Test assumption that bindable names are fixednames

.gitlab-ci.yml

@@ -56,16 +56,6 @@ variables:
   # Some jobs may clean up the build artifacts unless this is set to 0.
   CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1
 
-  # DNS Shotgun performance testing defaults
-  SHOTGUN_ROUNDS: 1
-  SHOTGUN_DURATION: 120
-  # allow unlimited improvements against baseline
-  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'
-
 default:
   # Allow all running CI jobs to be automatically canceled when a new
   # version of a branch is pushed.
@@ -117,55 +107,16 @@ stages:
     - runner-manager
     - aarch64
 
-.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
+
+.freebsd-stress-amd64: &freebsd_stress_amd64
   tags:
-    - amd64
-    - autoscaler
+    - bsd-stress-test
     - aws
-    - bsd-stress-test-1
+    - autoscaler
     - shell
     - stress-test
-
-.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
-  tags:
     - amd64
-    - autoscaler
-    - aws
-    - bsd-stress-test-2
-    - shell
-    - stress-test
-
-.freebsd-autoscaler-amd64: &freebsd_autoscaler_amd64
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    # Even though there's only one job per runtime environment, the GitLab
-    # "instance" executor insists on cloning the Git repository to a path that
-    # contains a variable number from zero to the "maximum concurrent instances
-    # count" allowed on the GitLab Runner. See the "0" directory in this
-    # example path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
-    #
-    # This is not a problem for isolated jobs like "stress" tests that depend
-    # on no other jobs. However, it is a problem for jobs that need other jobs'
-    # artifacts. For example, a system test job that has its Git repo cloned to
-    # the "/1/" sub-path will fail if it downloads build job artifacts that
-    # have ./configure output files with "/0/" in its sub-path recorded.
-    GIT_CLONE_PATH: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 13)
-
-.freebsd-autoscaler-13-amd64: &freebsd_autoscaler_13_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_13_amd64_tags
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 14)
-
-.freebsd-autoscaler-14-amd64: &freebsd_autoscaler_14_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_14_amd64_tags
 
 ### Docker Image Templates
 
@@ -253,6 +204,14 @@ stages:
 
 ### QCOW2 Image Templates
 
+.freebsd-13-amd64: &freebsd_13_amd64_image
+  image: "freebsd-13.4-x86_64"
+  <<: *libvirt_amd64
+
+.freebsd-14-amd64: &freebsd_14_amd64_image
+  image: "freebsd-14.2-x86_64"
+  <<: *libvirt_amd64
+
 .openbsd-amd64: &openbsd_amd64_image
   image: "openbsd-7.6-x86_64"
   <<: *libvirt_amd64
@@ -260,18 +219,31 @@ stages:
 ### Job Templates
 
 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web
 
 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - triggers
+    - web
 
 .default-triggering-rules: &default_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - merge_requests
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web
 
 .precheck: &precheck_job
   <<: *default_triggering_rules
@@ -371,41 +343,18 @@ stages:
 
 .shotgun: &shotgun_job
   <<: *base_image
+  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
   stage: performance
-  rules:
-    - &shotgun_rule_mr
-      if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-    - &shotgun_rule_tag
-      if: '$CI_COMMIT_TAG != null'
-      variables:
-        SHOTGUN_ROUNDS: 3
-    - &shotgun_rule_other
-      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
-  # when using data from a single run, the overall instability of the results
-  # causes quite high false positive rate, rerun the test to attemp to reduce those
-  retry: 1
   script:
-    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
+    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
     - PIPELINE_ID=$(curl -s -X POST --fail
         -F "token=$CI_JOB_TOKEN"
         -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
+        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
         -F "variables[SHOTGUN_DURATION]=300"
         -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
         -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
         -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
         https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
     - util/ci-wait-shotgun.py $PIPELINE_ID
   needs:
@@ -562,8 +511,6 @@ misc:
     - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
     - bash util/unused-headers.sh
     - bash util/xmllint-html.sh
-    # Check dangling symlinks in the repository
-    - if find . -xtype l | grep .; then exit 1; fi
   needs: []
   artifacts:
     paths:
@@ -587,7 +534,7 @@ vulture:
   <<: *precheck_job
   needs: []
   script:
-    - vulture --exclude "*ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
 
 ci-variables:
   stage: precheck
@@ -672,8 +619,9 @@ danger:
   script:
     - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
     - hazard
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  only:
+    refs:
+      - merge_requests
 
 checkbashisms:
   <<: *precheck_job
@@ -1320,8 +1268,6 @@ clang:asan:
   <<: *build_job
 
 system:clang:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *base_image
   <<: *system_test_job
   needs:
@@ -1341,7 +1287,7 @@ gcc:tsan:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
   <<: *tsan_fedora_41_amd64_image
   <<: *build_job
@@ -1370,8 +1316,7 @@ clang:tsan:
   variables:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    # -Wl,--disable-new-dtags ensures that Clang creates valid TSAN reports
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
 
 system:clang:tsan:
@@ -1450,19 +1395,27 @@ unit:clang:bookworm:amd64:
 # Jobs for Clang builds on FreeBSD 13 (amd64)
 
 clang:freebsd13:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_13_amd64_image
   <<: *build_job
-  <<: *freebsd_autoscaler_13_amd64
 
 system:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
   <<: *system_test_job
-  <<: *freebsd_autoscaler_13_amd64
+  variables:
+    USER: gitlab-runner
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
 
 unit:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
   <<: *unit_test_job
-  <<: *freebsd_autoscaler_13_amd64
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
@@ -1470,19 +1423,27 @@ unit:clang:freebsd13:amd64:
 # Jobs for Clang builds on FreeBSD 14 (amd64)
 
 clang:freebsd14:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_14_amd64_image
   <<: *build_job
-  <<: *freebsd_autoscaler_14_amd64
 
 system:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
   <<: *system_test_job
-  <<: *freebsd_autoscaler_14_amd64
+  variables:
+    USER: gitlab-runner
   needs:
     - job: clang:freebsd14:amd64
       artifacts: true
 
 unit:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
   <<: *unit_test_job
-  <<: *freebsd_autoscaler_14_amd64
   needs:
     - job: clang:freebsd14:amd64
       artifacts: true
@@ -1531,8 +1492,8 @@ release:
       artifacts: true
     - job: docs
       artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
   artifacts:
     paths:
       - "*-release"
@@ -1575,8 +1536,8 @@ sign:
   needs:
     - job: release
       artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
   when: manual
   allow_failure: false
 
@@ -1628,8 +1589,10 @@ coverity:
       - cov-int.tar.gz
     expire_in: "1 week"
     when: on_failure
-  rules:
-    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'
+  only:
+    variables:
+      - $COVERITY_SCAN_PROJECT_NAME
+      - $COVERITY_SCAN_TOKEN
 
 # Respdiff tests
 
@@ -1664,9 +1627,9 @@ respdiff:tsan:
   <<: *default_triggering_rules
   <<: *tsan_debian_bookworm_amd64_image
   variables:
-    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
     TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
@@ -1691,6 +1654,9 @@ respdiff-third-party:
 
 # Performance tests
 
+# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
+# allow re-use of the built container image. Otherwise, the jobs would do the
+# same builds in parallel rather than re-use the already built image.
 shotgun:udp:
   <<: *shotgun_job
   variables:
@@ -1701,29 +1667,25 @@ shotgun:tcp:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 12
+    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+  when: delayed
+  start_in: 5 minutes
 
 shotgun:dot:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: dot
     SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  rules: &shotgun_rules_manual_mr
-    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-      when: manual  # don't run on each MR unless requested
-      allow_failure: true
-    - *shotgun_rule_tag
-    - *shotgun_rule_other
+  when: delayed
+  start_in: 5 minutes
 
 shotgun:doh-get:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: doh-get
     SHOTGUN_TRAFFIC_MULTIPLIER: 3
-    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter
-  rules: *shotgun_rules_manual_mr
+  when: delayed
+  start_in: 5 minutes
 
 .stress-test: &stress_test
   stage: performance
@@ -1762,8 +1724,8 @@ fsck:
     - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
     - cd bind9-full-clone/
     - git fsck
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    - schedules
   needs: []
 
 gcov:
@@ -1815,8 +1777,9 @@ pairwise:
       - pairwise-model.txt
       - pairwise-output.*.txt
     when: on_failure
-  rules:
-    - if: '$PAIRWISE_TESTING != null'
+  only:
+    variables:
+      - $PAIRWISE_TESTING
 
 .post_merge_template: &post_merge
   <<: *base_image

.gitlab/issue_templates/Internal_use_only-CVE.md

@@ -70,8 +70,7 @@ confidential!
 
   - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
   - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
   - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
   - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
   - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
@@ -115,8 +114,7 @@ confidential!
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
 [step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves

ChangeLog

@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES

bin/check/check-tool.c

@@ -112,7 +112,8 @@ add(char *key, int value) {
 	}
 
 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		isc_symtab_create(sym_mctx, 100, freekey, sym_mctx, false,
+				  &symtab);
 	}
 
 	key = isc_mem_strdup(sym_mctx, key);
@@ -655,7 +656,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
 	dns_zone_setorigin(zone, origin);
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {

bin/check/named-checkconf.c

@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,7 +30,6 @@
 
 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -761,7 +759,7 @@ cleanup:
 	}
 
 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 
 	return result == ISC_R_SUCCESS ? 0 : 1;

bin/check/named-checkzone.c

@@ -22,7 +22,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,7 +31,6 @@
 
 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -577,7 +575,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }

bin/confgen/rndc-confgen.c

@@ -32,7 +32,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -41,7 +40,6 @@
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 
 #include <dst/dst.h>
@@ -290,7 +288,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/confgen/tsig-keygen.c

@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -37,7 +36,6 @@
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 
 #include <dst/dst.h>
@@ -296,7 +294,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/delv/delv.c

@@ -26,14 +26,17 @@
 #include <unistd.h>
 
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -56,7 +59,6 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -163,6 +165,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*
  * Static function prototypes
  */
@@ -589,7 +595,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);
 
-	result = dns_name_fromtext(n, &b, dns_rootname, 0);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
@@ -1611,7 +1617,24 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -2284,5 +2307,14 @@ cleanup:
 
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return 0;
 }

bin/dig/dig.c

@@ -20,9 +20,8 @@
 #include <time.h>
 
 #include <isc/attributes.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
-#include <isc/lib.h>
+#include <isc/fips.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -34,7 +33,6 @@
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -73,6 +71,14 @@ static bool short_form = false, printcmd = true, plusquest = false,
 static uint32_t splitwidth = 0xffffffff;
 
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 /*% opcode text */
 static const char *const opcodetext[] = {
@@ -289,7 +295,6 @@ help(void) {
 	       "                                      form of answers - global "
 	       "option)\n"
 	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
-	       "                 +[no]showbadvers    (Show BADVERS message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -298,8 +303,6 @@ help(void) {
 	       "statistics)\n"
 	       "                 +subnet=addr        (Set edns-client-subnet "
 	       "option)\n"
-	       "                 +[no]svcparamkeycompat (Display backward-"
-	       "compatible SvcParamKey names (keyN) for non-initial entries)\n"
 	       "                 +[no]tcflag         (Set TC flag in query "
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
@@ -328,7 +331,6 @@ help(void) {
 	       "                 +[no]yaml           (Present the results as "
 	       "YAML)\n"
 	       "                 +[no]zflag          (Set Z flag in query)\n"
-	       "                 +[no]zoneversion    (Request zone version)\n"
 	       "        global d-opts and servers (before host name) affect "
 	       "all "
 	       "queries.\n"
@@ -500,9 +502,6 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->expandaaaa) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	}
-	if (query->lookup->svcparamkeycompat) {
-		styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-	}
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
@@ -587,7 +586,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 
 	UNUSED(flags);
 
-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
 		return ISC_R_SUCCESS;
@@ -629,7 +628,9 @@ static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
-	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);
+	static unsigned char local_offsets[] = { 0, 6 };
+	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
+							local_offsets);
 
 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -694,9 +695,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		if (query->lookup->expandaaaa) {
 			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 		}
-		if (query->lookup->svcparamkeycompat) {
-			styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-		}
 		if (query->lookup->multiline) {
 			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -1774,8 +1772,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 						FULLCHECK("edns");
 						if (!state) {
 							lookup->edns = -1;
-							lookup->original_edns =
-								-1;
 							break;
 						}
 						if (value == NULL) {
@@ -1792,7 +1788,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							goto exit_or_usage;
 						}
 						lookup->edns = num;
-						lookup->original_edns = num;
 						break;
 					case 'f':
 						FULLCHECK("ednsflags");
@@ -2311,18 +2306,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			case 'w': /* showsearch */
 				switch (cmd[4]) {
 				case 'b':
-					switch (cmd[7]) {
-					case 'c':
-						FULLCHECK("showbadcookie");
-						lookup->showbadcookie = state;
-						break;
-					case 'v':
-						FULLCHECK("showbadvers");
-						lookup->showbadvers = state;
-						break;
-					default:
-						goto invalid_option;
-					}
+					FULLCHECK("showbadcookie");
+					lookup->showbadcookie = state;
 					break;
 				case 's':
 					FULLCHECK("showsearch");
@@ -2409,10 +2394,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				goto exit_or_usage;
 			}
 			break;
-		case 'v': /* svcparamkeycompat */
-			FULLCHECK("svcparamkeycompat");
-			lookup->svcparamkeycompat = state;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -2575,22 +2556,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			lookup->rrcomments = -1;
 		}
 		break;
-	case 'z':
-		switch (cmd[1]) {
-		case 'f': /* zflag */
-			FULLCHECK("zflag");
-			lookup->zflag = state;
-			break;
-		case 'o': /* zoneversion */
-			FULLCHECK("zoneversion");
-			if (state && lookup->edns == -1) {
-				lookup->edns = DEFAULT_EDNS_VERSION;
-			}
-			lookup->zoneversion = state;
-			break;
-		default:
-			goto invalid_option;
-		}
+	case 'z': /* zflag */
+		FULLCHECK("zflag");
+		lookup->zflag = state;
 		break;
 	default:
 	invalid_option:
@@ -2951,7 +2919,24 @@ preparse_args(int argc, char **argv) {
 				debugging = true;
 				break;
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -3479,5 +3464,14 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return exitcode;
 }

bin/dig/dig.rst

@@ -614,12 +614,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    BADCOOKIE rcode before retrying the request or not. The default
    is to not show the messages.
 
-.. option:: +showbadvers, +noshowbadvers
-
-   This option toggles whether to show the message containing the
-   BADVERS rcode before retrying the request or not. The default
-   is to not show the messages.
-
 .. option:: +showsearch, +noshowsearch
 
    This option performs [or does not perform] a search showing intermediate results.
@@ -648,14 +642,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    prefix-length of zero, which signals a resolver that the client's
    address information must *not* be used when resolving this query.
 
-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag
 
    This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
@@ -757,10 +743,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
    This flag is off by default.
 
-.. option:: +zoneversion, +nozoneversion
-
-   When enabled, this option includes an EDNS Zone Version request when sending a query.
-
 Multiple Queries
 ~~~~~~~~~~~~~~~~
 

bin/dig/dighost.c

@@ -605,7 +605,6 @@ make_empty_lookup(void) {
 		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
-		.original_edns = -1,
 		.recurse = true,
 		.retries = tries,
 		.comments = true,
@@ -705,7 +704,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->opcode = lookold->opcode;
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
-	looknew->zoneversion = lookold->zoneversion;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
 	looknew->https_mode = lookold->https_mode;
@@ -740,7 +738,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}
 
 	looknew->showbadcookie = lookold->showbadcookie;
-	looknew->showbadvers = lookold->showbadvers;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -761,13 +758,11 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
-	looknew->svcparamkeycompat = lookold->svcparamkeycompat;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
 	looknew->edns = lookold->edns;
-	looknew->original_edns = lookold->original_edns;
 	looknew->recurse = lookold->recurse;
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
@@ -862,14 +857,14 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 void
 setup_text_key(void) {
 	isc_result_t result;
-	dns_fixedname_t fkey;
-	dns_name_t *keyname = dns_fixedname_initname(&fkey);
+	dns_name_t keyname;
 	isc_buffer_t secretbuf;
 	unsigned int secretsize;
 	unsigned char *secretstore;
 
 	debug("setup_text_key()");
 	isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	dns_name_init(&keyname, NULL);
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int)strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -886,12 +881,12 @@ setup_text_key(void) {
 		goto failure;
 	}
 
-	result = dns_name_fromtext(keyname, namebuf, dns_rootname, 0);
+	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}
 
-	result = dns_tsigkey_create(keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -902,6 +897,7 @@ failure:
 	}
 
 	isc_mem_free(mctx, secretstore);
+	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 }
 
@@ -1942,7 +1938,6 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain);
-				lookup->edns = lookup->original_edns;
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2086,8 +2081,8 @@ insert_soa(dig_lookup_t *lookup) {
 	soa.common.rdclass = lookup->rdclass;
 	soa.common.rdtype = dns_rdatatype_soa;
 
-	dns_name_init(&soa.origin);
-	dns_name_init(&soa.contact);
+	dns_name_init(&soa.origin, NULL);
+	dns_name_init(&soa.contact, NULL);
 
 	dns_name_clone(dns_rootname, &soa.origin);
 	dns_name_clone(dns_rootname, &soa.contact);
@@ -2210,6 +2205,11 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	dns_message_gettempname(lookup->sendmsg, &lookup->name);
 
+	isc_buffer_init(&lookup->namebuf, lookup->name_space,
+			sizeof(lookup->name_space));
+	isc_buffer_init(&lookup->onamebuf, lookup->oname_space,
+			sizeof(lookup->oname_space));
+
 	/*
 	 * We cannot convert `textname' and `origin' separately.
 	 * `textname' doesn't contain TLD, but local mapping needs
@@ -2257,7 +2257,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		len = (unsigned int)strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
-		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0,
+					   &lookup->onamebuf);
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg, &lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
@@ -2275,12 +2276,12 @@ setup_lookup(dig_lookup_t *lookup) {
 			len = (unsigned int)strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(name, &b, NULL, 0);
+			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
 			if (result == ISC_R_SUCCESS) {
 				if (!dns_name_isabsolute(name)) {
 					result = dns_name_concatenate(
 						name, lookup->oname,
-						lookup->name);
+						lookup->name, &lookup->namebuf);
 				} else {
 					dns_name_copy(name, lookup->name);
 				}
@@ -2308,7 +2309,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
-						   dns_rootname, 0);
+						   dns_rootname, 0,
+						   &lookup->namebuf);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
@@ -2461,8 +2463,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
 		}
 		if (lookup->edns < 0) {
-			lookup->original_edns = lookup->edns =
-				DEFAULT_EDNS_VERSION;
+			lookup->edns = DEFAULT_EDNS_VERSION;
 		}
 
 		if (lookup->nsid) {
@@ -2592,14 +2593,6 @@ setup_lookup(dig_lookup_t *lookup) {
 			i++;
 		}
 
-		if (lookup->zoneversion) {
-			INSIST(i < MAXOPTS);
-			opts[i].code = DNS_OPT_ZONEVERSION;
-			opts[i].length = 0;
-			opts[i].value = NULL;
-			i++;
-		}
-
 		if (lookup->ednsoptscnt != 0) {
 			INSIST(i + lookup->ednsoptscnt <= MAXOPTS);
 			memmove(&opts[i], lookup->ednsopts,
@@ -4314,11 +4307,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
 	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg)
 	{
-		if (l->showbadvers) {
-			dighost_printmessage(query, &b, msg, true);
-			dighost_received(isc_buffer_usedlength(&b), &peer,
-					 query);
-		}
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */

bin/dig/dighost.h

@@ -104,8 +104,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -117,11 +118,11 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
-		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,				  /*% dig +trace */
+		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
+		tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,			/*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
-		ttlunits, use_usec, waiting_connect, zflag, zoneversion;
+		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -131,6 +132,8 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
+	isc_buffer_t namebuf;
+	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -148,7 +151,6 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
-	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;

bin/dig/host.c

@@ -21,7 +21,6 @@
 
 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -29,7 +28,6 @@
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -82,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };
 
 static char *
@@ -221,7 +218,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}
 
-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);
 
 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
@@ -246,7 +243,8 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (dns_rdatatype_isaddr(rdataset->type) ||
+			       (rdataset->type == dns_rdatatype_a ||
+				rdataset->type == dns_rdatatype_aaaa ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -459,16 +457,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}
 
 	if (!short_form) {

bin/dig/host.rst

@@ -122,7 +122,7 @@ Options
    CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
 
    When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
    records. If the :option:`-C` option is given, queries are made for SOA
    records. If ``name`` is a dotted-decimal IPv4 address or
    colon-delimited IPv6 address, :program:`host` queries for PTR records.

bin/dig/nslookup.c

@@ -20,7 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -30,7 +30,6 @@
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>

bin/dnssec/Makefile.am

@@ -41,14 +41,6 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)
 
-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)

bin/dnssec/dnssec-cds.c

@@ -29,7 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -45,7 +44,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -178,7 +176,7 @@ initname(char *setname) {
 
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -1075,7 +1073,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }
 

bin/dnssec/dnssec-dsfromkey.c

@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -35,7 +34,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -67,7 +65,7 @@ initname(char *setname) {
 
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	return result;
 }
 
@@ -543,7 +541,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {

bin/dnssec/dnssec-importkey.c

@@ -20,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -33,7 +32,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -69,7 +67,7 @@ initname(char *setname) {
 
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	return result;
 }
 
@@ -456,7 +454,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {

bin/dnssec/dnssec-keyfromlabel.c

@@ -21,7 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -32,7 +31,6 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -367,7 +365,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -746,7 +744,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	if (freeit != NULL) {
 		free(freeit);

bin/dnssec/dnssec-keygen.c

@@ -38,8 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
-#include <isc/lib.h>
+#include <isc/fips.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -51,13 +50,17 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"
 
 const char *program = "dnssec-keygen";
@@ -146,7 +149,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -154,7 +157,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -272,7 +275,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -283,7 +286,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}
 
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -336,7 +339,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -496,7 +499,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -842,6 +845,10 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1100,9 +1107,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1129,11 +1134,32 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}
 
@@ -1280,8 +1306,16 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

bin/dnssec/dnssec-ksr.c

@@ -18,9 +18,8 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 
 #include <dns/callbacks.h>
@@ -28,7 +27,6 @@
 #include <dns/fixedname.h>
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -362,7 +360,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -1008,7 +1006,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	dname = dns_fixedname_initname(&dfname);
 	isc_buffer_init(&b, owner, strlen(owner));
 	isc_buffer_add(&b, strlen(owner));
-	ret = dns_name_fromtext(dname, &b, dns_rootname, 0);
+	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
 		return ret;
 	}
@@ -1348,6 +1346,10 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1367,9 +1369,7 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1423,18 +1423,37 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}
 
 	setup_logging();
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, argv[1], strlen(argv[1]));
 	isc_buffer_add(&buf, strlen(argv[1]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("invalid zone name %s: %s", argv[1],
 		      isc_result_totext(ret));

bin/dnssec/dnssec-revoke.c

@@ -23,14 +23,12 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 
 #include <dst/dst.h>
 
@@ -248,7 +246,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/dnssec/dnssec-settime.c

@@ -25,7 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -34,7 +33,6 @@
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 
 #include <dst/dst.h>
 
@@ -949,7 +947,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/dnssec/dnssec-signzone.c

@@ -42,9 +42,9 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -71,7 +71,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -89,6 +88,10 @@
 #include <dns/zoneverify.h>
 
 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include "dnssectool.h"
 
@@ -547,7 +550,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);
 
 		key = keythatsigned(&rrsig);
-		offline = (key != NULL) ? key->pubkey : false;
+		offline = key->pubkey;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
 		expired = isc_serial_gt(now, rrsig.timeexpire);
 		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
@@ -954,7 +957,7 @@ addnowildcardhash(hashlist_t *l,
 
 	wild = dns_fixedname_initname(&fixed);
 
-	result = dns_name_concatenate(dns_wildcardname, name, wild);
+	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -2029,7 +2032,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);
 
-	dns_name_downcase(name, name);
+	dns_name_downcase(name, name, NULL);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2397,7 +2400,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name);
+		dns_name_downcase(name, name, NULL);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2407,7 +2410,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname);
+		dns_name_downcase(nextname, nextname, NULL);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2574,7 +2577,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);
 
 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -3375,6 +3378,10 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
@@ -3663,9 +3670,7 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 
 		case '?':
@@ -3736,6 +3741,27 @@ main(int argc, char *argv[]) {
 
 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	setup_logging();
 
 	argc -= isc_commandline_index;
@@ -4107,6 +4133,15 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
 	if (printstats) {

bin/dnssec/dnssec-verify.c

@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -44,7 +43,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -105,7 +103,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);
 
 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -330,7 +328,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return result == ISC_R_SUCCESS ? 0 : 1;
 }

bin/named/bind9.xsl

@@ -931,7 +931,6 @@
                   <th>Messages Received</th>
                   <th>Records Received</th>
                   <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                 </tr>
               </thead>
               <tbody>
@@ -960,7 +959,6 @@
                     <td><xsl:value-of select="nmsg"/></td>
                     <td><xsl:value-of select="nrecs"/></td>
                     <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                   </tr>
                 </xsl:for-each>
               </tbody>

bin/named/builtin.c

@@ -459,7 +459,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 
 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->length == 0) {
+	if (name->labels == 0 && name->length == 0) {
 		return bdb->lookup(node);
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
 		return dns64_cname(&bdb->common.origin, name, node);
@@ -839,7 +839,7 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);
 
-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	name = &relname;
 
 	result = createnode(bdb, &node);
@@ -881,7 +881,7 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);
 
 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;
 
@@ -1197,8 +1197,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 
 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin);
-	dns_name_dup(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin, NULL);
+	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);
 
 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {

bin/named/config.c

@@ -99,7 +99,6 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
-	request-zoneversion false;\n\
 	resolver-query-timeout 10;\n\
 #	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
@@ -112,8 +111,6 @@ options {\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
 	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -235,12 +232,10 @@ options {\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
-	provide-zoneversion yes;\n\
 	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
@@ -262,7 +257,6 @@ view \"_bind\" chaos {\n\
 	notify no;\n\
 	allow-new-zones no;\n\
 	max-cache-size 2M;\n\
-	provide-zoneversion no;\n\
 \n\
 	# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
 	rate-limit {\n\
@@ -554,14 +548,14 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	}
 
 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep);
+	dns_name_init(*namep, NULL);
 
 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0);
+				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;

bin/named/controlconf.c

@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>
 
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>
 
 #include <isccfg/check.h>
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };
 
 static isc_result_t
@@ -736,6 +736,7 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
+		newstr = NULL;
 	}
 }
 
@@ -1335,6 +1336,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));
 
 	*controls = (named_controls_t){
@@ -1345,9 +1347,14 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 
+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return result;
+	}
 	*ctrlsp = controls;
 	return ISC_R_SUCCESS;
 }
@@ -1361,7 +1368,7 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));

bin/named/fuzz.c

@@ -25,6 +25,7 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>

bin/named/include/named/globals.h

@@ -86,6 +86,7 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
  * Logging.
  */
+EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);
 
 /*

bin/named/log.c

@@ -52,6 +52,8 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();
 
+	named_g_logging = true;
+
 	return ISC_R_SUCCESS;
 
 cleanup:

bin/named/main.c

@@ -30,9 +30,9 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -47,7 +47,6 @@
 
 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -90,6 +89,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -129,7 +132,6 @@ static int maxudp = 0;
 /*
  * -T options:
  */
-static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -151,13 +153,24 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }
 
@@ -166,10 +179,18 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 
 	_exit(EXIT_FAILURE);
@@ -186,19 +207,26 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */
 
-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}
 
 	if (named_g_coreok) {
 		abort();
@@ -217,20 +245,27 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
 
-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 
 	if (named_g_coreok) {
 		abort();
@@ -250,11 +285,19 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }
 
 static void
@@ -653,9 +696,7 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "cookiealwaysvalid")) {
-		cookiealwaysvalid = true;
-	} else if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -909,7 +950,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -1223,9 +1282,6 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
-	if (cookiealwaysvalid) {
-		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
-	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1516,6 +1572,15 @@ main(int argc, char *argv[]) {
 
 	named_os_shutdown();
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

bin/named/server.c

@@ -38,6 +38,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
@@ -663,7 +664,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		str = cfg_obj_asstring(nameobj);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
+		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		result = dns_nametree_add(*ntp, name, true);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(nameobj, ISC_LOG_ERROR,
@@ -723,7 +724,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_constinit(&namebuf, namestr, strlen(namestr));
 	isc_buffer_add(&namebuf, strlen(namestr));
-	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0));
+	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL));
 
 	if (*initialp) {
 		atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
@@ -912,7 +913,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		isc_buffer_constinit(&b, namestr, strlen(namestr));
 		isc_buffer_add(&b, strlen(namestr));
 		keyname = dns_fixedname_initname(&fkeyname);
-		result = dns_name_fromtext(keyname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			return result;
 		}
@@ -1305,7 +1306,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	isc_buffer_add(&b, strlen(str));
 	dns_fixedname_init(&fixed);
 	result = dns_name_fromtext(dns_fixedname_name(&fixed), &b, dns_rootname,
-				   0);
+				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -1391,13 +1392,6 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
 	}
 
-	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-zoneversion", &obj);
-	if (obj != NULL) {
-		CHECK(dns_peer_setrequestzoneversion(peer,
-						     cfg_obj_asboolean(obj)));
-	}
-
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "send-cookie", &obj);
 	if (obj != NULL) {
@@ -1597,7 +1591,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 
 	algorithms = cfg_tuple_get(disabled, "algorithms");
 	for (element = cfg_list_first(algorithms); element != NULL;
@@ -1640,7 +1634,7 @@ disable_ds_digests(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 
 	digests = cfg_tuple_get(disabled, "digests");
 	for (element = cfg_list_first(digests); element != NULL;
@@ -1684,7 +1678,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 		str = cfg_obj_asstring(value);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(name, &b, dns_rootname, 0);
+		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (dns_name_equal(name, zonename)) {
 			return true;
@@ -1867,7 +1861,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	name = dns_fixedname_initname(&fixed);
 	isc_buffer_constinit(&b, reverse, strlen(reverse));
 	isc_buffer_add(&b, strlen(reverse));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 	dns_zone_create(&zone, mctx, 0);
 	dns_zone_setorigin(zone, name);
 	dns_zone_setview(zone, view);
@@ -2751,7 +2745,7 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 	dns_name_t origin;
 	dns_catz_options_t *opts;
 
-	dns_name_init(&origin);
+	dns_name_init(&origin, NULL);
 	catz_obj = cfg_listelt_value(element);
 
 	str = cfg_obj_asstring(cfg_tuple_get(catz_obj, "zone name"));
@@ -3094,7 +3088,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ns.common.rdtype = dns_rdatatype_ns;
 	ns.common.rdclass = dns_db_class(db);
 	ns.mctx = NULL;
-	dns_name_init(&ns.name);
+	dns_name_init(&ns.name, NULL);
 	dns_name_clone(nsname, &ns.name);
 	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
 				   &ns, &b));
@@ -3253,7 +3247,6 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 
 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
-	dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION, false);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setautomatic(zone, true);
@@ -3770,7 +3763,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t maxbits;
 	unsigned int resopts = 0;
 	dns_zone_t *zone = NULL;
-	uint32_t clients_per_query, max_clients_per_query;
+	uint32_t max_clients_per_query;
 	bool empty_zones_enable;
 	const cfg_obj_t *disablelist = NULL;
 	isc_stats_t *resstats = NULL;
@@ -4710,19 +4703,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	dns_view_settransports(view, transports);
 	dns_transport_list_detach(&transports);
 
-	/*
-	 * Configure SIG(0) check limits when matching a DNS message to a view.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "sig0key-checks-limit", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->sig0key_checks_limit = cfg_obj_asuint32(obj);
-
-	obj = NULL;
-	result = named_config_get(maps, "sig0message-checks-limit", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->sig0message_checks_limit = cfg_obj_asuint32(obj);
-
 	/*
 	 * Configure the view's TSIG keys.
 	 */
@@ -5140,11 +5120,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->requestnsid = cfg_obj_asboolean(obj);
 
-	obj = NULL;
-	result = named_config_get(maps, "request-zoneversion", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->requestzoneversion = cfg_obj_asboolean(obj);
-
 	obj = NULL;
 	result = named_config_get(maps, "send-cookie", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -5181,26 +5156,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->v6bias = cfg_obj_asuint32(obj) * 1000;
 
-	obj = NULL;
-	result = named_config_get(maps, "clients-per-query", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	clients_per_query = cfg_obj_asuint32(obj);
-
 	obj = NULL;
 	result = named_config_get(maps, "max-clients-per-query", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	max_clients_per_query = cfg_obj_asuint32(obj);
 
-	if (max_clients_per_query < clients_per_query) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "configured clients-per-query (%u) exceeds "
-			    "max-clients-per-query (%u); automatically "
-			    "adjusting max-clients-per-query to (%u)",
-			    clients_per_query, max_clients_per_query,
-			    clients_per_query);
-		max_clients_per_query = clients_per_query;
-	}
-	dns_resolver_setclientsperquery(view->resolver, clients_per_query,
+	obj = NULL;
+	result = named_config_get(maps, "clients-per-query", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
 					max_clients_per_query);
 
 	/*
@@ -5899,8 +5863,8 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			name = dns_fixedname_initname(&fixed);
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname,
-						0));
+			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
+						NULL));
 
 			portobj = cfg_tuple_get(alternate, "port");
 			if (cfg_obj_isuint32(portobj)) {
@@ -5955,7 +5919,7 @@ validate_tls(const cfg_obj_t *config, dns_view_t *view, const cfg_obj_t *obj,
 
 	if (name != NULL && *name == NULL) {
 		*name = isc_mem_get(view->mctx, sizeof(dns_name_t));
-		dns_name_init(*name);
+		dns_name_init(*name, NULL);
 		dns_name_dup(nm, view->mctx, *name);
 	}
 
@@ -6255,7 +6219,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	isc_buffer_add(&buffer, strlen(zname));
 	dns_fixedname_init(&fixorigin);
 	CHECK(dns_name_fromtext(dns_fixedname_name(&fixorigin), &buffer,
-				dns_rootname, 0));
+				dns_rootname, 0, NULL));
 	origin = dns_fixedname_name(&fixorigin);
 
 	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"),
@@ -7266,7 +7230,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 	isc_buffer_constinit(&buffer, keynamestr, strlen(keynamestr));
 	isc_buffer_add(&buffer, strlen(keynamestr));
 	keyname = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0);
+	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -7318,7 +7282,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		INSIST(server->session_keybits == 0);
 
 		server->session_keyname = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(server->session_keyname);
+		dns_name_init(server->session_keyname, NULL);
 		dns_name_dup(keyname, mctx, server->session_keyname);
 
 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);
@@ -7824,7 +7788,8 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 	isc_buffer_constinit(&b, zonename, strlen(zonename));
 	isc_buffer_add(&b, strlen(zonename));
 	name = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE,
+				NULL));
 	dns_name_format(name, zname, sizeof(zname));
 
 	key.mv_data = zname;
@@ -7934,7 +7899,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Shut down all dyndb instances.
 	 */
-	dns_dyndb_cleanup();
+	dns_dyndb_cleanup(false);
 
 	/*
 	 * Parse the global default pseudo-config file.
@@ -9400,7 +9365,7 @@ view_loaded(void *arg) {
 
 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_NOTICE, "FIPS mode is %s",
-			      isc_crypto_fips_mode() ? "enabled" : "disabled");
+			      isc_fips_mode() ? "enabled" : "disabled");
 
 #if HAVE_LIBSYSTEMD
 		sd_notifyf(0,
@@ -9613,7 +9578,7 @@ shutdown_server(void *arg) {
 	/*
 	 * Shut down all dyndb instances.
 	 */
-	dns_dyndb_cleanup();
+	dns_dyndb_cleanup(true);
 
 	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
 		ISC_LIST_UNLINK(server->cachelist, nsc, link);
@@ -11855,7 +11820,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	isc_buffer_constinit(&b, target, strlen(target));
 	isc_buffer_add(&b, strlen(target));
 	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -12563,7 +12528,7 @@ nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
 	dns_fixedname_t fixed;
 
 	dns_fixedname_init(&fixed);
-	dns_name_downcase(name, dns_fixedname_name(&fixed));
+	dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);
 	dns_name_format(dns_fixedname_name(&fixed), namebuf, buflen);
 
 	key->mv_data = namebuf;
@@ -12965,7 +12930,7 @@ load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
 		isc_buffer_add(&b, strlen(origin));
 		name = dns_fixedname_initname(&fname);
 		CHECK(dns_name_fromtext(name, &b, dns_rootname,
-					DNS_NAME_DOWNCASE));
+					DNS_NAME_DOWNCASE, NULL));
 		dns_name_format(name, zname, sizeof(zname));
 
 		key.mv_data = zname;
@@ -13674,7 +13639,7 @@ named_server_changezone(named_server_t *server, char *command,
 	isc_buffer_add(&buf, strlen(zonename));
 
 	dnsname = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0));
+	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL));
 
 	if (redirect) {
 		if (!dns_name_equal(dnsname, dns_rootname)) {
@@ -15240,7 +15205,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		isc_buffer_t b;
 		isc_buffer_init(&b, namebuf, strlen(namebuf));
 		isc_buffer_add(&b, strlen(namebuf));
-		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0));
+		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0, NULL));
 		ntaname = fname;
 	}
 

bin/named/statschannel.c

@@ -97,7 +97,7 @@ typedef struct stats_dumparg {
 	isc_result_t result;
 } stats_dumparg_t;
 
-static isc_once_t once = ISC_ONCE_INITIALIZER;
+static isc_once_t once = ISC_ONCE_INIT;
 
 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
@@ -358,8 +358,6 @@ init_desc(void) {
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
 		       "KeepAliveOpt");
-	SET_NSSTATDESC(zoneversionopt, "ZONEVERSION option received",
-		       "ZoneVersionOpt");
 	SET_NSSTATDESC(padopt, "EDNS padding option received", "PadOpt");
 	SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
 	SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");
@@ -1490,7 +1488,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;
 
 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -1605,7 +1602,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -1619,13 +1616,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -1708,7 +1701,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));
 
 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1719,9 +1712,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
-	TRY0(xmlTextWriterEndElement(writer));
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -2569,7 +2559,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;
 
 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -2662,7 +2651,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -2677,15 +2666,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -2772,7 +2756,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}
 
 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2782,10 +2766,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
-	json_object_object_add(xfrinobj, "rate",
-			       json_object_new_int64(rate > INT64_MAX
-							     ? INT64_MAX
-							     : (int64_t)rate));
 
 	if (is_running && is_first_data_received) {
 		json_object_object_add(

bin/named/tkeyconf.c

@@ -62,9 +62,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tctx->domain);
+		dns_name_init(tctx->domain, NULL);
 		dns_name_dup(name, mctx, tctx->domain);
 	}
 
@@ -76,7 +76,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
 	}
 

bin/named/transportconf.c

@@ -27,16 +27,17 @@
 #include <named/log.h>
 #include <named/transportconf.h>
 
-#define create_name(id, name)                                     \
-	isc_buffer_t namesrc;                                     \
-	dns_fixedname_t _fn;                                      \
-	name = dns_fixedname_initname(&_fn);                      \
-	isc_buffer_constinit(&namesrc, id, strlen(id));           \
-	isc_buffer_add(&namesrc, strlen(id));                     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname, \
-				    DNS_NAME_DOWNCASE));          \
-	if (result != ISC_R_SUCCESS) {                            \
-		goto failure;                                     \
+#define create_name(id, name)                                      \
+	isc_buffer_t namesrc, namebuf;                             \
+	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
+	dns_name_init(name, NULL);                                 \
+	isc_buffer_constinit(&namesrc, id, strlen(id));            \
+	isc_buffer_add(&namesrc, strlen(id));                      \
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
+				    DNS_NAME_DOWNCASE, &namebuf)); \
+	if (result != ISC_R_SUCCESS) {                             \
+		goto failure;                                      \
 	}
 
 #define parse_transport_option(map, transport, name, setter)      \
@@ -99,15 +100,15 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *dohname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t dohname;
+		dns_transport_t *transport;
 
 		doh = cfg_listelt_value(element);
 		dohid = cfg_obj_asstring(cfg_map_getname(doh));
 
-		create_name(dohid, dohname);
+		create_name(dohid, &dohname);
 
-		transport = dns_transport_new(dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
 					      list);
 
 		dns_transport_set_tlsname(transport, dohid);
@@ -147,8 +148,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *tlsname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t tlsname;
+		dns_transport_t *transport;
 
 		tls = cfg_listelt_value(element);
 		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
@@ -158,9 +159,10 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 			goto failure;
 		}
 
-		create_name(tlsid, tlsname);
+		create_name(tlsid, &tlsname);
 
-		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      list);
 
 		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
@@ -220,12 +222,12 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
-	dns_name_t *tlsname = NULL;
+	dns_name_t tlsname;
 	dns_transport_t *transport;
 
-	create_name("ephemeral", tlsname);
+	create_name("ephemeral", &tlsname);
 
-	transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
 	dns_transport_set_tlsname(transport, "ephemeral");
 
 	return;

bin/named/tsigconf.c

@@ -46,11 +46,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	{
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
-		dns_fixedname_t fkey;
-		dns_name_t *keyname = dns_fixedname_initname(&fkey);
+		dns_name_t keyname;
 		dst_algorithm_t alg = DST_ALG_UNKNOWN;
 		const char *algstr = NULL;
-		isc_buffer_t keynamesrc;
+		char keynamedata[1024];
+		isc_buffer_t keynamesrc, keynamebuf;
 		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
 		int secretlen = 0;
@@ -68,10 +68,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		/*
 		 * Create the key name.
 		 */
+		dns_name_init(&keyname, NULL);
 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
-		ret = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
-					DNS_NAME_DOWNCASE);
+		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
+		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
+					DNS_NAME_DOWNCASE, &keynamebuf);
 		if (ret != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -101,7 +103,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);
 
-		ret = dns_tsigkey_create(keyname, alg, secret, secretlen, mctx,
+		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;

bin/named/zoneconf.c

@@ -253,7 +253,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0);
+					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -283,7 +283,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
-						   &b, dns_rootname, 0);
+						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
@@ -518,7 +518,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(nsname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
@@ -633,7 +633,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 */
 	CHECK(dns_db_newversion(db, &dbversion));
 
-	dns_name_init(&apexname);
+	dns_name_init(&apexname, NULL);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));
 
@@ -1227,12 +1227,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkasp(zone, NULL);
 		}
 
-		obj = NULL;
-		result = named_config_get(maps, "provide-zoneversion", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION,
-				   cfg_obj_asboolean(obj));
-
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1285,22 +1279,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1880,33 +1874,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
 
-		obj = NULL;
-		result = named_config_get(maps, "min-transfer-rate-in", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		uint32_t traffic_bytes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
-		uint32_t time_minutes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
-		if (traffic_bytes == 0) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' bytes"
-				    "value can not be '0'",
-				    zname);
-			CHECK(ISC_R_FAILURE);
-		}
-		/* Max. 28 days (in minutes). */
-		const unsigned int time_minutes_max = 28 * 24 * 60;
-		if (time_minutes < 1 || time_minutes > time_minutes_max) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' minutes"
-				    "value is out of range (1..%u)",
-				    zname, time_minutes_max);
-			CHECK(ISC_R_FAILURE);
-		}
-		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
-					 transferinsecs ? time_minutes
-							: time_minutes * 60);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1944,12 +1911,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource4(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource6(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);

bin/nsupdate/nsupdate.c

@@ -30,7 +30,6 @@
 #include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -53,7 +52,6 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -523,7 +521,8 @@ setup_keystr(void) {
 	isc_buffer_add(&keynamesrc, (unsigned int)(n - name));
 
 	debug("namefromtext");
-	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0);
+	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0,
+				   NULL);
 	check_result(result, "dns_name_fromtext");
 
 	secretlen = strlen(secretstr) * 3 / 4;
@@ -785,14 +784,16 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 }
 
 static isc_result_t
-create_name(const char *str, dns_name_t *name) {
-	isc_buffer_t namesrc;
+create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
+	isc_buffer_t namesrc, namebuf;
 
+	dns_name_init(name, NULL);
 	isc_buffer_constinit(&namesrc, str, strlen(str));
 	isc_buffer_add(&namesrc, strlen(str));
+	isc_buffer_init(&namebuf, namedata, len);
 
 	return dns_name_fromtext(name, &namesrc, dns_rootname,
-				 DNS_NAME_DOWNCASE);
+				 DNS_NAME_DOWNCASE, &namebuf);
 }
 
 static void
@@ -802,8 +803,8 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
-	dns_fixedname_t ftls;
-	dns_name_t *tlsname = dns_fixedname_initname(&ftls);
+	dns_name_t tlsname;
+	char namedata[DNS_NAME_FORMATSIZE + 1];
 
 	ddebug("setup_system()");
 
@@ -937,15 +938,17 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);
 
 	if (tls_client_key_file == NULL) {
-		result = create_name("tls-non-auth-client", tlsname);
+		result = create_name("tls-non-auth-client", namedata,
+				     sizeof(namedata), &tlsname);
 		check_result(result, "create_name (tls-non-auth-client)");
-		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-non-auth-client");
 	} else {
-		result = create_name("tls-auth-client", tlsname);
+		result = create_name("tls-auth-client", namedata,
+				     sizeof(namedata), &tlsname);
 		check_result(result, "create_name (tls-auth-client)");
-		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-auth-client");
 		dns_transport_set_keyfile(transport, tls_client_key_file);
@@ -1304,7 +1307,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	dns_message_gettempname(msg, namep);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
-	result = dns_name_fromtext(*namep, &source, dns_rootname, 0);
+	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
@@ -1730,7 +1733,7 @@ evaluate_key(char *cmdline) {
 
 	isc_buffer_init(&b, namestr, strlen(namestr));
 	isc_buffer_add(&b, strlen(namestr));
-	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0);
+	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
 		return STATUS_SYNTAX;
@@ -1784,7 +1787,7 @@ evaluate_zone(char *cmdline) {
 	userzone = dns_fixedname_initname(&fuserzone);
 	isc_buffer_init(&b, word, strlen(word));
 	isc_buffer_add(&b, strlen(word));
-	result = dns_name_fromtext(userzone, &b, dns_rootname, 0);
+	result = dns_name_fromtext(userzone, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
@@ -2609,8 +2612,8 @@ done:
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_primary, gmctx);
-		dns_name_init(&tmpzonename);
-		dns_name_init(&restart_primary);
+		dns_name_init(&tmpzonename, 0);
+		dns_name_init(&restart_primary, 0);
 	}
 	done_update();
 }
@@ -2876,7 +2879,7 @@ lookforsoa:
 	result = dns_rdata_tostruct(&soarr, &soa, NULL);
 	check_result(result, "dns_rdata_tostruct");
 
-	dns_name_init(&primary);
+	dns_name_init(&primary, NULL);
 	dns_name_clone(&soa.origin, &primary);
 
 	if (userzone != NULL) {
@@ -2932,9 +2935,9 @@ lookforsoa:
 
 #if HAVE_GSSAPI
 	if (usegsstsig) {
-		dns_name_init(&tmpzonename);
+		dns_name_init(&tmpzonename, NULL);
 		dns_name_dup(zname, gmctx, &tmpzonename);
-		dns_name_init(&restart_primary);
+		dns_name_init(&restart_primary, NULL);
 		dns_name_dup(&primary, gmctx, &restart_primary);
 		start_gssrequest(&primary);
 	} else {
@@ -2963,7 +2966,7 @@ droplabel:
 	if (nlabels == 1) {
 		fatal("could not find enclosing zone");
 	}
-	dns_name_init(&tname);
+	dns_name_init(&tname, NULL);
 	dns_name_getlabelsequence(name, 1, nlabels - 1, &tname);
 	dns_name_clone(&tname, name);
 	dns_request_destroy(&request);
@@ -3070,8 +3073,8 @@ failed_gssrequest(void) {
 
 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_primary, gmctx);
-	dns_name_init(&tmpzonename);
-	dns_name_init(&restart_primary);
+	dns_name_init(&tmpzonename, NULL);
+	dns_name_init(&restart_primary, NULL);
 
 	done_update();
 }
@@ -3118,7 +3121,7 @@ start_gssrequest(dns_name_t *primary) {
 	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(servname) failed: %s",
 		      isc_result_totext(result));
@@ -3135,7 +3138,7 @@ start_gssrequest(dns_name_t *primary) {
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));
 	isc_buffer_add(&buf, strlen(mykeystr));
 
-	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(keyname) failed: %s",
 		      isc_result_totext(result));
@@ -3294,7 +3297,7 @@ recvgss(void *arg) {
 	servname = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
 	check_result(result, "dns_name_fromtext");
 
 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,

bin/rndc/rndc.c

@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -37,7 +36,6 @@
 #include <isc/thread.h>
 #include <isc/util.h>
 
-#include <dns/lib.h>
 #include <dns/name.h>
 
 #include <isccc/alist.h>

bin/tests/system/chain/ns7/named.conf.in

@@ -28,7 +28,6 @@ options {
 	} except-from {
 		"example";
 	};
-	qname-minimization disabled;  // Regression test for GL #4652
 };
 
 trust-anchors { };

bin/tests/system/checkconf/good-server-christmas-tree.conf.in

@@ -31,7 +31,6 @@ server 0.0.0.0 {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
-	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -56,7 +55,6 @@ server :: {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
-	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;

bin/tests/system/checkzone/tests.sh

@@ -44,10 +44,6 @@ for db in zones/bad*.db; do
     zones/bad-dns-sd-reverse.db | zones/bad-svcb-servername.db)
       $CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db >test.out.$n 2>&1 || v=$?
       ;;
-    bad-cname-and*.db)
-      $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
-      grep "CNAME and other data" test.out.$n >/dev/null || ret=1
-      ;;
     *)
       $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
       ;;
@@ -131,13 +127,11 @@ status=$((status + ret))
 echo_i "checking that log-report-channel zones fail if '*._er/TXT' is missing ($n)"
 ret=0
 $CHECKZONE -R fail example zones/er.db >test.out2.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out2.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
 $CHECKZONE example zones/er-missing.db >test.out3.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out3.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
 $CHECKZONE -R fail example zones/er-missing.db >test.out4.$n 2>&1 && ret=1
 grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 echo_i "checking that raw zone with bad class is handled ($n)"

bin/tests/system/checkzone/zones/bad-cname-and-a.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		A	192.0.2.1
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-a6.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A6	0 ::1
-bad		WKS	10.0.0.1 tcp telnet ftp 0 1 2
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-aaaa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AAAA	::1
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-afsdb.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		BAD	65535 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-apl.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		APL
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-atma.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMA	+61200000000
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-atmrelay.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMRELAY	0 0 0
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-avc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AVC	foo:bar
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-caa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CAA	128 tbs "Unknown"
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cdnskey.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cds.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-cert.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CERT	65534 65535 254 (
-			MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
-			kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
-			VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-csync.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CSYNC	0 0 A NS AAAA
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dhcid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DHCID	AAIBY2/AuCccgoJbsaxcQc9TUapptP69l OjxfNuVAA2kjEA=
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dlv.db

@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DLV	30795 1 1 (
-			310D27F4D82C1FC2400704EA9939FE6E1CEA
-			A3B9 )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-dname.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DNAME	@
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-doa.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EID	12 89 AB
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eui48.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI48	01-23-45-67-89-ab
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-eui64.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI64	01-23-45-67-89-ab-cd-ef
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-gpos.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		GPOS	-22.6882 116.8652 250.0
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-hinfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HINFO	. .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-hip.db

@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HIP	( 2 200100107B1A74DF365639CC39F1D578
-			AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
-			rvs.example.com. )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-https.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HTTPS	0 example.net.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ipseckey.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		IPSECKEY	10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-isdn.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ISDN	isdn-address
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-kx.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		KX	10 kcd
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-l32.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		L32	10 1.2.3.4
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-l64.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		L64	10 0014:4fff:ff20:ee64
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-loc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		LOC	60 9 N 24 39 E 10 20 2000 20
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-lp.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		LP	10 example.net.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-md.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MD	madname
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-mg.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MG	mgmname
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-minfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MINFO	. .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-mx.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		MX	10 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-naptr.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NAPTR	0 0 "" "" "" .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nid.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NID	10 0014:4fff:ff20:ee64
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nimloc.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NIMLOC	12 89 AB
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ninfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NINFO	"foo"
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ns-soa.db

@@ -1,16 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-@		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nsap-ptr.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NSAP-PTR	.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-nsap.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		NSAP	0x47.0005.80.005a00.0000.0001.e133.ffffff000161.00
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-opengpgkey.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		OPENGPGKEY	( AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-ptr.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		PTR	.
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-px.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		PX	65535 . .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-resinfo.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		RESINFO	qnamemin exterr=15,16,17 infourl=https://resolver.example.com/guide
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-rkey.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		RKEY	0 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-rp.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		RP	. .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-rt.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		RT	65535 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-sink.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		SINK	8 0 2 l4ik
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-smimea.db

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		SMIMES	( 1 1 2 92003ba34942dc74152e2f2c408d29ec
-			a5a520e7f2e06bb944f4dca346baf63c
-			1b177615d466f6c4b71c216a50292bd5
-			8c9ebdd2f74e38fe51ffd48c43326cbc )
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-spf.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		SPF	"v=spf1 -all"
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-srv.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		SRV	0 0 0 .
-bad		CNAME	@

bin/tests/system/checkzone/zones/bad-cname-and-sshfp.db

@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
-bad		CNAME	@