Update release.md

2019-08-29 19:57:45 -04:00
88 changed files with 2243 additions and 3563 deletions
@@ -39,6 +39,9 @@
 - [ ] Update tickets in case of waiting support customers.

 ## Marketing
- - [ ] Post short note to Twitter.
+ - [ ] Update BIND Product page if needed
+ - [ ] Update BIND Significant Features Matrix in KB if needed
+ - [ ] Update BIND -S Edition data sheet if S Edition feature change
+ - [ ] Announce on social media
 - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
 - [ ] Write blog article (if a major release).
@@ -1,13 +1,3 @@
-5283.	[bug]		When a response-policy zone expires, ensure that
-			its policies are removed from the RPZ summary
-			database. [GL #1146]
-
-5282.	[bug]		Fixed a bug in searching for possible wildcard matches
-			for query names in the RPZ summary database. [GL #1146]
-
-5281.	[cleanup]	Don't escape commas when reporting named's command
-			line. [GL #1189]
-
 5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]

 5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
@@ -2633,6 +2633,10 @@ force_timeout(dig_query_t *query) {
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
 				   connect_timeout, query,
 				   sizeof(isc_event_t));
+	if (event == NULL) {
+		fatal("isc_event_allocate: %s",
+		      isc_result_totext(ISC_R_NOMEMORY));
+	}
 	isc_task_send(global_task, &event);

 	/*
@@ -1570,6 +1570,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
 				    sign, NULL, sizeof(sevent_t));
+	if (sevent == NULL)
+		fatal("failed to allocate event\n");

 	sevent->node = node;
 	sevent->fname = fname;
@@ -1625,6 +1627,8 @@ sign(isc_task_t *task, isc_event_t *event) {
 	wevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
 				    writenode, NULL, sizeof(sevent_t));
+	if (wevent == NULL)
+		fatal("failed to allocate event\n");
 	wevent->node = node;
 	wevent->fname = fname;
 	isc_task_send(master, ISC_EVENT_PTR(&wevent));
@@ -23,7 +23,6 @@
 #include <isc/result.h>
 #include <isc/util.h>

-#include <dns/db.h>
 #include <dns/result.h>
 #include <dns/sdb.h>

@@ -32,14 +31,6 @@
 #include <named/server.h>
 #include <named/os.h>

-#define CHECK(op)						\
-	do {							\
-		result = (op);					\
-		if (result != ISC_R_SUCCESS) {			\
-			goto cleanup;				\
-		}						\
-	} while (0)
-
 typedef struct builtin builtin_t;

 static isc_result_t do_version_lookup(dns_sdblookup_t *lookup);
@@ -47,6 +38,7 @@ static isc_result_t do_hostname_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_authors_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_id_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_empty_lookup(dns_sdblookup_t *lookup);
+static isc_result_t do_dns64_lookup(dns_sdblookup_t *lookup);

 /*
 * We can't use function pointers as the db_data directly
@@ -56,23 +48,232 @@ static isc_result_t do_empty_lookup(dns_sdblookup_t *lookup);

 struct builtin {
 	isc_result_t (*do_lookup)(dns_sdblookup_t *lookup);
-	isc_mem_t *mctx;
 	char *server;
 	char *contact;
 };

-static builtin_t version_builtin = { do_version_lookup, NULL, NULL, NULL };
-static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL, NULL };
-static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL, NULL };
-static builtin_t id_builtin = { do_id_lookup, NULL, NULL, NULL };
-static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL, NULL };
+static builtin_t version_builtin = { do_version_lookup,  NULL, NULL };
+static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
+static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
+static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
+static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
+static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };

 static dns_sdbimplementation_t *builtin_impl;
+static dns_sdbimplementation_t *dns64_impl;
+
+/*
+ * Pre computed HEX * 16 or 1 table.
+ */
+static const unsigned char hex16[256] = {
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*00*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,	/*10*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*20*/
+	 0, 16, 32, 48, 64, 80, 96,112,128,144,  1,  1,  1,  1,  1,  1,	/*30*/
+	 1,160,176,192,208,224,240,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*40*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*50*/
+	 1,160,176,192,208,224,240,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*60*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*70*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*80*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*90*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*A0*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*B0*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*C0*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*D0*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*E0*/
+	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1  /*F0*/
+};
+
+const unsigned char decimal[] = "0123456789";
+
+static size_t
+dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
+	size_t i, j = 0;
+
+	for (i = 0; i < 4U; i++) {
+		unsigned char c = v[start++];
+		if (start == 7U)
+			start++;
+		if (c > 99) {
+			rdata[j++] = 3;
+			rdata[j++] = decimal[c/100]; c = c % 100;
+			rdata[j++] = decimal[c/10]; c = c % 10;
+			rdata[j++] = decimal[c];
+		} else if (c > 9) {
+			rdata[j++] = 2;
+			rdata[j++] = decimal[c/10]; c = c % 10;
+			rdata[j++] = decimal[c];
+		} else {
+			rdata[j++] = 1;
+			rdata[j++] = decimal[c];
+		}
+	}
+	memmove(&rdata[j], "\07in-addr\04arpa", 14);
+	return (j + 14);
+}

 static isc_result_t
-builtin_lookup(const char *zone, const char *name,
-	       void *dbdata, dns_sdblookup_t *lookup,
-	       dns_clientinfomethods_t *methods,
+dns64_cname(const dns_name_t *zone, const dns_name_t *name,
+	    dns_sdblookup_t *lookup)
+{
+	size_t zlen, nlen, j, len;
+	unsigned char v[16], n;
+	unsigned int i;
+	unsigned char rdata[sizeof("123.123.123.123.in-addr.arpa.")];
+	unsigned char *ndata;
+
+	/*
+	 * The combined length of the zone and name is 74.
+	 *
+	 * The minimum zone length is 10 ((3)ip6(4)arpa(0)).
+	 *
+	 * The length of name should always be even as we are expecting
+	 * a series of nibbles.
+	 */
+	zlen = zone->length;
+	nlen = name->length;
+	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U)
+		return (ISC_R_NOTFOUND);
+
+	/*
+	 * We assume the zone name is well formed.
+	 */
+
+	/*
+	 * XXXMPA We could check the dns64 suffix here if we need to.
+	 */
+	/*
+	 * Check that name is a series of nibbles.
+	 * Compute the byte values that correspond to the nibbles as we go.
+	 *
+	 * Shift the final result 4 bits, by setting 'i' to 1, if we if we
+	 * have a odd number of nibbles so that "must be zero" tests below
+	 * are byte aligned and we correctly return ISC_R_NOTFOUND or
+	 * ISC_R_SUCCESS.  We will not generate a CNAME in this case.
+	 */
+	ndata = name->ndata;
+	i = (nlen % 4) == 2U ? 1 : 0;
+	j = nlen;
+	memset(v, 0, sizeof(v));
+	while (j != 0U) {
+		INSIST((i/2) < sizeof(v));
+		if (ndata[0] != 1)
+			return (ISC_R_NOTFOUND);
+		n = hex16[ndata[1]&0xff];
+		if (n == 1)
+			return (ISC_R_NOTFOUND);
+		v[i/2] = n | (v[i/2]>>4);
+		j -= 2;
+		ndata += 2;
+		i++;
+	}
+
+	/*
+	 * If we get here then we know name only consisted of nibbles.
+	 * Now we need to determine if the name exists or not and whether
+	 * it corresponds to a empty node in the zone or there should be
+	 * a CNAME.
+	 */
+#define ZLEN(x) (10 + (x)/2)
+	switch (zlen) {
+	case ZLEN(32):	/* prefix len 32 */
+		/*
+		 * The nibbles that map to this byte must be zero for 'name'
+		 * to exist in the zone.
+		 */
+		if (nlen > 16U && v[(nlen-1)/4 - 4] != 0)
+			return (ISC_R_NOTFOUND);
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 8, rdata);
+		break;
+	case ZLEN(40):	/* prefix len 40 */
+		/*
+		 * The nibbles that map to this byte must be zero for 'name'
+		 * to exist in the zone.
+		 */
+		if (nlen > 12U && v[(nlen-1)/4 - 3] != 0)
+			return (ISC_R_NOTFOUND);
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 6, rdata);
+		break;
+	case ZLEN(48):	/* prefix len 48 */
+		/*
+		 * The nibbles that map to this byte must be zero for 'name'
+		 * to exist in the zone.
+		 */
+		if (nlen > 8U && v[(nlen-1)/4 - 2] != 0)
+			return (ISC_R_NOTFOUND);
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 5, rdata);
+		break;
+	case ZLEN(56):	/* prefix len 56 */
+		/*
+		 * The nibbles that map to this byte must be zero for 'name'
+		 * to exist in the zone.
+		 */
+		if (nlen > 4U && v[(nlen-1)/4 - 1] != 0)
+			return (ISC_R_NOTFOUND);
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 4, rdata);
+		break;
+	case ZLEN(64):	/* prefix len 64 */
+		/*
+		 * The nibbles that map to this byte must be zero for 'name'
+		 * to exist in the zone.
+		 */
+		if (v[(nlen-1)/4] != 0)
+			return (ISC_R_NOTFOUND);
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 3, rdata);
+		break;
+	case ZLEN(96):	/* prefix len 96 */
+		/*
+		 * If the total length is not 74 then this is a empty node
+		 * so return success.
+		 */
+		if (nlen + zlen != 74U)
+			return (ISC_R_SUCCESS);
+		len = dns64_rdata(v, 0, rdata);
+		break;
+	default:
+		/*
+		 * This should never be reached unless someone adds a
+		 * zone declaration with this internal type to named.conf.
+		 */
+		return (ISC_R_NOTFOUND);
+	}
+	return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600,
+				 rdata, (unsigned int)len));
+}
+
+static isc_result_t
+builtin_lookup(const char *zone, const char *name, void *dbdata,
+	       dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
 	       dns_clientinfo_t *clientinfo)
 {
 	builtin_t *b = (builtin_t *) dbdata;
@@ -81,20 +282,34 @@ builtin_lookup(const char *zone, const char *name,
 	UNUSED(methods);
 	UNUSED(clientinfo);

-	if (strcmp(name, "@") == 0) {
+	if (strcmp(name, "@") == 0)
 		return (b->do_lookup(lookup));
-	} else {
+	else
 		return (ISC_R_NOTFOUND);
-	}
+}
+
+static isc_result_t
+dns64_lookup(const dns_name_t *zone, const dns_name_t *name, void *dbdata,
+	     dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
+	     dns_clientinfo_t *clientinfo)
+{
+	builtin_t *b = (builtin_t *) dbdata;
+
+	UNUSED(methods);
+	UNUSED(clientinfo);
+
+	if (name->labels == 0 && name->length == 0)
+		return (b->do_lookup(lookup));
+	else
+		return (dns64_cname(zone, name, lookup));
 }

 static isc_result_t
 put_txt(dns_sdblookup_t *lookup, const char *text) {
 	unsigned char buf[256];
 	unsigned int len = strlen(text);
-	if (len > 255) {
+	if (len > 255)
 		len = 255; /* Silently truncate */
-	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
 	return (dns_sdb_putrdata(lookup, dns_rdatatype_txt, 0, buf, len + 1));
@@ -103,11 +318,10 @@ put_txt(dns_sdblookup_t *lookup, const char *text) {
 static isc_result_t
 do_version_lookup(dns_sdblookup_t *lookup) {
 	if (named_g_server->version_set) {
-		if (named_g_server->version == NULL) {
+		if (named_g_server->version == NULL)
 			return (ISC_R_SUCCESS);
-		} else {
+		else
 			return (put_txt(lookup, named_g_server->version));
-		}
 	} else {
 		return (put_txt(lookup, named_g_version));
 	}
@@ -116,17 +330,15 @@ do_version_lookup(dns_sdblookup_t *lookup) {
 static isc_result_t
 do_hostname_lookup(dns_sdblookup_t *lookup) {
 	if (named_g_server->hostname_set) {
-		if (named_g_server->hostname == NULL) {
+		if (named_g_server->hostname == NULL)
 			return (ISC_R_SUCCESS);
-		} else {
+		else
 			return (put_txt(lookup, named_g_server->hostname));
-		}
 	} else {
 		char buf[256];
 		isc_result_t result = named_os_gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			return (result);
-		}
 		return (put_txt(lookup, buf));
 	}
 }
@@ -162,15 +374,13 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
 	/*
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
-	if (named_g_server->version_set) {
+	if (named_g_server->version_set)
 		return (ISC_R_SUCCESS);
-	}

 	for (p = authors; *p != NULL; p++) {
 		result = put_txt(lookup, *p);
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			return (result);
-		}
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -182,19 +392,24 @@ do_id_lookup(dns_sdblookup_t *lookup) {
 		isc_result_t result;

 		result = named_g_server->sctx->gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			return (result);
-		}
 		return (put_txt(lookup, buf));
-	} else if (named_g_server->sctx->server_id != NULL) {
+	} else if (named_g_server->sctx->server_id != NULL)
 		return (put_txt(lookup, named_g_server->sctx->server_id));
-	} else {
+	else
 		return (ISC_R_SUCCESS);
-	}
+}
+
+static isc_result_t
+do_dns64_lookup(dns_sdblookup_t *lookup) {
+	UNUSED(lookup);
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
 do_empty_lookup(dns_sdblookup_t *lookup) {
+
 	UNUSED(lookup);
 	return (ISC_R_SUCCESS);
 }
@@ -213,54 +428,48 @@ builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
 		server = ".";
 		contact = ".";
 	} else {
-		if (b->server != NULL) {
+		if (b->server != NULL)
 			server = b->server;
-		}
-		if (b->contact != NULL) {
+		if (b->contact != NULL)
 			contact = b->contact;
-		}
 	}

 	result = dns_sdb_putsoa(lookup, server, contact, 0);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
-	}

 	result = dns_sdb_putrr(lookup, "ns", 0, server);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
-	}

 	return (ISC_R_SUCCESS);
 }

 static isc_result_t
-builtin_create(const char *zone, isc_mem_t *mctx, int argc, char **argv,
+builtin_create(const char *zone, int argc, char **argv,
 	       void *driverdata, void **dbdata)
 {
 	REQUIRE(argc >= 1);

 	UNUSED(zone);
-	UNUSED(mctx);
 	UNUSED(driverdata);

-	if (strcmp(argv[0], "empty") == 0) {
-		if (argc != 3) {
+	if (strcmp(argv[0], "empty") == 0 || strcmp(argv[0], "dns64") == 0) {
+		if (argc != 3)
 			return (DNS_R_SYNTAX);
-		}
-	} else if (argc != 1) {
+	} else if (argc != 1)
 		return (DNS_R_SYNTAX);
-	}

-	if (strcmp(argv[0], "version") == 0) {
+	if (strcmp(argv[0], "version") == 0)
 		*dbdata = &version_builtin;
-	} else if (strcmp(argv[0], "hostname") == 0) {
+	else if (strcmp(argv[0], "hostname") == 0)
 		*dbdata = &hostname_builtin;
-	} else if (strcmp(argv[0], "authors") == 0) {
+	else if (strcmp(argv[0], "authors") == 0)
 		*dbdata = &authors_builtin;
-	} else if (strcmp(argv[0], "id") == 0) {
+	else if (strcmp(argv[0], "id") == 0)
 		*dbdata = &id_builtin;
-	} else if (strcmp(argv[0], "empty") == 0) {
+	else if (strcmp(argv[0], "empty") == 0 ||
+		 strcmp(argv[0], "dns64") == 0) {
 		builtin_t *empty;
 		char *server;
 		char *contact;
@@ -272,26 +481,30 @@ builtin_create(const char *zone, isc_mem_t *mctx, int argc, char **argv,
 		server = isc_mem_strdup(named_g_mctx, argv[1]);
 		contact = isc_mem_strdup(named_g_mctx, argv[2]);
 		if (empty == NULL || server == NULL || contact == NULL) {
-			*dbdata = &empty_builtin;
-			if (server != NULL) {
+			if (strcmp(argv[0], "empty") == 0)
+				*dbdata = &empty_builtin;
+			else
+				*dbdata = &dns64_builtin;
+			if (server != NULL)
 				isc_mem_free(named_g_mctx, server);
-			}
-			if (contact != NULL) {
+			if (contact != NULL)
 				isc_mem_free(named_g_mctx, contact);
-			}
-			if (empty != NULL) {
+			if (empty != NULL)
 				isc_mem_put(named_g_mctx, empty,
 					    sizeof (*empty));
-			}
 		} else {
-			memmove(empty, &empty_builtin, sizeof (empty_builtin));
+			if (strcmp(argv[0], "empty") == 0)
+				memmove(empty, &empty_builtin,
+					sizeof (empty_builtin));
+			else
+				memmove(empty, &dns64_builtin,
+					sizeof (empty_builtin));
 			empty->server = server;
 			empty->contact = contact;
 			*dbdata = empty;
 		}
-	} else {
+	} else
 		return (ISC_R_NOTIMPLEMENTED);
-	}
 	return (ISC_R_SUCCESS);
 }

@@ -307,10 +520,8 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 	 */
 	if (*dbdata == &version_builtin || *dbdata == &hostname_builtin ||
 	    *dbdata == &authors_builtin || *dbdata == &id_builtin ||
-	    *dbdata == &empty_builtin)
-	{
+	    *dbdata == &empty_builtin || *dbdata == &dns64_builtin)
 		return;
-	}

 	isc_mem_free(named_g_mctx, b->server);
 	isc_mem_free(named_g_mctx, b->contact);
@@ -320,12 +531,21 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 static dns_sdbmethods_t builtin_methods = {
 	builtin_lookup,
 	builtin_authority,
-	NULL,           /* allnodes */
+	NULL,		/* allnodes */
 	builtin_create,
 	builtin_destroy,
 	NULL
 };

+static dns_sdbmethods_t dns64_methods = {
+	NULL,
+	builtin_authority,
+	NULL,		/* allnodes */
+	builtin_create,
+	builtin_destroy,
+	dns64_lookup,
+};
+
 isc_result_t
 named_builtin_init(void) {
 	RUNTIME_CHECK(dns_sdb_register("_builtin", &builtin_methods, NULL,
@@ -333,10 +553,17 @@ named_builtin_init(void) {
 				       DNS_SDBFLAG_RELATIVERDATA,
 				       named_g_mctx, &builtin_impl)
 		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_sdb_register("_dns64", &dns64_methods, NULL,
+				       DNS_SDBFLAG_RELATIVEOWNER |
+				       DNS_SDBFLAG_RELATIVERDATA |
+				       DNS_SDBFLAG_DNS64,
+				       named_g_mctx, &dns64_impl)
+		      == ISC_R_SUCCESS);
 	return (ISC_R_SUCCESS);
 }

 void
 named_builtin_deinit(void) {
 	dns_sdb_unregister(&builtin_impl);
+	dns_sdb_unregister(&dns64_impl);
 }
@@ -161,6 +161,8 @@ EXTERN dns_geoip_databases_t	*named_g_geoip		INIT(NULL);
 EXTERN const char *		named_g_fuzz_addr	INIT(NULL);
 EXTERN isc_fuzztype_t		named_g_fuzz_type	INIT(isc_fuzz_none);

+EXTERN dns_acl_t *		named_g_mapped		INIT(NULL);
+
 #undef EXTERN
 #undef INIT

@@ -352,7 +352,7 @@ save_command_line(int argc, char *argv[]) {
 		*dst++ = ' ';

 		while (*src != '\0' && dst < eob) {
-			if (isalnum(*src) || *src == ',' ||
+			if (isalnum(*src) ||
 			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/')
 			{
@@ -1267,6 +1267,9 @@ static void
 cleanup(void) {
 	destroy_managers();

+	if (named_g_mapped != NULL)
+		dns_acl_detach(&named_g_mapped);
+
 	named_server_destroy(&named_g_server);

 	named_builtin_deinit();
@@ -62,6 +62,7 @@
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
 #include <dns/dnsrps.h>
+#include <dns/dns64.h>
 #include <dns/dyndb.h>
 #include <dns/events.h>
 #include <dns/forward.h>
@@ -85,7 +86,6 @@
 #include <dns/resolver.h>
 #include <dns/rootns.h>
 #include <dns/rriterator.h>
-#include <dns/sdb.h>
 #include <dns/secalg.h>
 #include <dns/soa.h>
 #include <dns/stats.h>
@@ -1848,6 +1848,83 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
 						   zclass, origin));
 }

+static isc_result_t
+dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
+	      unsigned int prefixlen, const char *server,
+	      const char *contact)
+{
+	char reverse[48+sizeof("ip6.arpa.")] = { 0 };
+	char buf[sizeof("x.x.")];
+	const char *dns64_dbtype[4] = { "_dns64", "dns64", ".", "." };
+	const char *sep = ": view ";
+	const char *viewname = view->name;
+	const unsigned char *s6;
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+	dns_zone_t *zone = NULL;
+	int dns64_dbtypec = 4;
+	isc_buffer_t b;
+	isc_result_t result;
+
+	REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
+		prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
+
+	if (!strcmp(viewname, "_default")) {
+		sep = "";
+		viewname = "";
+	}
+
+	/*
+	 * Construct the reverse name of the zone.
+	 */
+	s6 = na->type.in6.s6_addr;
+	while (prefixlen > 0) {
+		prefixlen -= 8;
+		snprintf(buf, sizeof(buf), "%x.%x.", s6[prefixlen/8] & 0xf,
+			 (s6[prefixlen/8] >> 4) & 0xf);
+		strlcat(reverse, buf, sizeof(reverse));
+	}
+	strlcat(reverse, "ip6.arpa.", sizeof(reverse));
+
+	/*
+	 * Create the actual zone.
+	 */
+	if (server != NULL)
+		dns64_dbtype[2] = server;
+	if (contact != NULL)
+		dns64_dbtype[3] = contact;
+	name = dns_fixedname_initname(&fixed);
+	isc_buffer_constinit(&b, reverse, strlen(reverse));
+	isc_buffer_add(&b, strlen(reverse));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_zone_create(&zone, mctx));
+	CHECK(dns_zone_setorigin(zone, name));
+	dns_zone_setview(zone, view);
+	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
+	dns_zone_setclass(zone, view->rdclass);
+	dns_zone_settype(zone, dns_zone_master);
+	dns_zone_setstats(zone, named_g_server->zonestats);
+	dns_zone_setdbtype(zone, dns64_dbtypec, dns64_dbtype);
+	if (view->queryacl != NULL)
+		dns_zone_setqueryacl(zone, view->queryacl);
+	if (view->queryonacl != NULL)
+		dns_zone_setqueryonacl(zone, view->queryonacl);
+	dns_zone_setdialup(zone, dns_dialuptype_no);
+	dns_zone_setnotifytype(zone, dns_notifytype_no);
+	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
+	CHECK(setquerystats(zone, mctx, dns_zonestat_none));	/* XXXMPA */
+	CHECK(dns_view_addzone(view, zone));
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "dns64 reverse zone%s%s: %s", sep,
+		      viewname, reverse);
+
+cleanup:
+	if (zone != NULL)
+		dns_zone_detach(&zone);
+	return (result);
+}
+
 #ifdef USE_DNSRPS
 typedef struct conf_dnsrps_ctx conf_dnsrps_ctx_t;
 struct conf_dnsrps_ctx {
@@ -2750,6 +2827,8 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	event = (catz_chgzone_event_t *) isc_event_allocate(view->mctx, origin,
 							    type, action, NULL,
 							    sizeof(*event));
+	if (event == NULL)
+		return (ISC_R_NOMEMORY);

 	event->cbd = (catz_cb_data_t *) udata;
 	event->entry = NULL;
@@ -3618,6 +3697,26 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 }
 #endif /* HAVE_DNSTAP */

+static isc_result_t
+create_mapped_acl(void) {
+	isc_result_t result;
+	dns_acl_t *acl = NULL;
+	struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
+	isc_netaddr_t addr;
+
+	isc_netaddr_fromin6(&addr, &in6);
+
+	result = dns_acl_create(named_g_mctx, 1, &acl);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96, true);
+	if (result == ISC_R_SUCCESS)
+		dns_acl_attach(acl, &named_g_mapped);
+	dns_acl_detach(&acl);
+	return (result);
+}
+
 #ifdef HAVE_DLOPEN
 /*%
 * A callback for the cfg_pluginlist_foreach() call in configure_view() below.
@@ -3721,6 +3820,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	bool auto_root = false;
 	named_cache_t *nsc;
 	bool zero_no_soattl;
+	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
 	unsigned int query_timeout, ndisp;
 	bool old_rpz_ok = false;
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
@@ -3757,11 +3857,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		cfgmaps[k++] = config;
 	cfgmaps[k] = NULL;

-	/*
-	 * Set the view's zone manager.
-	 */
-	dns_view_setzonemgr(view, named_g_server->zonemgr);
-
 	/*
 	 * Set the view's port number for outgoing queries.
 	 */
@@ -3984,6 +4079,115 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	zero_no_soattl = cfg_obj_asboolean(obj);

+	obj = NULL;
+	result = named_config_get(maps, "dns64", &obj);
+	if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") &&
+	    strcmp(view->name, "_meta")) {
+		isc_netaddr_t na, suffix, *sp;
+		unsigned int prefixlen;
+		const char *server, *contact;
+		const cfg_obj_t *myobj;
+
+		myobj = NULL;
+		result = named_config_get(maps, "dns64-server", &myobj);
+		if (result == ISC_R_SUCCESS)
+			server = cfg_obj_asstring(myobj);
+		else
+			server = NULL;
+
+		myobj = NULL;
+		result = named_config_get(maps, "dns64-contact", &myobj);
+		if (result == ISC_R_SUCCESS)
+			contact = cfg_obj_asstring(myobj);
+		else
+			contact = NULL;
+
+		for (element = cfg_list_first(obj);
+		     element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_obj_t *map = cfg_listelt_value(element);
+			dns_dns64_t *dns64 = NULL;
+			unsigned int dns64options = 0;
+
+			cfg_obj_asnetprefix(cfg_map_getname(map), &na,
+					    &prefixlen);
+
+			obj = NULL;
+			(void)cfg_map_get(map, "suffix", &obj);
+			if (obj != NULL) {
+				sp = &suffix;
+				isc_netaddr_fromsockaddr(sp,
+						      cfg_obj_assockaddr(obj));
+			} else
+				sp = NULL;
+
+			clients = mapped = excluded = NULL;
+			obj = NULL;
+			(void)cfg_map_get(map, "clients", &obj);
+			if (obj != NULL) {
+				result = cfg_acl_fromconfig(obj, config,
+							    named_g_lctx, actx,
+							    mctx, 0, &clients);
+				if (result != ISC_R_SUCCESS)
+					goto cleanup;
+			}
+			obj = NULL;
+			(void)cfg_map_get(map, "mapped", &obj);
+			if (obj != NULL) {
+				result = cfg_acl_fromconfig(obj, config,
+							    named_g_lctx, actx,
+							    mctx, 0, &mapped);
+				if (result != ISC_R_SUCCESS)
+					goto cleanup;
+			}
+			obj = NULL;
+			(void)cfg_map_get(map, "exclude", &obj);
+			if (obj != NULL) {
+				result = cfg_acl_fromconfig(obj, config,
+							    named_g_lctx, actx,
+							    mctx, 0, &excluded);
+				if (result != ISC_R_SUCCESS)
+					goto cleanup;
+			} else {
+				if (named_g_mapped == NULL) {
+					result = create_mapped_acl();
+					if (result != ISC_R_SUCCESS)
+						goto cleanup;
+				}
+				dns_acl_attach(named_g_mapped, &excluded);
+			}
+
+			obj = NULL;
+			(void)cfg_map_get(map, "recursive-only", &obj);
+			if (obj != NULL && cfg_obj_asboolean(obj))
+				dns64options |= DNS_DNS64_RECURSIVE_ONLY;
+
+			obj = NULL;
+			(void)cfg_map_get(map, "break-dnssec", &obj);
+			if (obj != NULL && cfg_obj_asboolean(obj))
+				dns64options |= DNS_DNS64_BREAK_DNSSEC;
+
+			result = dns_dns64_create(mctx, &na, prefixlen, sp,
+						  clients, mapped, excluded,
+						  dns64options, &dns64);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+			dns_dns64_append(&view->dns64, dns64);
+			view->dns64cnt++;
+			result = dns64_reverse(view, mctx, &na, prefixlen,
+					       server, contact);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+			if (clients != NULL)
+				dns_acl_detach(&clients);
+			if (mapped != NULL)
+				dns_acl_detach(&mapped);
+			if (excluded != NULL)
+				dns_acl_detach(&excluded);
+		}
+	}
+
 	obj = NULL;
 	result = named_config_get(maps, "dnssec-accept-expired", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4198,9 +4402,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * XXXRTH  Hardwired number of tasks.
 	 */
 	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4, &dscp4,
-				    (ISC_LIST_PREV(view, link) == NULL)));
+					    (ISC_LIST_PREV(view, link) == NULL)));
 	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6, &dscp6,
-				    (ISC_LIST_PREV(view, link) == NULL)));
+					    (ISC_LIST_PREV(view, link) == NULL)));
 	if (dispatch4 == NULL && dispatch6 == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "unable to obtain neither an IPv4 nor"
@@ -5321,6 +5525,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
 	}
+	if (clients != NULL) {
+		dns_acl_detach(&clients);
+	}
+	if (mapped != NULL) {
+		dns_acl_detach(&mapped);
+	}
+	if (excluded != NULL) {
+		dns_acl_detach(&excluded);
+	}
 	if (ring != NULL) {
 		dns_tsigkeyring_detach(&ring);
 	}
@@ -13352,6 +13565,8 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	dns_zone_attach(zone, &dz->zone);
 	dzevent = isc_event_allocate(named_g_mctx, server, NAMED_EVENT_DELZONE,
 				     rmzone, dz, sizeof(isc_event_t));
+	if (dzevent == NULL)
+		CHECK(ISC_R_NOMEMORY);

 	dns_zone_gettask(zone, &task);
 	isc_task_send(task, &dzevent);
@@ -24,32 +24,24 @@ NSLIBS =	../../lib/ns/libns.@A@

 LIBS =

-SO_TARGETS =	lib/dns64.@SO@ lib/filter-aaaa.@SO@
-SO_INSTALL =	dns64.@SO@ filter-aaaa.@SO@
+SO_TARGETS =	lib/filter-aaaa.@SO@
+SO_INSTALL =	filter-aaaa.@SO@
 TARGETS =	@SO_TARGETS@

-SO_OBJS =	dns64.@O@ filter-aaaa.@O@
-SO_SRCS =	dns64.c filter-aaaa.c
+SO_OBJS =	filter-aaaa.@O@
+SO_SRCS =	filter-aaaa.c

 CFLAGS =	@CFLAGS@ @SO_CFLAGS@
 SO_LDFLAGS =	@LDFLAGS@ @SO_LDFLAGS@

-MANPAGES =	dns64.8 filter-aaaa.8
+MANPAGES =	filter-aaaa.8

-HTMLPAGES =	dns64.html filter-aaaa.html
+HTMLPAGES =	filter-aaaa.html

 MANOBJS =	${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

-lib/dns64.@SO@: dns64.@SO@
-	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
-	${LIBTOOL_MODE_INSTALL} ${INSTALL} dns64.@SO@ `pwd`/lib
-
-dns64.@SO@: dns64.@O@
-	${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ \
-		dns64.@O@ ${LIBS}
-
 lib/filter-aaaa.@SO@: filter-aaaa.@SO@
 	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
 	${LIBTOOL_MODE_INSTALL} ${INSTALL} filter-aaaa.@SO@ `pwd`/lib
@@ -64,7 +56,7 @@ docclean manclean maintainer-clean::
 	rm -f ${MANOBJS}

 clean distclean::
-	rm -f dns64.@SO@ filter-aaaa.@SO@
+	rm -f filter-aaaa.so
 	rm -f ${TARGETS} ${OBJS}

 installdirs:
@@ -81,10 +73,7 @@ install:: @SO_TARGETS@ installdirs
 		fi \
 	done
 	${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/dns64.8 ${DESTDIR}${mandir}/man8

 uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${plugindir}/dns64.@SO@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${plugindir}/filter-aaaa.@SO@
-	rm -f ${DESTDIR}${mandir}/man8/dns64.8
 	rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8
@@ -1,144 +0,0 @@
-.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
-.hy 0
-.ad l
-'\" t
-.\"     Title: dns64.so
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 2018-11-30
-.\"    Manual: BIND9
-.\"    Source: ISC
-.\"  Language: English
-.\"
-.TH "DNS64\&.SO" "8" "2018\-11\-30" "ISC" "BIND9"
-.\" -----------------------------------------------------------------
-.\" * Define some portability stuff
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" http://bugs.debian.org/507673
-.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-dns64.so \- perform DNS64 synthesis
-.SH "SYNOPSIS"
-.HP 24
-\fBplugin query "dns64\&.so"\fR [\fI{\ parameters\ }\fR];
-.SH "DESCRIPTION"
-.PP
-\fBdns64\&.so\fR
-is a query plugin module for
-\fBnamed\fR, enabling
-\fBnamed\fR
-to perform DNS64 address synthesis\&.
-.PP
-Until BIND 9\&.12, this feature was implemented natively in
-\fBnamed\fR
-and enabled with the
-\fBdns64\fR
-option\&. This option is now deprecated in
-named\&.conf, but can be passed as parameters to the
-\fBdns64\&.so\fR
-plugin, for example:
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-	acl rfc1918 { 10/8; 192\&.168/16; 172\&.16/12; };
-	plugin query "/usr/local/lib/dns64\&.so" {
-		dns64 64:FF9B::/96 {
-			clients { any; };
-			mapped { !rfc1918; any; };
-			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
-			suffix ::;
-		};
-		dns64\-server "dns64\&.example\&.net\&.";
-		dns64\-contact "hostmaster\&.example\&.net\&.";
-	};
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-This plugin enables
-\fBnamed\fR
-to return mapped IPv4 addresses to AAAA queries when there are no AAAA records\&. It is intended to be used in conjunction with NAT64\&.
-.PP
-Each
-\fBdns64\fR
-option defined in the plugin parameters defines one DNS64 prefix\&. Multiple DNS64 prefixes can be defined\&.
-.PP
-Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, 64 and 96 as per RFC 6052\&.
-.PP
-Additionally a reverse IP6\&.ARPA zone will be created for the prefix to provide a mapping from the IP6\&.ARPA names to the corresponding IN\-ADDR\&.ARPA names using synthesized CNAMEs\&.
-\fBdns64\-server\fR
-and
-\fBdns64\-contact\fR
-can be used to specify the name of the server and contact for the zones\&. These are not settable on a per\-prefix basis\&.
-.PP
-Each
-\fBdns64\fR
-supports an optional
-\fBclients\fR
-ACL that determines which clients are affected by this directive\&. If not defined, it defaults to
-\fBany;\fR\&.
-.PP
-Each
-\fBdns64\fR
-supports an optional
-\fBmapped\fR
-ACL that selects which IPv4 addresses are to be mapped in the corresponding A RRset\&. If not defined it defaults to
-\fBany;\fR\&.
-.PP
-Normally, DNS64 won\*(Aqt apply to a domain name that owns one or more AAAA records; these records will simply be returned\&. The optional
-\fBexclude\fR
-ACL allows specification of a list of IPv6 addresses that will be ignored if they appear in a domain name\*(Aqs AAAA records, and DNS64 will be applied to any A records the domain name owns\&. If not defined,
-\fBexclude\fR
-defaults to ::ffff:0\&.0\&.0\&.0/96\&.
-.PP
-A optional
-\fBsuffix\fR
-can also be defined to set the bits trailing the mapped IPv4 address bits\&. By default these bits are set to
-\fB::\fR\&. The bits matching the prefix and mapped IPv4 address must be zero\&.
-.PP
-If
-\fBrecursive\-only\fR
-is set to
-\fByes\fR
-the DNS64 synthesis will only happen for recursive queries\&. The default is
-\fBno\fR\&.
-.PP
-If
-\fBbreak\-dnssec\fR
-is set to
-\fByes\fR
-the DNS64 synthesis will happen even if the result, if validated, would cause a DNSSEC validation failure\&. If this option is set to
-\fBno\fR
-(the default), the DO is set on the incoming query, and there are RRSIGs on the applicable records, then synthesis will not happen\&.
-.SH "SEE ALSO"
-.PP
-BIND 9 Administrator Reference Manual\&.
-.SH "AUTHOR"
-.PP
-\fBInternet Systems Consortium, Inc\&.\fR
-.SH "COPYRIGHT"
-.br
-Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
-.br
@@ -1,154 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
-->
-
-<!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dns64">
-  <info>
-    <date>2018-11-30</date>
-  </info>
-  <refentryinfo>
-    <corpname>ISC</corpname>
-    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
-  </refentryinfo>
-  <refmeta>
-    <refentrytitle><application>dns64.so</application></refentrytitle>
-    <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>dns64.so</application></refname>
-    <refpurpose>perform DNS64 synthesis</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2019</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis sepchar=" ">
-      <command>plugin query "dns64.so"</command>
-      <arg choice="opt" rep="norepeat"><replaceable class="parameter">{ parameters }</replaceable></arg>;
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsection><info><title>DESCRIPTION</title></info>
-    <para>
-      <command>dns64.so</command> is a query plugin module for
-      <command>named</command>, enabling <command>named</command>
-      to perform DNS64 address synthesis.
-    </para>
-    <para>
-      Until BIND 9.12, this feature was implemented natively in
-      <command>named</command> and enabled with the
-      <command>dns64</command> option.
-      This option is now deprecated in <filename>named.conf</filename>,
-      but can be passed as parameters to the
-      <command>dns64.so</command> plugin, for example:
-    </para>
-    <programlisting>
-	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-
-	plugin query "/usr/local/lib/dns64.so" {
-		dns64 64:FF9B::/96 {
-			clients { any; };
-			mapped { !rfc1918; any; };
-			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
-			suffix ::;
-		};
-
-		dns64-server "dns64.example.net.";
-		dns64-contact "hostmaster.example.net.";
-	};
-</programlisting>
-    <para>
-      This plugin enables <command>named</command> to
-      return mapped IPv4 addresses to AAAA queries when
-      there are no AAAA records.  It is intended to be
-      used in conjunction with NAT64.
-    </para>
-    <para>
-      Each <command>dns64</command> option defined in the plugin
-      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
-      can be defined.
-    </para>
-    <para>
-      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
-      64 and 96 as per RFC 6052.
-    </para>
-    <para>
-      Additionally a reverse IP6.ARPA zone will be created for
-      the prefix to provide a mapping from the IP6.ARPA names
-      to the corresponding IN-ADDR.ARPA names using synthesized
-      CNAMEs.  <command>dns64-server</command> and
-      <command>dns64-contact</command> can be used to specify
-      the name of the server and contact for the zones.
-      These are not settable on a per-prefix basis.
-    </para>
-    <para>
-      Each <command>dns64</command> supports an optional
-      <command>clients</command> ACL that determines which
-      clients are affected by this directive.  If not defined,
-      it defaults to <userinput>any;</userinput>.
-    </para>
-    <para>
-      Each <command>dns64</command> supports an optional
-      <command>mapped</command> ACL that selects which
-      IPv4 addresses are to be mapped in the corresponding
-      A RRset.  If not defined it defaults to
-      <userinput>any;</userinput>.
-    </para>
-    <para>
-      Normally, DNS64 won't apply to a domain name that
-      owns one or more AAAA records; these records will
-      simply be returned.  The optional
-      <command>exclude</command> ACL allows specification
-      of a list of IPv6 addresses that will be ignored
-      if they appear in a domain name's AAAA records, and
-      DNS64 will be applied to any A records the domain
-      name owns.  If not defined, <command>exclude</command>
-      defaults to ::ffff:0.0.0.0/96.
-    </para>
-    <para>
-      A optional <command>suffix</command> can also
-      be defined to set the bits trailing the mapped
-      IPv4 address bits.  By default these bits are
-      set to <userinput>::</userinput>.  The bits
-      matching the prefix and mapped IPv4 address
-      must be zero.
-    </para>
-    <para>
-      If <command>recursive-only</command> is set to
-      <command>yes</command> the DNS64 synthesis will
-      only happen for recursive queries.  The default
-      is <command>no</command>.
-    </para>
-    <para>
-      If <command>break-dnssec</command> is set to
-      <command>yes</command> the DNS64 synthesis will
-      happen even if the result, if validated, would
-      cause a DNSSEC validation failure.  If this option
-      is set to <command>no</command> (the default), the DO
-      is set on the incoming query, and there are RRSIGs on
-      the applicable records, then synthesis will not happen.
-    </para>
-  </refsection>
-
-  <refsection><info><title>SEE ALSO</title></info>
-    <para>
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
-    </para>
-  </refsection>
-
-</refentry>
@@ -1,135 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>dns64.so</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="man.dns64"></a><div class="titlepage"></div>
-<div class="refnamediv">
-<h2>Name</h2>
-<p><span class="application">dns64.so</span> &#8212; perform DNS64 synthesis</p>
-</div>
-<div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">plugin query "dns64.so"</code>  [<em class="replaceable"><code>{ parameters }</code></em>];
-    </p></div>
-</div>
-<div class="refsection">
-<a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p>
-      <span class="command"><strong>dns64.so</strong></span> is a query plugin module for
-      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
-      to perform DNS64 address synthesis.
-    </p>
-<p>
-      Until BIND 9.12, this feature was implemented natively in
-      <span class="command"><strong>named</strong></span> and enabled with the
-      <span class="command"><strong>dns64</strong></span> option.
-      This option is now deprecated in <code class="filename">named.conf</code>,
-      but can be passed as parameters to the
-      <span class="command"><strong>dns64.so</strong></span> plugin, for example:
-    </p>
-<pre class="programlisting">
-	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-
-	plugin query "/usr/local/lib/dns64.so" {
-		dns64 64:FF9B::/96 {
-			clients { any; };
-			mapped { !rfc1918; any; };
-			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
-			suffix ::;
-		};
-
-		dns64-server "dns64.example.net.";
-		dns64-contact "hostmaster.example.net.";
-	};
-</pre>
-<p>
-      This plugin enables <span class="command"><strong>named</strong></span> to
-      return mapped IPv4 addresses to AAAA queries when
-      there are no AAAA records.  It is intended to be
-      used in conjunction with NAT64.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> option defined in the plugin
-      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
-      can be defined.
-    </p>
-<p>
-      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
-      64 and 96 as per RFC 6052.
-    </p>
-<p>
-      Additionally a reverse IP6.ARPA zone will be created for
-      the prefix to provide a mapping from the IP6.ARPA names
-      to the corresponding IN-ADDR.ARPA names using synthesized
-      CNAMEs.  <span class="command"><strong>dns64-server</strong></span> and
-      <span class="command"><strong>dns64-contact</strong></span> can be used to specify
-      the name of the server and contact for the zones.
-      These are not settable on a per-prefix basis.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> supports an optional
-      <span class="command"><strong>clients</strong></span> ACL that determines which
-      clients are affected by this directive.  If not defined,
-      it defaults to <strong class="userinput"><code>any;</code></strong>.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> supports an optional
-      <span class="command"><strong>mapped</strong></span> ACL that selects which
-      IPv4 addresses are to be mapped in the corresponding
-      A RRset.  If not defined it defaults to
-      <strong class="userinput"><code>any;</code></strong>.
-    </p>
-<p>
-      Normally, DNS64 won't apply to a domain name that
-      owns one or more AAAA records; these records will
-      simply be returned.  The optional
-      <span class="command"><strong>exclude</strong></span> ACL allows specification
-      of a list of IPv6 addresses that will be ignored
-      if they appear in a domain name's AAAA records, and
-      DNS64 will be applied to any A records the domain
-      name owns.  If not defined, <span class="command"><strong>exclude</strong></span>
-      defaults to ::ffff:0.0.0.0/96.
-    </p>
-<p>
-      A optional <span class="command"><strong>suffix</strong></span> can also
-      be defined to set the bits trailing the mapped
-      IPv4 address bits.  By default these bits are
-      set to <strong class="userinput"><code>::</code></strong>.  The bits
-      matching the prefix and mapped IPv4 address
-      must be zero.
-    </p>
-<p>
-      If <span class="command"><strong>recursive-only</strong></span> is set to
-      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
-      only happen for recursive queries.  The default
-      is <span class="command"><strong>no</strong></span>.
-    </p>
-<p>
-      If <span class="command"><strong>break-dnssec</strong></span> is set to
-      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
-      happen even if the result, if validated, would
-      cause a DNSSEC validation failure.  If this option
-      is set to <span class="command"><strong>no</strong></span> (the default), the DO
-      is set on the incoming query, and there are RRSIGs on
-      the applicable records, then synthesis will not happen.
-    </p>
-</div>
-<div class="refsection">
-<a name="id-1.8"></a><h2>SEE ALSO</h2>
-<p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
-    </p>
-</div>
-</div></body>
-</html>
@@ -76,6 +76,7 @@ typedef struct filter_data {
 } filter_data_t;

 typedef struct filter_instance {
+	ns_plugin_t *module;
 	isc_mem_t *mctx;

 	/*
@@ -167,7 +168,7 @@ install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 		.action_data = inst,
 	};

-	ns_hook_add(hooktable, mctx,
+	ns_hook_add(hooktable, mctx, -
 		    NS_QUERY_QCTX_INITIALIZED, &filter_init);
 	ns_hook_add(hooktable, mctx,
 		    NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
@@ -352,7 +353,7 @@ isc_result_t
 plugin_register(const char *parameters,
 		const void *cfg, const char *cfg_file, unsigned long cfg_line,
 		isc_mem_t *mctx, isc_log_t *lctx, void *actx,
-		dns_view_t *view, void **instp)
+		ns_hooktable_t *hooktable, void **instp)
 {
 	filter_instance_t *inst = NULL;
 	isc_result_t result;
@@ -396,7 +397,7 @@ plugin_register(const char *parameters,
 	/*
 	 * Set hook points in the view's hooktable.
 	 */
-	install_hooks(view->hooktable, mctx, inst);
+	install_hooks(hooktable, mctx, inst);

 	*instp = inst;

@@ -837,6 +838,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		result = ns_query_done(qctx);

 		*resp = result;
+
 		return (NS_HOOK_RETURN);
 	}

@@ -425,7 +425,6 @@ $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -433,7 +432,6 @@ $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo_i "check that a static root key generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -441,7 +439,6 @@ grep "static-key entry for the root zone WILL FAIL" checkconf.out$n > /dev/null
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo_i "check that a trusted-keys entry for root generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -449,7 +446,6 @@ grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/nul
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo_i "check that using dnssec-keys and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
@@ -457,7 +453,6 @@ grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 ::/0 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 ::/96 { suffix ::1; };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 ::/96 { suffix 127.0.0.1; };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 ::/129 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 ::/129 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 :: { };
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 FC36:EAFE:F993::/64 {
 		exclude { bogusacl; };
 	};
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 FC36:EAFE:F993::/64 {
 		clients { bogusacl; };
 	};
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	dns64 FC36:EAFE:F993::/64 {
 		mapped { bogusacl; };
 	};
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		mapped { !rfc1918; any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-plugin query "../../../plugins/lib/dns64.so" {
+options {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 { };
 };
@@ -24,9 +24,7 @@ options {
 	allow-recursion { 10.53.0.1; };
 	notify yes;
 	dnssec-validation yes;
-};

-plugin query "../../../../plugins/lib/dns64.so" {
 	dns64 2001:bbbb::/96 {
 		clients { any; };
 		mapped { !rfc1918; any; };
@@ -24,10 +24,7 @@ options {
 	recursion yes;
 	notify yes;
 	dnssec-validation yes;
-	response-policy { zone "rpz"; };
-};

-plugin query "../../../../plugins/lib/dns64.so" {
 	dns64 2001:aaaa::/96 {
 		clients { 10.53.0.2; };
 		mapped { !rfc1918; any; };
@@ -57,6 +54,8 @@ plugin query "../../../../plugins/lib/dns64.so" {
 	dns64 2001:64::/64 { clients { 10.53.0.6; }; };

 	dns64 2001:96::/96 { clients { 10.53.0.7; }; };
+
+	response-policy { zone "rpz"; };
 };

 zone "." {
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 86400      ; 1 day
-@               SOA	example. noc.example. (
-                                1         ; serial
-                                86400      ; refresh (1 day)
-                                3600       ; retry (1 hour)
-                                2592000    ; expire (4 weeks 2 days)
-                                25200      ; minimum (7 hours)
-                                )
-                        NS      @
-                        IN A    10.53.0.3
-
-a		A	1.2.3.4
-noa		TXT	there is no A record here
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS3
-
-controls { /* empty */ };
-
-acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify yes;
-	dnssec-enable yes;
-	dnssec-validation yes;
-	response-policy { zone "rpz"; };
-};
-
-plugin query "../../../../plugins/lib/dns64.so" {
-	dns64 2001:aaaa::/96 {
-		clients { none; };
-		mapped { !rfc1918; any; };
-		exclude { 2001:eeee::/32; 64:FF9B::/96; ::ffff:0000:0000/96; };
-		suffix ::;
-	};
-
-	dns64-server "dns64.example.net.";
-	dns64-contact "hostmaster.example.net.";
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-zone "rpz" {
-	type master;
-	file "rpz.db";
-};
-
-zone "example" {
-	type master;
-	file "example.db";
-};
@@ -1,21 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 86400      ; 1 day
-@               SOA	rpz. noc.rpz. (
-                                1         ; serial
-                                86400      ; refresh (1 day)
-                                3600       ; retry (1 hour)
-                                2592000    ; expire (4 weeks 2 days)
-                                25200      ; minimum (7 hours)
-                                )
-                        NS      @
-                        IN A    10.53.0.3
-a.example 	CNAME	a.example.
-noa.example 	CNAME	noa.example.
@@ -1,21 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 86400      ; 1 day
-@               SOA	example. noc.example. (
-                                1         ; serial
-                                86400      ; refresh (1 day)
-                                3600       ; retry (1 hour)
-                                2592000    ; expire (4 weeks 2 days)
-                                25200      ; minimum (7 hours)
-                                )
-                        NS      @
-                        IN A    10.53.0.4
-
-a-only		A	1.2.3.4
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS4
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	dnssec-enable yes;
-	dnssec-validation yes;
-};
-
-view us {
-	match-clients { 10.53.0.1; };
-	recursion yes;
-
-	plugin query "../../../../plugins/lib/dns64.so" {
-		dns64 2001:cccc::/96 {
-			clients { any; };
-		};
-	};
-
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-};
-
-view them {
-	recursion no;
-
-	plugin query "../../../../plugins/lib/dns64.so" {
-		dns64 2001:dddd::/96 {
-			clients { any; };
-		};
-	};
-
-	zone "example" {
-		type master;
-		file "example.db";
-	};
-};
@@ -16,7 +16,5 @@ $SHELL clean.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns4/named.conf.in ns4/named.conf

 cd ns1 && $SHELL sign.sh
@@ -21,22 +21,22 @@ DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"

 for conf in conf/good*.conf
 do
-	n=`expr $n + 1`
-	echo_i "checking that $conf is accepted ($n)"
-	ret=0
-	$CHECKCONF "$conf" || ret=1
-	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+        echo_i "checking that $conf is accepted ($n)"
+        ret=0
+        $CHECKCONF "$conf" || ret=1
+        n=`expr $n + 1`
+        if [ $ret != 0 ]; then echo_i "failed"; fi
+        status=`expr $status + $ret`
 done

 for conf in conf/bad*.conf
 do
+        echo_i "checking that $conf is rejected ($n)"
+        ret=0
+        $CHECKCONF "$conf" >/dev/null && ret=1
 	n=`expr $n + 1`
-	echo_i "checking that $conf is rejected ($n)"
-	ret=0
-	$CHECKCONF "$conf" >/dev/null && ret=1
-	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+        if [ $ret != 0 ]; then echo_i "failed"; fi
+        status=`expr $status + $ret`
 done

 # Check the example. domain
@@ -1400,34 +1400,5 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-echo_i "checking dns64 client resume after rpz match with A ($n)"
-ret=0
-$DIG $DIGOPTS aaaa a.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking dns64 client resume after rpz match without A ($n)"
-ret=0
-$DIG $DIGOPTS aaaa noa.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking dns64 configured in separate views($n)"
-ret=0
-# recursive view
-$DIG $DIGOPTS aaaa a-only.example +rec @10.53.0.4 -b 10.53.0.1 > dig.out.ns4.test$n.1 || ret=1
-grep "flags:.* ra;" dig.out.ns4.test$n.1 > /dev/null || ret=1
-grep "2001:cccc::102:305" dig.out.ns4.test$n.1 > /dev/null || ret=1
-$DIG $DIGOPTS aaaa a-only.example +rec @10.53.0.4 -b 10.53.0.2 > dig.out.ns4.test$n.2 || ret=1
-grep "flags:.* rd;" dig.out.ns4.test$n.2 > /dev/null || ret=1
-grep "2001:dddd::102:304" dig.out.ns4.test$n.2 > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -213,6 +213,10 @@ syncptr(sample_instance_t *inst, dns_name_t *name,
 						      SYNCPTR_WRITE_EVENT,
 						      syncptr_write, NULL,
 						      sizeof(syncptrevent_t));
+	if (pevent == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	isc_buffer_init(&pevent->b, pevent->buf, sizeof(pevent->buf));
 	dns_fixedname_init(&pevent->ptr_target_name);

@@ -20,6 +20,11 @@ options {
 	recursion yes;
 	dnssec-validation no;
 	notify yes;
+	dns64 64:ff9b::/96 {
+			    clients { any; };
+			    exclude { any; };
+			    mapped { any; };
+	};
 	minimal-responses no;
 };

@@ -28,14 +33,6 @@ plugin query "../../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa { any; };
 };

-plugin query "../../../../plugins/lib/dns64.so" {
-	dns64 64:ff9b::/96 {
-		clients { any; };
-		exclude { any; };
-		mapped { any; };
-	};
-};
-
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;
@@ -795,12 +795,5 @@ grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "check logged command line ($n)"
-ret=0
-grep "running as: .* -m record,size,mctx " ns1/named.run > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -29,9 +29,9 @@ fi
 # remove those files first, then decide whether to remove the others.
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
-rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
+rm -f ns3/bl*.db ns*/empty.db
 rm -f ns3/manual-update-rpz.db
-rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
+rm -f ns5/example.db ns5/bl.db
 rm -f ns8/manual-update-rpz.db
 rm -f */policy2.db
 rm -f */*.jnl
@@ -28,11 +28,8 @@ options {
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;
-	min-refresh-time 1;
-	min-retry-time 1;

 	response-policy {
-	    zone "fast-expire";
 	    zone "bl"					max-policy-ttl 100;
 	    zone "bl-2";
 	    zone "bl-given"	policy given		recursive-only yes;
@@ -113,10 +110,3 @@ zone "manual-update-rpz." {
 	file "manual-update-rpz.db";
 	notify no;
 };
-
-zone "fast-expire." {
-	type secondary;
-	file "fast-expire.db";
-	masters { 10.53.0.5; };
-	notify no;
-};
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "fast-expire." {
-	type master;
-	file "fast-expire.db";
-	allow-transfer { any; };
-	notify no;
-};
@@ -1,16 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@					SOA	fast-expire. hostmaster (
-						1 3 1 5 60
-						)
-					NS	ns.tld3.
-
-expired.fast-expire.		        A	10.0.0.10
@@ -86,5 +86,3 @@ zone "policy2" {
 	allow-update { any; };
 	allow-transfer { any; };
 };
-
-include "expire.conf";
@@ -74,10 +74,6 @@ done
 cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
 cp ns8/manual-update-rpz.db.in ns8/manual-update-rpz.db

-# a zone that expires quickly and then can't be refreshed
-cp ns5/fast-expire.db.in ns5/fast-expire.db
-cp ns5/expire.conf.in ns5/expire.conf
-
 # $1=directory
 # $2=domain name
 # $3=input zone file
@@ -759,11 +759,6 @@ EOF
    done
  fi

-  # reconfigure the ns5 master server without the fast-exire zone, so
-  # it can't be refreshed on ns3, and will expire in 5 seconds.
-  cat /dev/null > ns5/expire.conf
-  rndc_reconfig ns5 10.53.0.5
-
  # restart the main test RPZ server to see if that creates a core file
  if test -z "$HAVE_CORE"; then
    $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
@@ -859,12 +854,6 @@ EOF
    echo_i "checking rpz with delegation fails correctly (${t})"
    $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
    grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
-
-    t=`expr $t + 1`
-    echo_i "checking policies from expired zone are no longer in effect ($t)"
-    $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
-    grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
-    grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed"
  fi

  # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 senarios.
@@ -1,33 +0,0 @@
-@@
-statement S;
-expression V;
-@@
-
-V = isc_event_allocate(...);
- if (V == NULL) S
-
-@@
-type T;
-statement S;
-expression V;
-@@
-
-V = (T *)isc_event_allocate(...);
- if (V == NULL) S
-
-@@
-statement S;
-expression V;
-@@
-
-if (V == NULL) V = isc_event_allocate(...);
- if (V == NULL) S
-
-@@
-statement S1, S2;
-expression V;
-@@
-
-V = isc_event_allocate(...);
- if (V == NULL) S1 else { S2 }
-+ S2
@@ -18106,7 +18106,6 @@ allow-query { !{ !10/8; any; }; key example; };
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dnssec/dnssec-verify.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/dnstap-read.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/plugins/filter-aaaa.docbook"/>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/plugins/dns64.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dig/host.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/mdig.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkconf.docbook"/>
@@ -1,173 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2000-2018 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>dns64.so</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
-<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
-<link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
-<link rel="prev" href="man.filter-aaaa.html" title="filter-aaaa.so">
-<link rel="next" href="man.host.html" title="host">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
-<div class="navheader">
-<table width="100%" summary="Navigation header">
-<tr><th colspan="3" align="center"><span class="application">dns64.so</span></th></tr>
-<tr>
-<td width="20%" align="left">
-<a accesskey="p" href="man.filter-aaaa.html">Prev</a> </td>
-<th width="60%" align="center">Manual pages</th>
-<td width="20%" align="right"> <a accesskey="n" href="man.host.html">Next</a>
-</td>
-</tr>
-</table>
-<hr>
-</div>
-<div class="refentry">
-<a name="man.dns64"></a><div class="titlepage"></div>
-<div class="refnamediv">
-<h2>Name</h2>
-<p><span class="application">dns64.so</span> &#8212; perform DNS64 synthesis</p>
-</div>
-<div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">hook query "dns64.so"</code>  [<em class="replaceable"><code>{ parameters }</code></em>];
-    </p></div>
-</div>
-<div class="refsection">
-<a name="id-1.13.20.7"></a><h2>DESCRIPTION</h2>
-<p>
-      <span class="command"><strong>dns64.so</strong></span> is a query hook module for
-      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
-      to perform DNS64 address synthesis.
-    </p>
-<p>
-      Until BIND 9.12, this feature was implemented natively in
-      <span class="command"><strong>named</strong></span> and enabled with the
-      <span class="command"><strong>dns64</strong></span> option.
-      This option is now deprecated in <code class="filename">named.conf</code>,
-      but can be passed as parameters to the
-      <span class="command"><strong>dns64.so</strong></span> module, for example:
-    </p>
-<pre class="programlisting">
-	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-
-	plugin query "/usr/local/lib/dns64.so" {
-		dns64 64:FF9B::/96 {
-			clients { any; };
-			mapped { !rfc1918; any; };
-			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
-			suffix ::;
-		};
-
-		dns64-server "dns64.example.net.";
-		dns64-contact "hostmaster.example.net.";
-	};
-</pre>
-<p>
-      This plugin enables <span class="command"><strong>named</strong></span> to
-      return mapped IPv4 addresses to AAAA queries when
-      there are no AAAA records.  It is intended to be
-      used in conjunction with NAT64.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> option defined in the plugin
-      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
-      can be defined.
-    </p>
-<p>
-      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
-      64 and 96 as per RFC 6052.
-    </p>
-<p>
-      Additionally a reverse IP6.ARPA zone will be created for
-      the prefix to provide a mapping from the IP6.ARPA names
-      to the corresponding IN-ADDR.ARPA names using synthesized
-      CNAMEs.  <span class="command"><strong>dns64-server</strong></span> and
-      <span class="command"><strong>dns64-contact</strong></span> can be used to specify
-      the name of the server and contact for the zones.
-      These are not settable on a per-prefix basis.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> supports an optional
-      <span class="command"><strong>clients</strong></span> ACL that determines which
-      clients are affected by this directive.  If not defined,
-      it defaults to <strong class="userinput"><code>any;</code></strong>.
-    </p>
-<p>
-      Each <span class="command"><strong>dns64</strong></span> supports an optional
-      <span class="command"><strong>mapped</strong></span> ACL that selects which
-      IPv4 addresses are to be mapped in the corresponding
-      A RRset.  If not defined it defaults to
-      <strong class="userinput"><code>any;</code></strong>.
-    </p>
-<p>
-      Normally, DNS64 won't apply to a domain name that
-      owns one or more AAAA records; these records will
-      simply be returned.  The optional
-      <span class="command"><strong>exclude</strong></span> ACL allows specification
-      of a list of IPv6 addresses that will be ignored
-      if they appear in a domain name's AAAA records, and
-      DNS64 will be applied to any A records the domain
-      name owns.  If not defined, <span class="command"><strong>exclude</strong></span>
-      defaults to ::ffff:0.0.0.0/96.
-    </p>
-<p>
-      A optional <span class="command"><strong>suffix</strong></span> can also
-      be defined to set the bits trailing the mapped
-      IPv4 address bits.  By default these bits are
-      set to <strong class="userinput"><code>::</code></strong>.  The bits
-      matching the prefix and mapped IPv4 address
-      must be zero.
-    </p>
-<p>
-      If <span class="command"><strong>recursive-only</strong></span> is set to
-      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
-      only happen for recursive queries.  The default
-      is <span class="command"><strong>no</strong></span>.
-    </p>
-<p>
-      If <span class="command"><strong>break-dnssec</strong></span> is set to
-      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
-      happen even if the result, if validated, would
-      cause a DNSSEC validation failure.  If this option
-      is set to <span class="command"><strong>no</strong></span> (the default), the DO
-      is set on the incoming query, and there are RRSIGs on
-      the applicable records, then synthesis will not happen.
-    </p>
-</div>
-<div class="refsection">
-<a name="id-1.13.20.8"></a><h2>SEE ALSO</h2>
-<p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
-    </p>
-</div>
-</div>
-<div class="navfooter">
-<hr>
-<table width="100%" summary="Navigation footer">
-<tr>
-<td width="40%" align="left">
-<a accesskey="p" href="man.filter-aaaa.html">Prev</a> </td>
-<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch12.html">Up</a></td>
-<td width="40%" align="right"> <a accesskey="n" href="man.host.html">Next</a>
-</td>
-</tr>
-<tr>
-<td width="40%" align="left" valign="top">
-<span class="application">filter-aaaa.so</span> </td>
-<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> host</td>
-</tr>
-</table>
-</div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
-</body>
-</html>
@@ -394,13 +394,6 @@
 	  when run with <command>+expandaaaa +short</command>. [GL #1152]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  When a <command>response-policy</command> zone expires, ensure
-	  that its policies are removed from the RPZ summary database.
-	  [GL #1146]
-	</para>
-      </listitem>
    </itemizedlist>
  </section>

@@ -26,16 +26,15 @@
    in the future.
  </para>
  <para>
-    The only plugins currently included in BIND are
-    <filename>filter-aaaa.so</filename> and <filename>dns64.so</filename>,
-    which replace the <command>filter-aaaa</command> and
-    <command>dns64</command> features that previously existed natively
+    The only plugin currently included in BIND is
+    <filename>filter-aaaa.so</filename>, which replaces the
+    <command>filter-aaaa</command> feature that previously existed natively
    as part of <command>named</command>.
-    The code for these features has been removed from <command>named</command>,
-    and they can no longer be configured using standard
+    The code for this feature has been removed from <command>named</command>,
+    and can no longer be configured using standard
    <filename>named.conf</filename> syntax, but linking in the
-    <filename>filter-aaaa.so</filename> or <filename>dns64.so</filename>
-    plugins provides identical functionality.
+    <filename>filter-aaaa.so</filename> plugin provides identical
+    functionality.
  </para>

  <section><info><title>Configuring Plugins</title></info>
@@ -477,6 +477,112 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 	return (result);
 }

+static const unsigned char zeros[16];
+
+static isc_result_t
+check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
+	    const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	const cfg_obj_t *dns64 = NULL;
+	const cfg_obj_t *options;
+	const cfg_listelt_t *element;
+	const cfg_obj_t *map, *obj;
+	isc_netaddr_t na, sa;
+	unsigned int prefixlen;
+	int nbytes;
+	int i;
+
+	static const char *acls[] = { "clients", "exclude", "mapped", NULL};
+
+	if (voptions != NULL)
+		cfg_map_get(voptions, "dns64", &dns64);
+	if (config != NULL && dns64 == NULL) {
+		options = NULL;
+		cfg_map_get(config, "options", &options);
+		if (options != NULL)
+			cfg_map_get(options, "dns64", &dns64);
+	}
+	if (dns64 == NULL)
+		return (ISC_R_SUCCESS);
+
+	for (element = cfg_list_first(dns64);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		map = cfg_listelt_value(element);
+		obj = cfg_map_getname(map);
+
+		cfg_obj_asnetprefix(obj, &na, &prefixlen);
+		if (na.family != AF_INET6) {
+			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
+				    "dns64 requires a IPv6 prefix");
+			result = ISC_R_FAILURE;
+			continue;
+		}
+
+		if (na.type.in6.s6_addr[8] != 0) {
+			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
+				 "invalid prefix, bits [64..71] must be zero");
+			result = ISC_R_FAILURE;
+			continue;
+		}
+
+		if (prefixlen != 32 && prefixlen != 40 && prefixlen != 48 &&
+		    prefixlen != 56 && prefixlen != 64 && prefixlen != 96) {
+			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
+				    "bad prefix length %u [32/40/48/56/64/96]",
+				    prefixlen);
+			result = ISC_R_FAILURE;
+			continue;
+		}
+
+		for (i = 0; acls[i] != NULL; i++) {
+			obj = NULL;
+			(void)cfg_map_get(map, acls[i], &obj);
+			if (obj != NULL) {
+				dns_acl_t *acl = NULL;
+				isc_result_t tresult;
+
+				tresult = cfg_acl_fromconfig(obj, config,
+							     logctx, actx,
+							     mctx, 0, &acl);
+				if (acl != NULL)
+					dns_acl_detach(&acl);
+				if (tresult != ISC_R_SUCCESS)
+					result = tresult;
+			}
+		}
+
+		obj = NULL;
+		(void)cfg_map_get(map, "suffix", &obj);
+		if (obj != NULL) {
+			isc_netaddr_fromsockaddr(&sa, cfg_obj_assockaddr(obj));
+			if (sa.family != AF_INET6) {
+				cfg_obj_log(map, logctx, ISC_LOG_ERROR,
+					    "dns64 requires a IPv6 suffix");
+				result = ISC_R_FAILURE;
+				continue;
+			}
+			nbytes = prefixlen / 8 + 4;
+			if (prefixlen <= 64)
+				nbytes++;
+			if (memcmp(sa.type.in6.s6_addr, zeros, nbytes) != 0) {
+				char netaddrbuf[ISC_NETADDR_FORMATSIZE];
+				isc_netaddr_format(&sa, netaddrbuf,
+						   sizeof(netaddrbuf));
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "bad suffix '%s' leading "
+					    "%u octets not zeros",
+					    netaddrbuf, nbytes);
+				result = ISC_R_FAILURE;
+			}
+		}
+	}
+
+	return (result);
+}
+
 #define CHECK_RRL(cond, pat, val1, val2)				\
 	do {								\
 		if (!(cond)) {						\
@@ -774,6 +880,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,

 	static const char *server_contact[] = {
 		"empty-server", "empty-contact",
+		"dns64-server", "dns64-contact",
 		NULL
 	};

@@ -3738,6 +3845,11 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		result = tresult;
 	}

+	tresult = check_dns64(actx, voptions, config, logctx, mctx);
+	if (tresult != ISC_R_SUCCESS) {
+		result = tresult;
+	}
+
 	tresult = check_ratelimit(actx, voptions, config, logctx, mctx);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
@@ -62,7 +62,7 @@ DNSTAPOBJS = dnstap.@O@ dnstap.pb-c.@O@
 DNSOBJS =	acl.@O@ adb.@O@ badcache.@O@ byaddr.@O@ \
 		cache.@O@ callbacks.@O@ catz.@O@ clientinfo.@O@ compress.@O@ \
 		db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \
-		dlz.@O@ dnsrps.@O@ dnssec.@O@ ds.@O@ dyndb.@O@ \
+		dlz.@O@ dns64.@O@ dnsrps.@O@ dnssec.@O@ ds.@O@ dyndb.@O@ \
 		ecs.@O@ fixedname.@O@ forward.@O@ \
 		ipkeylist.@O@ iptable.@O@ journal.@O@ keydata.@O@ \
 		keytable.@O@ lib.@O@ log.@O@ lookup.@O@ \
@@ -99,7 +99,7 @@ DNSTAPSRCS = dnstap.c dnstap.pb-c.c
 DNSSRCS =	acl.c adb.c badcache. byaddr.c \
 		cache.c callbacks.c clientinfo.c compress.c \
 		db.c dbiterator.c dbtable.c diff.c dispatch.c \
-		dlz.c dnsrps.c dnssec.c ds.c dyndb.c \
+		dlz.c dns64.c dnsrps.c dnssec.c ds.c dyndb.c \
 		ecs.c fixedname.c forward.c \
 		ipkeylist.c iptable.c journal.c keydata.c keytable.c lib.c \
 		log.c lookup.c master.c masterdump.c message.c \
@@ -556,12 +556,20 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 					   DNS_EVENT_CACHECLEAN,
 					   incremental_cleaning_action,
 					   cleaner, sizeof(isc_event_t));
+		if (cleaner->resched_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}

 		cleaner->overmem_event =
 			isc_event_allocate(cache->mctx, cleaner,
 					   DNS_EVENT_CACHEOVERMEM,
 					   overmem_cleaning_action,
 					   cleaner, sizeof(isc_event_t));
+		if (cleaner->overmem_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
 	}

 	return (ISC_R_SUCCESS);
@@ -1342,6 +1342,10 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	event = (dns_clientresevent_t *)
 		isc_event_allocate(mctx, tclone, DNS_EVENT_CLIENTRESDONE,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	event->result = DNS_R_SERVFAIL;
 	ISC_LIST_INIT(event->answerlist);

@@ -1729,6 +1733,10 @@ dns_client_startrequest(dns_client_t *client, dns_message_t *qmessage,
 		isc_event_allocate(client->mctx, tclone,
 				   DNS_EVENT_CLIENTREQDONE,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}

 	ctx = isc_mem_get(client->mctx, sizeof(*ctx));
 	if (ctx == NULL)
@@ -2839,6 +2847,8 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 	uctx->event = (dns_clientupdateevent_t *)
 		isc_event_allocate(client->mctx, tclone, DNS_EVENT_UPDATEDONE,
 				   action, arg, sizeof(*uctx->event));
+	if (uctx->event == NULL)
+		goto fail;
 	if (zonename != NULL) {
 		uctx->zonename = dns_fixedname_name(&uctx->zonefname);
 		result = dns_name_copy(zonename, uctx->zonename, NULL);
@@ -2914,8 +2924,11 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 		event = isc_event_allocate(client->mctx, dns_client_startupdate,
 					   DNS_EVENT_STARTUPDATE, startupdate,
 					   uctx, sizeof(*event));
-		result = ISC_R_SUCCESS;
-		isc_task_send(task, &event);
+		if (event != NULL) {
+			result = ISC_R_SUCCESS;
+			isc_task_send(task, &event);
+		} else
+			result = ISC_R_NOMEMORY;
 	}
 	if (result == ISC_R_SUCCESS)
 		return (result);
@@ -2444,6 +2444,10 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 					    DNS_EVENT_DISPATCHCONTROL,
 					    destroy_disp, disp,
 					    sizeof(isc_event_t));
+	if (disp->ctlevent == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto kill_task;
+	}

 	isc_task_setname(disp->task[0], "tcpdispatch", disp);

@@ -2481,6 +2485,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,

 	return (ISC_R_SUCCESS);

+	/*
+	 * Error returns.
+	 */
+ kill_task:
+	isc_task_detach(&disp->task[0]);
 kill_socket:
 	isc_socket_detach(&disp->socket);
 deallocate_dispatch:
@@ -2888,6 +2897,10 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 					    DNS_EVENT_DISPATCHCONTROL,
 					    destroy_disp, disp,
 					    sizeof(isc_event_t));
+	if (disp->ctlevent == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto kill_task;
+	}

 	disp->sepool = NULL;
 	if (isc_mempool_create(mgr->mctx, sizeof(isc_socketevent_t),
@@ -2929,6 +2942,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	 */
 kill_ctlevent:
 	isc_event_free(&disp->ctlevent);
+ kill_task:
 	for (i = 0; i < disp->ntasks; i++) {
 		isc_task_detach(&disp->task[i]);
 	}
@@ -3540,6 +3554,8 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 		    isc_event_allocate(disp->mgr->mctx, NULL,
 				      DNS_EVENT_IMPORTRECVDONE, udp_shrecv,
 				      disp, sizeof(isc_socketevent_t));
+	if (newsevent == NULL)
+		return;

 	buf = allocate_udp_buffer(disp);
 	if (buf == NULL) {
@@ -0,0 +1,293 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+
+#include <isc/list.h>
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/acl.h>
+#include <dns/dns64.h>
+#include <dns/rdata.h>
+#include <dns/rdataset.h>
+#include <dns/result.h>
+#include <string.h>
+
+struct dns_dns64 {
+	unsigned char		bits[16];	/*
+						 * Prefix + suffix bits.
+						 */
+	dns_acl_t *		clients;	/*
+						 * Which clients get mapped
+						 * addresses.
+						 */
+	dns_acl_t *		mapped;		/*
+						 * IPv4 addresses to be mapped.
+						 */
+	dns_acl_t *		excluded;	/*
+						 * IPv6 addresses that are
+						 * treated as not existing.
+						 */
+	unsigned int		prefixlen;	/*
+						 * Start of mapped address.
+						 */
+	unsigned int		flags;
+	isc_mem_t *		mctx;
+	ISC_LINK(dns_dns64_t)	link;
+};
+
+isc_result_t
+dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
+		 unsigned int prefixlen, const isc_netaddr_t *suffix,
+		 dns_acl_t *clients, dns_acl_t *mapped, dns_acl_t *excluded,
+		 unsigned int flags, dns_dns64_t **dns64p)
+{
+	dns_dns64_t *dns64;
+	unsigned int nbytes = 16;
+
+	REQUIRE(prefix != NULL && prefix->family == AF_INET6);
+	/* Legal prefix lengths from rfc6052.txt. */
+	REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
+		prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
+	REQUIRE(isc_netaddr_prefixok(prefix, prefixlen) == ISC_R_SUCCESS);
+	REQUIRE(dns64p != NULL && *dns64p == NULL);
+
+	if (suffix != NULL) {
+		static const unsigned char zeros[16];
+		REQUIRE(prefix->family == AF_INET6);
+		nbytes = prefixlen / 8 + 4;
+		/* Bits 64-71 are zeros. rfc6052.txt */
+		if (prefixlen >= 32 && prefixlen <= 64)
+			nbytes++;
+		REQUIRE(memcmp(suffix->type.in6.s6_addr, zeros, nbytes) == 0);
+	}
+
+	dns64 = isc_mem_get(mctx, sizeof(dns_dns64_t));
+	memset(dns64->bits, 0, sizeof(dns64->bits));
+	memmove(dns64->bits, prefix->type.in6.s6_addr, prefixlen / 8);
+	if (suffix != NULL)
+		memmove(dns64->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
+			16 - nbytes);
+	dns64->clients = NULL;
+	if (clients != NULL)
+		dns_acl_attach(clients, &dns64->clients);
+	dns64->mapped = NULL;
+	if (mapped != NULL)
+		dns_acl_attach(mapped, &dns64->mapped);
+	dns64->excluded = NULL;
+	if (excluded != NULL)
+		dns_acl_attach(excluded, &dns64->excluded);
+	dns64->prefixlen = prefixlen;
+	dns64->flags = flags;
+	ISC_LINK_INIT(dns64, link);
+	dns64->mctx = NULL;
+	isc_mem_attach(mctx, &dns64->mctx);
+	*dns64p = dns64;
+	return (ISC_R_SUCCESS);
+}
+
+void
+dns_dns64_destroy(dns_dns64_t **dns64p) {
+	dns_dns64_t *dns64;
+
+	REQUIRE(dns64p != NULL && *dns64p != NULL);
+
+	dns64 = *dns64p;
+	*dns64p = NULL;
+
+	REQUIRE(!ISC_LINK_LINKED(dns64, link));
+
+	if (dns64->clients != NULL)
+		dns_acl_detach(&dns64->clients);
+	if (dns64->mapped != NULL)
+		dns_acl_detach(&dns64->mapped);
+	if (dns64->excluded != NULL)
+		dns_acl_detach(&dns64->excluded);
+	isc_mem_putanddetach(&dns64->mctx, dns64, sizeof(*dns64));
+}
+
+isc_result_t
+dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
+		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		    unsigned int flags, unsigned char *a, unsigned char *aaaa)
+{
+	unsigned int nbytes, i;
+	isc_result_t result;
+	int match;
+
+	if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
+	    (flags & DNS_DNS64_RECURSIVE) == 0)
+		return (DNS_R_DISALLOWED);
+
+	if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
+	    (flags & DNS_DNS64_DNSSEC) != 0)
+		return (DNS_R_DISALLOWED);
+
+	if (dns64->clients != NULL) {
+		result = dns_acl_match(reqaddr, reqsigner, dns64->clients,
+				       env, &match, NULL);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		if (match <= 0)
+			return (DNS_R_DISALLOWED);
+	}
+
+	if (dns64->mapped != NULL) {
+		struct in_addr ina;
+		isc_netaddr_t netaddr;
+
+		memmove(&ina.s_addr, a, 4);
+		isc_netaddr_fromin(&netaddr, &ina);
+		result = dns_acl_match(&netaddr, NULL, dns64->mapped,
+				       env, &match, NULL);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		if (match <= 0)
+			return (DNS_R_DISALLOWED);
+	}
+
+	nbytes = dns64->prefixlen / 8;
+	INSIST(nbytes <= 12);
+	/* Copy prefix. */
+	memmove(aaaa, dns64->bits, nbytes);
+	/* Bits 64-71 are zeros. rfc6052.txt */
+	if (nbytes == 8)
+		aaaa[nbytes++] = 0;
+	/* Copy mapped address. */
+	for (i = 0; i < 4U; i++) {
+		aaaa[nbytes++] = a[i];
+		/* Bits 64-71 are zeros. rfc6052.txt */
+		if (nbytes == 8)
+			aaaa[nbytes++] = 0;
+	}
+	/* Copy suffix. */
+	memmove(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
+	return (ISC_R_SUCCESS);
+}
+
+dns_dns64_t *
+dns_dns64_next(dns_dns64_t *dns64) {
+	dns64 = ISC_LIST_NEXT(dns64, link);
+	return (dns64);
+}
+
+void
+dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64) {
+	ISC_LIST_APPEND(*list, dns64, link);
+}
+
+void
+dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64) {
+	ISC_LIST_UNLINK(*list, dns64, link);
+}
+
+bool
+dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
+		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		 unsigned int flags, dns_rdataset_t *rdataset,
+		 bool *aaaaok, size_t aaaaoklen)
+{
+	struct in6_addr in6;
+	isc_netaddr_t netaddr;
+	isc_result_t result;
+	int match;
+	bool answer = false;
+	bool found = false;
+	unsigned int i, ok;
+
+	REQUIRE(rdataset != NULL);
+	REQUIRE(rdataset->type == dns_rdatatype_aaaa);
+	REQUIRE(rdataset->rdclass == dns_rdataclass_in);
+	if (aaaaok != NULL)
+		REQUIRE(aaaaoklen == dns_rdataset_count(rdataset));
+
+	for (;dns64 != NULL; dns64 = ISC_LIST_NEXT(dns64, link)) {
+		if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
+		    (flags & DNS_DNS64_RECURSIVE) == 0)
+			continue;
+
+		if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
+		    (flags & DNS_DNS64_DNSSEC) != 0)
+			continue;
+		/*
+		 * Work out if this dns64 structure applies to this client.
+		 */
+		if (dns64->clients != NULL) {
+			result = dns_acl_match(reqaddr, reqsigner,
+					       dns64->clients, env,
+					       &match, NULL);
+			if (result != ISC_R_SUCCESS)
+				continue;
+			if (match <= 0)
+				continue;
+		}
+
+		if (!found && aaaaok != NULL) {
+			for (i = 0; i < aaaaoklen; i++)
+				aaaaok[i] = false;
+		}
+		found = true;
+
+		/*
+		 * If we are not excluding any addresses then any AAAA
+		 * will do.
+		 */
+		if (dns64->excluded == NULL) {
+			answer = true;
+			if (aaaaok == NULL)
+				goto done;
+			for (i = 0; i < aaaaoklen; i++)
+				aaaaok[i] = true;
+			goto done;
+		}
+
+		i = 0; ok = 0;
+		for (result = dns_rdataset_first(rdataset);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdataset_next(rdataset)) {
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			if (aaaaok == NULL || !aaaaok[i]) {
+
+				dns_rdataset_current(rdataset, &rdata);
+				memmove(&in6.s6_addr, rdata.data, 16);
+				isc_netaddr_fromin6(&netaddr, &in6);
+
+				result = dns_acl_match(&netaddr, NULL,
+						       dns64->excluded, env,
+						       &match, NULL);
+				if (result == ISC_R_SUCCESS && match <= 0) {
+					answer = true;
+					if (aaaaok == NULL)
+						goto done;
+					aaaaok[i] = true;
+					ok++;
+				}
+			} else
+				ok++;
+			i++;
+		}
+		/*
+		 * Are all addresses ok?
+		 */
+		if (aaaaok != NULL && ok == aaaaoklen)
+			goto done;
+	}
+
+ done:
+	if (!found && aaaaok != NULL) {
+		for (i = 0; i < aaaaoklen; i++)
+			aaaaok[i] = true;
+	}
+	return (found ? answer : true);
+}
@@ -807,6 +807,9 @@ check_file_size_and_maybe_reopen(dns_dtenv_t *env) {
 	 */
 	event = isc_event_allocate(env->mctx, NULL, DNS_EVENT_FREESTORAGE,
 				   perform_reopen, env, sizeof(*event));
+	if (event == NULL) {
+		goto unlock_and_return;
+	}
 	isc_task_attach(env->reopen_task, &reopen_task);
 	isc_task_send(reopen_task, &event);
 	env->reopen_queued = true;
@@ -17,7 +17,7 @@ HEADERS =	acl.h adb.h badcache.h bit.h byaddr.h \
 		cache.h callbacks.h catz.h cert.h \
 		client.h clientinfo.h compress.h \
 		db.h dbiterator.h dbtable.h diff.h dispatch.h \
-		dlz.h dlz_dlopen.h dnsrps.h dnssec.h ds.h dsdigest.h \
+		dlz.h dlz_dlopen.h dns64.h dnsrps.h dnssec.h ds.h dsdigest.h \
 		dnstap.h dyndb.h ecs.h \
 		edns.h ecdb.h events.h fixedname.h forward.h geoip.h \
 		ipkeylist.h iptable.h \
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+#ifndef DNS_DNS64_H
+#define DNS_DNS64_H 1
+
+#include <stdbool.h>
+
+#include <isc/lang.h>
+
+#include <dns/types.h>
+
+ISC_LANG_BEGINDECLS
+
+/*
+ * dns_dns64_create() flags.
+ */
+#define DNS_DNS64_RECURSIVE_ONLY	0x01	/* If set then this record
+						 * only applies to recursive
+						 * queries.
+						 */
+#define DNS_DNS64_BREAK_DNSSEC		0x02	/* If set then still perform
+						 * DNSSEC synthesis even
+						 * though the result would
+						 * fail validation.
+						 */
+
+/*
+ * dns_dns64_aaaaok() and dns_dns64_aaaafroma() flags.
+ */
+#define DNS_DNS64_RECURSIVE		0x01	/* Recursive query. */
+#define DNS_DNS64_DNSSEC		0x02	/* DNSSEC sensitive query. */
+
+isc_result_t
+dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
+		 unsigned int prefixlen, const isc_netaddr_t *suffix,
+		 dns_acl_t *client, dns_acl_t *mapped, dns_acl_t *excluded,
+		 unsigned int flags, dns_dns64_t **dns64);
+/*
+ * Create a dns64 record which is used to identify the set of clients
+ * it applies to and how to perform the DNS64 synthesis.
+ *
+ * 'prefix' and 'prefixlen' defined the leading bits of the AAAA records
+ * to be synthesised.  'suffix' defines the bits after the A records bits.
+ * If suffix is NULL zeros will be used for these bits.  'client' defines
+ * for which clients this record applies.  If 'client' is NULL then all
+ * clients apply.  'mapped' defines which A records are candidated for
+ * mapping.  If 'mapped' is NULL then all A records will be mapped.
+ * 'excluded' defines which AAAA are to be treated as non-existent for the
+ * purposed of determining whether to perform syntesis.  If 'excluded' is
+ * NULL then no AAAA records prevent synthesis.
+ *
+ * If DNS_DNS64_RECURSIVE_ONLY is set then the record will only match if
+ * DNS_DNS64_RECURSIVE is set when calling  dns_dns64_aaaaok() and
+ * dns_dns64_aaaafroma().
+ *
+ * If DNS_DNS64_BREAK_DNSSEC is set then the record will still apply if
+ * DNS_DNS64_DNSSEC is set when calling  dns_dns64_aaaaok() and
+ * dns_dns64_aaaafroma() otherwise the record will be ignored.
+ *
+ * Requires:
+ *      'mctx'          to be valid.
+ *      'prefix'        to be valid and the address family to AF_INET6.
+ *      'prefixlen'     to be one of 32, 40, 48, 56, 72 and 96.
+ *                      the bits not covered by prefixlen in prefix to
+ *                      be zero.
+ *      'suffix'        to be NULL or the address family be set to AF_INET6
+ *                      and the leading 'prefixlen' + 32 bits of the 'suffix'
+ *                      to be zero.  If 'prefixlen' is 40, 48 or 56 then the
+ *                      the leading 'prefixlen' + 40 bits of 'suffix' must be
+ *                      zero.
+ *	'client'	to be NULL or a valid acl.
+ *	'mapped'	to be NULL or a valid acl.
+ *	'excluded'	to be NULL or a valid acl.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ */
+
+void
+dns_dns64_destroy(dns_dns64_t **dns64p);
+/*
+ * Destroys a dns64 record.
+ *
+ * Requires the record to not be linked.
+ */
+
+isc_result_t
+dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
+		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		    unsigned int flags, unsigned char *a, unsigned char *aaaa);
+/*
+ * dns_dns64_aaaafroma() determines whether to perform a DNS64 address
+ * synthesis from 'a' based on 'dns64', 'reqaddr', 'reqsigner', 'env',
+ * 'flags' and 'aaaa'.  If synthesis is performed then the result is
+ * written to '*aaaa'.
+ *
+ * The synthesised address will be of the form:
+ *
+ *	 <prefix bits><a bits><suffix bits>
+ *
+ * If <a bits> straddle bits 64-71 of the AAAA record, then 8 zero bits will
+ * be inserted at bits 64-71.
+ *
+ * Requires:
+ *	'dns64'		to be valid.
+ *	'reqaddr'	to be valid.
+ *	'reqsigner'	to be NULL or valid.
+ *	'env'		to be valid.
+ *	'a'		to point to a IPv4 address in network order.
+ *	'aaaa'		to point to a IPv6 address buffer in network order.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS		if synthesis was performed.
+ *	DNS_R_DISALLOWED	if there is no match.
+ */
+
+dns_dns64_t *
+dns_dns64_next(dns_dns64_t *dns64);
+/*
+ * Return the next dns64 record in the list.
+ */
+
+void
+dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64);
+/*
+ * Append the dns64 record to the list.
+ */
+
+void
+dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64);
+/*
+ * Unlink the dns64 record from the list.
+ */
+
+bool
+dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
+		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		 unsigned int flags, dns_rdataset_t *rdataset,
+		 bool *aaaaok, size_t aaaaoklen);
+/*
+ * Determine if there are any non-excluded AAAA records in from the
+ * matching dns64 records in the list starting at 'dns64'.  If there
+ * is a non-exluded address return true.  If all addresses are
+ * excluded in the matched records return false.   If no records
+ * match then return true.
+ *
+ * If aaaaok is defined then dns_dns64_aaaaok() return a array of which
+ * addresses in 'rdataset' were deemed to not be exclude by any matching
+ * record.  If there are no matching records then all entries are set
+ * to true.
+ *
+ * Requires
+ * 	'rdataset'	to be valid and to be for type AAAA and class IN.
+ *	'aaaaoklen'	must match the number of records in 'rdataset'
+ *			if 'aaaaok' in non NULL.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* DNS_DNS64_H */
@@ -71,8 +71,7 @@ typedef isc_result_t
 			 dns_sdballnodes_t *allnodes);

 typedef isc_result_t
-(*dns_sdbcreatefunc_t)(const char *zone, isc_mem_t *mctx,
-		       int argc, char **argv,
+(*dns_sdbcreatefunc_t)(const char *zone, int argc, char **argv,
 		       void *driverdata, void **dbdata);

 typedef void
@@ -99,13 +98,6 @@ ISC_LANG_BEGINDECLS
 #define DNS_SDBFLAG_THREADSAFE 0x00000004U
 #define DNS_SDBFLAG_DNS64 0x00000008U

-typedef isc_result_t
-(*dns_sdbregister_t)(const char *drivername, const dns_sdbmethods_t *methods,
-		     void *driverdata, unsigned int flags, isc_mem_t *mctx,
-		     dns_sdbimplementation_t **sdbimp);
-typedef void
-(*dns_sdbunregister_t)(dns_sdbimplementation_t **sdbimp);
-
 isc_result_t
 dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
 		 void *driverdata, unsigned int flags, isc_mem_t *mctx,
@@ -176,6 +176,8 @@ struct dns_view {
 	uint16_t			padding;
 	dns_acl_t *			pad_acl;
 	unsigned int			maxbits;
+	dns_dns64list_t 		dns64;
+	unsigned int 			dns64cnt;
 	dns_rpz_zones_t			*rpzs;
 	dns_catz_zones_t		*catzs;
 	dns_dlzdblist_t 		dlz_searched;
@@ -231,8 +233,6 @@ struct dns_view {
 	dns_dtmsgtype_t			dttypes;	/* Dnstap message types
 							   to log */

-	dns_zonemgr_t			*zonemgr;
-
 	/* Registered module instances */
 	void				*plugins;
 	void				(*plugins_free)(isc_mem_t *, void **);
@@ -1360,14 +1360,6 @@ dns_view_setviewrevert(dns_view_t *view);
 *\li	'view' to be valid.
 */

-void
-dns_view_setzonemgr(dns_view_t *view, dns_zonemgr_t *zonemgr);
-/*%<
- * Set the view's zone manager.
- *
- * Requires:
- *\li	'view' to be valid.
- */

 ISC_LANG_ENDDECLS

@@ -377,6 +377,10 @@ dns_lookup_create(isc_mem_t *mctx, const dns_name_t *name, dns_rdatatype_t type,

 	ievent = isc_event_allocate(mctx, lookup, DNS_EVENT_LOOKUPDONE,
 				    action, arg, sizeof(*lookup->event));
+	if (ievent == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup_lookup;
+	}
 	lookup->event = (dns_lookupevent_t *)ievent;
 	lookup->event->ev_destroy = levent_destroy;
 	lookup->event->ev_destroy_arg = mctx;
@@ -422,6 +426,7 @@ dns_lookup_create(isc_mem_t *mctx, const dns_name_t *name, dns_rdatatype_t type,

 	isc_task_detach(&lookup->task);

+ cleanup_lookup:
 	isc_mem_putanddetach(&mctx, lookup, sizeof(*lookup));

 	return (result);
@@ -3078,6 +3078,8 @@ task_send(dns_loadctx_t *lctx) {
 	event = isc_event_allocate(lctx->mctx, NULL,
 				   DNS_EVENT_MASTERQUANTUM,
 				   load_quantum, lctx, sizeof(*event));
+	if (event == NULL)
+		return (ISC_R_NOMEMORY);
 	isc_task_send(lctx->task, &event);
 	return (ISC_R_SUCCESS);
 }
@@ -1444,6 +1444,8 @@ task_send(dns_dumpctx_t *dctx) {

 	event = isc_event_allocate(dctx->mctx, NULL, DNS_EVENT_DUMPQUANTUM,
 				   dump_quantum, dctx, sizeof(*event));
+	if (event == NULL)
+		return (ISC_R_NOMEMORY);
 	isc_task_send(dctx->task, &event);
 	return (ISC_R_SUCCESS);
 }
@@ -1052,6 +1052,8 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 							   free_rbtdb_callback,
 							   rbtdb,
 							   sizeof(isc_event_t));
+			if (event == NULL)
+				continue;
 			isc_task_send(rbtdb->task, &event);
 			return;
 		}
@@ -1859,11 +1861,16 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) {
 						DNS_EVENT_RBTPRUNE,
 						prune_tree, node,
 						sizeof(isc_event_t));
-			new_reference(rbtdb, node);
-			db = NULL;
-			attach((dns_db_t *)rbtdb, &db);
-			ev->ev_sender = db;
-			isc_task_send(rbtdb->task, &ev);
+			if (ev != NULL) {
+				new_reference(rbtdb, node);
+				db = NULL;
+				attach((dns_db_t *)rbtdb, &db);
+				ev->ev_sender = db;
+				isc_task_send(rbtdb->task, &ev);
+			} else {
+				ISC_LIST_APPEND(rbtdb->deadnodes[bucketnum],
+						node, deadlink);
+			}
 		} else {
 			delete_node(rbtdb, node);
 		}
@@ -2060,12 +2067,34 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 						DNS_EVENT_RBTPRUNE,
 						prune_tree, node,
 						sizeof(isc_event_t));
-			new_reference(rbtdb, node);
-			db = NULL;
-			attach((dns_db_t *)rbtdb, &db);
-			ev->ev_sender = db;
-			isc_task_send(rbtdb->task, &ev);
-			no_reference = false;
+			if (ev != NULL) {
+				new_reference(rbtdb, node);
+				db = NULL;
+				attach((dns_db_t *)rbtdb, &db);
+				ev->ev_sender = db;
+				isc_task_send(rbtdb->task, &ev);
+				no_reference = false;
+			} else {
+				/*
+				 * XXX: this is a weird situation.  We could
+				 * ignore this error case, but then the stale
+				 * node will unlikely be purged except via a
+				 * rare condition such as manual cleanup.  So
+				 * we queue it in the deadnodes list, hoping
+				 * the memory shortage is temporary and the node
+				 * will be deleted later.
+				 */
+				isc_log_write(dns_lctx,
+					      DNS_LOGCATEGORY_DATABASE,
+					      DNS_LOGMODULE_CACHE,
+					      ISC_LOG_INFO,
+					      "decrement_reference: failed to "
+					      "allocate pruning event");
+				INSIST(node->data == NULL);
+				INSIST(!ISC_LINK_LINKED(node, deadlink));
+				ISC_LIST_APPEND(rbtdb->deadnodes[bucket], node,
+						deadlink);
+			}
 		} else {
 			delete_node(rbtdb, node);
 		}
@@ -736,6 +736,10 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 	request->event = (dns_requestevent_t *)
 		isc_event_allocate(mctx, task, DNS_EVENT_REQUESTDONE,
 				   action, arg, sizeof(dns_requestevent_t));
+	if (request->event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	isc_task_attach(task, &tclone);
 	request->event->ev_sender = task;
 	request->event->request = request;
@@ -922,6 +926,10 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
 	request->event = (dns_requestevent_t *)
 		isc_event_allocate(mctx, task, DNS_EVENT_REQUESTDONE,
 				   action, arg, sizeof(dns_requestevent_t));
+	if (request->event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	isc_task_attach(task, &tclone);
 	request->event->ev_sender = task;
 	request->event->request = request;
@@ -4620,6 +4620,10 @@ fctx_join(fetchctx_t *fctx, isc_task_t *task, const isc_sockaddr_t *client,
 	event = (dns_fetchevent_t *)
 		isc_event_allocate(fctx->res->mctx, tclone, DNS_EVENT_FETCHDONE,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		isc_task_detach(&tclone);
+		return (ISC_R_NOMEMORY);
+	}
 	event->result = DNS_R_SERVFAIL;
 	event->qtype = fctx->type;
 	event->db = NULL;
@@ -1644,12 +1644,10 @@ dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 		dns_name_format(&zone->origin, dname, DNS_NAME_FORMATSIZE);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
-			      "rpz: %s: update already queued or running",
-			      dname);
-		if (zone->dbversion != NULL) {
+			      "rpz: %s: update already queued or running", dname);
+		if (zone->dbversion != NULL)
 			dns_db_closeversion(zone->db, &zone->dbversion,
 					    false);
-		}
 		dns_db_currentversion(zone->db, &zone->dbversion);
 	}

@@ -2620,47 +2618,39 @@ dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 	dns_rbtnode_t *nmnode;
 	const dns_rpz_nm_data_t *nm_data;
 	dns_rpz_zbits_t found_zbits;
-	dns_rbtnodechain_t chain;
 	isc_result_t result;
-	int i;

-	if (zbits == 0) {
+	if (zbits == 0)
 		return (0);
-	}

 	found_zbits = 0;

-	dns_rbtnodechain_init(&chain);
-
 	RWLOCK(&rpzs->search_lock, isc_rwlocktype_read);

 	nmnode = NULL;
-	result = dns_rbt_findnode(rpzs->rbt, trig_name, NULL, &nmnode,
-				  &chain, DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+	result = dns_rbt_findnode(rpzs->rbt, trig_name, NULL, &nmnode, NULL,
+				  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
 	switch (result) {
 	case ISC_R_SUCCESS:
 		nm_data = nmnode->data;
 		if (nm_data != NULL) {
-			if (rpz_type == DNS_RPZ_TYPE_QNAME) {
+			if (rpz_type == DNS_RPZ_TYPE_QNAME)
 				found_zbits = nm_data->set.qname;
-			} else {
+			else
 				found_zbits = nm_data->set.ns;
-			}
 		}
-		/* FALLTHROUGH */
-
+		nmnode = nmnode->parent;
+		/* fall thru */
 	case DNS_R_PARTIALMATCH:
-		i = chain.level_matches;
-		while (i >= 0 && (nmnode = chain.levels[i]) != NULL) {
+		while (nmnode != NULL) {
 			nm_data = nmnode->data;
 			if (nm_data != NULL) {
-				if (rpz_type == DNS_RPZ_TYPE_QNAME) {
+				if (rpz_type == DNS_RPZ_TYPE_QNAME)
 					found_zbits |= nm_data->wild.qname;
-				} else {
+				else
 					found_zbits |= nm_data->wild.ns;
-				}
 			}
-			i--;
+			nmnode = nmnode->parent;
 		}
 		break;

@@ -2680,9 +2670,6 @@ dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 	}

 	RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
-
-	dns_rbtnodechain_invalidate(&chain);
-
 	return (zbits & found_zbits);
 }

@@ -1367,7 +1367,7 @@ dns_sdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	sdb->dbdata = NULL;
 	if (imp->methods->create != NULL) {
 		MAYBE_LOCK(sdb);
-		result = imp->methods->create(sdb->zone, mctx, argc, argv,
+		result = imp->methods->create(sdb->zone, argc, argv,
 					      imp->driverdata, &sdb->dbdata);
 		MAYBE_UNLOCK(sdb);
 		if (result != ISC_R_SUCCESS)
@@ -3048,6 +3048,10 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 				   DNS_EVENT_VALIDATORSTART,
 				   validator_start, NULL,
 				   sizeof(dns_validatorevent_t));
+	if (event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup_val;
+	}
 	isc_task_attach(task, &tclone);
 	event->validator = val;
 	event->result = ISC_R_FAILURE;
@@ -3110,6 +3114,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	isc_task_detach(&tclone);
 	isc_event_free(ISC_EVENT_PTR(&event));

+ cleanup_val:
 	dns_view_weakdetach(&val->view);
 	isc_mem_put(view->mctx, val, sizeof(*val));

@@ -35,6 +35,7 @@
 #include <dns/db.h>
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
+#include <dns/dns64.h>
 #include <dns/dnssec.h>
 #include <dns/events.h>
 #include <dns/forward.h>
@@ -158,6 +159,8 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->resstats = NULL;
 	view->resquerystats = NULL;
 	view->cacheshared = false;
+	ISC_LIST_INIT(view->dns64);
+	view->dns64cnt = 0;

 	/*
 	 * Initialize configuration data with default values.
@@ -246,7 +249,6 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->hooktable_free = NULL;

 	isc_mutex_init(&view->new_zone_lock);
-	view->zonemgr = NULL;

 	result = dns_order_create(view->mctx, &view->order);
 	if (result != ISC_R_SUCCESS) {
@@ -332,6 +334,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,

 static inline void
 destroy(dns_view_t *view) {
+	dns_dns64_t *dns64;
 	dns_dlzdb_t *dlzdb;

 	REQUIRE(!ISC_LINK_LINKED(view, link));
@@ -495,6 +498,12 @@ destroy(dns_view_t *view) {
 		dns_keytable_detach(&view->secroots_priv);
 	if (view->ntatable_priv != NULL)
 		dns_ntatable_detach(&view->ntatable_priv);
+	for (dns64 = ISC_LIST_HEAD(view->dns64);
+	     dns64 != NULL;
+	     dns64 = ISC_LIST_HEAD(view->dns64)) {
+		dns_dns64_unlink(&view->dns64, dns64);
+		dns_dns64_destroy(&dns64);
+	}
 	if (view->managed_keys != NULL)
 		dns_zone_detach(&view->managed_keys);
 	if (view->redirect != NULL)
@@ -532,9 +541,6 @@ destroy(dns_view_t *view) {
 	isc_refcount_destroy(&view->weakrefs);
 	isc_mem_free(view->mctx, view->nta_file);
 	isc_mem_free(view->mctx, view->name);
-	if (view->zonemgr != NULL) {
-		dns_zonemgr_detach(&view->zonemgr);
-	}
 	if (view->hooktable != NULL && view->hooktable_free != NULL) {
 		view->hooktable_free(view->mctx, &view->hooktable);
 	}
@@ -2407,10 +2413,3 @@ dns_view_setviewrevert(dns_view_t *view) {
 		dns_zt_setviewrevert(zonetable);
 	}
 }
-
-void
-dns_view_setzonemgr(dns_view_t *view, dns_zonemgr_t *zonemgr) {
-	REQUIRE(DNS_VIEW_VALID(view));
-
-	dns_zonemgr_attach(zonemgr, &view->zonemgr);
-}
@@ -307,6 +307,13 @@ dns_dlzdestroy
 dns_dlzregister
 dns_dlzstrtoargv
 dns_dlzunregister
+dns_dns64_aaaafroma
+dns_dns64_aaaaok
+dns_dns64_append
+dns_dns64_create
+dns_dns64_destroy
+dns_dns64_next
+dns_dns64_unlink
 dns_dnssec_findmatchingkeys
 dns_dnssec_findzonekeys
 dns_dnssec_keyactive
@@ -1087,7 +1094,6 @@ dns_view_setresstats
 dns_view_setrootdelonly
 dns_view_setviewcommit
 dns_view_setviewrevert
-dns_view_setzonemgr
 dns_view_simplefind
 dns_view_thaw
 dns_view_untrust
@@ -1122,6 +1122,12 @@ zone_free(dns_zone_t *zone) {
 	if (zone->loadtask != NULL) {
 		isc_task_detach(&zone->loadtask);
 	}
+	if (zone->view != NULL) {
+		dns_view_weakdetach(&zone->view);
+	}
+	if (zone->prev_view != NULL) {
+		dns_view_weakdetach(&zone->prev_view);
+	}

 	/* Unmanaged objects */
 	while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
@@ -1244,13 +1250,6 @@ zone_free(dns_zone_t *zone) {
 		isc_stats_detach(&zone->gluecachestats);
 	}

-	if (zone->view != NULL) {
-		dns_view_weakdetach(&zone->view);
-	}
-	if (zone->prev_view != NULL) {
-		dns_view_weakdetach(&zone->prev_view);
-	}
-
 	/* last stuff */
 	ZONEDB_DESTROYLOCK(&zone->dblock);
 	isc_mutex_destroy(&zone->lock);
@@ -1715,7 +1714,7 @@ dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs,
 {
 	/*
 	 * Only RBTDB zones can be used for response policy zones,
-	 * because only they have the code to create the summary data.
+	 * because only they have the code to load the create the summary data.
 	 * Only zones that are loaded instead of mmap()ed create the
 	 * summary data and so can be policy zones.
 	 */
@@ -2190,12 +2189,12 @@ dns_zone_asyncload(dns_zone_t *zone, bool newonly,
 {
 	isc_event_t *e;
 	dns_asyncload_t *asl = NULL;
+	isc_result_t result = ISC_R_SUCCESS;

 	REQUIRE(DNS_ZONE_VALID(zone));

-	if (zone->zmgr == NULL) {
+	if (zone->zmgr == NULL)
 		return (ISC_R_FAILURE);
-	}

 	/* If we already have a load pending, stop now */
 	LOCK_ZONE(zone);
@@ -2215,6 +2214,8 @@ dns_zone_asyncload(dns_zone_t *zone, bool newonly,
 			       DNS_EVENT_ZONELOAD,
 			       zone_asyncload, asl,
 			       sizeof(isc_event_t));
+	if (e == NULL)
+		CHECK(ISC_R_NOMEMORY);

 	zone_iattach(zone, &asl->zone);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADPENDING);
@@ -2222,6 +2223,12 @@ dns_zone_asyncload(dns_zone_t *zone, bool newonly,
 	UNLOCK_ZONE(zone);

 	return (ISC_R_SUCCESS);
+
+  failure:
+	if (asl != NULL)
+		isc_mem_put(zone->mctx, asl, sizeof (*asl));
+	UNLOCK_ZONE(zone);
+	return (result);
 }

 bool
@@ -10574,8 +10581,6 @@ dns_zone_expire(dns_zone_t *zone) {

 static void
 zone_expire(dns_zone_t *zone) {
-	dns_db_t *db = NULL;
-
 	/*
 	 * 'zone' locked by caller.
 	 */
@@ -10588,32 +10593,6 @@ zone_expire(dns_zone_t *zone) {
 	zone->refresh = DNS_ZONE_DEFAULTREFRESH;
 	zone->retry = DNS_ZONE_DEFAULTRETRY;
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
-
-	/*
-	 * An RPZ zone has expired; before unloading it, we must
-	 * first remove it from the RPZ summary database. The
-	 * easiest way to do this is "update" it with an empty
-	 * database so that the update callback synchonizes
-	 * the diff automatically.
-	 */
-	if (zone->rpzs != NULL && zone->rpz_num != DNS_RPZ_INVALID_NUM) {
-		isc_result_t result;
-		dns_rpz_zone_t *rpz = zone->rpzs->zones[zone->rpz_num];
-
-		CHECK(dns_db_create(zone->mctx, "rbt", &zone->origin,
-				    dns_dbtype_zone, zone->rdclass,
-				    0, NULL, &db));
-		CHECK(dns_rpz_dbupdate_callback(db, rpz));
-		dns_zone_log(zone, ISC_LOG_WARNING,
-			     "response-policy zone expired; "
-			     "policies unloaded");
-	}
-
- failure:
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
 	zone_unload(zone);
 }

@@ -11384,6 +11363,8 @@ notify_send_queue(dns_notify_t *notify, bool startup) {
 	INSIST(notify->event == NULL);
 	e = isc_event_allocate(notify->mctx, NULL, DNS_EVENT_NOTIFYSENDTOADDR,
 			       notify_send_toaddr, notify, sizeof(isc_event_t));
+	if (e == NULL)
+		return (ISC_R_NOMEMORY);
 	if (startup)
 		notify->event = e;
 	e->ev_arg = notify;
@@ -12686,6 +12667,10 @@ queue_soa_query(dns_zone_t *zone) {

 	e = isc_event_allocate(zone->mctx, NULL, DNS_EVENT_ZONE,
 			       soa_query, zone, sizeof(isc_event_t));
+	if (e == NULL) {
+		cancel_refresh(zone);
+		return;
+	}

 	/*
 	 * Attach so that we won't clean up
@@ -14892,6 +14877,8 @@ zone_send_secureserial(dns_zone_t *zone, uint32_t serial) {
 			       DNS_EVENT_ZONESECURESERIAL,
 			       receive_secure_serial, zone->secure,
 			       sizeof(struct secure_event));
+	if (e == NULL)
+		return (ISC_R_NOMEMORY);
 	((struct secure_event *)e)->serial = serial;
 	INSIST(LOCKED_ZONE(zone->secure));
 	zone_iattach(zone->secure, &dummy);
@@ -15352,6 +15339,8 @@ zone_send_securedb(dns_zone_t *zone, dns_db_t *db) {
 			       DNS_EVENT_ZONESECUREDB,
 			       receive_secure_db, zone->secure,
 			       sizeof(struct secure_event));
+	if (e == NULL)
+		return (ISC_R_NOMEMORY);
 	dns_db_attach(db, &dummy);
 	((struct secure_event *)e)->db = dummy;
 	INSIST(LOCKED_ZONE(zone->secure));
@@ -17051,6 +17040,8 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	 */
 	e = isc_event_allocate(zmgr->mctx, zmgr, DNS_EVENT_ZONESTARTXFRIN,
 			       got_transfer_quota, zone, sizeof(isc_event_t));
+	if (e == NULL)
+		return (ISC_R_NOMEMORY);

 	LOCK_ZONE(zone);
 	INSIST(zone->statelist == &zmgr->waiting_for_xfrin);
@@ -17106,6 +17097,10 @@ zonemgr_getio(dns_zonemgr_t *zmgr, bool high,

 	io->event = isc_event_allocate(zmgr->mctx, task, DNS_EVENT_IOREADY,
 				       action, arg, sizeof(*io->event));
+	if (io->event == NULL) {
+		isc_mem_put(zmgr->mctx, io, sizeof(*io));
+		return (ISC_R_NOMEMORY);
+	}

 	io->zmgr = zmgr;
 	io->high = high;
@@ -19258,6 +19253,10 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) {

 	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_KEYDONE, keydone,
 			       zone, sizeof(struct keydone));
+	if (e == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto failure;
+	}

 	kd = (struct keydone *) e;
 	if (strcasecmp(keystr, "all") == 0) {
@@ -19559,6 +19558,10 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,

 	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_SETNSEC3PARAM,
 			       setnsec3param, zone, sizeof(struct np3event));
+	if (e == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto failure;
+	}

 	npe = (struct np3event *) e;
 	np = &npe->params;
@@ -19820,6 +19823,10 @@ dns_zone_setserial(dns_zone_t *zone, uint32_t serial) {

 	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_SETSERIAL,
 			       setserial, zone, sizeof(struct ssevent));
+	if (e == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto failure;
+	}

 	sse = (struct ssevent *)e;
 	sse->serial = serial;
@@ -224,6 +224,10 @@ isc_app_ctxonrun(isc_appctx_t *ctx, isc_mem_t *mctx, isc_task_t *task,
 	isc_task_attach(task, &cloned_task);
 	event = isc_event_allocate(mctx, cloned_task, ISC_APPEVENT_SHUTDOWN,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		isc_task_detach(&cloned_task);
+		return (ISC_R_NOMEMORY);
+	}

 	LOCK(&ctx->lock);
 	ISC_LINK_INIT(event, ev_link);
@@ -785,6 +785,8 @@ isc_task_onshutdown(isc_task_t *task0, isc_taskaction_t action,
 				   action,
 				   arg,
 				   sizeof(*event));
+	if (event == NULL)
+		return (ISC_R_NOMEMORY);

 	LOCK(&task->lock);
 	if (TASK_SHUTTINGDOWN(task)) {
@@ -1451,6 +1451,9 @@ allocate_socketevent(isc_mem_t *mctx, void *sender,
 						     eventtype, action, arg,
 						     sizeof(*ev));

+	if (ev == NULL)
+		return (NULL);
+
 	ev->result = ISC_R_UNSET;
 	ISC_LINK_INIT(ev, ev_link);
 	ev->region.base = NULL;
@@ -4642,6 +4645,10 @@ isc_socket_accept(isc_socket_t *sock0,
 	dev = (isc_socket_newconnev_t *)
 		isc_event_allocate(manager->mctx, task, ISC_SOCKEVENT_NEWCONN,
 				   action, arg, sizeof(*dev));
+	if (dev == NULL) {
+		UNLOCK(&sock->lock);
+		return (ISC_R_NOMEMORY);
+	}
 	ISC_LINK_INIT(dev, ev_link);

 	result = allocate_socket(manager, sock->type, &nsock);
@@ -4713,6 +4720,10 @@ isc_socket_connect(isc_socket_t *sock0, const isc_sockaddr_t *addr,
 							ISC_SOCKEVENT_CONNECT,
 							action,	arg,
 							sizeof(*dev));
+	if (dev == NULL) {
+		UNLOCK(&sock->lock);
+		return (ISC_R_NOMEMORY);
+	}
 	ISC_LINK_INIT(dev, ev_link);

 	if (sock->connecting) {
@@ -983,6 +983,8 @@ allocate_socketevent(isc_mem_t *mctx, isc_socket_t *sock,
 	ev = (isc_socketevent_t *)isc_event_allocate(mctx, sock, eventtype,
 						     action, arg,
 						     sizeof(*ev));
+	if (ev == NULL)
+		return (NULL);

 	ev->result = ISC_R_IOERROR; // XXXMLG temporary change to detect failure to set
 	ISC_LINK_INIT(ev, ev_link);
@@ -3060,6 +3062,10 @@ isc_socket_accept(isc_socket_t *sock,
 	adev = (isc_socket_newconnev_t *)
 		isc_event_allocate(manager->mctx, task, ISC_SOCKEVENT_NEWCONN,
 				   action, arg, sizeof(*adev));
+	if (adev == NULL) {
+		UNLOCK(&sock->lock);
+		return (ISC_R_NOMEMORY);
+	}
 	ISC_LINK_INIT(adev, ev_link);

 	result = allocate_socket(manager, sock->type, &nsock);
@@ -3204,6 +3210,10 @@ isc_socket_connect(isc_socket_t *sock, const isc_sockaddr_t *addr,
 							ISC_SOCKEVENT_CONNECT,
 							action,	arg,
 							sizeof(*cdev));
+	if (cdev == NULL) {
+		UNLOCK(&sock->lock);
+		return (ISC_R_NOMEMORY);
+	}
 	ISC_LINK_INIT(cdev, ev_link);

 	if (sock->connected) {
@@ -1801,6 +1801,30 @@ static cfg_type_t cfg_type_prefetch = {
 	"prefetch", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
 	&cfg_rep_tuple, prefetch_fields
 };
+/*
+ * DNS64.
+ */
+static cfg_clausedef_t
+dns64_clauses[] = {
+	{ "break-dnssec", &cfg_type_boolean, 0 },
+	{ "clients", &cfg_type_bracketed_aml, 0 },
+	{ "exclude", &cfg_type_bracketed_aml, 0 },
+	{ "mapped", &cfg_type_bracketed_aml, 0 },
+	{ "recursive-only", &cfg_type_boolean, 0 },
+	{ "suffix", &cfg_type_netaddr6, 0 },
+	{ NULL, NULL, 0 },
+};
+
+static cfg_clausedef_t *
+dns64_clausesets[] = {
+	dns64_clauses,
+	NULL
+};
+
+static cfg_type_t cfg_type_dns64 = {
+	"dns64", cfg_parse_netprefix_map, cfg_print_map, cfg_doc_map,
+	&cfg_rep_map, dns64_clausesets
+};

 /*%
 * Clauses that can be found within the 'view' statement,
@@ -1838,10 +1862,9 @@ view_clauses[] = {
 	{ "disable-ds-digests", &cfg_type_disabledsdigest,
 	  CFG_CLAUSEFLAG_MULTI },
 	{ "disable-empty-zone", &cfg_type_astring, CFG_CLAUSEFLAG_MULTI },
-	{ "dns64", &cfg_type_bracketed_text,
-	  CFG_CLAUSEFLAG_MULTI|CFG_CLAUSEFLAG_OBSOLETE },
-	{ "dns64-contact", &cfg_type_astring, CFG_CLAUSEFLAG_OBSOLETE },
-	{ "dns64-server", &cfg_type_astring, CFG_CLAUSEFLAG_OBSOLETE },
+	{ "dns64", &cfg_type_dns64, CFG_CLAUSEFLAG_MULTI },
+	{ "dns64-contact", &cfg_type_astring, 0 },
+	{ "dns64-server", &cfg_type_astring, 0 },
 #ifdef USE_DNSRPS
 	{ "dnsrps-enable", &cfg_type_boolean, 0 },
 	{ "dnsrps-options", &cfg_type_bracketed_text, 0 },
@@ -33,12 +33,10 @@
 #include <isc/types.h>

 #include <dns/view.h>
-#include <dns/zone.h>

 #include <ns/hooks.h>
 #include <ns/log.h>
 #include <ns/query.h>
-#include <ns/server.h>

 #define CHECK(op)						\
 	do {							\
@@ -413,7 +411,7 @@ ns_plugin_register(const char *modpath, const char *parameters,
 		      "registering plugin '%s'", modpath);

 	CHECK(plugin->register_func(parameters, cfg, cfg_file, cfg_line,
-				    mctx, lctx, actx, view,
+				    mctx, lctx, actx, view->hooktable,
 				    &plugin->inst));

 	ISC_LIST_APPEND(*(ns_plugins_t *)view->plugins, plugin, link);
@@ -21,7 +21,6 @@
 #include <isc/result.h>

 #include <dns/rdatatype.h>
-#include <dns/sdb.h>

 #include <ns/client.h>
 #include <ns/query.h>
@@ -267,7 +266,7 @@ typedef isc_result_t
 ns_plugin_register_t(const char *parameters,
 		     const void *cfg, const char *file, unsigned long line,
 		     isc_mem_t *mctx, isc_log_t *lctx, void *actx,
-		     dns_view_t *view, void **instp);
+		     ns_hooktable_t *hooktable, void **instp);
 /*%<
 * Called when registering a new plugin.
 *
@@ -70,6 +70,12 @@ struct ns_query {
 	isc_bufferlist_t		namebufs;
 	ISC_LIST(ns_dbversion_t)	activeversions;
 	ISC_LIST(ns_dbversion_t)	freeversions;
+	dns_rdataset_t *		dns64_aaaa;
+	dns_rdataset_t *		dns64_sigaaaa;
+	bool *				dns64_aaaaok;
+	unsigned int			dns64_aaaaoklen;
+	unsigned int			dns64_options;
+	unsigned int			dns64_ttl;

 	struct {
 		dns_db_t *      	db;
@@ -105,8 +111,8 @@ struct ns_query {
 #define NS_QUERYATTR_NOADDITIONAL	0x00800
 #define NS_QUERYATTR_CACHEACLOKVALID	0x01000
 #define NS_QUERYATTR_CACHEACLOK		0x02000
-/* Obsolete: NS_QUERYATTR_DNS64		0x04000 */
-/* Obsolete: NS_QUERYATTR_DNS64EXCLUDE	0x08000 */
+#define NS_QUERYATTR_DNS64		0x04000
+#define NS_QUERYATTR_DNS64EXCLUDE	0x08000
 #define NS_QUERYATTR_RRL_CHECKED	0x10000
 #define NS_QUERYATTR_REDIRECT		0x20000

@@ -132,7 +138,7 @@ struct query_ctx {
 	bool is_zone;				/* is DB a zone DB? */
 	bool is_staticstub_zone;
 	bool resuming;				/* resumed from recursion? */
-	bool rpz;
+	bool dns64, dns64_exclude, rpz;
 	bool authoritative;			/* authoritative query? */
 	bool want_restart;			/* CNAME chain or other
 						 * restart needed */
@@ -164,8 +170,6 @@ struct query_ctx {

 	dns_view_t *view;			/* client view */

-	isc_result_t nxresult;			/* NXDOMAIN/NXRRSET */
-
 	isc_result_t result;			/* query result */
 	int line;				/* line to report error */
 };
@@ -239,43 +243,6 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 * recursion completes.
 */

-isc_result_t
-ns_query_lookup(query_ctx_t *qctx);
-/*%<
- * Perform a local database lookup, in either an authoritative or
- * cache database. If unable to answer, call ns_query_done(); otherwise
- * hand off processing to query_gotanswer().
- */
-
-isc_result_t
-ns_query_addsoa(query_ctx_t *qctx, dns_ttl_t ttl, dns_section_t section);
-/*%<
- * Add SOA to the authority section when sending negative responses
- * (or to the additional section if sending negative responses triggered
- * by RPZ rewriting.)
- */
-
-isc_result_t
-ns_query_nodata(query_ctx_t *qctx);
-/*%<
- * Handle authoritative NOERROR/NODATA responses.
- */
-
-isc_result_t
-ns_query_ncache(query_ctx_t *qctx);
-/*%<
- * Handle negative cache responses, DNS_R_NCACHENXRRSET or
- * DNS_R_NCACHENXDOMAIN. (Note: may be called with other
- * result codes as a result of hook actions; for example,
- * DNS64 may call with DNS_R_NXOMAIN.)
- */
-
-void
-ns_query_setorder(ns_client_t *client, dns_name_t *name,
-		  dns_rdataset_t *rdataset);
-/*%<
- * Set the ordering for 'rdataset'.
- */

 isc_result_t
 ns__query_sfcache(query_ctx_t *qctx);
@@ -1534,6 +1534,8 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   update_action, NULL, sizeof(*event));
+	if (event == NULL)
+		FAIL(ISC_R_NOMEMORY);
 	event->zone = zone;
 	event->result = ISC_R_SUCCESS;

@@ -1546,6 +1548,9 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	dns_zone_gettask(zone, &zonetask);
 	isc_task_send(zonetask, ISC_EVENT_PTR(&event));

+ failure:
+	if (event != NULL)
+		isc_event_free(ISC_EVENT_PTR(&event));
 	return (result);
 }

@@ -3484,6 +3489,8 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   forward_action, NULL, sizeof(*event));
+	if (event == NULL)
+		FAIL(ISC_R_NOMEMORY);
 	event->zone = zone;
 	event->result = ISC_R_SUCCESS;

@@ -79,16 +79,11 @@ ns_plugin_expandpath
 ns_plugin_register
 ns_plugins_create
 ns_plugins_free
-ns_query_addsoa
 ns_query_cancel
 ns_query_done
 ns_query_free
 ns_query_init
-ns_query_lookup
-ns_query_ncache
-ns_query_nodata
 ns_query_recurse
-ns_query_setorder
 ns_query_start
 ns_server_attach
 ns_server_create
@@ -244,10 +244,6 @@
 ./bin/pkcs11/win32/pk11tokens.vcxproj.filters.in	X	2014,2015,2018,2019
 ./bin/pkcs11/win32/pk11tokens.vcxproj.in	X	2014,2015,2016,2017,2018,2019
 ./bin/pkcs11/win32/pk11tokens.vcxproj.user	X	2014,2018,2019
-./bin/plugins/dns64.8				MAN	DOCBOOK
-./bin/plugins/dns64.c				C	2019
-./bin/plugins/dns64.docbook			SGML	2019
-./bin/plugins/dns64.html			HTML	DOCBOOK
 ./bin/plugins/filter-aaaa.8			MAN	DOCBOOK
 ./bin/plugins/filter-aaaa.c			C	2018,2019
 ./bin/plugins/filter-aaaa.docbook		SGML	2018,2019
@@ -1425,7 +1421,6 @@
 ./doc/arm/man.ddns-confgen.html			X	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./doc/arm/man.delv.html				X	2014,2015,2016,2017,2018,2019
 ./doc/arm/man.dig.html				X	2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
-./doc/arm/man.dns64.html			X	2019
 ./doc/arm/man.dnssec-cds.html			X	2017,2018,2019
 ./doc/arm/man.dnssec-checkds.html		X	2013,2014,2015,2016,2017,2018,2019
 ./doc/arm/man.dnssec-coverage.html		X	2013,2014,2015,2016,2017,2018,2019
@@ -1604,6 +1599,7 @@
 ./lib/dns/diff.c				C	2000,2001,2002,2003,2004,2005,2007,2008,2009,2011,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dispatch.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dlz.c					C.PORTION	1999,2000,2001,2005,2007,2009,2010,2011,2012,2013,2015,2016,2018,2019
+./lib/dns/dns64.c				C	2010,2011,2014,2016,2017,2018,2019
 ./lib/dns/dnsrps.c				C	2017,2018,2019
 ./lib/dns/dnssec.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dnstap.c				C	2015,2016,2017,2018,2019
@@ -1647,6 +1643,7 @@
 ./lib/dns/include/dns/dispatch.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/include/dns/dlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2013,2016,2018,2019
 ./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013,2016,2017,2018,2019
+./lib/dns/include/dns/dns64.h			C	2010,2014,2016,2018,2019
 ./lib/dns/include/dns/dnsrps.h			C	2017,2018,2019
 ./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019
 ./lib/dns/include/dns/dnstap.h			C	2015,2016,2017,2018,2019