Merge branch 'prep-release' into v9_14_0_patch

release note for allow-update bug

See merge request isc-projects/bind9!1706

.dir-locals.el

@@ -53,7 +53,6 @@
 
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
-	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")
 	       (expand-file-name "/usr/local/include")
 	       )
 	      )
@@ -61,12 +60,5 @@
 
    (eval setq flycheck-clang-include-path include-directories)
    (eval setq flycheck-cppcheck-include-path include-directories)
-   (eval setq flycheck-clang-args
-	 (list
-	  "-include"
-	  (expand-file-name
-	   (concat directory-of-current-dir-locals-file "config.h"))
-	  )
-	 )
    )
   ))

.gitattributes

@@ -1,2 +1,3 @@
 *.sln.in eol=crlf
-*.vcxproj.* eol=crlf
+*.vcxproj.in eol=crlf
+*.vcxproj.filters.in eol=crlf

.gitignore

@@ -1,58 +1,36 @@
-*-symtbl.c
-*.a
-*.gcda
-*.gcno
-*.la
-*.lo
-*.o
-*.orig
-*.plist/ # ccc-analyzer store its results in .plist directories
+Makefile
+config.log
+config.h
+config.cache
+config.status
+libtool
+/isc-config.sh
+/configure.lineno
+autom4te.cache/
 *.rej
+*.orig
+*.o
+*.lo
 *.so
+*.a
+*.la
+*.gcno
+*.gcda
 *_test
-*~
+*-symtbl.c
+timestamp
+ans.run
+named.run
+named.memstats
+gen.dSYM/
 .ccache/
-.cproject
 .deps/
 .dirstamp
 .libs/
+# ccc-analyzer store its results in .plist directories
+*.plist/
+*~
 .project
+.cproject
 .settings
-/aclocal.m4
-/ar-lib
-/autom4te.cache/
-/bind.keys.h
-/compile
-/config.cache
-/config.guess
-/config.h
-/config.h.in
-/config.log
-/config.status
-/config.sub
-/configure
-/configure.lineno
-/depcomp
-/install-sh
-/isc-config.sh
-/libltdl/*
-/libtool
-/ltmain.sh
-/m4/libtool.m4
-/m4/ltargz.m4
-/m4/ltdl.m4
-/m4/ltoptions.m4
-/m4/ltsugar.m4
-/m4/ltversion.m4
-/m4/lt~obsolete.m4
-/missing
-/py-compile
-/stamp-h1
-/test-driver
-Makefile
-ans.run
-gen.dSYM/
-kyua.log
-named.memstats
-named.run
-timestamp
+kyua.log

.gitlab-ci.yml

@@ -8,12 +8,6 @@ variables:
   CCACHE_DIR: "/ccache"
   SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
-  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
-  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
-
-  BUILD_PARALLEL_JOBS: 6
-  TEST_PARALLEL_JOBS: 6
-
 stages:
   - precheck
   - build
@@ -50,6 +44,10 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
   <<: *linux_amd64
 
+.debian-jessie-i386: &debian_jessie_i386_image
+  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
+  <<: *linux_i386
+
 .debian-stretch-amd64: &debian_stretch_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
   <<: *linux_amd64
@@ -58,10 +56,6 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
   <<: *linux_i386
 
-.debian-buster-amd64: &debian_buster_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  <<: *linux_i386
-
 .debian-sid-amd64: &debian_sid_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
   <<: *linux_amd64
@@ -107,62 +101,26 @@ stages:
   <<: *debian_sid_amd64_image
   stage: precheck
 
-.autoconf: &autoconf_job
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  script:
-    - autoreconf -fi
-  artifacts:
-    untracked: true
-    expire_in: "1 hour"
-
-.configure: &configure |
-    ./configure \
-    --disable-maintainer-mode \
-    --enable-developer \
-    --with-libtool \
-    --disable-static \
-    --with-cmocka \
-    --with-libxml2 \
-    --with-json-c \
-    --prefix=$HOME/.local \
-    --without-make-clean \
-    $EXTRA_CONFIGURE \
-    || cat config.log
-    
 .build: &build_job
   <<: *default_triggering_rules
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
   script:
-    - *configure
+    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
-  dependencies:
-    - autoreconf:sid:amd64
   artifacts:
     untracked: true
     expire_in: "1 hour"
 
-.setup_interfaces: &setup_interfaces |
-    if [ "$(id -u)" -eq "0" ]; then
-      bash -x bin/tests/system/ifconfig.sh up;
-    else
-      sudo bash -x bin/tests/system/ifconfig.sh up;
-    fi
-
-.setup_softhsm: &setup_softhsm |
-    bash -x util/prepare-softhsm2.sh
-
 .system_test: &system_test_job
   <<: *default_triggering_rules
   stage: test
   retry: 2
   before_script:
-    - *setup_interfaces
-    - *setup_softhsm
+    - bash -x bin/tests/system/ifconfig.sh up
+    - bash -x util/prepare-softhsm2.sh
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -171,22 +129,16 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
-.kyua_report: &kyua_report_html |
-  kyua report-html \
-       --force \
-       --results-file "$KYUA_RESULT" \
-       --results-filter "" \
-       --output kyua_html
-
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
   stage: test
   before_script:
-    - *setup_softhsm
+    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
+    - bash -x util/prepare-softhsm2.sh
   script:
     - make unit
   after_script:
-    - *kyua_report_html
+    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
   artifacts:
     paths:
       - kyua.log
@@ -199,9 +151,6 @@ stages:
 
 # Jobs in the precheck stage
 
-autoreconf:sid:amd64:
-  <<: *autoconf_job
-
 misc:sid:amd64:
   <<: *precheck_job
   script:
@@ -239,8 +188,6 @@ docs:sid:amd64:
     - ./configure || cat config.log
     - make -C doc/misc docbook
     - make -C doc/arm Bv9ARM.html
-  dependencies:
-    - autoreconf:sid:amd64
   artifacts:
     paths:
       - doc/arm/
@@ -312,7 +259,7 @@ gcc:jessie:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
+    EXTRA_CONFIGURE: "--without-cmocka --with-python"
   <<: *debian_jessie_amd64_image
   <<: *build_job
 
@@ -349,34 +296,13 @@ unit:gcc:stretch:amd64:
   dependencies:
     - gcc:stretch:amd64
 
-# Jobs for regular GCC builds on Debian 10 Buster (amd64)
-
-gcc:buster:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *debian_buster_amd64_image
-  <<: *build_job
-
-system:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:buster:amd64
-
-unit:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:buster:amd64
-
 # Jobs for regular GCC builds on Debian Sid (amd64)
 
 gcc:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
-    EXTRA_CONFIGURE: "--with-libidn22"
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
     RUN_MAKE_INSTALL: 1
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -398,7 +324,7 @@ unit:gcc:sid:amd64:
 gcc:sid:i386:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2 --without-python"
   <<: *debian_sid_i386_image
   <<: *build_job
@@ -443,7 +369,6 @@ gcc:xenial:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--disable-geoip"
   <<: *ubuntu_xenial_amd64_image
   <<: *build_job
 
@@ -504,49 +429,6 @@ unit:asan:sid:amd64:
   dependencies:
     - asan:sid:amd64
 
-rwlock:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-system:rwlock:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - rwlock:sid:amd64
-
-unit:rwlock:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - rwlock:sid:amd64
-
-# Jobs for mutex-based atomics on Debian SID (amd64)
-mutexatomics:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-#system:mutexatomics:sid:amd64:
-#  <<: *debian_sid_amd64_image
-#  <<: *system_test_job
-#  dependencies:
-#    - mutexatomics:sid:amd64
-#  allow_failure: true
-
-#unit:mutexatomics:sid:amd64:
-#  <<: *debian_sid_amd64_image
-#  <<: *unit_test_job
-#  dependencies:
-#    - mutexatomics:sid:amd64
-#  allow_failure: true
-
 # Jobs for Clang builds on Debian Stretch (amd64)
 
 clang:stretch:amd64:
@@ -594,25 +476,3 @@ unit:pkcs11:sid:amd64:
   <<: *unit_test_job
   dependencies:
     - pkcs11:sid:amd64
-
-# Jobs with libtool disabled
-
-nolibtool:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -Og -g"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-system:nolibtool:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - nolibtool:sid:amd64
-
-unit:nolibtool:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - nolibtool:sid:amd64

CHANGES

@@ -1,309 +1,11 @@
-5266.	[bug]		named-checkconf failed to report dnstap-output
-			missing from named.conf when dnstap was specified.
-			[GL #1136]
+	--- 9.14.0 released ---
 
-5265.	[bug]		DNS64 and RPZ nodata (CNAME *.) rules interacted badly
-			[GL #1106]
-
-5264.	[func]		New DNS Cookie algorithm - siphash24 - has been added
-			to BIND 9, and the old HMAC-SHA DNS Cookie algorithms
-			have been removed. [GL #605]
-
-	--- 9.15.2 released ---
-
-5263.	[cleanup]	Use atomics and isc_refcount_t wherever possible.
-			[GL #1038]
-
-5262.	[func]		Removed support for the legacy GeoIP API. [GL #1112]
-
-5261.	[cleanup]	Remove SO_BSDCOMPAT socket option usage.
-
-5260.	[bug]		dnstap-read was producing malformed output for large
-			packets. [GL #1093]
-
-5259.	[func]		New option '-i' for 'named-checkconf' to ignore
-			warnings about deprecated options. [GL #1101]
-
-5258.	[func]		Added support for the GeoIP2 API from MaxMind. This
-			will be compiled in by default if the "libmaxminddb"
-			library is found at compile time, but can be
-			suppressed using "configure --disable-geoip".
-
-			Certain geoip ACL settings that were available with
-			legacy GeoIP are not available when using GeoIP2.
-			[GL #182]
-
-5257.	[bug]		Some statistics data was not being displayed.
-			Add shading to the zone tables. [GL #1030]
-
-5256.	[bug]		Ensure that glue records are included in root
-			priming responses if "minimal-responses" is not
-			set to "yes". [GL #1092]
-
-5255.	[bug]		Errors encountered while reloading inline-signing
-			zones could be ignored, causing the zone content to
-			be left in an incompletely updated state rather than
-			reverted. [GL #1109]
-
-5254.	[func]		Collect metrics to report to the statistics-channel
-			DNSSEC signing operations (dnssec-sign) and refresh
-			operations (dnssec-refresh) per zone and per keytag.
-			[GL #513]
-
-5253.	[port]		Support platforms that don't define ULLONG_MAX.
-			[GL #1098]
-
-5252.	[func]		Report if the last 'rndc reload/reconfig' failed in
-			rndc status. [GL !2040]
-
-5251.	[bug]		Statistics were broken in x86 Windows builds.
-			[GL #1081]
-
-5250.	[func]		The default size for RSA keys is now 2048 bits,
-			for both ZSKs and KSKs. [GL #1097]
-
-5249.	[bug]		Fix a possible underflow in recursion clients
-			statistics when hitting recursive clients
-			soft quota. [GL #1067]
-
-	--- 9.15.1 released ---
-
-5248.	[func]		To clarify the configuration of DNSSEC keys,
-			the "managed-keys" and "trusted-keys" options
-			have both been deprecated.  The new "dnssec-keys"
-			statement can now be used for all trust anchors,
-			with the keywords "iniital-key" or "static-key"
-			to indicate whether the configured trust anchor
-			should be used for initialization of RFC 5011 key
-			management, or as a permanent trust anchor.
-
-			The "static-key" keyword will generate a warning if
-			used for the root zone.
-
-			Configurations using "trusted-keys" or "managed-keys"
-			will continue to work with no changes, but will
-			generate warnings in the log. In a future release,
-			these options will be marked obsolete. [GL #6]
-
-5247.	[cleanup]	The 'cleaning-interval' option has been removed.
-			[GL !1731]
-
-5246.	[func]		Log TSIG if appropriate in 'sending notify to' message.
-			[GL #1058]
-
-5245.	[cleanup]	Reduce logging level for IXFR up-to-date poll
-			responses. [GL #1009]
-
-5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
-			that could cause an assertion failure if a
-			significant number of incoming packets were
-			rejected. (CVE-2019-6471) [GL #942]
-
-5243.	[bug]		Fix a possible race between dispatcher and socket
-			code in a high-load cold-cache resolver scenario.
-			[GL #943]
-
-5242.	[bug]		In relaxed qname minimizatiom mode, fall back to
-			normal resolution when encountering a lame
-			delegation, and use _.domain/A queries rather
-			than domain/NS. [GL #1055]
-
-5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
-			[GL #225]
-
-5240.	[bug]		Remove key id calculation for RSAMD5. [GL #996]
-
-5239.	[func]		Change the json-c detection to pkg-config. [GL #855]
-
-5238.	[bug]		Fix a possible deadlock in TCP code. [GL #1046]
-
-5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
-			[GL #1028]
-
-5236.	[func]		Add SipHash 2-4 implementation in lib/isc/siphash.c
-			and switch isc_hash_function() to use SipHash 2-4.
-			[GL #605]
-
-5235.	[cleanup]	Refactor lib/isc/app.c to be thread-safe, unused
-			parts of the API has been removed and the
-			isc_appctx_t data type has been changed to be
-			fully opaque. [GL #1023]
-
-5234.	[port]		arm: just use the compiler's default support for
-			yield. [GL #981]
-
-	--- 9.15.0 released ---
-
-5233.	[bug]		Negative trust anchors did not work with "forward only;"
-			to validating resolvers. [GL #997]
-
-5232.	[placeholder]
-
-5231.	[protocol]	Add support for displaying CLIENT-TAG and SERVER-TAG.
-			[GL #960]
-
-5230.	[protocol]	The SHA-1 hash algorithm is no longer used when
-			generating DS and CDS records. [GL #1015]
-
-5229.	[protocol]	Enforce known SSHFP fingerprint lengths. [GL #852]
-
-5228.	[func]		If trusted-keys and managed-keys were configured
-			simultaneously for the same name, the key could
-			not be be rolled automatically. This is now
-			a fatal configuration error. [GL #868]
-
-5227.	[placeholder]
-
-5226.	[placeholder]
-
-5225.	[func]		Allow dig to print out AAAA record fully expanded.
-			with +[no]expandaaaa. [GL #765]
-
-5224.	[bug]		Only test provide-ixfr on TCP streams. [GL #991]
-
-5223.	[bug]		Fixed a race in the filter-aaaa plugin accessing
-			the hash table. [GL #1005]
-
-5222.	[bug]		'delv -t ANY' could leak memory. [GL #983]
-
-5221.	[test]		Enable parallel execution of system tests on
-			Windows. [GL !4101]
-
-5220.	[cleanup]	Refactor the isc_stat structure to take advantage
-			of stdatomic. [GL !1493]
-
-5219.	[bug]		Fixed a race in the filter-aaaa plugin that could
-			trigger a crash when returning an instance object
-			to the memory pool. [GL #982]
-
-5218.	[bug]		Conditionally include <dlfcn.h>. [GL #995]
-
-5217.	[bug]		Restore key id calculation for RSAMD5. [GL #996]
-
-5216.	[bug]		Fetches-per-zone counter wasn't updated correctly
-			when doing qname minimization. [GL #992]
-
-5215.	[bug]		Change #5124 was incomplete; named could still
-			return FORMERR instead of SERVFAIL in some cases.
-			[GL #990]
-
-5214.	[bug]		win32: named now removes its lock file upon shutdown.
-			[GL #979]
-
-5213.	[bug]		win32: Eliminated a race which allowed named.exe running
-			as a service to be killed prematurely during shutdown.
-			[GL #978]
-
-5212.	[placeholder]
-
-5211.	[bug]		Allow out-of-zone additional data to be included
-			in authoritative responses if recursion is allowed
-			and "minimal-responses" is disabled.  This behavior
-			was inadvertently removed in change #4605. [GL #817]
-
-5210.	[bug]		When dnstap is enabled and recursion is not
-			available, incoming queries are now logged
-			as "auth". Previously, this depended on whether
-			recursion was requested by the client, not on
-			whether recursion was available. [GL #963]
-
-5209.	[bug]		When update-check-ksk is true, add_sigs was not
-			considering offline keys, leaving record sets signed
-			with the incorrect type key. [GL #763]
-
-5208.	[test]		Run valid rdata wire encodings through totext+fromtext
-			and tofmttext+fromtext methods to check these methods.
-			[GL #899]
-
-5207.	[test]		Check delv and dig TTL values. [GL #965]
-
-5206.	[bug]		Delv could print out bad TTLs. [GL #965]
-
-5205.	[bug]		Enforce that a DS hash exists. [GL #899]
-
-5204.	[test]		Check that dns_rdata_fromtext() produces a record that
-			will be accepted by dns_rdata_fromwire(). [GL #852]
-
-5203.	[bug]		Enforce whether key rdata exists or not in KEY,
-			DNSKEY, CDNSKEY and RKEY. [GL #899]
-
-5202.	[bug]		<dns/ecs.h> was missing ISC_LANG_ENDDECLS. [GL #976]
-
-5201.	[bug]		Fix a possible deadlock in RPZ update code. [GL #973]
-
-5200.	[security]	tcp-clients settings could be exceeded in some cases,
-			which could lead to exhaustion of file descriptors.
-			(CVE-2018-5743) [GL #615]
-
-5199.	[security]	In certain configurations, named could crash
-			if nxdomain-redirect was in use and a redirected
-			query resulted in an NXDOMAIN from the cache.
-			(CVE-2019-6467) [GL #880]
-
-5198.	[bug]		If a fetch context was being shut down and, at the same
-			time, we returned from qname minimization, an INSIST
-			could be hit. [GL #966]
-
-5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
-			records. Similarly on multiple OPT and multiple TSIG
-			records. [GL #920]
-
-5196.	[bug]		make install failed with --with-dlopen=no. [GL #955]
-
-5195.	[bug]		"allow-update" and "allow-update-forwarding" were
-			treated as configuration errors if used at the
-			options or view level. [GL #913]
-
-5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
-
-5193.	[bug]		EID and NIMLOC failed to do multi-line output
-			correctly. [GL #899]
-
-5192.	[placeholder]
-
-5191.	[placeholder]
-
-5190.	[bug]		Ignore trust anchors using disabled algorithms.
-			[GL #806]
-
-5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
-
-5188.	[func]		The "dnssec-enable" option is deprecated and no
-			longer has any effect; DNSSEC responses are
-			always enabled. [GL #866]
-
-5187.	[test]		Set time zone before running any tests in dnstap_test.
-			[GL #940]
-
-5186.	[cleanup]	More dnssec-keygen manual tidying. [GL !1678]
-
-5185.	[placeholder]
-
-5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
-
-5183.	[bug]		Reinitialize ECS data before reusing client
-			structures. [GL #881]
+	--- 9.14.0rc3 released ---
 
 5182.	[bug]		Fix a high-load race/crash in handling of
 			isc_socket_close() in resolver. [GL #834]
 
-5181.	[func]		Add a mechanism for a DLZ module to signal that
-			the view's allow-transfer ACL should be used to
-			determine whether transfers are allowed. [GL #803]
-
-5180.	[bug]		delv now honors the operating system's preferred
-			ephemeral port range. [GL #925]
-
-5179.	[cleanup]	Replace some vague type declarations with the more
-			specific dns_secalg_t and dns_dsdigest_t.
-			Thanks to Tony Finch. [GL !1498]
-
-5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
-			errors when writing files. [GL #902]
-
-5177.	[func]		Add the ability to specify in named.conf whether a
-			response-policy zone's SOA record should be added
-			to the additional section (add-soa yes/no). [GL #865]
+	--- 9.14.0rc2 released ---
 
 5176.	[tests]		Remove a dependency on libxml in statschannel system
 			test. [GL #926]
@@ -334,15 +36,12 @@
 			empty node could cause a crash while processing a
 			type ANY query. [GL #901]
 
+	--- 9.14.0rc1 released ---
+
 5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
 			keep previous version of the database if RPZ fails to
 			load. [GL #813]
 
-5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
-			redirect name. [GL #892]
-
-5166.	[placeholder]
-
 5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
 			[GL #428]
 
@@ -370,6 +69,20 @@
 5157.	[bug]		Nslookup now errors out if there are extra command
 			line arguments. [GL #207]
 
+5141.	[security]	Zone transfer controls for writable DLZ zones were
+			not effective as the allowzonexfr method was not being
+			called for such zones. (CVE-2019-6465) [GL #790]
+
+5118.	[security]	Named could crash if it is managing a key with
+			`managed-keys` and the authoritative zone is rolling
+			the key to an unsupported algorithm. (CVE-2018-5745)
+			[GL #780]
+
+5110.	[security]	Named leaked memory if there were multiple Key Tag
+			EDNS options present. (CVE-2018-5744) [GL #772]
+
+	--- 9.13.6 released ---
+
 5156.	[doc]		Extended and refined the section of the ARM describing
 			mirror zones. [GL #774]
 
@@ -428,10 +141,6 @@
 			and "nsdname-enable" both now default to yes,
 			regardless of compile-time settings. [GL #824]
 
-5141.	[security]	Zone transfer controls for writable DLZ zones were
-			not effective as the allowzonexfr method was not being
-			called for such zones. (CVE-2019-6465) [GL #790]
-
 5140.	[bug]		Don't immediately mark existing keys as inactive and
 			deleted when running dnssec-keymgr for the first
 			time. [GL #117]
@@ -502,11 +211,6 @@
 
 5119.	[placeholder]
 
-5118.	[security]	Named could crash if it is managing a key with
-			`managed-keys` and the authoritative zone is rolling
-			the key to an unsupported algorithm. (CVE-2018-5745)
-			[GL #780]
-
 5117.	[placeholder]
 
 5116.	[bug]		Named/named-checkconf triggered a assertion when
@@ -527,9 +231,6 @@
 5111.	[bug]		Occluded DNSKEY records could make it into the
 			delegating NSEC/NSEC3 bitmap. [GL #742]
 
-5110.	[security]	Named leaked memory if there were multiple Key Tag
-			EDNS options present. (CVE-2018-5744) [GL #772]
-
 5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]
 
 	--- 9.13.5 released ---

CONTRIBUTING

@@ -1,5 +1,3 @@
-CONTRIBUTING
-
 BIND Source Access and Contributor Guidelines
 
 Feb 22, 2018

HISTORY

@@ -1,81 +1,5 @@
-HISTORY
-
 Functional enhancements from prior major releases of BIND 9
 
-BIND 9.14
-
-BIND 9.14 (a stable branch based on the 9.13 development branch) includes
-a number of changes from BIND 9.12 and earlier releases. New features
-include:
-
-  * A new "plugin" mechanism has been added to allow query functionality
-    to be extended using dynamically loadable libraries. The "filter-aaaa"
-    feature has been removed from named and is now implemented as a
-    plugin.
-  * Socket and task code has been refactored to improve performance.
-  * QNAME minimization, as described in RFC 7816, is now supported.
-  * "Root key sentinel" support, enabling validating resolvers to indicate
-    via a special query which trust anchors are configured for the root
-    zone.
-  * Secondary zones can now be configured as "mirror" zones; their
-    contents are transferred in as with traditional slave zones, but are
-    subject to DNSSEC validation and are not treated as authoritative data
-    when answering. This makes it easier to configure a local copy of the
-    root zone as described in RFC 7706.
-  * The "validate-except" option allows configuration of domains below
-    which DNSSEC validation should not be performed.
-  * The default value of "dnssec-validation" is now "auto".
-  * IDNA2008 is now supported when linking with libidn2.
-  * "named -V" now outputs the default paths for files used by named and
-    other tools.
-
-In addition, workarounds that were formerly in place to enable resolution
-of domains whose authoritative servers did not respond to EDNS queries
-have been removed. See https://dnsflagday.net for more details.
-
-Cryptographic support has been modernized. BIND now uses the best
-available pseudo-random number generator for the platform on which it's
-built. Very old versions of OpenSSL are no longer supported. Cryptography
-is now mandatory: building BIND without DNSSEC is no longer supported.
-
-Special code to support certain legacy operating systems has also been
-removed; see the file PLATFORMS.md for details of supported platforms. In
-addition to OpenSSL, BIND now requires support for IPv6, threads, and
-standard atomic operations provided by the C compiler.
-
-BIND 9.12
-
-BIND 9.12 includes a number of changes from BIND 9.11 and earlier
-releases. New features include:
-
-  * named and related libraries have been substantially refactored for
-    improved query performance -- particularly on delegation heavy zones
-    -- and for improved readability, maintainability, and testability.
-  * Code implementing the name server query processing logic has been
-    moved into a new libns library, for easier testing and use in tools
-    other than named.
-  * Cached, validated NSEC and other records can now be used to synthesize
-    NXDOMAIN responses.
-  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting 'max-journal-size default' now limits the size of journal
-    files to twice the size of the zone.
-  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
-    message.
-  * dnstap output files can now be configured to roll automatically when
-    reaching a given size.
-  * Log file timestamps can now also be formatted in ISO 8601 (local) or
-    ISO 8601 (UTC) formats.
-  * Logging channels and dnstap output files can now be configured to use
-    a timestamp as the suffix when rolling to a new file.
-  * 'named-checkconf -l' lists zones found in named.conf.
-  * Added support for the EDNS Padding and Keepalive options.
-  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored.
-  * The default key algorithm in rndc-confgen is now hmac-sha256.
-  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
-    default without a configure option.
-  * The obsolete isc-hmac-fixup command has been removed.
-
 BIND 9.11
 
 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
@@ -507,11 +431,11 @@ BIND 9.4.0
   * Detect duplicates of UDP queries we are recursing on and drop them.
     New stats category "duplicates".
   * "USE INTERNAL MALLOC" is now runtime selectable.
-  * The lame cache is now done on a <qname,qclass,qtype> basis as some
-    servers only appear to be lame for certain query types.
+  * The lame cache is now done on a basis as some servers only appear to
+    be lame for certain query types.
   * Limit the number of recursive clients that can be waiting for a single
-    query (<qname,qtype,qclass>) to resolve. New options clients-per-query
-    and max-clients-per-query.
+    query () to resolve. New options clients-per-query and
+    max-clients-per-query.
   * dig: report the number of extra bytes still left in the packet after
     processing all the records.
   * Support for IPSECKEY rdata type.

HISTORY.md

@@ -10,81 +10,6 @@
 -->
 ### Functional enhancements from prior major releases of BIND 9
 
-#### BIND 9.14
-
-BIND 9.14 (a stable branch based on the 9.13 development branch)
-includes a number of changes from BIND 9.12 and earlier releases.
-New features include:
-
-* A new "plugin" mechanism has been added to allow query functionality
-  to be extended using dynamically loadable libraries. The "filter-aaaa"
-  feature has been removed from named and is now implemented as a plugin.
-* Socket and task code has been refactored to improve performance.
-* QNAME minimization, as described in RFC 7816, is now supported.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-* Secondary zones can now be configured as "mirror" zones; their contents
-  are transferred in as with traditional slave zones, but are subject to
-  DNSSEC validation and are not treated as authoritative data when
-  answering. This makes it easier to configure a local copy of the root
-  zone as described in RFC 7706.
-* The "validate-except" option allows configuration of domains below which
-  DNSSEC validation should not be performed.
-* The default value of "dnssec-validation" is now "auto".
-* IDNA2008 is now supported when linking with `libidn2`.
-* "named -V" now outputs the default paths for files used by named
-  and other tools.
-
-In addition, workarounds that were formerly in place to enable resolution
-of domains whose authoritative servers did not respond to EDNS queries
-have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
-for more details.
-
-Cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory: building BIND without DNSSEC is no
-longer supported.
-
-Special code to support certain legacy operating systems has also
-been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
-of supported platforms. In addition to OpenSSL, BIND now requires
-support for IPv6, threads, and standard atomic operations provided
-by the C compiler.
-
-#### BIND 9.12
-
-BIND 9.12 includes a number of changes from BIND 9.11 and earlier releases.
-New features include:
-
-* `named` and related libraries have been substantially refactored for
-  improved query performance -- particularly on delegation heavy zones --
-  and for improved readability, maintainability, and testability.
-* Code implementing the name server query processing logic has been moved
-  into a new `libns` library, for easier testing and use in tools other
-  than `named`.
-* Cached, validated NSEC and other records can now be used to synthesize
-  NXDOMAIN responses.
-* The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `'max-journal-size default'` now limits the size of journal files
-  to twice the size of the zone.
-* `dnstap-read -x` prints a hex dump of the wire format of each logged
-  DNS message.
-* `dnstap` output files can now be configured to roll automatically when
-  reaching a given size.
-* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
-  8601 (UTC) formats.
-* Logging channels and `dnstap` output files can now be configured to use a
-  timestamp as the suffix when rolling to a new file.
-* `'named-checkconf -l'` lists zones found in `named.conf`.
-* Added support for the EDNS Padding and Keepalive options.
-* 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
-
 #### BIND 9.11
 
 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier

Makefile.in

@@ -97,27 +97,27 @@ test-force:
 	exit $$status
 
 README: README.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="README" -f markdown-smart -t html README.md | \
+	${PANDOC} --email-obfuscation=none -s -t html README.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 HISTORY: HISTORY.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="HISTORY" -f markdown-smart -t html HISTORY.md | \
+	${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 OPTIONS: OPTIONS.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="OPTIONS" -f markdown-smart -t html OPTIONS.md | \
+	${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 CONTRIBUTING: CONTRIBUTING.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="CONTRIBUTING" -f markdown-smart -t html CONTRIBUTING.md | \
+	${PANDOC} --email-obfuscation=none -s -t html CONTRIBUTING.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 PLATFORMS: PLATFORMS.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="PLATFORMS" -f markdown-smart -t html PLATFORMS.md | \
+	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 

OPTIONS

@@ -1,12 +1,10 @@
-OPTIONS
-
 Setting the STD_CDEFINES environment variable before running configure can
 be used to enable certain compile-time options that are not explicitly
 defined in configure.
 
 Some of these settings are:
 
-         Setting                            Description
+Setting                   Description
                           Overwrite memory with tag values when allocating
 -DISC_MEM_DEFAULTFILL=1   or freeing it; this impairs performance but
                           makes debugging of memory problems easier.

PLATFORMS

@@ -1,5 +1,3 @@
-PLATFORMS
-
 Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
@@ -15,7 +13,7 @@ offer support on a "best effort" basis for some.
 
 Regularly tested platforms
 
-As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:
 
   * Debian 8, 9, 10
@@ -53,7 +51,7 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 Unsupported platforms
 
-These are platforms on which BIND 9.15 is known not to build or run:
+These are platforms on which BIND 9.14 is known not to build or run:
 
   * Platforms without at least OpenSSL 1.0.2
   * Windows 10 / x86
@@ -66,6 +64,31 @@ These are platforms on which BIND 9.15 is known not to build or run:
 
 Platform quirks
 
+ARM
+
+If the compilation ends with following error:
+
+Error: selected processor does not support `yield' in ARM mode
+
+You will need to set -march compiler option to native, so the compiler
+recognizes yield assembler instruction. The proper way to set -march=
+native would be to put it into CFLAGS, e.g. run ./configure like this:
+CFLAGS="-march=native -Os -g" ./configure plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from
+Debian armhf documentation):
+
+  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
+    recommended build option is -march=armv7-a.
+
+  * FPU should be set at VFPv3-D16 as they represent the minimum
+    specification of the processors to support here, therefore the
+    recommended build option is -mfpu=vfpv3-d16.
+
+The configure command should look like this:
+
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
+
 NetBSD 6 i386
 
 The i386 build of NetBSD requires the libatomic library, available from

PLATFORMS.md

@@ -23,7 +23,7 @@ offer support on a "best effort" basis for some.
 
 ### Regularly tested platforms
 
-As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:
 
 * Debian 8, 9, 10
@@ -60,7 +60,7 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 ## Unsupported platforms
 
-These are platforms on which BIND 9.15 is known *not* to build or run:
+These are platforms on which BIND 9.14 is known *not* to build or run:
 
 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
@@ -72,6 +72,35 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 
 ## Platform quirks
 
+### ARM
+
+If the compilation ends with following error:
+
+```
+Error: selected processor does not support `yield' in ARM mode
+```
+
+You will need to set `-march` compiler option to `native`, so the compiler
+recognizes `yield` assembler instruction.  The proper way to set `-march=native`
+would be to put it into `CFLAGS`, e.g. run `./configure` like this:
+`CFLAGS="-march=native -Os -g" ./configure` plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from Debian
+armhf documentation):
+
+* The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
+  build option is `-march=armv7-a`.
+
+* FPU should be set at VFPv3-D16 as they represent the minimum specification of
+  the processors to support here, therefore the recommended build option is
+  `-mfpu=vfpv3-d16`.
+
+The `configure` command should look like this:
+
+```
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
+```
+
 ### NetBSD 6 i386
 
 The i386 build of NetBSD requires the `libatomic` library, available from

README

@@ -1,5 +1,3 @@
-README
-
 BIND 9
 
 Contents
@@ -7,7 +5,7 @@ Contents
  1. Introduction
  2. Reporting bugs and getting help
  3. Contributing to BIND
- 4. BIND 9.15 features
+ 4. BIND 9.14 features
  5. Building BIND
  6. macOS
  7. Dependencies
@@ -39,7 +37,7 @@ in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
 501(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
-source software licensed under the terms of the Mozilla Public License,
+source software licenced under the terms of the Mozilla Public License,
 version 2.0.
 
 For a summary of features introduced in past major releases of BIND, see
@@ -102,13 +100,48 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.
 
-BIND 9.15 features
+BIND 9.14 features
 
-BIND 9.15 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.14 and earlier releases. New features include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating the
+most recent stable branch, 9.12. These changes include:
 
-  * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC key configuration using dnssec-keys
+  * A new "plugin" mechanism has been added to allow query functionality
+    to be extended using dynamically loadable libraries. The "filter-aaaa"
+    feature has been removed from named and is now implemented as a
+    plugin.
+  * QNAME minimization, as described in RFC 7816, is now supported.
+  * Socket and task code has been refactored to improve performance on
+    most modern machines.
+  * "Root key sentinel" support, enabling validating resolvers to indicate
+    via a special query which trust anchors are configured for the root
+    zone.
+  * Secondary zones can now be configured as "mirror" zones; their
+    contents are transferred in as with traditional slave zones, but are
+    subject to DNSSEC validation and are not treated as authoritative data
+    when answering. This makes it easier to configure a local copy of the
+    root zone as described in RFC 7706.
+  * The "validate-except" option allows configuration of domains below
+    which DNSSEC validation should not be performed.
+  * The default value of "dnssec-validation" is now "auto".
+  * IDNA2008 is now supported when linking with libidn2.
+  * "named -V" now outputs the default paths for files used by named and
+    other tools.
+
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See https://dnsflagday.net for more details.
+
+Cryptographic support has been modernized. BIND now uses the best
+available pseudo-random number generator for the platform on which it's
+built. Very old versions of OpenSSL are no longer supported. Cryptography
+is now mandatory: building BIND without DNSSEC is no longer supported.
+
+Special code to support certain legacy operating systems has also been
+removed; see the file PLATFORMS.md for details of supported platforms. In
+addition to OpenSSL, BIND now requires support for IPv6, threads, and
+standard atomic operations provided by the C compiler. Non-threaded builds
+are no longer supported.
 
 Building BIND
 
@@ -139,7 +172,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
 Several environment variables that can be set before running configure
 will affect compilation:
 
-   Variable                            Description
+Variable       Description
 CC             The C compiler to use. configure tries to figure out the
                right one for supported systems.
                C compiler flags. Defaults to include -g and/or -O2 as
@@ -192,10 +225,8 @@ operations, specify the path to the PKCS#11 provider library using
 
 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2 http://xmlsoft.org or json-c https://
-github.com/json-c. If these are installed at a nonstandard location, then:
-
-  * for libxml2, specify the prefix using --with-libxml2=/prefix,
-  * for json-c, adjust PKG_CONFIG_PATH.
+github.com/json-c. If these are installed at a nonstandard location,
+specify the prefix using --with-libxml2=/prefix or --with-libjson=/prefix.
 
 To support compression on the HTTP statistics channel, the server must be
 linked against libzlib. If this is installed in a nonstandard location,
@@ -205,11 +236,10 @@ To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in
 a nonstandard location, specify the prefix using with-lmdb=/prefix.
 
-To support MaxMind GeoIP2 location-based ACLs, the server must be linked
-with libmaxminddb. This is turned on by default if the library is found;
-if the library is installed in a nonstandard location, specify the prefix
-using --with-maxminddb=/prefix. GeoIP2 support can be switched off with
---disable-geoip.
+To support GeoIP location-based ACLs, the server must be linked with
+libGeoIP. This is not turned on by default; BIND must be configured with
+--with-geoip. If the library is installed in a nonstandard location,
+specify the prefix using --with-geoip=/prefix.
 
 For DNSTAP packet logging, you must have installed libfstrm https://
 github.com/farsightsec/fstrm and libprotobuf-c https://
@@ -247,8 +277,11 @@ default, installation is into /usr/local, but this can be changed with the
 
 You may specify the option --sysconfdir to set the directory where
 configuration files like named.conf go by default, and --localstatedir to
-set the default parent directory of run/named.pid. --sysconfdir defaults
-to $prefix/etc and --localstatedir defaults to $prefix/var.
+set the default parent directory of run/named.pid. For backwards
+compatibility with BIND 8, --sysconfdir defaults to /etc and
+--localstatedir defaults to /var if no --prefix option is given. If there
+is a --prefix option, sysconfdir defaults to $prefix/etc and localstatedir
+defaults to $prefix/var.
 
 Automated testing
 
@@ -291,7 +324,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
 changes listed first. Change notes include tags indicating the category of
 the change that was made; these categories are:
 
-   Category                            Description
+Category       Description
 [func]         New feature
 [bug]          General bug fix
 [security]     Fix for a significant security flaw
@@ -319,46 +352,26 @@ releases (i.e., those with version numbers ending in zero). Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.
 
-Bug report identifiers
-
-Most notes in the CHANGES file include a reference to a bug report or
-issue number. Prior to 2018, these were usually of the form [RT #NNN] and
-referred to entries in the "bind9-bugs" RT database, which was not open to
-the public. More recent entries use the form [GL #NNN] or, less often, [GL
-!NNN], which, respectively, refer to issues or merge requests in the
-Gitlab database. Most of these are publicly readable, unless they include
-information which is confidential or security senstive.
-
-To look up a Gitlab issue by its number, use the URL https://
-gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
-use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
-
-In rare cases, an issue or merge request number may be followed with the
-letter "P". This indicates that the information is in the private ISC
-Gitlab instance, which is not visible to the public.
-
 Acknowledgments
 
   * The original development of BIND 9 was underwritten by the following
     organizations:
 
-      Sun Microsystems, Inc.
-      Hewlett Packard
-      Compaq Computer Corporation
-      IBM
-      Process Software Corporation
-      Silicon Graphics, Inc.
-      Network Associates, Inc.
-      U.S. Defense Information Systems Agency
-      USENIX Association
-      Stichting NLnet - NLnet Foundation
-      Nominum, Inc.
+    Sun Microsystems, Inc.
+    Hewlett Packard
+    Compaq Computer Corporation
+    IBM
+    Process Software Corporation
+    Silicon Graphics, Inc.
+    Network Associates, Inc.
+    U.S. Defense Information Systems Agency
+    USENIX Association
+    Stichting NLnet - NLnet Foundation
+    Nominum, Inc.
 
   * This product includes software developed by the OpenSSL Project for
     use in the OpenSSL Toolkit. http://www.OpenSSL.org/
-
   * This product includes cryptographic software written by Eric Young
     (eay@cryptsoft.com)
-
   * This product includes software written by Tim Hudson
     (tjh@cryptsoft.com)

README.md

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.15 features](#features)
+1. [BIND 9.14 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -48,7 +48,7 @@ used in versions 4 and 8.  Internet Systems Consortium
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
 ongoing maintenance and improvement.  BIND is open source software
-licensed under the terms of the Mozilla Public License, version 2.0.
+licenced under the terms of the Mozilla Public License, version 2.0.
 
 For a summary of features introduced in past major releases of BIND,
 see the file [HISTORY](HISTORY.md).
@@ -117,14 +117,48 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.
 
-### <a name="features"/> BIND 9.15 features
+### <a name="features"/> BIND 9.14 features
 
-BIND 9.15 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.14 and earlier releases. New features
-include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating
+the most recent stable branch, 9.12.  These changes include:
 
-* Support for the new GeoIP2 geolocation API
-* Improved DNSSEC key configuration using `dnssec-keys`
+* A new "plugin" mechanism has been added to allow query functionality
+  to be extended using dynamically loadable libraries. The "filter-aaaa"
+  feature has been removed from named and is now implemented as a plugin.
+* QNAME minimization, as described in RFC 7816, is now supported.
+* Socket and task code has been refactored to improve performance on most
+  modern machines.
+* "Root key sentinel" support, enabling validating resolvers to indicate
+  via a special query which trust anchors are configured for the root zone.
+* Secondary zones can now be configured as "mirror" zones; their contents
+  are transferred in as with traditional slave zones, but are subject to
+  DNSSEC validation and are not treated as authoritative data when
+  answering. This makes it easier to configure a local copy of the root
+  zone as described in RFC 7706.
+* The "validate-except" option allows configuration of domains below which
+  DNSSEC validation should not be performed.
+* The default value of "dnssec-validation" is now "auto".
+* IDNA2008 is now supported when linking with `libidn2`.
+* "named -V" now outputs the default paths for files used by named
+  and other tools.
+
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
+for more details.
+
+Cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory: building BIND without DNSSEC is no
+longer supported.
+
+Special code to support certain legacy operating systems has also
+been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
+of supported platforms. In addition to OpenSSL, BIND now requires
+support for IPv6, threads, and standard atomic operations provided
+by the C compiler. Non-threaded builds are no longer supported.
 
 ### <a name="build"/> Building BIND
 
@@ -204,10 +238,8 @@ To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2
 [http://xmlsoft.org](http://xmlsoft.org) or json-c
 [https://github.com/json-c](https://github.com/json-c).  If these are
-installed at a nonstandard location, then:
-
-* for libxml2, specify the prefix using `--with-libxml2=/prefix`,
-* for json-c, adjust `PKG_CONFIG_PATH`.
+installed at a nonstandard location, specify the prefix using
+`--with-libxml2=/prefix` or `--with-libjson=/prefix`.
 
 To support compression on the HTTP statistics channel, the server must be
 linked against libzlib.  If this is installed in a nonstandard location,
@@ -217,11 +249,10 @@ To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in a
 nonstandard location, specify the prefix using `with-lmdb=/prefix`.
 
-To support MaxMind GeoIP2 location-based ACLs, the server must be linked
-with `libmaxminddb`. This is turned on by default if the library is
-found; if the library is installed in a nonstandard location,
-specify the prefix using `--with-maxminddb=/prefix`. GeoIP2 support
-can be switched off with `--disable-geoip`.
+To support GeoIP location-based ACLs, the server must be linked with
+libGeoIP. This is not turned on by default; BIND must be configured with
+`--with-geoip`. If the library is installed in a nonstandard location,
+specify the prefix using `--with-geoip=/prefix`.
 
 For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
@@ -260,8 +291,11 @@ default, installation is into /usr/local, but this can be changed with the
 
 You may specify the option `--sysconfdir` to set the directory where
 configuration files like `named.conf` go by default, and `--localstatedir`
-to set the default parent directory of `run/named.pid`.   `--sysconfdir`
-defaults to `$prefix/etc` and `--localstatedir` defaults to `$prefix/var`.
+to set the default parent directory of `run/named.pid`.   For backwards
+compatibility with BIND 8, `--sysconfdir` defaults to `/etc` and
+`--localstatedir` defaults to `/var` if no `--prefix` option is given.  If
+there is a `--prefix` option, sysconfdir defaults to `$prefix/etc` and
+localstatedir defaults to `$prefix/var`.
 
 ### <a name="testing"/> Automated testing
 
@@ -327,25 +361,6 @@ releases (i.e., those with version numbers ending in zero).  Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.
 
-#### Bug report identifiers
-
-Most notes in the CHANGES file include a reference to a bug report or
-issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
-and referred to entries in the "bind9-bugs" RT database, which was not open
-to the public. More recent entries use the form `[GL #NNN]` or, less often,
-`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
-Gitlab database. Most of these are publicly readable, unless they include
-information which is confidential or security senstive.
-
-To look up a Gitlab issue by its number, use the URL
-[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
-To look up a merge request, use
-[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
-
-In rare cases, an issue or merge request number may be followed with the
-letter "P". This indicates that the information is in the private ISC
-Gitlab instance, which is not visible to the public.
-
 ### <a name="ack"/> Acknowledgments
 
 * The original development of BIND 9 was underwritten by the

aclocal.m4

@@ -288,99 +288,9 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
-# AM_CONDITIONAL                                            -*- Autoconf -*-
-
-# Copyright (C) 1997-2018 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# AM_CONDITIONAL(NAME, SHELL-CONDITION)
-# -------------------------------------
-# Define a conditional.
-AC_DEFUN([AM_CONDITIONAL],
-[AC_PREREQ([2.52])dnl
- m4_if([$1], [TRUE],  [AC_FATAL([$0: invalid condition: $1])],
-       [$1], [FALSE], [AC_FATAL([$0: invalid condition: $1])])dnl
-AC_SUBST([$1_TRUE])dnl
-AC_SUBST([$1_FALSE])dnl
-_AM_SUBST_NOTMAKE([$1_TRUE])dnl
-_AM_SUBST_NOTMAKE([$1_FALSE])dnl
-m4_define([_AM_COND_VALUE_$1], [$2])dnl
-if $2; then
-  $1_TRUE=
-  $1_FALSE='#'
-else
-  $1_TRUE='#'
-  $1_FALSE=
-fi
-AC_CONFIG_COMMANDS_PRE(
-[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then
-  AC_MSG_ERROR([[conditional "$1" was never defined.
-Usually this means the macro was only invoked conditionally.]])
-fi])])
-
-# Add --enable-maintainer-mode option to configure.         -*- Autoconf -*-
-# From Jim Meyering
-
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# AM_MAINTAINER_MODE([DEFAULT-MODE])
-# ----------------------------------
-# Control maintainer-specific portions of Makefiles.
-# Default is to disable them, unless 'enable' is passed literally.
-# For symmetry, 'disable' may be passed as well.  Anyway, the user
-# can override the default with the --enable/--disable switch.
-AC_DEFUN([AM_MAINTAINER_MODE],
-[m4_case(m4_default([$1], [disable]),
-       [enable], [m4_define([am_maintainer_other], [disable])],
-       [disable], [m4_define([am_maintainer_other], [enable])],
-       [m4_define([am_maintainer_other], [enable])
-        m4_warn([syntax], [unexpected argument to AM@&t@_MAINTAINER_MODE: $1])])
-AC_MSG_CHECKING([whether to enable maintainer-specific portions of Makefiles])
-  dnl maintainer-mode's default is 'disable' unless 'enable' is passed
-  AC_ARG_ENABLE([maintainer-mode],
-    [AS_HELP_STRING([--]am_maintainer_other[-maintainer-mode],
-      am_maintainer_other[ make rules and dependencies not useful
-      (and sometimes confusing) to the casual installer])],
-    [USE_MAINTAINER_MODE=$enableval],
-    [USE_MAINTAINER_MODE=]m4_if(am_maintainer_other, [enable], [no], [yes]))
-  AC_MSG_RESULT([$USE_MAINTAINER_MODE])
-  AM_CONDITIONAL([MAINTAINER_MODE], [test $USE_MAINTAINER_MODE = yes])
-  MAINT=$MAINTAINER_MODE_TRUE
-  AC_SUBST([MAINT])dnl
-]
-)
-
-# Copyright (C) 2006-2018 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# _AM_SUBST_NOTMAKE(VARIABLE)
-# ---------------------------
-# Prevent Automake from outputting VARIABLE = @VARIABLE@ in Makefile.in.
-# This macro is traced by Automake.
-AC_DEFUN([_AM_SUBST_NOTMAKE])
-
-# AM_SUBST_NOTMAKE(VARIABLE)
-# --------------------------
-# Public sister of _AM_SUBST_NOTMAKE.
-AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
-
-m4_include([m4/ax_check_compile_flag.m4])
-m4_include([m4/ax_check_link_flag.m4])
 m4_include([m4/ax_check_openssl.m4])
 m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
-m4_include([m4/ax_restore_flags.m4])
-m4_include([m4/ax_save_flags.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])

bin/check/Makefile.in

@@ -16,16 +16,15 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${ISC_INCLUDES} \
-		${OPENSSL_CFLAGS}
+		${ISC_INCLUDES} @OPENSSL_INCLUDES@
 
 CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@
 

bin/check/check-tool.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdbool.h>
 #include <stdio.h>
 #include <inttypes.h>

bin/check/named-checkconf.8

@@ -86,11 +86,6 @@ Check "core" configuration only\&. This suppresses the loading of plugin modules
 statements to be ignored\&.
 .RE
 .PP
-\-i
-.RS 4
-Ignore warnings on deprecated options\&.
-.RE
-.PP
 \-p
 .RS 4
 Print out the

bin/check/named-checkconf.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <errno.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -28,7 +30,6 @@
 #include <isc/util.h>
 
 #include <isccfg/namedconf.h>
-#include <isccfg/grammar.h>
 
 #include <bind9/check.h>
 
@@ -62,7 +63,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
 
 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-chijlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -556,7 +557,6 @@ main(int argc, char **argv) {
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
-	bool nodeprecate = false;
 	unsigned int flags = 0;
 
 	isc_commandline_errprint = false;
@@ -564,7 +564,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "cdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -597,10 +597,6 @@ main(int argc, char **argv) {
 			debug++;
 			break;
 
-		case 'i':
-			nodeprecate = true;
-			break;
-
 		case 'j':
 			nomerge = false;
 			break;
@@ -681,16 +677,11 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
 
-	if (nodeprecate) {
-		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
-	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);
 
 	if (cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config) !=
 	    ISC_R_SUCCESS)
-	{
 		exit(1);
-	}
 
 	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
 	if (result != ISC_R_SUCCESS) {

bin/check/named-checkconf.docbook

@@ -126,15 +126,6 @@
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term>-i</term>
-        <listitem>
-          <para>
-	    Ignore warnings on deprecated options.
-          </para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term>-p</term>
         <listitem>

bin/check/named-checkconf.html

@@ -96,12 +96,6 @@
 	    <span class="command"><strong>plugin</strong></span> statements to be ignored.
           </p>
         </dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-          <p>
-	    Ignore warnings on deprecated options.
-          </p>
-        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
           <p>

bin/check/named-checkzone.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdbool.h>
 #include <stdlib.h>
 #include <inttypes.h>

bin/check/win32/checkconf.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/check/win32/checkconf.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/check/win32/checktool.vcxproj.in

@@ -65,7 +65,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -89,7 +88,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/check/win32/checktool.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/check/win32/checkzone.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -96,7 +95,6 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/check/win32/checkzone.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/confgen/Makefile.in

@@ -27,9 +27,9 @@ CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/confgen/ddns-confgen.c

@@ -17,6 +17,8 @@
  * and the corresponding key and update-policy statements in named.conf.
  */
 
+#include <config.h>
+
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdlib.h>

bin/confgen/keygen.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdlib.h>
 #include <stdarg.h>
 

bin/confgen/rndc-confgen.c

@@ -20,6 +20,8 @@
  * controls statement altogether.
  */
 
+#include <config.h>
+
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdlib.h>

bin/confgen/unix/os.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <confgen/os.h>
 
 #include <fcntl.h>

bin/confgen/util.c

@@ -12,6 +12,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdlib.h>

bin/confgen/win32/confgentool.vcxproj.in

@@ -60,7 +60,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -85,7 +84,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/confgen/win32/confgentool.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/confgen/win32/ddnsconfgen.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -96,7 +95,6 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/confgen/win32/ddnsconfgen.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/confgen/win32/os.c

@@ -9,6 +9,9 @@
  * information regarding copyright ownership.
  */
 
+
+#include <config.h>
+
 #include <confgen/os.h>
 
 #include <fcntl.h>

bin/confgen/win32/rndcconfgen.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/confgen/win32/rndcconfgen.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/delv/Makefile.in

@@ -16,17 +16,16 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${OPENSSL_CFLAGS}
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@
 
 CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/delv/delv.1

@@ -146,16 +146,14 @@ to specify the name of a zone containing DLV records\&.
 Note: When reading the trust anchor file,
 \fBdelv\fR
 treats
-\fBdnssec\-keys\fR\fBinitial\-key\fR
-and
-\fBstatic\-key\fR
-entries identically\&. That is, even if a key is configured with
-\fBinitial\-key\fR, indicating that it is meant to be used only as an initializing key for RFC 5011 key maintenance, it is still treated by
+\fBmanaged\-keys\fR
+statements and
+\fBtrusted\-keys\fR
+statements identically\&. That is, for a managed key, it is the
+\fIinitial\fR
+key that is trusted; RFC 5011 key management is not supported\&.
 \fBdelv\fR
-as if it had been configured as a
-\fBstatic\-key\fR\&.
-\fBdelv\fR
-does not consult the managed keys database maintained by
+will not consult the managed\-keys database maintained by
 \fBnamed\fR\&. This means that if either of the keys in
 /etc/bind\&.keys
 is revoked and rolled over, it will be necessary to update

bin/delv/delv.c

@@ -9,6 +9,7 @@
  * information regarding copyright ownership.
  */
 
+#include <config.h>
 #include <bind.keys.h>
 
 #ifndef WIN32
@@ -133,13 +134,13 @@ static bool use_tcp = false;
 static char *anchorfile = NULL;
 static char *trust_anchor = NULL;
 static char *dlv_anchor = NULL;
-static int num_keys = 0;
+static int trusted_keys = 0;
 
 static dns_fixedname_t afn, dfn;
 static dns_name_t *anchor_name = NULL, *dlv_name = NULL;
 
 /* Default bind.keys contents */
-static char anchortext[] = DNSSEC_KEYS;
+static char anchortext[] = MANAGED_KEYS;
 
 /*
  * Static function prototypes
@@ -642,7 +643,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 
 	CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
 				       keyname, &rrdatabuf));
-	num_keys++;
+	trusted_keys++;
 
  cleanup:
 	if (result == DST_R_NOCRYPTO)
@@ -693,15 +694,13 @@ static isc_result_t
 setup_dnsseckeys(dns_client_t *client) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
-	const cfg_obj_t *trusted_keys = NULL;
+	const cfg_obj_t *keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
-	const cfg_obj_t *dnssec_keys = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;
 
-	if (!root_validation && !dlv_validation) {
+	if (!root_validation && !dlv_validation)
 		return (ISC_R_SUCCESS);
-	}
 
 	if (filename == NULL) {
 #ifndef WIN32
@@ -716,33 +715,27 @@ setup_dnsseckeys(dns_client_t *client) {
 
 	if (trust_anchor == NULL) {
 		trust_anchor = isc_mem_strdup(mctx, ".");
-		if (trust_anchor == NULL) {
+		if (trust_anchor == NULL)
 			fatal("out of memory");
-		}
 	}
 
-	if (trust_anchor != NULL) {
+	if (trust_anchor != NULL)
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
-	}
-	if (dlv_anchor != NULL) {
+	if (dlv_anchor != NULL)
 		CHECK(convert_name(&dfn, &dlv_name, dlv_anchor));
-	}
 
 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
 
 	if (access(filename, R_OK) != 0) {
-		if (anchorfile != NULL) {
+		if (anchorfile != NULL)
 			fatal("Unable to read key file '%s'", anchorfile);
-		}
 	} else {
 		result = cfg_parse_file(parser, filename,
 					&cfg_type_bindkeys, &bindkeys);
-		if (result != ISC_R_SUCCESS) {
-			if (anchorfile != NULL) {
+		if (result != ISC_R_SUCCESS)
+			if (anchorfile != NULL)
 				fatal("Unable to load keys from '%s'",
 				      anchorfile);
-			}
-		}
 	}
 
 	if (bindkeys == NULL) {
@@ -752,34 +745,25 @@ setup_dnsseckeys(dns_client_t *client) {
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
 		result = cfg_parse_buffer(parser, &b, NULL, 0,
 					  &cfg_type_bindkeys, 0, &bindkeys);
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("Unable to parse built-in keys");
-		}
 	}
 
 	INSIST(bindkeys != NULL);
-	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
+	cfg_map_get(bindkeys, "trusted-keys", &keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
-	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);
 
-	if (trusted_keys != NULL) {
-		CHECK(load_keys(trusted_keys, client));
-	}
-	if (managed_keys != NULL) {
+	if (keys != NULL)
+		CHECK(load_keys(keys, client));
+	if (managed_keys != NULL)
 		CHECK(load_keys(managed_keys, client));
-	}
-	if (dnssec_keys != NULL) {
-		CHECK(load_keys(dnssec_keys, client));
-	}
 	result = ISC_R_SUCCESS;
 
-	if (num_keys == 0) {
+	if (trusted_keys == 0)
 		fatal("No trusted keys were loaded");
-	}
 
-	if (dlv_validation) {
+	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);
-	}
 
 
  cleanup:
@@ -789,10 +773,9 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
-	}
 	return (result);
 }
 
@@ -1640,9 +1623,9 @@ main(int argc, char *argv[]) {
 		fatal("failed to create mctx");
 
 	CHECK(isc_appctx_create(mctx, &actx));
-	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
-	CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
-	CHECK(isc_timermgr_createinctx(mctx, &timermgr));
+	CHECK(isc_taskmgr_createinctx(mctx, actx, 1, 0, &taskmgr));
+	CHECK(isc_socketmgr_createinctx(mctx, actx, &socketmgr));
+	CHECK(isc_timermgr_createinctx(mctx, actx, &timermgr));
 
 	parse_args(argc, argv);
 

bin/delv/delv.docbook

@@ -218,17 +218,14 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>dnssec-keys</option>
-	    <option>initial-key</option> and <option>static-key</option>
-	    entries identically.  That is, even if a key is configured
-	    with <command>initial-key</command>, indicating that it is
-	    meant to be used only as an initializing key for RFC 5011
-	    key maintenance, it is still treated by <command>delv</command>
-	    as if it had been configured as a <command>static-key</command>.
-	    <command>delv</command> does not consult the managed keys
-	    database maintained by <command>named</command>. This means
-	    that if either of the keys in
-	    <filename>/etc/bind.keys</filename> is revoked
+	    <command>delv</command> treats <option>managed-keys</option>
+	    statements and <option>trusted-keys</option> statements
+	    identically.  That is, for a managed key, it is the
+	    <emphasis>initial</emphasis> key that is trusted; RFC 5011
+	    key management is not supported. <command>delv</command>
+	    will not consult the managed-keys database maintained by
+	    <command>named</command>. This means that if either of the
+	    keys in <filename>/etc/bind.keys</filename> is revoked
 	    and rolled over, it will be necessary to update
 	    <filename>/etc/bind.keys</filename> to use DNSSEC
 	    validation in <command>delv</command>.

bin/delv/delv.html

@@ -200,17 +200,14 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
-	    <code class="option">initial-key</code> and <code class="option">static-key</code>
-	    entries identically.  That is, even if a key is configured
-	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is
-	    meant to be used only as an initializing key for RFC 5011
-	    key maintenance, it is still treated by <span class="command"><strong>delv</strong></span>
-	    as if it had been configured as a <span class="command"><strong>static-key</strong></span>.
-	    <span class="command"><strong>delv</strong></span> does not consult the managed keys
-	    database maintained by <span class="command"><strong>named</strong></span>. This means
-	    that if either of the keys in
-	    <code class="filename">/etc/bind.keys</code> is revoked
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">managed-keys</code>
+	    statements and <code class="option">trusted-keys</code> statements
+	    identically.  That is, for a managed key, it is the
+	    <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
+	    key management is not supported. <span class="command"><strong>delv</strong></span>
+	    will not consult the managed-keys database maintained by
+	    <span class="command"><strong>named</strong></span>. This means that if either of the
+	    keys in <code class="filename">/etc/bind.keys</code> is revoked
 	    and rolled over, it will be necessary to update
 	    <code class="filename">/etc/bind.keys</code> to use DNSSEC
 	    validation in <span class="command"><strong>delv</strong></span>.

bin/delv/win32/delv.vcxproj.in

@@ -60,8 +60,7 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
@@ -88,8 +87,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>

bin/delv/win32/delv.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dig/Makefile.in

@@ -19,17 +19,16 @@ READLINE_LIB = @READLINE_LIB@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ \
-		${OPENSSL_CFLAGS}
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
 
 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/dig/dig.1

@@ -450,11 +450,6 @@ clears the EDNS options to be sent\&.
 Send an EDNS Expire option\&.
 .RE
 .PP
-\fB+[no]expandaaaa\fR
-.RS 4
-When printing AAAA record print all zero nibbles rather than the default RFC 5952 preferred presentation format\&.
-.RE
-.PP
 \fB+[no]fail\fR
 .RS 4
 Do not try the next server if you receive a SERVFAIL\&. The default is to not try the next server which is the reverse of normal stub resolver behavior\&.
@@ -589,11 +584,11 @@ A synonym for
 .RS 4
 Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
 \fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when using the
+normally sends recursive queries\&. Recursion is automatically disabled when the
 \fI+nssearch\fR
-option, and when using
+or
 \fI+trace\fR
-except for an initial recursive query to get the list of root servers\&.
+query options are used\&.
 .RE
 .PP
 \fB+retry=T\fR

bin/dig/dig.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -187,7 +189,6 @@ help(void) {
 "                 +[no]ednsnegotiation (Set EDNS version negotiation)\n"
 "                 +ednsopt=###[:value] (Send specified EDNS option)\n"
 "                 +noednsopt          (Clear list of +ednsopt options)\n"
-"                 +[no]expandaaaa     (Expand AAAA records)\n"
 "                 +[no]expire         (Request time to expire)\n"
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
 "                 +[no]header-only    (Send query without a question section)\n"
@@ -474,8 +475,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		styleflags |= DNS_STYLEFLAG_NO_CLASS;
 	if (query->lookup->nocrypto)
 		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (query->lookup->expandaaaa)
-		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	if (query->lookup->multiline) {
 		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -1037,24 +1036,8 @@ plus_option(char *option, bool is_batchfile,
 			}
 			break;
 		case 'x':
-			switch (cmd[2]) {
-			case 'p':
-				switch(cmd[3]) {
-				case 'a':
-					FULLCHECK("expandaaaa");
-					lookup->expandaaaa = state;
-					break;
-				case 'i':
-					FULLCHECK("expire");
-					lookup->expire = state;
-					break;
-				default:
-					goto invalid_option;
-				}
-				break;
-			default:
-				goto invalid_option;
-			}
+			FULLCHECK("expire");
+			lookup->expire = state;
 			break;
 		default:
 			goto invalid_option;
@@ -1462,7 +1445,7 @@ plus_option(char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = true;
+					lookup->recurse = false;
 					lookup->identify = true;
 					lookup->comments = false;
 					lookup->rrcomments = 0;

bin/dig/dig.docbook

@@ -747,16 +747,6 @@
 	  </listitem>
 	</varlistentry>
 
-	<varlistentry>
-	  <term><option>+[no]expandaaaa</option></term>
-	  <listitem>
-	    <para>
-	      When printing AAAA record print all zero nibbles rather
-	      than the default RFC 5952 preferred presentation format.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]fail</option></term>
 	  <listitem>
@@ -1010,10 +1000,8 @@
 	      in the query.  This bit is set by default, which means
 	      <command>dig</command> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      using the <parameter>+nssearch</parameter> option, and
-	      when using <parameter>+trace</parameter> except for
-	      an initial recursive query to get the list of root
-	      servers.
+	      the <parameter>+nssearch</parameter> or
+	      <parameter>+trace</parameter> query options are used.
 	    </para>
 	  </listitem>
 	</varlistentry>

bin/dig/dig.html

@@ -598,13 +598,6 @@
 	      Send an EDNS Expire option.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]expandaaaa</code></span></dt>
-<dd>
-	    <p>
-	      When printing AAAA record print all zero nibbles rather
-	      than the default RFC 5952 preferred presentation format.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]fail</code></span></dt>
 <dd>
 	    <p>
@@ -797,10 +790,8 @@
 	      in the query.  This bit is set by default, which means
 	      <span class="command"><strong>dig</strong></span> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      using the <em class="parameter"><code>+nssearch</code></em> option, and
-	      when using <em class="parameter"><code>+trace</code></em> except for
-	      an initial recursive query to get the list of root
-	      servers.
+	      the <em class="parameter"><code>+nssearch</code></em> or
+	      <em class="parameter"><code>+trace</code></em> query options are used.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+retry=T</code></span></dt>

bin/dig/dighost.c

@@ -19,6 +19,8 @@
  * functions in most applications.
  */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -621,7 +623,6 @@ make_empty_lookup(void) {
 	looknew->nocrypto = false;
 	looknew->ttlunits = false;
 	looknew->ttlunits = false;
-	looknew->expandaaaa = false;
 	looknew->qr = false;
 #ifdef HAVE_LIBIDN2
 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
@@ -770,7 +771,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->use_usec = lookold->use_usec;
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
-	looknew->expandaaaa = lookold->expandaaaa;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
@@ -1411,8 +1411,6 @@ dig_ednsoptname_t optnames[] = {
 	{ 12, "PAD" },		/* shorthand */
 	{ 13, "CHAIN" },	/* RFC 7901 */
 	{ 14, "KEY-TAG" },	/* RFC 8145 */
-	{ 16, "CLIENT-TAG" },	/* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },	/* draft-bellis-dnsop-edns-tags */
 	{ 26946, "DEVICEID" },	/* Brian Hartvigsen */
 };
 
@@ -2191,14 +2189,12 @@ setup_lookup(dig_lookup_t *lookup) {
 	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
-
 	/*
-	 * If this is a trace request, completely disallow recursion after
-	 * looking up the root name servers, since it's meaningless for traces.
+	 * If this is a trace request, completely disallow recursion, since
+	 * it's meaningless for traces.
 	 */
-	if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
+	if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
 		lookup->recurse = false;
-	}
 
 	if (lookup->recurse &&
 	    lookup->rdtype != dns_rdatatype_axfr &&

bin/dig/host.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>

bin/dig/include/dig/dig.h

@@ -140,7 +140,6 @@ struct dig_lookup {
 		ttlunits,
 		idnin,
 		idnout,
-		expandaaaa,
 		qr;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];

bin/dig/nslookup.c

@@ -9,6 +9,8 @@
  * information regarding copyright ownership.
  */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>

bin/dig/win32/dig.vcxproj.in

@@ -60,7 +60,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -88,7 +87,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dig/win32/dig.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dig/win32/dighost.vcxproj.in

@@ -60,7 +60,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -86,7 +85,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dig/win32/dighost.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dig/win32/host.vcxproj.in

@@ -60,7 +60,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -88,7 +87,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dig/win32/host.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dig/win32/nslookup.vcxproj.in

@@ -60,7 +60,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -88,7 +87,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dig/win32/nslookup.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/Makefile.in

@@ -15,15 +15,14 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${OPENSSL_CFLAGS}
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
 
 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@

bin/dnssec/dnssec-cds.c

@@ -16,6 +16,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <errno.h>
 #include <inttypes.h>
 #include <stdbool.h>
@@ -59,7 +61,12 @@
 
 #include "dnssectool.h"
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-cds";
+int verbose;
 
 /*
  * Infrastructure
@@ -75,6 +82,12 @@ static dns_fixedname_t fixed;
 static dns_name_t *name = NULL;
 static dns_rdataclass_t rdclass = dns_rdataclass_in;
 
+/*
+ * List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
+ * from -a arguments. The size of the array is an arbitrary limit.
+ */
+static uint8_t dtype[8];
+
 static const char *startstr  = NULL;	/* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;	/* restrict sig inception times */
 static dns_rdata_rrsig_t oldestsig;	/* for recording inception time */
@@ -116,7 +129,7 @@ static int nkey; /* number of child zone DNSKEY records */
 typedef struct keyinfo {
 	dns_rdata_t rdata;
 	dst_key_t *dst;
-	dns_secalg_t algo;
+	uint8_t algo;
 	dns_keytag_t tag;
 } keyinfo_t;
 
@@ -601,12 +614,12 @@ free_keytable(keyinfo_t **keytable_p) {
  * otherwise the key algorithm. This is used by the signature coverage
  * check functions below.
  */
-static dns_secalg_t *
+static uint8_t *
 matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigset)
 {
 	isc_result_t result;
-	dns_secalg_t *algo;
+	uint8_t *algo;
 	int i;
 
 	algo = isc_mem_get(mctx, nkey);
@@ -689,7 +702,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
  * fetched from the child zone, any working signature is enough.
  */
 static bool
-signed_loose(dns_secalg_t *algo) {
+signed_loose(uint8_t *algo) {
 	bool ok = false;
 	int i;
 	for (i = 0; i < nkey; i++) {
@@ -708,7 +721,7 @@ signed_loose(dns_secalg_t *algo) {
  * RRset.
  */
 static bool
-signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
+signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
 	isc_result_t result;
 	bool all_ok = true;
 
@@ -825,6 +838,34 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * For sorting the digest types so that DS records generated
+ * from CDNSKEY records are in canonical order.
+ */
+static int
+cmp_dtype(const void *ap, const void *bp) {
+	int a = *(const uint8_t *)ap;
+	int b = *(const uint8_t *)bp;
+	return (a - b);
+}
+
+static void
+add_dtype(const char *dn) {
+	uint8_t dt;
+	unsigned i, n;
+
+	dt = strtodsdigest(dn);
+	n = sizeof(dtype)/sizeof(dtype[0]);
+	for (i = 0; i < n; i++) {
+		if (dtype[i] == 0 || dtype[i] == dt) {
+			dtype[i] = dt;
+			qsort(dtype, i+1, 1, cmp_dtype);
+			return;
+		}
+	}
+	fatal("too many -a digest type arguments");
+}
+
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata,
 		uint32_t ttl, dns_rdataset_t *rdset)
@@ -895,7 +936,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	dns_rdata_t *arrdata;
 	dns_rdata_ds_t *ds;
 	dns_keytag_t key_tag;
-	dns_secalg_t algorithm;
+	uint8_t algorithm;
 	bool match;
 	int i, j, n, d;
 
@@ -1113,7 +1154,7 @@ main(int argc, char *argv[]) {
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'a':
-			add_dtype(strtodsdigest(isc_commandline_argument));
+			add_dtype(isc_commandline_argument);
 			break;
 		case 'c':
 			rdclass = strtoclass(isc_commandline_argument);

bin/dnssec/dnssec-dsfromkey.8

@@ -10,12 +10,12 @@
 .\"     Title: dnssec-dsfromkey
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-05-08
+.\"      Date: 2012-05-02
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-DSFROMKEY" "8" "2019\-05\-08" "ISC" "BIND9"
+.TH "DNSSEC\-DSFROMKEY" "8" "2012\-05\-02" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -83,13 +83,13 @@ file, as generated by
 \-1
 .RS 4
 An abbreviation for
-\fB\-a SHA\-1\fR\&. (Note: The SHA\-1 algorithm is no longer recommended for use when generating new DS and CDS records\&.)
+\fB\-a SHA1\fR
 .RE
 .PP
 \-2
 .RS 4
 An abbreviation for
-\fB\-a SHA\-256\fR\&.
+\fB\-a SHA\-256\fR
 .RE
 .PP
 \-a \fIalgorithm\fR
@@ -98,7 +98,7 @@ Specify a digest algorithm to use when converting DNSKEY records to DS records\&
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&. (Note: The SHA\-1 algorithm is no longer recommended for use when generating new DS and CDS records\&.)
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-A

bin/dnssec/dnssec-dsfromkey.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -47,7 +49,12 @@
 
 #include "dnssectool.h"
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-dsfromkey";
+int verbose;
 
 static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;
@@ -228,7 +235,7 @@ logkey(dns_rdata_t *rdata)
 }
 
 static void
-emit(dns_dsdigest_t dt, bool showall, char *lookaside,
+emit(unsigned int dtype, bool showall, char *lookaside,
      bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -254,7 +261,7 @@ emit(dns_dsdigest_t dt, bool showall, char *lookaside,
 	if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall)
 		return;
 
-	result = dns_ds_buildrdata(name, rdata, dt, buf, &ds);
+	result = dns_ds_buildrdata(name, rdata, dtype, buf, &ds);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't build record");
 
@@ -305,18 +312,6 @@ emit(dns_dsdigest_t dt, bool showall, char *lookaside,
 	printf("%.*s\n", (int)r.length, r.base);
 }
 
-static void
-emits(bool showall, char *lookaside, bool cds, dns_rdata_t *rdata) {
-	unsigned i, n;
-
-	n = sizeof(dtype)/sizeof(dtype[0]);
-	for (i = 0; i < n; i++) {
-		if (dtype[i] != 0) {
-			emit(dtype[i], showall, lookaside, cds, rdata);
-		}
-	}
-}
-
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 
@@ -355,9 +350,11 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	bool		cds = false;
-	bool		usekeyset = false;
-	bool		showall = false;
+	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	bool	cds = false;
+	bool	both = true;
+	bool	usekeyset = false;
+	bool	showall = false;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
 	dns_rdataset_t	rdataset;
@@ -365,14 +362,12 @@ main(int argc, char **argv) {
 
 	dns_rdata_init(&rdata);
 
-	if (argc == 1) {
+	if (argc == 1)
 		usage();
-	}
 
 	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
-	}
 
 #if USE_PKCS11
 	pk11_result_register();
@@ -385,16 +380,19 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
-			add_dtype(DNS_DSDIGEST_SHA1);
+			dtype = DNS_DSDIGEST_SHA1;
+			both = false;
 			break;
 		case '2':
-			add_dtype(DNS_DSDIGEST_SHA256);
+			dtype = DNS_DSDIGEST_SHA256;
+			both = false;
 			break;
 		case 'A':
 			showall = true;
 			break;
 		case 'a':
-			add_dtype(strtodsdigest(isc_commandline_argument));
+			dtype = strtodsdigest(isc_commandline_argument);
+			both = false;
 			break;
 		case 'C':
 			if (lookaside != NULL)
@@ -462,32 +460,22 @@ main(int argc, char **argv) {
 
 	rdclass = strtoclass(classname);
 
-	if (usekeyset && filename != NULL) {
+	if (usekeyset && filename != NULL)
 		fatal("cannot use both -s and -f");
-	}
 
 	/* When not using -f, -A is implicit */
-	if (filename == NULL) {
+	if (filename == NULL)
 		showall = true;
-	}
 
-	/* Default digest type if none specified. */
-	if (dtype[0] == 0) {
-		dtype[0] = DNS_DSDIGEST_SHA256;
-	}
-
-	if (argc < isc_commandline_index + 1 && filename == NULL) {
+	if (argc < isc_commandline_index + 1 && filename == NULL)
 		fatal("the key file name was not specified");
-	}
-	if (argc > isc_commandline_index + 1) {
+	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");
-	}
 
 	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	}
 
 	setup_logging(mctx, &log);
 
@@ -497,38 +485,38 @@ main(int argc, char **argv) {
 		if (argc < isc_commandline_index + 1 && filename != NULL) {
 			/* using zone name as the zone file name */
 			namestr = filename;
-		} else {
+		} else
 			namestr = argv[isc_commandline_index];
-		}
 
 		result = initname(namestr);
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not initialize name %s", namestr);
-		}
 
-		if (usekeyset) {
+		if (usekeyset)
 			result = loadkeyset(dir, &rdataset);
-		} else {
+		else
 			result = loadset(filename, &rdataset);
-		}
 
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not load DNSKEY set: %s\n",
 			      isc_result_totext(result));
-		}
 
 		for (result = dns_rdataset_first(&rdataset);
 		     result == ISC_R_SUCCESS;
-		     result = dns_rdataset_next(&rdataset))
-		{
+		     result = dns_rdataset_next(&rdataset)) {
 			dns_rdata_init(&rdata);
 			dns_rdataset_current(&rdataset, &rdata);
 
-			if (verbose > 2) {
+			if (verbose > 2)
 				logkey(&rdata);
-			}
 
-			emits(showall, lookaside, cds, &rdata);
+			if (both) {
+				emit(DNS_DSDIGEST_SHA1, showall, lookaside,
+				     cds, &rdata);
+				emit(DNS_DSDIGEST_SHA256, showall, lookaside,
+				     cds, &rdata);
+			} else
+				emit(dtype, showall, lookaside, cds, &rdata);
 		}
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
@@ -536,25 +524,28 @@ main(int argc, char **argv) {
 		loadkey(argv[isc_commandline_index], key_buf,
 			DST_KEY_MAXSIZE, &rdata);
 
-		emits(showall, lookaside, cds, &rdata);
+		if (both) {
+			emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds,
+			     &rdata);
+			emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds,
+			     &rdata);
+		} else
+			emit(dtype, showall, lookaside, cds, &rdata);
 	}
 
-	if (dns_rdataset_isassociated(&rdataset)) {
+	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
-	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
-	if (verbose > 10) {
+	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
-	}
 	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
 		return (1);
-	} else {
+	} else
 		return (0);
-	}
 }

bin/dnssec/dnssec-dsfromkey.docbook

@@ -12,7 +12,7 @@
 <!-- Converted by db4-upgrade version 1.0 -->
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-dsfromkey">
   <info>
-    <date>2019-05-08</date>
+    <date>2012-05-02</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -150,9 +150,7 @@
 	<term>-1</term>
 	<listitem>
 	  <para>
-	    An abbreviation for <option>-a SHA-1</option>.
-	    (Note: The SHA-1 algorithm is no longer recommended for use
-	    when generating new DS and CDS records.)
+	    An abbreviation for <option>-a SHA1</option>
 	  </para>
 	</listitem>
       </varlistentry>
@@ -161,7 +159,7 @@
 	<term>-2</term>
 	<listitem>
 	  <para>
-	    An abbreviation for <option>-a SHA-256</option>.
+	    An abbreviation for <option>-a SHA-256</option>
 	  </para>
 	</listitem>
       </varlistentry>
@@ -180,8 +178,6 @@
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
-	    (Note: The SHA-1 algorithm is no longer recommended for use
-	    when generating new DS and CDS records.)
 	  </para>
 	</listitem>
       </varlistentry>

bin/dnssec/dnssec-dsfromkey.html

@@ -135,15 +135,13 @@
 <dt><span class="term">-1</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA-1</code>.
-	    (Note: The SHA-1 algorithm is no longer recommended for use
-	    when generating new DS and CDS records.)
+	    An abbreviation for <code class="option">-a SHA1</code>
 	  </p>
 	</dd>
 <dt><span class="term">-2</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA-256</code>.
+	    An abbreviation for <code class="option">-a SHA-256</code>
 	  </p>
 	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
@@ -159,8 +157,6 @@
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
-	    (Note: The SHA-1 algorithm is no longer recommended for use
-	    when generating new DS and CDS records.)
 	  </p>
 	</dd>
 <dt><span class="term">-A</span></dt>

bin/dnssec/dnssec-importkey.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdbool.h>
 #include <stdlib.h>
 
@@ -46,7 +48,12 @@
 
 #include "dnssectool.h"
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-importkey";
+int verbose;
 
 static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;

bin/dnssec/dnssec-keyfromlabel.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
@@ -46,6 +48,7 @@
 #define MAX_RSA 4096 /* should be long enough... */
 
 const char *program = "dnssec-keyfromlabel";
+int verbose;
 
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
@@ -218,8 +221,6 @@ main(int argc, char **argv) {
 			break;
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
-            if (label == NULL)
-                fatal("Failed to allocate memory for label");
 			break;
 		case 'n':
 			nametype = isc_commandline_argument;

bin/dnssec/dnssec-keygen.8

@@ -92,7 +92,8 @@ to generate TSIG keys\&.
 .RS 4
 Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 4096 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
 .sp
-If the key size is not specified, some algorithms have pre\-defined defaults\&. For instance, RSA keys have a default size of 2048 bits\&.
+If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
+\fB\-f KSK\fR) default to 2048 bits\&.
 .RE
 .PP
 \-C
@@ -307,18 +308,17 @@ contains the private key\&.
 .PP
 The
 \&.key
-file contains a DNSKEY or KEY record\&. When a zone is being signed by
-\fBnamed\fR
-or
-\fBdnssec\-signzone\fR\fB\-S\fR, DNSKEY records are included automatically\&. In other cases, the
-\&.key
-file can be inserted into a zone file manually or with a
-\fB$INCLUDE\fR
-statement\&.
+file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&.
 .PP
 The
 \&.private
 file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&.
+.PP
+Both
+\&.key
+and
+\&.private
+files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
 To generate an ECDSAP256SHA256 zone\-signing key for the zone

bin/dnssec/dnssec-keygen.c

@@ -25,6 +25,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
@@ -61,6 +63,7 @@
 #define MAX_RSA 4096 /* should be long enough... */
 
 const char *program = "dnssec-keygen";
+int verbose;
 
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
@@ -554,7 +557,11 @@ main(int argc, char **argv) {
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
-				size = 2048;
+				if ((kskflag & DNS_KEYFLAG_KSK) != 0) {
+					size = 2048;
+				} else {
+					size = 1024;
+				}
 				if (verbose > 0) {
 					fprintf(stderr, "key size not "
 							"specified; defaulting"

bin/dnssec/dnssec-keygen.docbook

@@ -176,8 +176,10 @@
 	  </para>
 	  <para>
 	    If the key size is not specified, some algorithms have
-	    pre-defined defaults.  For instance, RSA keys have a default
-	    size of 2048 bits.
+	    pre-defined defaults.  For example, RSA keys for use as
+	    DNSSEC zone signing keys have a default size of 1024 bits;
+	    RSA keys for use as key signing keys (KSKs, generated with
+	    <option>-f KSK</option>) default to 2048 bits.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -569,12 +571,10 @@
       key.
     </para>
     <para>
-      The <filename>.key</filename> file contains a DNSKEY or KEY record.
-      When a zone is being signed by <command>named</command>
-      or <command>dnssec-signzone</command> <option>-S</option>, DNSKEY
-      records are included automatically. In other cases,
-      the <filename>.key</filename> file can be inserted into a zone file
-      manually or with a <userinput>$INCLUDE</userinput> statement.
+      The <filename>.key</filename> file contains a DNS KEY record
+      that
+      can be inserted into a zone file (directly or with a $INCLUDE
+      statement).
     </para>
     <para>
       The <filename>.private</filename> file contains
@@ -582,6 +582,11 @@
       fields.  For obvious security reasons, this file does not have
       general read permission.
     </para>
+    <para>
+      Both <filename>.key</filename> and <filename>.private</filename>
+      files are generated for symmetric cryptography algorithms such as
+      HMAC-MD5, even though the public and private key are equivalent.
+    </para>
   </refsection>
 
   <refsection><info><title>EXAMPLE</title></info>

bin/dnssec/dnssec-keygen.html

@@ -145,8 +145,10 @@
 	  </p>
 	  <p>
 	    If the key size is not specified, some algorithms have
-	    pre-defined defaults.  For instance, RSA keys have a default
-	    size of 2048 bits.
+	    pre-defined defaults.  For example, RSA keys for use as
+	    DNSSEC zone signing keys have a default size of 1024 bits;
+	    RSA keys for use as key signing keys (KSKs, generated with
+	    <code class="option">-f KSK</code>) default to 2048 bits.
 	  </p>
 	</dd>
 <dt><span class="term">-C</span></dt>
@@ -460,12 +462,10 @@
       key.
     </p>
     <p>
-      The <code class="filename">.key</code> file contains a DNSKEY or KEY record.
-      When a zone is being signed by <span class="command"><strong>named</strong></span>
-      or <span class="command"><strong>dnssec-signzone</strong></span> <code class="option">-S</code>, DNSKEY
-      records are included automatically. In other cases,
-      the <code class="filename">.key</code> file can be inserted into a zone file
-      manually or with a <strong class="userinput"><code>$INCLUDE</code></strong> statement.
+      The <code class="filename">.key</code> file contains a DNS KEY record
+      that
+      can be inserted into a zone file (directly or with a $INCLUDE
+      statement).
     </p>
     <p>
       The <code class="filename">.private</code> file contains
@@ -473,6 +473,11 @@
       fields.  For obvious security reasons, this file does not have
       general read permission.
     </p>
+    <p>
+      Both <code class="filename">.key</code> and <code class="filename">.private</code>
+      files are generated for symmetric cryptography algorithms such as
+      HMAC-MD5, even though the public and private key are equivalent.
+    </p>
   </div>
 
   <div class="refsection">

bin/dnssec/dnssec-revoke.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -37,6 +39,7 @@
 #include "dnssectool.h"
 
 const char *program = "dnssec-revoke";
+int verbose;
 
 static isc_mem_t	*mctx = NULL;
 

bin/dnssec/dnssec-settime.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -40,6 +42,7 @@
 #include "dnssectool.h"
 
 const char *program = "dnssec-settime";
+int verbose;
 
 static isc_mem_t	*mctx = NULL;
 

bin/dnssec/dnssec-signzone.c

@@ -25,6 +25,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -32,7 +34,6 @@
 #include <unistd.h>
 
 #include <isc/app.h>
-#include <isc/atomic.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
 #include <isc/event.h>
@@ -46,8 +47,8 @@
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/rwlock.h>
-#include <isc/safe.h>
 #include <isc/serial.h>
+#include <isc/safe.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -87,7 +88,12 @@
 
 #include "dnssectool.h"
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-signzone";
+int verbose;
 
 typedef struct hashlist hashlist_t;
 
@@ -156,8 +162,7 @@ static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
-static atomic_bool shuttingdown;
-static atomic_bool finished;
+static bool shuttingdown = false, finished = false;
 static bool nokeys = false;
 static bool removefile = false;
 static bool generateds = false;
@@ -989,6 +994,16 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 		dns_rdata_init(&key);
 		dns_rdata_init(&ds);
 		dns_rdataset_current(&keyset, &key);
+		result = dns_ds_buildrdata(name, &key, DNS_DSDIGEST_SHA1,
+					   dsbuf, &ds);
+		check_result(result, "dns_ds_buildrdata");
+
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					      ttl, &ds, &tuple);
+		check_result(result, "dns_difftuple_create");
+		dns_diff_append(&diff, &tuple);
+
+		dns_rdata_reset(&ds);
 		result = dns_ds_buildrdata(name, &key, DNS_DSDIGEST_SHA256,
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");
@@ -1456,12 +1471,11 @@ signapex(void) {
 	cleannode(gdb, gversion, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
-	if (result == ISC_R_NOMORE) {
-		atomic_store(&finished, true);
-	} else if (result != ISC_R_SUCCESS) {
+	if (result == ISC_R_NOMORE)
+		finished = true;
+	else if (result != ISC_R_SUCCESS)
 		fatal("failure iterating database: %s",
 		      isc_result_totext(result));
-	}
 }
 
 /*%
@@ -1481,12 +1495,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	static dns_fixedname_t fzonecut;	/* Protected by namelock. */
 	static unsigned int ended = 0;		/* Protected by namelock. */
 
-	if (atomic_load(&shuttingdown)) {
+	if (shuttingdown)
 		return;
-	}
 
 	LOCK(&namelock);
-	if (atomic_load(&finished)) {
+	if (finished) {
 		ended++;
 		if (ended == ntasks) {
 			isc_task_detach(&task);
@@ -1556,7 +1569,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
  next:
 		result = dns_dbiterator_next(gdbiter);
 		if (result == ISC_R_NOMORE) {
-			atomic_store(&finished, true);
+			finished = true;
 			break;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("failure iterating database: %s",
@@ -2989,6 +3002,19 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 		isc_buffer_usedregion(&b, &r);
 		dns_rdata_fromregion(&rdata, gclass, dns_rdatatype_dnskey, &r);
 		if (type != dns_rdatatype_dnskey) {
+			result = dns_ds_buildrdata(gorigin, &rdata,
+						   DNS_DSDIGEST_SHA1,
+						   dsbuf, &ds);
+			check_result(result, "dns_ds_buildrdata");
+			if (type == dns_rdatatype_dlv)
+				ds.type = dns_rdatatype_dlv;
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, 0, &ds, &tuple);
+			check_result(result, "dns_difftuple_create");
+			dns_diff_append(&diff, &tuple);
+
+			dns_rdata_reset(&ds);
 			result = dns_ds_buildrdata(gorigin, &rdata,
 						   DNS_DSDIGEST_SHA256,
 						   dsbuf, &ds);
@@ -2999,12 +3025,11 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						      DNS_DIFFOP_ADDRESIGN,
 						      name, 0, &ds, &tuple);
 
-		} else {
+		} else
 			result = dns_difftuple_create(mctx,
 						      DNS_DIFFOP_ADDRESIGN,
 						      gorigin, zone_soa_min_ttl,
 						      &rdata, &tuple);
-		}
 		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}
@@ -3216,9 +3241,6 @@ main(int argc, char *argv[]) {
 	bool set_iter = false;
 	bool nonsecify = false;
 
-	atomic_init(&shuttingdown, false);
-	atomic_init(&finished, false);
-
 	/* Unused letters: Bb G J q Yy (and F is reserved). */
 #define CMDLINE_FLAGS \
 	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQRr:s:ST:tuUv:VX:xzZ:"
@@ -3861,7 +3883,7 @@ main(int argc, char *argv[]) {
 	presign();
 	TIME_NOW(&sign_start);
 	signapex();
-	if (!atomic_load(&finished)) {
+	if (!finished) {
 		/*
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
@@ -3874,12 +3896,11 @@ main(int argc, char *argv[]) {
 				      isc_result_totext(result));
 		}
 		(void)isc_app_run();
-		if (!atomic_load(&finished)) {
+		if (!finished)
 			fatal("process aborted by user");
-		}
 	} else
 		isc_task_detach(&master);
-	atomic_store(&shuttingdown, true);;
+	shuttingdown = true;
 	for (i = 0; i < (int)ntasks; i++)
 		isc_task_detach(&tasks[i]);
 	isc_taskmgr_destroy(&taskmgr);

bin/dnssec/dnssec-verify.c

@@ -11,6 +11,8 @@
 
 /*! \file */
 
+#include <config.h>
+
 #include <stdbool.h>
 #include <stdlib.h>
 #include <time.h>
@@ -67,6 +69,7 @@
 #include "dnssectool.h"
 
 const char *program = "dnssec-verify";
+int verbose;
 
 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;

bin/dnssec/dnssectool.c

@@ -15,6 +15,8 @@
  * DNSSEC Support Routines.
  */
 
+#include <config.h>
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -57,8 +59,8 @@
 
 #include "dnssectool.h"
 
-int verbose;
-uint8_t dtype[8];
+extern int verbose;
+extern const char *program;
 
 static fatalcallback_t *fatalcallback = NULL;
 
@@ -344,32 +346,6 @@ strtodsdigest(const char *algname) {
 	}
 }
 
-static int
-cmp_dtype(const void *ap, const void *bp) {
-	int a = *(const uint8_t *)ap;
-	int b = *(const uint8_t *)bp;
-	return (a - b);
-}
-
-void
-add_dtype(unsigned int dt) {
-	unsigned i, n;
-
-	/* ensure there is space for a zero terminator */
-	n = sizeof(dtype)/sizeof(dtype[0]) - 1;
-	for (i = 0; i < n; i++) {
-		if (dtype[i] == dt) {
-			return;
-		}
-		if (dtype[i] == 0) {
-			dtype[i] = dt;
-			qsort(dtype, i+1, 1, cmp_dtype);
-			return;
-		}
-	}
-	fatal("too many -a digest type arguments");
-}
-
 isc_result_t
 try_dir(const char *dirname) {
 	isc_result_t result;

bin/dnssec/dnssectool.h

@@ -21,25 +21,6 @@
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 
-#ifndef PATH_MAX
-#define PATH_MAX 1024   /* WIN32, and others don't define this. */
-#endif
-
-/*! verbosity: set by -v option in each program, defined in dnssectool.c */
-extern int verbose;
-
-/*! program name, statically initialized in each program */
-extern const char *program;
-
-/*!
- * List of DS digest types used by dnssec-cds and dnssec-dsfromkey,
- * defined in dnssectool.c. Filled in by add_dtype() from -a
- * arguments, sorted (so that DS records are in a canonical order) and
- * terminated by a zero. The size of the array is an arbitrary limit
- * which should be greater than the number of known digest types.
- */
-extern uint8_t dtype[8];
-
 typedef void (fatalcallback_t)(void);
 
 ISC_PLATFORM_NORETURN_PRE void
@@ -74,14 +55,11 @@ isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp);
 
-dns_rdataclass_t
-strtoclass(const char *str);
-
 unsigned int
 strtodsdigest(const char *str);
 
-void
-add_dtype(unsigned int dt);
+dns_rdataclass_t
+strtoclass(const char *str);
 
 isc_result_t
 try_dir(const char *dirname);

bin/dnssec/win32/cds.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/cds.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/dnssectool.vcxproj.in

@@ -68,7 +68,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -93,7 +92,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/dnssectool.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/dsfromkey.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -103,7 +102,6 @@ set PYTHONPATH=.
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/dsfromkey.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/importkey.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/importkey.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/keyfromlabel.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/keyfromlabel.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/keygen.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/keygen.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/revoke.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/revoke.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/settime.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>

bin/dnssec/win32/settime.vcxproj.user

@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>

bin/dnssec/win32/signzone.vcxproj.in

@@ -62,7 +62,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
@@ -90,7 +89,6 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>