set "multi-master" automatically with multiple primaries

By default, named logs a message at level info if a secondary
zone receives an update indicating that the serial number has
gone backwards. The "multi-master" option was provided to
allow this message to be suppressed if a zone was configured
with multiple primary servers.

That option has now been marked obsolete. The message is now
logged at debug level 1 when there are multiple primary server
addresses configured for the zone. It is still logged at level
info if there is only address.

.gitignore

@@ -96,7 +96,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop

.gitlab-ci.yml

@@ -51,10 +51,11 @@ variables:
   # cross-testrun files as there is no need to use that feature in CI.
   PYTEST_ADDOPTS: "-p no:cacheprovider"
 
-  HYPOTHESIS_PROFILE: "ci"
+  # Default platforms to run "stress" tests on
+  BIND_STRESS_TEST_OS: linux
+  BIND_STRESS_TEST_ARCH: amd64
 
-  # Some jobs may clean up the build artifacts unless this is set to 0.
-  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1
+  HYPOTHESIS_PROFILE: "ci"
 
 default:
   # Allow all running CI jobs to be automatically canceled when a new
@@ -376,7 +377,6 @@ stages:
     - >
       "$PYTEST" --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "$TEST_PARALLEL_JOBS" | tee pytest.out.txt
     - '( ! grep -F "grep: warning:" pytest.out.txt )'
-    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || ( cd ../../.. && make clean >/dev/null 2>&1 )
   after_script:
     - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
     - *display_pytest_failures
@@ -431,7 +431,6 @@ stages:
     - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
   script:
     - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
-    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || make clean >/dev/null 2>&1
   after_script:
     - test -d bind-* && cd bind-*
     - REALSOURCEDIR="$PWD"
@@ -468,12 +467,10 @@ stages:
       junit: junit.xml
 
 .docs: &docs_job
-  variables:
-    DOC_MAKE_TARGET: doc
   stage: docs
   script:
     - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k ${DOC_MAKE_TARGET} V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k doc V=1
     - find doc/man/ -maxdepth 1 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" -e "input text line longer than 80 bytes" )
 
 .respdiff: &respdiff_job
@@ -567,29 +564,21 @@ clang-format:
     when: on_failure
 
 coccinelle:
-  ######################################################################
-  # Revert to using the "precheck_job" anchor after the "base" image is
-  # upgraded to Debian trixie, which has Coccinelle 1.2.
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  ######################################################################
+  <<: *precheck_job
   needs: []
   script:
     - util/check-cocci
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
 pylint:
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
+  <<: *precheck_job
   needs: []
   variables:
     PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
   script:
     - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/|^contrib/)')
       # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE '(ans\.py|vulture_ignore_list\.py)')
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')
 
 reuse:
   <<: *precheck_job
@@ -615,6 +604,11 @@ shfmt:
 
 danger:
   <<: *precheck_job
+  # Keep the GIT_DEPTH environment variable set to a "high number" before
+  # https://github.com/libgit2/libgit2/pull/6662 is addressed and integrated
+  # into pygit2.
+  variables:
+    GIT_DEPTH: 1000
   needs: []
   script:
     - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
@@ -630,9 +624,7 @@ checkbashisms:
     - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)
 
 mypy:
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
+  <<: *precheck_job
   script:
     - mypy "bin/tests/system/isctest/"
 
@@ -669,33 +661,18 @@ changelog:
     GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL
     GIT_COMMITTER_NAME: $GITLAB_USER_NAME
     GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
-    DOC_MAKE_TARGET: html
   before_script:
     - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
     - sed -i 's/^Draft:\s*//' commitmsg
     - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
     - git commit --allow-empty -F commitmsg
-    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD >> $(ls doc/changelog/changelog-9.* | sort --version-sort | tail -n 1)
-  after_script:
-    - git diff
+    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD
   needs:
     - job: autoreconf
       artifacts: true
   artifacts:
     untracked: true
 
-linkcheck:
-  <<: *base_image
-  stage: docs
-  script:
-    - pushd doc/arm/ > /dev/null && sphinx-build -b linkcheck . linkcheck_output/
-  artifacts:
-    paths:
-      - doc/arm/linkcheck_output/
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
-  needs: []
-
 docs:
   <<: *default_triggering_rules
   <<: *base_image
@@ -767,6 +744,18 @@ cross-version-config-tests:
     untracked: true
     expire_in: "1 day"
     when: always
+  # Changes in the January milestone necessitate allowing this job to fail. The
+  # "soft failure" should be reverted when January releases are published.
+  # - #4261 introduced extra artifacts check but missed a file visible only in
+  #   this job. This is fixed in !9815 but present in December releases.
+  #   System test affected: mkeys.
+  # - #4666 removed the "fixed" value for the "rrset-order" option, but the
+  #   value is still present in the December release system test.
+  #   System test affected: rrsetorder.
+  # - #4482 removed the "dnssec-must-be-secure" feature that is still present
+  #   in the December release.
+  #   System tests affected: autosign, dnssec, and dsdigest.
+  allow_failure: true
 
 # Jobs for regular GCC builds on Alpine Linux 3.21 (amd64)
 
@@ -913,8 +902,7 @@ gcc:bookworm:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
-    # Tracing needs to be disabled otherwise gcovr fails
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT} --disable-tracing"
+    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
     RUN_MAKE_INSTALL: 1
   <<: *debian_bookworm_amd64_image
   <<: *build_job
@@ -924,9 +912,8 @@ system:gcc:bookworm:amd64:
   <<: *system_test_gcov_job
   variables:
     CI_ENABLE_ALL_TESTS: 1
-    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
     TZ: Australia/Sydney
-  needs:  # using artifacts from unit test job is required for gcov
+  needs:
     - job: unit:gcc:bookworm:amd64
       artifacts: true
 
@@ -935,7 +922,6 @@ unit:gcc:bookworm:amd64:
   <<: *unit_test_gcov_job
   variables:
     CI_ENABLE_ALL_TESTS: 1
-    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
   needs:
     - job: gcc:bookworm:amd64
       artifacts: true
@@ -954,7 +940,7 @@ system:gcc:bookworm:rbt:amd64:
   <<: *debian_bookworm_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:bookworm:rbt:amd64
+    - job: unit:gcc:bookworm:rbt:amd64
       artifacts: true
 
 unit:gcc:bookworm:rbt:amd64:
@@ -1603,10 +1589,9 @@ respdiff:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
   script:
     - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1
 
 respdiff:asan:
   <<: *respdiff_job
@@ -1617,10 +1602,9 @@ respdiff:asan:
     CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1
 
 respdiff:tsan:
   <<: *respdiff_job
@@ -1631,11 +1615,10 @@ respdiff:tsan:
     CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
     TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1
   after_script:
     - *find_python
     - *parse_tsan
@@ -1647,10 +1630,9 @@ respdiff-third-party:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Og"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.2"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
   script:
     - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}"
-    - cd ../.. && make clean >/dev/null 2>&1
 
 # Performance tests
 
@@ -1679,39 +1661,281 @@ shotgun:dot:
   when: delayed
   start_in: 5 minutes
 
-shotgun:doh-get:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: doh-get
-    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
-
 .stress-test: &stress_test
   stage: performance
-
-generate-stress-test-configs:
-  <<: *base_image
-  <<: *default_triggering_rules
-  stage: precheck
   script:
-    - util/generate-stress-test-configs.py > stress-test-configs.yml
-  artifacts:
-    paths:
-      - stress-test-configs.yml
-  needs: []
-
-stress-test-child-pipeline:
-  <<: *default_triggering_rules
-  stage: performance
-  trigger:
-    include:
-      - artifact: stress-test-configs.yml
-        job: generate-stress-test-configs
+    - *configure
+    - *setup_interfaces
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make DESTDIR="${INSTALL_PATH}" install
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - cd bind9-qa/stress
+    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
   needs:
-    - job: generate-stress-test-configs
+    - job: autoreconf
       artifacts: true
 
+.stress-test-long: &stress_test_long_job
+  <<: *stress_test
+  artifacts:
+    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    expire_in: "1 week"
+    when: always
+  timeout: 2h
+
+.stress-test-short: &stress_test_short_job
+  <<: *stress_test
+  only:
+    - merge_requests
+  artifacts:
+    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    when: always
+
+stress:short:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:authoritative:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:recursive:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:rpz:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
 # git fsck operates over the whole repository and is sufficient to schedule it
 # only in one branch, preferably "main". GitLab's clone strategy prevents us
 # from using the "bind9" repo clone; we need to clone it ourselves.
@@ -1802,10 +2026,10 @@ pairwise:
     - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
     - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
     # non-fast-forward merges are disabled so we have to have merge commit on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e "s|^See merge request ${CI_PROJECT_PATH}\!||p")"
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
     - >
-      : stop if this is not a merge request in the current project\'s namespace
-    - test -n "$MERGE_REQUEST_ID"
+      : stop if this is not a merge request
+    - test "$MERGE_REQUEST_ID" -ge 0
     - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
 
 backports:
@@ -1821,6 +2045,6 @@ backports:
 merged-metadata:
   <<: *post_merge
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^v9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
   script:
     - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"

.gitlab/issue_templates/Internal_use_only-CVE.md

@@ -31,11 +31,11 @@ confidential!
   - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
   - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
   - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
   - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and the CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
   - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
   - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
   - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
   - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
   - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
@@ -48,7 +48,6 @@ confidential!
   - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
   - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
   - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_coordinate_check]  **(SwEng)** Make sure other vendors are able to release on the date that was previously agreed upon
   - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
   - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
   - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
@@ -69,15 +68,15 @@ confidential!
 ### On the Day of Public Disclosure
 
   - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
+  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
   - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
   - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
-  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
   - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
   - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
   - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
   - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
   - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the appropriate announce queue in RT that the release is published
+  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published
 
 ### After Public Disclosure
 
@@ -86,13 +85,13 @@ confidential!
 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
 [step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-ticket-in-support-portal-earliest-queue-which-will-notify-earliest-customers
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
+[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -103,25 +102,25 @@ confidential!
 [step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
 [step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
 [step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_coordinate_check]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#make-sure-other-vendors-are-able-to-release-on-the-date-that-was-previously-agreed-upon
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-the-support-portal-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-5-day-queue-in-rt-with-the-text-of-the-advisory-earliest-and-t-5
+[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
+[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
+[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-3-day-queue-in-rt-with-the-text-of-the-advisory-t-3
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
+[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
 [step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
 [step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
-[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-tickets-in-the-asn-queues-in-rt-that-the-embargo-is-lifted
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#open-a-ticket-in-the-appropriate-announce-queue-in-rt-that-the-release-is-published
+[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
 
 /confidential

CONTRIBUTING.md

@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*
 
 ### Contents
 
@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git
 
 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:
 
->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18
 
 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.
 
 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code
 
 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.
 
 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:
 
 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
   accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`
 
 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.
 
 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.
 
 ##### Documentation

bin/check/check-tool.c

@@ -112,7 +112,11 @@ add(char *key, int value) {
 	}
 
 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
+					   false, &symtab);
+		if (result != ISC_R_SUCCESS) {
+			return;
+		}
 	}
 
 	key = isc_mem_strdup(sym_mctx, key);
@@ -140,97 +144,12 @@ logged(char *key, int value) {
 	return false;
 }
 
-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
-	}
-}
-
 static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -238,7 +157,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;
 
 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -249,6 +168,12 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		return answer;
 	}
 
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -258,9 +183,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -303,7 +228,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -433,27 +358,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
+	freeaddrinfo(ai);
 	return answer;
 }
 
 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;
 
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -463,9 +386,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -498,9 +421,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;
 
 	case EAI_NONAME:
@@ -521,7 +442,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -530,19 +451,19 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 
 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;
 
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -552,9 +473,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -587,9 +508,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;
 
 	case EAI_NONAME:
@@ -610,7 +529,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -656,17 +575,17 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
-	dns_zone_setorigin(zone, origin);
+	CHECK(dns_zone_setorigin(zone, origin));
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
-		dns_zone_setstream(zone, stdin, fileformat,
-				   &dns_master_style_default);
+		CHECK(dns_zone_setstream(zone, stdin, fileformat,
+					 &dns_master_style_default));
 	} else {
-		dns_zone_setfile(zone, filename, fileformat,
-				 &dns_master_style_default);
+		CHECK(dns_zone_setfile(zone, filename, fileformat,
+				       &dns_master_style_default));
 	}
 	if (journal != NULL) {
-		dns_zone_setjournal(zone, journal);
+		CHECK(dns_zone_setjournal(zone, journal));
 	}
 
 	region.base = UNCONST(classname);
@@ -684,7 +603,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);

bin/check/check-tool.h

@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>
 
@@ -25,6 +26,8 @@
 #include <dns/types.h>
 #include <dns/zone.h>
 
+ISC_LANG_BEGINDECLS
+
 isc_result_t
 setup_logging(FILE *errout);
 
@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS

bin/check/named-checkzone.rst

@@ -91,13 +91,9 @@ Options
    (both in-zone and out-of-zone hostnames). Mode ``local`` only
    checks SRV records which refer to in-zone hostnames.
 
-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
    Mode ``full`` checks that delegation NS records refer to A or AAAA
    records (both in-zone and out-of-zone hostnames). It also checks that
    glue address records in the zone match those advertised by the child.
-
    Mode ``local`` only checks NS records which refer to in-zone
    hostnames or verifies that some required glue exists, i.e., when the
    name server is in a child zone.

bin/confgen/include/confgen/os.h

@@ -17,6 +17,10 @@
 
 #include <stdio.h>
 
+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
  *   0 		success
  *   -1 	insufficient permissions, or 'user' does not exist.
  */
+
+ISC_LANG_ENDDECLS

bin/confgen/keygen.h

@@ -16,10 +16,13 @@
 /*! \file */
 
 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>
 
 #include <dns/secalg.h>
 
+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS

bin/confgen/util.h

@@ -17,6 +17,7 @@
 
 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 
 #define NS_CONTROL_PORT 953
 
@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)
 
+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
 
 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS

bin/delv/delv.c

@@ -228,6 +228,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -787,7 +788,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	num_keys++;
 
 cleanup:
-	if (result == DST_R_UNSUPPORTEDALG) {
+	if (result == DST_R_NOCRYPTO) {
+		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
+	} else if (result == DST_R_UNSUPPORTEDALG) {
 		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
@@ -821,6 +824,9 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	}
 
 cleanup:
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
 	return result;
 }
 
@@ -1119,6 +1125,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -2137,13 +2151,9 @@ sendquery(void *arg) {
 				    &requestmgr));
 
 	dns_view_attach(view, &(dns_view_t *){ NULL });
-
-	const unsigned int timeout = isc_nm_getinitialtimeout(netmgr) /
-				     MS_PER_SEC;
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, timeout, timeout, 0,
-				 0, isc_loop(), recvresponse, message,
-				 &request));
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
+				 recvresponse, message, &request));
 	return;
 
 cleanup:
@@ -2195,8 +2205,8 @@ run_server(void *arg) {
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
 				     NULL, &interfacemgr));
 
-	dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			"_default", &view);
+	CHECK(dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
+			      "_default", &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);

bin/dig/dig.c

@@ -303,8 +303,6 @@ help(void) {
 	       "statistics)\n"
 	       "                 +subnet=addr        (Set edns-client-subnet "
 	       "option)\n"
-	       "                 +[no]svcparamkeycompat (Display backward-"
-	       "compatible SvcParamKey names (keyN) for non-initial entries)\n"
 	       "                 +[no]tcflag         (Set TC flag in query "
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
@@ -504,9 +502,6 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->expandaaaa) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	}
-	if (query->lookup->svcparamkeycompat) {
-		styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-	}
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
@@ -700,9 +695,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		if (query->lookup->expandaaaa) {
 			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 		}
-		if (query->lookup->svcparamkeycompat) {
-			styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-		}
 		if (query->lookup->multiline) {
 			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -2402,10 +2394,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				goto exit_or_usage;
 			}
 			break;
-		case 'v': /* svcparamkeycompat */
-			FULLCHECK("svcparamkeycompat");
-			lookup->svcparamkeycompat = state;
-			break;
 		default:
 			goto invalid_option;
 		}

bin/dig/dig.rst

@@ -642,14 +642,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    prefix-length of zero, which signals a resolver that the client's
    address information must *not* be used when resolving this query.
 
-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag
 
    This option sets [or does not set] the TC (TrunCation) bit in the query. The default is

bin/dig/dighost.c

@@ -40,6 +40,7 @@
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -60,7 +61,6 @@
 #include <isc/xml.h>
 
 #include <dns/byaddr.h>
-#include <dns/ede.h>
 #include <dns/fixedname.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -758,7 +758,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
-	looknew->svcparamkeycompat = lookold->svcparamkeycompat;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
@@ -2780,12 +2779,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }
 
-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2832,7 +2825,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}
 
 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -3046,8 +3042,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3067,15 +3062,14 @@ start_tcp(dig_query_t *query) {
 
 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}
 
 	return;

bin/dig/dighost.h

@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
  * in a tight loop of constant lookups.  It's value is arbitrary.
  */
 
+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -104,8 +107,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -462,3 +466,5 @@ dig_shutdown(void);
 
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS

bin/dnssec/dnssec-dsfromkey.c

@@ -381,7 +381,7 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = false;
 
-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -417,6 +417,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;

bin/dnssec/dnssec-signzone.c

@@ -419,9 +419,10 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}
 
+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);
 
@@ -539,7 +540,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}
 
 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;
 
 		dns_rdataset_current(&sigset, &sigrdata);
@@ -550,10 +551,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);
 
 		key = keythatsigned(&rrsig);
-		offline = key->pubkey;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);
 
 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -582,21 +581,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;
 
-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -609,32 +602,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;
 
-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}
 
 		if (keep) {
@@ -3386,12 +3372,9 @@ main(int argc, char *argv[]) {
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
 
-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"
 
 	/*
@@ -3565,6 +3548,10 @@ main(int argc, char *argv[]) {
 			}
 			break;
 
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;

bin/dnssec/dnssec-signzone.rst

@@ -174,11 +174,6 @@ Options
    days. Therefore, if any existing RRSIG records are due to expire in
    less than 7.5 days, they are replaced.
 
-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format
 
    This option sets the format of the input zone file. Possible formats are
@@ -274,7 +269,7 @@ Options
    with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
    :program:`dnssec-signzone` to remove signatures from keys that are no longer
    active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").
 
 .. option:: -q
 
@@ -291,7 +286,7 @@ Options
    This option is similar to :option:`-Q`, except it forces
    :program:`dnssec-signzone` to remove signatures from keys that are no longer
    published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
    Rollover").
 
 .. option:: -S

bin/dnssec/dnssectool.c

@@ -460,7 +460,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();
 
-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}
 
 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);

bin/named/config.c

@@ -118,7 +118,6 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
-	tcp-primaries-timeout 150;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
 #	tkey-domain <none>\n\
@@ -194,6 +193,7 @@ options {\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -332,7 +332,7 @@ dnssec-policy \"insecure\" {\n\
 
 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -504,9 +504,9 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return ztype;
 }
 
-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -533,6 +533,23 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 	return ISC_R_NOTFOUND;
 }
 
+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return getremotesdef(cctx, list, name, ret);
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return result;
+	}
+	return ISC_R_NOTFOUND;
+}
+
 static isc_result_t
 named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		     dns_name_t **namep) {
@@ -581,12 +598,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}
 
-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -669,6 +684,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}
 
+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -699,22 +716,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;

bin/named/control.c

@@ -233,8 +233,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {

bin/named/controlconf.c

@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>
 
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>
 
 #include <isccfg/check.h>
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };
 
 static isc_result_t
@@ -489,7 +489,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = DNS_R_CLOCKSKEW;
+			result = ISCCC_R_CLOCKSKEW;
 			goto cleanup;
 		}
 	} else {
@@ -503,7 +503,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = DNS_R_EXPIRED;
+		result = ISCCC_R_EXPIRED;
 		goto cleanup;
 	}
 
@@ -842,12 +842,15 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));
 
 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	*keyid = (controlkey_t){
-		.algorithm = DST_ALG_UNKNOWN,
-		.link = ISC_LINK_INITIALIZER,
-	};
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
+	keyid->secret.base = NULL;
+	keyid->secret.length = 0;
+	keyid->algorithm = DST_ALG_UNKNOWN;
+	ISC_LINK_INIT(keyid, link);
+	if (keyid->keyname == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}
 
 	CHECK(isccfg_check_key(key));
 
@@ -1336,6 +1339,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));
 
 	*controls = (named_controls_t){
@@ -1346,9 +1350,14 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 
+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return result;
+	}
 	*ctrlsp = controls;
 	return ISC_R_SUCCESS;
 }
@@ -1362,7 +1371,7 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));

bin/named/include/named/builtin.h

@@ -17,6 +17,7 @@
 
 #include <inttypes.h>
 
+#include <isc/lang.h>
 #include <isc/types.h>
 
 #include <dns/clientinfo.h>

bin/named/include/named/config.h

@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);
 
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);
 
 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,

bin/named/include/named/control.h

@@ -43,7 +43,6 @@
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_HALT	   "halt"
 #define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
 #define NAMED_COMMAND_MKEYS	   "managed-keys"
 #define NAMED_COMMAND_MODZONE	   "modzone"
 #define NAMED_COMMAND_NOTIFY	   "notify"

bin/named/include/named/server.h

@@ -388,15 +388,3 @@ named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
  */
 isc_result_t
 named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);

bin/named/include/named/tkeyconf.h

@@ -15,10 +15,13 @@
 
 /*! \file */
 
+#include <isc/lang.h>
 #include <isc/types.h>
 
 #include <isccfg/cfg.h>
 
+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -34,5 +37,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
  *
  *	Returns:
  *\li		ISC_R_SUCCESS
- *\li		return codes from dns_name_fromtext()
+ *\li		ISC_R_NOMEMORY
  */
+
+ISC_LANG_ENDDECLS

bin/named/include/named/transportconf.h

@@ -15,12 +15,15 @@
 
 /*! \file */
 
+#include <isc/lang.h>
 #include <isc/types.h>
 
 #include <dns/transport.h>
 
 #include <isccfg/cfg.h>
 
+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
  *	\li	'listp' is not NULL, and '*listp' is NULL
  *
  */
+
+ISC_LANG_ENDDECLS

bin/named/include/named/tsigconf.h

@@ -15,8 +15,11 @@
 
 /*! \file */
 
+#include <isc/lang.h>
 #include <isc/types.h>
 
+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -32,6 +35,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
  *
  *	Returns:
  *	\li	ISC_R_SUCCESS
- *	\li	DNS_R_BADALG
- *	\li	return codes from dns_name_fromtext()
+ *	\li	ISC_R_NOMEMORY
  */
+
+ISC_LANG_ENDDECLS

bin/named/include/named/zoneconf.h

@@ -17,11 +17,14 @@
 
 #include <stdbool.h>
 
+#include <isc/lang.h>
 #include <isc/types.h>
 
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 
+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
  * \li	'rdclass' to be a valid rdataclass
  * \li	'name' to be a valid zone origin name
  */
+
+ISC_LANG_ENDDECLS

bin/named/main.c

@@ -1414,7 +1414,14 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		return ISC_R_FAILURE;
 	}
 
-	instance = isc_mem_allocate(mctx, namelen + 1);
+	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
+				 "allocation failed: %s",
+				 isc_result_totext(ISC_R_NOMEMORY));
+		scf_handle_destroy(h);
+		return ISC_R_FAILURE;
+	}
+
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
 			UNEXPECTED_ERROR("scf_myname() failed: %s",

bin/named/server.c

@@ -140,15 +140,6 @@
 #include <named/smf_globals.h>
 #endif /* ifdef HAVE_LIBSCF */
 
-/* On DragonFly BSD the header does not provide jemalloc API */
-#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
-#include <malloc_np.h>
-#define JEMALLOC_API_SUPPORTED 1
-#elif defined(HAVE_JEMALLOC)
-#include <jemalloc/jemalloc.h>
-#define JEMALLOC_API_SUPPORTED 1
-#endif
-
 #ifdef HAVE_LMDB
 #include <lmdb.h>
 #define configure_newzones configure_newzones_db
@@ -178,8 +169,6 @@
 #define MAX_KEEPALIVE_TIMEOUT  UINT32_C(UINT16_MAX * 100)
 #define MIN_ADVERTISED_TIMEOUT UINT32_C(0) /* No minimum */
 #define MAX_ADVERTISED_TIMEOUT UINT32_C(UINT16_MAX * 100)
-#define MIN_PRIMARIES_TIMEOUT  UINT32_C(2500)	/* 2.5 seconds */
-#define MAX_PRIMARIES_TIMEOUT  UINT32_C(120000) /* 2 minutes */
 
 /*%
  * Check an operation for failure.  Assumes that the function
@@ -369,22 +358,6 @@ typedef struct {
 	isc_result_t result;
 } ns_dzarg_t;
 
-typedef enum {
-	MEMPROF_UNSUPPORTED = 0x00,
-	MEMPROF_INACTIVE = 0x01,
-	MEMPROF_FAILING = 0x02,
-	MEMPROF_OFF = 0x03,
-	MEMPROF_ON = 0x04,
-} memprof_status;
-
-static const char *memprof_status_text[] = {
-	[MEMPROF_UNSUPPORTED] = "UNSUPPORTED",
-	[MEMPROF_INACTIVE] = "INACTIVE",
-	[MEMPROF_FAILING] = "FAILING",
-	[MEMPROF_OFF] = "OFF",
-	[MEMPROF_ON] = "ON",
-};
-
 /*
  * These zones should not leak onto the Internet.
  */
@@ -611,6 +584,51 @@ configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	return result;
 }
 
+/*%
+ * Configure a sortlist at '*aclp'.  Essentially the same as
+ * configure_view_acl() except it calls cfg_acl_fromconfig with a
+ * nest_level value of 2.
+ */
+static isc_result_t
+configure_view_sortlist(const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			cfg_aclconfctx_t *actx, isc_mem_t *mctx,
+			dns_acl_t **aclp) {
+	isc_result_t result;
+	const cfg_obj_t *maps[3];
+	const cfg_obj_t *aclobj = NULL;
+	int i = 0;
+
+	if (*aclp != NULL) {
+		dns_acl_detach(aclp);
+	}
+	if (vconfig != NULL) {
+		maps[i++] = cfg_tuple_get(vconfig, "options");
+	}
+	if (config != NULL) {
+		const cfg_obj_t *options = NULL;
+		(void)cfg_map_get(config, "options", &options);
+		if (options != NULL) {
+			maps[i++] = options;
+		}
+	}
+	maps[i] = NULL;
+
+	(void)named_config_get(maps, "sortlist", &aclobj);
+	if (aclobj == NULL) {
+		return ISC_R_SUCCESS;
+	}
+
+	/*
+	 * Use a nest level of 3 for the "top level" of the sortlist;
+	 * this means each entry in the top three levels will be stored
+	 * as lists of separate, nested ACLs, rather than merged together
+	 * into IP tables as is usually done with ACLs.
+	 */
+	result = cfg_acl_fromconfig(aclobj, config, actx, mctx, 3, aclp);
+
+	return result;
+}
+
 static isc_result_t
 configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 			 const char *confname, const char *conftuplename,
@@ -931,6 +949,15 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 			    initializing ? "initial-key" : "static-key",
 			    namestr, isc_result_totext(result));
 		return ISC_R_SUCCESS;
+	case DST_R_NOCRYPTO:
+		/*
+		 * Crypto support is not available.
+		 */
+		cfg_obj_log(key, ISC_LOG_ERROR,
+			    "ignoring %s for '%s': no crypto support",
+			    initializing ? "initial-key" : "static-key",
+			    namestr);
+		return result;
 	default:
 		/*
 		 * Something unexpected happened; we have no choice but to
@@ -1012,6 +1039,9 @@ cleanup:
 	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
 	}
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
 	return result;
 }
 
@@ -1332,12 +1362,15 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	 * explicit entry for "." when the name is "*".
 	 */
 	if (addroot) {
-		dns_order_add(order, dns_rootname, rdtype, rdclass, mode);
+		result = dns_order_add(order, dns_rootname, rdtype, rdclass,
+				       mode);
+		if (result != ISC_R_SUCCESS) {
+			return result;
+		}
 	}
 
-	dns_order_add(order, dns_fixedname_name(&fixed), rdtype, rdclass, mode);
-
-	return ISC_R_SUCCESS;
+	return dns_order_add(order, dns_fixedname_name(&fixed), rdtype, rdclass,
+			     mode);
 }
 
 static isc_result_t
@@ -1696,7 +1729,7 @@ check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
 	unsigned int i;
 	isc_result_t result = ISC_R_SUCCESS;
 
-	dns_zone_getdbtype(zone, &argv, mctx);
+	CHECK(dns_zone_getdbtype(zone, &argv, mctx));
 
 	/*
 	 * Check that all the arguments match.
@@ -1865,7 +1898,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	isc_buffer_add(&b, strlen(reverse));
 	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 	dns_zone_create(&zone, mctx, 0);
-	dns_zone_setorigin(zone, name);
+	CHECK(dns_zone_setorigin(zone, name));
 	dns_zone_setview(zone, view);
 	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 	dns_zone_setclass(zone, view->rdclass);
@@ -2791,8 +2824,8 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 		obj = cfg_tuple_get(catz_obj, "default-primaries");
 	}
 	if (obj != NULL && cfg_obj_istuple(obj)) {
-		result = named_config_getipandkeylist(config, obj, view->mctx,
-						      &opts->masters);
+		result = named_config_getipandkeylist(
+			config, "primaries", obj, view->mctx, &opts->masters);
 	}
 
 	obj = cfg_tuple_get(catz_obj, "in-memory");
@@ -3235,7 +3268,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 
 	if (pzone == NULL) {
 		CHECK(dns_zonemgr_createzone(named_g_server->zonemgr, &zone));
-		dns_zone_setorigin(zone, name);
+		CHECK(dns_zone_setorigin(zone, name));
 		CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 		if (db == NULL) {
 			dns_zone_setdbtype(zone, empty_dbtypec, empty_dbtype);
@@ -3342,7 +3375,7 @@ create_ipv4only_zone(dns_zone_t *pzone, dns_view_t *view,
 		 * Create the actual zone.
 		 */
 		dns_zone_create(&zone, mctx, 0);
-		dns_zone_setorigin(zone, name);
+		CHECK(dns_zone_setorigin(zone, name));
 		CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 		dns_zone_setclass(zone, view->rdclass);
 		dns_zone_settype(zone, dns_zone_primary);
@@ -3925,6 +3958,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			const cfg_obj_t *name, *search = NULL;
 			char *s = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 
+			if (s == NULL) {
+				result = ISC_R_NOMEMORY;
+				goto cleanup;
+			}
+
 			result = isc_commandline_strtoargv(mctx, s, &dlzargc,
 							   &dlzargv, 0);
 			if (result != ISC_R_SUCCESS) {
@@ -4154,9 +4192,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 				dns64options |= DNS_DNS64_BREAK_DNSSEC;
 			}
 
-			dns_dns64_create(mctx, &na, prefixlen, sp, clients,
-					 mapped, excluded, dns64options,
-					 &dns64);
+			result = dns_dns64_create(mctx, &na, prefixlen, sp,
+						  clients, mapped, excluded,
+						  dns64options, &dns64);
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup;
+			}
 			dns_dns64_append(&view->dns64, dns64);
 			view->dns64cnt++;
 			result = dns64_reverse(view, mctx, &na, prefixlen,
@@ -4752,7 +4793,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		dns_peerlist_t *newpeers = NULL;
 
 		(void)named_config_get(cfgmaps, "server", &peers);
-		dns_peerlist_new(mctx, &newpeers);
+		CHECK(dns_peerlist_new(mctx, &newpeers));
 		for (element = cfg_list_first(peers); element != NULL;
 		     element = cfg_list_next(element))
 		{
@@ -4774,7 +4815,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		const cfg_obj_t *rrsetorder = NULL;
 
 		(void)named_config_get(maps, "rrset-order", &rrsetorder);
-		dns_order_create(mctx, &order);
+		CHECK(dns_order_create(mctx, &order));
 		for (element = cfg_list_first(rrsetorder); element != NULL;
 		     element = cfg_list_next(element))
 		{
@@ -5080,6 +5121,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 				       "except-from", named_g_mctx,
 				       &view->answernames_exclude));
 
+	/*
+	 * Configure sortlist, if set
+	 */
+	CHECK(configure_view_sortlist(vconfig, config, actx, named_g_mctx,
+				      &view->sortlist));
+
 	/*
 	 * Configure default allow-update and allow-update-forwarding ACLs,
 	 * so they can be inherited by zones. (XXX: These are not
@@ -5320,9 +5367,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 		if (dctx == NULL) {
 			const void *hashinit = isc_hash_get_initializer();
-			dns_dyndb_createctx(mctx, hashinit, view,
-					    named_g_server->zonemgr,
-					    named_g_loopmgr, &dctx);
+			CHECK(dns_dyndb_createctx(mctx, hashinit, view,
+						  named_g_server->zonemgr,
+						  named_g_loopmgr, &dctx));
 		}
 
 		CHECK(configure_dyndb(dyndb, mctx, dctx));
@@ -6164,8 +6211,12 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	}
 	INSIST(view == NULL);
 
-	dns_view_create(named_g_mctx, named_g_loopmgr, named_g_dispatchmgr,
-			viewclass, viewname, &view);
+	result = dns_view_create(named_g_mctx, named_g_loopmgr,
+				 named_g_dispatchmgr, viewclass, viewname,
+				 &view);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}
 
 	isc_nonce_buf(view->secret, sizeof(view->secret));
 
@@ -6369,7 +6420,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		} else {
 			CHECK(dns_zonemgr_createzone(named_g_server->zonemgr,
 						     &zone));
-			dns_zone_setorigin(zone, origin);
+			CHECK(dns_zone_setorigin(zone, origin));
 			dns_zone_setview(zone, view);
 			CHECK(dns_zonemgr_managezone(named_g_server->zonemgr,
 						     zone));
@@ -6472,7 +6523,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		 * to create a new one.
 		 */
 		CHECK(dns_zonemgr_createzone(named_g_server->zonemgr, &zone));
-		dns_zone_setorigin(zone, origin);
+		CHECK(dns_zone_setorigin(zone, origin));
 		dns_zone_setview(zone, view);
 		CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 		dns_zone_setstats(zone, named_g_server->zonestats);
@@ -6530,7 +6581,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		if (raw == NULL) {
 			dns_zone_create(&raw, dns_zone_getmem(zone),
 					dns_zone_gettid(zone));
-			dns_zone_setorigin(raw, origin);
+			CHECK(dns_zone_setorigin(raw, origin));
 			dns_zone_setview(raw, view);
 			dns_zone_setstats(raw, named_g_server->zonestats);
 			CHECK(dns_zone_link(zone, raw));
@@ -6631,14 +6682,14 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 
 	/* No existing keydata zone was found; create one */
 	CHECK(dns_zonemgr_createzone(named_g_server->zonemgr, &zone));
-	dns_zone_setorigin(zone, dns_rootname);
+	CHECK(dns_zone_setorigin(zone, dns_rootname));
 
 	defaultview = (strcmp(view->name, "_default") == 0);
 	CHECK(isc_file_sanitize(
 		directory, defaultview ? "managed-keys" : view->name,
 		defaultview ? "bind" : "mkeys", filename, sizeof(filename)));
-	dns_zone_setfile(zone, filename, dns_masterformat_text,
-			 &dns_master_style_default);
+	CHECK(dns_zone_setfile(zone, filename, dns_masterformat_text,
+			       &dns_master_style_default));
 
 	dns_zone_setview(zone, view);
 	dns_zone_settype(zone, dns_zone_key);
@@ -6938,7 +6989,7 @@ tat_send(void *arg) {
 		result = dns_resolver_createfetch(
 			tat->view->resolver, tatname, dns_rdatatype_null,
 			domain, &nameservers, NULL, NULL, 0, 0, 0, NULL, NULL,
-			tat->loop, tat_done, tat, NULL, &tat->rdataset,
+			tat->loop, tat_done, tat, &tat->rdataset,
 			&tat->sigrdataset, &tat->fetch);
 	}
 
@@ -7868,7 +7919,7 @@ load_configuration(const char *filename, named_server_t *server,
 	ns_altsecretlist_t altsecrets, tmpaltsecrets;
 	uint32_t softquota = 0;
 	uint32_t max;
-	uint64_t initial, idle, keepalive, advertised, primaries;
+	uint64_t initial, idle, keepalive, advertised;
 	bool loadbalancesockets;
 	bool exclusive = true;
 	dns_aclenv_t *env =
@@ -8207,29 +8258,8 @@ load_configuration(const char *filename, named_server_t *server,
 		advertised = MAX_ADVERTISED_TIMEOUT;
 	}
 
-	obj = NULL;
-	result = named_config_get(maps, "tcp-primaries-timeout", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	primaries = cfg_obj_asuint32(obj) * 100;
-	if (primaries > MAX_PRIMARIES_TIMEOUT) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "tcp-primaries-timeout value is out of range: "
-			    "lowering to %" PRIu32,
-			    MAX_PRIMARIES_TIMEOUT / 100);
-		primaries = MAX_PRIMARIES_TIMEOUT;
-	} else if (primaries < MIN_PRIMARIES_TIMEOUT) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "tcp-primaries-timeout value is out of range: "
-			    "raising to %" PRIu32,
-			    MIN_PRIMARIES_TIMEOUT / 100);
-		primaries = MIN_PRIMARIES_TIMEOUT;
-	}
-
-	isc_nm_setinitialtimeout(named_g_netmgr, initial);
-	isc_nm_setprimariestimeout(named_g_netmgr, primaries);
-	isc_nm_setidletimeout(named_g_netmgr, idle);
-	isc_nm_setkeepalivetimeout(named_g_netmgr, keepalive);
-	isc_nm_setadvertisedtimeout(named_g_netmgr, advertised);
+	isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
+			   advertised);
 
 #define CAP_IF_NOT_ZERO(v, min, max) \
 	if (v > 0 && v < min) {      \
@@ -8272,8 +8302,20 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Configure sets of UDP query source ports.
 	 */
-	isc_portset_create(named_g_mctx, &v4portset);
-	isc_portset_create(named_g_mctx, &v6portset);
+	result = isc_portset_create(named_g_mctx, &v4portset);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "creating UDP/IPv4 port set: %s",
+			      isc_result_totext(result));
+		goto cleanup_bindkeys_parser;
+	}
+	result = isc_portset_create(named_g_mctx, &v6portset);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "creating UDP/IPv6 port set: %s",
+			      isc_result_totext(result));
+		goto cleanup_v4portset;
+	}
 
 	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
 	if (result != ISC_R_SUCCESS) {
@@ -8281,7 +8323,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      ISC_LOG_ERROR,
 			      "get the default UDP/IPv4 port range: %s",
 			      isc_result_totext(result));
-		goto cleanup_portsets;
+		goto cleanup_v6portset;
 	}
 
 	isc_portset_addrange(v4portset, udpport_low, udpport_high);
@@ -8299,7 +8341,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      ISC_LOG_ERROR,
 			      "get the default UDP/IPv6 port range: %s",
 			      isc_result_totext(result));
-		goto cleanup_portsets;
+		goto cleanup_v6portset;
 	}
 	isc_portset_addrange(v6portset, udpport_low, udpport_high);
 	if (!ns_server_getoption(server->sctx, NS_SERVER_DISABLE6)) {
@@ -8378,7 +8420,7 @@ load_configuration(const char *filename, named_server_t *server,
 	} else {
 		result = named_config_getport(config, "port", &listen_port);
 		if (result != ISC_R_SUCCESS) {
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 	}
 
@@ -8425,13 +8467,13 @@ load_configuration(const char *filename, named_server_t *server,
 
 		result = named_config_get(maps, "listen-on", &clistenon);
 		if (result != ISC_R_SUCCESS) {
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 		result = listenlist_fromconfig(
 			clistenon, config, named_g_aclconfctx, named_g_mctx,
 			AF_INET, server->tlsctx_server_cache, &listenon);
 		if (result != ISC_R_SUCCESS) {
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 		if (listenon != NULL) {
 			ns_interfacemgr_setlistenon4(server->interfacemgr,
@@ -8449,13 +8491,13 @@ load_configuration(const char *filename, named_server_t *server,
 
 		result = named_config_get(maps, "listen-on-v6", &clistenon);
 		if (result != ISC_R_SUCCESS) {
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 		result = listenlist_fromconfig(
 			clistenon, config, named_g_aclconfctx, named_g_mctx,
 			AF_INET6, server->tlsctx_server_cache, &listenon);
 		if (result != ISC_R_SUCCESS) {
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 		if (listenon != NULL) {
 			ns_interfacemgr_setlistenon6(server->interfacemgr,
@@ -8485,7 +8527,7 @@ load_configuration(const char *filename, named_server_t *server,
 				      "unable to listen on any configured "
 				      "interfaces");
 			result = ISC_R_FAILURE;
-			goto cleanup_portsets;
+			goto cleanup_v6portset;
 		}
 	}
 
@@ -9292,8 +9334,10 @@ cleanup_keystorelist:
 		dns_keystore_detach(&keystore);
 	}
 
-cleanup_portsets:
+cleanup_v6portset:
 	isc_portset_destroy(named_g_mctx, &v6portset);
+
+cleanup_v4portset:
 	isc_portset_destroy(named_g_mctx, &v4portset);
 
 cleanup_bindkeys_parser:
@@ -10106,39 +10150,6 @@ named_server_closelogswanted(void *arg, int signum) {
 	isc_async_run(named_g_mainloop, named_server_closelogs, server);
 }
 
-#ifdef JEMALLOC_API_SUPPORTED
-static isc_result_t
-memprof_toggle(bool active) {
-	if (mallctl("prof.active", NULL, NULL, &active, sizeof(active)) != 0) {
-		return ISC_R_FAILURE;
-	}
-
-	return ISC_R_SUCCESS;
-}
-
-static isc_result_t
-memprof_dump(void) {
-	if (mallctl("prof.dump", NULL, NULL, NULL, 0) != 0) {
-		return ISC_R_FAILURE;
-	}
-
-	return ISC_R_SUCCESS;
-}
-#else
-static isc_result_t
-memprof_toggle(bool active) {
-	UNUSED(active);
-
-	return ISC_R_NOTIMPLEMENTED;
-}
-
-static isc_result_t
-memprof_dump(void) {
-	return ISC_R_NOTIMPLEMENTED;
-}
-
-#endif /* JEMALLOC_API_SUPPORTED */
-
 void
 named_server_scan_interfaces(named_server_t *server) {
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
@@ -12011,10 +12022,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 			 : "OFF");
 	CHECK(putstr(text, line));
 
-	snprintf(line, sizeof(line), "memory profiling is %s\n",
-		 named_server_getmemprof());
-	CHECK(putstr(text, line));
-
 	snprintf(line, sizeof(line), "recursive clients: %u/%u/%u\n",
 		 isc_quota_getused(&server->sctx->recursionquota),
 		 isc_quota_getsoft(&server->sctx->recursionquota),
@@ -14634,16 +14641,10 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		/*
 		 * Output the DNSSEC status of the key and signing policy.
 		 */
-		isc_result_t r;
 		LOCK(&kasp->lock);
-		r = dns_keymgr_status(kasp, &keys, now, &output[0],
-				      sizeof(output));
+		dns_keymgr_status(kasp, &keys, now, &output[0], sizeof(output));
 		UNLOCK(&kasp->lock);
 		CHECK(putstr(text, output));
-		if (r != ISC_R_SUCCESS) {
-			CHECK(putstr(text,
-				     "\n\nStatus output is truncated..."));
-		}
 	} else if (checkds) {
 		/*
 		 * Mark DS record has been seen, so it may move to the
@@ -15825,7 +15826,7 @@ isc_result_t
 named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 	char *ptr;
 	isc_result_t result = ISC_R_SUCCESS;
-	uint32_t initial, idle, keepalive, advertised, primaries;
+	uint32_t initial, idle, keepalive, advertised;
 	char msg[128];
 
 	/* Skip the command name. */
@@ -15834,11 +15835,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		return ISC_R_UNEXPECTEDEND;
 	}
 
-	initial = isc_nm_getinitialtimeout(named_g_netmgr);
-	primaries = isc_nm_getprimariestimeout(named_g_netmgr);
-	idle = isc_nm_getidletimeout(named_g_netmgr);
-	keepalive = isc_nm_getkeepalivetimeout(named_g_netmgr);
-	advertised = isc_nm_getadvertisedtimeout(named_g_netmgr);
+	isc_nm_gettimeouts(named_g_netmgr, &initial, &idle, &keepalive,
+			   &advertised);
 
 	/* Look for optional arguments. */
 	ptr = next_token(lex, NULL);
@@ -15888,24 +15886,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 			CHECK(ISC_R_RANGE);
 		}
 
-		ptr = next_token(lex, text);
-		if (ptr == NULL) {
-			return ISC_R_UNEXPECTEDEND;
-		}
-		CHECK(isc_parse_uint32(&primaries, ptr, 10));
-		primaries *= 100;
-		if (primaries > MAX_PRIMARIES_TIMEOUT) {
-			CHECK(ISC_R_RANGE);
-		}
-		if (primaries < MIN_PRIMARIES_TIMEOUT) {
-			CHECK(ISC_R_RANGE);
-		}
-
-		isc_nm_setinitialtimeout(named_g_netmgr, initial);
-		isc_nm_setprimariestimeout(named_g_netmgr, primaries);
-		isc_nm_setidletimeout(named_g_netmgr, idle);
-		isc_nm_setkeepalivetimeout(named_g_netmgr, keepalive);
-		isc_nm_setadvertisedtimeout(named_g_netmgr, advertised);
+		isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
+				   advertised);
 	}
 
 	snprintf(msg, sizeof(msg), "tcp-initial-timeout=%u\n", initial / 100);
@@ -15915,11 +15897,9 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 	snprintf(msg, sizeof(msg), "tcp-keepalive-timeout=%u\n",
 		 keepalive / 100);
 	CHECK(putstr(text, msg));
-	snprintf(msg, sizeof(msg), "tcp-advertised-timeout=%u\n",
+	snprintf(msg, sizeof(msg), "tcp-advertised-timeout=%u",
 		 advertised / 100);
 	CHECK(putstr(text, msg));
-	snprintf(msg, sizeof(msg), "tcp-primaries-timeout=%u", primaries / 100);
-	CHECK(putstr(text, msg));
 
 cleanup:
 	if (isc_buffer_usedlength(*text) > 0) {
@@ -16246,113 +16226,3 @@ cleanup:
 
 	return result;
 }
-
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex) {
-	isc_result_t result = ISC_R_FAILURE;
-	bool active;
-	char *ptr;
-
-	/* Skip the command name. */
-	ptr = next_token(lex, NULL);
-	if (ptr == NULL) {
-		return ISC_R_UNEXPECTEDEND;
-	}
-
-	ptr = next_token(lex, NULL);
-	if (ptr == NULL) {
-		return ISC_R_UNEXPECTEDEND;
-	} else if (!strcasecmp(ptr, "dump")) {
-		result = memprof_dump();
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "failed to dump memory profile");
-
-		} else {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "memory profile dumped");
-		}
-
-		goto done;
-	} else if (!strcasecmp(ptr, "on") || !strcasecmp(ptr, "yes") ||
-		   !strcasecmp(ptr, "enable") || !strcasecmp(ptr, "true"))
-	{
-		active = true;
-	} else if (!strcasecmp(ptr, "off") || !strcasecmp(ptr, "no") ||
-		   !strcasecmp(ptr, "disable") || !strcasecmp(ptr, "false"))
-	{
-		active = false;
-	} else {
-		return DNS_R_SYNTAX;
-	}
-
-	result = memprof_toggle(active);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
-			      "failed to toggle memory profiling");
-	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_INFO, "memory profiling %s",
-			      active ? "enabled" : "disabled");
-	}
-
-done:
-	return result;
-}
-
-#ifdef JEMALLOC_API_SUPPORTED
-const char *
-named_server_getmemprof(void) {
-	memprof_status status = MEMPROF_ON;
-	bool is_enabled;
-	size_t len = sizeof(is_enabled);
-
-	if (mallctl("config.prof", &is_enabled, &len, NULL, 0) != 0) {
-		status = MEMPROF_FAILING;
-		goto done;
-	}
-
-	INSIST(len == sizeof(is_enabled));
-
-	if (!is_enabled) {
-		status = MEMPROF_UNSUPPORTED;
-		goto done;
-	}
-
-	if (mallctl("opt.prof", &is_enabled, &len, NULL, 0) != 0) {
-		status = MEMPROF_FAILING;
-		goto done;
-	}
-
-	INSIST(len == sizeof(is_enabled));
-
-	if (!is_enabled) {
-		status = MEMPROF_INACTIVE;
-		goto done;
-	}
-
-	len = sizeof(is_enabled);
-	if (mallctl("prof.active", &is_enabled, &len, NULL, 0) != 0) {
-		status = MEMPROF_FAILING;
-		goto done;
-	}
-
-	INSIST(len == sizeof(is_enabled));
-
-	if (!is_enabled) {
-		status = MEMPROF_OFF;
-	}
-
-done:
-	return memprof_status_text[status];
-}
-
-#else  /* JEMALLOC_API_SUPPORTED */
-const char *
-named_server_getmemprof(void) {
-	return memprof_status_text[MEMPROF_UNSUPPORTED];
-}
-#endif /* JEMALLOC_API_SUPPORTED */

bin/named/tkeyconf.c

@@ -53,7 +53,10 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_buffer_t b;
 	const cfg_obj_t *obj;
 
-	dns_tkeyctx_create(mctx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}
 
 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);

bin/named/zoneconf.c

@@ -897,7 +897,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = ZONEDB_DEFAULT;
@@ -907,7 +906,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
-	bool multi;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -978,6 +976,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
+	if (cpval == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}
 
 	obj = NULL;
 	result = cfg_map_get(zoptions, "dlz", &obj);
@@ -1106,20 +1107,24 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;
 
-		dns_zone_setfile(raw, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 
 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		dns_zone_setfile(zone, signedname, dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
+		CHECK(result);
 	} else {
-		dns_zone_setfile(zone, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}
 
 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}
 
 	/*
@@ -1266,8 +1271,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1620,7 +1625,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			dns_zone_setkeydirectory(zone, filename);
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 		/* Also save a reference to the keystore list. */
 		dns_zone_setkeystores(zone, keystorelist);
@@ -1672,8 +1677,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1830,7 +1836,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
-		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "primaries", &obj);
 		if (obj == NULL) {
@@ -1845,7 +1850,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1853,27 +1858,17 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
-			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
 			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
 					      0);
 		}
 
-		multi = false;
-		if (count > 1) {
-			obj = NULL;
-			result = named_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			multi = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);

bin/nsupdate/nsupdate.c

@@ -766,12 +766,14 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 	in_port_t udpport_low, udpport_high;
 	isc_result_t result;
 
-	isc_portset_create(gmctx, &v4portset);
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
 	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
 	check_result(result, "isc_net_getudpportrange (v4)");
 	isc_portset_addrange(v4portset, udpport_low, udpport_high);
 
-	isc_portset_create(gmctx, &v6portset);
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
 	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
 	check_result(result, "isc_net_getudpportrange (v6)");
 	isc_portset_addrange(v6portset, udpport_low, udpport_high);
@@ -2663,9 +2665,9 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 
 	result = dns_request_create(requestmgr, updatemsg, srcaddr, primary,
 				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, timeout, timeout, udp_timeout,
-				    udp_retries, isc_loop_main(loopmgr),
-				    update_completed, NULL, &request);
+				    tsigkey, timeout, udp_timeout, udp_retries,
+				    isc_loop_main(loopmgr), update_completed,
+				    NULL, &request);
 	check_result(result, "dns_request_create");
 
 	if (debugging) {
@@ -2768,11 +2770,11 @@ recvsoa(void *arg) {
 			srcaddr = localaddr4;
 		}
 
-		result = dns_request_create(
-			requestmgr, soaquery, srcaddr, addr, req_transport,
-			req_tls_ctx_cache, options, NULL, timeout, timeout,
-			udp_timeout, udp_retries, isc_loop_main(loopmgr),
-			recvsoa, reqinfo, &request);
+		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
+					    req_transport, req_tls_ctx_cache,
+					    options, NULL, timeout, udp_timeout,
+					    udp_retries, isc_loop_main(loopmgr),
+					    recvsoa, reqinfo, &request);
 		check_result(result, "dns_request_create");
 		requests++;
 		return;
@@ -3007,8 +3009,8 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	result = dns_request_create(
 		requestmgr, msg, srcaddr, destaddr, req_transport,
 		req_tls_ctx_cache, options, default_servers ? NULL : tsigkey,
-		timeout, timeout, udp_timeout, udp_retries,
-		isc_loop_main(loopmgr), recvsoa, reqinfo, request);
+		timeout, udp_timeout, udp_retries, isc_loop_main(loopmgr),
+		recvsoa, reqinfo, request);
 	check_result(result, "dns_request_create");
 	requests++;
 }
@@ -3208,11 +3210,10 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}
 
-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
-				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, timeout, timeout, udp_timeout,
-				    udp_retries, isc_loop_main(loopmgr),
-				    recvgss, reqinfo, request);
+	result = dns_request_create(
+		requestmgr, msg, srcaddr, destaddr, req_transport,
+		req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
+		udp_retries, isc_loop_main(loopmgr), recvgss, reqinfo, request);
 	check_result(result, "dns_request_create");
 	if (debugging) {
 		show_message(stdout, msg, "Outgoing update query:");
@@ -3519,7 +3520,7 @@ getinput(void *arg) {
 
 int
 main(int argc, char **argv) {
-	const uint32_t timeoutms = timeout * MS_PER_SEC;
+	uint32_t timeoutms;
 
 	style = &dns_master_style_debug;
 
@@ -3544,11 +3545,8 @@ main(int argc, char **argv) {
 	parse_args(argc, argv);
 
 	/* Set the network manager timeouts in milliseconds. */
-	isc_nm_setinitialtimeout(netmgr, timeoutms);
-	isc_nm_setprimariestimeout(netmgr, timeoutms);
-	isc_nm_setidletimeout(netmgr, timeoutms);
-	isc_nm_setkeepalivetimeout(netmgr, timeoutms);
-	isc_nm_setadvertisedtimeout(netmgr, timeoutms);
+	timeoutms = timeout * 1000;
+	isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);
 
 	isc_loopmgr_setup(loopmgr, setup_system, NULL);
 	isc_loopmgr_setup(loopmgr, getinput, NULL);

bin/rndc/rndc.c

@@ -143,10 +143,6 @@ command is one of the following:\n\
 		Display RFC 5011 managed keys information\n\
   managed-keys sync [class [view]]\n\
 		Write RFC 5011 managed keys to disk\n\
-  memprof [ on | off | dump ]\n\
-		Enable / disable memory profiling or dump the profile.\n\
-		Requires named to built with jemalloc and run with the relevant\n\
-		MALLOC_CONF environment variables.\n\
   modzone zone [class [view]] { zone-options }\n\
 		Modify a zone's configuration.\n\
 		Requires allow-new-zones option.\n\
@@ -212,7 +208,7 @@ command is one of the following:\n\
 		Dump a single zone's changes to disk, and optionally\n\
 		remove its journal file.\n\
   tcp-timeouts	Display the tcp-*-timeout option values\n\
-  tcp-timeouts initial idle keepalive advertised primaries\n\
+  tcp-timeouts initial idle keepalive advertised\n\
 		Update the tcp-*-timeout option values\n\
   thaw		Enable updates to all dynamic zones and reload them.\n\
   thaw zone [class [view]]\n\
@@ -957,10 +953,7 @@ main(int argc, char **argv) {
 	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr);
 	isc_loopmgr_setup(loopmgr, rndc_start, NULL);
 
-	isc_nm_setinitialtimeout(netmgr, timeout);
-	isc_nm_setprimariestimeout(netmgr, timeout);
-	isc_nm_setidletimeout(netmgr, timeout);
-	isc_nm_setkeepalivetimeout(netmgr, timeout);
+	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);
 
 	logconfig = isc_logconfig_get();
 	isc_log_settag(logconfig, progname);

bin/rndc/rndc.rst

@@ -322,19 +322,6 @@ Currently supported commands are:
       keys in the event of a trust anchor rollover, or as a brute-force
       repair for key maintenance problems.
 
-.. option:: memprof [(on | off | dump)]
-
-   This command controls memory profiling. To have any effect, :iscman:`named` must be
-   built with jemalloc, the library have profiling support enabled and run with the
-   ``prof:true`` allocator configuration. (either via ``MALLOC_CONF`` or ``/etc/malloc.conf``)
-
-   The ``prof_active:false`` option is recommended to ensure the profiling overhead does
-   not affect :iscman:`named` when not needed.
-
-   The ``on`` and ``off`` options will start and stop the jemalloc memory profiling respectively.
-   When run with the `dump` option, :iscman:`named` will dump the profile to the working
-   directory. The name will be chosen automatically by jemalloc.
-
 .. option:: modzone zone [class [view]] configuration
 
    This command modifies the configuration of a zone while the server is running. This

bin/rndc/util.h

@@ -17,6 +17,7 @@
 
 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 
 #define NS_CONTROL_PORT 953
 
@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)
 
+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
 
 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS

bin/tests/system/Makefile.am

@@ -150,6 +150,7 @@ TESTS =				\
 	sfcache			\
 	shutdown		\
 	smartsign		\
+	sortlist		\
 	spf			\
 	staticstub		\
 	statistics		\

bin/tests/system/addzone/ns3/named1.conf.in

@@ -34,6 +34,6 @@ zone "." {
 	file "redirect.db";
 };
 
-remote-servers "test" {
+primaries "test" {
 	10.53.0.99;
 };

bin/tests/system/checkconf/bad-duplicate-primaries-1.conf

@@ -11,5 +11,5 @@
  * information regarding copyright ownership.
  */
 
-remote-servers duplicate { 1.2.3.4; };
+primaries duplicate { 1.2.3.4; };
 primaries duplicate { 4.3.2.1; };

bin/tests/system/checkconf/bad-duplicate-primaries-2.conf

@@ -11,5 +11,5 @@
  * information regarding copyright ownership.
  */
 
-remote-servers duplicate { 1.2.3.4; };
-remote-servers duplicate { 4.3.2.1; };
+masters duplicate { 1.2.3.4; };
+primaries duplicate { 4.3.2.1; };

bin/tests/system/checkconf/bad-parental-agents-def-view2.conf

@@ -12,7 +12,7 @@
  */
 
 view "test" {
-	remote-servers "net" {
+	parental-agents "net" {
 		192.168.1.2;
 	 };
 	zone "example.net" {

bin/tests/system/checkconf/bad-parental-agents-dupdef.conf

@@ -11,11 +11,11 @@
  * information regarding copyright ownership.
  */
 
-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.1;
 };
 
-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.2;
 };
 

bin/tests/system/checkconf/bad-parental-agents-empty.conf

@@ -11,7 +11,7 @@
  * information regarding copyright ownership.
  */
 
-remote-servers "net" { };
+parental-agents "net" { };
 
 zone "example.net" {
 	type primary;

bin/tests/system/checkconf/bad-parental-agents-notfound.conf

@@ -11,7 +11,7 @@
  * information regarding copyright ownership.
  */
 
-remote-servers "com" {
+parental-agents "com" {
 	192.168.1.2;
 };
 

bin/tests/system/checkconf/bad-primaries-notfound.conf

@@ -11,7 +11,7 @@
  * information regarding copyright ownership.
  */
 
-remote-servers "net" {
+primaries "net" {
 	 192.168.1.2;
 };
 

bin/tests/system/checkconf/deprecated.conf

@@ -14,6 +14,8 @@
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;
+
+	sortlist { };
 };
 
 trust-anchors {

bin/tests/system/checkconf/good-masters-and-primaries.conf

@@ -11,5 +11,5 @@
  * information regarding copyright ownership.
  */
 
-remote-servers a { 1.2.3.4; };
-remote-servers b { 1.2.3.4; };
+masters a { 1.2.3.4; };
+primaries b { 1.2.3.4; };

bin/tests/system/checkconf/good.conf.in

@@ -86,7 +86,7 @@ options {
 	transfer-source 0.0.0.0;
 	zone-statistics none;
 };
-remote-servers "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
+parental-agents "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
 	10.10.10.11;
 	2001:db8::11;
 };

bin/tests/system/checkconf/inline-bad.conf

@@ -12,8 +12,8 @@
  */
 
 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";

bin/tests/system/checkconf/inline-good.conf

@@ -12,8 +12,8 @@
  */
 
 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	file "/var/cache/bind/example.net.db";

bin/tests/system/checkconf/inline-no.conf

@@ -12,8 +12,8 @@
  */
 
 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";

bin/tests/system/checkconf/tests.sh

@@ -184,6 +184,7 @@ echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1 || ret=1
 grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
+grep "option 'sortlist' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 # set -i to ignore deprecate warnings
@@ -735,5 +736,16 @@ if [ $ret != 0 ]; then
 fi
 status=$((status + ret))
 
+n=$((n + 1))
+echo_i "check for obsolete option warnings ($n)"
+ret=0
+$CHECKCONF warn-obsolete.conf >checkconf.out$n 2>&1 || ret=1
+grep -F "option 'multi-master' is obsolete and should be removed" checkconf.out$n >/dev/null || ret=1
+if [ $ret != 0 ]; then
+  echo_i "failed"
+  ret=1
+fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkconf/warn-obsolete.conf

@@ -11,18 +11,8 @@
  * information regarding copyright ownership.
  */
 
-remote-servers "one" {
-	1.2.3.4;
-};
-
-parental-agents "two" {
-	1.2.3.5;
-};
-
-primaries "three" {
-	1.2.3.6;
-};
-
-masters "four" {
-	1.2.3.7;
+zone . {
+	type secondary;
+	primaries { 10.53.0.1; 10.53.0.2; };
+	multi-master yes;
 };

bin/tests/system/checkds/ns9/named.conf.in

@@ -37,7 +37,7 @@ controls {
 	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
-remote-servers "ns8" port @PORT@ {
+parental-agents "ns8" port @PORT@ {
 	10.53.0.8;
 };
 

bin/tests/system/checkzone/tests.sh

@@ -44,10 +44,6 @@ for db in zones/bad*.db; do
     zones/bad-dns-sd-reverse.db | zones/bad-svcb-servername.db)
       $CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db >test.out.$n 2>&1 || v=$?
       ;;
-    bad-cname-and*.db)
-      $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
-      grep "CNAME and other data" test.out.$n >/dev/null || ret=1
-      ;;
     *)
       $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
       ;;
@@ -222,41 +218,5 @@ echo $lines
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkzone/zones/bad-cname-and-a.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		A	192.0.2.1
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-a6.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A6	0 ::1
-bad		WKS	10.0.0.1 tcp telnet ftp 0 1 2
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-aaaa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AAAA	::1
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-afsdb.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		BAD	65535 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-apl.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		APL
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-atma.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMA	+61200000000
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-atmrelay.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMRELAY	0 0 0
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-avc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AVC	foo:bar
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-caa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CAA	128 tbs "Unknown"
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cdnskey.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cds.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cert.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CERT	65534 65535 254 (
-			MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
-			kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
-			VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-csync.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CSYNC	0 0 A NS AAAA
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dhcid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DHCID	AAIBY2/AuCccgoJbsaxcQc9TUapptP69l OjxfNuVAA2kjEA=
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dlv.db

@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DLV	30795 1 1 (
-			310D27F4D82C1FC2400704EA9939FE6E1CEA
-			A3B9 )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dname.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DNAME	@
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-doa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EID	12 89 AB
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eui48.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI48	01-23-45-67-89-ab
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eui64.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI64	01-23-45-67-89-ab-cd-ef
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-gpos.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		GPOS	-22.6882 116.8652 250.0
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-hinfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HINFO	. .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-hip.db

@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HIP	( 2 200100107B1A74DF365639CC39F1D578
-			AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
-			rvs.example.com. )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-https.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HTTPS	0 example.net.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ipseckey.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		IPSECKEY	10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-isdn.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ISDN	isdn-address
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-kx.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		KX	10 kcd
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-l32.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		L32	10 1.2.3.4
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-l64.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		L64	10 0014:4fff:ff20:ee64
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-loc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		LOC	60 9 N 24 39 E 10 20 2000 20
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-lp.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		LP	10 example.net.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-md.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MD	madname
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-mg.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MG	mgmname
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-minfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MINFO	. .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-mx.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MX	10 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-naptr.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NAPTR	0 0 "" "" "" .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NID	10 0014:4fff:ff20:ee64
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nimloc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NIMLOC	12 89 AB
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ninfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NINFO	"foo"
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ns-soa.db

@@ -1,16 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-@		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nsap-ptr.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NSAP-PTR	.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nsap.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NSAP	0x47.0005.80.005a00.0000.0001.e133.ffffff000161.00
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-opengpgkey.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		OPENGPGKEY	( AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@