4.3.5
================
BUG FIXES:
        - Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode.
        - Fix #144: Typo fix in nsd.conf.5.in.
        - For #145: Fix that service of remaining TCP and TLS connections
          does not allow new queries to be made, the connection is closed.
          Only existing queries and zone transfers are answered, new ones
          are rejected by a close of the channel.
        - Fix that nsd-control has timeout when connection is down.
        - remove windows socket ifdefs from nsd-control.
        - Fix #148: CNAME need not be followed after a synthesized CNAME
          for a CNAME query.
        - Fix configure.ac for autoconf 2.70.
        - Fix #150: TXT record validation difference with BIND.
        - Fix #151: DNAME not applied more than once to resolve the query.
        - Fix #152: '*' in Rdata causes the return code to be NOERROR instead
          of NX.

Tests, OKs?

diff --git acx_nlnetlabs.m4 acx_nlnetlabs.m4
index 31e43d67e87..d33352f17b8 100644
--- acx_nlnetlabs.m4
+++ acx_nlnetlabs.m4
@@ -2,7 +2,9 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 35
+# Version 37
+# 2021-01-05 fix defun for aclocal
+# 2021-01-05 autoconf 2.70 autoupdate and fixes, no AC_TRY_COMPILE
 # 2020-08-24 Use EVP_sha256 instead of HMAC_Update (for openssl-3.0.0).
 # 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
 # 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
@@ -447,15 +449,12 @@ AC_DEFUN([ACX_CHECK_FORMAT_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" 
attribute)
 AC_CACHE_VAL(ac_cv_c_format_attribute,
 [ac_cv_c_format_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2)));
-], [
+]], [[
    f ("%s", "str");
-],
-[ac_cv_c_format_attribute="yes"],
-[ac_cv_c_format_attribute="no"])
+]])],[ac_cv_c_format_attribute="yes"],[ac_cv_c_format_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_format_attribute)
@@ -484,14 +483,11 @@ AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" 
attribute)
 AC_CACHE_VAL(ac_cv_c_unused_attribute,
 [ac_cv_c_unused_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *u __attribute__((unused)));
-], [
+]], [[
    f ("x");
-],
-[ac_cv_c_unused_attribute="yes"],
-[ac_cv_c_unused_attribute="no"])
+]])],[ac_cv_c_unused_attribute="yes"],[ac_cv_c_unused_attribute="no"])
 ])
 
 dnl Setup ATTR_UNUSED config.h parts.
@@ -548,7 +544,7 @@ dnl as a requirement so that is gets called before LIBTOOL
 dnl because libtools 'AC_REQUIRE' names are right after this one, before
 dnl this function contents.
 AC_REQUIRE([ACX_LIBTOOL_C_PRE])
-AC_PROG_LIBTOOL
+LT_INIT
 ])
 
 dnl Detect if u_char type is defined, otherwise define it.
@@ -677,14 +673,14 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
-            AC_TRY_LINK(, [
+            AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                 int EVP_sha256(void);
                 (void)EVP_sha256();
-              ], [
+              ]])],[
                 AC_MSG_RESULT(yes)
                 AC_DEFINE([HAVE_EVP_SHA256], 1,
                           [If you have EVP_sha256])
-              ], [
+              ],[
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.    
                 BAKLIBS="$LIBS"
@@ -692,10 +688,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                LIBS="$LIBS -lgdi32 -lws2_32"
                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
-                AC_TRY_LINK([], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                     int EVP_sha256(void);
                     (void)EVP_sha256();
-                  ],[
+                  ]])],[
                     AC_DEFINE([HAVE_EVP_SHA256], 1,
                         [If you have EVP_sha256])
                     AC_MSG_RESULT(yes) 
@@ -706,10 +702,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBS="$LIBS -ldl"
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
-                    AC_TRY_LINK([], [
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                         int EVP_sha256(void);
                         (void)EVP_sha256();
-                      ],[
+                      ]])],[
                         AC_DEFINE([HAVE_EVP_SHA256], 1,
                             [If you have EVP_sha256])
                         AC_MSG_RESULT(yes) 
@@ -720,10 +716,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                         LIBS="$LIBS -ldl -pthread"
                         LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
                         AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
-                        AC_TRY_LINK([], [
+                        AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                             int EVP_sha256(void);
                             (void)EVP_sha256();
-                          ],[
+                          ]])],[
                             AC_DEFINE([HAVE_EVP_SHA256], 1,
                                 [If you have EVP_sha256])
                             AC_MSG_RESULT(yes) 
@@ -750,8 +746,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                    [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check 
/usr/local/ssl
                             /usr/lib/ssl /usr/ssl /usr/pkg /usr/local 
/opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -769,8 +764,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check 
/usr/local/ssl
                                 /usr/lib/ssl /usr/ssl /usr/pkg /usr/local 
/opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -1062,7 +1056,7 @@ dnl defines MKDIR_HAS_ONE_ARG
 AC_DEFUN([ACX_MKDIR_ONE_ARG],
 [
 AC_MSG_CHECKING([whether mkdir has one arg])
-AC_TRY_COMPILE([
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 #include <stdio.h>
 #include <unistd.h>
 #ifdef HAVE_WINSOCK2_H
@@ -1071,14 +1065,12 @@ AC_TRY_COMPILE([
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
-], [
+]], [[
        (void)mkdir("directory");
-],
-AC_MSG_RESULT(yes)
+]])],[AC_MSG_RESULT(yes)
 AC_DEFINE(MKDIR_HAS_ONE_ARG, 1, [Define if mkdir has one argument.])
-,
-AC_MSG_RESULT(no)
-)
+],[AC_MSG_RESULT(no)
+])
 ])dnl end of ACX_MKDIR_ONE_ARG
 
 dnl Check for ioctlsocket function. works on mingw32 too.
diff --git config.h.in config.h.in
index c528729cc75..4c85367f027 100644
--- config.h.in
+++ config.h.in
@@ -552,7 +552,8 @@
 /* If reallocarray needs defines to appear in the headers */
 #undef REALLOCARRAY_NEEDS_DEFINES
 
-/* Define as the return type of signal handlers (`int' or `void'). */
+/* Return type of signal handlers, but autoconf 2.70 says 'your code may
+   safely assume C89 semantics that RETSIGTYPE is void.' */
 #undef RETSIGTYPE
 
 /* Define this to configure as a root server. */
@@ -824,10 +825,8 @@
 
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_TIME_H
 #include <time.h>
diff --git configure configure
index 349068f5d0c..d137fc314da 100644
--- configure
+++ configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for NSD 4.3.4.
+# Generated by GNU Autoconf 2.69 for NSD 4.3.5.
 #
 # Report bugs to <[email protected]>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='NSD'
 PACKAGE_TARNAME='nsd'
-PACKAGE_VERSION='4.3.4'
-PACKAGE_STRING='NSD 4.3.4'
+PACKAGE_VERSION='4.3.5'
+PACKAGE_STRING='NSD 4.3.5'
 PACKAGE_BUGREPORT='[email protected]'
 PACKAGE_URL=''
 
@@ -1314,7 +1314,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures NSD 4.3.4 to adapt to many kinds of systems.
+\`configure' configures NSD 4.3.5 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1376,7 +1376,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of NSD 4.3.4:";;
+     short | recursive ) echo "Configuration of NSD 4.3.5:";;
    esac
   cat <<\_ACEOF
 
@@ -1536,7 +1536,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-NSD configure 4.3.4
+NSD configure 4.3.5
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2245,7 +2245,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by NSD $as_me 4.3.4, which was
+It was created by NSD $as_me 4.3.5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3863,7 +3863,6 @@ $as_echo "$ac_cv_safe_to_define___extensions__" >&6; }
   $as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h
 
 
-
 if test "$ac_cv_header_minix_config_h" = "yes"; then
 
 $as_echo "#define _NETBSD_SOURCE 1" >>confdefs.h
@@ -6201,118 +6200,6 @@ $as_echo "#define USE_MINI_EVENT 1" >>confdefs.h
 fi
 
 # Checks for header files.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
-$as_echo_n "checking for ANSI C header files... " >&6; }
-if ${ac_cv_header_stdc+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <float.h>
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_header_stdc=yes
-else
-  ac_cv_header_stdc=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
-if test $ac_cv_header_stdc = yes; then
-  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <string.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "memchr" >/dev/null 2>&1; then :
-
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
-
-fi
-
-if test $ac_cv_header_stdc = yes; then
-  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdlib.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "free" >/dev/null 2>&1; then :
-
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
-
-fi
-
-if test $ac_cv_header_stdc = yes; then
-  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
-  if test "$cross_compiling" = yes; then :
-  :
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <ctype.h>
-#include <stdlib.h>
-#if ((' ' & 0x0FF) == 0x020)
-# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
-# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
-#else
-# define ISLOWER(c) \
-                  (('a' <= (c) && (c) <= 'i') \
-                    || ('j' <= (c) && (c) <= 'r') \
-                    || ('s' <= (c) && (c) <= 'z'))
-# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
-#endif
-
-#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
-int
-main ()
-{
-  int i;
-  for (i = 0; i < 256; i++)
-    if (XOR (islower (i), ISLOWER (i))
-       || toupper (i) != TOUPPER (i))
-      return 2;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-
-else
-  ac_cv_header_stdc=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-fi
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
-$as_echo "$ac_cv_header_stdc" >&6; }
-if test $ac_cv_header_stdc = yes; then
-
-$as_echo "#define STDC_HEADERS 1" >>confdefs.h
-
-fi
-
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for sys/wait.h that is 
POSIX.1 compatible" >&5
 $as_echo_n "checking for sys/wait.h that is POSIX.1 compatible... " >&6; }
 if ${ac_cv_header_sys_wait_h+:} false; then :
@@ -6833,10 +6720,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -6886,10 +6771,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -6939,10 +6822,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -6992,10 +6873,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7045,10 +6924,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7098,10 +6975,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7151,10 +7026,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7204,10 +7077,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7257,10 +7128,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7310,10 +7179,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7363,10 +7230,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7416,10 +7281,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -7904,38 +7767,8 @@ $as_echo "#define malloc rpl_malloc" >>confdefs.h
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking return type of signal 
handlers" >&5
-$as_echo_n "checking return type of signal handlers... " >&6; }
-if ${ac_cv_type_signal+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-#include <signal.h>
-
-int
-main ()
-{
-return *(signal (0, 0)) (0) == 1;
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_type_signal=int
-else
-  ac_cv_type_signal=void
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_signal" >&5
-$as_echo "$ac_cv_type_signal" >&6; }
-
-cat >>confdefs.h <<_ACEOF
-#define RETSIGTYPE $ac_cv_type_signal
-_ACEOF
 
+$as_echo "#define RETSIGTYPE void" >>confdefs.h
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGEFILE_SOURCE value 
needed for large files" >&5
 $as_echo_n "checking for _LARGEFILE_SOURCE value needed for large files... " 
>&6; }
@@ -9864,10 +9697,8 @@ else
 /* end confdefs.h.  */
 
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -10835,7 +10666,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by NSD $as_me 4.3.4, which was
+This file was extended by NSD $as_me 4.3.5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10897,7 +10728,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; 
s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-NSD config.status 4.3.4
+NSD config.status 4.3.5
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git configure.ac configure.ac
index 06e2f0e3b7e..07f36535818 100644
--- configure.ac
+++ configure.ac
@@ -5,8 +5,8 @@ dnl
 sinclude(acx_nlnetlabs.m4)
 sinclude(dnstap/dnstap.m4)
 
-AC_INIT(NSD,4.3.4,[email protected])
-AC_CONFIG_HEADER([config.h])
+AC_INIT([NSD],[4.3.5],[[email protected]])
+AC_CONFIG_HEADERS([config.h])
 
 #
 # Setup the standard programs
@@ -23,7 +23,7 @@ cmdln="`echo $@ | sed -e 's/\\\\/\\\\\\\\/g' | sed -e 
's/"/\\\\"/'g`"
 AC_DEFINE_UNQUOTED(CONFCMDLINE, ["$cmdln"], [Command line arguments used with 
configure])
 
 CFLAGS="$CFLAGS"
-AC_AIX
+AC_USE_SYSTEM_EXTENSIONS
 if test "$ac_cv_header_minix_config_h" = "yes"; then
        AC_DEFINE(_NETBSD_SOURCE,1, [Enable for compile on Minix])
 fi
@@ -51,7 +51,7 @@ esac
 #
 configdir=$sysconfdir/nsd
 AC_ARG_WITH([configdir],
-       AC_HELP_STRING([--with-configdir=dir], [NSD configuration directory]),
+       AS_HELP_STRING([--with-configdir=dir],[NSD configuration directory]),
        [configdir=$withval])
 AC_DEFINE_UNQUOTED(CONFIGDIR, ["`eval echo $configdir`"], [NSD config dir])
 AC_SUBST(configdir)
@@ -60,7 +60,7 @@ AC_SUBST(configdir)
 # Determine configuration file
 nsd_conf_file=${configdir}/nsd.conf
 AC_ARG_WITH([nsd_conf_file],
-       AC_HELP_STRING([--with-nsd_conf_file=path], [Pathname to the NSD 
configuration file]),
+       AS_HELP_STRING([--with-nsd_conf_file=path],[Pathname to the NSD 
configuration file]),
        [nsd_conf_file=$withval])
 AC_SUBST(nsd_conf_file)
 # the eval is to evaluate shell expansion twice, once
@@ -72,7 +72,7 @@ AC_DEFINE_UNQUOTED(CONFIGFILE, ["`eval echo 
$nsd_conf_file`"], [Pathname to the
 #
 logfile=${localstatedir}/log/nsd.log
 AC_ARG_WITH([logfile],
-       AC_HELP_STRING([--with-logfile=path], [Pathname to the default log 
file]),
+       AS_HELP_STRING([--with-logfile=path],[Pathname to the default log 
file]),
        [logfile=$withval])
 AC_SUBST(logfile)
 
@@ -91,7 +91,7 @@ else
        pidfile=${dbdir}/nsd.pid
 fi
 AC_ARG_WITH([pidfile],
-       AC_HELP_STRING([--with-pidfile=path], [Pathname to the NSD pidfile]),
+       AS_HELP_STRING([--with-pidfile=path],[Pathname to the NSD pidfile]),
        [pidfile=$withval])
 AC_SUBST(pidfile)
 AC_DEFINE_UNQUOTED(PIDFILE, ["`eval echo $pidfile`"], [Pathname to the NSD 
pidfile])
@@ -101,7 +101,7 @@ AC_DEFINE_UNQUOTED(PIDFILE, ["`eval echo $pidfile`"], 
[Pathname to the NSD pidfi
 #
 dbfile=${dbdir}/nsd.db
 AC_ARG_WITH([dbfile],
-       AC_HELP_STRING([--with-dbfile=path], [Pathname to the NSD database]),
+       AS_HELP_STRING([--with-dbfile=path],[Pathname to the NSD database]),
        [dbfile=$withval])
 AC_SUBST(dbfile)
 AC_DEFINE_UNQUOTED(DBFILE, ["`eval echo $dbfile`"], [Pathname to the NSD 
database])
@@ -119,29 +119,26 @@ AC_SUBST(piddir)
 #
 zonesdir=$configdir
 AC_ARG_WITH([zonesdir],
-       AC_HELP_STRING([--with-zonesdir=dir], [NSD default location for zone 
files]),
+       AS_HELP_STRING([--with-zonesdir=dir],[NSD default location for zone 
files]),
        [zonesdir=$withval])
 AC_SUBST(zonesdir)
 AC_DEFINE_UNQUOTED(ZONESDIR, ["`eval echo $zonesdir`"], [NSD default location 
for zone files. Empty string or NULL to disable.])
 
 # default xfrd file location.
 xfrdfile=${dbdir}/xfrd.state
-AC_ARG_WITH([xfrdfile], AC_HELP_STRING([--with-xfrdfile=path],
-       [Pathname to the NSD xfrd zone timer state file]), [xfrdfile=$withval])
+AC_ARG_WITH([xfrdfile], AS_HELP_STRING([--with-xfrdfile=path],[Pathname to the 
NSD xfrd zone timer state file]), [xfrdfile=$withval])
 AC_DEFINE_UNQUOTED(XFRDFILE, ["`eval echo $xfrdfile`"], [Pathname to the NSD 
xfrd zone timer state file.])
 AC_SUBST(xfrdfile)
 
 # default zonelist file location.
 zonelistfile=${dbdir}/zone.list
-AC_ARG_WITH([zonelistfile], AC_HELP_STRING([--with-zonelistfile=path],
-       [Pathname to the NSD zone list file]), [zonelistfile=$withval])
+AC_ARG_WITH([zonelistfile], 
AS_HELP_STRING([--with-zonelistfile=path],[Pathname to the NSD zone list 
file]), [zonelistfile=$withval])
 AC_DEFINE_UNQUOTED(ZONELISTFILE, ["`eval echo $zonelistfile`"], [Pathname to 
the NSD zone list file.])
 AC_SUBST(zonelistfile)
 
 # default xfr dir location.
 xfrdir="/tmp"
-AC_ARG_WITH([xfrdir], AC_HELP_STRING([--with-xfrdir=path],
-       [Pathname to where the NSD transfer dir is created]), [xfrdir=$withval])
+AC_ARG_WITH([xfrdir], AS_HELP_STRING([--with-xfrdir=path],[Pathname to where 
the NSD transfer dir is created]), [xfrdir=$withval])
 AC_DEFINE_UNQUOTED(XFRDIR, ["`eval echo $xfrdir`"], [Pathname to where the NSD 
transfer dir is created.])
 AC_SUBST(xfrdir)
 
@@ -160,7 +157,7 @@ AC_DEFINE_UNQUOTED(NSD_START_PATH, ["$nsd_start_path"], 
[Pathname to start nsd f
 # Determine default chroot directory
 #
 AC_ARG_WITH([chroot],
-       AC_HELP_STRING([--with-chroot=dir], [NSD default chroot directory]),
+       AS_HELP_STRING([--with-chroot=dir],[NSD default chroot directory]),
        [
                chrootdir=$withval
                AC_DEFINE_UNQUOTED(CHROOTDIR, ["`eval echo $chrootdir`"], [NSD 
default chroot directory])
@@ -172,7 +169,7 @@ AC_SUBST(chrootdir)
 #
 user=nsd
 AC_ARG_WITH([user],
-       AC_HELP_STRING([--with-user=username], [User name or ID to answer the 
queries with]),
+       AS_HELP_STRING([--with-user=username],[User name or ID to answer the 
queries with]),
        [user=$withval])
 AC_SUBST(user)
 AC_DEFINE_UNQUOTED(USER, ["$user"], [the user name to drop privileges to])
@@ -182,7 +179,7 @@ AC_PROG_SED
 AC_PROG_AWK
 AC_PROG_GREP
 AC_PROG_EGREP
-AC_PROG_LEX
+AC_PROG_LEX([noyywrap])
 AC_PROG_YACC
 AC_PROG_LN_S
 AC_PROG_INSTALL
@@ -222,15 +219,12 @@ AC_DEFUN([AC_CHECK_FORMAT_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" 
attribute)
 AC_CACHE_VAL(ac_cv_c_format_attribute,
 [ac_cv_c_format_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2)));
-], [
+]], [[
    f ("%s", "str");
-],
-[ac_cv_c_format_attribute="yes"],
-[ac_cv_c_format_attribute="no"])
+]])],[ac_cv_c_format_attribute="yes"],[ac_cv_c_format_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_format_attribute)
@@ -244,14 +238,11 @@ AC_DEFUN([AC_CHECK_UNUSED_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" 
attribute)
 AC_CACHE_VAL(ac_cv_c_unused_attribute,
 [ac_cv_c_unused_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *u __attribute__((unused)));
-], [
+]], [[
    f ("x");
-],
-[ac_cv_c_unused_attribute="yes"],
-[ac_cv_c_unused_attribute="no"])
+]])],[ac_cv_c_unused_attribute="yes"],[ac_cv_c_unused_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_unused_attribute)
@@ -265,14 +256,11 @@ AC_DEFUN([CHECK_NORETURN_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" 
attribute)
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
-AC_TRY_COMPILE(
-[ #include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
 __attribute__((noreturn)) void f(int x) { printf("%d", x); }
-], [
+]], [[
    f(1);
-],
-[ac_cv_c_noreturn_attribute="yes"],
-[ac_cv_c_noreturn_attribute="no"])
+]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
@@ -313,14 +301,10 @@ AC_DEFUN([AC_CHECK_CTIME_R],
 AC_MSG_CHECKING(whether ctime_r works with two arguments)
 AC_CACHE_VAL(ac_cv_c_ctime_c,
 [ac_cv_c_ctime_c=no
-AC_TRY_COMPILE(
-[#include <time.h>
-void testing (void) { time_t clock; char current_time[40]; ctime_r(&clock, 
current_time); }],
-[
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <time.h>
+void testing (void) { time_t clock; char current_time[40]; ctime_r(&clock, 
current_time); }]], [[
         testing();
-],
-[ac_cv_c_ctime_c="yes"],
-[ac_cv_c_ctime_c="no"])
+]])],[ac_cv_c_ctime_c="yes"],[ac_cv_c_ctime_c="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_ctime_c)
@@ -358,8 +342,7 @@ AC_CHECK_CTIME_R
 # http://www.gnu.org/software/ac-archive/htmldoc/check_ssl.html and
 # modified for NSD.
 AC_DEFUN([CHECK_SSL], [
-    AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                [enable SSL (will check /usr/local/ssl
+    AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will 
check /usr/local/ssl
                 /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr 
/usr/local/opt/openssl)]),[
         ],[
             withval="yes"
@@ -381,9 +364,9 @@ AC_DEFUN([CHECK_SSL], [
             fi
         done
         if test x_$found_ssl != x_yes; then
-            AC_MSG_ERROR(Cannot find the SSL libraries in $withval)
+            AC_MSG_ERROR([Cannot find the SSL libraries in $withval])
         else
-            AC_MSG_RESULT(found in $ssldir)
+            AC_MSG_RESULT([found in $ssldir])
             HAVE_SSL=yes
             if test x_$ssldir != x_/usr; then
                 LDFLAGS="$LDFLAGS -L$ssldir/lib";
@@ -397,8 +380,7 @@ AC_DEFUN([CHECK_SSL], [
 ])dnl
 
 # check for libevent
-AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
-    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw 
/usr /usr/local/opt/libevent or you can specify an explicit path), useful when 
the zone count is high.]),
+AC_ARG_WITH(libevent, AS_HELP_STRING([--with-libevent=pathname],[use libevent 
(will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr 
/usr/local/opt/libevent or you can specify an explicit path), useful when the 
zone count is high.]),
     [ ],[ withval="yes" ])
 if test x_$withval = x_yes -o x_$withval != x_no; then
         AC_MSG_CHECKING(for libevent)
@@ -466,7 +448,6 @@ else
 fi
 
 # Checks for header files.
-AC_HEADER_STDC
 AC_HEADER_SYS_WAIT
 AC_CHECK_HEADERS([time.h arpa/inet.h signal.h string.h strings.h fcntl.h 
limits.h netinet/in.h netinet/tcp.h stddef.h sys/param.h sys/socket.h sys/un.h 
syslog.h unistd.h sys/select.h stdarg.h stdint.h netdb.h sys/bitypes.h tcpd.h 
glob.h grp.h endian.h sys/random.h])
 
@@ -565,7 +546,7 @@ fi
 if test "$srcdir" != "."; then
        CPPFLAGS="$CPPFLAGS -I$srcdir"
        if test -f $srcdir/config.h; then
-               AC_ERROR([$srcdir/config.h is in the way, please remove it])
+               AC_MSG_ERROR([$srcdir/config.h is in the way, please remove it])
        fi
 fi
 
@@ -577,18 +558,15 @@ dnl systems to get some types.
 
 dnl AC_LIBGTOP_CHECK_TYPE(TYPE, DEFAULT)
 AC_DEFUN([AC_LIBGTOP_CHECK_TYPE],
-[AC_REQUIRE([AC_HEADER_STDC])dnl
-AC_MSG_CHECKING(for $1)
+[AC_MSG_CHECKING(for $1)
 AC_CACHE_VAL(ac_cv_type_$1,
 [AC_EGREP_CPP(dnl
 changequote(<<,>>)dnl
 <<(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]>>dnl
 changequote([,]), [
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
@@ -650,7 +628,7 @@ AC_INCLUDES_DEFAULT
 AC_FUNC_CHOWN
 AC_FUNC_FORK
 AC_FUNC_MALLOC
-AC_TYPE_SIGNAL
+AC_DEFINE(RETSIGTYPE,void,[Return type of signal handlers, but autoconf 2.70 
says 'your code may safely assume C89 semantics that RETSIGTYPE is void.'])
 AC_FUNC_FSEEKO
 AC_SYS_LARGEFILE
 AC_CHECK_SIZEOF(void*)
@@ -664,7 +642,7 @@ AC_INCLUDES_DEFAULT
 #include <sys/socket.h>
 ])
 
-AC_ARG_ENABLE(recvmmsg, AC_HELP_STRING([--enable-recvmmsg], [Enable recvmmsg 
and sendmmsg compilation, faster but some kernel versions may have 
implementation problems for IPv6]))
+AC_ARG_ENABLE(recvmmsg, AS_HELP_STRING([--enable-recvmmsg],[Enable recvmmsg 
and sendmmsg compilation, faster but some kernel versions may have 
implementation problems for IPv6]))
 case "$enable_recvmmsg" in
         yes)
                AC_CHECK_FUNC([recvmmsg], [
@@ -732,8 +710,7 @@ AC_INCLUDES_DEFAULT
 AC_DEFUN([AC_CHECK_CPU_OR],
 [AC_REQUIRE([AC_PROG_CC])
 AC_MSG_CHECKING(whether CPU_OR works with three arguments)
-AC_TRY_COMPILE(
-[#ifdef HAVE_SCHED_H
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#ifdef HAVE_SCHED_H
 # include <sched.h>
 #endif
 #ifdef HAVE_SYS_CPUSET_H
@@ -751,12 +728,12 @@ void testing (void) {
        memset(&a, 0, sizeof(a));
        memset(&b, 0, sizeof(b));
        CPU_OR(&a, &a, &b);
-}], [
+}]], [[
         testing();
-], [
+]])],[
        AC_MSG_RESULT(yes)
        AC_DEFINE([CPU_OR_THREE_ARGS], 1, [number of arguments for CPU_OR is 
three])
-], [
+],[
        AC_MSG_RESULT(no)
 ])])
 
@@ -919,7 +896,7 @@ dnl Determine the syslog facility to use
 dnl
 facility=LOG_DAEMON
 AC_ARG_WITH([facility],
-        AC_HELP_STRING([--with-facility=name], [Syslog default facility 
(LOG_DAEMON)]),
+        AS_HELP_STRING([--with-facility=name],[Syslog default facility 
(LOG_DAEMON)]),
         [facility=$withval])
 AC_DEFINE_UNQUOTED([FACILITY], $facility, [Define to the default facility for 
syslog.])
 
@@ -928,14 +905,14 @@ dnl Determine the default tcp timeout
 dnl
 tcp_timeout=120
 AC_ARG_WITH([tcp_timeout],
-       AC_HELP_STRING([--with-tcp-timeout=number], [Limit the default tcp 
timeout]),
+       AS_HELP_STRING([--with-tcp-timeout=number],[Limit the default tcp 
timeout]),
        [tcp_timeout=$withval])
 AC_DEFINE_UNQUOTED([TCP_TIMEOUT], $tcp_timeout, [Define to the default tcp 
timeout.])
 
 dnl
 dnl Features
 dnl
-AC_ARG_ENABLE(root-server, AC_HELP_STRING([--enable-root-server], [Configure 
NSD as a root server]))
+AC_ARG_ENABLE(root-server, AS_HELP_STRING([--enable-root-server],[Configure 
NSD as a root server]))
 case "$enable_root_server" in
         yes)
                AC_DEFINE_UNQUOTED([ROOT_SERVER], [], [Define this to configure 
as a root server.])
@@ -944,7 +921,7 @@ case "$enable_root_server" in
                 ;;
 esac
 
-AC_ARG_ENABLE(ipv6, AC_HELP_STRING([--disable-ipv6], [Disables IPv6 support]))
+AC_ARG_ENABLE(ipv6, AS_HELP_STRING([--disable-ipv6],[Disables IPv6 support]))
 case "$enable_ipv6" in
         no)
                 ;;
@@ -953,7 +930,7 @@ case "$enable_ipv6" in
                ;;
 esac
 
-AC_ARG_ENABLE(bind8-stats, AC_HELP_STRING([--enable-bind8-stats], [Enables 
BIND8 like NSTATS & XSTATS and statistics in nsd-control]))
+AC_ARG_ENABLE(bind8-stats, AS_HELP_STRING([--enable-bind8-stats],[Enables 
BIND8 like NSTATS & XSTATS and statistics in nsd-control]))
 
 case "$enable_bind8_stats" in
        yes|'')
@@ -963,7 +940,7 @@ case "$enable_bind8_stats" in
                ;;
 esac
 
-AC_ARG_ENABLE(zone-stats, AC_HELP_STRING([--enable-zone-stats], [Enable 
per-zone statistics gathering (needs --enable-bind8-stats)]))
+AC_ARG_ENABLE(zone-stats, AS_HELP_STRING([--enable-zone-stats],[Enable 
per-zone statistics gathering (needs --enable-bind8-stats)]))
 case "$enable_zone_stats" in
        yes)
                AC_DEFINE_UNQUOTED([USE_ZONE_STATS], [], [Define this to enable 
per-zone statistics gathering.])
@@ -973,7 +950,7 @@ case "$enable_zone_stats" in
                ;;
 esac
 
-AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable internal 
runtime checks]))
+AC_ARG_ENABLE(checking, AS_HELP_STRING([--enable-checking],[Enable internal 
runtime checks]))
 case "$enable_checking" in
         yes)
                CHECK_COMPILER_FLAG(W, [ CFLAGS="$CFLAGS -W" ])
@@ -986,11 +963,11 @@ case "$enable_checking" in
                 ;;
 esac
 
-AC_ARG_ENABLE(memclean, AC_HELP_STRING([--enable-memclean], [Cleanup memory 
(at exit) for eg. valgrind, memcheck]))
+AC_ARG_ENABLE(memclean, AS_HELP_STRING([--enable-memclean],[Cleanup memory (at 
exit) for eg. valgrind, memcheck]))
 if test "$enable_memclean" = "yes"; then AC_DEFINE_UNQUOTED([MEMCLEAN], [1], 
[Define this to cleanup memory at exit (eg. for valgrind, etc.)])
 fi
 
-AC_ARG_ENABLE(ratelimit, AC_HELP_STRING([--enable-ratelimit], [Enable rate 
limiting]))
+AC_ARG_ENABLE(ratelimit, AS_HELP_STRING([--enable-ratelimit],[Enable rate 
limiting]))
 case "$enable_ratelimit" in
        yes)
                AC_DEFINE_UNQUOTED([RATELIMIT], [], [Define this to enable rate 
limiting.])
@@ -1003,7 +980,7 @@ case "$enable_ratelimit" in
 esac
 AC_SUBST(ratelimit)
 
-AC_ARG_ENABLE(ratelimit-default-is-off, 
AC_HELP_STRING([--enable-ratelimit-default-is-off], [Enable this to set default 
of ratelimit to off (enable in nsd.conf), otherwise ratelimit is enabled by 
default if --enable-ratelimit is enabled]))
+AC_ARG_ENABLE(ratelimit-default-is-off, 
AS_HELP_STRING([--enable-ratelimit-default-is-off],[Enable this to set default 
of ratelimit to off (enable in nsd.conf), otherwise ratelimit is enabled by 
default if --enable-ratelimit is enabled]))
 case "$enable_ratelimit_default_is_off" in
        yes)
                AC_DEFINE_UNQUOTED([RATELIMIT_DEFAULT_OFF], [], [Define this to 
set ratelimit to off by default.])
@@ -1025,10 +1002,10 @@ if test x$HAVE_SSL = x"yes"; then
        # Check for -pthread
        BAKLIBS="$LIBS"
        LIBS="-lcrypto $LIBS"
-       AC_TRY_LINK([], [
+       AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                int EVP_sha256(void);
                (void)EVP_sha256();
-       ], [],[
+       ]])],[],[
                dnl so link fails for EVP_sha256, try with -pthread.
                BAKCFLAGS="$CFLAGS"
                CFLAGS="$CFLAGS -pthread"
@@ -1084,7 +1061,7 @@ else
        AC_MSG_WARN([No SSL, therefore TLS is disabled])
 fi
 
-AC_ARG_ENABLE(nsec3, AC_HELP_STRING([--disable-nsec3], [Disable NSEC3 
support]))
+AC_ARG_ENABLE(nsec3, AS_HELP_STRING([--disable-nsec3],[Disable NSEC3 support]))
 case "$enable_nsec3" in
         no)
                ;;
@@ -1100,7 +1077,7 @@ case "$enable_nsec3" in
                 ;;
 esac
 
-AC_ARG_ENABLE(minimal-responses, AC_HELP_STRING([--disable-minimal-responses], 
[Disable response minimization. More truncation.]))
+AC_ARG_ENABLE(minimal-responses, 
AS_HELP_STRING([--disable-minimal-responses],[Disable response minimization. 
More truncation.]))
 case "$enable_minimal_responses" in
         no)
                ;;
@@ -1109,7 +1086,7 @@ case "$enable_minimal_responses" in
                 ;;
 esac
 
-AC_ARG_ENABLE(mmap, AC_HELP_STRING([--enable-mmap], [Use mmap instead of 
malloc. Experimental.]))
+AC_ARG_ENABLE(mmap, AS_HELP_STRING([--enable-mmap],[Use mmap instead of 
malloc. Experimental.]))
 case "$enable_mmap" in
         yes)
                AC_CHECK_HEADERS([sys/mman.h])
@@ -1121,7 +1098,7 @@ case "$enable_mmap" in
                 ;;
 esac
 
-AC_ARG_ENABLE(radix-tree, AC_HELP_STRING([--disable-radix-tree], [You can 
disable the radix tree and use the red-black tree for the main lookups, the 
red-black tree uses less memory, but uses some more CPU.]))
+AC_ARG_ENABLE(radix-tree, AS_HELP_STRING([--disable-radix-tree],[You can 
disable the radix tree and use the red-black tree for the main lookups, the 
red-black tree uses less memory, but uses some more CPU.]))
 case "$enable_radix_tree" in
         no)
        ;;
@@ -1130,7 +1107,7 @@ case "$enable_radix_tree" in
        ;;
 esac
 
-AC_ARG_ENABLE(packed, AC_HELP_STRING([--enable-packed], [Enable packed 
structure alignment, uses less memory, but unaligned reads.]))
+AC_ARG_ENABLE(packed, AS_HELP_STRING([--enable-packed],[Enable packed 
structure alignment, uses less memory, but unaligned reads.]))
 case "$enable_packed" in
        yes)
        AC_DEFINE_UNQUOTED([PACKED_STRUCTS], [], [Define this to use packed 
structure alignment.])
@@ -1164,7 +1141,7 @@ dt_DNSTAP([${localstatedir}/run/nsd-dnstap.sock],
 sinclude(systemd.m4)
 # Include systemd.m4 - end
 
-AC_ARG_ENABLE(tcp-fastopen, AC_HELP_STRING([--enable-tcp-fastopen], [Enable 
TCP Fast Open]))
+AC_ARG_ENABLE(tcp-fastopen, AS_HELP_STRING([--enable-tcp-fastopen],[Enable TCP 
Fast Open]))
 case "$enable_tcp_fastopen" in
        yes)
              AC_CHECK_DECL([TCP_FASTOPEN], [], [AC_MSG_ERROR([TCP Fast Open is 
not available: please rerun without --enable-tcp-fastopen])], 
[AC_INCLUDES_DEFAULT
@@ -1219,10 +1196,8 @@ AH_BOTTOM([
 
 AH_BOTTOM([
 #include <sys/types.h>
-#if STDC_HEADERS
 #include <stdlib.h>
 #include <stddef.h>
-#endif
 
 #ifdef HAVE_TIME_H
 #include <time.h>
diff --git dnstap/dnstap.m4 dnstap/dnstap.m4
index 5b78b3e267c..11b6de36509 100644
--- dnstap/dnstap.m4
+++ dnstap/dnstap.m4
@@ -20,7 +20,7 @@ AC_DEFUN([dt_DNSTAP],
     if test -z "$PROTOC_C"; then
       AC_MSG_ERROR([The protoc-c program was not found. Please install 
protobuf-c!])
     fi
-    AC_ARG_WITH([protobuf-c], AC_HELP_STRING([--with-protobuf-c=path],
+    AC_ARG_WITH([protobuf-c], AS_HELP_STRING([--with-protobuf-c=path],
        [Path where protobuf-c is installed, for dnstap]), [
          # workaround for protobuf-c includes at old dir before 
protobuf-c-1.0.0
          if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
@@ -40,7 +40,7 @@ AC_DEFUN([dt_DNSTAP],
            fi
          fi
     ])
-    AC_ARG_WITH([libfstrm], AC_HELP_STRING([--with-libfstrm=path],
+    AC_ARG_WITH([libfstrm], AS_HELP_STRING([--with-libfstrm=path],
        [Path where libfstrm is installed, for dnstap]), [
        CFLAGS="$CFLAGS -I$withval/include"
        LDFLAGS="$LDFLAGS -L$withval/lib"
diff --git doc/ChangeLog doc/ChangeLog
index 018c484aac3..66233f85934 100644
--- doc/ChangeLog
+++ doc/ChangeLog
@@ -1,6 +1,50 @@
+19 January 2021: Wouter
+       - Set branch ready for 4.3.5 release.
+
+15 January 2021: Wouter
+       - Fix #152: '*' in Rdata causes the return code to be NOERROR instead
+         of NX.
+       - Add config.guess and config.sub to .gitignore for autoconf 2.70.
+       - Fix #150: TXT record validation difference with BIND.
+       - Fixup TXT record validation fix for escaped quotes.
+       - Fixup TXT record validation fix for escaped backslashes.
+       - Fixup escape character parse for quoted strings.
+
+11 January 2021: Wouter
+       - Fix #151: DNAME not applied more than once to resolve the query.
+       - Fix dname test for #148.
+       - For #151: fix to not produce loops in output.
+
+5 January 2021: Wouter
+       - Fix configure.ac for autoconf 2.70.
+
+4 January 2021: Wouter
+       - Fix #148: CNAME need not be followed after a synthesized CNAME
+         for a CNAME query.
+
+11 December 2020: Wouter
+       - Fix that nsd-control has timeout when connection is down.
+       - remove windows socket ifdefs from nsd-control.
+
+3 December 2020: Wouter
+       - For #145: Fix that service of remaining TCP and TLS connections
+         does not allow new queries to be made, the connection is closed.
+         Only existing queries and zone transfers are answered, new ones
+         are rejected by a close of the channel.
+
+30 November 2020: Wouter
+       - Fix #144: fix better.
+
+27 November 2020: Wouter
+       - Fix #144: Typo fix in nsd.conf.5.in.
+
+26 November 2020: Wouter
+       - Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode.
+
 24 November 2020: Wouter
        - Merge PR #141: ZONEMD RR type.
-       - tag for 4.3.4rc1.
+       - tag for 4.3.4rc1.  This became 4.3.4 release on 1 dec 2020.
+         The code repo continues for 4.3.5 in development.
 
 23 November 2020: Wouter
        - Fix #142: NODATA answers missin SOA in authority section after
diff --git doc/RELNOTES doc/RELNOTES
index 9bb1202601f..13d4c1f42ea 100644
--- doc/RELNOTES
+++ doc/RELNOTES
@@ -1,5 +1,25 @@
 NSD RELEASE NOTES
 
+4.3.5
+================
+BUG FIXES:
+       - Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode.
+       - Fix #144: Typo fix in nsd.conf.5.in.
+       - For #145: Fix that service of remaining TCP and TLS connections
+         does not allow new queries to be made, the connection is closed.
+         Only existing queries and zone transfers are answered, new ones
+         are rejected by a close of the channel.
+       - Fix that nsd-control has timeout when connection is down.
+       - remove windows socket ifdefs from nsd-control.
+       - Fix #148: CNAME need not be followed after a synthesized CNAME
+         for a CNAME query.
+       - Fix configure.ac for autoconf 2.70.
+       - Fix #150: TXT record validation difference with BIND.
+       - Fix #151: DNAME not applied more than once to resolve the query.
+       - Fix #152: '*' in Rdata causes the return code to be NOERROR instead
+         of NX.
+
+
 4.3.4
 ================
 FEATURES:
diff --git nsd-checkconf.8.in nsd-checkconf.8.in
index 5355b408580..43b5f19598e 100644
--- nsd-checkconf.8.in
+++ nsd-checkconf.8.in
@@ -1,4 +1,4 @@
-.TH "nsd\-checkconf" "8" "Dec  1, 2020" "NLnet Labs" "nsd 4.3.4"
+.TH "nsd\-checkconf" "8" "Jan 26, 2021" "NLnet Labs" "nsd 4.3.5"
 .\" Copyright (c) 2001\-2008, NLnet Labs. All rights reserved.
 .\" See LICENSE for the license.
 .SH "NAME"
diff --git nsd-checkzone.8.in nsd-checkzone.8.in
index 27195a65517..2cd10c1f193 100644
--- nsd-checkzone.8.in
+++ nsd-checkzone.8.in
@@ -1,4 +1,4 @@
-.TH "nsd\-checkzone" "8" "Dec  1, 2020" "NLnet Labs" "nsd 4.3.4"
+.TH "nsd\-checkzone" "8" "Jan 26, 2021" "NLnet Labs" "nsd 4.3.5"
 .\" Copyright (c) 2014, NLnet Labs. All rights reserved.
 .\" See LICENSE for the license.
 .SH "NAME"
diff --git nsd-control.8.in nsd-control.8.in
index 56ef19386a9..1b16fdd0668 100644
--- nsd-control.8.in
+++ nsd-control.8.in
@@ -1,4 +1,4 @@
-.TH "nsd\-control" "8" "Dec  1, 2020" "NLnet Labs" "nsd 4.3.4"
+.TH "nsd\-control" "8" "Jan 26, 2021" "NLnet Labs" "nsd 4.3.5"
 .\" Copyright (c) 2011, NLnet Labs. All rights reserved.
 .\" See LICENSE for the license.
 .SH "NAME"
diff --git nsd-control.c nsd-control.c
index 1216e248ae9..5a5f4764991 100644
--- nsd-control.c
+++ nsd-control.c
@@ -59,6 +59,7 @@
 #ifdef HAVE_SYS_UN_H
 #include <sys/un.h>
 #endif
+#include <fcntl.h>
 #include "util.h"
 #include "tsig.h"
 #include "options.h"
@@ -67,6 +68,9 @@ static void usage(void) ATTR_NORETURN;
 static void ssl_err(const char* s) ATTR_NORETURN;
 static void ssl_path_err(const char* s, const char *path) ATTR_NORETURN;
 
+/** timeout to wait for connection over stream, in msec */
+#define NSD_CONTROL_CONNECT_TIMEOUT 5000
+
 /** Give nsd-control usage, and exit (1). */
 static void
 usage()
@@ -185,6 +189,21 @@ setup_ctx(struct nsd_options* cfg)
        return ctx;
 }
 
+/** check connect error */
+static void
+checkconnecterr(int err, const char* svr, int port, int statuscmd)
+{
+       if(!port) fprintf(stderr, "error: connect (%s): %s\n", svr,
+               strerror(err));
+       else fprintf(stderr, "error: connect (%s@%d): %s\n", svr, port,
+               strerror(err));
+       if(err == ECONNREFUSED && statuscmd) {
+               printf("nsd is stopped\n");
+               exit(3);
+       }
+       exit(1);
+}
+
 /** contact the server with TCP connect */
 static int
 contact_server(const char* svr, struct nsd_options* cfg, int statuscmd)
@@ -270,17 +289,53 @@ contact_server(const char* svr, struct nsd_options* cfg, 
int statuscmd)
                fprintf(stderr, "socket: %s\n", strerror(errno));
                exit(1);
        }
+       if(fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
+               fprintf(stderr, "error: set nonblocking: fcntl: %s",
+                       strerror(errno));
+       }
        if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
-               int err = errno;
-               if(!port) fprintf(stderr, "error: connect (%s): %s\n", svr,
-                       strerror(err));
-               else fprintf(stderr, "error: connect (%s@%d): %s\n", svr, port,
-                       strerror(err));
-               if(err == ECONNREFUSED && statuscmd) {
-                       printf("nsd is stopped\n");
-                       exit(3);
+               if(errno != EINPROGRESS) {
+                       checkconnecterr(errno, svr, port, statuscmd);
                }
-               exit(1);
+       }
+       while(1) {
+               fd_set rset, wset, eset;
+               struct timeval tv;
+               FD_ZERO(&rset);
+               FD_SET(fd, &rset);
+               FD_ZERO(&wset);
+               FD_SET(fd, &wset);
+               FD_ZERO(&eset);
+               FD_SET(fd, &eset);
+               tv.tv_sec = NSD_CONTROL_CONNECT_TIMEOUT/1000;
+               tv.tv_usec= (NSD_CONTROL_CONNECT_TIMEOUT%1000)*1000;
+               if(select(fd+1, &rset, &wset, &eset, &tv) == -1) {
+                       fprintf(stderr, "select: %s\n", strerror(errno));
+                       exit(1);
+               }
+               if(!FD_ISSET(fd, &rset) && !FD_ISSET(fd, &wset) &&
+                       !FD_ISSET(fd, &eset)) {
+                       fprintf(stderr, "timeout: could not connect to 
server\n");
+                       exit(1);
+               } else {
+                       /* check nonblocking connect error */
+                       int error = 0;
+                       socklen_t len = (socklen_t)sizeof(error);
+                       if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
+                               &len) < 0) {
+                               error = errno; /* on solaris errno is error */
+                       }
+                       if(error != 0) {
+                               if(error == EINPROGRESS || error == EWOULDBLOCK)
+                                       continue; /* try again later */
+                               checkconnecterr(error, svr, port, statuscmd);
+                       }
+               }
+               break;
+       }
+       if(fcntl(fd, F_SETFL, 0) == -1) {
+               fprintf(stderr, "error: set blocking: fcntl: %s",
+                       strerror(errno));
        }
        return fd;
 }
@@ -464,10 +519,6 @@ int main(int argc, char* argv[])
        int c;
        const char* cfgfile = CONFIGFILE;
        char* svr = NULL;
-#ifdef USE_WINSOCK
-       int r;
-       WSADATA wsa_data;
-#endif
        log_init("nsd-control");
 
 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
diff --git nsd.8.in nsd.8.in
index cec7a9761eb..acff975c89d 100644
--- nsd.8.in
+++ nsd.8.in
@@ -1,9 +1,9 @@
-.TH "NSD" "8" "Dec  1, 2020" "NLnet Labs" "NSD 4.3.4"
+.TH "NSD" "8" "Jan 26, 2021" "NLnet Labs" "NSD 4.3.5"
 .\" Copyright (c) 2001\-2008, NLnet Labs. All rights reserved.
 .\" See LICENSE for the license.
 .SH "NAME"
 .B nsd
-\- Name Server Daemon (NSD) version 4.3.4.
+\- Name Server Daemon (NSD) version 4.3.5.
 .SH "SYNOPSIS"
 .B nsd
 .RB [ \-4 ] 
diff --git nsd.conf.5.in nsd.conf.5.in
index bd8589d6978..32c86d7566f 100644
--- nsd.conf.5.in
+++ nsd.conf.5.in
@@ -1,4 +1,4 @@
-.TH "nsd.conf" "5" "Dec  1, 2020" "NLnet Labs" "nsd 4.3.4"
+.TH "nsd.conf" "5" "Jan 26, 2021" "NLnet Labs" "nsd 4.3.5"
 .\" Copyright (c) 2001\-2008, NLnet Labs. All rights reserved.
 .\" See LICENSE for the license.
 .SH "NAME"
@@ -161,7 +161,7 @@ anycast instances.  Use ip-transparent to be able to list 
addresses that
 turn on later (typical for certain load-balancing).
 .TP
 .B interface:\fR <ip4 or ip6>[@port] [servers] [bindtodevice] [setfib]
-Same as ip\-address (for easy of compatibility with unbound.conf).
+Same as ip\-address (for ease of compatibility with unbound.conf).
 .TP
 .B ip\-transparent:\fR <yes or no>
 Allows NSD to bind to non local addresses. This is useful to have NSD
diff --git query.c query.c
index 5cdc877753d..d985b8f8237 100644
--- query.c
+++ query.c
@@ -771,14 +771,29 @@ query_synthesize_cname(struct query* q, struct answer* 
answer, const dname_type*
           their (not allocated yet) parents */
        /* any domains below src are not_existing (because of DNAME at src) */
        int i;
+       size_t j;
        domain_type* cname_domain;
        domain_type* cname_dest;
        rrset_type* rrset;
 
-       /* allocate source part */
        domain_type* lastparent = src;
        assert(q && answer && from_name && to_name && src && 
to_closest_encloser);
        assert(to_closest_match);
+
+       /* check for loop by duplicate CNAME rrset synthesized */
+       for(j=0; j<answer->rrset_count; ++j) {
+               if(answer->section[j] == ANSWER_SECTION &&
+                       answer->rrsets[j]->rr_count == 1 &&
+                       answer->rrsets[j]->rrs[0].type == TYPE_CNAME &&
+                       
dname_compare(domain_dname(answer->rrsets[j]->rrs[0].owner), from_name) == 0 &&
+                       answer->rrsets[j]->rrs[0].rdata_count == 1 &&
+                       
dname_compare(domain_dname(answer->rrsets[j]->rrs[0].rdatas->domain), to_name) 
== 0) {
+                       DEBUG(DEBUG_QUERY,2, (LOG_INFO, "loop for synthesized 
CNAME rrset for query %s", dname_to_string(q->qname, NULL)));
+                       return 0;
+               }
+       }
+
+       /* allocate source part */
        for(i=0; i < from_name->label_count - domain_dname(src)->label_count; 
i++)
        {
                domain_type* newdom = query_get_tempdomain(q);
@@ -844,7 +859,9 @@ query_synthesize_cname(struct query* q, struct answer* 
answer, const dname_type*
        rrset->rrs->rdatas->domain = cname_dest;
 
        if(!add_rrset(q, answer, ANSWER_SECTION, cname_domain, rrset)) {
-               log_msg(LOG_ERR, "could not add synthesized CNAME rrset to 
packet");
+               DEBUG(DEBUG_QUERY,2, (LOG_INFO, "could not add synthesized 
CNAME rrset to packet for query %s", dname_to_string(q->qname, NULL)));
+               /* failure to add CNAME; likely is a loop, the same twice */
+               return 0;
        }
 
        return cname_dest->number;
@@ -1074,6 +1091,7 @@ answer_authoritative(struct nsd   *nsd,
        domain_type *match;
        domain_type *original = closest_match;
        domain_type *dname_ce;
+       domain_type *wildcard_child;
        rrset_type *rrset;
 
 #ifdef NSEC3
@@ -1094,8 +1112,11 @@ answer_authoritative(struct nsd   *nsd,
        } else if ((rrset=domain_find_rrset(closest_encloser, q->zone, 
TYPE_DNAME))) {
                /* process DNAME */
                const dname_type* name = qname;
+               domain_type* src = closest_encloser;
                domain_type *dest = rdata_atom_domain(rrset->rrs[0].rdatas[0]);
-               int added;
+               const dname_type* newname;
+               size_t newnum = 0;
+               zone_type* origzone = q->zone;
                assert(rrset->rr_count > 0);
                if(domain_number != 0) /* we followed CNAMEs or DNAMEs */
                        name = domain_dname(closest_match);
@@ -1104,43 +1125,45 @@ answer_authoritative(struct nsd   *nsd,
                        domain_to_string(closest_encloser)));
                DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->dest is %s",
                        domain_to_string(dest)));
-               /* if the DNAME set is not added we have a loop, do not follow 
*/
-               added = add_rrset(q, answer, ANSWER_SECTION, closest_encloser, 
rrset);
-               if(added) {
-                       domain_type* src = closest_encloser;
-                       const dname_type* newname = dname_replace(q->region, 
name,
-                               domain_dname(src), domain_dname(dest));
-                       size_t newnum = 0;
-                       zone_type* origzone = q->zone;
-                       ++q->cname_count;
-                       if(!newname) { /* newname too long */
-                               RCODE_SET(q->packet, RCODE_YXDOMAIN);
+               if(!add_rrset(q, answer, ANSWER_SECTION, closest_encloser, 
rrset)) {
+                       /* stop if DNAME loops, when added second time */
+                       if(dname_is_subdomain(domain_dname(dest), 
domain_dname(src))) {
                                return;
                        }
-                       DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", 
dname_to_string(newname, NULL)));
-                       /* follow the DNAME */
-                       (void)namedb_lookup(nsd->db, newname, &closest_match, 
&closest_encloser);
-                       /* synthesize CNAME record */
-                       newnum = query_synthesize_cname(q, answer, name, 
newname,
-                               src, closest_encloser, &closest_match, 
rrset->rrs[0].ttl);
-                       if(!newnum) {
-                               /* could not synthesize the CNAME. */
-                               /* return previous CNAMEs to make resolver 
recurse for us */
-                               return;
-                       }
-
-                       answer_lookup_zone(nsd, q, answer, newnum,
-                               closest_match == closest_encloser,
-                               closest_match, closest_encloser, newname);
-                       q->zone = origzone;
                }
-               if(!added)  /* log the error so operator can find looping 
recursors */
-                       log_msg(LOG_INFO, "DNAME processing stopped due to 
loop, qname %s",
-                               dname_to_string(q->qname, NULL));
+               newname = dname_replace(q->region, name,
+                       domain_dname(src), domain_dname(dest));
+               ++q->cname_count;
+               if(!newname) { /* newname too long */
+                       RCODE_SET(q->packet, RCODE_YXDOMAIN);
+                       return;
+               }
+               DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", 
dname_to_string(newname, NULL)));
+               /* follow the DNAME */
+               (void)namedb_lookup(nsd->db, newname, &closest_match, 
&closest_encloser);
+               /* synthesize CNAME record */
+               newnum = query_synthesize_cname(q, answer, name, newname,
+                       src, closest_encloser, &closest_match, 
rrset->rrs[0].ttl);
+               if(!newnum) {
+                       /* could not synthesize the CNAME. */
+                       /* return previous CNAMEs to make resolver recurse for 
us */
+                       return;
+               }
+               if(q->qtype == TYPE_CNAME) {
+                       /* The synthesized CNAME is the answer to
+                        * that query, same as BIND does for query
+                        * of type CNAME */
+                       return;
+               }
+
+               answer_lookup_zone(nsd, q, answer, newnum,
+                       closest_match == closest_encloser,
+                       closest_match, closest_encloser, newname);
+               q->zone = origzone;
                return;
-       } else if (domain_wildcard_child(closest_encloser)) {
+       } else if 
((wildcard_child=domain_wildcard_child(closest_encloser))!=NULL &&
+               wildcard_child->is_existing) {
                /* Generate the domain from the wildcard.  */
-               domain_type *wildcard_child = 
domain_wildcard_child(closest_encloser);
 #ifdef RATELIMIT
                q->wildcard_domain = wildcard_child;
 #endif
diff --git server.c server.c
index b666d0c63d9..bbcfe0c80f3 100644
--- server.c
+++ server.c
@@ -209,6 +209,11 @@ struct tcp_handler_data
         * The timeout in msec for this tcp connection
         */
        int     tcp_timeout;
+
+       /*
+        * If the connection is allowed to have further queries on it.
+        */
+       int tcp_no_more_queries;
 #ifdef HAVE_SSL
        /*
         * TLS object.
@@ -3102,6 +3107,7 @@ service_remaining_tcp(struct nsd* nsd)
                }
 #endif
 
+               p->tcp_no_more_queries = 1;
                /* set timeout to 1/10 second */
                if(p->tcp_timeout > 100)
                        p->tcp_timeout = 100;
@@ -3493,8 +3499,9 @@ handle_tcp_reading(int fd, short event, void* arg)
                return;
        }
 
-       if (data->nsd->tcp_query_count > 0 &&
-               data->query_count >= data->nsd->tcp_query_count) {
+       if ((data->nsd->tcp_query_count > 0 &&
+               data->query_count >= data->nsd->tcp_query_count) ||
+               data->tcp_no_more_queries) {
                /* No more queries allowed on this tcp connection. */
                cleanup_tcp_handler(data);
                return;
@@ -3846,8 +3853,9 @@ handle_tcp_writing(int fd, short event, void* arg)
         * Done sending, wait for the next request to arrive on the
         * TCP socket by installing the TCP read handler.
         */
-       if (data->nsd->tcp_query_count > 0 &&
-               data->query_count >= data->nsd->tcp_query_count) {
+       if ((data->nsd->tcp_query_count > 0 &&
+               data->query_count >= data->nsd->tcp_query_count) ||
+               data->tcp_no_more_queries) {
 
                (void) shutdown(fd, SHUT_WR);
        }
@@ -3971,8 +3979,9 @@ handle_tls_reading(int fd, short event, void* arg)
                return;
        }
 
-       if (data->nsd->tcp_query_count > 0 &&
-           data->query_count >= data->nsd->tcp_query_count) {
+       if ((data->nsd->tcp_query_count > 0 &&
+           data->query_count >= data->nsd->tcp_query_count) ||
+           data->tcp_no_more_queries) {
                /* No more queries allowed on this tcp connection. */
                cleanup_tcp_handler(data);
                return;
@@ -4286,8 +4295,9 @@ handle_tls_writing(int fd, short event, void* arg)
         * Done sending, wait for the next request to arrive on the
         * TCP socket by installing the TCP read handler.
         */
-       if (data->nsd->tcp_query_count > 0 &&
-               data->query_count >= data->nsd->tcp_query_count) {
+       if ((data->nsd->tcp_query_count > 0 &&
+               data->query_count >= data->nsd->tcp_query_count) ||
+               data->tcp_no_more_queries) {
 
                (void) shutdown(fd, SHUT_WR);
        }
@@ -4432,6 +4442,7 @@ handle_tcp_accept(int fd, short event, void* arg)
        memcpy(&tcp_data->query->addr, &addr, addrlen);
        tcp_data->query->addrlen = addrlen;
 
+       tcp_data->tcp_no_more_queries = 0;
        tcp_data->tcp_timeout = data->nsd->tcp_timeout * 1000;
        if (data->nsd->current_tcp_count > data->nsd->maximum_tcp_count/2) {
                /* very busy, give smaller timeout */
diff --git xfrd-tcp.c xfrd-tcp.c
index d00c13b756a..4e3a6a48c28 100644
--- xfrd-tcp.c
+++ xfrd-tcp.c
@@ -607,6 +607,7 @@ xfrd_tcp_setup_write_packet(struct xfrd_tcp_pipeline* tp, 
xfrd_zone_type* zone)
 
                xfrd_setup_packet(tcp->packet, TYPE_AXFR, CLASS_IN, zone->apex,
                        zone->query_id);
+               zone->query_type = TYPE_AXFR;
        } else {
                DEBUG(DEBUG_XFRD,1, (LOG_INFO, "request incremental zone "
                                                "transfer (IXFR) for %s to %s",
@@ -614,6 +615,7 @@ xfrd_tcp_setup_write_packet(struct xfrd_tcp_pipeline* tp, 
xfrd_zone_type* zone)
 
                xfrd_setup_packet(tcp->packet, TYPE_IXFR, CLASS_IN, zone->apex,
                        zone->query_id);
+               zone->query_type = TYPE_IXFR;
                NSCOUNT_SET(tcp->packet, 1);
                xfrd_write_soa_buffer(tcp->packet, zone->apex, &zone->soa_disk);
        }
diff --git xfrd.c xfrd.c
index 65d6d955af6..8d2b1091452 100644
--- xfrd.c
+++ xfrd.c
@@ -1586,6 +1586,7 @@ xfrd_send_ixfr_request_udp(xfrd_zone_type* zone)
        xfrd_setup_packet(xfrd->packet, TYPE_IXFR, CLASS_IN, zone->apex,
                qid_generate());
        zone->query_id = ID(xfrd->packet);
+       zone->query_type = TYPE_IXFR;
        /* delete old xfr file? */
        if(zone->msg_seq_nr)
                xfrd_unlink_xfrfile(xfrd->nsd, zone->xfrfilenumber);
@@ -2093,7 +2094,8 @@ xfrd_handle_received_xfr_packet(xfrd_zone_type* zone, 
buffer_type* packet)
                                        (int)zone->msg_new_serial:0,
                                        zone->master->ip_address_spec));
                        }
-                       if (res == xfrd_packet_notimpl)
+                       if (res == xfrd_packet_notimpl
+                               && zone->query_type == TYPE_IXFR)
                                return res;
                        else
                                return xfrd_packet_bad;
diff --git xfrd.h xfrd.h
index 4890ce0b53f..a3e68ffa135 100644
--- xfrd.h
+++ xfrd.h
@@ -210,6 +210,7 @@ struct xfrd_zone {
        /* xfr message handling data */
        /* query id */
        uint16_t query_id;
+       uint16_t query_type;
        uint32_t msg_seq_nr; /* number of messages already handled */
        uint32_t msg_old_serial, msg_new_serial; /* host byte order */
        size_t msg_rr_count;
diff --git zlexer.lex zlexer.lex
index 14dfbf3c7fd..0e849cd016c 100644
--- zlexer.lex
+++ zlexer.lex
@@ -129,6 +129,7 @@ COMMENT ;
 DOT     \.
 BIT    [^\]\n]|\\.
 ANY     [^\"\n\\]|\\.
+ANYNOSPC [^\"\n\\ \t]|\\.
 
 %x     incl bitlabel quotedstring
 
@@ -304,6 +305,35 @@ ANY     [^\"\n\\]|\\.
 }
 <quotedstring>{ANY}*   { LEXOUT(("STR ")); yymore(); }
 <quotedstring>\n       { ++parser->line; yymore(); }
+<quotedstring>{QUOTE}{ANYNOSPC}{ANYNOSPC}* {
+       /* for strings like "abc"def */
+       char* qt;
+       LEXOUT(("\" "));
+       BEGIN(INITIAL);
+       for(qt=yytext; *qt!=0; qt++) {
+               if(qt[0]=='"') {
+                       /* (unescaped) character is quote */
+                       break;
+               }
+               if(qt[0] == '\\' && qt[1] == '\\') {
+                       /* escaped backslash, skip that backslash */
+                       qt+=1;
+                       continue;
+               }
+               if(qt[0] == '\\' && qt[1] == '"') {
+                       /* escaped quote, skip that quote */
+                       qt+=1;
+                       continue;
+               }
+       }
+       assert(qt);
+       assert(*qt=='"');
+       /* remove middle quote */
+       if(qt[1] != 0)
+               memmove(qt, qt+1, strlen(qt+1));
+       yytext[yyleng - 1] = '\0';
+       return parse_token(STR, yytext, &lexer_state);
+}
 <quotedstring>{QUOTE} {
        LEXOUT(("\" "));
        BEGIN(INITIAL);

-- 
I'm not entirely sure you are real.

Reply via email to