib/ldns/ldns/sha1.h
+++ b/contrib/ldns/ldns/sha1.h
@@ -1,6 +1,13 @@
 #ifndef LDNS_SHA1_H
 #define LDNS_SHA1_H
 
+#include <stdint.h>  /* uint32_t and friends */
+#include <stddef.h>  /* size_t and NULL */
+
+#if LDNS_BUILD_CONFIG_HAVE_INTTYPES_H
+# include <inttypes.h>
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -29,7 +36,7 @@ void ldns_sha1_final(unsigned char digest[LDNS_SHA1_DIGEST_LENGTH], ldns_sha1_ct
  *             available
  * \return the SHA1 digest of the given data
  */
-unsigned char *ldns_sha1(unsigned char *data, unsigned int data_len, unsigned char *digest);
+unsigned char *ldns_sha1(const unsigned char *data, unsigned int data_len, unsigned char *digest);
 
 #ifdef __cplusplus
 }
diff --git a/contrib/ldns/ldns/sha2.h b/contrib/ldns/ldns/sha2.h
index 238767af45f030..c3c1f1a0962310 100644
--- a/contrib/ldns/ldns/sha2.h
+++ b/contrib/ldns/ldns/sha2.h
@@ -46,23 +46,16 @@
 #ifndef __LDNS_SHA2_H__
 #define __LDNS_SHA2_H__
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-
-/*
- * Import u_intXX_t size_t type definitions from system headers.  You
- * may need to change this, or define these things yourself in this
- * file.
- */
-#include <sys/types.h>
+#include <stdint.h>  /* uint32_t and friends */
+#include <stddef.h>  /* size_t and NULL */
 
 #if LDNS_BUILD_CONFIG_HAVE_INTTYPES_H
+# include <inttypes.h>
+#endif
 
-#include <inttypes.h>
-
-#endif /* LDNS_BUILD_CONFIG_HAVE_INTTYPES_H */
+#ifdef __cplusplus
+extern "C" {
+#endif
 
 
 /*** SHA-256/384/512 Various Length Definitions ***********************/
@@ -116,7 +109,7 @@ void ldns_sha512_final(uint8_t[LDNS_SHA512_DIGEST_LENGTH], ldns_sha512_CTX*);
  *             available
  * \return the SHA1 digest of the given data
  */
-unsigned char *ldns_sha256(unsigned char *data, unsigned int data_len, unsigned char *digest);
+unsigned char *ldns_sha256(const unsigned char *data, unsigned int data_len, unsigned char *digest);
 
 /**
  * Convenience function to digest a fixed block of data at once.
@@ -128,7 +121,7 @@ unsigned char *ldns_sha256(unsigned char *data, unsigned int data_len, unsigned
  *             available
  * \return the SHA1 digest of the given data
  */
-unsigned char *ldns_sha384(unsigned char *data, unsigned int data_len, unsigned char *digest);
+unsigned char *ldns_sha384(const unsigned char *data, unsigned int data_len, unsigned char *digest);
 
 /**
  * Convenience function to digest a fixed block of data at once.
@@ -140,7 +133,7 @@ unsigned char *ldns_sha384(unsigned char *data, unsigned int data_len, unsigned
  *             available
  * \return the SHA1 digest of the given data
  */
-unsigned char *ldns_sha512(unsigned char *data, unsigned int data_len, unsigned char *digest);
+unsigned char *ldns_sha512(const unsigned char *data, unsigned int data_len, unsigned char *digest);
 
 #ifdef	__cplusplus
 }
diff --git a/contrib/ldns/ldns/str2host.h b/contrib/ldns/ldns/str2host.h
index d639970546ad68..2892db0bfb1cad 100644
--- a/contrib/ldns/ldns/str2host.h
+++ b/contrib/ldns/ldns/str2host.h
@@ -32,7 +32,7 @@ extern "C" {
 
 /**
  * convert a byte into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] bytestr the string to be converted
  * \return ldns_status
  */
@@ -40,7 +40,7 @@ ldns_status ldns_str2rdf_int8(ldns_rdf **rd, const char *bytestr);
 
 /**
  * convert a string to a int16 in wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] shortstr the string to be converted
  * \return ldns_status
  */
@@ -48,7 +48,7 @@ ldns_status ldns_str2rdf_int16(ldns_rdf **rd, const char *shortstr);
 
 /**
  * convert a strings into a 4 byte int in wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] longstr the string to be converted
  * \return ldns_status
  */
@@ -56,21 +56,21 @@ ldns_status ldns_str2rdf_int32(ldns_rdf **rd, const char *longstr);
 
 /**
  * convert a time string to a time value in wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] time the string to be converted
  * \return ldns_status
  */
 ldns_status ldns_str2rdf_time(ldns_rdf **rd, const char *time);
 
 /* convert string with NSEC3 salt to wireformat) 
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * return ldns_status
  */
 ldns_status ldns_str2rdf_nsec3_salt(ldns_rdf **rd, const char *nsec3_salt);
 
 /* convert a time period (think TTL's) to wireformat) 
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * return ldns_status
  */
@@ -78,7 +78,7 @@ ldns_status ldns_str2rdf_period(ldns_rdf **rd, const char *str);
 
 /**
  * convert str with an A record into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -86,7 +86,7 @@ ldns_status ldns_str2rdf_a(ldns_rdf **rd, const char *str);
 
 /**
  * convert the str with an AAAA record into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -94,7 +94,7 @@ ldns_status ldns_str2rdf_aaaa(ldns_rdf **rd, const char *str);
 
 /**
  * convert a string into wireformat (think txt record)
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted (NULL terminated)
  * \return ldns_status
  */
@@ -102,7 +102,7 @@ ldns_status ldns_str2rdf_str(ldns_rdf **rd, const char *str);
 
 /**
  * convert str with the apl record into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -110,7 +110,7 @@ ldns_status ldns_str2rdf_apl(ldns_rdf **rd, const char *str);
 
 /**
  * convert the string with the b64 data into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -118,7 +118,7 @@ ldns_status ldns_str2rdf_b64(ldns_rdf **rd, const char *str);
 
 /**
  * convert the string with the b32 ext hex data into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -126,7 +126,7 @@ ldns_status ldns_str2rdf_b32_ext(ldns_rdf **rd, const char *str);
 
 /**
  * convert a hex value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -134,7 +134,7 @@ ldns_status ldns_str2rdf_hex(ldns_rdf **rd, const char *str);
 
 /**
  * convert string with nsec into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -142,7 +142,7 @@ ldns_status ldns_str2rdf_nsec(ldns_rdf **rd, const char *str);
 
 /**
  * convert a rrtype into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -150,7 +150,7 @@ ldns_status ldns_str2rdf_type(ldns_rdf **rd, const char *str);
 
 /**
  * convert string with a classname into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -158,7 +158,7 @@ ldns_status ldns_str2rdf_class(ldns_rdf **rd, const char *str);
 
 /**
  * convert an certificate algorithm value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -166,7 +166,7 @@ ldns_status ldns_str2rdf_cert_alg(ldns_rdf **rd, const char *str);
 
 /**
  * convert an algorithm value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -174,7 +174,7 @@ ldns_status ldns_str2rdf_alg(ldns_rdf **rd, const char *str);
 
 /**
  * convert a tlsa certificate usage value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -182,7 +182,7 @@ ldns_status ldns_str2rdf_certificate_usage(ldns_rdf **rd, const char *str);
 
 /**
  * convert a tlsa selector value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -190,7 +190,7 @@ ldns_status ldns_str2rdf_selector(ldns_rdf **rd, const char *str);
 
 /**
  * convert a tlsa matching type value into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -198,7 +198,7 @@ ldns_status ldns_str2rdf_matching_type(ldns_rdf **rd, const char *str);
 
 /**
  * convert a string with a unknown RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -206,7 +206,7 @@ ldns_status ldns_str2rdf_unknown(ldns_rdf **rd, const char *str);
 
 /**
  * convert string with a protocol service into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -214,7 +214,7 @@ ldns_status ldns_str2rdf_service(ldns_rdf **rd, const char *str);
 
 /**
  * convert a string with a LOC RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -222,7 +222,7 @@ ldns_status ldns_str2rdf_loc(ldns_rdf **rd, const char *str);
 
 /**
  * convert string with a WKS RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -230,7 +230,7 @@ ldns_status ldns_str2rdf_wks(ldns_rdf **rd, const char *str);
 
 /**
  * convert a str with a NSAP RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -238,7 +238,7 @@ ldns_status ldns_str2rdf_nsap(ldns_rdf **rd, const char *str);
 
 /**
  * convert a str with a ATMA RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -246,7 +246,7 @@ ldns_status ldns_str2rdf_atma(ldns_rdf **rd, const char *str);
 
 /**
  * convert a str with a IPSECKEY RR into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -254,7 +254,7 @@ ldns_status ldns_str2rdf_ipseckey(ldns_rdf **rd, const char *str);
 
 /**
  * convert a dname string into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -262,7 +262,7 @@ ldns_status ldns_str2rdf_dname(ldns_rdf **rd, const char *str);
 
 /**
  * convert 4 * 16bit hex separated by colons into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -270,7 +270,7 @@ ldns_status ldns_str2rdf_ilnp64(ldns_rdf **rd, const char *str);
 
 /**
  * convert 6 hex bytes separated by dashes into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -278,7 +278,7 @@ ldns_status ldns_str2rdf_eui48(ldns_rdf **rd, const char *str);
 
 /**
  * convert 8 hex bytes separated by dashes into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -286,7 +286,7 @@ ldns_status ldns_str2rdf_eui64(ldns_rdf **rd, const char *str);
 
 /**
  * Convert a non-zero sequence of US-ASCII letters and numbers into wireformat
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -295,7 +295,7 @@ ldns_status ldns_str2rdf_tag(ldns_rdf **rd, const char *str);
 /**
  * Convert a <character-string> encoding of the value field as specified 
  * [RFC1035], Section 5.1., encoded as one bug chunk of data.
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
@@ -305,12 +305,32 @@ ldns_status ldns_str2rdf_long_str(ldns_rdf **rd, const char *str);
  * Convert a "<algorithm> <hit> <pk>" encoding of the value field as specified 
  * in Section 6. of [RFC5205], encoded as wireformat as specified in Section 5.
  * of [RFC5205].
- * \param[in] rd the rdf where to put the data
+ * \param[out] rd the rdf where to put the data
  * \param[in] str the string to be converted
  * \return ldns_status
  */
 ldns_status ldns_str2rdf_hip(ldns_rdf **rd, const char *str);
 
+/**
+ * Convert a "<precedence> <D-bit> <type> <relay>" encoding
+ * of the value field as specified in Section  4.3.1 of
+ * [draft-ietf-mboned-driad-amt-discovery], encoded as wireformat as specified in
+ * Section 4.2 of [draft-ietf-mboned-driad-amt-discovery]
+ * \param[out] rd the rdf where to put the data
+ * \param[in] str the string to be converted
+ * \return ldns_status
+ */
+ldns_status ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str);
+
+/**
+ * Convert a series of "key[=<value>]" encodings to wireformat as described in
+ * [draft-ietf-dnsop-svcb-https].
+ * \param[out] rd the rdf where to put the data
+ * \param[in] str the string to be converted
+ * \return ldns_status
+ */
+ldns_status ldns_str2rdf_svcparams(ldns_rdf **rd, const char *str);
+
 
 #ifdef __cplusplus
 }
diff --git a/contrib/ldns/ldns/update.h b/contrib/ldns/ldns/update.h
index 414aff73c07ea7..8840d384270201 100644
--- a/contrib/ldns/ldns/update.h
+++ b/contrib/ldns/ldns/update.h
@@ -42,7 +42,7 @@ ldns_pkt *ldns_update_pkt_new(ldns_rdf *zone_rdf, ldns_rr_class clas, const ldns
  * \param[in] p packet to copy to
  * \param[in] r resolver to copy from
  *
- * \return status wether successfull or not
+ * \return status whether successful or not
  */
 ldns_status ldns_update_pkt_tsig_add(ldns_pkt *p, const ldns_resolver *r);
 
diff --git a/contrib/ldns/ldns/util.h b/contrib/ldns/ldns/util.h
index be7f8241eaa9f4..1d8fa8836a332e 100644
--- a/contrib/ldns/ldns/util.h
+++ b/contrib/ldns/ldns/util.h
@@ -27,8 +27,8 @@ extern "C" {
 #define dprintf(X,Y) fprintf(stderr, (X), (Y))
 /* #define	dprintf(X, Y)  */
 
-#define LDNS_VERSION "1.7.0"
-#define LDNS_REVISION ((1<<16)|(7<<8)|(0))
+#define LDNS_VERSION "1.8.3"
+#define LDNS_REVISION ((1<<16)|(8<<8)|(3))
 
 /**
  * splint static inline workaround
@@ -274,19 +274,22 @@ time_t mktime_from_utc(const struct tm *tm);
 
 /**
  * The function interprets time as the number of seconds since epoch
- * with respect to now using serial arithmitics (rfc1982).
+ * with respect to now using serial arithmetics (rfc1982).
  * That number of seconds is then converted to broken-out time information.
  * This is especially useful when converting the inception and expiration
  * fields of RRSIG records.
  *
  * \param[in] time number of seconds since epoch (midnight, January 1st, 1970)
- *            to be intepreted as a serial arithmitics number relative to now.
+ *            to be interpreted as a serial arithmetics number relative to now.
  * \param[in] now number of seconds since epoch (midnight, January 1st, 1970)
  *            to which the time value is compared to determine the final value.
  * \param[out] result the struct with the broken-out time information
  * \return result on success or NULL on error
  */
-struct tm * ldns_serial_arithmitics_gmtime_r(int32_t time, time_t now, struct tm *result);
+struct tm * ldns_serial_arithmetics_gmtime_r(int32_t time, time_t now, struct tm *result);
+
+/* previously used wrong spelling */
+#define ldns_serial_arithmitics_gmtime_r ldns_serial_arithmetics_gmtime_r
  
 /**
  * Seed the random function.
diff --git a/contrib/ldns/ldns/util.h.in b/contrib/ldns/ldns/util.h.in
index 514fcf3bb434d0..7115a2b7f3bfee 100644
--- a/contrib/ldns/ldns/util.h.in
+++ b/contrib/ldns/ldns/util.h.in
@@ -274,19 +274,22 @@ time_t mktime_from_utc(const struct tm *tm);
 
 /**
  * The function interprets time as the number of seconds since epoch
- * with respect to now using serial arithmitics (rfc1982).
+ * with respect to now using serial arithmetics (rfc1982).
  * That number of seconds is then converted to broken-out time information.
  * This is especially useful when converting the inception and expiration
  * fields of RRSIG records.
  *
  * \param[in] time number of seconds since epoch (midnight, January 1st, 1970)
- *            to be intepreted as a serial arithmitics number relative to now.
+ *            to be interpreted as a serial arithmetics number relative to now.
  * \param[in] now number of seconds since epoch (midnight, January 1st, 1970)
  *            to which the time value is compared to determine the final value.
  * \param[out] result the struct with the broken-out time information
  * \return result on success or NULL on error
  */
-struct tm * ldns_serial_arithmitics_gmtime_r(int32_t time, time_t now, struct tm *result);
+struct tm * ldns_serial_arithmetics_gmtime_r(int32_t time, time_t now, struct tm *result);
+
+/* previously used wrong spelling */
+#define ldns_serial_arithmitics_gmtime_r ldns_serial_arithmetics_gmtime_r
  
 /**
  * Seed the random function.
diff --git a/contrib/ldns/ldns/wire2host.h b/contrib/ldns/ldns/wire2host.h
index 6a7999c31d7282..67b385c163aadd 100644
--- a/contrib/ldns/ldns/wire2host.h
+++ b/contrib/ldns/ldns/wire2host.h
@@ -118,7 +118,7 @@ extern "C" {
  * This function will initialize and allocate memory space for the packet 
  * structure.
  * 
- * \param[in] packet pointer to the structure to hold the packet
+ * \param[out] packet pointer to the structure to hold the packet
  * \param[in] data pointer to the buffer with the data
  * \param[in] len the length of the data buffer (in bytes)
  * \return LDNS_STATUS_OK if everything succeeds, error otherwise
@@ -130,7 +130,7 @@ ldns_status ldns_wire2pkt(ldns_pkt **packet, const uint8_t *data, size_t len);
  * This function will initialize and allocate memory space for the packet 
  * structure.
  * 
- * \param[in] packet pointer to the structure to hold the packet
+ * \param[out] packet pointer to the structure to hold the packet
  * \param[in] buffer the buffer with the data
  * \return LDNS_STATUS_OK if everything succeeds, error otherwise
  */
@@ -142,7 +142,7 @@ ldns_status ldns_buffer2pkt_wire(ldns_pkt **packet, const ldns_buffer *buffer);
  * space for the dname structure. The length of the wiredata of this rdf 
  * is added to the *pos value.
  *
- * \param[in] dname pointer to the structure to hold the rdata value
+ * \param[out] dname pointer to the structure to hold the rdata value
  * \param[in] wire pointer to the buffer with the data
  * \param[in] max the length of the data buffer (in bytes)
  * \param[in] pos the position of the rdf in the buffer (ie. the number of bytes 
@@ -177,7 +177,7 @@ ldns_status ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *
  * structure.
  * The length of the wiredata of this rr is added to the *pos value.
  * 
- * \param[in] rr pointer to the structure to hold the rdata value
+ * \param[out] rr pointer to the structure to hold the rdata value
  * \param[in] wire pointer to the buffer with the data
  * \param[in] max the length of the data buffer (in bytes)
  * \param[in] pos the position of the rr in the buffer (ie. the number of bytes 
diff --git a/contrib/ldns/ldns/zone.h b/contrib/ldns/ldns/zone.h
index f51b6bc0ebc1cc..805661f878f7e1 100644
--- a/contrib/ldns/ldns/zone.h
+++ b/contrib/ldns/ldns/zone.h
@@ -43,7 +43,7 @@ struct ldns_struct_zone
 {
 	/** the soa defines a zone */
 	ldns_rr 	*_soa;
-	/* basicly a zone is a list of rr's */
+	/* basically a zone is a list of rr's */
 	ldns_rr_list 	*_rrs;
 	/* we could change this to be a b-tree etc etc todo */
 };
@@ -97,7 +97,7 @@ void ldns_zone_set_rrs(ldns_zone *z, ldns_rr_list *rrlist);
  * copying, so the rr_list structure inside z is modified!
  * \param[in] z the zone to add to
  * \param[in] list the list to add
- * \return a true on succes otherwise falsed
+ * \return a true on success otherwise false
  */
 bool ldns_zone_push_rr_list(ldns_zone *z, const ldns_rr_list *list);
 
@@ -106,7 +106,7 @@ bool ldns_zone_push_rr_list(ldns_zone *z, const ldns_rr_list *list);
  * copying, so the rr_list structure inside z is modified!
  * \param[in] z the zone to add to
  * \param[in] rr the rr to add
- * \return a true on succes otherwise falsed
+ * \return a true on success otherwise false
  */
 bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr);
 
diff --git a/contrib/ldns/libdns.doxygen b/contrib/ldns/libdns.doxygen.in
similarity index 87%
rename from contrib/ldns/libdns.doxygen
rename to contrib/ldns/libdns.doxygen.in
index 014baa28caa326..c83cdf4c219117 100644
--- a/contrib/ldns/libdns.doxygen
+++ b/contrib/ldns/libdns.doxygen.in
@@ -1,4 +1,4 @@
-# Doxyfile 1.8.11
+# Doxyfile 1.9.1
 
 # This file describes the settings to be used by the documentation system
 # doxygen (www.doxygen.org) for a project.
@@ -17,11 +17,11 @@
 # Project related configuration options
 #---------------------------------------------------------------------------
 
-# This tag specifies the encoding used for all characters in the config file
-# that follow. The default is UTF-8 which is also the encoding used for all text
-# before the first occurrence of this tag. Doxygen uses libiconv (or the iconv
-# built into libc) for the transcoding. See http://www.gnu.org/software/libiconv
-# for the list of possible encodings.
+# This tag specifies the encoding used for all characters in the configuration
+# file that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# https://www.gnu.org/software/libiconv/ for the list of possible encodings.
 # The default value is: UTF-8.
 
 DOXYFILE_ENCODING      = UTF-8
@@ -32,13 +32,13 @@ DOXYFILE_ENCODING      = UTF-8
 # title of most generated pages and in a few other places.
 # The default value is: My Project.
 
-PROJECT_NAME           = ldns
+PROJECT_NAME           = @PACKAGE_NAME@
 
 # The PROJECT_NUMBER tag can be used to enter a project or revision number. This
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 1.7.0
+PROJECT_NUMBER         = @PACKAGE_VERSION@
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -93,6 +93,14 @@ ALLOW_UNICODE_NAMES    = NO
 
 OUTPUT_LANGUAGE        = English
 
+# The OUTPUT_TEXT_DIRECTION tag is used to specify the direction in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all generated output in the proper direction.
+# Possible values are: None, LTR, RTL and Context.
+# The default value is: None.
+
+OUTPUT_TEXT_DIRECTION  = None
+
 # If the BRIEF_MEMBER_DESC tag is set to YES, doxygen will include brief member
 # descriptions after the members that are listed in the file and class
 # documentation (similar to Javadoc). Set to NO to disable this.
@@ -179,6 +187,16 @@ SHORT_NAMES            = NO
 
 JAVADOC_AUTOBRIEF      = YES
 
+# If the JAVADOC_BANNER tag is set to YES then doxygen will interpret a line
+# such as
+# /***************
+# as being the beginning of a Javadoc-style comment "banner". If set to NO, the
+# Javadoc-style will behave just like regular comments and it will not be
+# interpreted by doxygen.
+# The default value is: NO.
+
+JAVADOC_BANNER         = NO
+
 # If the QT_AUTOBRIEF tag is set to YES then doxygen will interpret the first
 # line (until the first dot) of a Qt-style comment as the brief description. If
 # set to NO, the Qt-style will behave just like regular Qt-style comments (thus
@@ -199,6 +217,14 @@ QT_AUTOBRIEF           = NO
 
 MULTILINE_CPP_IS_BRIEF = NO
 
+# By default Python docstrings are displayed as preformatted text and doxygen's
+# special commands cannot be used. By setting PYTHON_DOCSTRING to NO the
+# doxygen's special commands can be used and the contents of the docstring
+# documentation blocks is shown as doxygen documentation.
+# The default value is: YES.
+
+PYTHON_DOCSTRING       = YES
+
 # If the INHERIT_DOCS tag is set to YES then an undocumented member inherits the
 # documentation from any documented member that it re-implements.
 # The default value is: YES.
@@ -226,16 +252,15 @@ TAB_SIZE               = 8
 # will allow you to put the command \sideeffect (or @sideeffect) in the
 # documentation, which will result in a user-defined paragraph with heading
 # "Side Effects:". You can put \n's in the value part of an alias to insert
-# newlines.
+# newlines (in the resulting output). You can put ^^ in the value part of an
+# alias to insert a newline as if a physical newline was in the original file.
+# When you need a literal { or } or , in the value part of an alias you have to
+# escape them by means of a backslash (\), this can lead to conflicts with the
+# commands \{ and \} for these it is advised to use the version @{ and @} or use
+# a double escape (\\{ and \\})
 
 ALIASES                =
 
-# This tag can be used to specify a number of word-keyword mappings (TCL only).
-# A mapping has the form "name=value". For example adding "class=itcl::class"
-# will allow you to use the command class in the itcl::class meaning.
-
-TCL_SUBST              =
-
 # Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C sources
 # only. Doxygen will then generate output that is more tailored for C. For
 # instance, some of the names that are used will be different. The list of all
@@ -264,28 +289,40 @@ OPTIMIZE_FOR_FORTRAN   = NO
 
 OPTIMIZE_OUTPUT_VHDL   = NO
 
+# Set the OPTIMIZE_OUTPUT_SLICE tag to YES if your project consists of Slice
+# sources only. Doxygen will then generate output that is more tailored for that
+# language. For instance, namespaces will be presented as modules, types will be
+# separated into more groups, etc.
+# The default value is: NO.
+
+OPTIMIZE_OUTPUT_SLICE  = NO
+
 # Doxygen selects the parser to use depending on the extension of the files it
 # parses. With this tag you can assign which parser to use for a given
 # extension. Doxygen has a built-in mapping, but you can override or extend it
 # using this tag. The format is ext=language, where ext is a file extension, and
-# language is one of the parsers supported by doxygen: IDL, Java, Javascript,
-# C#, C, C++, D, PHP, Objective-C, Python, Fortran (fixed format Fortran:
-# FortranFixed, free formatted Fortran: FortranFree, unknown formatted Fortran:
-# Fortran. In the later case the parser tries to guess whether the code is fixed
-# or free formatted code, this is the default for Fortran type files), VHDL. For
-# instance to make doxygen treat .inc files as Fortran files (default is PHP),
-# and .f files as C (default is Fortran), use: inc=Fortran f=C.
+# language is one of the parsers supported by doxygen: IDL, Java, JavaScript,
+# Csharp (C#), C, C++, D, PHP, md (Markdown), Objective-C, Python, Slice, VHDL,
+# Fortran (fixed format Fortran: FortranFixed, free formatted Fortran:
+# FortranFree, unknown formatted Fortran: Fortran. In the later case the parser
+# tries to guess whether the code is fixed or free formatted code, this is the
+# default for Fortran type files). For instance to make doxygen treat .inc files
+# as Fortran files (default is PHP), and .f files as C (default is Fortran),
+# use: inc=Fortran f=C.
 #
 # Note: For files without extension you can use no_extension as a placeholder.
 #
 # Note that for custom extensions you also need to set FILE_PATTERNS otherwise
-# the files are not read by doxygen.
+# the files are not read by doxygen. When specifying no_extension you should add
+# * to the FILE_PATTERNS.
+#
+# Note see also the list of default file extension mappings.
 
 EXTENSION_MAPPING      =
 
 # If the MARKDOWN_SUPPORT tag is enabled then doxygen pre-processes all comments
 # according to the Markdown format, which allows for more readable
-# documentation. See http://daringfireball.net/projects/markdown/ for details.
+# documentation. See https://daringfireball.net/projects/markdown/ for details.
 # The output of markdown processing is further processed by doxygen, so you can
 # mix doxygen, HTML, and XML commands with Markdown formatting. Disable only in
 # case of backward compatibilities issues.
@@ -293,6 +330,15 @@ EXTENSION_MAPPING      =
 
 MARKDOWN_SUPPORT       = YES
 
+# When the TOC_INCLUDE_HEADINGS tag is set to a non-zero value, all headings up
+# to that level are automatically included in the table of contents, even if
+# they do not have an id attribute.
+# Note: This feature currently applies only to Markdown headings.
+# Minimum value: 0, maximum value: 99, default value: 5.
+# This tag requires that the tag MARKDOWN_SUPPORT is set to YES.
+
+TOC_INCLUDE_HEADINGS   = 5
+
 # When enabled doxygen tries to link words that correspond to documented
 # classes, or namespaces to their corresponding documentation. Such a link can
 # be prevented in individual cases by putting a % sign in front of the word or
@@ -318,7 +364,7 @@ BUILTIN_STL_SUPPORT    = NO
 CPP_CLI_SUPPORT        = NO
 
 # Set the SIP_SUPPORT tag to YES if your project consists of sip (see:
-# http://www.riverbankcomputing.co.uk/software/sip/intro) sources only. Doxygen
+# https://www.riverbankcomputing.com/software/sip/intro) sources only. Doxygen
 # will parse them like normal C++ but will assume all classes use public instead
 # of private inheritance when no explicit protection keyword is present.
 # The default value is: NO.
@@ -404,6 +450,19 @@ TYPEDEF_HIDES_STRUCT   = NO
 
 LOOKUP_CACHE_SIZE      = 0
 
+# The NUM_PROC_THREADS specifies the number threads doxygen is allowed to use
+# during processing. When set to 0 doxygen will based this on the number of
+# cores available in the system. You can set it explicitly to a value larger
+# than 0 to get more control over the balance between CPU load and processing
+# speed. At this moment only the input processing can be done using multiple
+# threads. Since this is still an experimental feature the default is set to 1,
+# which efficively disables parallel processing. Please report any issues you
+# encounter. Generating dot graphs in parallel is controlled by the
+# DOT_NUM_THREADS setting.
+# Minimum value: 0, maximum value: 32, default value: 1.
+
+NUM_PROC_THREADS       = 1
+
 #---------------------------------------------------------------------------
 # Build related configuration options
 #---------------------------------------------------------------------------
@@ -424,6 +483,12 @@ EXTRACT_ALL            = YES
 
 EXTRACT_PRIVATE        = NO
 
+# If the EXTRACT_PRIV_VIRTUAL tag is set to YES, documented private virtual
+# methods of a class will be included in the documentation.
+# The default value is: NO.
+
+EXTRACT_PRIV_VIRTUAL   = NO
+
 # If the EXTRACT_PACKAGE tag is set to YES, all members with package or internal
 # scope will be included in the documentation.
 # The default value is: NO.
@@ -461,6 +526,13 @@ EXTRACT_LOCAL_METHODS  = NO
 
 EXTRACT_ANON_NSPACES   = NO
 
+# If this flag is set to YES, the name of an unnamed parameter in a declaration
+# will be determined by the corresponding definition. By default unnamed
+# parameters remain unnamed in the output.
+# The default value is: YES.
+
+RESOLVE_UNNAMED_PARAMS = YES
+
 # If the HIDE_UNDOC_MEMBERS tag is set to YES, doxygen will hide all
 # undocumented members inside documented classes or files. If set to NO these
 # members will be included in the various overviews, but no documentation
@@ -478,8 +550,8 @@ HIDE_UNDOC_MEMBERS     = NO
 HIDE_UNDOC_CLASSES     = NO
 
 # If the HIDE_FRIEND_COMPOUNDS tag is set to YES, doxygen will hide all friend
-# (class|struct|union) declarations. If set to NO, these declarations will be
-# included in the documentation.
+# declarations. If set to NO, these declarations will be included in the
+# documentation.
 # The default value is: NO.
 
 HIDE_FRIEND_COMPOUNDS  = NO
@@ -498,11 +570,18 @@ HIDE_IN_BODY_DOCS      = NO
 
 INTERNAL_DOCS          = NO
 
-# If the CASE_SENSE_NAMES tag is set to NO then doxygen will only generate file
-# names in lower-case letters. If set to YES, upper-case letters are also
-# allowed. This is useful if you have classes or files whose names only differ
-# in case and if your file system supports case sensitive file names. Windows
-# and Mac users are advised to set this option to NO.
+# With the correct setting of option CASE_SENSE_NAMES doxygen will better be
+# able to match the capabilities of the underlying filesystem. In case the
+# filesystem is case sensitive (i.e. it supports files in the same directory
+# whose names only differ in casing), the option must be set to YES to properly
+# deal with such files in case they appear in the input. For filesystems that
+# are not case sensitive the option should be be set to NO to properly deal with
+# output files written for symbols that only differ in casing, such as for two
+# classes, one named CLASS and the other named Class, and to also support
+# references to files without having to specify the exact matching casing. On
+# Windows (including Cygwin) and MacOS, users should typically set this option
+# to NO, whereas on Linux or other Unix flavors it should typically be set to
+# YES.
 # The default value is: system dependent.
 
 CASE_SENSE_NAMES       = YES
@@ -689,7 +768,7 @@ LAYOUT_FILE            =
 # The CITE_BIB_FILES tag can be used to specify one or more bib files containing
 # the reference definitions. This must be a list of .bib files. The .bib
 # extension is automatically appended if omitted. This requires the bibtex tool
-# to be installed. See also http://en.wikipedia.org/wiki/BibTeX for more info.
+# to be installed. See also https://en.wikipedia.org/wiki/BibTeX for more info.
 # For LaTeX the style of the bibliography can be controlled using
 # LATEX_BIB_STYLE. To use this feature you need bibtex and perl available in the
 # search path. See also \cite for info how to create references.
@@ -734,13 +813,17 @@ WARN_IF_DOC_ERROR      = YES
 # This WARN_NO_PARAMDOC option can be enabled to get warnings for functions that
 # are documented, but have no documentation for their parameters or return
 # value. If set to NO, doxygen will only warn about wrong or incomplete
-# parameter documentation, but not about the absence of documentation.
+# parameter documentation, but not about the absence of documentation. If
+# EXTRACT_ALL is set to YES then this flag will automatically be disabled.
 # The default value is: NO.
 
 WARN_NO_PARAMDOC       = NO
 
 # If the WARN_AS_ERROR tag is set to YES then doxygen will immediately stop when
-# a warning is encountered.
+# a warning is encountered. If the WARN_AS_ERROR tag is set to FAIL_ON_WARNINGS
+# then doxygen will continue running as if WARN_AS_ERROR tag is set to NO, but
+# at the end of the doxygen process doxygen will return with a non-zero status.
+# Possible values are: NO, YES and FAIL_ON_WARNINGS.
 # The default value is: NO.
 
 WARN_AS_ERROR          = NO
@@ -781,8 +864,8 @@ INPUT                  = . \
 # This tag can be used to specify the character encoding of the source files
 # that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses
 # libiconv (or the iconv built into libc) for the transcoding. See the libiconv
-# documentation (see: http://www.gnu.org/software/libiconv) for the list of
-# possible encodings.
+# documentation (see:
+# https://www.gnu.org/software/libiconv/) for the list of possible encodings.
 # The default value is: UTF-8.
 
 INPUT_ENCODING         = UTF-8
@@ -795,11 +878,15 @@ INPUT_ENCODING         = UTF-8
 # need to set EXTENSION_MAPPING for the extension otherwise the files are not
 # read by doxygen.
 #
+# Note the list of default checked file patterns might differ from the list of
+# default file extension mappings.
+#
 # If left blank the following patterns are tested:*.c, *.cc, *.cxx, *.cpp,
 # *.c++, *.java, *.ii, *.ixx, *.ipp, *.i++, *.inl, *.idl, *.ddl, *.odl, *.h,
 # *.hh, *.hxx, *.hpp, *.h++, *.cs, *.d, *.php, *.php4, *.php5, *.phtml, *.inc,
-# *.m, *.markdown, *.md, *.mm, *.dox, *.py, *.pyw, *.f90, *.f, *.for, *.tcl,
-# *.vhd, *.vhdl, *.ucf, *.qsf, *.as and *.js.
+# *.m, *.markdown, *.md, *.mm, *.dox (to be provided as doxygen C comment),
+# *.py, *.pyw, *.f90, *.f95, *.f03, *.f08, *.f18, *.f, *.for, *.vhd, *.vhdl,
+# *.ucf, *.qsf and *.ice.
 
 FILE_PATTERNS          =
 
@@ -954,7 +1041,7 @@ INLINE_SOURCES         = NO
 STRIP_CODE_COMMENTS    = YES
 
 # If the REFERENCED_BY_RELATION tag is set to YES then for each documented
-# function all documented functions referencing it will be listed.
+# entity all documented functions referencing it will be listed.
 # The default value is: NO.
 
 REFERENCED_BY_RELATION = NO
@@ -986,12 +1073,12 @@ SOURCE_TOOLTIPS        = YES
 # If the USE_HTAGS tag is set to YES then the references to source code will
 # point to the HTML generated by the htags(1) tool instead of doxygen built-in
 # source browser. The htags tool is part of GNU's global source tagging system
-# (see http://www.gnu.org/software/global/global.html). You will need version
+# (see https://www.gnu.org/software/global/global.html). You will need version
 # 4.8.6 or higher.
 #
 # To use it do the following:
 # - Install the latest version of global
-# - Enable SOURCE_BROWSER and USE_HTAGS in the config file
+# - Enable SOURCE_BROWSER and USE_HTAGS in the configuration file
 # - Make sure the INPUT points to the root of the source tree
 # - Run doxygen as normal
 #
@@ -1014,16 +1101,22 @@ USE_HTAGS              = NO
 VERBATIM_HEADERS       = YES
 
 # If the CLANG_ASSISTED_PARSING tag is set to YES then doxygen will use the
-# clang parser (see: http://clang.llvm.org/) for more accurate parsing at the
-# cost of reduced performance. This can be particularly helpful with template
-# rich C++ code for which doxygen's built-in parser lacks the necessary type
-# information.
+# clang parser (see:
+# http://clang.llvm.org/) for more accurate parsing at the cost of reduced
+# performance. This can be particularly helpful with template rich C++ code for
+# which doxygen's built-in parser lacks the necessary type information.
 # Note: The availability of this option depends on whether or not doxygen was
-# generated with the -Duse-libclang=ON option for CMake.
+# generated with the -Duse_libclang=ON option for CMake.
 # The default value is: NO.
 
 CLANG_ASSISTED_PARSING = NO
 
+# If clang assisted parsing is enabled and the CLANG_ADD_INC_PATHS tag is set to
+# YES then doxygen will add the directory of each input to the include path.
+# The default value is: YES.
+
+CLANG_ADD_INC_PATHS    = YES
+
 # If clang assisted parsing is enabled you can provide the compiler with command
 # line options that you would normally use when invoking the compiler. Note that
 # the include paths will already be set by doxygen for the files and directories
@@ -1032,6 +1125,19 @@ CLANG_ASSISTED_PARSING = NO
 
 CLANG_OPTIONS          =
 
+# If clang assisted parsing is enabled you can provide the clang parser with the
+# path to the directory containing a file called compile_commands.json. This
+# file is the compilation database (see:
+# http://clang.llvm.org/docs/HowToSetupToolingForLLVM.html) containing the
+# options used when the source files were built. This is equivalent to
+# specifying the -p option to a clang tool, such as clang-check. These options
+# will then be passed to the parser. Any options specified with CLANG_OPTIONS
+# will be added as well.
+# Note: The availability of this option depends on whether or not doxygen was
+# generated with the -Duse_libclang=ON option for CMake.
+
+CLANG_DATABASE_PATH    =
+
 #---------------------------------------------------------------------------
 # Configuration options related to the alphabetical class index
 #---------------------------------------------------------------------------
@@ -1043,13 +1149,6 @@ CLANG_OPTIONS          =
 
 ALPHABETICAL_INDEX     = YES
 
-# The COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns in
-# which the alphabetical index list will be split.
-# Minimum value: 1, maximum value: 20, default value: 5.
-# This tag requires that the tag ALPHABETICAL_INDEX is set to YES.
-
-COLS_IN_ALPHA_INDEX    = 3
-
 # In case all classes in a project start with a common prefix, all classes will
 # be put under the same header in the alphabetical index. The IGNORE_PREFIX tag
 # can be used to specify a prefix (or a list of prefixes) that should be ignored
@@ -1150,7 +1249,7 @@ HTML_EXTRA_FILES       =
 # The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
 # will adjust the colors in the style sheet and background images according to
 # this color. Hue is specified as an angle on a colorwheel, see
-# http://en.wikipedia.org/wiki/Hue for more information. For instance the value
+# https://en.wikipedia.org/wiki/Hue for more information. For instance the value
 # 0 represents red, 60 is yellow, 120 is green, 180 is cyan, 240 is blue, 300
 # purple, and 360 is red again.
 # Minimum value: 0, maximum value: 359, default value: 220.
@@ -1186,6 +1285,17 @@ HTML_COLORSTYLE_GAMMA  = 80
 
 HTML_TIMESTAMP         = YES
 
+# If the HTML_DYNAMIC_MENUS tag is set to YES then the generated HTML
+# documentation will contain a main index with vertical navigation menus that
+# are dynamically created via JavaScript. If disabled, the navigation index will
+# consists of multiple levels of tabs that are statically embedded in every HTML
+# page. Disable this option to support browsers that do not have JavaScript,
+# like the Qt help browser.
+# The default value is: YES.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_DYNAMIC_MENUS     = YES
+
 # If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
 # documentation will contain sections that can be hidden and shown after the
 # page has loaded.
@@ -1209,13 +1319,14 @@ HTML_INDEX_NUM_ENTRIES = 100
 
 # If the GENERATE_DOCSET tag is set to YES, additional index files will be
 # generated that can be used as input for Apple's Xcode 3 integrated development
-# environment (see: http://developer.apple.com/tools/xcode/), introduced with
-# OSX 10.5 (Leopard). To create a documentation set, doxygen will generate a
-# Makefile in the HTML output directory. Running make will produce the docset in
-# that directory and running make install will install the docset in
+# environment (see:
+# https://developer.apple.com/xcode/), introduced with OSX 10.5 (Leopard). To
+# create a documentation set, doxygen will generate a Makefile in the HTML
+# output directory. Running make will produce the docset in that directory and
+# running make install will install the docset in
 # ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find it at
-# startup. See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
-# for more information.
+# startup. See https://developer.apple.com/library/archive/featuredarticles/Doxy
+# genXcode/_index.html for more information.
 # The default value is: NO.
 # This tag requires that the tag GENERATE_HTML is set to YES.
 
@@ -1254,8 +1365,8 @@ DOCSET_PUBLISHER_NAME  = Publisher
 # If the GENERATE_HTMLHELP tag is set to YES then doxygen generates three
 # additional HTML index files: index.hhp, index.hhc, and index.hhk. The
 # index.hhp is a project file that can be read by Microsoft's HTML Help Workshop
-# (see: http://www.microsoft.com/en-us/download/details.aspx?id=21138) on
-# Windows.
+# (see:
+# https://www.microsoft.com/en-us/download/details.aspx?id=21138) on Windows.
 #
 # The HTML Help Workshop contains a compiler that can convert all HTML output
 # generated by doxygen into a single compiled HTML file (.chm). Compiled HTML
@@ -1285,7 +1396,7 @@ CHM_FILE               =
 HHC_LOCATION           =
 
 # The GENERATE_CHI flag controls if a separate .chi index file is generated
-# (YES) or that it should be included in the master .chm file (NO).
+# (YES) or that it should be included in the main .chm file (NO).
 # The default value is: NO.
 # This tag requires that the tag GENERATE_HTMLHELP is set to YES.
 
@@ -1330,7 +1441,8 @@ QCH_FILE               =
 
 # The QHP_NAMESPACE tag specifies the namespace to use when generating Qt Help
 # Project output. For more information please see Qt Help Project / Namespace
-# (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#namespace).
+# (see:
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#namespace).
 # The default value is: org.doxygen.Project.
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
@@ -1338,8 +1450,8 @@ QHP_NAMESPACE          = org.doxygen.Project
 
 # The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating Qt
 # Help Project output. For more information please see Qt Help Project / Virtual
-# Folders (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#virtual-
-# folders).
+# Folders (see:
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#virtual-folders).
 # The default value is: doc.
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
@@ -1347,30 +1459,30 @@ QHP_VIRTUAL_FOLDER     = doc
 
 # If the QHP_CUST_FILTER_NAME tag is set, it specifies the name of a custom
 # filter to add. For more information please see Qt Help Project / Custom
-# Filters (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#custom-
-# filters).
+# Filters (see:
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#custom-filters).
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
 QHP_CUST_FILTER_NAME   =
 
 # The QHP_CUST_FILTER_ATTRS tag specifies the list of the attributes of the
 # custom filter to add. For more information please see Qt Help Project / Custom
-# Filters (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#custom-
-# filters).
+# Filters (see:
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#custom-filters).
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
 QHP_CUST_FILTER_ATTRS  =
 
 # The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
 # project's filter section matches. Qt Help Project / Filter Attributes (see:
-# http://qt-project.org/doc/qt-4.8/qthelpproject.html#filter-attributes).
+# https://doc.qt.io/archives/qt-4.8/qthelpproject.html#filter-attributes).
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
 QHP_SECT_FILTER_ATTRS  =
 
-# The QHG_LOCATION tag can be used to specify the location of Qt's
-# qhelpgenerator. If non-empty doxygen will try to run qhelpgenerator on the
-# generated .qhp file.
+# The QHG_LOCATION tag can be used to specify the location (absolute path
+# including file name) of Qt's qhelpgenerator. If non-empty doxygen will try to
+# run qhelpgenerator on the generated .qhp file.
 # This tag requires that the tag GENERATE_QHP is set to YES.
 
 QHG_LOCATION           =
@@ -1447,6 +1559,17 @@ TREEVIEW_WIDTH         = 250
 
 EXT_LINKS_IN_WINDOW    = NO
 
+# If the HTML_FORMULA_FORMAT option is set to svg, doxygen will use the pdf2svg
+# tool (see https://github.com/dawbarton/pdf2svg) or inkscape (see
+# https://inkscape.org) to generate formulas as SVG images instead of PNGs for
+# the HTML output. These images will generally look nicer at scaled resolutions.
+# Possible values are: png (the default) and svg (looks nicer but requires the
+# pdf2svg or inkscape tool).
+# The default value is: png.
+# This tag requires that the tag GENERATE_HTML is set to YES.
+
+HTML_FORMULA_FORMAT    = png
+
 # Use this tag to change the font size of LaTeX formulas included as images in
 # the HTML documentation. When you change the font size after a successful
 # doxygen run you need to manually remove any form_*.png images from the HTML
@@ -1456,7 +1579,7 @@ EXT_LINKS_IN_WINDOW    = NO
 
 FORMULA_FONTSIZE       = 10
 
-# Use the FORMULA_TRANPARENT tag to determine whether or not the images
+# Use the FORMULA_TRANSPARENT tag to determine whether or not the images
 # generated for formulas are transparent PNGs. Transparent PNGs are not
 # supported properly for IE 6.0, but are supported on all modern browsers.
 #
@@ -1467,8 +1590,14 @@ FORMULA_FONTSIZE       = 10
 
 FORMULA_TRANSPARENT    = YES
 
+# The FORMULA_MACROFILE can contain LaTeX \newcommand and \renewcommand commands
+# to create new LaTeX commands to be used in formulas as building blocks. See
+# the section "Including formulas" for details.
+
+FORMULA_MACROFILE      =
+
 # Enable the USE_MATHJAX option to render LaTeX formulas using MathJax (see
-# http://www.mathjax.org) which uses client side Javascript for the rendering
+# https://www.mathjax.org) which uses client side JavaScript for the rendering
 # instead of using pre-rendered bitmaps. Use this if you do not have LaTeX
 # installed or if you want to formulas look prettier in the HTML output. When
 # enabled you may also need to install MathJax separately and configure the path
@@ -1480,7 +1609,7 @@ USE_MATHJAX            = NO
 
 # When MathJax is enabled you can set the default output format to be used for
 # the MathJax output. See the MathJax site (see:
-# http://docs.mathjax.org/en/latest/output.html) for more details.
+# http://docs.mathjax.org/en/v2.7-latest/output.html) for more details.
 # Possible values are: HTML-CSS (which is slower, but has the best
 # compatibility), NativeMML (i.e. MathML) and SVG.
 # The default value is: HTML-CSS.
@@ -1495,8 +1624,8 @@ MATHJAX_FORMAT         = HTML-CSS
 # MATHJAX_RELPATH should be ../mathjax. The default value points to the MathJax
 # Content Delivery Network so you can quickly see the result without installing
 # MathJax. However, it is strongly recommended to install a local copy of
-# MathJax from http://www.mathjax.org before deployment.
-# The default value is: http://cdn.mathjax.org/mathjax/latest.
+# MathJax from https://www.mathjax.org before deployment.
+# The default value is: https://cdn.jsdelivr.net/npm/mathjax@2.
 # This tag requires that the tag USE_MATHJAX is set to YES.
 
 MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
@@ -1510,7 +1639,8 @@ MATHJAX_EXTENSIONS     =
 
 # The MATHJAX_CODEFILE tag can be used to specify a file with javascript pieces
 # of code that will be used on startup of the MathJax code. See the MathJax site
-# (see: http://docs.mathjax.org/en/latest/output.html) for more details. For an
+# (see:
+# http://docs.mathjax.org/en/v2.7-latest/output.html) for more details. For an
 # example see the documentation.
 # This tag requires that the tag USE_MATHJAX is set to YES.
 
@@ -1538,7 +1668,7 @@ MATHJAX_CODEFILE       =
 SEARCHENGINE           = NO
 
 # When the SERVER_BASED_SEARCH tag is enabled the search engine will be
-# implemented using a web server instead of a web client using Javascript. There
+# implemented using a web server instead of a web client using JavaScript. There
 # are two flavors of web server based searching depending on the EXTERNAL_SEARCH
 # setting. When disabled, doxygen will generate a PHP script for searching and
 # an index file used by the script. When EXTERNAL_SEARCH is enabled the indexing
@@ -1557,7 +1687,8 @@ SERVER_BASED_SEARCH    = NO
 #
 # Doxygen ships with an example indexer (doxyindexer) and search engine
 # (doxysearch.cgi) which are based on the open source search engine library
-# Xapian (see: http://xapian.org/).
+# Xapian (see:
+# https://xapian.org/).
 #
 # See the section "External Indexing and Searching" for details.
 # The default value is: NO.
@@ -1570,8 +1701,9 @@ EXTERNAL_SEARCH        = NO
 #
 # Doxygen ships with an example indexer (doxyindexer) and search engine
 # (doxysearch.cgi) which are based on the open source search engine library
-# Xapian (see: http://xapian.org/). See the section "External Indexing and
-# Searching" for details.
+# Xapian (see:
+# https://xapian.org/). See the section "External Indexing and Searching" for
+# details.
 # This tag requires that the tag SEARCHENGINE is set to YES.
 
 SEARCHENGINE_URL       =
@@ -1622,21 +1754,35 @@ LATEX_OUTPUT           = latex
 # The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
 # invoked.
 #
-# Note that when enabling USE_PDFLATEX this option is only used for generating
-# bitmaps for formulas in the HTML output, but not in the Makefile that is
-# written to the output directory.
-# The default file is: latex.
+# Note that when not enabling USE_PDFLATEX the default is latex when enabling
+# USE_PDFLATEX the default is pdflatex and when in the later case latex is
+# chosen this is overwritten by pdflatex. For specific output languages the
+# default can have been set differently, this depends on the implementation of
+# the output language.
 # This tag requires that the tag GENERATE_LATEX is set to YES.
 
 LATEX_CMD_NAME         = latex
 
 # The MAKEINDEX_CMD_NAME tag can be used to specify the command name to generate
 # index for LaTeX.
+# Note: This tag is used in the Makefile / make.bat.
+# See also: LATEX_MAKEINDEX_CMD for the part in the generated output file
+# (.tex).
 # The default file is: makeindex.
 # This tag requires that the tag GENERATE_LATEX is set to YES.
 
 MAKEINDEX_CMD_NAME     = makeindex
 
+# The LATEX_MAKEINDEX_CMD tag can be used to specify the command name to
+# generate index for LaTeX. In case there is no backslash (\) as first character
+# it will be automatically added in the LaTeX code.
+# Note: This tag is used in the generated output file (.tex).
+# See also: MAKEINDEX_CMD_NAME for the part in the Makefile / make.bat.
+# The default value is: makeindex.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_MAKEINDEX_CMD    = makeindex
+
 # If the COMPACT_LATEX tag is set to YES, doxygen generates more compact LaTeX
 # documents. This may be useful for small projects and may help to save some
 # trees in general.
@@ -1721,9 +1867,11 @@ LATEX_EXTRA_FILES      =
 
 PDF_HYPERLINKS         = YES
 
-# If the USE_PDFLATEX tag is set to YES, doxygen will use pdflatex to generate
-# the PDF file directly from the LaTeX files. Set this option to YES, to get a
-# higher quality PDF documentation.
+# If the USE_PDFLATEX tag is set to YES, doxygen will use the engine as
+# specified with LATEX_CMD_NAME to generate the PDF file directly from the LaTeX
+# files. Set this option to YES, to get a higher quality PDF documentation.
+#
+# See also section LATEX_CMD_NAME for selecting the engine.
 # The default value is: YES.
 # This tag requires that the tag GENERATE_LATEX is set to YES.
 
@@ -1757,7 +1905,7 @@ LATEX_SOURCE_CODE      = NO
 
 # The LATEX_BIB_STYLE tag can be used to specify the style to use for the
 # bibliography, e.g. plainnat, or ieeetr. See
-# http://en.wikipedia.org/wiki/BibTeX and \cite for more info.
+# https://en.wikipedia.org/wiki/BibTeX and \cite for more info.
 # The default value is: plain.
 # This tag requires that the tag GENERATE_LATEX is set to YES.
 
@@ -1771,6 +1919,14 @@ LATEX_BIB_STYLE        = plain
 
 LATEX_TIMESTAMP        = NO
 
+# The LATEX_EMOJI_DIRECTORY tag is used to specify the (relative or absolute)
+# path from which the emoji images will be read. If a relative path is entered,
+# it will be relative to the LATEX_OUTPUT directory. If left blank the
+# LATEX_OUTPUT directory will be used.
+# This tag requires that the tag GENERATE_LATEX is set to YES.
+
+LATEX_EMOJI_DIRECTORY  =
+
 #---------------------------------------------------------------------------
 # Configuration options related to the RTF output
 #---------------------------------------------------------------------------
@@ -1810,9 +1966,9 @@ COMPACT_RTF            = NO
 
 RTF_HYPERLINKS         = NO
 
-# Load stylesheet definitions from file. Syntax is similar to doxygen's config
-# file, i.e. a series of assignments. You only have to provide replacements,
-# missing definitions are set to their default value.
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# configuration file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
 #
 # See also section "Doxygen usage" for information on how to generate the
 # default style sheet that doxygen normally uses.
@@ -1821,8 +1977,8 @@ RTF_HYPERLINKS         = NO
 RTF_STYLESHEET_FILE    =
 
 # Set optional variables used in the generation of an RTF document. Syntax is
-# similar to doxygen's config file. A template extensions file can be generated
-# using doxygen -e rtf extensionFile.
+# similar to doxygen's configuration file. A template extensions file can be
+# generated using doxygen -e rtf extensionFile.
 # This tag requires that the tag GENERATE_RTF is set to YES.
 
 RTF_EXTENSIONS_FILE    =
@@ -1908,6 +2064,13 @@ XML_OUTPUT             = xml
 
 XML_PROGRAMLISTING     = YES
 
+# If the XML_NS_MEMB_FILE_SCOPE tag is set to YES, doxygen will include
+# namespace members in file scope as well, matching the HTML output.
+# The default value is: NO.
+# This tag requires that the tag GENERATE_XML is set to YES.
+
+XML_NS_MEMB_FILE_SCOPE = NO
+
 #---------------------------------------------------------------------------
 # Configuration options related to the DOCBOOK output
 #---------------------------------------------------------------------------
@@ -1940,9 +2103,9 @@ DOCBOOK_PROGRAMLISTING = NO
 #---------------------------------------------------------------------------
 
 # If the GENERATE_AUTOGEN_DEF tag is set to YES, doxygen will generate an
-# AutoGen Definitions (see http://autogen.sf.net) file that captures the
-# structure of the code including all documentation. Note that this feature is
-# still experimental and incomplete at the moment.
+# AutoGen Definitions (see http://autogen.sourceforge.net/) file that captures
+# the structure of the code including all documentation. Note that this feature
+# is still experimental and incomplete at the moment.
 # The default value is: NO.
 
 GENERATE_AUTOGEN_DEF   = NO
@@ -2109,12 +2272,6 @@ EXTERNAL_GROUPS        = YES
 
 EXTERNAL_PAGES         = YES
 
-# The PERL_PATH should be the absolute path and name of the perl script
-# interpreter (i.e. the result of 'which perl').
-# The default file (with absolute path) is: /usr/bin/perl.
-
-PERL_PATH              = /usr/bin/perl
-
 #---------------------------------------------------------------------------
 # Configuration options related to the dot tool
 #---------------------------------------------------------------------------
@@ -2128,15 +2285,6 @@ PERL_PATH              = /usr/bin/perl
 
 CLASS_DIAGRAMS         = YES
 
-# You can define message sequence charts within doxygen comments using the \msc
-# command. Doxygen will then run the mscgen tool (see:
-# http://www.mcternan.me.uk/mscgen/)) to produce the chart and insert it in the
-# documentation. The MSCGEN_PATH tag allows you to specify the directory where
-# the mscgen tool resides. If left empty the tool is assumed to be found in the
-# default search path.
-
-MSCGEN_PATH            =
-
 # You can include diagrams made with dia in doxygen documentation. Doxygen will
 # then run dia to produce the diagram and insert it in the documentation. The
 # DIA_PATH tag allows you to specify the directory where the dia binary resides.
@@ -2234,10 +2382,32 @@ UML_LOOK               = NO
 # but if the number exceeds 15, the total amount of fields shown is limited to
 # 10.
 # Minimum value: 0, maximum value: 100, default value: 10.
-# This tag requires that the tag HAVE_DOT is set to YES.
+# This tag requires that the tag UML_LOOK is set to YES.
 
 UML_LIMIT_NUM_FIELDS   = 10
 
+# If the DOT_UML_DETAILS tag is set to NO, doxygen will show attributes and
+# methods without types and arguments in the UML graphs. If the DOT_UML_DETAILS
+# tag is set to YES, doxygen will add type and arguments for attributes and
+# methods in the UML graphs. If the DOT_UML_DETAILS tag is set to NONE, doxygen
+# will not generate fields with class member information in the UML graphs. The
+# class diagrams will look similar to the default class diagrams but using UML
+# notation for the relationships.
+# Possible values are: NO, YES and NONE.
+# The default value is: NO.
+# This tag requires that the tag UML_LOOK is set to YES.
+
+DOT_UML_DETAILS        = NO
+
+# The DOT_WRAP_THRESHOLD tag can be used to set the maximum number of characters
+# to display on a single line. If the actual line length exceeds this threshold
+# significantly it will wrapped across multiple lines. Some heuristics are apply
+# to avoid ugly line breaks.
+# Minimum value: 0, maximum value: 1000, default value: 17.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_WRAP_THRESHOLD     = 17
+
 # If the TEMPLATE_RELATIONS tag is set to YES then the inheritance and
 # collaboration graphs will show the relations between templates and their
 # instances.
@@ -2366,6 +2536,11 @@ DIAFILE_DIRS           =
 
 PLANTUML_JAR_PATH      =
 
+# When using plantuml, the PLANTUML_CFG_FILE tag can be used to specify a
+# configuration file for plantuml.
+
+PLANTUML_CFG_FILE      =
+
 # When using plantuml, the specified paths are searched for files specified by
 # the !include statement in a plantuml block.
 
@@ -2424,9 +2599,11 @@ DOT_MULTI_TARGETS      = YES
 
 GENERATE_LEGEND        = YES
 
-# If the DOT_CLEANUP tag is set to YES, doxygen will remove the intermediate dot
+# If the DOT_CLEANUP tag is set to YES, doxygen will remove the intermediate
 # files that are used to generate the various graphs.
+#
+# Note: This setting is not only used for dot files but also for msc and
+# plantuml temporary files.
 # The default value is: YES.
-# This tag requires that the tag HAVE_DOT is set to YES.
 
 DOT_CLEANUP            = YES
diff --git a/contrib/ldns/ltmain.sh b/contrib/ldns/ltmain.sh
index 2ad8be8483de82..540a92ab547656 100755
--- a/contrib/ldns/ltmain.sh
+++ b/contrib/ldns/ltmain.sh
@@ -31,7 +31,7 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION="2.4.6 Debian-2.4.6-1"
+VERSION="2.4.6 Debian-2.4.6-15build2"
 package_revision=2.4.6
 
 
@@ -387,7 +387,7 @@ EXIT_SKIP=77	  # $? = 77 is used to indicate a skipped test to automake.
 # putting '$debug_cmd' at the start of all your functions, you can get
 # bash to show function call trace with:
 #
-#    debug_cmd='eval echo "${FUNCNAME[0]} $*" >&2' bash your-script-name
+#    debug_cmd='echo "${FUNCNAME[0]} $*" >&2' bash your-script-name
 debug_cmd=${debug_cmd-":"}
 exit_cmd=:
 
@@ -1370,7 +1370,7 @@ func_lt_ver ()
 #! /bin/sh
 
 # Set a version string for this script.
-scriptversion=2014-01-07.03; # UTC
+scriptversion=2015-10-07.11; # UTC
 
 # A portable, pluggable option parser for Bourne shell.
 # Written by Gary V. Vaughan, 2010
@@ -1530,6 +1530,8 @@ func_run_hooks ()
 {
     $debug_cmd
 
+    _G_rc_run_hooks=false
+
     case " $hookable_fns " in
       *" $1 "*) ;;
       *) func_fatal_error "'$1' does not support hook funcions.n" ;;
@@ -1538,16 +1540,16 @@ func_run_hooks ()
     eval _G_hook_fns=\$$1_hooks; shift
 
     for _G_hook in $_G_hook_fns; do
-      eval $_G_hook '"$@"'
-
-      # store returned options list back into positional
-      # parameters for next 'cmd' execution.
-      eval _G_hook_result=\$${_G_hook}_result
-      eval set dummy "$_G_hook_result"; shift
+      if eval $_G_hook '"$@"'; then
+        # store returned options list back into positional
+        # parameters for next 'cmd' execution.
+        eval _G_hook_result=\$${_G_hook}_result
+        eval set dummy "$_G_hook_result"; shift
+        _G_rc_run_hooks=:
+      fi
     done
 
-    func_quote_for_eval ${1+"$@"}
-    func_run_hooks_result=$func_quote_for_eval_result
+    $_G_rc_run_hooks && func_run_hooks_result=$_G_hook_result
 }
 
 
@@ -1557,10 +1559,16 @@ func_run_hooks ()
 ## --------------- ##
 
 # In order to add your own option parsing hooks, you must accept the
-# full positional parameter list in your hook function, remove any
-# options that you action, and then pass back the remaining unprocessed
+# full positional parameter list in your hook function, you may remove/edit
+# any options that you action, and then pass back the remaining unprocessed
 # options in '<hooked_function_name>_result', escaped suitably for
-# 'eval'.  Like this:
+# 'eval'.  In this case you also must return $EXIT_SUCCESS to let the
+# hook's caller know that it should pay attention to
+# '<hooked_function_name>_result'.  Returning $EXIT_FAILURE signalizes that
+# arguments are left untouched by the hook and therefore caller will ignore the
+# result variable.
+#
+# Like this:
 #
 #    my_options_prep ()
 #    {
@@ -1570,9 +1578,11 @@ func_run_hooks ()
 #        usage_message=$usage_message'
 #      -s, --silent       don'\''t print informational messages
 #    '
-#
-#        func_quote_for_eval ${1+"$@"}
-#        my_options_prep_result=$func_quote_for_eval_result
+#        # No change in '$@' (ignored completely by this hook).  There is
+#        # no need to do the equivalent (but slower) action:
+#        # func_quote_for_eval ${1+"$@"}
+#        # my_options_prep_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_options_prep my_options_prep
 #
@@ -1581,25 +1591,37 @@ func_run_hooks ()
 #    {
 #        $debug_cmd
 #
+#        args_changed=false
+#
 #        # Note that for efficiency, we parse as many options as we can
 #        # recognise in a loop before passing the remainder back to the
 #        # caller on the first unrecognised argument we encounter.
 #        while test $# -gt 0; do
 #          opt=$1; shift
 #          case $opt in
-#            --silent|-s) opt_silent=: ;;
+#            --silent|-s) opt_silent=:
+#                         args_changed=:
+#                         ;;
 #            # Separate non-argument short options:
 #            -s*)         func_split_short_opt "$_G_opt"
 #                         set dummy "$func_split_short_opt_name" \
 #                             "-$func_split_short_opt_arg" ${1+"$@"}
 #                         shift
+#                         args_changed=:
 #                         ;;
-#            *)            set dummy "$_G_opt" "$*"; shift; break ;;
+#            *)           # Make sure the first unrecognised option "$_G_opt"
+#                         # is added back to "$@", we could need that later
+#                         # if $args_changed is true.
+#                         set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
 #          esac
 #        done
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_silent_option_result=$func_quote_for_eval_result
+#        if $args_changed; then
+#          func_quote_for_eval ${1+"$@"}
+#          my_silent_option_result=$func_quote_for_eval_result
+#        fi
+#
+#        $args_changed
 #    }
 #    func_add_hook func_parse_options my_silent_option
 #
@@ -1611,16 +1633,32 @@ func_run_hooks ()
 #        $opt_silent && $opt_verbose && func_fatal_help "\
 #    '--silent' and '--verbose' options are mutually exclusive."
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_option_validation_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_validate_options my_option_validation
 #
-# You'll alse need to manually amend $usage_message to reflect the extra
+# You'll also need to manually amend $usage_message to reflect the extra
 # options you parse.  It's preferable to append if you can, so that
 # multiple option parsing hooks can be added safely.
 
 
+# func_options_finish [ARG]...
+# ----------------------------
+# Finishing the option parse loop (call 'func_options' hooks ATM).
+func_options_finish ()
+{
+    $debug_cmd
+
+    _G_func_options_finish_exit=false
+    if func_run_hooks func_options ${1+"$@"}; then
+      func_options_finish_result=$func_run_hooks_result
+      _G_func_options_finish_exit=:
+    fi
+
+    $_G_func_options_finish_exit
+}
+
+
 # func_options [ARG]...
 # ---------------------
 # All the functions called inside func_options are hookable. See the
@@ -1630,17 +1668,28 @@ func_options ()
 {
     $debug_cmd
 
-    func_options_prep ${1+"$@"}
-    eval func_parse_options \
-        ${func_options_prep_result+"$func_options_prep_result"}
-    eval func_validate_options \
-        ${func_parse_options_result+"$func_parse_options_result"}
+    _G_rc_options=false
 
-    eval func_run_hooks func_options \
-        ${func_validate_options_result+"$func_validate_options_result"}
+    for my_func in options_prep parse_options validate_options options_finish
+    do
+      if eval func_$my_func '${1+"$@"}'; then
+        eval _G_res_var='$'"func_${my_func}_result"
+        eval set dummy "$_G_res_var" ; shift
+        _G_rc_options=:
+      fi
+    done
+
+    # Save modified positional parameters for caller.  As a top-level
+    # options-parser function we always need to set the 'func_options_result'
+    # variable (regardless the $_G_rc_options value).
+    if $_G_rc_options; then
+      func_options_result=$_G_res_var
+    else
+      func_quote_for_eval ${1+"$@"}
+      func_options_result=$func_quote_for_eval_result
+    fi
 
-    # save modified positional parameters for caller
-    func_options_result=$func_run_hooks_result
+    $_G_rc_options
 }
 
 
@@ -1649,9 +1698,9 @@ func_options ()
 # All initialisations required before starting the option parse loop.
 # Note that when calling hook functions, we pass through the list of
 # positional parameters.  If a hook function modifies that list, and
-# needs to propogate that back to rest of this script, then the complete
+# needs to propagate that back to rest of this script, then the complete
 # modified list must be put in 'func_run_hooks_result' before
-# returning.
+# returning $EXIT_SUCCESS (otherwise $EXIT_FAILURE is returned).
 func_hookable func_options_prep
 func_options_prep ()
 {
@@ -1661,10 +1710,14 @@ func_options_prep ()
     opt_verbose=false
     opt_warning_types=
 
-    func_run_hooks func_options_prep ${1+"$@"}
+    _G_rc_options_prep=false
+    if func_run_hooks func_options_prep ${1+"$@"}; then
+      _G_rc_options_prep=:
+      # save modified positional parameters for caller
+      func_options_prep_result=$func_run_hooks_result
+    fi
 
-    # save modified positional parameters for caller
-    func_options_prep_result=$func_run_hooks_result
+    $_G_rc_options_prep
 }
 
 
@@ -1678,18 +1731,20 @@ func_parse_options ()
 
     func_parse_options_result=
 
+    _G_rc_parse_options=false
     # this just eases exit handling
     while test $# -gt 0; do
       # Defer to hook functions for initial option parsing, so they
       # get priority in the event of reusing an option name.
-      func_run_hooks func_parse_options ${1+"$@"}
-
-      # Adjust func_parse_options positional parameters to match
-      eval set dummy "$func_run_hooks_result"; shift
+      if func_run_hooks func_parse_options ${1+"$@"}; then
+        eval set dummy "$func_run_hooks_result"; shift
+        _G_rc_parse_options=:
+      fi
 
       # Break out of the loop if we already parsed every option.
       test $# -gt 0 || break
 
+      _G_match_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -1704,7 +1759,10 @@ func_parse_options ()
 		      ;;
 
         --warnings|--warning|-W)
-                      test $# = 0 && func_missing_arg $_G_opt && break
+                      if test $# = 0 && func_missing_arg $_G_opt; then
+                        _G_rc_parse_options=:
+                        break
+                      fi
                       case " $warning_categories $1" in
                         *" $1 "*)
                           # trailing space prevents matching last $1 above
@@ -1757,15 +1815,25 @@ func_parse_options ()
                       shift
                       ;;
 
-        --)           break ;;
+        --)           _G_rc_parse_options=: ; break ;;
         -*)           func_fatal_help "unrecognised option: '$_G_opt'" ;;
-        *)            set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
+        *)            set dummy "$_G_opt" ${1+"$@"}; shift
+                      _G_match_parse_options=false
+                      break
+                      ;;
       esac
+
+      $_G_match_parse_options && _G_rc_parse_options=:
     done
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    func_parse_options_result=$func_quote_for_eval_result
+
+    if $_G_rc_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      func_parse_options_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_parse_options
 }
 
 
@@ -1778,16 +1846,21 @@ func_validate_options ()
 {
     $debug_cmd
 
+    _G_rc_validate_options=false
+
     # Display all warnings if -W was not given.
     test -n "$opt_warning_types" || opt_warning_types=" $warning_categories"
 
-    func_run_hooks func_validate_options ${1+"$@"}
+    if func_run_hooks func_validate_options ${1+"$@"}; then
+      # save modified positional parameters for caller
+      func_validate_options_result=$func_run_hooks_result
+      _G_rc_validate_options=:
+    fi
 
     # Bail if the options were screwed!
     $exit_cmd $EXIT_FAILURE
 
-    # save modified positional parameters for caller
-    func_validate_options_result=$func_run_hooks_result
+    $_G_rc_validate_options
 }
 
 
@@ -1977,7 +2050,7 @@ func_version ()
 # End:
 
 # Set a version string.
-scriptversion='(GNU libtool) 2.4.6 Debian-2.4.6-1'
+scriptversion='(GNU libtool) 2.4.6'
 
 
 # func_echo ARG...
@@ -2068,7 +2141,7 @@ include the following information:
        compiler:       $LTCC
        compiler flags: $LTCFLAGS
        linker:         $LD (gnu? $with_gnu_ld)
-       version:        $progname $scriptversion
+       version:        $progname $scriptversion Debian-2.4.6-15build2
        automake:       `($AUTOMAKE --version) 2>/dev/null |$SED 1q`
        autoconf:       `($AUTOCONF --version) 2>/dev/null |$SED 1q`
 
@@ -2270,6 +2343,8 @@ libtool_options_prep ()
     nonopt=
     preserve_args=
 
+    _G_rc_lt_options_prep=:
+
     # Shorthand for --mode=foo, only valid as the first argument
     case $1 in
     clean|clea|cle|cl)
@@ -2293,11 +2368,18 @@ libtool_options_prep ()
     uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u)
       shift; set dummy --mode uninstall ${1+"$@"}; shift
       ;;
+    *)
+      _G_rc_lt_options_prep=false
+      ;;
     esac
 
-    # Pass back the list of options.
-    func_quote_for_eval ${1+"$@"}
-    libtool_options_prep_result=$func_quote_for_eval_result
+    if $_G_rc_lt_options_prep; then
+      # Pass back the list of options.
+      func_quote_for_eval ${1+"$@"}
+      libtool_options_prep_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_lt_options_prep
 }
 func_add_hook func_options_prep libtool_options_prep
 
@@ -2309,9 +2391,12 @@ libtool_parse_options ()
 {
     $debug_cmd
 
+    _G_rc_lt_parse_options=false
+
     # Perform our own loop to consume as many options as possible in
     # each iteration.
     while test $# -gt 0; do
+      _G_match_lt_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -2386,15 +2471,22 @@ libtool_parse_options ()
                         func_append preserve_args " $_G_opt"
                         ;;
 
-	# An option not handled by this hook function:
-        *)		set dummy "$_G_opt" ${1+"$@"};	shift; break  ;;
+        # An option not handled by this hook function:
+        *)              set dummy "$_G_opt" ${1+"$@"} ; shift
+                        _G_match_lt_parse_options=false
+                        break
+                        ;;
       esac
+      $_G_match_lt_parse_options && _G_rc_lt_parse_options=:
     done
 
+    if $_G_rc_lt_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      libtool_parse_options_result=$func_quote_for_eval_result
+    fi
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    libtool_parse_options_result=$func_quote_for_eval_result
+    $_G_rc_lt_parse_options
 }
 func_add_hook func_parse_options libtool_parse_options
 
@@ -7275,10 +7367,13 @@ func_mode_link ()
       # -specs=*             GCC specs files
       # -stdlib=*            select c++ std lib with clang
       # -fsanitize=*         Clang/GCC memory and address sanitizer
+      # -fuse-ld=*           Linker select flags for GCC
+      # -static-*            direct GCC to link specific libraries statically
+      # -fcilkplus           Cilk Plus language extension features for C/C++
       -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
       -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
       -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
-      -specs=*|-fsanitize=*)
+      -specs=*|-fsanitize=*|-fuse-ld=*|-static-*|-fcilkplus)
         func_quote_for_eval "$arg"
 	arg=$func_quote_for_eval_result
         func_append compile_command " $arg"
diff --git a/contrib/ldns/m4/ax_config_feature.m4 b/contrib/ldns/m4/ax_config_feature.m4
index e205723e015921..3c2f2ef27ff7df 100644
--- a/contrib/ldns/m4/ax_config_feature.m4
+++ b/contrib/ldns/m4/ax_config_feature.m4
@@ -1,5 +1,5 @@
 # ===========================================================================
-#     http://www.gnu.org/software/autoconf-archive/ax_config_feature.html
+#    https://www.gnu.org/software/autoconf-archive/ax_config_feature.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -73,7 +73,7 @@
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <http://www.gnu.org/licenses/>.
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -88,7 +88,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 10
+#serial 11
 
 AC_DEFUN([AX_CONFIG_FEATURE],[ dnl
 m4_pushdef([FEATURE], patsubst([$1], -, _))dnl
diff --git a/contrib/ldns/m4/ax_have_poll.m4 b/contrib/ldns/m4/ax_have_poll.m4
index 14d3d4b3055f02..b90cda684d30a0 100644
--- a/contrib/ldns/m4/ax_have_poll.m4
+++ b/contrib/ldns/m4/ax_have_poll.m4
@@ -1,5 +1,5 @@
 # ===========================================================================
-#       http://www.gnu.org/software/autoconf-archive/ax_have_poll.html
+#       https://www.gnu.org/software/autoconf-archive/ax_have_poll.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -34,7 +34,7 @@
 #   and this notice are preserved. This file is offered as-is, without any
 #   warranty.
 
-#serial 7
+#serial 8
 
 AC_DEFUN([AX_HAVE_POLL], [dnl
   AC_MSG_CHECKING([for poll(2)])
diff --git a/contrib/ldns/m4/libtool.m4 b/contrib/ldns/m4/libtool.m4
index ee80844b619f4e..c4c02946dece79 100644
--- a/contrib/ldns/m4/libtool.m4
+++ b/contrib/ldns/m4/libtool.m4
@@ -1041,8 +1041,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR cr libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR cr libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
       echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
       $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
       cat > conftest.c << _LT_EOF
@@ -1071,11 +1071,11 @@ _LT_EOF
       # to the OS version, if on x86, and 10.4, the deployment
       # target defaults to 10.4. Don't you love it?
       case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
+	10.0,*86*-darwin8*|10.0,*-darwin[[912]]*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 	10.[[012]][[,.]]*)
 	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
+	10.*|11.*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
@@ -1492,7 +1492,7 @@ need_locks=$enable_libtool_lock
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 _LT_DECL([], [AR], [1], [The archiver])
 _LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
 
@@ -4063,7 +4063,8 @@ _LT_EOF
   if AC_TRY_EVAL(ac_compile); then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4703,6 +4704,12 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -6438,7 +6445,7 @@ if test yes != "$_lt_caught_CXX_error"; then
       # Commands to make compiler produce verbose output that lists
       # what "hidden" libraries, object files and flags are used when
       # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
     else
       GXX=no
@@ -6813,7 +6820,7 @@ if test yes != "$_lt_caught_CXX_error"; then
             # explicitly linking system object files so we need to strip them
             # from the output so that they don't get included in the library
             # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
             ;;
           *)
             if test yes = "$GXX"; then
@@ -6878,7 +6885,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
           *)
 	    if test yes = "$GXX"; then
@@ -7217,7 +7224,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 	    else
 	      # FIXME: insert proper C++ library support
@@ -7301,7 +7308,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7312,7 +7319,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi
 
 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
diff --git a/contrib/ldns/makewin.sh b/contrib/ldns/makewin.sh
new file mode 100755
index 00000000000000..accc9058e75eb7
--- /dev/null
+++ b/contrib/ldns/makewin.sh
@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+
+# compile ldns for windows
+cdir="$(echo ldns.win.$$)"
+tmpdir=$(pwd)
+mkdir "$cdir"
+cd "$cdir"
+#configure="mingw32-configure"
+#strip="i686-w64-mingw32-strip"
+#warch="i686"
+configure="mingw64-configure"
+strip="x86_64-w64-mingw32-strip"
+warch="x86_64"
+WINSSL="$HOME/Downloads/openssl-1.1.0h.tar.gz"
+cross_flag=""
+cross_flag_nonstatic=""
+RC="no"
+SNAPSHOT="no"
+CHECKOUT=""
+# the destination is a zipfile in the start directory ldns-a.b.c.zip
+# the start directory is a git repository, and it is copied to build from.
+
+info () {
+	echo "info: $1"
+}
+
+error_cleanup () {
+	echo "$1"
+	cd "$tmpdir"
+	rm -rf "$cdir"
+	exit 1
+}
+
+replace_text () {
+    (cp "$1" "$1".orig && \
+        sed -e "s/$2/$3/g" < "$1".orig > "$1" && \
+        rm "$1".orig) || error_cleanup "Replacement for $1 failed."
+}
+
+# Parse command line arguments
+while [ "$1" ]; do
+    case "$1" in
+	"-h")
+		echo "Compile a zip file with static executables, and"
+		echo "dynamic library, static library, include dir and"
+		echo "manual pages."
+		echo ""
+		echo "	-h		This usage information."
+		echo "	-s		snapshot, current date appended to version"
+		echo "	-rc <nr>	release candidate, the number is added to version"
+		echo "			ldns-<version>rc<nr>."
+		echo "	-c <tag/br>	Checkout this tag or branch, (defaults to current"
+		echo "			branch)."
+		echo "	-wssl <file>	Pass openssl.tar.gz file, use absolute path."
+		echo ""
+		exit 1
+		;;
+	"-c")
+		CHECKOUT="$2"
+		shift
+		;;
+	"-s")
+		SNAPSHOT="yes"
+		;;
+	"-rc")
+		RC="$2"
+		shift
+		;;
+	"-wssl")
+		WINSSL="$2"
+		shift
+		;;
+	*)
+		error_cleanup "Unrecognized argument -- $1"
+		;;
+    esac
+    shift
+done
+if [ -z "$CHECKOUT" ]
+then
+        if [ "$RC" = "no" ]
+        then
+                CHECKOUT=$( (git status | head -n 1 | awk '{print$3}') || echo master)
+        else
+                CHECKOUT=$( (git status | head -n 1 | awk '{print$3}') || echo develop)
+        fi
+fi
+
+# this script creates a temp directory $cdir.
+# this directory contains subdirectories:
+# ldns/ : ldns source compiled
+# openssl-a.b.c/ : the openSSL source compiled
+# ldnsinstall/ : install of ldns here.
+# sslinstall/ : install of ssl here.
+# file/ : directory to gather the components of the zipfile distribution
+# ldns-nonstatic/ : ldns source compiled nonstatic
+# ldnsinstall-nonstatic/ : install of ldns nonstatic compile
+# openssl-nonstatic/ : nonstatic openssl source compiled
+# sslinstall-nonstatic/ : install of nonstatic openssl compile
+
+info "exporting source into $cdir/ldns"
+git clone git://git.nlnetlabs.nl/ldns/ ldns || error_cleanup "git command failed"
+(cd ldns; git checkout "$CHECKOUT") || error_cleanup "Could not checkout $CHECKOUT"
+#svn export . $cdir/ldns
+info "exporting source into $cdir/ldns-nonstatic"
+git clone git://git.nlnetlabs.nl/ldns/ ldns-nonstatic || error_cleanup "git command failed"
+(cd ldns-nonstatic; git checkout "$CHECKOUT") || error_cleanup "Could not checkout $CHECKOUT"
+#svn export . $cdir/ldns-nonstatic
+
+# Fix up the version number if necessary
+(cd ldns; if test ! -f install-sh -a -f ../../install-sh; then cp ../../install-sh . ; fi; libtoolize -ci; autoreconf -fi)
+version=$(./ldns/configure --version | head -1 | awk '{ print $3 }') || \
+    error_cleanup "Cannot determine version number."
+info "LDNS version: $version"
+if [ "$RC" != "no" ]; then
+	info "Building LDNS release candidate $RC."
+	version2="${version}-rc$RC"
+	info "Version number: $version2"
+	replace_text "ldns/configure.ac" "AC_INIT(ldns, $version" "AC_INIT(ldns, $version2"
+	replace_text "ldns-nonstatic/configure.ac" "AC_INIT(ldns, $version" "AC_INIT(ldns, $version2"
+	version="$version2"
+fi
+if [ "$SNAPSHOT" = "yes" ]; then
+	info "Building LDNS snapshot."
+	version2="${version}_$(date +%Y%m%d)"
+	info "Snapshot version number: $version2"
+	replace_text "ldns/configure.ac" "AC_INIT(ldns, $version" "AC_INIT(ldns, $version2"
+	replace_text "ldns-nonstatic/configure.ac" "AC_INIT(ldns, $version" "AC_INIT(ldns, $version2"
+	version="$version2"
+fi
+
+# Build OpenSSL
+gzip -cd "$WINSSL" | tar xf - || error_cleanup "tar unpack of $WINSSL failed"
+sslinstall="$(pwd)/sslinstall"
+cd openssl-* || error_cleanup "no openssl-X dir in tarball"
+if test $configure = "mingw64-configure"; then
+	sslflags="no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64"
+else
+	sslflags="no-shared no-asm -DOPENSSL_NO_CAPIENG mingw"
+fi
+info "winssl: Configure $sslflags"
+CC="${warch}-w64-mingw32-gcc" AR="${warch}-w64-mingw32-ar" RANLIB="${warch}-w64-mingw32-ranlib" WINDRES="${warch}-w64-mingw32-windres" ./Configure --prefix="$sslinstall" "$sslflags" || error_cleanup "OpenSSL Configure failed"
+info "winssl: make"
+make || error_cleanup "make failed for $WINSSL"
+info "winssl: make install_sw"
+make install_sw || error_cleanup "OpenSSL install failed"
+cross_flag="$cross_flag --with-ssl=$sslinstall"
+cd ..
+
+# Build ldns
+ldnsinstall="$(pwd)/ldnsinstall"
+cd ldns
+info "ldns: autoconf"
+# cp install-sh because one at ../.. means libtoolize won't install it for us.
+if test ! -f install-sh -a -f ../../install-sh; then cp ../../install-sh . ; fi
+libtoolize -ci
+autoreconf -fi
+ldns_flag="--with-examples --with-drill"
+info "ldns: Configure $cross_flag $ldns_flag"
+$configure "$cross_flag" "$ldns_flag" || error_cleanup "ldns configure failed"
+info "ldns: make"
+make || error_cleanup "ldns make failed"
+# do not strip debug symbols, could be useful for stack traces
+# $strip lib/*.dll || error_cleanup "cannot strip ldns dll"
+make doc || error_cleanup "ldns make doc failed"
+DESTDIR=$ldnsinstall make install || error_cleanup "ldns make install failed"
+cd ..
+
+# Build OpenSSL nonstatic
+sslinstallnonstatic="$(pwd)/sslinstallnonstatic"
+mkdir openssl-nonstatic
+cd openssl-nonstatic
+# remove openssl-a.b.c/ and put in openssl-nonstatic directory
+gzip -cd "$WINSSL" | tar xf - --strip-components=1 || error_cleanup "tar unpack of $WINSSL failed"
+if test "$configure" = "mingw64-configure"; then
+	sslflags_nonstatic="shared no-asm -DOPENSSL_NO_CAPIENG mingw64"
+else
+	sslflags_nonstatic="shared no-asm -DOPENSSL_NO_CAPIENG mingw"
+fi
+info "winsslnonstatic: Configure $sslflags_nonstatic"
+CC="${warch}-w64-mingw32-gcc" AR="${warch}-w64-mingw32-ar" RANLIB="${warch}-w64-mingw32-ranlib" WINDRES="${warch}-w64-mingw32-windres" ./Configure --prefix="$sslinstallnonstatic" "$sslflags_nonstatic" || error_cleanup "OpenSSL Configure failed"
+info "winsslnonstatic: make"
+make || error_cleanup "make failed for $WINSSL"
+info "winsslnonstatic: make install_sw"
+make install_sw || error_cleanup "OpenSSL install failed"
+cross_flag_nonstatic="$cross_flag_nonstatic --with-ssl=$sslinstallnonstatic"
+cd ..
+
+# Build ldns nonstatic
+ldnsinstallnonstatic="$(pwd)/ldnsinstall-nonstatic"
+cd ldns-nonstatic
+info "ldnsnonstatic: autoconf"
+# cp install-sh because one at ../.. means libtoolize won't install it for us.
+if test ! -f install-sh -a -f ../../install-sh; then cp ../../install-sh . ; fi
+libtoolize -ci
+autoreconf -fi
+ldns_flag_nonstatic="--with-examples --with-drill"
+info "ldnsnonstatic: Configure $cross_flag_nonstatic $ldns_flag_nonstatic"
+$configure "$cross_flag_nonstatic" "$ldns_flag_nonstatic" || error_cleanup "ldns configure failed"
+info "ldnsnonstatic: make"
+make || error_cleanup "ldns make failed"
+# do not strip debug symbols, could be useful for stack traces
+# $strip lib/*.dll || error_cleanup "cannot strip ldns dll"
+make doc || error_cleanup "ldns make doc failed"
+DESTDIR=$ldnsinstallnonstatic make install || error_cleanup "ldns make install failed"
+cd ..
+
+# create zipfile
+file="ldns-$version.zip"
+rm -f "$file"
+info "Creating $file"
+mkdir file
+cd file
+installplace="$ldnsinstall/usr/$warch-w64-mingw32/sys-root/mingw"
+installplacenonstatic="$ldnsinstallnonstatic/usr/$warch-w64-mingw32/sys-root/mingw"
+cp "$installplace"/lib/libldns.a .
+cp "$installplacenonstatic"/lib/libldns.dll.a .
+cp "$installplacenonstatic"/bin/*.dll .
+cp "$sslinstallnonstatic"/lib/*.dll.a .
+cp "$sslinstallnonstatic"/bin/*.dll .
+cp "$sslinstallnonstatic"/lib/engines-*/*.dll .
+cp ../ldns/LICENSE .
+cp ../ldns/README .
+cp ../ldns/Changelog .
+info "copy static exe"
+for x in "$installplace"/bin/* ; do
+	cp "$x" "$(basename "$x").exe"
+done
+# but the shell script stays a script file
+mv ldns-config.exe ldns-config
+info "copy include"
+mkdir include
+mkdir include/ldns
+cp "$installplace"/include/ldns/*.h include/ldns/.
+info "copy man1"
+mkdir man1
+cp "$installplace"/share/man/man1/* man1/.
+info "copy man3"
+mkdir man3
+cp "$installplace"/share/man/man3/* man3/.
+info "create cat1"
+mkdir cat1
+for x in man1/*.1; do groff -man -Tascii -Z "$x" | grotty -cbu > cat1/"$(basename "$x" .1).txt"; done
+info "create cat3"
+mkdir cat3
+for x in man3/*.3; do groff -man -Tascii -Z "$x" | grotty -cbu > cat3/"$(basename "$x" .3).txt"; done
+rm -f "../../$file"
+info "$file contents"
+# show contents of directory we are zipping up.
+du -s ./*
+# zip it
+info "zip $file"
+zip -r ../../"$file" LICENSE README libldns.a *.dll *.dll.a Changelog *.exe include man1 man3 cat1 cat3
+info "Testing $file"
+(cd ../.. ; zip -T "$file" ) || error_cleanup "errors in zipfile $file"
+cd ..
+
+# cleanup before exit
+cd "$tmpdir"
+rm -rf "$cdir"
+echo "done"
+# display
+ls -lG "$file"
diff --git a/contrib/ldns/net.c b/contrib/ldns/net.c
index 9e048d2cd8226d..57d4dff24dbe1d 100644
--- a/contrib/ldns/net.c
+++ b/contrib/ldns/net.c
@@ -198,11 +198,12 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 #ifndef S_SPLINT_S
 	if ((sockfd = socket((int)((struct sockaddr*)to)->sa_family, SOCK_STREAM, 
 					IPPROTO_TCP)) == SOCK_INVALID) {
-		return 0;
+		return -1;
 	}
 #endif
 	if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == SOCK_INVALID){
-		return 0;
+		close_socket(sockfd);
+		return -1;
 	}
 
 	/* perform nonblocking connect, to be able to wait with select() */
@@ -215,13 +216,13 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 		if(1) {
 #endif
 			close_socket(sockfd);
-			return 0;
+			return -1;
 		}
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() != WSAEINPROGRESS &&
 			WSAGetLastError() != WSAEWOULDBLOCK) {
 			close_socket(sockfd);
-			return 0;
+			return -1;
 		}
 #endif
 		/* error was only telling us that it would block */
@@ -234,7 +235,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 
 		if(!ldns_sock_wait(sockfd, timeout, 1)) {
 			close_socket(sockfd);
-			return 0;
+			return -1;
 		}
 
 		/* check if there is a pending error for nonblocking connect */
@@ -255,7 +256,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 			close_socket(sockfd);
 			/* error in errno for our user */
 			errno = error;
-			return 0;
+			return -1;
 		}
 #else /* USE_WINSOCK */
 		if(error == WSAEINPROGRESS)
@@ -265,7 +266,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 		else if(error != 0) {
 			close_socket(sockfd);
 			errno = error;
-			return 0;
+			return -1;
 		}
 #endif /* USE_WINSOCK */
 		/* connected */
@@ -281,6 +282,14 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
 int
 ldns_tcp_connect(const struct sockaddr_storage *to, socklen_t tolen, 
 		struct timeval timeout)
+{
+	int s = ldns_tcp_connect_from(to, tolen, NULL, 0, timeout);
+	return s > 0 ? s : 0;
+}
+
+int
+ldns_tcp_connect2(const struct sockaddr_storage *to, socklen_t tolen, 
+		struct timeval timeout)
 {
 	return ldns_tcp_connect_from(to, tolen, NULL, 0, timeout);
 }
@@ -295,13 +304,9 @@ ldns_tcp_bgsend_from(ldns_buffer *qbin,
 	
 	sockfd = ldns_tcp_connect_from(to, tolen, from, fromlen, timeout);
 	
-	if (sockfd == 0) {
-		return 0;
-	}
-	
-	if (ldns_tcp_send_query(qbin, sockfd, to, tolen) == 0) {
+	if (sockfd >= 0 && ldns_tcp_send_query(qbin, sockfd, to, tolen) == 0) {
 		close_socket(sockfd);
-		return 0;
+		return -1;
 	}
 	
 	return sockfd;
@@ -312,9 +317,17 @@ ldns_tcp_bgsend(ldns_buffer *qbin,
 		const struct sockaddr_storage *to, socklen_t tolen, 
 		struct timeval timeout)
 {
-	return ldns_tcp_bgsend_from(qbin, to, tolen, NULL, 0, timeout);
+	int s = ldns_tcp_bgsend_from(qbin, to, tolen, NULL, 0, timeout);
+	return s > 0 ? s : 0;
 }
 
+int
+ldns_tcp_bgsend2(ldns_buffer *qbin,
+		const struct sockaddr_storage *to, socklen_t tolen, 
+		struct timeval timeout)
+{
+	return ldns_tcp_bgsend_from(qbin, to, tolen, NULL, 0, timeout);
+}
 
 /* keep in mind that in DNS tcp messages the first 2 bytes signal the
  * amount data to expect
@@ -330,24 +343,19 @@ ldns_tcp_send_from(uint8_t **result,  ldns_buffer *qbin,
 	
 	sockfd = ldns_tcp_bgsend_from(qbin, to, tolen, from, fromlen, timeout);
 	
-	if (sockfd == 0) {
+	if (sockfd == -1) {
 		return LDNS_STATUS_ERR;
 	}
 
 	answer = ldns_tcp_read_wire_timeout(sockfd, answer_size, timeout);
 	close_socket(sockfd);
 
-	if (*answer_size == 0) {
+	if (!answer) {
 		/* oops */
 		return LDNS_STATUS_NETWORK_ERR;
 	}
 
-	/* resize accordingly */
-	*result = LDNS_XREALLOC(answer, uint8_t, (size_t)*answer_size);
-        if(!*result) {
-                LDNS_FREE(answer);
-                return LDNS_STATUS_MEM_ERR;
-        }
+	*result = answer;
 	return LDNS_STATUS_OK;
 }
 
@@ -368,13 +376,28 @@ ldns_udp_connect(const struct sockaddr_storage *to, struct timeval ATTR_UNUSED(t
 #ifndef S_SPLINT_S
 	if ((sockfd = socket((int)((struct sockaddr*)to)->sa_family, SOCK_DGRAM, 
 					IPPROTO_UDP)) 
-			== -1) {
+			== SOCK_INVALID) {
                 return 0;
         }
 #endif
 	return sockfd;
 }
 
+int
+ldns_udp_connect2(const struct sockaddr_storage *to, struct timeval ATTR_UNUSED(timeout))
+{
+	int sockfd;
+
+#ifndef S_SPLINT_S
+	if ((sockfd = socket((int)((struct sockaddr*)to)->sa_family, SOCK_DGRAM, 
+					IPPROTO_UDP)) 
+			== SOCK_INVALID) {
+                return -1;
+        }
+#endif
+	return sockfd;
+}
+
 static int
 ldns_udp_bgsend_from(ldns_buffer *qbin,
 		const struct sockaddr_storage *to  , socklen_t tolen, 
@@ -383,19 +406,20 @@ ldns_udp_bgsend_from(ldns_buffer *qbin,
 {
 	int sockfd;
 
-	sockfd = ldns_udp_connect(to, timeout);
+	sockfd = ldns_udp_connect2(to, timeout);
 
-	if (sockfd == 0) {
-		return 0;
+	if (sockfd == -1) {
+		return -1;
 	}
 
 	if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == -1){
-		return 0;
+		close_socket(sockfd);
+		return -1;
 	}
 
 	if (ldns_udp_send_query(qbin, sockfd, to, tolen) == 0) {
 		close_socket(sockfd);
-		return 0;
+		return -1;
 	}
 	return sockfd;
 }
@@ -404,6 +428,15 @@ int
 ldns_udp_bgsend(ldns_buffer *qbin,
 		const struct sockaddr_storage *to  , socklen_t tolen, 
 		struct timeval timeout)
+{
+	int s = ldns_udp_bgsend_from(qbin, to, tolen, NULL, 0, timeout);
+	return s > 0 ? s : 0;
+}
+
+int
+ldns_udp_bgsend2(ldns_buffer *qbin,
+		const struct sockaddr_storage *to  , socklen_t tolen, 
+		struct timeval timeout)
 {
 	return ldns_udp_bgsend_from(qbin, to, tolen, NULL, 0, timeout);
 }
@@ -419,7 +452,7 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin,
 
 	sockfd = ldns_udp_bgsend_from(qbin, to, tolen, from, fromlen, timeout);
 
-	if (sockfd == 0) {
+	if (sockfd == -1) {
 		return LDNS_STATUS_SOCKET_ERROR;
 	}
 
@@ -430,14 +463,14 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin,
 	}
 
         /* set to nonblocking, so if the checksum is bad, it becomes
-         * an EGAIN error and the ldns_udp_send function does not block,
+         * an EAGAIN error and the ldns_udp_send function does not block,
          * but returns a 'NETWORK_ERROR' much like a timeout. */
         ldns_sock_nonblock(sockfd);
 
 	answer = ldns_udp_read_wire(sockfd, answer_size, NULL, NULL);
 	close_socket(sockfd);
 
-	if (*answer_size == 0) {
+	if (!answer) {
 		/* oops */
 		return LDNS_STATUS_NETWORK_ERR;
 	}
@@ -461,7 +494,7 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf
 	uint8_t i;
 
 	struct sockaddr_storage *src = NULL;
-	size_t src_len;
+	size_t src_len = 0;
 	struct sockaddr_storage *ns;
 	size_t ns_len;
 	struct timeval tv_s;
@@ -571,6 +604,9 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf
 		if (!reply_bytes) {
 			/* the current nameserver seems to have a problem, blacklist it */
 			if (ldns_resolver_fail(r)) {
+				if(src) {
+					LDNS_FREE(src);
+				}
 				LDNS_FREE(ns);
 				return LDNS_STATUS_ERR;
 			} else {
@@ -581,10 +617,12 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf
 		
 		status = ldns_wire2pkt(&reply, reply_bytes, reply_size);
 		if (status != LDNS_STATUS_OK) {
+			if(src) LDNS_FREE(src);
 			LDNS_FREE(reply_bytes);
 			LDNS_FREE(ns);
 			return status;
 		}
+		assert(reply);
 		
 		LDNS_FREE(ns);
 		gettimeofday(&tv_e, NULL);
@@ -676,9 +714,6 @@ ldns_udp_send_query(ldns_buffer *qbin, int sockfd, const struct sockaddr_storage
 	if (bytes == -1 || (size_t)bytes != ldns_buffer_position(qbin)) {
 		return 0;
 	}
-	if ((size_t) bytes != ldns_buffer_position(qbin)) {
-		return 0;
-	}
 	return bytes;
 }
 
@@ -918,6 +953,9 @@ ldns_axfr_start(ldns_resolver *resolver, const ldns_rdf *domain, ldns_rr_class c
 				src, (socklen_t)src_len,
 				ldns_resolver_timeout(resolver));
 	}
+	if (src) {
+		LDNS_FREE(src);
+	}
 
 	if (resolver->_socket == SOCK_INVALID) {
 		ldns_pkt_free(query);
diff --git a/contrib/ldns/packaging/fedora/ldns.spec b/contrib/ldns/packaging/fedora/ldns.spec
index 6658d011a00037..9b02cfd26b1178 100644
--- a/contrib/ldns/packaging/fedora/ldns.spec
+++ b/contrib/ldns/packaging/fedora/ldns.spec
@@ -23,7 +23,7 @@ BuildRequires:  python-devel, swig
 %endif
 
 %description
-ldns is a library with the aim to simplify DNS programing in C. All
+ldns is a library with the aim to simplify DNS programming in C. All
 lowlevel DNS/DNSSEC operations are supported. We also define a higher
 level API which allows a programmer to (for instance) create or sign
 packets.
@@ -125,7 +125,7 @@ rm -rf %{buildroot}
 
 * Wed Jun 08 2011 Paul Wouters <paul@xelerance.com> - 1.6.10-1
 - Updated to 1.6.10
-- commented out build dependancies for svn snapshots
+- commented out build dependencies for svn snapshots
 
 * Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.6.9-1
 - Updated to 1.6.9
diff --git a/contrib/ldns/packaging/ldns-config.in b/contrib/ldns/packaging/ldns-config.in
index ffb2c57f3471c9..623f77e54ea4a4 100755
--- a/contrib/ldns/packaging/ldns-config.in
+++ b/contrib/ldns/packaging/ldns-config.in
@@ -4,26 +4,37 @@ prefix="@prefix@"
 exec_prefix="@exec_prefix@"
 VERSION="@PACKAGE_VERSION@"
 CFLAGS="@CFLAGS@"
-CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@ @PYTHON_CPPFLAGS@"
-LDFLAGS="@LDFLAGS@ @LIBSSL_LDFLAGS@ @PYTHON_LDFLAGS@"
+CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@"
+LDFLAGS="@LDFLAGS@ @LIBSSL_LDFLAGS@"
+PYTHON_CPPFLAGS="@PYTHON_CPPFLAGS@"
+PYTHON_LDFLAGS="@PYTHON_LDFLAGS@"
 LIBS="@LIBS@ @LIBSSL_LIBS@"
 LIBDIR="@libdir@"
 INCLUDEDIR="@includedir@"
 LIBVERSION="@VERSION_INFO@"
 
+
 for arg in $@
 do
     if [ $arg = "--cflags" ]
     then
         echo "-I${INCLUDEDIR}"
     fi
+    if [ $arg = "--python-cflags" ]
+    then
+        echo "${PYTHON_CPPFLAGS} -I${INCLUDEDIR}"
+    fi
     if [ $arg = "--libs" ]
     then
         echo "${LDFLAGS} -L${LIBDIR} ${LIBS} -lldns"
     fi
+    if [ $arg = "--python-libs" ]
+    then
+        echo "${LDFLAGS} ${PYTHON_LDFLAGS} -L${LIBDIR} ${LIBS} -lldns"
+    fi
     if [ $arg = "-h" ] || [ $arg = "--help" ]
     then
-        echo "Usage: $0 [--cflags] [--libs] [--version]"
+        echo "Usage: $0 [--cflags] [--python-cflags] [--libs] [--python-libs] [--version]"
     fi
     if [ $arg = "--version" ]
     then
diff --git a/contrib/ldns/packet.c b/contrib/ldns/packet.c
index 95f8f3fe4d248b..d2587a8141f3cf 100644
--- a/contrib/ldns/packet.c
+++ b/contrib/ldns/packet.c
@@ -26,6 +26,7 @@
  */
 
 #define LDNS_EDNS_MASK_DO_BIT 0x8000
+#define LDNS_EDNS_MASK_UNASSIGNED (0xFFFF & ~LDNS_EDNS_MASK_DO_BIT)
 
 /* TODO defines for 3600 */
 /* convert to and from numerical flag values */
@@ -242,6 +243,19 @@ ldns_pkt_set_edns_do(ldns_pkt *packet, bool value)
 	}
 }
 
+uint16_t
+ldns_pkt_edns_unassigned(const ldns_pkt *packet)
+{
+	return (packet->_edns_z & LDNS_EDNS_MASK_UNASSIGNED);
+}
+
+void
+ldns_pkt_set_edns_unassigned(ldns_pkt *packet, uint16_t value)
+{
+	packet->_edns_z = (packet->_edns_z & ~LDNS_EDNS_MASK_UNASSIGNED)
+			| (value & LDNS_EDNS_MASK_UNASSIGNED);
+}
+
 ldns_rdf *
 ldns_pkt_edns_data(const ldns_pkt *packet)
 {
@@ -375,6 +389,7 @@ ldns_pkt_rr(const ldns_pkt *pkt, ldns_pkt_section sec, const ldns_rr *rr)
 		return ldns_rr_list_contains_rr(ldns_pkt_additional(pkt), rr);
 	case LDNS_SECTION_ANY:
 		result = ldns_rr_list_contains_rr(ldns_pkt_question(pkt), rr);
+		/* fallthrough */
 	case LDNS_SECTION_ANY_NOQUESTION:
 		result = result
 		    || ldns_rr_list_contains_rr(ldns_pkt_answer(pkt), rr)
@@ -623,6 +638,15 @@ ldns_pkt_set_edns_data(ldns_pkt *packet, ldns_rdf *data)
 	packet->_edns_data = data;
 }
 
+void
+ldns_pkt_set_edns_option_list(ldns_pkt *packet, ldns_edns_option_list *list)
+{
+	if (packet->_edns_list)
+		ldns_edns_option_list_deep_free(packet->_edns_list);
+	packet->_edns_list = list;
+}
+
+
 void
 ldns_pkt_set_section_count(ldns_pkt *packet, ldns_pkt_section s, uint16_t count)
 {
@@ -723,15 +747,95 @@ ldns_pkt_safe_push_rr_list(ldns_pkt *p, ldns_pkt_section s, ldns_rr_list *list)
 }
 
 bool
-ldns_pkt_edns(const ldns_pkt *pkt) {
+ldns_pkt_edns(const ldns_pkt *pkt)
+{
 	return (ldns_pkt_edns_udp_size(pkt) > 0 ||
 		ldns_pkt_edns_extended_rcode(pkt) > 0 ||
 		ldns_pkt_edns_data(pkt) ||
 		ldns_pkt_edns_do(pkt) ||
+		pkt->_edns_list ||
                 pkt->_edns_present
 	       );
 }
 
+ldns_edns_option_list*
+pkt_edns_data2edns_option_list(const ldns_rdf *edns_data);
+ldns_edns_option_list*
+pkt_edns_data2edns_option_list(const ldns_rdf *edns_data)
+{
+	size_t pos = 0;
+	ldns_edns_option_list* edns_list;
+	size_t max;
+	const uint8_t* wire;
+
+	if (!edns_data)
+		return NULL;
+
+	max = ldns_rdf_size(edns_data);
+	wire = ldns_rdf_data(edns_data);
+	if (!max)
+		return NULL;
+
+	if (!(edns_list = ldns_edns_option_list_new()))
+		return NULL;
+
+	while (pos < max) {
+		ldns_edns_option* edns;
+		uint8_t *data;
+
+		if (pos + 4 > max) { /* make sure the header is  */
+			ldns_edns_option_list_deep_free(edns_list);
+			return NULL;
+		}
+		ldns_edns_option_code code = ldns_read_uint16(&wire[pos]);
+		size_t size = ldns_read_uint16(&wire[pos+2]);
+		pos += 4;
+
+		if (pos + size > max) { /* make sure the size fits the data */
+			ldns_edns_option_list_deep_free(edns_list);
+			return NULL;
+		}
+		data = LDNS_XMALLOC(uint8_t, size);
+
+		if (!data) {
+			ldns_edns_option_list_deep_free(edns_list);
+			return NULL;
+		}
+		memcpy(data, &wire[pos], size);
+		pos += size;
+
+		edns = ldns_edns_new(code, size, data);
+
+		if (!edns) {
+			ldns_edns_option_list_deep_free(edns_list);
+			return NULL;
+		}
+		if (!ldns_edns_option_list_push(edns_list, edns)) {
+			ldns_edns_option_list_deep_free(edns_list);
+			return NULL;
+		}
+	}
+	return edns_list;
+
+}
+
+ldns_edns_option_list*
+ldns_pkt_edns_get_option_list(ldns_pkt *packet)
+{
+	/* return the list if it already exists */
+	if (packet->_edns_list != NULL)
+		return packet->_edns_list;
+
+	/* if the list doesn't exists, we create it by parsing the
+	 * packet->_edns_data
+	 */
+	if (!ldns_pkt_edns_data(packet))
+		return NULL;
+
+	return ( packet->_edns_list
+	       = pkt_edns_data2edns_option_list(ldns_pkt_edns_data(packet)));
+}
+
 
 /* Create/destroy/convert functions
  */
@@ -781,8 +885,9 @@ ldns_pkt_new(void)
 	ldns_pkt_set_edns_version(packet, 0);
 	ldns_pkt_set_edns_z(packet, 0);
 	ldns_pkt_set_edns_data(packet, NULL);
+	packet->_edns_list = NULL;
 	packet->_edns_present = false;
-	
+
 	ldns_pkt_set_tsig(packet, NULL);
 	
 	return packet;
@@ -799,6 +904,7 @@ ldns_pkt_free(ldns_pkt *packet)
 		ldns_rr_list_deep_free(packet->_additional);
 		ldns_rr_free(packet->_tsig_rr);
 		ldns_rdf_deep_free(packet->_edns_data);
+		ldns_edns_option_list_deep_free(packet->_edns_list);
 		ldns_rdf_deep_free(packet->_answerfrom);
 		LDNS_FREE(packet);
 	}
@@ -928,11 +1034,13 @@ ldns_pkt_query_new_frm_str_internal(ldns_pkt **p, const char *name,
 	}
 
 	if (!ldns_pkt_set_flags(packet, flags)) {
+		ldns_pkt_free(packet);
 		return LDNS_STATUS_ERR;
 	}
 
 	question_rr = ldns_rr_new();
 	if (!question_rr) {
+		ldns_pkt_free(packet);
 		return LDNS_STATUS_MEM_ERR;
 	}
 
@@ -1146,6 +1254,9 @@ ldns_pkt_clone(const ldns_pkt *pkt)
 		ldns_pkt_set_edns_data(new_pkt, 
 			ldns_rdf_clone(ldns_pkt_edns_data(pkt)));
 	ldns_pkt_set_edns_do(new_pkt, ldns_pkt_edns_do(pkt));
+	if (pkt->_edns_list)
+		ldns_pkt_set_edns_option_list(new_pkt,
+			ldns_edns_option_list_clone(pkt->_edns_list));
 
 	ldns_rr_list_deep_free(new_pkt->_question);
 	ldns_rr_list_deep_free(new_pkt->_answer);
diff --git a/contrib/ldns/parse.c b/contrib/ldns/parse.c
index e68627c25a7259..9698ba71e881e8 100644
--- a/contrib/ldns/parse.c
+++ b/contrib/ldns/parse.c
@@ -27,31 +27,45 @@ ldns_fget_token(FILE *f, char *token, const char *delim, size_t limit)
 	return ldns_fget_token_l(f, token, delim, limit, NULL);
 }
 
-ssize_t
-ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *line_nr)
+ldns_status
+ldns_fget_token_l_st(FILE *f, char **token, size_t *limit, bool fixed
+                    , const char *delim, int *line_nr)
 {
 	int c, prev_c;
-	int p; /* 0 -> no parenthese seen, >0 nr of ( seen */
+	int p; /* 0 -> no parentheses seen, >0 nr of ( seen */
 	int com, quoted;
-	char *t;
+	char *t, *old_token;
 	size_t i;
 	const char *d;
 	const char *del;
 
-	/* standard delimeters */
+	/* standard delimiters */
 	if (!delim) {
 		/* from isspace(3) */
 		del = LDNS_PARSE_NORMAL;
 	} else {
 		del = delim;
 	}
+	if (!token || !limit)
+		return LDNS_STATUS_NULL;
 
+	if (fixed) {
+		if (*token == NULL || *limit == 0)
+			return LDNS_STATUS_NULL;
+
+	} else if (*token == NULL) {
+		*limit = LDNS_MAX_LINELEN;
+		if (!(*token = LDNS_XMALLOC(char, *limit + 1)))
+			return LDNS_STATUS_MEM_ERR;
+
+	} else if (*limit == 0)
+		return LDNS_STATUS_ERR;
 	p = 0;
 	i = 0;
 	com = 0;
 	quoted = 0;
 	prev_c = 0;
-	t = token;
+	t = *token;
 	if (del[0] == '"') {
 		quoted = 1;
 	}
@@ -79,7 +93,8 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li
 		if (p < 0) {
 			/* more ) then ( - close off the string */
 			*t = '\0';
-			return 0;
+			return i == 0 ? LDNS_STATUS_SYNTAX_EMPTY
+			              : LDNS_STATUS_OK;
 		}
 
 		/* do something with comments ; */
@@ -113,11 +128,28 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li
 			continue;
 		}
 
-		if (c == '\n' && p != 0 && t > token) {
+		if (c == '\n' && p != 0 && t > *token) {
 			/* in parentheses */
 			if (line_nr) {
 				*line_nr = *line_nr + 1;
 			}
+			if (*limit > 0
+			&&  (i >= *limit || (size_t)(t - *token) >= *limit)) {
+				if (fixed) {
+					*t = '\0';
+					return LDNS_STATUS_SYNTAX_ERR;
+				}
+				old_token = *token;
+				*limit *= 2;
+				*token = LDNS_XREALLOC(*token, char, *limit + 1);
+				if (*token == NULL) {
+					*token = old_token;
+					*t = '\0';
+					return LDNS_STATUS_MEM_ERR;
+				}
+				if (*token != old_token)
+					t = *token + (t - old_token);
+			}
 			*t++ = ' ';
 			prev_c = c;
 			continue;
@@ -135,30 +167,42 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li
 		if (c != '\0' && c != '\n') {
 			i++;
 		}
-		if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
-			*t = '\0';
-			return -1;
+		if (*limit > 0
+		&&  (i >= *limit || (size_t)(t - *token) >= *limit)) {
+			if (fixed) {
+				*t = '\0';
+				return LDNS_STATUS_SYNTAX_ERR;
+			}
+			old_token = *token;
+			*limit *= 2;
+			*token = LDNS_XREALLOC(*token, char, *limit + 1);
+			if (*token == NULL) {
+				*token = old_token;
+				*t = '\0';
+				return LDNS_STATUS_MEM_ERR;
+			}
+			if (*token != old_token)
+				t = *token + (t - old_token);
 		}
 		if (c != '\0' && c != '\n') {
 			*t++ = c;
 		}
+		if (c == '\n' && line_nr) {
+			*line_nr = *line_nr + 1;
+		}
 		if (c == '\\' && prev_c == '\\')
 			prev_c = 0;
 		else	prev_c = c;
 	}
 	*t = '\0';
 	if (c == EOF) {
-		return (ssize_t)i;
+		return i == 0 ? LDNS_STATUS_SYNTAX_EMPTY : LDNS_STATUS_OK;
 	}
 
-	if (i == 0) {
-		/* nothing read */
-		return -1;
-	}
 	if (p != 0) {
-		return -1;
+		return LDNS_STATUS_SYNTAX_ERR;
 	}
-	return (ssize_t)i;
+	return i == 0 ? LDNS_STATUS_SYNTAX_EMPTY : LDNS_STATUS_OK;
 
 tokenread:
 	if(*del == '"') /* do not skip over quotes, they are significant */
@@ -166,10 +210,21 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li
 	else	ldns_fskipcs_l(f, del, line_nr);
 	*t = '\0';
 	if (p != 0) {
-		return -1;
+		return LDNS_STATUS_SYNTAX_ERR;
 	}
+	return i == 0 ? LDNS_STATUS_SYNTAX_EMPTY : LDNS_STATUS_OK;
+}
 
-	return (ssize_t)i;
+
+ssize_t
+ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *line_nr)
+{
+	if (limit == 0)
+		limit = LDNS_MAX_LINELEN;
+	if (ldns_fget_token_l_st(f, &token, &limit, true, delim, line_nr))
+		return -1;
+	else
+		return (ssize_t)strlen(token);
 }
 
 ssize_t
@@ -219,7 +274,7 @@ ssize_t
 ldns_bget_token(ldns_buffer *b, char *token, const char *delim, size_t limit)
 {
 	int c, lc;
-	int p; /* 0 -> no parenthese seen, >0 nr of ( seen */
+	int p; /* 0 -> no parentheses seen, >0 nr of ( seen */
 	int com, quoted;
 	char *t;
 	size_t i;
diff --git a/contrib/ldns/radix.c b/contrib/ldns/radix.c
index 43f73653d29a05..9695e137baa4bf 100644
--- a/contrib/ldns/radix.c
+++ b/contrib/ldns/radix.c
@@ -225,9 +225,9 @@ ldns_radix_insert(ldns_radix_t* tree, uint8_t* key, radix_strlen_t len,
 		}
 	} else if (pos == len) {
 		/** Exact match found */
+		LDNS_FREE(add);
 		if (prefix->data) {
 			/* Element already exists */
-			LDNS_FREE(add);
 			return LDNS_STATUS_EXISTS_ERR;
 		}
 		prefix->data = data;
@@ -1120,12 +1120,15 @@ ldns_radix_array_split(ldns_radix_array_t* array, uint8_t* key,
 		if (array->len - common_len > 1) {
 			if (!ldns_radix_prefix_remainder(common_len+1,
 				array->str, array->len, &s1, &l1)) {
+				LDNS_FREE(common);
 				return 0;
 			}
 		}
 		if (strlen_to_add - common_len > 1) {
 			if (!ldns_radix_prefix_remainder(common_len+1,
 				str_to_add, strlen_to_add, &s2, &l2)) {
+				LDNS_FREE(common);
+				LDNS_FREE(s1);
 				return 0;
 			}
 		}
diff --git a/contrib/ldns/rbtree.c b/contrib/ldns/rbtree.c
index 01ae9c704263f3..d43081a1b5f9a8 100644
--- a/contrib/ldns/rbtree.c
+++ b/contrib/ldns/rbtree.c
@@ -71,7 +71,7 @@ static void ldns_rbtree_insert_fixup(ldns_rbtree_t *rbtree, ldns_rbnode_t *node)
 static void ldns_rbtree_delete_fixup(ldns_rbtree_t* rbtree, ldns_rbnode_t* child, ldns_rbnode_t* child_parent);
 
 /*
- * Creates a new red black tree, intializes and returns a pointer to it.
+ * Creates a new red black tree, initializes and returns a pointer to it.
  *
  * Return NULL on failure.
  *
diff --git a/contrib/ldns/rdata.c b/contrib/ldns/rdata.c
index 3bc4b391e339a3..3f899a217eb7f6 100644
--- a/contrib/ldns/rdata.c
+++ b/contrib/ldns/rdata.c
@@ -360,6 +360,12 @@ ldns_rdf_new_frm_str(ldns_rdf_type type, const char *str)
 	case LDNS_RDF_TYPE_MATCHING_TYPE:
 		status = ldns_str2rdf_matching_type(&rdf, str);
 		break;
+	case LDNS_RDF_TYPE_AMTRELAY:
+		status = ldns_str2rdf_amtrelay(&rdf, str);
+		break;
+	case LDNS_RDF_TYPE_SVCPARAMS:
+		status = ldns_str2rdf_svcparams(&rdf, str);
+		break;
 	case LDNS_RDF_TYPE_NONE:
 	default:
 		/* default default ??? */
@@ -618,7 +624,7 @@ ldns_octet(char *word, size_t *length)
                         return LDNS_STATUS_DDD_OVERFLOW;
                     }
                 } else {
-                    /* an espaced character, like \<space> ? 
+                    /* an escaped character, like \<space> ? 
                     * remove the '\' keep the rest */
                     *p = *++s;
                     (*length)++;
diff --git a/contrib/ldns/resolver.c b/contrib/ldns/resolver.c
index 79f502588a99fd..f9ec65a559665b 100644
--- a/contrib/ldns/resolver.c
+++ b/contrib/ldns/resolver.c
@@ -764,7 +764,7 @@ ldns_resolver_new_frm_fp(ldns_resolver **res, FILE *fp)
 ldns_status
 ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
 {
-	ldns_resolver *r;
+	ldns_resolver *r = NULL;
 	const char *keyword[LDNS_RESOLV_KEYWORDS];
 	char word[LDNS_MAX_LINELEN + 1];
 	int8_t expect;
@@ -780,7 +780,7 @@ ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
         if(!line_nr) line_nr = &lnr;
 
 	if(!fp) {
-		myfp = fopen("/etc/resolv.conf", "r");
+		myfp = fopen(LDNS_RESOLV_CONF, "r");
 		if(!myfp)
 			return LDNS_STATUS_FILE_ERR;
 	}
@@ -800,7 +800,6 @@ ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
 	keyword[LDNS_RESOLV_SORTLIST] = "sortlist";
 	keyword[LDNS_RESOLV_OPTIONS] = "options";
 	keyword[LDNS_RESOLV_ANCHOR] = "anchor";
-	expect = LDNS_RESOLV_KEYWORD;
 
 	r = ldns_resolver_new();
 	if (!r) {
@@ -860,6 +859,7 @@ ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
 				gtr = ldns_fget_token_l(myfp, word, LDNS_PARSE_NORMAL, 0, line_nr);
 				if (gtr == 0) {
 					if(!fp) fclose(myfp);
+					ldns_resolver_deep_free(r);
 					return LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR;
 				}
                                 if(word[0] == '#') {
@@ -868,8 +868,8 @@ ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
                                 }
 				tmp = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, word);
 				if (!tmp) {
-					ldns_resolver_deep_free(r);
 					if(!fp) fclose(myfp);
+					ldns_resolver_deep_free(r);
 					return LDNS_STATUS_SYNTAX_DNAME_ERR;
 				}
 
@@ -882,6 +882,7 @@ ldns_resolver_new_frm_fp_l(ldns_resolver **res, FILE *fp, int *line_nr)
 				gtr = ldns_fget_token_l(myfp, word, LDNS_PARSE_NORMAL, 0, line_nr);
 				if (gtr == 0) {
 					if(!fp) fclose(myfp);
+					ldns_resolver_deep_free(r);
 					return LDNS_STATUS_SYNTAX_MISSING_VALUE_ERR;
 				}
                                 if(word[0] == '#') {
@@ -1108,7 +1109,8 @@ ldns_resolver_search_status(ldns_pkt** pkt,
 
 			s = ldns_resolver_query_status(pkt, r,
 					new_name, t, c, flags);
-			ldns_rdf_free(new_name);
+			ldns_rdf_deep_free(new_name);
+
 			if (pkt && *pkt) {
 				if (s == LDNS_STATUS_OK && 
 						ldns_pkt_get_rcode(*pkt) ==
@@ -1132,6 +1134,7 @@ ldns_resolver_search(const ldns_resolver *r,const  ldns_rdf *name,
 	if (ldns_resolver_search_status(&pkt, (ldns_resolver *)r,
 				name, t, c, flags) != LDNS_STATUS_OK) {
 		ldns_pkt_free(pkt);
+		return NULL;
 	}
 	return pkt;
 }
@@ -1165,6 +1168,7 @@ ldns_resolver_query(const ldns_resolver *r, const ldns_rdf *name,
 	if (ldns_resolver_query_status(&pkt, (ldns_resolver *)r,
 				name, t, c, flags) != LDNS_STATUS_OK) {
 		ldns_pkt_free(pkt);
+		return NULL;
 	}
 	return pkt;
 }
@@ -1178,6 +1182,7 @@ ldns_resolver_backup_rtt(ldns_resolver *r)
 	if (old_rtt && ldns_resolver_nameserver_count(r)) {
 		new_rtt = LDNS_XMALLOC(size_t
 				, ldns_resolver_nameserver_count(r));
+		if (!new_rtt) return NULL;
 		memcpy(new_rtt, old_rtt, sizeof(size_t)
 				* ldns_resolver_nameserver_count(r));
 		ldns_resolver_set_rtt(r, new_rtt);
@@ -1240,6 +1245,7 @@ ldns_resolver_send_pkt(ldns_pkt **answer, ldns_resolver *r,
 				    ldns_pkt_tc(answer_pkt)) {
 					ldns_resolver_set_usevc(r, true);
 					ldns_pkt_free(answer_pkt);
+					answer_pkt = NULL;
 					stat = ldns_send(&answer_pkt, r, query_pkt);
 					ldns_resolver_set_usevc(r, false);
 				}
@@ -1247,7 +1253,7 @@ ldns_resolver_send_pkt(ldns_pkt **answer, ldns_resolver *r,
 		}
 	}
 
-	if (answer) {
+	if (answer && answer_pkt) {
 		*answer = answer_pkt;
 	}
 
@@ -1528,14 +1534,14 @@ void
 ldns_axfr_abort(ldns_resolver *resolver)
 {
 	/* Only abort if an actual AXFR is in progress */
-	if (resolver->_socket != 0)
+	if (resolver->_socket != -1)
 	{
 #ifndef USE_WINSOCK
 		close(resolver->_socket);
 #else
 		closesocket(resolver->_socket);
 #endif
-		resolver->_socket = 0;
+		resolver->_socket = -1;
 	}
 }
 
diff --git a/contrib/ldns/rr.c b/contrib/ldns/rr.c
index c971610e96bf3e..6167a7aa193892 100644
--- a/contrib/ldns/rr.c
+++ b/contrib/ldns/rr.c
@@ -20,6 +20,12 @@
 #define LDNS_TTL_DATALEN    21
 #define LDNS_RRLIST_INIT    8
 
+#define _IS_WHITESPACE(chr) \
+    ( NULL != strchr( LDNS_PARSE_NO_NL, chr) )
+
+#define _BUFFER_IS_AT_WHITESPACE(rd_buf) \
+    _IS_WHITESPACE(*(ldns_buffer_current(rd_buf)))
+
 ldns_rr *
 ldns_rr_new(void)
 {
@@ -111,8 +117,9 @@ ldns_rdf_type_maybe_quoted(ldns_rdf_type rdf_type)
  */
 static ldns_status
 ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
-							 uint32_t default_ttl, const ldns_rdf *origin,
-							 ldns_rdf **prev, bool question)
+                             uint32_t default_ttl, const ldns_rdf *origin,
+                             ldns_rdf **prev, bool question,
+			     bool *explicit_ttl)
 {
 	ldns_rr *new;
 	const ldns_rr_descriptor *desc;
@@ -125,6 +132,7 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 	ldns_rr_class clas_val;
 	char  *clas = NULL;
 	char  *type = NULL;
+	size_t type_sz;
 	char  *rdata = NULL;
 	char  *rd = NULL;
 	char  *xtok = NULL; /* For RDF types with spaces (i.e. extra tokens) */
@@ -197,6 +205,9 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		} else {
 			ttl_val = default_ttl;
 		}
+		if (explicit_ttl)
+			*explicit_ttl = false;
+
 		/* we not ASSUMING the TTL is missing and that
 		 * the rest of the RR is still there. That is
 		 * CLASS TYPE RDATA
@@ -208,13 +219,17 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		 */
 		if (clas_val == 0) {
 			clas_val = LDNS_RR_CLASS_IN;
-			type = LDNS_XMALLOC(char, strlen(ttl) + 1);
+			type_sz = strlen(ttl) + 1;
+			type = LDNS_XMALLOC(char, type_sz);
 			if (!type) {
 				goto memerror;
 			}
-			strncpy(type, ttl, strlen(ttl) + 1);
+			strlcpy(type, ttl, type_sz);
 		}
 	} else {
+		if (explicit_ttl)
+			*explicit_ttl = true;
+
 		if (-1 == ldns_bget_token(
 				rr_buf, clas, "\t\n ", LDNS_SYNTAX_DATALEN)) {
 
@@ -227,11 +242,12 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		 */
 		if (clas_val == 0) {
 			clas_val = LDNS_RR_CLASS_IN;
-			type = LDNS_XMALLOC(char, strlen(clas) + 1);
+			type_sz = strlen(clas) + 1;
+			type = LDNS_XMALLOC(char, type_sz);
 			if (!type) {
 				goto memerror;
 			}
-			strncpy(type, clas, strlen(clas) + 1);
+			strlcpy(type, clas, type_sz);
 		}
 	}
 	/* the rest should still be waiting for us */
@@ -256,7 +272,7 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 	}
 	ldns_buffer_new_frm_data(rd_buf, rdata, strlen(rdata));
 
-	if (strlen(owner) <= 1 && strncmp(owner, "@", 1) == 0) {
+	if (strncmp(owner, "@", 1) == 0) {
 		if (origin) {
 			ldns_rr_set_owner(new, ldns_rdf_clone(origin));
 		} else if (prev && *prev) {
@@ -344,13 +360,16 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		switch (ldns_rr_descriptor_field_type(desc, r_cnt)) {
 		case LDNS_RDF_TYPE_B64        :
 		case LDNS_RDF_TYPE_HEX        : /* These rdf types may con- */
-		case LDNS_RDF_TYPE_LOC        : /* tain whitespace, only if */
-		case LDNS_RDF_TYPE_WKS        : /* it is the last rd field. */
+		case LDNS_RDF_TYPE_NSEC       : /* tain whitespace, only if */
+		case LDNS_RDF_TYPE_LOC        : /* it is the last rd field. */
+		case LDNS_RDF_TYPE_WKS        :
 		case LDNS_RDF_TYPE_IPSECKEY   :
-		case LDNS_RDF_TYPE_NSEC       :	if (r_cnt == r_max - 1) {
+		case LDNS_RDF_TYPE_AMTRELAY   :
+		case LDNS_RDF_TYPE_SVCPARAMS  :	if (r_cnt == r_max - 1) {
 							delimiters = "\n";
 							break;
 						}
+						/* fallthrough */
 		default                       :	delimiters = "\n\t "; 
 		}
 
@@ -359,16 +378,19 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 				desc, r_cnt)) &&
 				ldns_buffer_remaining(rd_buf) > 0){
 
-			/* skip spaces */
-			while (*(ldns_buffer_current(rd_buf)) == ' ') {
+			/* skip whitespace */
+			while (ldns_buffer_remaining(rd_buf) > 0 &&
+				_BUFFER_IS_AT_WHITESPACE(rd_buf)) {
 				ldns_buffer_skip(rd_buf, 1);
 			}
 
-			if (*(ldns_buffer_current(rd_buf)) == '\"') {
+			if (ldns_buffer_remaining(rd_buf) > 0 &&
+				*(ldns_buffer_current(rd_buf)) == '\"') {
 				delimiters = "\"\0";
 				ldns_buffer_skip(rd_buf, 1);
 				quoted = true;
-			} else if (ldns_rr_descriptor_field_type(desc, r_cnt)
+			}
+			if (!quoted && ldns_rr_descriptor_field_type(desc, r_cnt)
 					== LDNS_RDF_TYPE_LONG_STR) {
 
 				status = LDNS_STATUS_SYNTAX_RDATA_ERR;
@@ -380,9 +402,9 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		 * _maximum() only
 		 */
 
-		/* skip spaces */
+		/* skip whitespace */
 		while (ldns_buffer_position(rd_buf) < ldns_buffer_limit(rd_buf)
-				&& *(ldns_buffer_current(rd_buf)) == ' '
+				&& _BUFFER_IS_AT_WHITESPACE(rd_buf)
 				&& !quoted) {
 
 			ldns_buffer_skip(rd_buf, 1);
@@ -393,6 +415,7 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 				rd_buf, rd, delimiters, LDNS_MAX_RDFLEN))) {
 
 			done = true;
+			(void)done; /* we're breaking, so done not read anymore */
 			break;
 		}
 		/* hmmz, rfc3597 specifies that any type can be represented 
@@ -403,7 +426,7 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 
 		/* unknown RR data */
 		if (strncmp(rd, "\\#", 2) == 0 && !quoted &&
-				(rd_strlen == 2 || rd[2]==' ')) {
+				(rd_strlen == 2 || _IS_WHITESPACE(rd[2]))) {
 
 			was_unknown_rr_format = 1;
 			/* go back to before \#
@@ -432,18 +455,18 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 			while(cur_hex_data_size < 2 * hex_data_size) {
 				c = ldns_bget_token(rd_buf, rd,
 						delimiters, LDNS_MAX_RDFLEN);
-				if (c != -1) {
-					rd_strlen = strlen(rd);
+				if (c == -1) {
+					status = LDNS_STATUS_SYNTAX_RDATA_ERR;
+					goto error;
 				}
-				if (c == -1 || 
-				    (size_t)cur_hex_data_size + rd_strlen >
+				rd_strlen = strlen(rd);
+				if ((size_t)cur_hex_data_size + rd_strlen >
 				    2 * (size_t)hex_data_size) {
-
 					status = LDNS_STATUS_SYNTAX_RDATA_ERR;
 					goto error;
 				}
-				strncpy(hex_data_str + cur_hex_data_size, rd,
-						rd_strlen);
+				strlcpy(hex_data_str + cur_hex_data_size, rd,
+						rd_strlen + 1);
 
 				cur_hex_data_size += rd_strlen;
 			}
@@ -573,10 +596,12 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 						    LDNS_RDF_TYPE_DNAME, ".")
 					    );
 
-				} else if (r && rd_strlen >= 1 && origin &&
-						!ldns_dname_str_absolute(rd)) {
+				} else if (r && rd_strlen >= 1
+				    && (origin || rr_type == LDNS_RR_TYPE_SOA)
+				    && !ldns_dname_str_absolute(rd)) {
 
-					status = ldns_dname_cat(r, origin);
+					status = ldns_dname_cat(r, origin
+					    ? origin : ldns_rr_owner(new));
 					if (status != LDNS_STATUS_OK) {
 						goto error;
 					}
@@ -594,14 +619,6 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 			}
 			ldns_rr_push_rdf(new, r);
 		}
-		if (quoted) {
-			if (ldns_buffer_available(rd_buf, 1)) {
-				ldns_buffer_skip(rd_buf, 1);
-			} else {
-				done = true;
-			}
-		}
-
 	} /* for (done = false, r_cnt = 0; !done && r_cnt < r_max; r_cnt++) */
 	LDNS_FREE(rd);
 	LDNS_FREE(xtok);
@@ -665,7 +682,8 @@ ldns_rr_new_frm_str(ldns_rr **newrr, const char *str,
 	                                    default_ttl,
 	                                    origin,
 	                                    prev,
-	                                    false);
+	                                    false,
+					    NULL);
 }
 
 ldns_status
@@ -677,7 +695,8 @@ ldns_rr_new_question_frm_str(ldns_rr **newrr, const char *str,
 	                                    0,
 	                                    origin,
 	                                    prev,
-	                                    true);
+	                                    true,
+					    NULL);
 }
 
 /* Strip whitespace from the start and the end of <line>.  */
@@ -703,43 +722,32 @@ ldns_rr_new_frm_fp(ldns_rr **newrr, FILE *fp, uint32_t *ttl, ldns_rdf **origin,
 }
 
 ldns_status
-ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev, int *line_nr)
+_ldns_rr_new_frm_fp_l_internal(ldns_rr **newrr, FILE *fp,
+		uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev,
+		int *line_nr, bool *explicit_ttl);
+ldns_status
+_ldns_rr_new_frm_fp_l_internal(ldns_rr **newrr, FILE *fp,
+		uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev,
+		int *line_nr, bool *explicit_ttl)
 {
-	char *line;
+	char *line = NULL;
+	size_t limit = 0;
 	const char *endptr;  /* unused */
 	ldns_rr *rr;
 	uint32_t ttl;
 	ldns_rdf *tmp;
 	ldns_status s;
-	ssize_t size;
 
 	if (default_ttl) {
 		ttl = *default_ttl;
 	} else {
 		ttl = 0;
 	}
-
-	line = LDNS_XMALLOC(char, LDNS_MAX_LINELEN + 1);
-	if (!line) {
-		return LDNS_STATUS_MEM_ERR;
-	}
-
 	/* read an entire line in from the file */
-	if ((size = ldns_fget_token_l(fp, line, LDNS_PARSE_SKIP_SPACE, LDNS_MAX_LINELEN, line_nr)) == -1) {
-		LDNS_FREE(line);
-		/* if last line was empty, we are now at feof, which is not
-		 * always a parse error (happens when for instance last line
-		 * was a comment)
-		 */
-		return LDNS_STATUS_SYNTAX_ERR;
-	}
-
-	/* we can have the situation, where we've read ok, but still got
-	 * no bytes to play with, in this case size is 0
-	 */
-	if (size == 0) {
+	if ((s = ldns_fget_token_l_st( fp, &line, &limit, false
+	                             , LDNS_PARSE_SKIP_SPACE, line_nr))) {
 		LDNS_FREE(line);
-		return LDNS_STATUS_SYNTAX_EMPTY;
+		return s;
 	}
 
 	if (strncmp(line, "$ORIGIN", 7) == 0 && isspace((unsigned char)line[7])) {
@@ -769,9 +777,11 @@ ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl, ldns_rdf
 		return LDNS_STATUS_SYNTAX_EMPTY;
 	} else {
 		if (origin && *origin) {
-			s = ldns_rr_new_frm_str(&rr, (const char*) line, ttl, *origin, prev);
+			s = ldns_rr_new_frm_str_internal(&rr, (const char*)line,
+				ttl, *origin, prev, false, explicit_ttl);
 		} else {
-			s = ldns_rr_new_frm_str(&rr, (const char*) line, ttl, NULL, prev);
+			s = ldns_rr_new_frm_str_internal(&rr, (const char*)line,
+				ttl, NULL, prev, false, explicit_ttl);
 		}
 	}
 	LDNS_FREE(line);
@@ -786,6 +796,14 @@ ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl, ldns_rdf
 	return s;
 }
 
+ldns_status
+ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl,
+		ldns_rdf **origin, ldns_rdf **prev, int *line_nr)
+{
+	return _ldns_rr_new_frm_fp_l_internal(newrr, fp, default_ttl, origin,
+			prev, line_nr, NULL);
+}
+
 void
 ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
 {
@@ -830,7 +848,7 @@ ldns_rr_set_rdf(ldns_rr *rr, const ldns_rdf *f, size_t position)
 
 	rd_count = ldns_rr_rd_count(rr);
 	if (position < rd_count) {
-		/* dicard the old one */
+		/* discard the old one */
 		pop = rr->_rdata_fields[position];
 		rr->_rdata_fields[position] = (ldns_rdf*)f;
 		return pop;
@@ -1184,6 +1202,7 @@ ldns_rr_list_pop_rr(ldns_rr_list *rr_list)
 		        rr_list->_rrs = a;
 		        rr_list->_rr_capacity = cap;
                 }
+                /* if the realloc fails, the capacity for the list remains unchanged */
 	}
 
 	ldns_rr_list_set_rr_count(rr_list, rr_count - 1);
@@ -1311,7 +1330,7 @@ ldns_rr_set_push_rr(ldns_rr_list *rr_list, ldns_rr *rr)
 			return false;
 		}
 		/* ok, still alive - check if the rr already
-		 * exists - if so, dont' add it */
+		 * exists - if so, don't add it */
 		for(i = 0; i < rr_count; i++) {
 			if(ldns_rr_compare(
 					ldns_rr_list_rr(rr_list, i), rr) == 0) {
@@ -1958,6 +1977,17 @@ static const ldns_rdf_type type_openpgpkey_wireformat[] = {
 static const ldns_rdf_type type_csync_wireformat[] = {
 	LDNS_RDF_TYPE_INT32, LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_NSEC
 };
+static const ldns_rdf_type type_zonemd_wireformat[] = {
+	LDNS_RDF_TYPE_INT32,
+	LDNS_RDF_TYPE_INT8, LDNS_RDF_TYPE_INT8, LDNS_RDF_TYPE_HEX
+};
+#ifdef RRTYPE_SVCB_HTTPS
+static const ldns_rdf_type type_svcb_wireformat[] = {
+	LDNS_RDF_TYPE_INT16,
+	LDNS_RDF_TYPE_DNAME, 
+	LDNS_RDF_TYPE_SVCPARAMS
+};
+#endif
 /* nsec3 is some vars, followed by same type of data of nsec */
 static const ldns_rdf_type type_nsec3_wireformat[] = {
 /*	LDNS_RDF_TYPE_NSEC3_VARS, LDNS_RDF_TYPE_NSEC3_NEXT_OWNER, LDNS_RDF_TYPE_NSEC*/
@@ -2037,6 +2067,22 @@ static const ldns_rdf_type type_caa_wireformat[] = {
 	LDNS_RDF_TYPE_TAG,
 	LDNS_RDF_TYPE_LONG_STR
 };
+#ifdef RRTYPE_DOA
+static const ldns_rdf_type type_doa_wireformat[] = {
+	LDNS_RDF_TYPE_INT32,
+	LDNS_RDF_TYPE_INT32,
+	LDNS_RDF_TYPE_INT8,
+	LDNS_RDF_TYPE_STR,
+	LDNS_RDF_TYPE_B64
+};
+#endif
+#ifdef RRTYPE_AMTRELAY
+static const ldns_rdf_type type_amtrelay_wireformat[] = {
+	LDNS_RDF_TYPE_AMTRELAY
+};
+#endif
+
+
 /** \endcond */
 
 /** \cond */
@@ -2188,11 +2234,20 @@ static ldns_rr_descriptor rdata_field_descriptors[] = {
 #else
 {LDNS_RR_TYPE_NULL, "TYPE61", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 #endif
+	/* 62 */
+	{LDNS_RR_TYPE_CSYNC, "CSYNC", 3, 3, type_csync_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+	/* 63 */
+	{LDNS_RR_TYPE_ZONEMD, "ZONEMD", 4, 4, type_zonemd_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#ifdef RRTYPE_SVCB_HTTPS
+	/* 64 */
+	{LDNS_RR_TYPE_SVCB, "SVCB", 2, 3, type_svcb_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 1 },
+	/* 65 */
+	{LDNS_RR_TYPE_HTTPS, "HTTPS", 2, 3, type_svcb_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 1 },
 
-{LDNS_RR_TYPE_CSYNC, "CSYNC", 3, 3, type_csync_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE63", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#else
 {LDNS_RR_TYPE_NULL, "TYPE64", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE65", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#endif
 {LDNS_RR_TYPE_NULL, "TYPE66", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE67", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE68", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
@@ -2425,6 +2480,18 @@ static ldns_rr_descriptor rdata_field_descriptors[] = {
 #else
 {LDNS_RR_TYPE_NULL, "TYPE258", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 #endif
+#ifdef RRTYPE_DOA
+	/* 259 */
+	{LDNS_RR_TYPE_DOA, "DOA", 5, 5, type_doa_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#else
+{LDNS_RR_TYPE_NULL, "TYPE259", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#endif
+#ifdef RRTYPE_AMTRELAY
+	/* 260 */
+	{LDNS_RR_TYPE_AMTRELAY, "AMTRELAY", 1, 1, type_amtrelay_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#else
+{LDNS_RR_TYPE_NULL, "TYPE260", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+#endif
 
 /* split in array, no longer contiguous */
 
@@ -2450,7 +2517,7 @@ static ldns_rr_descriptor rdata_field_descriptors[] = {
 /*---------------------------------------------------------------------------*
  * The functions below return an bitmap RDF with the space required to set
  * or unset all known RR types. Arguably these functions are better situated
- * in rdata.c, however for the space calculation it is necesarry to walk
+ * in rdata.c, however for the space calculation it is necessary to walk
  * through rdata_field_descriptors which is not easily possible from anywhere
  * other than rr.c where it is declared static.
  *
@@ -2528,10 +2595,10 @@ ldns_rdf_bitmap_known_rr_types_set(ldns_rdf** rdf, int value)
 		/* Format rdf data according RFC3845 Section 2.1.2 (see above)
 		 */
 		dptr = data = LDNS_XMALLOC(uint8_t, sz);
-		memset(data, value, sz);
 		if (!data) {
 			return LDNS_STATUS_MEM_ERR;
 		}
+		memset(data, value, sz);
 		for (i = 0; i < 256; i++) {
 			if (windows[i]) {
 				*dptr++ = (uint8_t)i;
diff --git a/contrib/ldns/rr_functions.c b/contrib/ldns/rr_functions.c
index 20a0bfaa1aa3b5..b9b9eae5be7289 100644
--- a/contrib/ldns/rr_functions.c
+++ b/contrib/ldns/rr_functions.c
@@ -24,7 +24,7 @@
  * return a specific rdf
  * \param[in] type type of RR
  * \param[in] rr   the rr itself
- * \param[in] pos  at which postion to get it
+ * \param[in] pos  at which position to get it
  * \return the rdf sought
  */
 static ldns_rdf *
@@ -41,7 +41,7 @@ ldns_rr_function(ldns_rr_type type, const ldns_rr *rr, size_t pos)
  * \param[in] type type of RR
  * \param[in] rr   the rr itself
  * \param[in] rdf  the rdf to set
- * \param[in] pos  at which postion to set it
+ * \param[in] pos  at which position to set it
  * \return true or false
  */
 static bool
@@ -269,14 +269,17 @@ ldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
                             const size_t len,
                             const ldns_algorithm alg)
 {
+#ifdef USE_DSA
 	/* for DSA keys */
 	uint8_t t;
+#endif /* USE_DSA */
 	
 	/* for RSA keys */
 	uint16_t exp;
 	uint16_t int16;
 	
 	switch ((ldns_signing_algorithm)alg) {
+#ifdef USE_DSA
 	case LDNS_SIGN_DSA:
 	case LDNS_SIGN_DSA_NSEC3:
 		if (len > 0) {
@@ -286,6 +289,7 @@ ldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
 			return 0;
 		}
 		break;
+#endif /* USE_DSA */
 	case LDNS_SIGN_RSAMD5:
 	case LDNS_SIGN_RSASHA1:
 	case LDNS_SIGN_RSASHA1_NSEC3:
diff --git a/contrib/ldns/sha1.c b/contrib/ldns/sha1.c
index 18a4dd28f34e3f..9b7e60ece09053 100644
--- a/contrib/ldns/sha1.c
+++ b/contrib/ldns/sha1.c
@@ -97,6 +97,7 @@ ldns_sha1_transform(uint32_t state[5], const unsigned char buffer[LDNS_SHA1_BLOC
     state[4] += e;
     /* Wipe variables */
     a = b = c = d = e = 0;
+    (void)a;
 }
 
 
@@ -167,7 +168,7 @@ ldns_sha1_final(unsigned char digest[LDNS_SHA1_DIGEST_LENGTH], ldns_sha1_ctx *co
 }
 
 unsigned char *
-ldns_sha1(unsigned char *data, unsigned int data_len, unsigned char *digest)
+ldns_sha1(const unsigned char *data, unsigned int data_len, unsigned char *digest)
 {
     ldns_sha1_ctx ctx;
     ldns_sha1_init(&ctx);
diff --git a/contrib/ldns/sha2.c b/contrib/ldns/sha2.c
index 9a27122bfe1e3b..8988ee06d04b01 100644
--- a/contrib/ldns/sha2.c
+++ b/contrib/ldns/sha2.c
@@ -73,7 +73,7 @@
  * Please make sure that your system defines BYTE_ORDER.  If your
  * architecture is little-endian, make sure it also defines
  * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
- * equivilent.
+ * equivalent.
  *
  * If your system does not define the above, then you can do so by
  * hand like this:
@@ -494,6 +494,7 @@ static void ldns_sha256_Transform(ldns_sha256_CTX* context,
 
 	/* Clean up */
 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
+	(void)a;
 }
 
 #endif /* SHA2_UNROLL_TRANSFORM */
@@ -527,6 +528,7 @@ void ldns_sha256_update(ldns_sha256_CTX* context, const sha2_byte *data, size_t
 			context->bitcount += len << 3;
 			/* Clean up: */
 			usedspace = freespace = 0;
+			(void)usedspace;
 			return;
 		}
 	}
@@ -544,6 +546,7 @@ void ldns_sha256_update(ldns_sha256_CTX* context, const sha2_byte *data, size_t
 	}
 	/* Clean up: */
 	usedspace = freespace = 0;
+	(void)usedspace;
 }
 
 typedef union _ldns_sha2_buffer_union {
@@ -551,7 +554,7 @@ typedef union _ldns_sha2_buffer_union {
         uint64_t* theLongs;
 } ldns_sha2_buffer_union;
 
-void ldns_sha256_final(sha2_byte digest[], ldns_sha256_CTX* context) {
+void ldns_sha256_final(sha2_byte digest[LDNS_SHA256_DIGEST_LENGTH], ldns_sha256_CTX* context) {
 	sha2_word32	*d = (sha2_word32*)digest;
 	size_t usedspace;
 	ldns_sha2_buffer_union cast_var;
@@ -614,10 +617,11 @@ void ldns_sha256_final(sha2_byte digest[], ldns_sha256_CTX* context) {
 	/* Clean up state data: */
 	MEMSET_BZERO(context, sizeof(ldns_sha256_CTX));
 	usedspace = 0;
+	(void)usedspace;
 }
 
 unsigned char *
-ldns_sha256(unsigned char *data, unsigned int data_len, unsigned char *digest)
+ldns_sha256(const unsigned char *data, unsigned int data_len, unsigned char *digest)
 {
     ldns_sha256_CTX ctx;
     ldns_sha256_init(&ctx);
@@ -803,6 +807,7 @@ static void ldns_sha512_Transform(ldns_sha512_CTX* context,
 
 	/* Clean up */
 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
+	(void)a;
 }
 
 #endif /* SHA2_UNROLL_TRANSFORM */
@@ -836,6 +841,7 @@ void ldns_sha512_update(ldns_sha512_CTX* context, const sha2_byte *data, size_t
 			ADDINC128(context->bitcount, len << 3);
 			/* Clean up: */
 			usedspace = freespace = 0;
+			(void)usedspace;
 			return;
 		}
 	}
@@ -853,6 +859,7 @@ void ldns_sha512_update(ldns_sha512_CTX* context, const sha2_byte *data, size_t
 	}
 	/* Clean up: */
 	usedspace = freespace = 0;
+	(void)usedspace;
 }
 
 static void ldns_sha512_Last(ldns_sha512_CTX* context) {
@@ -898,7 +905,7 @@ static void ldns_sha512_Last(ldns_sha512_CTX* context) {
 	ldns_sha512_Transform(context, (sha2_word64*)context->buffer);
 }
 
-void ldns_sha512_final(sha2_byte digest[], ldns_sha512_CTX* context) {
+void ldns_sha512_final(sha2_byte digest[LDNS_SHA512_DIGEST_LENGTH], ldns_sha512_CTX* context) {
 	sha2_word64	*d = (sha2_word64*)digest;
 
 	/* Sanity check: */
@@ -928,7 +935,7 @@ void ldns_sha512_final(sha2_byte digest[], ldns_sha512_CTX* context) {
 }
 
 unsigned char *
-ldns_sha512(unsigned char *data, unsigned int data_len, unsigned char *digest)
+ldns_sha512(const unsigned char *data, unsigned int data_len, unsigned char *digest)
 {
     ldns_sha512_CTX ctx;
     ldns_sha512_init(&ctx);
@@ -951,7 +958,7 @@ void ldns_sha384_update(ldns_sha384_CTX* context, const sha2_byte* data, size_t
 	ldns_sha512_update((ldns_sha512_CTX*)context, data, len);
 }
 
-void ldns_sha384_final(sha2_byte digest[], ldns_sha384_CTX* context) {
+void ldns_sha384_final(sha2_byte digest[LDNS_SHA384_DIGEST_LENGTH], ldns_sha384_CTX* context) {
 	sha2_word64	*d = (sha2_word64*)digest;
 
 	/* Sanity check: */
@@ -981,7 +988,7 @@ void ldns_sha384_final(sha2_byte digest[], ldns_sha384_CTX* context) {
 }
 
 unsigned char *
-ldns_sha384(unsigned char *data, unsigned int data_len, unsigned char *digest)
+ldns_sha384(const unsigned char *data, unsigned int data_len, unsigned char *digest)
 {
     ldns_sha384_CTX ctx;
     ldns_sha384_init(&ctx);
diff --git a/contrib/ldns/str2host.c b/contrib/ldns/str2host.c
index c396f54792b9a4..4617aa3c7a0531 100644
--- a/contrib/ldns/str2host.c
+++ b/contrib/ldns/str2host.c
@@ -57,13 +57,13 @@ ldns_status
 ldns_str2rdf_time(ldns_rdf **rd, const char *time)
 {
 	/* convert a time YYYYDDMMHHMMSS to wireformat */
-	uint16_t *r = NULL;
+	uint32_t *r = NULL;
 	struct tm tm;
 	uint32_t l;
 	char *end;
 
 	/* Try to scan the time... */
-	r = (uint16_t*)LDNS_MALLOC(uint32_t);
+	r = (uint32_t *)LDNS_MALLOC(uint32_t);
         if(!r) return LDNS_STATUS_MEM_ERR;
 
 	memset(&tm, 0, sizeof(tm));
@@ -197,10 +197,10 @@ ldns_status
 ldns_str2rdf_int32(ldns_rdf **rd, const char *longstr)
 {
 	char *end;
-	uint16_t *r = NULL;
+	uint32_t *r = NULL;
 	uint32_t l;
 
-	r = (uint16_t*)LDNS_MALLOC(uint32_t);
+	r = (uint32_t*)LDNS_MALLOC(uint32_t);
         if(!r) return LDNS_STATUS_MEM_ERR;
 	errno = 0; /* must set to zero before call,
 			note race condition on errno */
@@ -304,7 +304,7 @@ parse_char(uint8_t *ch_p, const char** str_p)
 
 /*
  * No special care is taken, all dots are translated into
- * label seperators.
+ * label separators.
  * Could be made more efficient....we do 3 memcpy's in total...
  */
 ldns_status
@@ -344,7 +344,7 @@ ldns_str2rdf_dname(ldns_rdf **d, const char *str)
 	pq = buf;
 	label_len = 0;
 	for (s = str; *s; s++, q++) {
-		if (q > buf + LDNS_MAX_DOMAINLEN) {
+		if (q >= buf + LDNS_MAX_DOMAINLEN) {
 			return LDNS_STATUS_DOMAINNAME_OVERFLOW;
 		}
 		*q = 0;
@@ -378,7 +378,7 @@ ldns_str2rdf_dname(ldns_rdf **d, const char *str)
 
 	/* add root label if last char was not '.' */
 	if (!ldns_dname_str_absolute(str)) {
-		if (q > buf + LDNS_MAX_DOMAINLEN) {
+		if (q >= buf + LDNS_MAX_DOMAINLEN) {
 			return LDNS_STATUS_DOMAINNAME_OVERFLOW;
 		}
                 if (label_len > LDNS_MAX_LABELLEN) {
@@ -445,6 +445,7 @@ ldns_str2rdf_str(ldns_rdf **rd, const char *str)
 		*++dp = ch;
 	}
 	if (! str) {
+		LDNS_FREE(data);
 		return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
 	}
 	length = (size_t)(dp - data);
@@ -584,6 +585,11 @@ ldns_str2rdf_b64(ldns_rdf **rd, const char *str)
 	uint8_t *buffer;
 	int16_t i;
 
+	if ((*str == '-' || *str == '0') && str[1] == '\0') {
+		*rd = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, 0, NULL);
+		return *rd ? LDNS_STATUS_OK : LDNS_STATUS_MEM_ERR;
+	}
+
 	buffer = LDNS_XMALLOC(uint8_t, ldns_b64_ntop_calculate_size(strlen(str)));
         if(!buffer) {
                 return LDNS_STATUS_MEM_ERR;
@@ -609,15 +615,19 @@ ldns_str2rdf_b32_ext(ldns_rdf **rd, const char *str)
 	uint8_t *buffer;
 	int i;
 	/* first byte contains length of actual b32 data */
-	uint8_t len = ldns_b32_pton_calculate_size(strlen(str));
+	size_t slen = strlen(str);
+	size_t len = ldns_b32_pton_calculate_size(slen);
+	if (len > 255) {
+		return LDNS_STATUS_INVALID_B32_EXT;
+	}
 	buffer = LDNS_XMALLOC(uint8_t, len + 1);
         if(!buffer) {
                 return LDNS_STATUS_MEM_ERR;
         }
 	buffer[0] = len;
 
-	i = ldns_b32_pton_extended_hex((const char*)str, strlen(str), buffer + 1,
-							 ldns_b32_ntop_calculate_size(strlen(str)));
+	i = ldns_b32_pton_extended_hex((const char*)str, slen, buffer + 1,
+							 ldns_b32_ntop_calculate_size(slen));
 	if (i < 0) {
                 LDNS_FREE(buffer);
 		return LDNS_STATUS_INVALID_B32_EXT;
@@ -869,13 +879,16 @@ loc_parse_cm(char* my_str, char** endstr, uint8_t* m, uint8_t* e)
 	/* read <digits>[.<digits>][mM] */
 	/* into mantissa exponent format for LOC type */
 	uint32_t meters = 0, cm = 0, val;
+	char* cm_endstr;
 	while (isblank((unsigned char)*my_str)) {
 		my_str++;
 	}
 	meters = (uint32_t)strtol(my_str, &my_str, 10);
 	if (*my_str == '.') {
 		my_str++;
-		cm = (uint32_t)strtol(my_str, &my_str, 10);
+		cm = (uint32_t)strtol(my_str, &cm_endstr, 10);
+		if (cm_endstr - my_str == 1) cm *= 10;
+		my_str = cm_endstr;
 	}
 	if (meters >= 1) {
 		*e = 2;
@@ -916,8 +929,8 @@ ldns_str2rdf_loc(ldns_rdf **rd, const char *str)
 	uint8_t vert_pre_b = 1, vert_pre_e = 3;
 
 	double s = 0.0;
-	bool northerness;
-	bool easterness;
+	bool northern_hemisphere;
+	bool eastern_hemisphere;
 
 	char *my_str = (char *) str;
 
@@ -953,9 +966,9 @@ ldns_str2rdf_loc(ldns_rdf **rd, const char *str)
 	}
 
 	if (*my_str == 'N') {
-		northerness = true;
+		northern_hemisphere = true;
 	} else if (*my_str == 'S') {
-		northerness = false;
+		northern_hemisphere = false;
 	} else {
 		return LDNS_STATUS_INVALID_STR;
 	}
@@ -969,7 +982,7 @@ ldns_str2rdf_loc(ldns_rdf **rd, const char *str)
 	latitude = (uint32_t) s;
 	latitude += 1000 * 60 * m;
 	latitude += 1000 * 60 * 60 * h;
-	if (northerness) {
+	if (northern_hemisphere) {
 		latitude = equator + latitude;
 	} else {
 		latitude = equator - latitude;
@@ -1010,9 +1023,9 @@ ldns_str2rdf_loc(ldns_rdf **rd, const char *str)
 	}
 
 	if (*my_str == 'E') {
-		easterness = true;
+		eastern_hemisphere = true;
 	} else if (*my_str == 'W') {
-		easterness = false;
+		eastern_hemisphere = false;
 	} else {
 		return LDNS_STATUS_INVALID_STR;
 	}
@@ -1027,7 +1040,7 @@ ldns_str2rdf_loc(ldns_rdf **rd, const char *str)
 	longitude += 1000 * 60 * m;
 	longitude += 1000 * 60 * 60 * h;
 
-	if (easterness) {
+	if (eastern_hemisphere) {
 		longitude += equator;
 	} else {
 		longitude = equator - longitude;
@@ -1088,7 +1101,10 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 	ldns_buffer *str_buf;
 
 	char *proto_str = NULL;
+	char *lc_proto_str = NULL;
 	char *token;
+	char *lc_token;
+	char *c;
 	if(strlen(str) == 0)
 		token = LDNS_XMALLOC(char, 50);
 	else 	token = LDNS_XMALLOC(char, strlen(str)+2);
@@ -1106,7 +1122,13 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 	while(ldns_bget_token(str_buf, token, "\t\n ", strlen(str)) > 0) {
 		if (!proto_str) {
 			proto_str = strdup(token);
-			if (!proto_str) {
+			lc_proto_str = strdup(token);
+			for (c = lc_proto_str; *c; c++) {
+				*c = tolower((unsigned char)*c);
+			}
+			if (!proto_str || !lc_proto_str) {
+				free(proto_str);
+				free(lc_proto_str);
 				LDNS_FREE(bitmap);
 				LDNS_FREE(token);
 	                        ldns_buffer_free(str_buf);
@@ -1114,11 +1136,32 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 			}
 		} else {
 			serv = getservbyname(token, proto_str);
+			if (!serv) {
+				serv = getservbyname(token, lc_proto_str);
+			}
+			if (!serv && (lc_token = strdup(token))) {
+				for (c = lc_token; *c; c++) {
+					*c = tolower((unsigned char)*c);
+				}
+				serv = getservbyname(lc_token, proto_str);
+				if (!serv) {
+					serv = getservbyname(lc_token, lc_proto_str);
+				}
+				free(lc_token);
+			}
 			if (serv) {
 				serv_port = (int) ntohs((uint16_t) serv->s_port);
 			} else {
 				serv_port = atoi(token);
 			}
+			if (serv_port < 0 || serv_port > 65535) {
+				LDNS_FREE(bitmap);
+			        LDNS_FREE(token);
+                                ldns_buffer_free(str_buf);
+			        free(proto_str);
+			        free(lc_proto_str);
+			        return LDNS_STATUS_INVALID_STR;
+			}
 			if (serv_port / 8 >= bm_len) {
 				uint8_t *b2 = LDNS_XREALLOC(bitmap, uint8_t, (serv_port / 8) + 1);
                                 if(!b2) {
@@ -1126,6 +1169,7 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 				        LDNS_FREE(token);
 	                                ldns_buffer_free(str_buf);
 				        free(proto_str);
+				        free(lc_proto_str);
 				        return LDNS_STATUS_INVALID_STR;
                                 }
 				bitmap = b2;
@@ -1143,6 +1187,7 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 		LDNS_FREE(token);
 	        ldns_buffer_free(str_buf);
 	        free(proto_str);
+	        free(lc_proto_str);
 		return LDNS_STATUS_INVALID_STR;
 	}
 
@@ -1152,10 +1197,14 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 	        ldns_buffer_free(str_buf);
 	        LDNS_FREE(bitmap);
 	        free(proto_str);
+	        free(lc_proto_str);
 	        return LDNS_STATUS_INVALID_STR;
         }
     if (proto_str)
 		proto = getprotobyname(proto_str);
+    	if (!proto) {
+		proto = getprotobyname(lc_proto_str);
+	}
 	if (proto) {
 		data[0] = (uint8_t) proto->p_proto;
 	} else if (proto_str) {
@@ -1170,6 +1219,7 @@ ldns_str2rdf_wks(ldns_rdf **rd, const char *str)
 	ldns_buffer_free(str_buf);
 	LDNS_FREE(bitmap);
 	free(proto_str);
+	free(lc_proto_str);
 #ifdef HAVE_ENDSERVENT
 	endservent();
 #endif
@@ -1300,6 +1350,8 @@ ldns_str2rdf_ipseckey(ldns_rdf **rd, const char *str)
 		status = ldns_str2rdf_aaaa(&gateway_rdf, gateway);
 	} else if (gateway_type == 3) {
 		status = ldns_str2rdf_dname(&gateway_rdf, gateway);
+	} else if (gateway_type > 3) {
+		status = LDNS_STATUS_INVALID_STR;
 	}
 
 	if (status != LDNS_STATUS_OK) {
@@ -1366,8 +1418,8 @@ ldns_str2rdf_ipseckey(ldns_rdf **rd, const char *str)
 		LDNS_FREE(publickey);
 	LDNS_FREE(token);
 	ldns_buffer_free(str_buf);
-	ldns_rdf_free(gateway_rdf);
-	ldns_rdf_free(publickey_rdf);
+	ldns_rdf_deep_free(gateway_rdf);
+	ldns_rdf_deep_free(publickey_rdf);
 	LDNS_FREE(data);
 	if(!*rd) return LDNS_STATUS_MEM_ERR;
 	return LDNS_STATUS_OK;
@@ -1494,17 +1546,23 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str)
 		}
 	}
 	if (! str) {
+		LDNS_FREE(data);
 		return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
 	}
-	length = (size_t)(dp - data);
-
-	/* Lose the overmeasure */
-	data = LDNS_XREALLOC(dp = data, uint8_t, length);
-	if (! data) {
-		LDNS_FREE(dp);
-		return LDNS_STATUS_MEM_ERR;
+	if (!(length = (size_t)(dp - data))) {
+		/* An empty string is a data buffer of 0 bytes.  The rdf for 
+		 * this long string has to have length 0 and point to NULL.
+		 */
+		LDNS_FREE(data);
+		data = NULL;
+	} else {
+		/* Lose the overmeasure */
+		data = LDNS_XREALLOC(dp = data, uint8_t, length);
+		if (! data) {
+			LDNS_FREE(dp);
+			return LDNS_STATUS_MEM_ERR;
+		}
 	}
-
 	/* Create rdf */
 	*rd = ldns_rdf_new(LDNS_RDF_TYPE_LONG_STR, length, data);
 	if (! *rd) {
@@ -1517,17 +1575,17 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str)
 ldns_status
 ldns_str2rdf_hip(ldns_rdf **rd, const char *str)
 {
-	const char *hit = strchr(str, ' ') + 1;
-	const char *pk  = hit == NULL ? NULL : strchr(hit, ' ') + 1;
+	const char *hit = str == NULL ? NULL : strchr(str, ' ');
+	const char *pk  = hit == NULL ? NULL : strchr(hit + 1, ' ');
 	size_t hit_size = hit == NULL ? 0
-	                : pk  == NULL ? strlen(hit) : (size_t) (pk - hit) - 1;
-	size_t  pk_size = pk  == NULL ? 0 : strlen(pk);
+	                : pk  == NULL ? strlen(hit + 1) : (size_t) (pk - hit) - 1;
+	size_t  pk_size = pk  == NULL ? 0 : strlen(pk + 1);
 	size_t hit_wire_size = (hit_size + 1) / 2;
 	size_t  pk_wire_size = ldns_b64_pton_calculate_size(pk_size);
 	size_t rdf_size = 4 + hit_wire_size + pk_wire_size;
 
 	char *endptr; /* utility var for strtol usage */
-	int algorithm = strtol(str, &endptr, 10);
+	int algorithm = str == NULL ? 0 : strtol(str, &endptr, 10);
 
 	uint8_t *data, *dp;
 	int hi, lo, written;
@@ -1540,6 +1598,8 @@ ldns_str2rdf_hip(ldns_rdf **rd, const char *str)
 
 		return LDNS_STATUS_SYNTAX_ERR;
 	}
+	hit += 1;
+	pk  += 1;
 	if ((data = LDNS_XMALLOC(uint8_t, rdf_size)) == NULL) {
 
 		return LDNS_STATUS_MEM_ERR;
@@ -1605,3 +1665,773 @@ ldns_str2rdf_hip(ldns_rdf **rd, const char *str)
 	}
 	return LDNS_STATUS_OK;
 }
+
+
+/* Implementation mimics ldns_str2rdf_ipseckey */
+ldns_status
+ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str)
+{
+	/* From draft-ietf-mboned-driad-amt-discovery
+	 *      Section 4.2. AMTRELAY RData Format
+	 *************************************************
+
+	 0                   1                   2                   3
+	 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	|   precedence  |D|    type     |                               |
+	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
+	~                            relay                              ~
+	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  */
+
+	uint8_t precedence = 0;
+	uint8_t relay_type = 0;
+	uint8_t discovery_optional = 0;
+	char* relay = NULL;
+	uint8_t *data;
+	ldns_buffer *str_buf;
+	char *token;
+	int token_count = 0;
+	int amtrelay_len = 0;
+	ldns_rdf* relay_rdf = NULL;
+	ldns_status status = LDNS_STATUS_OK;
+	
+	if(strlen(str) == 0)
+		token = LDNS_XMALLOC(char, 256);
+	else	token = LDNS_XMALLOC(char, strlen(str)+2);
+	if(!token) return LDNS_STATUS_MEM_ERR;
+
+	str_buf = LDNS_MALLOC(ldns_buffer);
+	if(!str_buf) {LDNS_FREE(token); return LDNS_STATUS_MEM_ERR;}
+	ldns_buffer_new_frm_data(str_buf, (char *)str, strlen(str));
+	if(ldns_buffer_status(str_buf) != LDNS_STATUS_OK) {
+		LDNS_FREE(str_buf);
+		LDNS_FREE(token);
+		return LDNS_STATUS_MEM_ERR;
+	}
+	while(ldns_bget_token(str_buf, token, "\t\n ", strlen(str)) > 0) {
+		switch (token_count) {
+		case 0:
+			precedence = (uint8_t)atoi(token);
+			break;
+		case 1:
+			discovery_optional = (uint8_t)atoi(token);
+			if (discovery_optional != 0 &&
+			    discovery_optional != 1) {
+				LDNS_FREE(relay);
+				LDNS_FREE(token);
+				ldns_buffer_free(str_buf);
+				return LDNS_STATUS_INVALID_STR;
+			}
+			break;
+		case 2:
+			relay_type = (uint8_t)atoi(token);
+			break;
+		case 3:
+			relay = strdup(token);
+			if (!relay || (relay_type == 0 &&
+					(token[0] != '.' || token[1] != '\0'))) {
+				LDNS_FREE(relay);
+				LDNS_FREE(token);
+				ldns_buffer_free(str_buf);
+				return LDNS_STATUS_INVALID_STR;
+			}
+			break;
+		default:
+			LDNS_FREE(token);
+			ldns_buffer_free(str_buf);
+			return LDNS_STATUS_INVALID_STR;
+			break;
+		}
+		token_count++;
+	}
+	if (!relay && relay_type > 0) {
+		if (relay)
+			LDNS_FREE(relay);
+		LDNS_FREE(token);
+		ldns_buffer_free(str_buf);
+		return LDNS_STATUS_INVALID_STR;
+	}
+
+	if (relay_type == 1) {
+		status = ldns_str2rdf_a(&relay_rdf, relay);
+	} else if (relay_type == 2) {
+		status = ldns_str2rdf_aaaa(&relay_rdf, relay);
+	} else if (relay_type == 3) {
+		status = ldns_str2rdf_dname(&relay_rdf, relay);
+	} else if (relay_type > 3) {
+		status = LDNS_STATUS_INVALID_STR;
+	}
+
+	if (status != LDNS_STATUS_OK) {
+		if (relay)
+			LDNS_FREE(relay);
+		LDNS_FREE(token);
+		ldns_buffer_free(str_buf);
+		return LDNS_STATUS_INVALID_STR;
+	}
+
+	/* now copy all into one amtrelay rdf */
+	if (relay_type)
+		amtrelay_len = 2 + (int)ldns_rdf_size(relay_rdf);
+	else
+		amtrelay_len = 2;
+
+	data = LDNS_XMALLOC(uint8_t, amtrelay_len);
+	if(!data) {
+		if (relay)
+			LDNS_FREE(relay);
+		LDNS_FREE(token);
+		ldns_buffer_free(str_buf);
+		if (relay_rdf) ldns_rdf_free(relay_rdf);
+		return LDNS_STATUS_MEM_ERR;
+	}
+
+	data[0] = precedence;
+	data[1] = relay_type;
+	data[1] |= (discovery_optional << 7);
+
+	if (relay_type) {
+		memcpy(data + 2,
+			ldns_rdf_data(relay_rdf), ldns_rdf_size(relay_rdf));
+	}
+	*rd = ldns_rdf_new_frm_data( LDNS_RDF_TYPE_AMTRELAY
+	                           , (uint16_t) amtrelay_len, data);
+
+	if (relay)
+		LDNS_FREE(relay);
+	LDNS_FREE(token);
+	ldns_buffer_free(str_buf);
+	ldns_rdf_free(relay_rdf);
+	LDNS_FREE(data);
+	if(!*rd) return LDNS_STATUS_MEM_ERR;
+	return LDNS_STATUS_OK;
+}
+
+#ifdef RRTYPE_SVCB_HTTPS
+static int
+network_uint16_cmp(const void *a, const void *b)
+{
+	return ((int)ldns_read_uint16(a)) - ((int)ldns_read_uint16(b));
+}
+
+static ldns_status parse_svcparam_key(const char **s, ldns_svcparam_key *key);
+static ldns_status
+parse_svcparam_mandatory(const char **s, uint8_t **dp, uint8_t *eod)
+{
+	bool quoted = false;
+	uint8_t *keys = *dp;
+	int prev_key;
+
+	if (**s == '"') {
+		*s += 1;
+		quoted = true;
+	}
+	for (;;) {
+		ldns_status st;
+		ldns_svcparam_key key;
+
+		if ((st = parse_svcparam_key(s, &key)))
+			return st;
+
+		if (*dp + 2 > eod)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+		
+		ldns_write_uint16(*dp, key);
+		*dp += 2;
+
+		if (**s == ',')
+			*s += 1;
+		else
+			break;
+	}
+	if (quoted) {
+		if (**s != '"')
+			return LDNS_STATUS_INVALID_STR;
+		*s += 1;
+	}
+	if (*dp - keys == 0)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	if (**s && !isspace((unsigned char)**s))
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	/* In draft-ietf-dnsop-svcb-https-02 Section 7:
+	 *
+	 *     In wire format, the keys are represented by their numeric
+	 *     values in network byte order, concatenated in ascending order.
+	 */
+	qsort(keys, (*dp - keys) / 2, 2, network_uint16_cmp);
+
+	/* In draft-ietf-dnsop-svcb-https-02 Section 7:
+	 *
+	 *     Keys ...<snip>... MUST NOT appear more than once.
+	 */
+	prev_key = -1;
+	while (keys < *dp) {
+		uint16_t key = ldns_read_uint16(keys);
+
+		if (key == prev_key) {
+			/* "Be conservative in what you send,
+			 *  be liberal in what you accept"
+			 *
+			 * Instead of
+			 *   `return LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE;`,
+			 *
+			 * we eliminate the double occurrence.
+			 */
+			memmove(keys - 2, keys, *dp - keys);
+			*dp -= 2;
+		} else {
+			prev_key = key;
+			keys += 2;
+		}
+	}
+	return LDNS_STATUS_OK;
+}
+
+INLINE bool parse_escape2(uint8_t *ch_p, const char** str_p)
+{ *str_p += 1; return parse_escape(ch_p, str_p); }
+
+static ldns_status
+parse_svcparam_alpn(const char **s, uint8_t **dp, uint8_t *eod)
+{
+	uint8_t *val;
+	size_t len;
+
+	if (*dp + 1 > eod)
+		return LDNS_STATUS_RDATA_OVERFLOW;
+	*dp += 1;
+	val = *dp;
+	if (**s == '"') {
+		*s += 1;
+		while (**s != '"') {
+			if (**s == 0)
+				return LDNS_STATUS_INVALID_STR;
+
+			else if (**s == ',') {
+				len = *dp - val;
+				if (len == 0 || len > 255)
+					return LDNS_STATUS_INVALID_STR;
+				val[-1] = len;
+				if (*dp + 1 > eod)
+					return LDNS_STATUS_RDATA_OVERFLOW;
+				*dp += 1;
+				val = *dp;
+				*s += 1;
+
+			} else if (*dp + 1 > eod)
+				return LDNS_STATUS_RDATA_OVERFLOW;
+
+			else if (**s != '\\')
+				*(*dp)++ = (uint8_t)*(*s)++;
+
+			else if (!parse_escape2(*dp, s))
+				return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
+			else
+				*dp += 1;
+		}
+		*s += 1;
+
+	} else while (**s && !isspace((unsigned char)**s)) {
+		if (**s == ',') {
+			len = *dp - val;
+			if (len == 0 || len > 255)
+				return LDNS_STATUS_INVALID_STR;
+			val[-1] = len;
+			if (*dp + 1 > eod)
+				return LDNS_STATUS_RDATA_OVERFLOW;
+			*dp += 1;
+			val = *dp;
+			*s += 1;
+
+		} else if (*dp + 1 > eod)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+
+		else if (**s != '\\')
+			*(*dp)++ = (uint8_t)*(*s)++;
+
+		else if (!parse_escape2(*dp, s))
+			return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
+		else
+			*dp += 1;
+	}
+	len = *dp - val;
+	if (len == 0 || len > 255)
+		return LDNS_STATUS_INVALID_STR;
+	val[-1] = len;
+	return **s && !isspace((unsigned char)**s)
+	     ? LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR
+	     : LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam_value(const char **s, uint8_t **dp, uint8_t *eod)
+{
+	if (**s == '"') {
+		*s += 1;
+		while (**s != '"') {
+			if (**s == 0)
+				return LDNS_STATUS_INVALID_STR;
+
+			else if (*dp + 1 > eod)
+				return LDNS_STATUS_RDATA_OVERFLOW;
+
+			else if (**s != '\\')
+				*(*dp)++ = (uint8_t)*(*s)++;
+
+			else if (!parse_escape2(*dp, s))
+				return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
+			else
+				*dp += 1;
+		}
+		*s += 1;
+
+	} else while (**s && !isspace((unsigned char)**s)) {
+		if (*dp + 1 > eod)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+
+		else if (**s != '\\')
+			*(*dp)++ = (uint8_t)*(*s)++;
+
+		else if (!parse_escape2(*dp, s))
+			return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
+		else
+			*dp += 1;
+	}
+	return **s && !isspace((unsigned char)**s)
+	     ? LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR
+	     : LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam_port(const char **s, uint8_t **dp, uint8_t *eod)
+{
+	uint8_t *val = *dp;
+	ldns_status st;
+	size_t len;
+	char num_str[6];
+	char *endptr;
+	unsigned long int num;
+
+	if ((st = parse_svcparam_value(s, dp, eod)))
+		return st;
+	len = *dp - val;
+	if (len == 0 || len > 5)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	memcpy(num_str, val, len);
+	num_str[len] = 0;
+	num = strtoul(num_str, &endptr, 10);
+	if (*endptr)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	ldns_write_uint16(val, num);
+	*dp = val + 2;
+	return LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam_ipv4hint(const char **s, uint8_t **dp, uint8_t *eod)                
+{                                                                               
+	bool quoted = false;
+
+	if (**s == '"') {
+		*s += 1;
+		quoted = true;
+	}
+	for (;;) {
+		const char *ipv4_start = *s;
+		char        ipv4_str[16];
+		size_t      len;
+
+		while (isdigit((unsigned char)**s) || **s == '.')
+			*s += 1;
+		
+		len = *s - ipv4_start;
+		if (len == 0 || len > 15)
+			return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+		if (*dp + 4 > eod)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+
+		memcpy(ipv4_str, ipv4_start, len);
+		ipv4_str[len] = 0;
+		if (inet_pton(AF_INET, ipv4_str, *dp) != 1)
+			return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+		*dp += 4;
+		if (**s == ',')
+			*s += 1;
+		else
+			break;
+	}
+	if (quoted) {
+		if (**s != '"')
+			return LDNS_STATUS_INVALID_STR;
+		*s += 1;
+	}
+	return **s && !isspace((unsigned char)**s)
+	     ? LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR
+	     : LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam_ech(const char **s, uint8_t **dp, uint8_t *eod)
+{                                                                               
+	bool quoted = false;
+	const char *b64_str;
+	size_t len, pad, out_len;
+	char in_buf[4096];
+	char *in = in_buf;
+	int out;
+
+	if (**s == '"') {
+		*s += 1;
+		quoted = true;
+	}
+	b64_str = *s;
+	while (isalnum((unsigned char)**s) || **s == '+'
+	                                   || **s == '/'
+	                                   || **s == '=')
+		*s += 1;
+
+	len = *s - b64_str;
+	pad = len % 4;
+	pad = pad ? 4 - pad : 0;
+	if (len == 0 || pad == 3)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	if (quoted) {
+		if (**s != '"')
+			return LDNS_STATUS_INVALID_STR;
+		*s += 1;
+	}
+	if (**s && !isspace((unsigned char)**s))
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+	
+	out_len = ldns_b64_pton_calculate_size(len);
+	if (*dp + out_len > eod)
+		return LDNS_STATUS_RDATA_OVERFLOW;
+
+	if (len + pad > sizeof(in_buf) - 1
+	&& !(in = LDNS_XMALLOC(char, len + pad + 1)))
+		return LDNS_STATUS_MEM_ERR;
+
+	memcpy(in, b64_str, len);
+	while (pad--)
+		in[len++] = '=';
+	in[len] = 0;
+	out = ldns_b64_pton(in, *dp, out_len);
+	if (in != in_buf)
+		LDNS_FREE(in);
+
+	if (out <= 0)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+	*dp += out;
+	return LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam_ipv6hint(const char **s, uint8_t **dp, uint8_t *eod)                
+{                                                                               
+	bool quoted = false;
+
+	if (**s == '"') {
+		*s += 1;
+		quoted = true;
+	}
+	for (;;) {
+		const char *ipv6_start = *s;
+		char        ipv6_str[INET6_ADDRSTRLEN];
+		size_t      len;
+
+		while (isxdigit((unsigned char)**s) || **s == ':' || **s == '.')
+			*s += 1;
+		
+		len = *s - ipv6_start;
+		if (len == 0 || len > INET6_ADDRSTRLEN)
+			return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+		if (*dp + 16 > eod)
+			return LDNS_STATUS_RDATA_OVERFLOW;
+
+		memcpy(ipv6_str, ipv6_start, len);
+		ipv6_str[len] = 0;
+		if (inet_pton(AF_INET6, ipv6_str, *dp) != 1)
+			return LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR;
+
+		*dp += 16;
+		if (**s == ',')
+			*s += 1;
+		else
+			break;
+	}
+	if (quoted) {
+		if (**s != '"')
+			return LDNS_STATUS_INVALID_STR;
+		*s += 1;
+	}
+	return **s && !isspace((unsigned char)**s)
+	     ? LDNS_STATUS_SYNTAX_SVCPARAM_VALUE_ERR
+	     : LDNS_STATUS_OK;
+}
+
+struct struct_svcparam_key_def {
+	const char *str;
+	size_t      len;
+};
+typedef struct struct_svcparam_key_def svcparam_key_def;
+
+static svcparam_key_def svcparam_key_defs[] = { { "mandatory"      ,  9 }
+                                              , { "alpn"           ,  4 }
+                                              , { "no-default-alpn", 15 }
+                                              , { "port"           ,  4 }
+                                              , { "ipv4hint"       ,  8 }
+                                              , { "ech"            ,  3 }
+                                              , { "ipv6hint"       ,  8 }
+                                              , { "dohpath"        ,  7 } };
+
+static const size_t svcparam_key_defs_len = sizeof(svcparam_key_defs)
+                                          / sizeof(svcparam_key_def);
+
+/* svcparam_key2buffer_str() should actually be in host2str.c, but we need the
+ * svcparam_key_defs for it and it is not an exposed symbol anyway.
+ */
+static ldns_status svcparam_key2buffer_str(ldns_buffer *output, uint16_t key)
+{
+	if (key <= LDNS_SVCPARAM_KEY_LAST_KEY)
+		ldns_buffer_write_string(output, svcparam_key_defs[key].str);
+	else
+		ldns_buffer_printf(output, "key%d", (int)key);
+	return	ldns_buffer_status(output);
+}
+
+static ldns_status
+parse_svcparam_key(const char **s, ldns_svcparam_key *key)
+{
+	size_t i, len;
+	const char *key_str = *s;
+	char num_str[6];
+	char *endptr;
+	unsigned long int num;
+
+	/* parse key */
+	while (islower((unsigned char)**s) || isdigit((unsigned char)**s)
+	                                   || **s == '-')
+		*s += 1;
+
+	len = *s - key_str;
+	for (i = 0; i < svcparam_key_defs_len; i++) {
+		if (len == svcparam_key_defs[i].len
+		&& !strncmp(key_str, svcparam_key_defs[i].str, len)) {
+			*key = i;
+			return LDNS_STATUS_OK;
+		}
+	}
+	/* Also allow "echconfig" from earlier draft versions. */
+	if (len == 9 && !strncmp(key_str, "echconfig", 9)) {
+		*key = LDNS_SVCPARAM_KEY_ECH;
+		return LDNS_STATUS_OK;
+	}
+	if (len < 4 || len > 8 || strncmp(key_str, "key", 3))
+		return LDNS_STATUS_SYNTAX_SVCPARAM_KEY_ERR;
+
+	memcpy(num_str, key_str + 3, len - 3);
+	num_str[len - 3] = 0;
+	num = strtoul(num_str, &endptr, 10);
+	if (*endptr || num > 65535)
+		return LDNS_STATUS_SYNTAX_SVCPARAM_KEY_ERR;
+
+	/* key65535 is Reserved to be an ("Invalid key"), though there is no
+	 * physiological reason to deny usage. We restrict ourselves to the
+	 * anatomical limitations only to maximize serviceability.
+	 * ```
+	 * if (num == 65535)
+	 * 	return LDNS_STATUS_RESERVED_SVCPARAM_KEY;
+	 * ```
+	 */
+	*key = num;
+	return LDNS_STATUS_OK;
+}
+
+static ldns_status
+parse_svcparam(const char **s, uint8_t **dp, uint8_t *eod)
+{
+	ldns_svcparam_key key;
+	ldns_status st;
+	uint8_t *val;
+
+	if (*dp + 4 > eod)
+		return LDNS_STATUS_RDATA_OVERFLOW;
+	
+	if ((st = parse_svcparam_key(s, &key)))
+		return st;
+
+	ldns_write_uint16(*dp, key);
+	ldns_write_uint16(*dp + 2, 0);
+	*dp += 4;
+	if (isspace((unsigned char)**s) || !**s)
+		return LDNS_STATUS_OK;
+
+	else if (**s != '=')
+		return LDNS_STATUS_SYNTAX_ERR;
+	*s += 1;
+	val = *dp;
+	switch(key) {
+	case LDNS_SVCPARAM_KEY_MANDATORY:
+		st = parse_svcparam_mandatory(s, dp, eod);
+		break;
+	case LDNS_SVCPARAM_KEY_ALPN:
+		st = parse_svcparam_alpn(s, dp, eod);
+		break;
+	case LDNS_SVCPARAM_KEY_NO_DEFAULT_ALPN:
+		return LDNS_STATUS_NO_SVCPARAM_VALUE_EXPECTED;
+	case LDNS_SVCPARAM_KEY_PORT:
+		st = parse_svcparam_port(s, dp, eod);
+		break;
+	case LDNS_SVCPARAM_KEY_IPV4HINT:
+		st = parse_svcparam_ipv4hint(s, dp, eod);
+		break;
+	case LDNS_SVCPARAM_KEY_ECH:
+		st = parse_svcparam_ech(s, dp, eod);
+		break;
+	case LDNS_SVCPARAM_KEY_IPV6HINT:
+		st = parse_svcparam_ipv6hint(s, dp, eod);
+		break;
+	default:
+		st = parse_svcparam_value(s, dp, eod);
+		break;
+	}
+	if (st)
+		return st;
+	ldns_write_uint16(val - 2, *dp - val);
+	return LDNS_STATUS_OK;
+}
+
+static int
+svcparam_ptr_cmp(const void *a, const void *b)
+{
+	uint8_t *x = *(uint8_t **)a          , *y = *(uint8_t **)b;
+	uint16_t x_type = ldns_read_uint16(x),  y_type = ldns_read_uint16(y);
+	uint16_t x_len                       ,  y_len;
+
+	if (x_type != y_type)
+		return x_type > y_type ? 1 : -1;
+
+	x_len = ldns_read_uint16(x + 2);
+	y_len = ldns_read_uint16(y + 2);
+
+	return  x_len != y_len
+	     ? (x_len >  y_len ? 1 : -1)
+	     : (x_len == 0     ? 0 : memcmp(x + 4, y + 4, x_len));
+}
+
+ldns_status
+ldns_str2rdf_svcparams(ldns_rdf **rd, const char *str)
+{
+	uint8_t *data, *dp, *eod, *p, *new_data;
+	ldns_status st = LDNS_STATUS_OK;
+	size_t length, i;
+	size_t nparams = 0;
+	uint8_t **svcparams;
+	int prev_key;
+
+	if (!rd || !str)
+		return LDNS_STATUS_NULL;
+
+	length = strlen(str);
+	/* Worst case space requirement. We'll realloc to actual size later. */
+	if (!(dp = data = LDNS_XMALLOC(uint8_t, length * 4)))
+		return LDNS_STATUS_MEM_ERR;
+	eod = data + length * 4;
+
+	/* Fill data with parsed bytes */
+	for (;;) {
+		while (isspace((unsigned char)*str))
+			str += 1;
+		if(!*str)
+			break;
+		if ((st = parse_svcparam(&str, &dp, eod))) {
+			LDNS_FREE(data);
+			return st;
+		}
+		nparams += 1;
+	}
+
+	/* draft-ietf-dnsop-svcb-https-02 in Section 2.2:
+	 *
+	 *     SvcParamKeys SHALL appear in increasing numeric order
+	 *
+	 * A svcparams array (with pointers to the individual key, value pairs)
+	 * is created to qsort the pairs in increasing numeric order.
+	 */
+	if (!(svcparams = LDNS_XMALLOC(uint8_t *, nparams))) {
+		LDNS_FREE(data);
+		return LDNS_STATUS_MEM_ERR;
+	}
+	for ( p = data, i = 0
+	    ; p < dp && i < nparams
+	    ; p += 4 + ldns_read_uint16(p + 2))
+		svcparams[i++] = p;
+
+	qsort(svcparams, i, sizeof(uint8_t *), svcparam_ptr_cmp);
+
+	/* Write out the (key, value) pairs to a newly allocated data in
+	 * sorted order.
+	 */
+	length = dp - data;
+	if (!(new_data = LDNS_XMALLOC(uint8_t, length))) {
+		LDNS_FREE(data);
+		LDNS_FREE(svcparams);
+		return LDNS_STATUS_MEM_ERR;
+	}
+	prev_key = -1;
+	for ( p = new_data, i = 0
+	    ; p < new_data + length && i < nparams
+	    ; p += 4 + ldns_read_uint16(p + 2), i += 1) {
+		uint16_t key = ldns_read_uint16(svcparams[i]);
+
+		/* In draft-ietf-dnsop-svcb-https-02 Section 2.1:
+		 *
+		 *     SvcParams ...<snip>... keys MUST NOT be repeated.
+		 *
+		 * ldns will not impose this limitation on the library user,
+		 * but we can merge completely equal repetitions into one.
+		 * So, not doing
+		 * ```
+		 * if (key == prev_key)
+		 * 	return LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE;
+		 * ```
+		 * but instead:
+		 */
+		if (key == prev_key && ldns_read_uint16(svcparams[i] + 2)
+		                    == ldns_read_uint16(svcparams[i - 1] + 2)
+		&&  0 == memcmp( svcparams[i    ] + 4
+		               , svcparams[i - 1] + 4
+		               , ldns_read_uint16(svcparams[i] + 2))) {
+			p -= 4 + ldns_read_uint16(svcparams[i] + 2);
+			continue;
+		}
+		memcpy(p, svcparams[i], 4 + ldns_read_uint16(svcparams[i] + 2));
+		prev_key = key;
+	}
+	LDNS_FREE(data);
+	LDNS_FREE(svcparams);
+
+	/* Create rdf */
+	*rd = ldns_rdf_new(LDNS_RDF_TYPE_SVCPARAMS, p - new_data, new_data);
+	if (! *rd) {
+		LDNS_FREE(new_data);
+		return LDNS_STATUS_MEM_ERR;
+	}
+	return LDNS_STATUS_OK;
+}
+#else	/* #ifdef RRTYPE_SVCB_HTTPS */
+ldns_status
+ldns_str2rdf_svcparams(ldns_rdf **rd, const char *str)
+{
+	(void)rd; (void)str;
+	return LDNS_STATUS_NOT_IMPL;
+}
+#endif	/* #ifdef RRTYPE_SVCB_HTTPS */
diff --git a/contrib/ldns/tsig.c b/contrib/ldns/tsig.c
index 62776f061d6afa..26a1e73f1d7aa4 100644
--- a/contrib/ldns/tsig.c
+++ b/contrib/ldns/tsig.c
@@ -196,7 +196,7 @@ ldns_tsig_mac_new(ldns_rdf **tsig_mac, const uint8_t *pkt_wire, size_t pkt_wire_
 		return LDNS_STATUS_MEM_ERR;
 	}
 	/*
-	 * prepare the digestable information
+	 * prepare the digestible information
 	 */
 	data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
 	if (!data_buffer) {
@@ -349,7 +349,19 @@ ldns_pkt_tsig_verify_next(ldns_pkt *pkt, const uint8_t *wire, size_t wirelen, co
 
 	ldns_rdf_deep_free(key_name_rdf);
 
-	if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) {
+	if( ldns_rdf_size(pkt_mac_rdf) != ldns_rdf_size(my_mac_rdf)) {
+		ldns_rdf_deep_free(my_mac_rdf);
+		return false;
+	}
+	/* use time insensitive memory compare */
+	if(
+#ifdef HAVE_CRYPTO_MEMCMP
+	    CRYPTO_memcmp
+#else
+	    memcmp
+#endif
+		(ldns_rdf_data(pkt_mac_rdf), ldns_rdf_data(my_mac_rdf),
+		ldns_rdf_size(my_mac_rdf)) == 0) {
 		ldns_rdf_deep_free(my_mac_rdf);
 		return true;
 	} else {
diff --git a/contrib/ldns/util.c b/contrib/ldns/util.c
index 3dcd8495ebb96f..662aa23a96d161 100644
--- a/contrib/ldns/util.c
+++ b/contrib/ldns/util.c
@@ -293,25 +293,37 @@ ldns_gmtime64_r(int64_t clock, struct tm *result)
 #endif /* SIZEOF_TIME_T <= 4 */
 
 static int64_t
-ldns_serial_arithmitics_time(int32_t time, time_t now)
+ldns_serial_arithmetics_time(int32_t time, time_t now)
 {
-	int32_t offset = time - (int32_t) now;
+	/* Casting due to https://github.com/NLnetLabs/ldns/issues/71 */
+	int32_t offset = (int32_t) ((uint32_t) time - (uint32_t) now);
 	return (int64_t) now + offset;
 }
 
-
 struct tm *
-ldns_serial_arithmitics_gmtime_r(int32_t time, time_t now, struct tm *result)
+ldns_serial_arithmetics_gmtime_r(int32_t time, time_t now, struct tm *result)
 {
 #if SIZEOF_TIME_T <= 4
-	int64_t secs_since_epoch = ldns_serial_arithmitics_time(time, now);
+	int64_t secs_since_epoch = ldns_serial_arithmetics_time(time, now);
 	return  ldns_gmtime64_r(secs_since_epoch, result);
 #else
-	time_t  secs_since_epoch = ldns_serial_arithmitics_time(time, now);
+	time_t  secs_since_epoch = ldns_serial_arithmetics_time(time, now);
 	return  gmtime_r(&secs_since_epoch, result);
 #endif
 }
 
+#ifdef ldns_serial_arithmitics_gmtime_r
+#undef ldns_serial_arithmitics_gmtime_r
+#endif
+/* alias function because of previously used wrong spelling */
+struct tm *
+ldns_serial_arithmitics_gmtime_r(int32_t time, time_t now, struct tm *result);
+struct tm *
+ldns_serial_arithmitics_gmtime_r(int32_t time, time_t now, struct tm *result)
+{
+	return ldns_serial_arithmetics_gmtime_r(time, now, result);
+}
+
 /**
  * Init the random source
  * applications should call this if they need entropy data within ldns
@@ -377,7 +389,7 @@ ldns_init_random(FILE *fd, unsigned int size)
 		RAND_seed(seed, (int) size);
 #else
 		/* Seed the standard prng, only uses the first
-		 * unsigned sizeof(unsiged int) bytes found in the entropy pool
+		 * unsigned sizeof(unsigned int) bytes found in the entropy pool
 		 */
 		memcpy(&seed_i, seed, sizeof(seed_i));
 		srandom(seed_i);
@@ -548,10 +560,12 @@ ldns_b32_ntop_base(const uint8_t* src, size_t src_sz,
 
 		/* ........ ........ ....4444 4....... ........ */
 		         c =  src[3]         >> 7 ;
+		/* fallthrough */
 	case 3: dst[4] = b32[(src[2] & 0x0f) << 1 | c];
 
 		/* ........ .......3 3333.... ........ ........ */
 			 c =  src[2]         >> 4 ;
+		/* fallthrough */
 	case 2:	dst[3] = b32[(src[1] & 0x01) << 4 | c];
 
 		/* ........ ..22222. ........ ........ ........ */
@@ -559,6 +573,7 @@ ldns_b32_ntop_base(const uint8_t* src, size_t src_sz,
 
 		/* .....111 11...... ........ ........ ........ */
 	                 c =  src[1]         >> 6 ;
+		/* fallthrough */
 	case 1:	dst[1] = b32[(src[0] & 0x07) << 2 | c];
 
 		/* 00000... ........ ........ ........ ........ */
@@ -569,9 +584,12 @@ ldns_b32_ntop_base(const uint8_t* src, size_t src_sz,
 		switch (src_sz) {
 			case 1: dst[2] = '=';
 				dst[3] = '=';
+				/* fallthrough */
 			case 2: dst[4] = '=';
+				/* fallthrough */
 			case 3: dst[5] = '=';
 				dst[6] = '=';
+				/* fallthrough */
 			case 4: dst[7] = '=';
 		}
 	}
@@ -696,15 +714,18 @@ ldns_b32_pton_base(const char* src, size_t src_sz,
 			/* ........ ........ ........ .55555.. ........ */
 			/* ........ ........ ....4444 4....... ........ */
 			dst[3] = buf[4] << 7 | buf[5] << 2 | buf[6] >> 3;
+			/* fallthrough */
 
 		case 5: /* ........ ........ ....4444 4....... ........ */
 			/* ........ .......3 3333.... ........ ........ */
 			dst[2] = buf[3] << 4 | buf[4] >> 1;
+			/* fallthrough */
 
 		case 4: /* ........ .......3 3333.... ........ ........ */
 			/* ........ ..22222. ........ ........ ........ */
 			/* .....111 11...... ........ ........ ........ */
 			dst[1] = buf[1] << 6 | buf[2] << 1 | buf[3] >> 4;
+			/* fallthrough */
 
 		case 2: /* .....111 11...... ........ ........ ........ */
 			/* 00000... ........ ........ ........ ........ */
diff --git a/contrib/ldns/wire2host.c b/contrib/ldns/wire2host.c
index 680d2f9dcb7082..63b67a0d171349 100644
--- a/contrib/ldns/wire2host.c
+++ b/contrib/ldns/wire2host.c
@@ -272,6 +272,8 @@ ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *pos)
 		case LDNS_RDF_TYPE_ATMA:
 		case LDNS_RDF_TYPE_IPSECKEY:
 		case LDNS_RDF_TYPE_LONG_STR:
+		case LDNS_RDF_TYPE_AMTRELAY:
+		case LDNS_RDF_TYPE_SVCPARAMS:
 		case LDNS_RDF_TYPE_NONE:
 			/*
 			 * Read to end of rr rdata
@@ -309,7 +311,6 @@ ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *pos)
 	return LDNS_STATUS_OK;
 }
 
-
 /* TODO:
          can *pos be incremented at READ_INT? or maybe use something like
          RR_CLASS(wire)?
@@ -412,6 +413,10 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
 
 	uint8_t data[4];
 
+	if (!packet) {
+		return LDNS_STATUS_MEM_ERR;
+	}
+
 	status = ldns_wire2pkt_hdr(packet, wire, max, &pos);
 	LDNS_STATUS_CHECK_GOTO(status, status_error);
 
@@ -464,6 +469,7 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
 			ldns_pkt_set_edns_z(packet, ldns_read_uint16(&data[2]));
 			/* edns might not have rdfs */
 			if (ldns_rr_rdf(rr, 0)) {
+				ldns_rdf_deep_free(ldns_pkt_edns_data(packet));
 				ldns_pkt_set_edns_data(packet, ldns_rdf_clone(ldns_rr_rdf(rr, 0)));
 			}
 			ldns_rr_free(rr);
diff --git a/contrib/ldns/zone.c b/contrib/ldns/zone.c
index e95207482354a6..9a5d4c4e9e12f0 100644
--- a/contrib/ldns/zone.c
+++ b/contrib/ldns/zone.c
@@ -180,7 +180,7 @@ ldns_zone_new(void)
 	return z;
 }
 
-/* we regocnize:
+/* we recognize:
  * $TTL, $ORIGIN
  */
 ldns_status
@@ -189,19 +189,28 @@ ldns_zone_new_frm_fp(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t t
 	return ldns_zone_new_frm_fp_l(z, fp, origin, ttl, c, NULL);
 }
 
+ldns_status _ldns_rr_new_frm_fp_l_internal(ldns_rr **newrr, FILE *fp,
+		uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev,
+		int *line_nr, bool *explicit_ttl);
+
 /* XXX: class is never used */
 ldns_status
-ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t ttl,
-        ldns_rr_class ATTR_UNUSED(c), int *line_nr)
+ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin,
+	uint32_t default_ttl, ldns_rr_class ATTR_UNUSED(c), int *line_nr)
 {
 	ldns_zone *newzone;
-	ldns_rr *rr;
+	ldns_rr *rr, *prev_rr = NULL;
 	uint32_t my_ttl;
 	ldns_rdf *my_origin;
 	ldns_rdf *my_prev;
 	bool soa_seen = false; 	/* 2 soa are an error */
 	ldns_status s;
 	ldns_status ret;
+	/* RFC 1035 Section 5.1, says 'Omitted class and TTL values are default
+	 * to the last explicitly stated values.'
+	 */
+	bool ttl_from_TTL = false;
+	bool explicit_ttl = false;
 
 	/* most cases of error are memory problems */
 	ret = LDNS_STATUS_MEM_ERR;
@@ -210,7 +219,7 @@ ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t
 	my_origin = NULL;
 	my_prev = NULL;
 
-	my_ttl    = ttl;
+	my_ttl    = default_ttl;
 	
 	if (origin) {
 		my_origin = ldns_rdf_clone(origin);
@@ -224,9 +233,58 @@ ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t
 	if (!newzone) goto error;
 
 	while(!feof(fp)) {
-		s = ldns_rr_new_frm_fp_l(&rr, fp, &my_ttl, &my_origin, &my_prev, line_nr);
+		/* If ttl came from $TTL line, then it should be the default.
+		 * (RFC 2308 Section 4)
+		 * Otherwise it "defaults to the last explicitly stated value"
+		 * (RFC 1035 Section 5.1)
+		 */
+		if (ttl_from_TTL)
+			my_ttl = default_ttl;
+		s = _ldns_rr_new_frm_fp_l_internal(&rr, fp, &my_ttl, &my_origin,
+				&my_prev, line_nr, &explicit_ttl);
 		switch (s) {
 		case LDNS_STATUS_OK:
+			if (explicit_ttl) {
+				if (!ttl_from_TTL) {
+					/* No $TTL, so ttl "defaults to the
+					 * last explicitly stated value"
+					 * (RFC 1035 Section 5.1)
+					 */
+					my_ttl = ldns_rr_ttl(rr);
+				}
+			/* When ttl is implicit, try to adhere to the rules as
+			 * much as possible. (also for compatibility with bind)
+			 * This was changed when fixing an issue with ZONEMD
+			 * which hashes the TTL too.
+			 */
+			} else if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SIG
+			       ||  ldns_rr_get_type(rr) == LDNS_RR_TYPE_RRSIG) {
+				if (ldns_rr_rd_count(rr) >= 4
+				&&  ldns_rdf_get_type(ldns_rr_rdf(rr, 3)) == LDNS_RDF_TYPE_INT32)
+
+					/* SIG without explicit ttl get ttl
+					 * from the original_ttl field
+					 * (RFC 2535 Section 7.2)
+					 *
+					 * Similarly for RRSIG, but stated less
+					 * specifically in the spec.
+					 * (RFC 4034 Section 3)
+					 */
+					ldns_rr_set_ttl(rr,
+					    ldns_rdf2native_int32(
+					        ldns_rr_rdf(rr, 3)));
+
+			} else if (prev_rr
+			       &&  ldns_rr_get_type(prev_rr) == ldns_rr_get_type(rr)
+			       &&  ldns_dname_compare( ldns_rr_owner(prev_rr)
+			                             , ldns_rr_owner(rr)) == 0)
+
+				/* "TTLs of all RRs in an RRSet must be the same"
+				 * (RFC 2881 Section 5.2)
+				 */
+				ldns_rr_set_ttl(rr, ldns_rr_ttl(prev_rr));
+
+			prev_rr = rr;
 			if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
 				if (soa_seen) {
 					/* second SOA 
@@ -245,19 +303,25 @@ ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t
 			}
 			
 			/* a normal RR - as sofar the DNS is normal */
-			if (!ldns_zone_push_rr(newzone, rr)) goto error;
+			if (!ldns_zone_push_rr(newzone, rr)) {
+				ldns_rr_free(rr);
+				goto error;
+			}
+			break;
 
 		case LDNS_STATUS_SYNTAX_EMPTY:
 			/* empty line was seen */
 		case LDNS_STATUS_SYNTAX_TTL:
 			/* the function set the ttl */
+			default_ttl = my_ttl;
+			ttl_from_TTL = true;
 			break;
 		case LDNS_STATUS_SYNTAX_ORIGIN:
 			/* the function set the origin */
 			break;
 		case LDNS_STATUS_SYNTAX_INCLUDE:
 			ret = LDNS_STATUS_SYNTAX_INCLUDE_ERR_NOTIMPL;
-			break;
+			goto error;
 		default:
 			ret = s;
 			goto error;
diff --git a/lib/libldns/Makefile b/lib/libldns/Makefile
index 40efe0ff0fdae8..993d58244dbb0b 100644
--- a/lib/libldns/Makefile
+++ b/lib/libldns/Makefile
@@ -12,10 +12,10 @@ PRIVATELIB= true
 CFLAGS+= -I${LDNSDIR}
 
 SRCS=	buffer.c dane.c dname.c dnssec.c dnssec_sign.c dnssec_verify.c \
-	dnssec_zone.c duration.c error.c higher.c host2str.c host2wire.c \
-	keys.c net.c packet.c parse.c radix.c rbtree.c rdata.c resolver.c \
-	rr.c rr_functions.c sha1.c sha2.c str2host.c tsig.c update.c util.c \
-	wire2host.c zone.c
+	dnssec_zone.c duration.c edns.c error.c higher.c host2str.c \
+	host2wire.c keys.c net.c packet.c parse.c radix.c rbtree.c rdata.c \
+	resolver.c rr.c rr_functions.c sha1.c sha2.c str2host.c tsig.c \
+	update.c util.c wire2host.c zone.c
 
 SRCS+=	b64_ntop.c b64_pton.c
 
@@ -23,6 +23,7 @@ LIBADD=	ssl crypto
 
 WARNS ?= 3
 
+CWARNFLAGS.parse.c=	${NO_WUSE_AFTER_FREE}
 CWARNFLAGS.sha2.c=	${NO_WARRAY_PARAMETER}
 
 .include <bsd.lib.mk>