Test - use regular malloc

Remove layering from isc_socket, isc_timer, isc_mem
Remove layering from isc_task and isc_app
2018-08-06 20:38:16 +02:00 · 2018-08-06 17:25:14 +02:00 · 2018-08-06 16:27:02 +02:00 · 2018-08-06 15:49:16 +02:00 · 2018-08-06 12:20:18 +02:00 · 2018-08-06 09:53:00 +02:00
315 changed files with 3562 additions and 17657 deletions
@@ -2,7 +2,7 @@ variables:
  DEBIAN_FRONTEND: noninteractive
  LC_ALL: C
  DOCKER_DRIVER: overlay2
-  CI_REGISTRY_IMAGE: oerdnj/bind9
+  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"

 stages:
@@ -10,6 +10,20 @@ stages:
  - build
  - test

+.centos-centos6-amd64: &centos_centos6_amd64_image
+  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
+  tags:
+    - linux
+    - docker
+    - amd64
+
+.centos-centos7-amd64: &centos_centos7_amd64_image
+  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
+  tags:
+    - linux
+    - docker
+    - amd64
+
 .debian-jessie-amd64: &debian_jessie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
  tags:
@@ -98,9 +112,9 @@ stages:
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-    - ./autogen.sh
+#    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr/local --with-libidn2
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr $EXTRA_CONFIGURE
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
  artifacts:
    expire_in: '1 hour'
@@ -111,6 +125,9 @@ stages:
  before_script:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
+    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
+    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
@@ -123,6 +140,9 @@ stages:
  stage: test
  before_script:
    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
+    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
+    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
  script:
    - make unit
  after_script:
@@ -178,17 +198,49 @@ precheck:debian:sid:amd64:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

+build:centos:centos6:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
+  <<: *centos_centos6_amd64_image
+  <<: *build_job
+
+build:centos:centos7:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *centos_centos7_amd64_image
+  <<: *build_job
+
 build:clang:debian:sid:amd64:
  variables:
    CC: clang-6.0
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job

+build:debian:jessie:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_jessie_amd64_image
+  <<: *build_job
+
+build:debian:stretch:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
 build:debian:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job

@@ -196,6 +248,7 @@ build:clang:debian:sid:i386:
  variables:
    CC: clang-6.0
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_i386_image
  <<: *build_job

@@ -203,9 +256,34 @@ build:debian:sid:i386:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_i386_image
  <<: *build_job

+unittest:centos:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:centos:centos6:amd64
+
+unittest:centos:centos7:amd64:
+  <<: *centos_centos7_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:centos:centos7:amd64
+
+unittest:debian:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:debian:jessie:amd64
+
+unittest:debian:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:debian:stretch:amd64
+
 unittest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
@@ -224,6 +302,30 @@ unittest:debian:sid:i386:
  dependencies:
    - build:debian:sid:i386

+systemtest:centos:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - build:centos:centos6:amd64
+
+systemtest:centos:centos7:amd64:
+  <<: *centos_centos7_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - build:centos:centos7:amd64
+
+systemtest:debian:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - build:debian:jessie:amd64
+
+systemtest:debian:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - build:debian:stretch:amd64
+
 systemtest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
@@ -235,3 +337,23 @@ systemtest:debian:sid:i386:
  <<: *system_test_job
  dependencies:
    - build:debian:sid:i386
+
+pkcs11:build:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+pkcs11:unittest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - pkcs11:build:debian:sid:amd64
+
+pkcs11:systemtest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - pkcs11:build:debian:sid:amd64
@@ -1,4 +1,30 @@
-4996.	[bug]		dig: Handle malformed ednsopt options. [GL #403]
+5005.	[bug]		dnssec-verify, and dnssec-signzone at the verification
+			step, failed on some validly signed zones. [GL #442]
+
+5004.	[bug]		'rndc reconfig' could cause inline zones to stop
+			re-signing. [GL #439]
+
+5003.	[bug]		dns_acl_isinsecure did not handle geoip elements.
+			[GL #406]
+
+5002.	[bug]		mdig: Handle malformed +ednsopt option, support 100
+			+ednsopt options per query rather than 100 total and
+			address memory leaks if +ednsopt was specified.
+			[GL #410]
+
+5001.	[bug]		Fix refcount errors on error paths. [GL !563]
+
+5000.	[bug]		named_server_servestale() could leave the server in
+			exclusive mode if an error occured. [GL #441]
+
+4999.	[cleanup]	Remove custom printf implementaion in lib/isc/print.c.
+			[GL #261]
+
+4998.	[test]		Make resolver and cacheclean tests more civilized.
+
+4997.	[placeholder]
+
+4996.	[bug]		dig: Handle malformed +ednsopt option. [GL #403]

 4995.	[test]		Add tests for "tcp-self" update policy. [GL !282]

@@ -121,12 +121,6 @@ int sigwait(const unsigned int *set, int *sig);
 /** define if you have strerror in the C library. */
 #undef HAVE_STRERROR

-/* Define if OpenSSL includes DSA support */
-#undef HAVE_OPENSSL_DSA
-
-/* Define if you have getpassphrase in the C library. */
-#undef HAVE_GETPASSPHRASE
-
 /* Define to the length type used by the socket API (socklen_t, size_t, int). */
 #undef ISC_SOCKADDR_LEN_T

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.15.1 -*- Autoconf -*-

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2017 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.

 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 12 (pkg-config-0.29.2)
-
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29.1)
+dnl
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -55,7 +55,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.2])
+[m4_define([PKG_MACROS_VERSION], [0.29.1])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl

 pkg_failed=no
-AC_MSG_CHECKING([for $2])
+AC_MSG_CHECKING([for $1])

 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])

 if test $pkg_failed = yes; then
-        AC_MSG_RESULT([no])
+   	AC_MSG_RESULT([no])
        _PKG_SHORT_ERRORS_SUPPORTED
        if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else
+        else 
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
        fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
        ])
 elif test $pkg_failed = untried; then
-        AC_MSG_RESULT([no])
+     	AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
@@ -288,8 +288,9 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR

-m4_include([libtool.m4/libtool.m4])
-m4_include([libtool.m4/ltoptions.m4])
-m4_include([libtool.m4/ltsugar.m4])
-m4_include([libtool.m4/ltversion.m4])
-m4_include([libtool.m4/lt~obsolete.m4])
+m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/libtool.m4])
+m4_include([m4/ltoptions.m4])
+m4_include([m4/ltsugar.m4])
+m4_include([m4/ltversion.m4])
+m4_include([m4/lt~obsolete.m4])
@@ -10,4 +10,4 @@
 # information regarding copyright ownership.

 # Run this script after modifying configure.in to generate configure
-autoreconf -i
+autoreconf -f -i
@@ -16,15 +16,15 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${ISC_INCLUDES} @DST_OPENSSL_INC@
+		${ISC_INCLUDES} @OPENSSL_INCLUDES@

 CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@

@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -58,7 +58,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -80,7 +80,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -87,7 +87,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -27,8 +27,8 @@ CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@

@@ -36,7 +36,7 @@
 #include <isc/time.h>
 #include <isc/util.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -102,7 +102,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -43,10 +43,8 @@
 const char *
 alg_totext(dns_secalg_t alg) {
 	switch (alg) {
-#ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
 		return "hmac-md5";
-#endif
 	    case DST_ALG_HMACSHA1:
 		return "hmac-sha1";
 	    case DST_ALG_HMACSHA224:
@@ -71,10 +69,8 @@ alg_fromtext(const char *name) {
 	if (strncasecmp(p, "hmac-", 5) == 0)
 		p = &name[5];

-#ifndef PK11_MD5_DISABLE
 	if (strcasecmp(p, "md5") == 0)
 		return DST_ALG_HMACMD5;
-#endif
 	if (strcasecmp(p, "sha1") == 0)
 		return DST_ALG_HMACSHA1;
 	if (strcasecmp(p, "sha224") == 0)
@@ -124,9 +120,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	dst_key_t *key = NULL;

 	switch (alg) {
-#ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
-#endif
 	    case DST_ALG_HMACSHA1:
 	    case DST_ALG_HMACSHA224:
 	    case DST_ALG_HMACSHA256:
@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@

 CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
@@ -24,8 +24,8 @@ CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@

 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -19,7 +19,7 @@ READLINE_LIB = @READLINE_LIB@

 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@

 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -27,8 +27,8 @@ CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@

 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -64,7 +64,7 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

-LDFLAGS =	@LIBIDN2_LDFLAGS@
+LDFLAGS =	@LDFLAGS@ @LIBIDN2_LDFLAGS@

 dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="dig.@O@ dighost.@O@ ${UOBJS}"; \
@@ -260,7 +260,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
+#if !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
 #else
 		tmnow  = *localtime(&tnow);
@@ -1771,11 +1771,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else  {
-#ifndef PK11_MD5_DISABLE
 			hmacname = DNS_TSIG_HMACMD5_NAME;
-#else
-			hmacname = DNS_TSIG_HMACSHA256_NAME;
-#endif
 			digestbits = 0;
 		}
 		/* XXXONDREJ: FIXME */
@@ -84,7 +84,7 @@

 #include <dig/dig.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -1032,14 +1032,12 @@ parse_hmac(const char *hmac) {

 	digestbits = 0;

-#ifndef PK11_MD5_DISABLE
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
 	} else
-#endif
 	if (strcasecmp(buf, "hmac-sha1") == 0) {
 		hmacname = DNS_TSIG_HMACSHA1_NAME;
 		digestbits = 0;
@@ -1153,11 +1151,9 @@ setup_file_key(void) {
 	}

 	switch (dst_key_alg(dstkey)) {
-#ifndef PK11_MD5_DISABLE
 	case DST_ALG_HMACMD5:
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 		break;
-#endif
 	case DST_ALG_HMACSHA1:
 		hmacname = DNS_TSIG_HMACSHA1_NAME;
 		break;
@@ -1314,7 +1310,7 @@ setup_libs(void) {

 	debug("setup_libs()");

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -77,7 +77,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -15,15 +15,14 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@

-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-		-DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@

 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -53,7 +53,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -1147,7 +1147,7 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -41,7 +41,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -370,7 +370,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -41,7 +41,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -310,7 +310,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -37,7 +37,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -69,12 +69,9 @@ usage(void) {
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "        name of an OpenSSL engine to use "
-				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
@@ -124,11 +121,7 @@ main(int argc, char **argv) {
 	const char	*directory = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
-#ifdef USE_PKCS11
-	const char	*engine = PKCS11_ENGINE;
-#else
 	const char	*engine = NULL;
-#endif
 	char		*classname = NULL;
 	char		*endp;
 	dst_key_t	*key = NULL;
@@ -173,7 +166,7 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -388,20 +381,10 @@ main(int argc, char **argv) {
 		}

 		if (strcasecmp(algname, "RSA") == 0) {
-#ifndef PK11_MD5_DISABLE
 			fprintf(stderr, "The use of RSA (RSAMD5) is not "
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
-#else
-			fprintf(stderr,
-				"The use of RSA (RSAMD5) was disabled\n");
-			if (freeit != NULL)
-				free(freeit);
-			return (1);
-		} else if (strcasecmp(algname, "RSAMD5") == 0) {
-			fprintf(stderr, "The use of RSAMD5 was disabled\n");
-#endif
 			if (freeit != NULL)
 				free(freeit);
 			return (1);
@@ -512,11 +495,6 @@ main(int argc, char **argv) {
 		alg = dst_key_alg(prevkey);
 		flags = dst_key_flags(prevkey);

-#ifdef PK11_MD5_DISABLE
-		if (alg == DST_ALG_RSAMD5)
-			fatal("Key %s uses disabled RSAMD5", predecessor);
-#endif
-
 		dst_key_format(prevkey, keystr, sizeof(keystr));
 		dst_key_getprivateformat(prevkey, &major, &minor);
 		if (major != DST_MAJOR_VERSION || minor < DST_MINOR_VERSION)
@@ -606,7 +584,7 @@ main(int argc, char **argv) {

 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#if HAVE_PKCS11
+#if USE_PKCS11
 				"pkcs11",
 #else
 				engine,
@@ -52,7 +52,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -106,12 +106,9 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "        name of an OpenSSL engine to use "
-				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
@@ -216,11 +213,7 @@ main(int argc, char **argv) {
 	dst_key_t	*prevkey = NULL;
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
-#ifdef USE_PKCS11
-	const char	*engine = PKCS11_ENGINE;
-#else
 	const char	*engine = NULL;
-#endif
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	int		dbits = 0;
@@ -247,7 +240,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -523,23 +516,12 @@ main(int argc, char **argv) {
 		}

 		if (strcasecmp(algname, "RSA") == 0) {
-#ifndef PK11_MD5_DISABLE
 			fprintf(stderr, "The use of RSA (RSAMD5) is not "
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
 			INSIST(freeit == NULL);
 			return (1);
-#else
-			fprintf(stderr,
-				"The use of RSA (RSAMD5) was disabled\n");
-			INSIST(freeit == NULL);
-			return (1);
-		} else if (strcasecmp(algname, "RSAMD5") == 0) {
-			fprintf(stderr, "The use of RSAMD5 was disabled\n");
-			INSIST(freeit == NULL);
-			return (1);
-#endif
 		} else {
 			r.base = algname;
 			r.length = strlen(algname);
@@ -552,10 +534,6 @@ main(int argc, char **argv) {
 			}
 		}

-#ifdef PK11_MD5_DISABLE
-		INSIST((alg != DNS_KEYALG_RSAMD5));
-#endif
-
 		if (!dst_algorithm_supported(alg)) {
 			fatal("unsupported algorithm: %d", alg);
 		}
@@ -30,7 +30,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -49,12 +49,9 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "    -E engine:    specify OpenSSL engine "
-					   "(default \"pkcs11\")\n");
 #else
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 #endif
@@ -75,11 +72,7 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-#ifdef USE_PKCS11
-	const char *engine = PKCS11_ENGINE;
-#else
 	const char *engine = NULL;
-#endif
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -33,7 +33,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -53,7 +53,7 @@ usage(void) {
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -127,11 +127,7 @@ printtime(dst_key_t *key, int type, const char *tag, isc_boolean_t epoch,
 int
 main(int argc, char **argv) {
 	isc_result_t	result;
-#ifdef USE_PKCS11
-	const char	*engine = PKCS11_ENGINE;
-#else
 	const char	*engine = NULL;
-#endif
 	const char 	*filename = NULL;
 	char		*directory = NULL;
 	char		newname[1024];
@@ -178,7 +174,7 @@ main(int argc, char **argv) {

 	setup_logging(mctx, &log);

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -80,7 +80,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -789,7 +789,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return (isc_safe_memcompare(a, b, hash_length + 1));
+	return (memcmp(a, b, hash_length + 1));
 }

 static void
@@ -3131,12 +3131,9 @@ usage(void) {
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
-				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
@@ -3229,11 +3226,7 @@ main(int argc, char *argv[]) {
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
 	isc_log_t *log = NULL;
-#ifdef USE_PKCS11
-	const char *engine = PKCS11_ENGINE;
-#else
 	const char *engine = NULL;
-#endif
 	isc_boolean_t free_output = ISC_FALSE;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3286,7 +3279,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -62,7 +62,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -150,12 +150,9 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if HAVE_PKCS11
+#if USE_PKCS11
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
-				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
@@ -171,11 +168,7 @@ main(int argc, char *argv[]) {
 	char *inputformatstr = NULL;
 	isc_result_t result;
 	isc_log_t *log = NULL;
-#ifdef USE_PKCS11
-	const char *engine = PKCS11_ENGINE;
-#else
 	const char *engine = NULL;
-#endif
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -212,7 +205,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -61,7 +61,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -84,7 +84,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -94,7 +94,7 @@ set PYTHONPATH=.
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -55,7 +55,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -46,17 +46,17 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${NS_INCLUDES} ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-		${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@

-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@
+CDEFINES =      @CONTRIB_DLZ@

 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@

@@ -51,11 +51,7 @@ options {\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
-#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 "	cookie-algorithm aes;\n"
-#else
-"	cookie-algorithm sha256;\n"
-#endif
 #ifndef WIN32
 "	coresize default;\n\
 	datasize default;\n"
@@ -957,11 +953,9 @@ struct keyalgorithms {
 	unsigned int type;
 	isc_uint16_t size;
 } algorithms[] = {
-#ifndef PK11_MD5_DISABLE
 	{ "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
 	{ "hmac-md5.sig-alg.reg.int", hmacmd5, DST_ALG_HMACMD5, 0 },
 	{ "hmac-md5.sig-alg.reg.int.", hmacmd5, DST_ALG_HMACMD5, 0 },
-#endif
 	{ "hmac-sha1", hmacsha1, DST_ALG_HMACSHA1, 160 },
 	{ "hmac-sha224", hmacsha224, DST_ALG_HMACSHA224, 224 },
 	{ "hmac-sha256", hmacsha256, DST_ALG_HMACSHA256, 256 },
@@ -1008,9 +1002,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,

 	if (name != NULL) {
 		switch (algorithms[i].hmac) {
-#ifndef PK11_MD5_DISABLE
 		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
-#endif
 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 		case hmacsha256: *name = dns_tsig_hmacsha256_name; break;
@@ -142,11 +142,7 @@ EXTERN const char *		named_g_defaultdnstap	INIT(NULL);

 EXTERN const char *		named_g_username	INIT(NULL);

-#if defined(USE_PKCS11)
-EXTERN const char *		named_g_engine		INIT(PKCS11_ENGINE);
-#else
 EXTERN const char *		named_g_engine		INIT(NULL);
-#endif

 EXTERN isc_time_t		named_g_boottime;
 EXTERN isc_time_t		named_g_configtime;
@@ -44,7 +44,7 @@
 #include <dns/view.h>

 #include <dst/result.h>
-#if HAVE_PKCS11
+#if USE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -75,10 +75,8 @@
 #include <named/smf_globals.h>
 #endif

-#if HAVE_OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
-#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/xmlversion.h>
 #endif
@@ -691,7 +689,6 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef __SUNPRO_C
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
-#if HAVE_OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
@@ -703,7 +700,6 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to OpenSSL version: %s\n",
 			       SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#endif
 #ifdef HAVE_LIBXML2
 			printf("compiled with libxml2 version: %s\n",
 			       LIBXML_DOTTED_VERSION);
@@ -722,11 +718,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to zlib version: %s\n",
 			       zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 			printf("threads support is enabled\n");
-#else
-			printf("threads support is disabled\n");
-#endif
 			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
@@ -778,7 +770,6 @@ create_managers(void) {

 	INSIST(named_g_cpus_detected > 0);

-#ifdef ISC_PLATFORM_USETHREADS
 	if (named_g_cpus == 0)
 		named_g_cpus = named_g_cpus_detected;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -787,9 +778,6 @@ create_managers(void) {
 		      named_g_cpus_detected,
 		      named_g_cpus_detected == 1 ? "" : "s",
 		      named_g_cpus, named_g_cpus == 1 ? "" : "s");
-#else
-	named_g_cpus = 1;
-#endif
 #ifdef WIN32
 	named_g_udpdisp = 1;
 #else
@@ -802,12 +790,10 @@ create_managers(void) {
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
-#endif

 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
 				    &named_g_taskmgr);
@@ -834,7 +820,7 @@ create_managers(void) {
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -919,12 +905,10 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */

-#ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
 	 */
 	named_g_cpus_detected = isc_os_ncpus();
-#endif

 	named_os_chroot(named_g_chrootdir);

@@ -1012,7 +996,7 @@ setup(void) {
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with OpenSSL version: %s",
-	              OPENSSL_VERSION_TEXT);
+		      OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
    OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -1051,15 +1035,9 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1358,7 +1336,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 	dst_result_register();
 	isccc_result_register();
-#if HAVE_PKCS11
+#if USE_PKCS11
 	pk11_result_register();
 #endif

@@ -6646,25 +6646,32 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	dns_rdataset_init(&nameservers);
 	result = dns_view_findzonecut(view, origin, domain, 0, 0, ISC_TRUE,
 				      ISC_TRUE, &nameservers, NULL);
-	if (result != ISC_R_SUCCESS) {
-		goto done;
+	if (result == ISC_R_SUCCESS) {
+		result = dns_resolver_createfetch(view->resolver, tatname,
+						  dns_rdatatype_null, domain,
+						  &nameservers, NULL, NULL, 0,
+						  0, 0, NULL, tat->task,
+						  tat_done, tat,
+						  &tat->rdataset,
+						  &tat->sigrdataset,
+						  &tat->fetch);
 	}

-	result = dns_resolver_createfetch(view->resolver, tatname,
-					  dns_rdatatype_null, domain,
-					  &nameservers, NULL, NULL, 0, 0, 0,
-					  NULL, tat->task, tat_done, tat,
-					  &tat->rdataset, &tat->sigrdataset,
-					  &tat->fetch);
-
 	/*
-	 * dns_resolver_createfetch() creates its own copies of 'domain' and
-	 * 'nameservers'; clean up the latter (the former points into a
-	 * dst_key_t structure and thus must not be freed).
+	 * 'domain' holds the dns_name_t pointer inside a dst_key_t structure.
+	 * dns_resolver_createfetch() creates its own copy of 'domain' if it
+	 * succeeds.  Thus, 'domain' is not freed here.
+	 *
+	 * Even if dns_view_findzonecut() returned something else than
+	 * ISC_R_SUCCESS, it still could have associated 'nameservers'.
+	 * dns_resolver_createfetch() creates its own copy of 'nameservers' if
+	 * it succeeds.  Thus, we need to check whether 'nameservers' is
+	 * associated and release it if it is.
 	 */
-	dns_rdataset_disassociate(&nameservers);
+	if (dns_rdataset_isassociated(&nameservers)) {
+		dns_rdataset_disassociate(&nameservers);
+	}

- done:
 	if (result != ISC_R_SUCCESS) {
 		isc_task_detach(&tat->task);
 		isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
@@ -7993,7 +8000,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

 #ifdef HAVE_GEOIP
 	/*
@@ -8865,11 +8872,7 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
-#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 		server->sctx->cookiealg = ns_cookiealg_aes;
-#else
-		INSIST(0);
-#endif
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_sha1;
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0) {
@@ -11205,7 +11208,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	}
 	CHECK(putstr(text, line));

-#ifdef ISC_PLATFORM_USETHREADS
 	snprintf(line, sizeof(line), "CPUs found: %u\n", named_g_cpus_detected);
 	CHECK(putstr(text, line));

@@ -11215,10 +11217,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	snprintf(line, sizeof(line), "UDP listeners per interface: %u\n",
 		 named_g_udpdisp);
 	CHECK(putstr(text, line));
-#else
-	snprintf(line, sizeof(line), "CPUs found: N/A (threads disabled)\n");
-	CHECK(putstr(text, line));
-#endif

 	snprintf(line, sizeof(line), "number of zones: %u (%u automatic)\n",
 		     zonecount, automatic);
@@ -11676,7 +11674,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		    isc_lex_t *lex, isc_buffer_t **text)
 {
 	isc_result_t result, tresult;
-	dns_zone_t *zone = NULL, *raw = NULL;
+	dns_zone_t *mayberaw = NULL, *raw = NULL;
 	dns_zonetype_t type;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
@@ -11685,11 +11683,11 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 	isc_boolean_t frozen;
 	const char *msg = NULL;

-	result = zone_from_args(server, lex, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &mayberaw, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	if (zone == NULL) {
+	if (mayberaw == NULL) {
 		result = isc_task_beginexclusive(server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		tresult = ISC_R_SUCCESS;
@@ -11709,26 +11707,26 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 			      isc_result_totext(tresult));
 		return (tresult);
 	}
-	dns_zone_getraw(zone, &raw);
+	dns_zone_getraw(mayberaw, &raw);
 	if (raw != NULL) {
-		dns_zone_detach(&zone);
-		dns_zone_attach(raw, &zone);
+		dns_zone_detach(&mayberaw);
+		dns_zone_attach(raw, &mayberaw);
 		dns_zone_detach(&raw);
 	}
-	type = dns_zone_gettype(zone);
+	type = dns_zone_gettype(mayberaw);
 	if (type != dns_zone_master) {
-		dns_zone_detach(&zone);
+		dns_zone_detach(&mayberaw);
 		return (DNS_R_NOTMASTER);
 	}

-	if (freeze && !dns_zone_isdynamic(zone, ISC_TRUE)) {
-		dns_zone_detach(&zone);
+	if (freeze && !dns_zone_isdynamic(mayberaw, ISC_TRUE)) {
+		dns_zone_detach(&mayberaw);
 		return (DNS_R_NOTDYNAMIC);
 	}

 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	frozen = dns_zone_getupdatedisabled(zone);
+	frozen = dns_zone_getupdatedisabled(mayberaw);
 	if (freeze) {
 		if (frozen) {
 			msg = "WARNING: The zone was already frozen.\n"
@@ -11737,16 +11735,16 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 			result = DNS_R_FROZEN;
 		}
 		if (result == ISC_R_SUCCESS) {
-			result = dns_zone_flush(zone);
+			result = dns_zone_flush(mayberaw);
 			if (result != ISC_R_SUCCESS)
 				msg = "Flushing the zone updates to "
 				      "disk failed.";
 		}
 		if (result == ISC_R_SUCCESS)
-			dns_zone_setupdatedisabled(zone, freeze);
+			dns_zone_setupdatedisabled(mayberaw, freeze);
 	} else {
 		if (frozen) {
-			result = dns_zone_loadandthaw(zone);
+			result = dns_zone_loadandthaw(mayberaw);
 			switch (result) {
 			case ISC_R_SUCCESS:
 			case DNS_R_UPTODATE:
@@ -11769,7 +11767,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		(void) putnull(text);
 	}

-	view = dns_zone_getview(zone);
+	view = dns_zone_getview(mayberaw);
 	if (strcmp(view->name, "_default") == 0 ||
 	    strcmp(view->name, "_bind") == 0)
 	{
@@ -11779,9 +11777,9 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		vname = view->name;
 		sep = " ";
 	}
-	dns_rdataclass_format(dns_zone_getclass(zone), classstr,
+	dns_rdataclass_format(dns_zone_getclass(mayberaw), classstr,
 			      sizeof(classstr));
-	dns_name_format(dns_zone_getorigin(zone),
+	dns_name_format(dns_zone_getorigin(mayberaw),
 			zonename, sizeof(zonename));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -11789,7 +11787,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		      freeze ? "freezing" : "thawing",
 		      zonename, classstr, sep, vname,
 		      isc_result_totext(result));
-	dns_zone_detach(&zone);
+	dns_zone_detach(&mayberaw);
 	return (result);
 }

@@ -14928,6 +14926,7 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
 	isc_boolean_t wantstatus = ISC_FALSE;
 	isc_result_t result = ISC_R_SUCCESS;
+	isc_boolean_t exclusive = ISC_FALSE;

 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -14979,6 +14978,7 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,

 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	exclusive = ISC_TRUE;

 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
@@ -15034,12 +15034,14 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 		}
 		found = ISC_TRUE;
 	}
-	isc_task_endexclusive(named_g_server->task);

 	if (!found)
 		result = ISC_R_NOTFOUND;

 cleanup:
+	if (exclusive)
+		isc_task_endexclusive(named_g_server->task);
+
 	if (isc_buffer_usedlength(*text) > 0)
 		(void) putnull(text);

@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@

 CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
-		${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
+		${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@

 CDEFINES =
 CWARNINGS =
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@@USE_GSSAPI@BUILDER="Visual Studio";_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@USE_GSSAPI@BUILDER="Visual Studio";_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@@USE_GSSAPI@BUILDER="Visual Studio";NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@USE_GSSAPI@BUILDER="Visual Studio";NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -1309,7 +1309,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS,
 					   ISC_TRUE);
 			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
-					   ISC_TRUE);
+					   ISC_FALSE);
 		} else
 			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
 					   ixfrdiff);
@@ -21,15 +21,15 @@ DST_GSSAPI_INC = @DST_GSSAPI_INC@

 CINCLUDES =	${DNS_INCLUDES} ${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${ISCCFG_INCLUDES} ${IRS_INCLUDES} ${DST_GSSAPI_INC} \
-		@DST_OPENSSL_INC@
+		@OPENSSL_INCLUDES@

 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_GSSAPI@
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 IRSLIBS =	../../lib/irs/libirs.@A@

@@ -399,7 +399,6 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 	/* Copy len bytes and NUL terminate. */
 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));

-#ifndef PK11_MD5_DISABLE
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		*hmac = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
@@ -410,9 +409,7 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 			return (ISC_FALSE);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
-	} else
-#endif
-	if (strcasecmp(buf, "hmac-sha1") == 0) {
+	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
 		*hmac = DNS_TSIG_HMACSHA1_NAME;
 	} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
 		*hmac = DNS_TSIG_HMACSHA1_NAME;
@@ -515,11 +512,7 @@ setup_keystr(void) {
 			exit(1);
 		}
 	} else {
-#ifndef PK11_MD5_DISABLE
 		hmacname = DNS_TSIG_HMACMD5_NAME;
-#else
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
-#endif
 		name = keystr;
 		n = s;
 	}
@@ -653,11 +646,9 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	}

 	switch (dst_key_alg(dstkey)) {
-#ifndef PK11_MD5_DISABLE
 	case DST_ALG_HMACMD5:
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 		break;
-#endif
 	case DST_ALG_HMACSHA1:
 		hmacname = DNS_TSIG_HMACSHA1_NAME;
 		break;
@@ -1581,12 +1572,9 @@ evaluate_key(char *cmdline) {
 			return (STATUS_SYNTAX);
 		}
 		namestr = n + 1;
-	} else
-#ifndef PK11_MD5_DISABLE
+	} else {
 		hmacname = DNS_TSIG_HMACMD5_NAME;
-#else
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
-#endif
+	}

 	isc_buffer_init(&b, namestr, strlen(namestr));
 	isc_buffer_add(&b, strlen(namestr));
@@ -53,7 +53,7 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@@USE_GSSAPI@USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@USE_GSSAPI@USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@@USE_GSSAPI@USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@USE_GSSAPI@USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -17,7 +17,7 @@ CINCLUDES =	${ISC_INCLUDES}

 CDEFINES =

-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@

 ISCDEPLIBS =	../../lib/isc/libisc.@A@

@@ -1,94 +0,0 @@
-
-			BIND-9 PKCS#11 support
-
-Prerequisite
-
-The PKCS#11 support needs a PKCS#11 OpenSSL engine based on the Solaris one,
-released the 2008-12-02 for OpenSSL 0.9.8i, with back port of key by reference
-and some improvements, including user friendly PIN management. You may also
-use the original engine code.
-
-Compilation
-
-"configure --with-pkcs11 ..."
-
-PKCS#11 Libraries
-
-Tested with Solaris one with a SCA board and with openCryptoki with the
-software token. Known to work on Linux and Windows 2003 server so
-should work on most operating systems. For AEP Keyper or any device used
-only for its protected key store, please switch to the sign-only engine.
-
-OpenSSL Engines
-
-With PKCS#11 support the PKCS#11 engine is statically loaded but at its
-initialization it dynamically loads the PKCS#11 objects.
-Even the pre commands are therefore unused they are defined with:
- SO_PATH:
-   define: PKCS11_SO_PATH
-   default: /usr/local/lib/engines/engine_pkcs11.so
- MODULE_PATH:
-   define: PKCS11_MODULE_PATH
-   default: /usr/lib/libpkcs11.so
-Without PKCS#11 support, a specific OpenSSL engine can be still used
-by defining ENGINE_ID at compile time.
-
-PKCS#11 tools
-
-The contrib/pkcs11-keygen directory contains a set of experimental tools
-to handle keys stored in a Hardware Security Module at the benefit of BIND.
-
-The patch for OpenSSL 0.9.8i is in this directory. Read its README.pkcs11
-for the way to use it (these are the original notes so with the original
-path, etc. Define HAVE_GETPASSPHRASE if you have getpassphrase() on
-a operating system which is not Solaris.)
-
-Not all tools are supported on AEP Keyper but genkey and dnssec-keyfromlabel
-are functional.
-
-PIN management
-
-With the just fixed PKCS#11 OpenSSL engine, the PIN should be entered
-each time it is required. With the improved engine, the PIN should be
-entered the first time it is required or can be configured in the
-OpenSSL configuration file (aka. openssl.cnf) by adding in it:
- - at the beginning:
-	openssl_conf = openssl_def
- - at any place these sections:
-	[ openssl_def ]
-	engines = engine_section
-	[ engine_section ]
-	pkcs11 = pkcs11_section
-	[ pkcs11_section ]
-	PIN = put__your__pin__value__here
-
-Slot management
-
-The engine tries to use the first best slot but it is recommended
-to simply use the slot 0 (usual default, meta-slot on Solaris).
-
-Sign-only engine
-
-openssl.../crypto/engine/hw_pk11-kp.c and hw_pk11_pub-kp.c contain
-a stripped down version of hw_pk11.c and hw_pk11_pub.c files which
-has only the useful functions (i.e., signature with a RSA private
-key in the device protected key store and key loading).
-
-This engine should be used with a device which provides mainly
-a protected store and no acceleration. AEP Keyper is an example
-of such a device (BTW with the fully capable engine, key export
-must be enabled on this device and this configuration is not yet
-supported).
-
-Original engine
-
-If you are using the original engine and getpassphrase() is not defined, add:
-#define getpassphrase(x) getpass(x)
-in openssl.../crypto/engine/hw_pk11_pub.c
-
-Notes
-
-Some names here are registered trademarks, at least Solaris is a trademark
-of Sun Microsystems Inc...
-Include files are from RSA Labs., PKCS#11 version is 2.20 amendment 3.
-The PKCS#11 support is compatible with the forthcoming FIPS 140-2 support.
@@ -67,10 +67,6 @@
 #define sleep(x)	Sleep(x)
 #endif

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 int
 main(int argc, char *argv[]) {
 	isc_result_t result;
@@ -149,8 +145,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -67,18 +67,14 @@
 #include <isc/print.h>
 #include <isc/result.h>
 #include <isc/types.h>
+#include <isc/util.h>

 #include <pk11/pk11.h>
 #include <pk11/result.h>
 #define WANT_DH_PRIMES
-#define WANT_ECC_CURVES
 #include <pk11/constants.h>
 #include <pkcs11/eddsa.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 /* Define static key template values */
 static CK_BBOOL truevalue = TRUE;
 static CK_BBOOL falsevalue = FALSE;
@@ -403,7 +399,7 @@ main(int argc, char *argv[]) {
 		public_template[RSA_PUBLIC_EXPONENT].ulValueLen = expsize;
 		break;
 	case key_ecc:
-		op_type = OP_EC;
+		op_type = OP_ECDSA;
 		if (bits == 0)
 			bits = 256;
 		else if (bits != 256 && bits != 384) {
@@ -435,8 +431,8 @@ main(int argc, char *argv[]) {
 #ifndef CKM_EDDSA_KEY_PAIR_GEN
 		fprintf(stderr, "CKM_EDDSA_KEY_PAIR_GEN is not defined\n");
 		usage();
-#endif
-		op_type = OP_EC;
+#else
+		op_type = OP_EDDSA;
 		if (bits == 0)
 			bits = 256;
 		else if (bits != 256 && bits != 456) {
@@ -463,6 +459,7 @@ main(int argc, char *argv[]) {
 				sizeof(pk11_ecc_ed448);
 		}

+#endif
 		break;
 	case key_dsa:
 		op_type = OP_DSA;
@@ -562,8 +559,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)		getpass(x)
-#endif
-
 int
 main(int argc, char *argv[]) {
 	isc_result_t result;
@@ -143,8 +139,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (logon && pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (logon && pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_FALSE,
 				  logon, pin, slot);
@@ -23,8 +23,8 @@ CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@

@@ -668,23 +668,21 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	secretstr = cfg_obj_asstring(secretobj);
 	algorithmstr = cfg_obj_asstring(algorithmobj);

-#ifndef PK11_MD5_DISABLE
-	if (strcasecmp(algorithmstr, "hmac-md5") == 0)
+	if (strcasecmp(algorithmstr, "hmac-md5") == 0) {
 		algorithm = ISCCC_ALG_HMACMD5;
-	else
-#endif
-	if (strcasecmp(algorithmstr, "hmac-sha1") == 0)
+	} else if (strcasecmp(algorithmstr, "hmac-sha1") == 0) {
 		algorithm = ISCCC_ALG_HMACSHA1;
-	else if (strcasecmp(algorithmstr, "hmac-sha224") == 0)
+	} else if (strcasecmp(algorithmstr, "hmac-sha224") == 0) {
 		algorithm = ISCCC_ALG_HMACSHA224;
-	else if (strcasecmp(algorithmstr, "hmac-sha256") == 0)
+	} else if (strcasecmp(algorithmstr, "hmac-sha256") == 0) {
 		algorithm = ISCCC_ALG_HMACSHA256;
-	else if (strcasecmp(algorithmstr, "hmac-sha384") == 0)
+	} else if (strcasecmp(algorithmstr, "hmac-sha384") == 0) {
 		algorithm = ISCCC_ALG_HMACSHA384;
-	else if (strcasecmp(algorithmstr, "hmac-sha512") == 0)
+	} else if (strcasecmp(algorithmstr, "hmac-sha512") == 0) {
 		algorithm = ISCCC_ALG_HMACSHA512;
-	else
+	} else {
 		fatal("unsupported algorithm: %s", algorithmstr);
+	}

 	secret.rstart = (unsigned char *)secretarray;
 	secret.rend = (unsigned char *)secretarray + sizeof(secretarray);
@@ -14,15 +14,15 @@ top_srcdir =	@top_srcdir@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		@DST_OPENSSL_INC@
+		@OPENSSL_INCLUDES@

 CDEFINES =
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 ISCCFGLIBS = 	../../lib/isccfg/libisccfg.@A@

 DNSDEPLIBS =	../../lib/dns/libdns.@A@
@@ -14,7 +14,7 @@ top_srcdir =	@top_srcdir@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@

 CDEFINES =	@USE_GSSAPI@

@@ -22,8 +22,8 @@ CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@

 DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 ISCCFGLIBS = 	../../../lib/isccfg/libisccfg.@A@

 DNSDEPLIBS =	../../../lib/dns/libdns.@A@
@@ -44,10 +44,8 @@ int
 main(int argc, char **argv) {
 	isc_sha1_t sha1;
 	isc_sha224_t sha224;
-#ifndef PK11_MD5_DISABLE
 	isc_md5_t md5;
 	isc_hmacmd5_t hmacmd5;
-#endif
 	isc_hmacsha1_t hmacsha1;
 	isc_hmacsha224_t hmacsha224;
 	isc_hmacsha256_t hmacsha256;
@@ -89,7 +87,6 @@ main(int argc, char **argv) {
 	isc_sha224_final(digest, &sha224);
 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);

-#ifndef PK11_MD5_DISABLE
 	s = "abc";
 	isc_md5_init(&md5);
 	memmove(buffer, s, strlen(s));
@@ -127,7 +124,6 @@ main(int argc, char **argv) {
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
 	isc_hmacmd5_sign(&hmacmd5, digest);
 	print_digest(s, "hmacmd5", digest, 4);
-#endif

 	/*
 	 * The 3 HMAC-SHA1 examples from RFC4634.
@@ -25,8 +25,6 @@
 #define sleep(x)	Sleep(1000 * x)
 #endif

-#ifdef ISC_PLATFORM_USETHREADS
-
 isc_rwlock_t lock;

 static isc_threadresult_t
@@ -130,15 +128,3 @@ main(int argc, char *argv[]) {

 	return (0);
 }
-
-#else
-
-int
-main(int argc, char *argv[]) {
-	UNUSED(argc);
-	UNUSED(argv);
-	fprintf(stderr, "This test requires threads.\n");
-	return(1);
-}
-
-#endif
@@ -13,31 +13,17 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-PROVIDER =	@PKCS11_PROVIDER@
-
 CINCLUDES =	${ISC_INCLUDES}
+CDEFINES =

-CDEFINES =	-DPK11_LIB_LOCATION=\"${PROVIDER}\"
-
-ISCLIBS =	../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@

 LIBS =		${ISCLIBS} @LIBS@

 SUBDIRS =	benchmarks

-TARGETS =	pkcs11-md5sum@EXEEXT@ pkcs11-hmacmd5@EXEEXT@
-SRCS =		pkcs11-md5sum.c pkcs11-hmacmd5.c
-
@BIND9_MAKE_RULES@

-pkcs11-md5sum@EXEEXT@: @srcdir@/pkcs11-md5sum.c
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
-		-o $@ @srcdir@/pkcs11-md5sum.c ${LIBS}
-
-pkcs11-hmacmd5@EXEEXT@: @srcdir@/pkcs11-hmacmd5.c
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
-		-o $@ @srcdir@/pkcs11-hmacmd5.c ${LIBS}
-
 test:

 clean distclean::
@@ -13,24 +13,21 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-PROVIDER =	@PKCS11_PROVIDER@
-
 CINCLUDES =	${ISC_INCLUDES}
+CDEFINES =

-CDEFINES =	-DPK11_LIB_LOCATION=\"${PROVIDER}\"
-
-ISCLIBS =	../../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@

 LIBS =		${ISCLIBS} @LIBS@

 SUBDIRS =

-TARGETS =	session@EXEEXT@ login@EXEEXT@ random@EXEEXT@ \
-		sha1@EXEEXT@ create@EXEEXT@ find@EXEEXT@ \
+TARGETS =	session@EXEEXT@ login@EXEEXT@ \
+		create@EXEEXT@ find@EXEEXT@ \
 		pubrsa@EXEEXT@ privrsa@EXEEXT@ genrsa@EXEEXT@ \
 		sign@EXEEXT@ verify@EXEEXT@

-SRCS =		session.c login.c random.c sha1.c create.c find.c \
+SRCS =		session.c login.c create.c find.c \
 		pubrsa.c privrsa.c genrsa.c sign.c verify.c

@BIND9_MAKE_RULES@
@@ -43,14 +40,6 @@ login@EXEEXT@: @srcdir@/login.c
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
 		-o $@ @srcdir@/login.c ${LIBS}

-random@EXEEXT@: @srcdir@/random.c
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
-		-o $@ @srcdir@/random.c ${LIBS}
-
-sha1@EXEEXT@: @srcdir@/sha1.c
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
-		-o $@ @srcdir@/sha1.c ${LIBS}
-
 create@EXEEXT@: @srcdir@/create.c
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} \
 		-o $@ @srcdir@/create.c ${LIBS}
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -175,7 +171,7 @@ main(int argc, char *argv[]) {
 		pk11_set_lib_name(lib_name);

 	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+		pin = getpass("Enter Pin: ");

 	result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -54,10 +54,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -152,8 +148,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -201,8 +197,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/internal.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -149,8 +145,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
+	}

 	rv = pkcs_C_Initialize(NULL_PTR);
 	if (rv != CKR_OK) {
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -279,8 +275,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -200,8 +196,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -1,195 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-/* random [-m module] [-s $slot] [-n count] */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <unistd.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-#ifndef HAVE_CLOCK_GETTIME
-
-#include <sys/time.h>
-
-#ifndef CLOCK_REALTIME
-#define CLOCK_REALTIME 0
-#endif
-
-static int clock_gettime(int32_t id, struct timespec *tp);
-
-static int
-clock_gettime(int32_t id, struct timespec *tp)
-{
-	struct timeval tv;
-	int result;
-
-	UNUSED(id);
-
-	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
-	return (result);
-}
-#endif
-
-CK_BYTE buf[1024];
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
-	CK_ULONG len = sizeof(buf);
-	pk11_context_t pctx;
-	pk11_optype_t op_type = OP_RAND;
-	char *lib_name = NULL;
-	int error = 0;
-	int c, errflg = 0;
-	unsigned int count = 1000;
-	unsigned int i;
-	struct timespec starttime;
-	struct timespec endtime;
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:s:n:")) != -1) {
-		switch (c) {
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			op_type = OP_ANY;
-			break;
-		case 'n':
-			count = atoi(isc_commandline_argument);
-			break;
-		case ':':
-			fprintf(stderr,
-				"Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr,
-			"\trandom [-m module] [-s slot] [-n count]\n");
-		exit(1);
-	}
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
-		pk11_set_lib_name(lib_name);
-
-	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE,
-				  ISC_FALSE, NULL, slot);
-	if ((result != ISC_R_SUCCESS) &&
-	    (result != PK11_R_NODIGESTSERVICE) &&
-	    (result != PK11_R_NOAESSERVICE)) {
-		fprintf(stderr, "Error initializing PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	hSession = pctx.session;
-
-	if (clock_gettime(CLOCK_REALTIME, &starttime) < 0) {
-		perror("clock_gettime(start)");
-		goto exit_session;
-	}
-
-	for (i = 0; i < count; i++) {
-		/* Get random bytes */
-		rv = pkcs_C_GenerateRandom(hSession, buf, len);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_GenerateRandom[%u]: Error = 0x%.8lX\n",
-				i, rv);
-			error = 1;
-			break;
-		}
-	}
-
-	if (clock_gettime(CLOCK_REALTIME, &endtime) < 0) {
-		perror("clock_gettime(end)");
-		goto exit_session;
-	}
-
-	endtime.tv_sec -= starttime.tv_sec;
-	endtime.tv_nsec -= starttime.tv_nsec;
-	while (endtime.tv_nsec < 0) {
-		endtime.tv_sec -= 1;
-		endtime.tv_nsec += 1000000000;
-	}
-	printf("%uK random bytes in %ld.%09lds\n", i,
-	       endtime.tv_sec, endtime.tv_nsec);
-	if (i > 0)
-		printf("%g random bytes/s\n",
-		       1024 * i / ((double) endtime.tv_sec +
-				   (double) endtime.tv_nsec / 1000000000.));
-
-    exit_session:
-	pk11_return_session(&pctx);
-	(void) pk11_finalize();
-
-	exit(error);
-}
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -272,8 +268,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -55,10 +55,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>

-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
 #ifndef HAVE_CLOCK_GETTIME

 #include <sys/time.h>
@@ -193,8 +189,9 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	if (pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
+	if (pin == NULL) {
+		pin = getpass("Enter Pin: ");
+	}

 	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
 				  ISC_TRUE, (const char *) pin, slot);
@@ -1,327 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-/*
- * pkcs11-hmacmd5
- *
- * Prints the MD5 HMAC of the standard input, using the PKCS#11 device.
- *
- * Usage:
- * pkcs11-hmacmd5 [-m module] [-s $slot] [-n] [-p $pin]
- *  -m: PKCS#11 provider module.  This must be the full
- *      path to a shared library object implementing the
- *      PKCS#11 API for a device.
- *  -s: Slot
- *  -p: PIN
- *  -n: don't log in to the PKCS#11 device
- *  -k: key name for the HMAC
- */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
-/* Define static key template values */
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-#define BLOCKSIZE	32768
-
-char buffer[BLOCKSIZE + 72];
-char digest[16];
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_SESSION_HANDLE hSession;
-	CK_MECHANISM mech = { CKM_MD5_HMAC, NULL, 0 };
-	CK_ULONG len;
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
-	CK_KEY_TYPE keyType = CKK_MD5_HMAC;
-	CK_ATTRIBUTE keyTemplate[] =
-	{
-		{ CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
-		{ CKA_VALUE, NULL, 0 }
-	};
-	pk11_context_t pctx;
-	pk11_optype_t op_type = OP_DIGEST;
-	char *lib_name = NULL;
-	char *pin = NULL;
-	int error = 0;
-	isc_boolean_t logon = ISC_TRUE;
-	int c, errflg = 0;
-	char *key = NULL;
-	size_t sum = 0;
-	unsigned int i;
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:s:np:k:")) != -1) {
-		switch (c) {
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			op_type = OP_ANY;
-			break;
-		case 'n':
-			logon = ISC_FALSE;
-			break;
-		case 'p':
-			pin = isc_commandline_argument;
-			break;
-		case 'k':
-			key = isc_commandline_argument;
-			break;
-		case ':':
-			fprintf(stderr,
-				"Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg || (key == NULL)) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr,
-			"\tpkcs11-hmacmd5 [-m module] [-s slot] "
-			"[-n|-p pin] -k key\n");
-		exit(1);
-	}
-
-	/* Decode the key */
-	for (i = 0; i < BLOCKSIZE / 2; i++) {
-		switch (c = *key++) {
-		case 0:
-			goto key_done;
-		case '0':
-		case '1':
-		case '2':
-		case '3':
-		case '4':
-		case '5':
-		case '6':
-		case '7':
-		case '8':
-		case '9':
-			if ((i & 1) == 0)
-				buffer[i >> 1] = (c - '0') << 4;
-			else
-				buffer[i >> 1] |= c - '0';
-			break;
-		case 'A':
-		case 'B':
-		case 'C':
-		case 'D':
-		case 'E':
-		case 'F':
-			if ((i & 1) == 0)
-				buffer[i >> 1] = (c - 'A' + 10) << 4;
-			else
-				buffer[i >> 1] |= c - 'A' + 10;
-			break;
-		case 'a':
-		case 'b':
-		case 'c':
-		case 'd':
-		case 'e':
-		case 'f':
-			if ((i & 1) == 0)
-				buffer[i >> 1] = (c - 'a' + 10) << 4;
-			else
-				buffer[i >> 1] |= c - 'a' + 10;
-			break;
-		default:
-			fprintf(stderr, "Not hexdigit '%c' in key\n", c);
-			exit(1);
-		}
-	}
-    key_done:
-	if ((i & 1) != 0) {
-		fprintf(stderr, "Even number of hexdigits in key\n");
-		exit(1);
-	}
-	len = i >> 1;
-	keyTemplate[5].pValue = buffer;
-	keyTemplate[5].ulValueLen = (CK_ULONG) len;
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
-		pk11_set_lib_name(lib_name);
-
-	if (logon && pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
-
-	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE, logon,
-				  (const char *) pin, slot);
-	if ((result != ISC_R_SUCCESS) &&
-	    (result != PK11_R_NORANDOMSERVICE) &&
-	    (result != PK11_R_NOAESSERVICE)) {
-		fprintf(stderr, "Error initializing PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	if (pin != NULL)
-		memset(pin, 0, strlen((char *)pin));
-
-	hSession = pctx.session;
-
-	rv = pkcs_C_CreateObject(hSession, keyTemplate, (CK_ULONG) 6, &hKey);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_CreateObject: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-	if (hKey == CK_INVALID_HANDLE) {
-		fprintf(stderr, "C_CreateObject failed\n");
-		error = 1;
-		goto exit_session;
-	}
-
-	rv = pkcs_C_SignInit(hSession, &mech, hKey);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_SignInit: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_sign;
-	}
-
-	for (;;) {
-		size_t n;
-
-		for (;;) {
-			n = fread(buffer + sum, 1, BLOCKSIZE - sum, stdin);
-			sum += n;
-			if (sum == BLOCKSIZE)
-				break;
-			if (n == 0) {
-				if (ferror(stdin)) {
-					fprintf(stderr, "fread failed\n");
-					error = 1;
-					goto exit_sign;
-				}
-				goto partial_block;
-			}
-			if (feof(stdin))
-				goto partial_block;
-		}
-
-		rv = pkcs_C_SignUpdate(hSession, (CK_BYTE_PTR) buffer,
-				       (CK_ULONG) BLOCKSIZE);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_SignUpdate: Error = 0x%.8lX\n",
-				rv);
-			error = 1;
-			goto exit_sign;
-		}
-	}
-
-partial_block:
-	if (sum > 0) {
-		rv = pkcs_C_SignUpdate(hSession, (CK_BYTE_PTR) buffer,
-				       (CK_ULONG) sum);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_SignUpdate: Error = 0x%.8lX\n",
-				rv);
-			error = 1;
-			goto exit_sign;
-		}
-	}
-
-	len = 16;
-	rv = pkcs_C_SignFinal(hSession, (CK_BYTE_PTR) digest, &len);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_SignFinal: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_sign;
-	}
-	if (len != 16) {
-		fprintf(stderr, "C_SignFinal: bad length = %lu\n", len);
-		error = 1;
-	}
-
-	for (i = 0; i < 16; i++)
-		printf("%02x", digest[i] & 0xff);
-	printf("\n");
-
-    exit_sign:
-	rv = pkcs_C_DestroyObject(hSession, hKey);
-	if ((error == 0) && (rv != CKR_OK)) {
-		fprintf(stderr, "C_DestroyObject: Error = 0x%.8lX\n", rv);
-		error = 1;
-	}
-
-    exit_session:
-	pk11_return_session(&pctx);
-	(void) pk11_finalize();
-
-	exit(error);
-}
@@ -1,230 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-/*
- * pkcs11-md5sum
- *
- * Prints the MD5 checksum of the standard input, using the PKCS#11 device.
- *
- * Usage:
- * pkcs11-md5sum [-m module] [-s $slot] [-n] [-p $pin]
- *  -m: PKCS#11 provider module.  This must be the full
- *      path to a shared library object implementing the
- *      PKCS#11 API for a device.
- *  -s: Slot
- *  -p: PIN
- *  -n: don't log in to the PKCS#11 device
- */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
-#define getpassphrase(x)	getpass(x)
-#endif
-
-#define BLOCKSIZE	32768
-
-char buffer[BLOCKSIZE + 72];
-char digest[16];
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_SESSION_HANDLE hSession;
-	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-	CK_ULONG len;
-	pk11_context_t pctx;
-	pk11_optype_t op_type = OP_DIGEST;
-	char *lib_name = NULL;
-	char *pin = NULL;
-	int error = 0;
-	isc_boolean_t logon = ISC_TRUE;
-	int c, errflg = 0;
-	size_t sum = 0;
-	unsigned int i;
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:s:np:")) != -1) {
-		switch (c) {
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			op_type = OP_ANY;
-			break;
-		case 'n':
-			logon = ISC_FALSE;
-			break;
-		case 'p':
-			pin = isc_commandline_argument;
-			break;
-		case ':':
-			fprintf(stderr,
-				"Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr,
-			"\tpkcs11-md5sum [-m module] [-s slot] [-n|-p pin]\n");
-		exit(1);
-	}
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
-		pk11_set_lib_name(lib_name);
-
-	if (logon && pin == NULL)
-		pin = getpassphrase("Enter Pin: ");
-
-	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE, logon,
-				  (const char *) pin, slot);
-	if ((result != ISC_R_SUCCESS) &&
-	    (result != PK11_R_NORANDOMSERVICE) &&
-	    (result != PK11_R_NOAESSERVICE)) {
-		fprintf(stderr, "Error initializing PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	if (pin != NULL)
-		memset(pin, 0, strlen((char *)pin));
-
-	hSession = pctx.session;
-
-	rv = pkcs_C_DigestInit(hSession, &mech);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_DigestInit: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-
-	for (;;) {
-		size_t n;
-
-		for (;;) {
-			n = fread(buffer + sum, 1, BLOCKSIZE - sum, stdin);
-			sum += n;
-			if (sum == BLOCKSIZE)
-				break;
-			if (n == 0) {
-				if (ferror(stdin)) {
-					fprintf(stderr, "fread failed\n");
-					error = 1;
-					goto exit_session;
-				}
-				goto partial_block;
-			}
-			if (feof(stdin))
-				goto partial_block;
-		}
-
-		rv = pkcs_C_DigestUpdate(hSession, (CK_BYTE_PTR) buffer,
-					 (CK_ULONG) BLOCKSIZE);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_DigestUpdate: Error = 0x%.8lX\n",
-				rv);
-			error = 1;
-			goto exit_session;
-		}
-	}
-
-partial_block:
-	if (sum > 0) {
-		rv = pkcs_C_DigestUpdate(hSession, (CK_BYTE_PTR) buffer,
-					 (CK_ULONG) sum);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_DigestUpdate: Error = 0x%.8lX\n",
-				rv);
-			error = 1;
-			goto exit_session;
-		}
-	}
-
-	len = 16;
-	rv = pkcs_C_DigestFinal(hSession, (CK_BYTE_PTR) digest, &len);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_DigestFinal: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-	if (len != 16) {
-		fprintf(stderr, "C_DigestFinal: bad length = %lu\n", len);
-		error = 1;
-	}
-
-	for (i = 0; i < 16; i++)
-		printf("%02x", digest[i] & 0xff);
-	printf("\n");
-
-    exit_session:
-	pk11_return_session(&pctx);
-	(void) pk11_finalize();
-
-	exit(error);
-}
@@ -23,7 +23,7 @@ CDEFINES =	@USE_GSSAPI@
 CWARNINGS =

 DNSLIBS =
-ISCLIBS =	../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@

 DNSDEPLIBS =
 ISCDEPLIBS =
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -81,6 +81,21 @@ in_cache () {
        return 0
 }

+# Extract records at and below name "$1" from the cache dump in file "$2".
+filter_tree () {
+	tree="$1"
+	file="$2"
+	perl -n -e '
+		next if /^;/;
+		if (/'"$tree"'/ || (/^\t/ && $print)) {
+			$print = 1;
+		} else {
+			$print = 0;
+		}
+		print if $print;
+	' "$file"
+}
+
 n=`expr $n + 1`
 echo_i "check correctness of routine cache cleaning ($n)"
 $DIG $DIGOPTS +tcp +keepopen -b 10.53.0.7 -f dig.batch > dig.out.ns2 || status=1
@@ -98,8 +113,8 @@ echo_i "reset and check that records are correctly cached initially ($n)"
 ret=0
 load_cache
 dump_cache
-nrecords=`grep flushtest.example ns2/named_dump.db.$n | grep -v '^;' | egrep '(TXT|ANY)'|  wc -l`
-[ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.$n | egrep '(TXT|ANY)' | wc -l`
+[ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -108,7 +123,7 @@ echo_i "check flushing of the full cache ($n)"
 ret=0
 clear_cache
 dump_cache
-nrecords=`grep flushtest.example ns2/named_dump.db.$n | grep -v '^;' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.$n | wc -l`
 [ $nrecords -eq 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -192,7 +207,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`grep flushtest.example ns2/named_dump.db.$n | grep -v '^;' | egrep '(TXT|ANY)' |  wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.$n | grep -v '^;' | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -210,7 +225,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`grep flushtest.example ns2/named_dump.db.$n | grep -v '^;' | egrep '(TXT|ANY)' |  wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.$n | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL ../testcrypto.sh || exit 255
-
 if test -n "$PYTHON"
 then
    if $PYTHON -c "import dns" 2> /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -12,8 +12,7 @@ SYSTEMTESTTOP=..

 status=0
 n=0
-# using dig insecure mode as not testing dnssec here
-DIGOPTS="-i -p ${PORT}"
+DIGOPTS="-p ${PORT}"
 SENDCMD="$PERL $SYSTEMTESTTOP/send.pl 10.53.0.4 ${EXTRAPORT1}"

 if [ -x ${DIG} ] ; then
@@ -443,23 +442,6 @@ if [ -x ${DIG} ] ; then
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`

-  n=`expr $n + 1`
-  if $FEATURETEST --with-idn
-  then
-    echo_i "checking dig +idnout ($n)"
-    ret=0
-    $DIG $DIGOPTS @10.53.0.3 +noidnout xn--caf-dma.example. > dig.out.1.test$n 2>&1 || ret=1
-    $DIG $DIGOPTS @10.53.0.3 +idnout xn--caf-dma.example. > dig.out.2.test$n 2>&1 || ret=1
-    grep "^xn--caf-dma.example" dig.out.1.test$n > /dev/null || ret=1
-    grep "^xn--caf-dma.example" dig.out.2.test$n > /dev/null && ret=1
-    grep 10.1.2.3 dig.out.1.test$n > /dev/null || ret=1
-    grep 10.1.2.3 dig.out.2.test$n > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-  else
-    echo_i "skipping 'dig +idnout' as IDN support is not enabled ($n)"
-  fi
-
  n=`expr $n + 1`
  echo_i "checking that dig warns about .local queries ($n)"
  ret=0
@@ -517,6 +499,19 @@ else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi

+MDIGOPTS="-p ${PORT}"
+if [ -x ${MDIG} ] ; then
+  n=`expr $n + 1`
+  echo_i "check that mdig handles malformed option '+ednsopt=:' gracefully ($n)"
+  ret=0
+  $MDIG $MDIGOPTS @10.53.0.3 +ednsopt=: a.example > dig.out.test$n 2>&1 && ret=1
+  grep "ednsopt no code point specified" dig.out.test$n > /dev/null || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+else
+  echo_i "$MDIG is needed, so skipping these mdig tests"
+fi
+
 # using delv insecure mode as not testing dnssec here
 DELVOPTS="-i -p ${PORT}"

@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
 CDEFINES =
 CWARNINGS =

@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -23,4 +23,4 @@ then
    fi
 fi

-exec $SHELL ../testcrypto.sh
+exit 0
@@ -1,23 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-ecdsafail=0
-$SHELL ../testcrypto.sh -q ecdsa || ecdsafail=1
-
-if [ $ecdsafail = 1 ]; then
-	echo_i "This test requires support for ECDSA cryptography." >&2
-	exit 255
-else
-        echo ecdsa > supported
-fi
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@

 CDEFINES =
 CWARNINGS =

 DNSLIBS =	../../../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@

 DNSDEPLIBS =	../../../../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../../../../lib/isc/libisc.@A@
@@ -1,15 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh ecdsa
@@ -1,125 +0,0 @@
-; File written on Mon Oct 16 09:16:28 2017
-; dnssec_signzone version 9.11.2
-signed.			120	IN SOA	ns.signed. hostmaster.ns.signed. (
-					1          ; serial
-					3600       ; refresh (1 hour)
-					1200       ; retry (20 minutes)
-					604800     ; expire (1 week)
-					60         ; minimum (1 minute)
-					)
-			120	RRSIG	SOA 3 1 120 (
-					20820519023008 20140501011600 17876 signed.
-					BJDbUrXS4UzBrTeNUMA0sSGYd+h9M5d8qzsE
-					q7RJyDtUNJIwP5vAnSQ= )
-			120	NS	ns.signed.
-			120	RRSIG	NS 3 1 120 (
-					20820519023008 20140501011600 17876 signed.
-					BGoYuOkkcTAYnym27q2BgqkjUgP/0/Tip1yc
-					txRS1D0CipTUZhCNrXc= )
-			120	MX	10 mx.signed.
-			120	RRSIG	MX 3 1 120 (
-					20820519023008 20140501011600 17876 signed.
-					BOUPCSEEJ8dZ0oWeiYEvGIonjagvM1OS+mEY
-					i5VUmysn7kArWqeFERs= )
-			60	NSEC	a-only.signed. NS SOA MX RRSIG NSEC DNSKEY
-			60	RRSIG	NSEC 3 1 60 (
-					20820519023008 20140501011600 17876 signed.
-					BBzvCsFw4EgfrIsFOu5IjP2gncm8dntwHaMD
-					IeJ6g6s7IOwFT5nyrOU= )
-			120	DNSKEY	256 3 3 (
-					BPXo3mJOeCCuorn7Hc7bxR3QDHrJvq9gUpPS
-					s8QYF3eiSpB97c8Br7fFzFYHQCJWWnCtpt1E
-					h7SveJSl1ASNl9W2KE6hDNXfDX+ixDOtFZ/7
-					PCh/obX36VK86EH+ZBNLxxEy9tHHCGO08zy8
-					3lWI3E5bk9a1sks2dy6hbQfMmyXWI5QwYS9D
-					j5Vs5yeUQ5e6SPmIqgqpn6VnDtAIfR2My7/r
-					/Jgf73gpZugZmn6wDbzNCyGIvtOJCHAY2OEg
-					ZfACKVdJrXZ42NKcJCgSTd1xY81UyMI9QAMq
-					64Lx/tENCo1GKBCk/1HMdiO6WKeXCJd1SYzN
-					VM+n4fRzEkmVT9wfyiSmoq6SxjeqrRebDz8G
-					42d4lsm2/0bmOlle+fva7LwtGOaS+tBqtD8K
-					kexFaixL5iY+LB0Q
-					) ; ZSK; alg = DSA ; key id = 17876
-			120	DNSKEY	257 3 3 (
-					BOOhXnn+YV6RQ+jRPdayrnC2cd9x5P77c1/6
-					Ev41qaWl1N7QRDXYh7VDS1UowoPbvQOvgQU0
-					X7+zKWrB8UQcdsUe96IH/wPab1qkJlKanZni
-					uFdB/2sTvQ6yabIC41dItnGeuN9VY1qwCa7T
-					4QFRVYyDPKgxo7MRLq9YoUN8RTcB6lY1BH9Z
-					QgcHZljAFVgU1Zc/6DZlQeBZyJafwIR+I7Eq
-					Oe+rR44ZeD5JRgI1OwGyw/b1wKUxFhM+4XJi
-					i8mQ1mrvzZ27iQbYP4WEzaskU6P5X+nPrTFi
-					tLEaPugt8Oe7+lHLjpHvHzSOJZ5Radfiqgzg
-					GGOzj1qmLfKLdRmp4VuBQ+1kguiz9D3ev89d
-					pzP7dYHuSdCjc9X0fLmPjU1xD6RyLCDEmUm7
-					eeRP55SiTiQCzJFr
-					) ; KSK; alg = DSA ; key id = 3746
-			120	RRSIG	DNSKEY 3 1 120 (
-					20820519023008 20140501011600 3746 signed.
-					BFuLN7ACQrD6/3WaieXRD1JpSXW9s+/xCZ1x
-					0ihUT1iKNvJS8F4Pafc= )
-			120	RRSIG	DNSKEY 3 1 120 (
-					20820519023008 20140501011600 17876 signed.
-					BN+8hbh1FGTNqHds0In57dPr5fVRU/P28dZa
-					zIP19bAwTH/ZvgrqUF0= )
-a-only.signed.		120	IN NS	1.0.0.1.signed.
-			60	NSEC	aaaa-only.signed. NS RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 (
-					20820519023008 20140501011600 17876 signed.
-					BHpGpjMihpoIykHTpK1XmkVn0jqSST3/K6Fx
-					vTaIb24rpkTriaXxChM= )
-aaaa-only.signed.	120	IN AAAA	2001:db8::2
-			120	RRSIG	AAAA 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BOvYax/3CDnEKTtbc6zoP4hYwhMe5SoXZh0w
-					muzBWw9bEH+Bdt1ZEQ4= )
-			60	NSEC	dual.signed. AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 (
-					20820519023008 20140501011600 17876 signed.
-					BIqxE79TUnT2DUuocTitGhTNGnLs0+3sLJdz
-					8haJbyH8pig1h7mqimU= )
-dual.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BIGL70eEIGVDW0gcYpEWgCFv4ne14hutQCMh
-					gQ6kcEbl2qszosJA60E= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BCmwk+ng/x1O7MhheK8MgAXYFVDDbyiZ76RV
-					iwQrPRm0ThNRtsQU+UY= )
-			60	NSEC	mx.signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 (
-					20820519023008 20140501011600 17876 signed.
-					BLlLAIHF4SX/eWMCkUvj0XTFmaOp3xnifqkL
-					nSWOAqtzJ5fwAdbNBdM= )
-ns.signed.		120	IN A	10.53.0.1
-			120	RRSIG	A 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BJ+Wll7VfNEjM4EfLY2rlx74oIwKRg9pjcJO
-					Zxt6GHQIJ2D6EfyMZ00= )
-			120	AAAA	fd92:7065:b8e:ffff::1
-			120	RRSIG	AAAA 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BGT/agHn4qcHzLV2hYcGeLJ6Tz1to9sTB8LI
-					lMwkV/KUu6UO7yvrnYk= )
-			60	NSEC	signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 (
-					20820519023008 20140501011600 17876 signed.
-					BNe3XmEGd/xxoh8FN3T3V9G1enCzNQJ7l3G+
-					D3QPrp7mYtPAGMxCLlc= )
-mx.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BMlIQp1acUSUvgzV1CWlM0+cS1bGkFsbS6HQ
-					d0S6TbNV+uNw0S1q0Dk= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 (
-					20820519023008 20140501011600 17876 signed.
-					BGtSuYQF7sRVT5OdVHPJjm0PERzSp4v+d/DP
-					Vp2UD0vSVSr3Vj2Wi4M= )
-			60	NSEC	ns.signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 (
-					20820519023008 20140501011600 17876 signed.
-					BMzQWws37wYfHvLnqgvjd+j5dkzBb2RYhrQk
-					ykM0GnTAR6ZpmgQO6jc= )
@@ -1,110 +0,0 @@
-; File written on Thu May  1 12:22:01 2014
-; dnssec_signzone version 9.8.5-P1
-signed.			120	IN SOA	ns.utld. hostmaster.ns.utld. (
-					1          ; serial
-					3600       ; refresh (1 hour)
-					1200       ; retry (20 minutes)
-					604800     ; expire (1 week)
-					60         ; minimum (1 minute)
-					)
-			120	RRSIG	SOA 3 1 120 20820519033608 (
-					20140501012201 20366 signed.
-					BMC1gbQgLgNsb9G6rElwoY6Krb6lV/WFsd/j
-					LO3aVnPXgU/noM1IBjs= )
-			120	NS	ns.utld.
-			120	RRSIG	NS 3 1 120 20820519033608 (
-					20140501012201 20366 signed.
-					BF9dWcW8GHL4QMp7rbeQgfUQmwEvskiMFqgt
-					GJqepDLkV4WXtw3TRK4= )
-			120	MX	10 mx.signed.
-			120	RRSIG	MX 3 1 120 20820519033608 (
-					20140501012201 20366 signed.
-					BJ7bngL8eZ9GrjQvHj0FDOgk2M6+YoW+cIAh
-					ZjGKcK431aUFMS3YSGE= )
-			60	NSEC	a-only.signed. NS SOA MX RRSIG NSEC DNSKEY
-			60	RRSIG	NSEC 3 1 60 20820519033608 (
-					20140501012201 20366 signed.
-					BHMei3tCaM9eYTPLRn93c6qp9ADL1Hxy+HlN
-					cLTyzzC+UxjUoI9O2VI= )
-			120	DNSKEY	256 3 3 (
-					BPLuLs4Ylbx3WZ8Ebj6GF+uEfI+J+RcaI1G3
-					TW4JHqVqeBa0gkPjnCDsK9VeUx5CR8i/T18f
-					YrOSojvASvdvG+TLNN9Jx+5A7c/43WzDOe2B
-					jeAlfZSl1Bie/ccGL6W1+lVvlO0OHI54EoKs
-					KxRub2izdouH4867a8dwahBlm14oWYXjqk3+
-					/ubDCPdXdTUvvLnDd9zyDpWYBXisb/3F8R1v
-					IcqyKDfJSTQSofLK+JlD+n7cv7U7pQWQn2qA
-					t/NkGcwF8EAbiQPmcF1BY6NnEMQ5XxNayAF5
-					Eza+i/kf3hLtS12cqW8hWm7aRYZWbzC4uUZL
-					WGK0XfAK2d/vT8ZMZo1oaYEvy3xHwfsFgrFV
-					qebm2ZFEomHpQ4KOSL1UhVI8uegUgnnovHjC
-					eS4q72Fh+LZTD8C4
-					) ; key id = 20366
-			120	DNSKEY	257 3 3 (
-					BPLuLs4Ylbx3WZ8Ebj6GF+uEfI+J+RcaI1G3
-					TW4JHqVqeBa0gkPjnCDsK9VeUx5CR8i/T18f
-					YrOSojvASvdvG+TLNN9Jx+5A7c/43WzDOe2B
-					jeAlfZSl1Bie/ccGL6W1+lVvlO0OHI54EoKs
-					KxRub2izdouH4867a8dwahBlm14oWYXjqk3+
-					/ubDCPdXdTUvvLnDd9zyDpWYBXisb/3F8R1v
-					IcqyKDfJSTQSofLK+JlD+n7cv7U7pQWQn2qA
-					t/NkGcwF8EAbiQPmcF1BY6NnEMQ5XxNayAF5
-					Eza+i/kf3hLtS12cqW8hWm7aRYZWbzC4uUZL
-					WGK0XfAK2d/vT8ZMZo1oaYEvy3xHwfsFgrFV
-					qebm2ZFEomHpQ4KOSL1UhVI8uegUgnnovHjC
-					eS4q72Fh+LZTD8C4
-					) ; key id = 20367
-			120	RRSIG	DNSKEY 3 1 120 20820519033608 (
-					20140501012201 20366 signed.
-					BBhlUYWd3f00zsSl+UJTxeVZUimQP8iMjf6j
-					Q7uPoI37BUz9NbZhTCg= )
-			120	RRSIG	DNSKEY 3 1 120 20820519033608 (
-					20140501012201 20367 signed.
-					BHPcogpnebYByfzp/KT53GsIiT3yPk/4atwj
-					NNsPFmVLqb/6yjotWQ0= )
-a-only.signed.		120	IN NS	1.0.0.1.signed.
-			60	NSEC	aaaa-only.signed. NS RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519033608 (
-					20140501012201 20366 signed.
-					BF1Wt+NtJ1Cuoj1H1D9BCS33ImdgkZeyEKuz
-					8FT66wAFigkXQ1zNofw= )
-aaaa-only.signed.	120	IN AAAA	2001:db8::2
-			120	RRSIG	AAAA 3 2 120 20820519033608 (
-					20140501012201 20366 signed.
-					BJFHllFzB91E/NWN1KjgmLuXQgDsGqBOuMuk
-					eNEc0RmToi3wV+TZwt0= )
-			60	NSEC	dual.signed. AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519033608 (
-					20140501012201 20366 signed.
-					BGfjvmN9LAHU2r9hXKgZRwyL4mZt4N/uBR1y
-					TKOGBOyx6b0hVHmGPnw= )
-dual.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519033608 (
-					20140501012201 20366 signed.
-					BEHMwkdjcbK++gvR/a36hSHf+uLwNUpbwKiw
-					PpmEz0be+gavwU0qSmY= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519033608 (
-					20140501012201 20366 signed.
-					BPKR07CI/4KFd5L7aLMvQifiYDb1EbAP2BIp
-					SgErW40i5qkFz9u588s= )
-			60	NSEC	mx.signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519033608 (
-					20140501012201 20366 signed.
-					BGJ0Ei6QbWJva3NwVSE/Bojcodsbu0sSVVLJ
-					QE8F5puTbx6qZ2dqrv4= )
-mx.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519033608 (
-					20140501012201 20366 signed.
-					BOyL/Pi5Ih/Xt3b1icWIqoagM7ZKXzPKrmbQ
-					VOZIvn0nmCj/gjShka4= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519033608 (
-					20140501012201 20366 signed.
-					BL1n80SXkdcDRaFa66xHIrMMFiYUnrM0zoGj
-					ArI7APPAxthUKN+ptAQ= )
-			60	NSEC	signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519033608 (
-					20140501012201 20366 signed.
-					BG6+zIJRFY4HqyUzPLcErSJibgtxxqfuHGYP
-					kXX9V0coQ3zBC92s2jo= )
@@ -19,12 +19,5 @@ copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
 copy_setports ns4/named1.conf.in ns4/named.conf

-if $SHELL ../testcrypto.sh -q
-then
-	(cd ns1 && $SHELL -e sign.sh)
-	(cd ns4 && $SHELL -e sign.sh)
-else
-	echo_i "using pre-signed zones"
-	cp -f ns1/signed.db.presigned ns1/signed.db.signed
-	cp -f ns4/signed.db.presigned ns4/signed.db.signed
-fi
+(cd ns1 && $SHELL -e sign.sh)
+(cd ns4 && $SHELL -e sign.sh)
@@ -76,7 +76,7 @@ case "$1" in
 		for ns in 1 2 3 4 5 6 7 8
 		do
 			[ $i -gt 0 -a $ns -gt 2 ] && break
-			int=`expr $i \* 10 + $ns - 1`
+			int=`expr $i \* 10 + $ns`
 			case "$sys" in
 			    *-pc-solaris2.5.1)
 				ifconfig lo0:$int 10.53.$i.$ns \
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -9,6 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
 if $PERL -e 'use Net::DNS;' 2>/dev/null
 then
    :
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -142,25 +142,20 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if $SHELL ../testcrypto.sh > /dev/null 2>&1
-then
-    $PERL $SYSTEMTESTTOP/stop.pl . ns1
+$PERL $SYSTEMTESTTOP/stop.pl . ns1

-    copy_setports ns1/named2.conf.in ns1/named.conf
+copy_setports ns1/named2.conf.in ns1/named.conf

-    $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns1
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns1

-    n=`expr $n + 1`
-    echo_i "checking recursive lookup to edns 512 + no tcp + trust anchor fails ($n)"
-    ret=0
-    $DIG $DIGOPTS +tcp @10.53.0.1 edns512-notcp soa > dig.out.test$n
-    grep "status: SERVFAIL" dig.out.test$n > /dev/null ||
-        grep "connection timed out;" dig.out.test$n > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-else
-    echo_i "skipping checking recursive lookup to edns 512 + no tcp + trust anchor fails as crypto not enabled"
-fi 
+n=`expr $n + 1`
+echo_i "checking recursive lookup to edns 512 + no tcp + trust anchor fails ($n)"
+ret=0
+$DIG $DIGOPTS +tcp @10.53.0.1 edns512-notcp soa > dig.out.test$n
+grep "status: SERVFAIL" dig.out.test$n > /dev/null ||
+    grep "connection timed out;" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-exec $SHELL ../testcrypto.sh
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Witold Kręcicki	fc4612a76c	Test - use regular malloc	2018-08-06 20:38:16 +02:00
Witold Kręcicki	c99496f6a8	Remove layering from isc_socket, isc_timer, isc_mem	2018-08-06 17:25:14 +02:00
Witold Kręcicki	59227dc277	Remove layering from isc_task and isc_app	2018-08-06 16:27:02 +02:00
Witold Kręcicki	1cfaf783e2	WiP'	2018-08-06 15:49:16 +02:00
Witold Kręcicki	234acfeffe	Get rid of isc_bind9 conditional	2018-08-06 12:20:18 +02:00
Witold Kręcicki	b4967c5735	Remove unthreaded support	2018-08-06 09:53:00 +02:00
Mark Andrews	9c4fb3b3e6	Merge branch 'remove-dead-code' into 'master' Remove dead code See merge request isc-projects/bind9!587	2018-08-02 19:22:25 -04:00
Mark Andrews	83a1e87dd2	remove dead code	2018-08-02 18:57:30 -04:00
Mark Andrews	5146cbc092	Merge branch '442-dnssec-verify-fails-on-case-sensitivity-of-owner-names-in-nsec-bitmap' into 'master' Resolve "dnssec-verify fails on case-sensitivity of owner names in NSEC bitmap" Closes #442 See merge request isc-projects/bind9!562	2018-08-02 18:34:46 -04:00
Mark Andrews	49cd3aac9c	add CHANGES	2018-08-03 08:21:48 +10:00
Mark Andrews	a94db46631	only check the bit map	2018-08-03 08:21:48 +10:00
Ondřej Surý	c3c0481293	Merge branch '543-revert-!553' into 'master' Revert "Merge branch 'modified-manual-install-oot' into 'master'" Closes #453 See merge request isc-projects/bind9!573	2018-08-02 10:32:08 -04:00
Ondřej SurýandOndřej Surý	69380eb033	Revert "Merge branch 'modified-manual-install-oot' into 'master'" This reverts commit `d9929b1b0a`, reversing changes made to `8abf2f23d0`.	2018-08-02 10:23:30 -04:00
Ondřej Surý	2c816e745b	Merge branch '454-broken-build-with-custom-ldflags' into 'master' Resolve "Broken build with custom LDFLAGS" Closes #454 See merge request isc-projects/bind9!572	2018-08-02 08:41:50 -04:00
Ondřej SurýandOndřej Surý	10e6bfc864	Preserve ${LDFLAGS} contents in bin/dig/	2018-08-02 08:33:03 -04:00
Mark Andrews	84385bc717	Merge branch '439-the-signed-instance-of-a-in-line-zone-should-be-treated-as-dynamic' into 'master' Resolve "The signed instance of a in-line zone should be treated as dynamic." Closes #439 See merge request isc-projects/bind9!554	2018-08-02 00:23:06 -04:00
Mark Andrews	d6d9fd1c71	add CHANGES	2018-08-02 14:07:03 +10:00
Mark Andrews	9130f055f4	treat the signed instance of a inline zone as dynamic	2018-08-02 00:00:13 -04:00
Mark Andrews	cfccd8d246	turn off ixfr-from-differences on signed instance of in-line zone	2018-08-02 00:00:13 -04:00
Mark Andrews	3ea9861e7a	rename zone to mayberaw	2018-08-02 00:00:13 -04:00
Mark Andrews	a71823bc5c	Merge branch '453-master-build-broken-in-documentation-tree' into 'master' add /opt/local/share/xsl/docbook-xsl-nons to the places to look for manpages/docbook.xsl under macports See merge request isc-projects/bind9!571	2018-08-01 22:41:45 -04:00
Mark Andrews	7425252207	add /opt/local/share/xsl/docbook-xsl-nons to the places to look for manpages/docbook.xsl under macports	2018-08-02 12:07:27 +10:00
Mark Andrews	c0bd1bf944	Merge branch '359-question-about-using-hashtable-size-log-messages-for-rpzs' into 'master' Resolve "Question about 'using hashtable size' log messages for RPZs" Closes #359 See merge request isc-projects/bind9!566	2018-08-01 21:32:01 -04:00
Mark Andrews	12d45c5cd1	lower log level to debug(1)	2018-08-01 21:31:17 -04:00
Mark Andrews	d30f6e5f99	Merge branch '424-nsupdate-tests-fail-intermittently' into 'master' Resolve "nsupdate tests fail intermittently" Closes #424 See merge request isc-projects/bind9!544	2018-08-01 21:25:27 -04:00
Mark Andrews	abe41ba011	use guard values for testing unixtime serial	2018-08-02 10:25:56 +10:00
Mark Andrews	6b30bc73c0	save SOA values	2018-08-01 20:04:09 -04:00
Mark Andrews	f335795068	Merge branch '406-dns_acl_isinsecure-does-not-handle-geoip-elements' into 'master' Resolve "dns_acl_isinsecure does not handle geoip elements." Closes #406 See merge request isc-projects/bind9!528	2018-08-01 19:30:22 -04:00
Mark Andrews	b0b76d259f	add CHANGES note	2018-08-02 09:19:04 +10:00
Mark Andrews	57eadf4d4f	handle dns_aclelementtype_geoip	2018-08-02 09:18:16 +10:00
Mark Andrews	fb8bb4e306	test dns_acl_isinsecure with geoip element	2018-08-02 09:18:16 +10:00
Mark Andrews	d7ae24c868	Merge branch '410-missing-sanity-check-for-call-to-next_token-in-file-mdig-c-for-bind-9-12-1-p2' into 'master' Resolve "Missing Sanity Check for call to next_token() in file 'mdig.c' for BIND 9.12.1-P2" Closes #410 See merge request isc-projects/bind9!527	2018-08-01 19:17:00 -04:00
Mark Andrews	84f1d9a204	add CHANGES note	2018-08-02 09:07:54 +10:00
Mark Andrews	2e688488f7	test mdig '+ednsopt=:' handling	2018-08-02 08:55:01 +10:00
Mark Andrews	d2943440a0	fix handling of '+ednsopt=:'; support 100 ednsopts per query rather than 100 total	2018-08-02 08:55:01 +10:00
Mark Andrews	1a5620db01	Merge branch '372-smimea-and-tlsa-methods-incorrectly-use-txt-type' into 'master' Resolve "smimea and tlsa methods incorrectly use txt type" Closes #372 See merge request isc-projects/bind9!458	2018-08-01 18:23:53 -04:00
Mark Andrews	63c9ec367f	use tlsa and smime structs to set common values	2018-08-01 18:15:08 -04:00
Mark Andrews	d9929b1b0a	Merge branch 'modified-manual-install-oot' into 'master' Use make automatic variables to install correct manual version. See merge request isc-projects/bind9!553	2018-08-01 02:06:44 -04:00
Petr MenšíkandMark Andrews	88f913ac81	Use make automatic variables to install updated manuals Make will choose modified manual from build directory or original from source directory automagically. Take advantage of install tool feature. Install all files in single command instead of iterating on each of them.	2018-08-01 01:56:16 -04:00
Ondřej Surý	8abf2f23d0	Merge branch '443-isc_buffer_printf-fixes' into 'master' Resolve "isc_buffer_printf() grows buffer without autorealloc being set + nit in isc_buffer_realloc()" Closes #443 See merge request isc-projects/bind9!559	2018-07-31 16:14:47 -04:00
Ondřej Surý	20faf4652a	Change isc_buffer_reallocate() into a static functions as it is not used outside of isc_buffer_reserve()	2018-07-31 22:00:30 +02:00
Ondřej Surý	7785f644c3	Remove illogical condition from isc_buffer_reallocate that would return ISC_R_NOSPACE when requested size is less than available size	2018-07-31 22:00:30 +02:00
Ondřej Surý	519bfe4c97	Forbid isc_buffer_printf from growing the buffer unless auto reallocation is enabled	2018-07-31 22:00:30 +02:00
Mark Andrews	6a6dc2f410	Merge branch 'misc-onerror-refcount-fixes' into 'master' refcount errors on error paths See merge request isc-projects/bind9!563	2018-07-31 03:56:46 -04:00
Mark Andrews	63aaff50df	add CHANGES	2018-07-31 17:46:53 +10:00
Mark Andrews	4093efc900	refcount errors on error paths	2018-07-31 17:41:45 +10:00
Evan Hunt	e91da20dc3	Merge branch '441-ns_server_servestale-can-leave-the-server-in-exclusive-mode-on-error' into 'master' Resolve "ns_server_servestale can leave the server in exclusive mode on error." Closes #441 See merge request isc-projects/bind9!557	2018-07-27 01:55:45 -04:00
Mark AndrewsandEvan Hunt	c8b07932e4	named_server_servestale could leave the server in exclusive mode if a error occurs.	2018-07-26 22:54:15 -07:00
Mark Andrews	ebcaae4ae5	Merge branch '432-sha2-c-does-not-compile-with-libressl' into 'master' Resolve "sha2.c does not compile with libressl." Closes #432 See merge request isc-projects/bind9!552	2018-07-24 19:28:50 -04:00
Mark Andrews	7671aba67d	look for LIBRESSL_VERSION_NUMBER as well	2018-07-24 18:22:29 +10:00
Ondřej Surý	e7c34d5179	Merge branch '227-replace-isc_safe-with-OpenSSL-fix-Windows' into 'master' Fix FTBFS on Windows due CRYPTO_memcmp missing in a linker phase of libiscc See merge request isc-projects/bind9!551	2018-07-24 03:57:23 -04:00
Ondřej Surý	187d22e090	Link libiscc with OpenSSL to fix CRYPTO_memcmp symbol missing	2018-07-24 09:37:09 +02:00
Evan Hunt	537f2284a3	Merge branch 'fix-openssl-configure' into 'master' Fix ax_check_openssl to accept "--with-openssl" or "--with-openssl=yes", and improve it to modern autotools standard See merge request isc-projects/bind9!550	2018-07-23 16:29:10 -04:00
Ondřej Surý	71877806e8	Fix ax_check_openssl to accept yes and improve it to modern autotools standard	2018-07-23 22:10:52 +02:00
Ondřej Surý	e0d42538f9	Merge branch '227-replace-isc_safe-with-OpenSSL' into 'master' Replace isc_safe routines with their OpenSSL counterparts See merge request isc-projects/bind9!546	2018-07-20 12:02:35 -04:00
Ondřej Surý	083461d332	Fix the isc_safe_memwipe() usage with (NULL, >0)	2018-07-20 10:08:24 -04:00
Ondřej Surý	b105ccee68	Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()	2018-07-20 10:06:14 -04:00
Ondřej Surý	66ba2fdad5	Replace isc_safe routines with their OpenSSL counter parts	2018-07-20 00:34:26 -04:00
Ondřej Surý	8b9b270c7d	Merge branch '261-print-c-issues' into 'master' Resolve "print.c issues" Closes #261 See merge request isc-projects/bind9!284	2018-07-20 00:17:53 -04:00
Ondřej Surý	8e6d89ad97	Add CHANGES entry for GL #261 .	2018-07-19 23:30:43 -04:00
Mark AndrewsandOndřej Surý	4c3386ad95	remove lib/isc/print.c and lib/isc/tests/print_test.c	2018-07-19 23:24:28 -04:00
Ondřej Surý	7fc59e384c	Merge branch '328-make-openssl-mandatory-windows' into 'master' Fix the Windows build after merging the crypto refactoring work See merge request isc-projects/bind9!545	2018-07-19 18:13:27 -04:00
Ondřej Surý	83cde08522	Introduce USE_OPENSSL define to Windows build, remove CRYPTO and AES conditions.	2018-07-19 16:54:53 -04:00
Ondřej Surý	51f7ed99fe	Merge branch '328-make-openssl-mandatory' into 'master' Resolve "Refactor crypto to use OpenSSL for everything but Public-Key Cryptography" Closes #328 See merge request isc-projects/bind9!371	2018-07-19 15:08:32 -04:00
Ondřej Surý	08974f39f1	Fix the Windows build	2018-07-19 14:00:40 -04:00
Ondřej Surý	fc496b2b5d	Fix DH and ECDSA algorithms in PKCS#11 build	2018-07-19 14:00:40 -04:00
Ondřej Surý	919179b369	Fix the build when EdDSA algorithms are not available	2018-07-19 13:17:38 -04:00
Ondřej Surý	ed090fed56	Cleanup copyrights	2018-07-19 13:17:38 -04:00
Ondřej Surý	0937e281a8	Add GitLab CI tests using SoftHSMv2 as PKCS#11 provider.	2018-07-19 13:17:38 -04:00
Ondřej Surý	0a73c9f137	Remove PKCS#11 DH implementation as there's no private keys stored in HSM for DH algorithm	2018-07-19 12:47:03 -04:00
Ondřej Surý	45abf438f8	Cleanup the configure feature report	2018-07-19 12:47:03 -04:00
Ondřej Surý	c40425d0f6	RSA and ECDSA cryptography is now mandatory; remove the checks for those	2018-07-19 12:47:03 -04:00
Ondřej Surý	9d1f4696ec	Disable DH test with PKCS#11	2018-07-19 12:47:03 -04:00
Ondřej Surý	c3b8130fe8	Make OpenSSL mandatory	2018-07-19 12:47:03 -04:00
Ondřej Surý	3322e41eeb	Merge branch 'gitlab-ci-add-jessie-and-stretch' into 'master' Add Debian jessie and stretch to GitLab CI See merge request isc-projects/bind9!543	2018-07-19 12:44:22 -04:00
Ondřej SurýandOndřej Surý	d34aa0ccd0	Remove quotes around $EXTRA_CONFIGURE to break out more options into ... more options and not a single one	2018-07-19 12:35:45 -04:00
Ondřej SurýandOndřej Surý	f5cb3d707a	Make libidn2 build optional	2018-07-19 12:35:45 -04:00
Ondřej SurýandOndřej Surý	1d8a62713d	Disable autogen.sh in precheck, it needs newer autoconf and it breaks the older builds	2018-07-19 12:35:45 -04:00
Ondřej SurýandOndřej Surý	d5ec498e26	Add Debian jessie and stretch images to the build to catch errors with older but supported releases	2018-07-19 12:35:45 -04:00
Michał Kępień	636e9fc259	Merge branch '423-fix-handling-of-tat-sending-failures' into 'master' Fix handling of TAT sending failures Closes #423 See merge request isc-projects/bind9!540	2018-07-19 12:15:18 -04:00
Michał KępieńandMark Andrews	8666f8d28f	Fix handling of TAT sending failures dns_view_zonecut() may associate the dns_rdataset_t structure passed to it even if it returns a result different then ISC_R_SUCCESS. Not handling this properly may cause a reference leak. Fix by ensuring 'nameservers' is cleaned up in all relevant failure modes.	2018-07-20 01:55:50 +10:00
Ondřej Surý	2975f37f1c	Merge branch 'use-internal-docker-registry' into 'master' Try using the integrated Docker Registry again See merge request isc-projects/bind9!539	2018-07-19 11:40:47 -04:00
Ondřej Surý	378e36a955	Try using the integrated Docker Registry again	2018-07-18 13:46:20 -04:00
Witold Krecicki	5bf1e8781e	Merge branch 'fix-various-tests-for-qmin' into 'master' Fix various tests for qmin See merge request isc-projects/bind9!520	2018-07-17 11:09:24 -04:00
Witold Kręcicki	48eedb8108	Changes entry	2018-07-17 17:00:23 +02:00
Michał Kępień	e10e6756c9	[squash] Make resolver tests even more civilized (ans8.pl) Set AA=1 even for truncated responses. Put glue record in responses to no-questions/NS queries. Add comments, simplify code.	2018-07-17 13:01:42 +02:00
Michał Kępień	82082ecd56	[squash] Make resolver tests even more civilized (ans2.pl and ans3.pl) Prevent ans2.pl from responding authoritatively for any name at or below example.net. Make ans3.pl properly answer example.net/NS queries. Use string comparisons instead of regular expressions where possible.	2018-07-17 13:00:34 +02:00
Michał Kępień	122a1a00be	[squash] Put Perl code extracting a tree from a cache dump in a separate function	2018-07-17 11:31:09 +02:00
Witold KręcickiandMichał Kępień	c96ca40023	cacheclean test: take into account that we can have multiple RRs at one name	2018-07-17 11:31:09 +02:00
Witold KręcickiandMichał Kępień	c8b36ea6b9	Make resolver tests more civilized	2018-07-17 11:31:09 +02:00
Witold Krecicki	15db6ee6e4	Merge branch '419-do-not-replace-lo0-address-on-solaris' into 'master' Do not replace lo0 address on Solaris Closes #419 See merge request isc-projects/bind9!535	2018-07-16 09:05:17 -04:00
Michał Kępień	618921902a	Do not replace lo0 address on Solaris lo0 and lo0:0 are the same interface on Solaris. Make sure bin/tests/system/ifconfig.sh does not touch lo0:0 in order to prevent it from changing the address of the loopback interface on Solaris.	2018-07-16 08:55:22 +02:00
Evan Hunt	229dfb5dc8	Merge branch 'placeholder' into 'master' placeholder See merge request isc-projects/bind9!534	2018-07-13 15:35:38 -04:00
Evan Hunt	ae1aa55c6f	placeholder	2018-07-13 12:35:11 -07:00
Michał Kępień	939824fce5	Merge branch '365-add-centos-to-ci' into 'master' Add CentOS 6/7 to CI Closes #365 and #404 See merge request isc-projects/bind9!531	2018-07-13 06:25:50 -04:00
Michał Kępień	f0966d1485	Add CentOS 6/7 to CI Modify .gitlab-ci.yml so that every CI pipeline also builds and tests BIND on CentOS versions 6 and 7. Use --disable-warn-error on CentOS 6 since it uses GCC 4.4.7 which suffers from bugs causing bogus warnings to be generated, e.g.: sigs_test.c: In function 'compare_tuples': sigs_test.c:75: warning: declaration of 'index' shadows a global declaration /usr/include/string.h:489: warning: shadowed declaration is here sigs_test.c: In function 'updatesigs_test': sigs_test.c:193: warning: declaration of 'index' shadows a global declaration /usr/include/string.h:489: warning: shadowed declaration is here	2018-07-13 08:22:12 +02:00
Michał Kępień	2be97feb46	Do not spam console if "git status --ignored" fails during tests The "git status" command in Git versions before 1.7.2 does not support the "--ignored" option. Prevent spamming the console when running system tests from a Git repository on a host with an ancient Git version installed.	2018-07-13 08:22:12 +02:00
Michał Kępień	fd30a03f2b	Remove IDN subtest from the "digdelv" system test The output of certain "dig +idnout" invocations may be locale-dependent. Remove the "dig +idnout" subtest from the "digdelv" system test as IDN support is already thoroughly tested by the "idna" system test.	2018-07-13 08:22:12 +02:00
Michał Kępień	cc0e8cda71	Include conf.sh from all prereq.sh scripts Every prereq.sh script must include bin/tests/system/conf.sh, otherwise if some prerequisite is not met, errors about echo_i not being found will be printed instead of actual error messages.	2018-07-13 08:22:12 +02:00
Michał Kępień	12df6829d1	Update ATF path in the ./configure invocation used during CI The Docker images used for CI install ATF to /usr, not /usr/local. Update the ./configure invocation in .gitlab-ci.yml accordingly in order to prevent confusion.	2018-07-13 08:22:12 +02:00
Michał Kępień	45e77a3680	Add "-f" to command line arguments for autoreconf in autogen.sh Depending on tool versions used, "autoreconf -i" may not update all Autoconf-generated files, which in turn may result in build errors. Make autogen.sh call autoreconf with the "-f" command line argument to ensure all Autoconf-generated files are updated when autogen.sh is run.	2018-07-13 08:21:55 +02:00
Mark Andrews	c08e60adcb	Merge branch '373-generic_tostruct_tlsa-incorrectly-initialises-common-structure' into 'master' Resolve "generic_tostruct_tlsa incorrectly initialises common structure." Closes #373 See merge request isc-projects/bind9!460	2018-07-11 19:45:56 -04:00
Mark Andrews	6e06d3e7c6	remove re-initalisation of common structure	2018-07-12 09:37:13 +10:00