fixup! WIP: Rewrite qpcache to use cds_lfht

WIP: Rewrite qpcache to use cds_lfht
fix: dev: Fix adbname reference
2025-03-21 01:56:48 +01:00 · 2025-03-21 01:56:03 +01:00 · 2025-03-21 00:26:25 +00:00 · 2025-03-20 23:25:29 +00:00 · 2025-03-20 18:25:05 +00:00 · 2025-03-20 18:22:58 +00:00
33 changed files with 1703 additions and 982 deletions
@@ -131,11 +131,13 @@ status=$((status + ret))
 echo_i "checking that log-report-channel zones fail if '*._er/TXT' is missing ($n)"
 ret=0
 $CHECKZONE -R fail example zones/er.db >test.out2.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out2.$n >/dev/null && ret=1
 $CHECKZONE example zones/er-missing.db >test.out3.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out3.$n >/dev/null && ret=1
 $CHECKZONE -R fail example zones/er-missing.db >test.out4.$n 2>&1 && ret=1
 grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 echo_i "checking that raw zone with bad class is handled ($n)"
@@ -2191,7 +2191,7 @@ echo_i "checking RRSIG query from cache ($n)"
 ret=0
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a >/dev/null || ret=1
 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1
-expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^\(A\|NSEC\)') || ret=1
+expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep -E '^(A|NSEC)') || ret=1
 test "$ans" = "$expect" || ret=1
 # also check that RA is set
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig >dig.out.ns4.test$n || ret=1
@@ -130,7 +130,7 @@ $KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone >keygen.out.$zone.2 2>&1
 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
 KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -f KSK -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zone -M 32768:65535 2>keygen.out.$zone.2)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.2)
 cat "${KSK}.key" | grep -v ";.*" >>"${zone}.db"
 cat "${ZSK}.key" | grep -v ";.*" >>"${zone}.db"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
@@ -350,10 +350,9 @@ setup step2.enable-dnssec.autosign
 TpubN="now-900s"
 # RRSIG TTL:              12 hour (43200 seconds)
 # zone-propagation-delay: 5 minutes (300 seconds)
-# retire-safety:          20 minutes (1200 seconds)
 # Already passed time:    -900 seconds
-# Total:                  43800 seconds
-TsbmN="now+43800s"
+# Total:                  42600 seconds
+TsbmN="now+42600s"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
 CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2>keygen.out.$zone.1)
 $SETTIME -s -g $O -k $R $TpubN -r $R $TpubN -d $H $TpubN -z $R $TpubN "$CSK" >settime.out.$zone.1 2>&1
@@ -365,10 +364,10 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $i
 # Step 3:
 # The zone signatures have been published long enough to become OMNIPRESENT.
 setup step3.enable-dnssec.autosign
-# Passed time since publications: 43800 + 900 = 44700 seconds.
-TpubN="now-44700s"
+# Passed time since publications: 42600 + 900 = 43500 seconds.
+TpubN="now-43500s"
 # The key is secure for using in chain of trust when the DNSKEY is OMNIPRESENT.
-TcotN="now-43800s"
+TcotN="now-42600s"
 # We can submit the DS now.
 TsbmN="now"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
@@ -127,9 +127,9 @@ setup step2.algorithm-roll.kasp
 # The time passed since the new algorithm keys have been introduced is 3 hours.
 TactN="now-3h"
 TpubN1="now-3h"
-# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp + publish-safety =
-# now - 3h + 6h + 1h + 1h = now + 5h
-TsbmN1="now+5h"
+# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp =
+# now - 3h + 6h + 1h = now + 4h
+TsbmN1="now+4h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I now"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I now"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -156,11 +156,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TsbmN1="now-1h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TsbmN1="now"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -188,11 +188,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TsbmN1="now-30h"
-TactN1="now-29h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TsbmN1="now-29h"
+TactN1="now-27h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -220,12 +220,12 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TsbmN1="now-32h"
-TactN1="now-31h"
+TpubN1="now-38h"
+TsbmN1="now-31h"
+TactN1="now-29h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -253,13 +253,13 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TremN="now-7h"
-TpubN1="now-47h"
-TsbmN1="now-39h"
-TactN1="now-38h"
-TdeaN="now-9h"
+TpubN1="now-45h"
+TsbmN1="now-38h"
+TactN1="now-36h"
+TdeaN="now-7h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -324,11 +324,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.csk-algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TactN1="now-6h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TactN1="now-3h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $csktimes $zone 2>keygen.out.$zone.1)
@@ -347,10 +347,10 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.csk-algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TactN1="now-35h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TactN1="now-33h"
 TsubN1="now-29h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -370,11 +370,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.csk-algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TactN1="now-37h"
+TpubN1="now-38h"
+TactN1="now-35h"
 TsubN1="now-31h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -394,12 +394,12 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.csk-algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TdeaN="now-9h"
 TremN="now-7h"
-TpubN1="now-47h"
-TactN1="now-44h"
+TpubN1="now-45h"
+TactN1="now-42h"
 TsubN1="now-38h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -275,9 +275,8 @@ set_keytimes_csk_policy() {
  set_keytime "KEY1" "ACTIVE" "${created}"
  # The DS can be published if the DNSKEY and RRSIG records are
  # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 86700
  # Key lifetime is unlimited, so not setting RETIRED and REMOVED.
 }

@@ -769,9 +768,8 @@ set_keytimes_algorithm_policy() {

  # The DS can be published if the DNSKEY and RRSIG records are
  # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
  # Key lifetime is 10 years, 315360000 seconds.
  set_addkeytime "KEY1" "RETIRED" "${published}" 315360000
  # The key is removed after the retire time plus DS TTL (1d),
@@ -1720,10 +1718,10 @@ published=$(awk '{print $3}' <published.test${n}.key1)
 set_keytime "KEY1" "PUBLISHED" "${published}"
 set_keytime "KEY1" "ACTIVE" "${published}"
 published=$(key_get KEY1 PUBLISHED)
-# The DS can be published if the DNSKEY and RRSIG records are OMNIPRESENT.
-#  This happens after max-zone-ttl (1d) plus publish-safety (1h) plus
-# zone-propagation-delay (300s) = 86400 + 3600 + 300 = 90300.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+# The DS can be published if the zone is fully signed.
+# This happens after max-zone-ttl (1d) plus
+# zone-propagation-delay (300s) = 86400 + 300 = 86700.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
 # Key lifetime is 6 months, 315360000 seconds.
 set_addkeytime "KEY1" "RETIRED" "${published}" 16070400
 # The key is removed after the retire time plus DS TTL (1d), parent
@@ -2486,9 +2484,9 @@ set_keytime "KEY1" "PUBLISHED" "${created}"
 set_keytime "KEY1" "ACTIVE" "${created}"
 # - The DS can be published if the DNSKEY and RRSIG records are
 #   OMNIPRESENT.  This happens after max-zone-ttl (12h) plus
-#   publish-safety (5m) plus zone-propagation-delay (5m) =
-#   43200 + 300 + 300 = 43800.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+#   plus zone-propagation-delay (5m) =
+#   43200 + 300 = 43500.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43500
 # - Key lifetime is unlimited, so not setting RETIRED and REMOVED.

 # Various signing policy checks.
@@ -2556,7 +2554,7 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 created=$(key_get KEY1 CREATED)
 set_addkeytime "KEY1" "PUBLISHED" "${created}" -900
 set_addkeytime "KEY1" "ACTIVE" "${created}" -900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 42600

 # Continue signing policy checks.
 check_keytimes
@@ -2566,8 +2564,8 @@ dnssec_verify

 # Next key event is when the zone signatures become OMNIPRESENT: max-zone-ttl
 # plus zone propagation delay plus retire safety minus the already elapsed
-# 900 seconds: 12h + 300s + 20m - 900 = 44700 - 900 = 43800 seconds
-check_next_key_event 43800
+# 900 seconds: 12h + 300s + 20m - 900 = 43500 - 900 = 42600 seconds
+check_next_key_event 42600

 #
 # Zone: step3.enable-dnssec.autosign.
@@ -2584,10 +2582,10 @@ check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The key was published and activated 44700 seconds ago (with settime).
+# - The key was published and activated 43500 seconds ago (with settime).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED" "${created}" -44700
-set_addkeytime "KEY1" "ACTIVE" "${created}" -44700
+set_addkeytime "KEY1" "PUBLISHED" "${created}" -43500
+set_addkeytime "KEY1" "ACTIVE" "${created}" -43500
 set_keytime "KEY1" "SYNCPUBLISH" "${created}"

 # Continue signing policy checks.
@@ -2603,8 +2601,8 @@ check_cdslog "$DIR" "$ZONE" KEY1
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "published" "$ZONE"
 # Next key event is when the DS can move to the OMNIPRESENT state.  This occurs
 # when the parent propagation delay have passed, plus the DS TTL and retire
-# safety delay:  1h + 2h + 20m = 3h20m = 12000 seconds
-check_next_key_event 12000
+# safety delay:  1h + 2h = 3h = 10800 seconds
+check_next_key_event 10800

 #
 # Zone: step4.enable-dnssec.autosign.
@@ -4388,9 +4386,9 @@ check_subdomain
 dnssec_verify

 # Next key event is when the DS becomes HIDDEN. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# parent propagation delay, and DS TTL:
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000

 #
 # Zone: step2.going-insecure.kasp
@@ -4456,8 +4454,8 @@ dnssec_verify

 # Next key event is when the DS becomes HIDDEN. This happens after the
 # parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000

 #
 # Zone: step2.going-insecure-dynamic.kasp
@@ -4651,12 +4649,11 @@ set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 created=$(key_get KEY3 CREATED)
 set_keytime "KEY3" "PUBLISHED" "${created}"
 set_keytime "KEY3" "ACTIVE" "${created}"
-# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
+# - It takes TTLsig + Dprp to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
 # - The new ZSK is published and activated.
 created=$(key_get KEY4 CREATED)
@@ -4725,12 +4722,12 @@ dnssec_verify

 # Next key event is when all zone signatures are signed with the new
 # algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
+# 6h + 1h.  But three hours have already passed (the time it took to
+# make the DNSKEY omnipresent), so the next event should be scheduled
+# in 4 hour: 14400 seconds.  Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time

 #
@@ -4753,28 +4750,28 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY3

 # Set expected key times:
-# - The old keys were activated 9 hours ago (32400 seconds).
-rollover_predecessor_keytimes -32400
-# - And retired 6 hours ago (21600 seconds).
+# - The old keys were activated 7 hours ago (25200 seconds).
+rollover_predecessor_keytimes -25200
+# - And retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -21600
+set_addkeytime "KEY2" "RETIRED" "${created}" -10800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
-# - The new keys are published 9 hours ago.
+# - The new keys are published 7 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY3" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY3" "ACTIVE" "${created}" -25200
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY4" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY4" "ACTIVE" "${created}" -25200

 # Continue signing policy checks.
 check_keytimes
@@ -4787,9 +4784,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY3 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800

 #
 # Zone: step4.algorithm-roll.kasp
@@ -4816,29 +4813,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 38 hours ago (136800 seconds).
-rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -126000
+set_addkeytime "KEY2" "RETIRED" "${created}" -118800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

-# - The new keys are published 38 hours ago.
+# - The new keys are published 36 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY3" "ACTIVE" "${created}" -129600
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY4" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY4" "ACTIVE" "${created}" -129600

 # Continue signing policy checks.
 check_keytimes
@@ -4867,29 +4864,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 40 hours ago (144000 seconds)
-rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old keys were activated 38 hours ago (136800 seconds)
+rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -133200
+set_addkeytime "KEY2" "RETIRED" "${created}" -126000
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

 # The new keys are published 40 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY3" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY4" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY4" "ACTIVE" "${created}" -136800

 # Continue signing policy checks.
 check_keytimes
@@ -4898,12 +4895,12 @@ check_subdomain
 dnssec_verify

 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds. Prevent intermittent
+# after the max-zone-ttl plus zone propagation delay (6h + 1h)
+# minus the time already passed since the UNRETENTIVE state has
+# been reached (2h): 7h - 2h = 5h = 18000 seconds. Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time

 #
@@ -4921,29 +4918,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -158400
+set_addkeytime "KEY2" "RETIRED" "${created}" -151200
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

 # The new keys are published 47 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY3" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY3" "ACTIVE" "${created}" -162000
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY4" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY4" "ACTIVE" "${created}" -162000

 # Continue signing policy checks.
 check_keytimes
@@ -5026,9 +5023,8 @@ set_keytime "KEY2" "ACTIVE" "${created}"
 # - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" "${Ipub}"

 # Continue signing policy checks.
@@ -5082,14 +5078,13 @@ check_apex
 check_subdomain
 dnssec_verify

-# Next key event is when all zone signatures are signed with the new
-# algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+# Next key event is when all zone signatures are signed with the new algorithm.
+# This is the max-zone-ttl plus zone propagation delay: 6h + 1h.  But three
+# hours have already passed (the time it took to make the DNSKEY omnipresent),
+# so the next event should be scheduled in 4 hour: 14400 seconds.  Prevent
+# intermittent false positives on slow platforms by subtracting the number of
+# seconds which passed between key creation and invoking 'rndc reconfig'.
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time

 #
@@ -5114,17 +5109,17 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY2

 # Set expected key times:
-# - The old key was activated 9 hours ago (32400 seconds).
-csk_rollover_predecessor_keytimes -32400
-# - And was retired 6 hours ago (21600 seconds).
+# - The old key was activated 7 hours ago (25200 seconds).
+csk_rollover_predecessor_keytimes -25200
+# - And was retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 9 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY2" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY2" "ACTIVE" "${created}" -25200
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" "${Ipub}"

@@ -5138,9 +5133,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800

 #
 # Zone: step4.csk-algorithm-roll.kasp
@@ -5164,17 +5159,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old key was activated 38 hours ago (136800 seconds)
-csk_rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+csk_rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 38 hours ago.
+# - The new key was published 36 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY2" "ACTIVE" "${created}" -129600
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -5204,17 +5199,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old key was activated 40 hours ago (144000 seconds)
-csk_rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old key was activated 38 hours ago (136800 seconds)
+csk_rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 40 hours ago.
+# - The new key was published 38 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY2" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -5225,12 +5220,12 @@ check_subdomain
 dnssec_verify

 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+# after the max-zone-ttl plus zone propagation delay (6h + 1h) minus the
+# time already passed since the UNRETENTIVE state has been reached (2h):
+# 7h - 2h = 5h = 18000 seconds.  Prevent intermittent false positives on slow
+# platforms by subtracting the number of seconds which passed between key
+# creation and invoking 'rndc reconfig'.
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time

 #
@@ -5248,17 +5243,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-csk_rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+csk_rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 47 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY2" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY2" "ACTIVE" "${created}" -162000
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -43,6 +43,12 @@ grep "status: NOERROR" dig.out.ns1.test${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+rndccmd 10.53.0.1 stats || ret=1 # Get the responses, RTT and timeout statistics before the following timeout tests
+grep -F 'responses received' ns1/named.stats >ns1/named.stats.responses-before || true
+grep -F 'queries with RTT' ns1/named.stats >ns1/named.stats.rtt-before || true
+grep -F 'query timeouts' ns1/named.stats >ns1/named.stats.timeouts-before || true
+mv ns1/named.stats ns1/named.stats-before
+
 # 'resolver-query-timeout' is set to 5 seconds in ns1, so dig with a lower
 # timeout value should give up earlier than that.
 n=$((n + 1))
@@ -66,6 +72,20 @@ grep -F "EDE: 22 (No Reachable Authority)" dig.out.ns1.test${n} >/dev/null || re
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "checking that the timeout didn't skew the resolver responses counters and did update the timeout counter ($n)"
+ret=0
+rndccmd 10.53.0.1 stats || ret=1
+grep -F 'responses received' ns1/named.stats >ns1/named.stats.responses-after || true
+grep -F 'queries with RTT' ns1/named.stats >ns1/named.stats.rtt-after || true
+grep -F 'query timeouts' ns1/named.stats >ns1/named.stats.timeouts-after || true
+mv ns1/named.stats ns1/named.stats-after
+diff ns1/named.stats.responses-before ns1/named.stats.responses-after >/dev/null || ret=1
+diff ns1/named.stats.rtt-before ns1/named.stats.rtt-after >/dev/null || ret=1
+diff ns1/named.stats.timeouts-before ns1/named.stats.timeouts-after >/dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 # 'resolver-query-timeout' is set to 5 seconds in ns1, so named should
 # interrupt the non-responsive query and send a SERVFAIL answer before dig's
 # own timeout fires, which is set to 7 seconds. This time, exampleudp.net is
@@ -21,6 +21,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "nextpart.out.*",
        "ans*/ans.run",
        "ans*/query.log",
+        "ns1/named.stats*",
        "ns4/tld.db",
        "ns5/trusted.conf",
        "ns6/K*",
@@ -18,6 +18,7 @@ Changelog
   development. Regular users should refer to :ref:`Release Notes <relnotes>`
   for changes relevant to them.

+.. include:: ../changelog/changelog-9.21.6.rst
 .. include:: ../changelog/changelog-9.21.5.rst
 .. include:: ../changelog/changelog-9.21.4.rst
 .. include:: ../changelog/changelog-9.21.3.rst
@@ -47,6 +47,7 @@ The list of known issues affecting the latest version in the 9.21 branch can be
 found at
 https://gitlab.isc.org/isc-projects/bind9/-/wikis/Known-Issues-in-BIND-9.21

+.. include:: ../notes/notes-9.21.6.rst
 .. include:: ../notes/notes-9.21.5.rst
 .. include:: ../notes/notes-9.21.4.rst
 .. include:: ../notes/notes-9.21.3.rst
@@ -0,0 +1,478 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+BIND 9.21.6
+-----------
+
+New Features
+~~~~~~~~~~~~
+
+- Implement the min-transfer-rate-in configuration option.
+  ``a282f1ba3f``
+
+  A new option 'min-transfer-rate-in <bytes> <minutes>' has been added
+  to the view and zone configurations. It can abort incoming zone
+  transfers which run very slowly due to network related issues, for
+  example. The default value is set to 10240 bytes in 5 minutes.
+  :gl:`#3914` :gl:`!9098`
+
+- Add digest methods for SIG and RRSIG. ``fd48df20f3``
+
+  ZONEMD digests RRSIG records and potentially digests SIG record. Add
+  digests methods for both record types. :gl:`#5219` :gl:`!10217`
+
+- Add HTTPS record query to host command line tool. ``d34414c47b``
+
+  The host command was extended to also query for the HTTPS RR type by
+  default. :gl:`!8642`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- Clean up unnecessary code in qpcache. ``74c9ff384e``
+
+  Removed some code from the cache database implementation that was left
+  over from before it and the zone database implementation were
+  separated. :gl:`!9991`
+
+- Cleanup isc/util.h header and friends. ``239712df16``
+
+  Cleanup short list macros from <isc/util.h>, remove two unused
+  headers, move locking macros to respective headers and use only the
+  C11 static assertion. :gl:`!10196`
+
+- Remove check for the mandatory IPv6 support. ``daa9c17905``
+
+  IPv6 Advanced Socket API (:rfc:`3542`) is a hard requirement, remove
+  the autoconf check to speed up the ./configure run a little bit.
+  :gl:`!10201`
+
+- Remove log initialization checks from named. ``1b3e7f52ec``
+
+  Logging initialization check is now redundant as there is a default
+  global log context created during libisc's constructor.
+
+  `isc_log` calls can safely be made at any time outside libisc's
+  constructor. :gl:`!10186`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Refactor and simplify isc_symtab. ``5559539eb0``
+
+  This commit does several changes to isc_symtab:
+
+  1. Rewrite the isc_symtab to internally use isc_hashmap instead of
+  hand-stiched hashtable.
+
+  2. Create a new isc_symtab_define_and_return() api, which returns
+  the already defined symvalue on ISC_R_EXISTS; this allows users    of
+  the API to skip the isc_symtab_lookup()+isc_symtab_define()    calls
+  and directly call isc_symtab_define_and_return().
+
+  3. Merge isccc_symtab into isc_symtab - the only missing function
+  was isccc_symtab_foreach() that was merged into isc_symtab API.
+
+  4. Add full set of unit tests for the isc_symtab API. :gl:`#5103`
+  :gl:`!9921`
+
+- Drop malformed notify messages early instead of decompressing them.
+  ``7fce7707db``
+
+  The DNS header shows if a message has multiple questions or invalid
+  NOTIFY sections. We can drop these messages early, right after parsing
+  the question. This matches RFC 9619 for multi-question messages and
+  Unbound's handling of NOTIFY. We still parse the question to include
+  it in our FORMERR response.
+
+  Add drop_msg_early() function to check for these conditions: -
+  Messages with more than one question, as required by RFC 9619 - NOTIFY
+  query messages containing answer sections (like Unbound) - NOTIFY
+  messages containing authority sections (like Unbound) :gl:`#5158`,
+  #3656 :gl:`!10056`
+
+- Cleanup parts of the isc_mem API. ``4ba1ccfa2e``
+
+  This MR changes custom attach/detach implementation with refcount
+  macros, replaces isc_mem_destroy() with isc_mem_detach(), and does
+  various small cleanups. :gl:`!9456`
+
+- Move the library initialization and shutdown to executables.
+  ``6e0c1f151c``
+
+  Instead of relying on unreliable order of execution of the library
+  constructors and destructors, move them to individual binaries.  The
+  advantage is that the execution time and order will remain constant
+  and will not depend on the dynamic load dependency solver.
+  :gl:`!10069`
+
+- Reduce memory used to store DNS names. ``24db1b1a8a``
+
+  The memory used to internally store the DNS names has been reduced.
+  :gl:`!10140`
+
+- Unify fips handling to isc_crypto and make the toggle one way.
+  ``3de629d6b7``
+
+  Since algorithm fetching is handled purely in libisc, FIPS mode
+  toggling can be purely done in within the library instead of provider
+  fetching in the binary for OpenSSL >=3.0.
+
+  Disabling FIPS mode isn't a realistic requirement and isn't done
+  anywhere in the codebase. Make the FIPS mode toggle enable-only to
+  reflect the situation. :gl:`!9920`
+
+Bug Fixes
+~~~~~~~~~
+
+- Prevent a reference leak when using plugins. ``5604d3a44e``
+
+  The `NS_QUERY_DONE_BEGIN` and `NS_QUERY_DONE_SEND` plugin hooks could
+  cause a reference leak if they returned `NS_HOOK_RETURN` without
+  cleaning up the query context properly. :gl:`#2094` :gl:`!9971`
+
+- Fix isc_quota bug. ``742d379d88``
+
+  Running jobs which were entered into the isc_quota queue is the
+  responsibility of the isc_quota_release() function, which, when
+  releasing a previously acquired quota, checks whether the queue is
+  empty, and if it's not, it runs a job from the queue without touching
+  the 'quota->used' counter. This mechanism is susceptible to a possible
+  hangup of a newly queued job in case when between the time a decision
+  has been made to queue it (because used >= max) and the time it was
+  actually queued, the last quota was released. Since there is no more
+  quotas to be released (unless arriving in the future), the newly
+  entered job will be stuck in the queue.
+
+  Fix the issue by adding checks in both isc_quota_release() and
+  isc_quota_acquire_cb() to make sure that the described hangup does not
+  happen. Also see code comments. :gl:`#4965` :gl:`!10082`
+
+- Fix dual-stack-servers configuration option. ``6af708f3b0``
+
+  The dual-stack-servers configuration option was not working as
+  expected; the specified servers were not being used when they should
+  have been, leading to resolution failures. This has been fixed.
+  :gl:`#5019` :gl:`!9708`
+
+- Implement sig0key-checks-limit and sig0message-checks-limit.
+  ``d78ebff861``
+
+  Previously a hard-coded limitation of maximum two key or message
+  verification checks were introduced when checking the message's SIG(0)
+  signature. It was done in order to protect against possible DoS
+  attacks. The logic behind choosing the number 2 was that more than a
+  single key should only be required during key rotations, and in that
+  case two keys are enough. But later it became apparent that there are
+  other use cases too where even more keys are required, see issue
+  number #5050 in GitLab.
+
+  This change introduces two new configuration options for the views,
+  `sig0key-checks-limit` and `sig0message-checks-limit`, which define
+  how many keys are allowed to be checked to find a matching key, and
+  how many message verifications are allowed to take place once a
+  matching key has been found. The latter protects against expensive
+  cryptographic operations when there are keys with colliding tags and
+  algorithm numbers, with default being 2, and the former protects
+  against a bit less expensive key parsing operations and defaults to
+  16. :gl:`#5050` :gl:`!9967`
+
+- Fix the data race causing a permanent active client increase.
+  ``479c366c2b``
+
+  Previously, a data race could cause a newly created fetch context for
+  a new client to be used before it had been fully initialized, which
+  would cause the query to become stuck; queries for the same data would
+  be either paused indefinitely or dropped because of the
+  `clients-per-query` limit. This has been fixed. :gl:`#5053`
+  :gl:`!10146`
+
+- Fix deferred validation of unsigned DS and DNSKEY records.
+  ``ebf1606f38``
+
+  When processing a query with the "checking disabled" bit set (CD=1),
+  `named` stores the unvalidated result in the cache, marked "pending".
+  When the same query is sent with CD=0, the cached data is validated,
+  and either accepted as an answer, or ejected from the cache as
+  invalid. This deferred validation was not attempted for DS and DNSKEY
+  records if they had no cached signatures, causing spurious validation
+  failures. We now complete the deferred validation in this scenario.
+
+  Also, if deferred validation fails, we now re-query the data to find
+  out whether the zone has been corrected since the invalid data was
+  cached. :gl:`#5066` :gl:`!10104`
+
+- When recording an rr trace, use libtool. ``6320586df0``
+
+  When a system test is run with the `USE_RR` environment variable set
+  to 1, an `rr` trace is now correctly generated for each instance of
+  `named`. :gl:`#5079` :gl:`!10197`
+
+- Do not cache signatures for rejected data. ``fc3a4d6f89``
+
+  The cache has been updated so that if new data is rejected - for
+  example, because there was already existing data at a higher trust
+  level - then its covering RRSIG will also be rejected. :gl:`#5132`
+  :gl:`!9999`
+
+- Fix wrong logging severity in do_nsfetch() ``1f6a16e6d0``
+
+  ISC_LOG_WARNING was used while ISC_LOG_DEBUG(3) was implied.
+  :gl:`#5145` :gl:`!10017`
+
+- Fix RPZ race condition during a reconfiguration. ``5ba811bea2``
+
+  With RPZ in use, `named` could terminate unexpectedly because of a
+  race condition when a reconfiguration command was received using
+  `rndc`. This has been fixed. :gl:`#5146` :gl:`!10079`
+
+- "CNAME and other data check" not applied to all types. ``b694acbe45``
+
+  An incorrect optimization caused "CNAME and other data" errors not to
+  be detected if certain types were at the same node as a CNAME.  This
+  has been fixed. :gl:`#5150` :gl:`!10033`
+
+- Use named Service Parameter Keys (SvcParamKeys) by default.
+  ``3f61a87be3``
+
+  When converting SVCB records to text representation `named` now uses
+  named `SvcParamKeys` values unless backward-compatible mode is
+  activated, in which case the values which were not defined initially
+  in RFC9460 and were added later (see [1]) are converted to opaque
+  "keyNNNN" syntax, like, for example, "key7" instead of "dohpath".
+
+  Also a new `+[no]svcparamkeycompat` option is implemented for `dig`,
+  which enables the backward-compatible mode and uses the opaque syntax,
+  if required for interoperability with other software or scripts. By
+  default, the compatibility mode is disabled.
+
+  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
+  :gl:`#5156` :gl:`!10085`
+
+- Relax private DNSKEY and RRSIG constraints. ``1bc7016d7a``
+
+  DNSKEY, KEY, RRSIG and SIG constraints have been relaxed to allow
+  empty key and signature material after the algorithm identifier for
+  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
+  the expected use of these types as no key material is shared and the
+  signatures are ineffective but these are private algorithms and they
+  can be totally insecure. :gl:`#5167` :gl:`!10083`
+
+- Delete dead nodes when committing a new version. ``67255da4b3``
+
+  In the qpzone implementation of `dns_db_closeversion()`, if there are
+  changed nodes that have no remaining data, delete them. :gl:`#5169`
+  :gl:`!10089`
+
+- Revert "Delete dead nodes when committing a new version"
+  ``b652d5327c``
+
+  This reverts commit 67255da4b376f65138b299dcd5eb6a3b7f9735a9,
+  reversing changes made to 74c9ff384e695d1b27fa365d1fee84576f869d4c.
+  :gl:`#5169` :gl:`!10224`
+
+- Fix dns_qp_insert() checks in qpzone. ``d6b63210a8``
+
+  Remove code in the QP zone database to handle failures of
+  `dns_qp_insert()` which can't actually happen. :gl:`#5171`
+  :gl:`!10088`
+
+- Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse.
+  ``f0785fedf1``
+
+  Previously, when parsing responses, named incorrectly rejected
+  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
+  the authority section. This rejection, if appropriate, should have
+  been left for the validator to determine and has been fixed.
+  :gl:`#5185` :gl:`!10125`
+
+- Fix TTL issue with ANY queries processed through RPZ "passthru"
+  ``23c1fbc609``
+
+  Answers to an "ANY" query which were processed by the RPZ "passthru"
+  policy had the response-policy's `max-policy-ttl` value unexpectedly
+  applied. This has been fixed. :gl:`#5187` :gl:`!10176`
+
+- Save time when creating a slab from another slab. ``cf981ab13b``
+
+  The `dns_rdataslab_fromrdataset()` function creates a slab from an
+  rdataset. If the source rdataset already uses a slab, then no
+  processing is necessary; we can just copy the existing slab to a new
+  location. :gl:`#5188` :gl:`!10162`
+
+- Dnssec-signzone needs to check for a NULL key when setting offline.
+  ``26f8ee7229``
+
+  dnssec-signzone could dereference a NULL key pointer when resigning a
+  zone.  This has been fixed. :gl:`#5192` :gl:`!10161`
+
+- Acquire the database reference before possibly last node release.
+  ``c4868b5bd9``
+
+  Acquire the database reference in the detachnode() to prevent the last
+  reference to be release while the NODE_LOCK being locked.  The
+  NODE_LOCK is locked/unlocked inside the RCU critical section, thus it
+  is most probably this should not pose a problem as the database uses
+  call_rcu memory reclamation, but this it is still safer to acquire the
+  reference before releasing the node. :gl:`#5194` :gl:`!10155`
+
+- Fix a logic error in cache_name() ``02ef8ff01c``
+
+  A change in 6aba56ae8 (checking whether a rejected RRset was identical
+  to the data it would have replaced, so that we could still cache a
+  signature) inadvertently introduced cases where processing of a
+  response would continue when previously it would have been skipped.
+  :gl:`#5197` :gl:`!10157`
+
+- Fix a bug in the statistics channel when querying zone transfers
+  information. ``e02d73e7e3``
+
+  When querying zone transfers information from the statistics channel
+  there was a rare possibility that `named` could terminate unexpectedly
+  if a zone transfer was in a state when transferring from all the
+  available primary servers had failed earlier. This has been fixed.
+  :gl:`#5198` :gl:`!10182`
+
+- Fix assertion failure when dumping recursing clients. ``796b662b92``
+
+  Previously, if a new counter was added to the hashtable while dumping
+  recursing clients via the `rndc recursing` command, and
+  `fetches-per-zone` was enabled, an assertion failure could occur. This
+  has been fixed. :gl:`#5200` :gl:`!10164`
+
+- Validating ADB fetches could cause a crash in import_rdataset()
+  ``49ccbe857a``
+
+  Previously, in some cases, the resolver could return rdatasets of type
+  CNAME or DNAME without the result code being set to `DNS_R_CNAME` or
+  `DNS_R_DNAME`. This could trigger an assertion failure in the ADB. The
+  resolver error has been fixed. :gl:`#5201` :gl:`!10172`
+
+- Call isc__iterated_hash_initialize in isc__work_cb. ``f3458fdf43``
+
+  isc_iterated_hash didn't work in offloaded threads as the per thread
+  initialisation has not been done.  This has been fixed. :gl:`#5214`
+  :gl:`!10206`
+
+- Fix a bug in get_request_transport_type() ``db5166ab99``
+
+  When `dns_remote_done()` is true, calling `dns_remote_curraddr()`
+  asserts. Add a `dns_remote_curraddr()` check before calling
+  `dns_remote_curraddr()`. :gl:`#5215` :gl:`!10222`
+
+- Clean up dns_rdataslab module. ``948f8d7a98``
+
+  Rdata slabs used in the QP databases are usually prepended with a slab
+  header, but are sometimes "raw", containing only the rdata and no
+  header. Previously, to allow for them to be used both ways, functions
+  that operated on them took a `reservelen` argument, which would be set
+  to either the header length or to zero, and skipped over that many
+  bytes at the beginning of the buffer. Most such functions were never
+  used on the raw form. To make the code clearer, each of these
+  functions now operates on full slabs with headers, and an alternate
+  "raw" version of the function has been added in cases where that was
+  needed.
+
+  In addition, the `dns_rdataslab_merge()` and `_subtract()` functions
+  have been rewritten for clarity and efficiency, and a minor bug has
+  been fixed in `dns_rdataslab_equal()` and `_equalx()`, which could
+  cause an incorrect result if both slabs being compared had zero
+  length. :gl:`!10084`
+
+- Dump the active resolver fetches from dns_resolver_dumpfetches()
+  ``5d0c347e75``
+
+  Previously, active resolver fetches were only dumped when the
+  `fetches-per-zone` configuration option was enabled. Now, active
+  resolver fetches are dumped along with the number of
+  `clients-per-server` counters per resolver fetch. :gl:`!10107`
+
+- Fix the foundname vs dcname madness in qpcache_findzonecut()
+  ``4e68dbf194``
+
+  The qpcache_findzonecut() accepts two "foundnames": 'foundname' and
+  'dcname' could be NULL.  Originally, when 'dcname' would be NULL, the
+  'dcname' would be set to 'foundname' which basically means that we
+  were copying the .ndata over itself for no apparent reason.
+  :gl:`!10049`
+
+- Post [CVE-2024-12705] Performance Drop Fixes, Part 2. ``c8104daf8d``
+
+  This merge request addresses several key performance bottlenecks in
+  the DoH (DNS over HTTPS) implementation by introducing significant
+  optimizations and improvements.
+
+  ### Key Improvements
+
+  1. **Simplification and Optimisation of `http_do_bio()` Function**:
+  - The code flow in the `http_do_bio()` function has been significantly
+  simplified. 2. **Flushing HTTP Write Buffer on Outgoing DNS
+  Messages**:    - The buffer is flushed and a send operation is
+  performed when there is an outgoing DNS message. 3. **Bumping Active
+  Streams Processing Limit**:    - The total number of active streams
+  has been increased to 60% of the total streams limit.
+
+  These changes collectively enhance the performance and reliability of
+  the DoH implementation, making it more efficient and robust for
+  handling high-load scenarios, particularly noticeable in long runs (>=
+  1h) of `stress:long:rpz:doh+udp:linux:*` tests. It improves perf. for
+  tests for BIND 9.18, but it likely will have a positive but less
+  pronounced effect on newer versions as well.
+
+  In essence, the merge request fixes three bottlenecks stacked upon
+  each other.
+
+  *It is a logical continuation of the merge requests !10109.* !10109,
+  unfortunately, did not completely [address the performance drop in
+  9.18](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/221545)
+  for longer runs of the stress test. This merge request [addresses
+  that](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/223661).
+
+  **P.S.**
+
+  The origin of the fixes is, in fact, the branch in !10193. So this MR
+  is a ... *forward port* of them. :gl:`!10192`
+
+- Post [CVE-2024-12705] Performance Drop Fixes. ``3033d127d2``
+
+  This merge request fixes a [performance
+  drop](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/216728)
+  after merging the fixes for #4795, in particular in 9.18.
+
+  The MR [fixes the
+  problem](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/219825)
+  without affecting performance for the newer versions, in particular
+  for [the development version](https://gitlab.isc.org/isc-projects/bind
+  9/-/pipelines/220619). :gl:`!10109`
+
+- Remove 'target' from dns_adb. ``764eb65cf6``
+
+  When a server name turns out to be a CNAME or DNAME, the ADB does not
+  use it, but the `dns_adbname` structure still stored a copy of the
+  target name. This is unnecessary and the code has been removed.
+  :gl:`!10149`
+
+- Simplify some dns_name API calls. ``e16560a650``
+
+  Several functions in the `dns_name` module have had parameters
+  removed, that were rarely or never used: - `dns_name_fromtext()` and
+  `dns_name_concatenate()` no longer take a target buffer. -
+  `dns_name_towire()` no longer takes a compression offset pointer; this
+  is now part of the compression context. - `dns_name_towire()` with a
+  `NULL` compression context will copy name data directly into a buffer
+  with no processing. :gl:`!10152`
+
+- Sync the TSAN CC, CFLAGS and LDFLAGS in the respdiff:tsan job.
+  ``22b5442722``
+
+  :gl:`!10209`
+
+
@@ -0,0 +1,186 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.21.6
+---------------------
+
+New Features
+~~~~~~~~~~~~
+
+- Implement the :any:`min-transfer-rate-in` configuration option.
+
+  A new option :any:`min-transfer-rate-in` has been added
+  to the view and zone configurations. It can abort incoming zone
+  transfers that run very slowly due to network-related issues, for
+  example. The default value is 10240 bytes in five minutes.
+  :gl:`#3914`
+
+- Add HTTPS record query to :iscman:`host` command line tool.
+
+  The :iscman:`host` command was extended to also query for the HTTPS RR
+  type by default.
+
+- Implement :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`.
+
+  Previously, a hard-coded limitation of a maximum of two key or message
+  verification checks was introduced when checking a message's ``SIG(0)``
+  signature, to protect against possible DoS
+  attacks. Two as a maximum was chosen so that more than a
+  single key should only be required during key rotations, and in that
+  case two keys are enough. It later became apparent that there are
+  other use cases where even more keys are required; see the related GitLab issue for examples.
+
+  This change introduces two new configuration options for the views:
+  :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`. They define
+  how many keys can be checked to find a matching key, and
+  how many message verifications are allowed to take place once a
+  matching key has been found. The former provides
+  slightly less "expensive" key parsing operations and defaults to
+  16. The latter protects against expensive
+  cryptographic operations when there are keys with colliding tags and
+  algorithm numbers; the default is 2. :gl:`#5050`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Drop malformed notify messages early instead of decompressing them.
+
+  The DNS header shows whether a message has multiple questions or invalid
+  NOTIFY sections. :iscman:`named` can now drop these messages early, right after parsing
+  the question, to match :rfc:`9619` for multi-question messages and
+  Unbound's handling of NOTIFY. Questions are still parsed to be included
+  in BIND's FORMERR response.
+
+  Add ``drop_msg_early()`` function to check for these conditions:
+
+    - Messages with more than one question, as required by :rfc:`9619`
+    - NOTIFY query messages containing answer sections (like Unbound)
+
+  :gl:`#5158`
+
+- Reduce memory used to store DNS names.
+
+  The memory used to internally store the DNS names has been reduced
+  by no longer caching certain fields from an internal data structure.
+
+
+Bug Fixes
+~~~~~~~~~
+
+- Fix :any:`dual-stack-servers` configuration option.
+
+  The :any:`dual-stack-servers` configuration option was not working as
+  expected; the specified servers were not being used when they should
+  have been, leading to resolution failures. This has been fixed.
+  :gl:`#5019`
+
+- Fix a data race causing a permanent active client increase.
+
+  Previously, a data race could cause a newly created fetch context for
+  a new client to be used before it had been fully initialized, which
+  would cause the query to become stuck; queries for the same data would
+  be either paused indefinitely or dropped because of the
+  :any:`clients-per-query` limit. This has been fixed. :gl:`#5053`
+
+- Fix deferred validation of unsigned DS and DNSKEY records.
+
+  When processing a query with the "checking disabled" bit set (CD=1),
+  :iscman:`named` stores the invalidated result in the cache, marked "pending".
+  When the same query is sent with CD=0, the cached data is validated
+  and either accepted as an answer, or ejected from the cache as
+  invalid. This deferred validation was not attempted for DS and DNSKEY
+  records if they had no cached signatures, causing spurious validation
+  failures. The deferred validation is now completed in this scenario.
+
+  Also, if deferred validation fails, the data is now re-queried to find
+  out whether the zone has been corrected since the invalid data was
+  cached. :gl:`#5066`
+
+- Fix RPZ race condition during a reconfiguration.
+
+  With RPZ in use, :iscman:`named` could terminate unexpectedly because of a
+  race condition when a reconfiguration command was received using
+  :iscman:`rndc`. This has been fixed. :gl:`#5146`
+
+- "CNAME and other data check" not applied to all types.
+
+  An incorrect optimization caused "CNAME and other data" errors not to
+  be detected if certain types were at the same node as a CNAME.  This
+  has been fixed. :gl:`#5150`
+
+- Use named Service Parameter Keys (``SvcParamKeys``) by default.
+
+  When converting SVCB records to text representation, :iscman:`named` now uses
+  named ``SvcParamKeys`` values unless backward-compatible mode is
+  activated. In that case, values which were not defined initially
+  in :rfc:`9460` and were added later (see [1]) are converted to opaque
+  "keyNNNN" syntax, e.g. "key7" instead of "dohpath".
+
+  Also a new ``+[no]svcparamkeycompat`` option is implemented for :iscman:`dig`,
+  which enables the backward-compatible mode and uses the opaque syntax,
+  if required for interoperability with other software or scripts. By
+  default, the compatibility mode is disabled.
+
+  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
+  :gl:`#5156`
+
+- Relax private DNSKEY and RRSIG constraints.
+
+  DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to allow
+  empty key and signature material after the algorithm identifier for
+  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
+  the expected use of these types, as no key material is shared and the
+  signatures are ineffective, but these are private algorithms and they
+  can be totally insecure. :gl:`#5167`
+
+- Remove NSEC/DS/NSEC3 RRSIG check from ``dns_message_parse()``.
+
+  Previously, when parsing responses, :iscman:`named` incorrectly rejected
+  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
+  the authority section. This rejection, if appropriate, should have
+  been left for the validator to determine and has been fixed.
+  :gl:`#5185`
+
+- Fix TTL issue with ANY queries processed through RPZ "passthru".
+
+  Answers to an "ANY" query which were processed by the RPZ "passthru"
+  policy had the response-policy's ``max-policy-ttl`` value unexpectedly
+  applied. This has been fixed. :gl:`#5187`
+
+- :iscman:`dnssec-signzone` needs to check for a NULL key when setting offline.
+
+  :iscman:`dnssec-signzone` could dereference a NULL key pointer when resigning
+  a zone.  This has been fixed. :gl:`#5192`
+
+- Fix a bug in the statistics channel when querying zone transfer
+  information.
+
+  When querying zone transfer information from the statistics channel,
+  there was a rare possibility that :iscman:`named` could terminate unexpectedly
+  if a zone transfer was in a state when transferring from all the
+  available primary servers had failed earlier. This has been fixed.
+  :gl:`#5198`
+
+- Fix assertion failure when dumping recursing clients.
+
+  Previously, if a new counter was added to the hash table while dumping
+  recursing clients via the :option:`rndc recursing` command, and
+  :any:`fetches-per-zone` was enabled, an assertion failure could occur. This
+  has been fixed. :gl:`#5200`
+
+- Dump the active resolver fetches from ``dns_resolver_dumpfetches()``
+
+  Previously, active resolver fetches were only dumped when the
+  :any:`fetches-per-zone` configuration option was enabled. Now, active
+  resolver fetches are dumped along with the number of
+  :any:`clients-per-query` counters per resolver fetch.
+
+
@@ -136,7 +136,6 @@ libdns_la_HEADERS =			\
 	include/dns/view.h		\
 	include/dns/xfrin.h		\
 	include/dns/zone.h		\
-	include/dns/zonekey.h		\
 	include/dns/zoneverify.h	\
 	include/dns/zt.h

@@ -255,7 +254,6 @@ libdns_la_SOURCES =			\
 	zone.c				\
 	zone_p.h			\
 	zoneverify.c			\
-	zonekey.c			\
 	zt.c

 if HAVE_GSSAPI
@@ -2909,6 +2909,7 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	 * createfetch to find deepest cached name when we're providing
 	 * domain and nameservers.
 	 */
+	dns_adbname_ref(adbname);
 	result = dns_resolver_createfetch(
 		adb->res, adbname->name, type, name, nameservers, NULL, NULL, 0,
 		options, depth, qc, gqc, isc_loop(), fetch_callback, adbname,
@@ -2916,11 +2917,10 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	if (result != ISC_R_SUCCESS) {
 		DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s",
 		   isc_result_totext(result));
+		dns_adbname_unref(adbname);
 		goto cleanup;
 	}

-	dns_adbname_ref(adbname);
-
 	if (type == dns_rdatatype_a) {
 		adbname->fetch_a = fetch;
 		inc_resstats(adb, dns_resstatscounter_gluefetchv4);
@@ -32,6 +32,7 @@
 #define NODE_LOCK(l, t, tp)                                      \
 	{                                                        \
 		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		rcu_read_lock();                                 \
 		RWLOCK((l), (t));                                \
 		*tp = t;                                         \
 	}
@@ -39,6 +40,7 @@
 	{                                                        \
 		STRONG_RWLOCK_CHECK(*tp != isc_rwlocktype_none); \
 		RWUNLOCK(l, *tp);                                \
+		rcu_read_unlock();                               \
 		*tp = isc_rwlocktype_none;                       \
 	}
 #define NODE_RDLOCK(l, tp) NODE_LOCK(l, isc_rwlocktype_read, tp);
@@ -46,10 +48,13 @@
 #define NODE_TRYLOCK(l, t, tp)                                   \
 	({                                                       \
 		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		rcu_read_lock();                                 \
 		isc_result_t _result = isc_rwlock_trylock(l, t); \
 		if (_result == ISC_R_SUCCESS) {                  \
 			*tp = t;                                 \
-		};                                               \
+		} else {                                         \
+			rcu_read_unlock();                       \
+		}                                                \
 		_result;                                         \
 	})
 #define NODE_TRYRDLOCK(l, tp) NODE_TRYLOCK(l, isc_rwlocktype_read, tp)
@@ -1101,6 +1101,41 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 	return false;
 }

+bool
+dns_dnssec_iszonekey(dns_rdata_dnskey_t *key) {
+	return (key->flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	       (key->flags & DNS_KEYTYPE_NOAUTH) == 0 &&
+	       (key->protocol == DNS_KEYPROTO_DNSSEC ||
+		key->protocol == DNS_KEYPROTO_ANY);
+}
+
+bool
+dns_dnssec_haszonekey(dns_rdataset_t *keyset) {
+	isc_result_t result;
+
+	REQUIRE(keyset != NULL);
+
+	if (keyset->type != dns_rdatatype_dnskey) {
+		return false;
+	}
+
+	for (result = dns_rdataset_first(keyset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(keyset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_dnskey_t key;
+
+		dns_rdataset_current(keyset, &rdata);
+		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */
+
+		if (dns_dnssec_iszonekey(&key)) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp) {
@@ -162,8 +162,7 @@ computeid(dst_key_t *key);
 static isc_result_t
 frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	   unsigned int protocol, dns_rdataclass_t rdclass,
-	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-	   dst_key_t **keyp);
+	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);

 static isc_result_t
 algorithm_status(unsigned int alg);
@@ -721,13 +720,6 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
 isc_result_t
 dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
-	return dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp);
-}
-
-isc_result_t
-dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
-		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-		   dst_key_t **keyp) {
 	uint8_t alg, proto;
 	uint32_t flags, extflags;
 	dst_key_t *key = NULL;
@@ -756,7 +748,7 @@ dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
 	}

 	result = frombuffer(name, alg, flags, proto, rdclass, source, mctx,
-			    no_rdata, &key);
+			    &key);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -775,7 +767,7 @@ dst_key_frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	isc_result_t result;

 	result = frombuffer(name, alg, flags, protocol, rdclass, source, mctx,
-			    false, &key);
+			    &key);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -2267,8 +2259,7 @@ computeid(dst_key_t *key) {
 static isc_result_t
 frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	   unsigned int protocol, dns_rdataclass_t rdclass,
-	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-	   dst_key_t **keyp) {
+	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
 	dst_key_t *key;
 	isc_result_t ret;

@@ -2290,12 +2281,10 @@ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 			return DST_R_UNSUPPORTEDALG;
 		}

-		if (!no_rdata) {
-			ret = key->func->fromdns(key, source);
-			if (ret != ISC_R_SUCCESS) {
-				dst_key_free(&key);
-				return ret;
-			}
+		ret = key->func->fromdns(key, source);
+		if (ret != ISC_R_SUCCESS) {
+			dst_key_free(&key);
+			return ret;
 		}
 	}

@@ -242,6 +242,24 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 * rrset.  dns_dnssec_signs() works on any rrset.
 */

+bool
+dns_dnssec_iszonekey(dns_rdata_dnskey_t *key);
+/*%<
+ * Verify that 'key' is a DNSSEC key with the DNS_KEYOWNER_ZONE flag set.
+ *
+ * Requires:
+ *\li		'key' is not NULL.
+ */
+
+bool
+dns_dnssec_haszonekey(dns_rdataset_t *keyset);
+/*%<
+ * Verify that 'keyset' includes at least one zone key.
+ *
+ * Requires:
+ *\li		'keyset' is not NULL.
+ */
+
 void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp);
@@ -43,6 +43,8 @@

 #include <stdbool.h>

+#include <urcu/rculfhash.h>
+
 #include <isc/atomic.h>
 #include <isc/heap.h>
 #include <isc/stdtime.h>
@@ -103,22 +105,31 @@ struct dns_slabheader {
 	 */

 	union {
-		struct dns_slabheader *next;
-		struct dns_slabheader *up;
-	};
-	/*%<
-	 * If this is the top header for an rdataset, 'next' points
-	 * to the top header for the next rdataset (i.e., the next type).
-	 *
-	 * Otherwise 'up' points up to the header whose down pointer points at
-	 * this header.
-	 */
+		struct {
+			struct cds_lfht_node ht_node;
+			struct rcu_head	     rcu_head;
+		};
+		struct {
+			union {
+				struct dns_slabheader *next;
+				struct dns_slabheader *up;
+			};
+			/*%<
+			 * If this is the top header for an rdataset, 'next'
+			 * points to the top header for the next rdataset (i.e.,
+			 * the next type).
+			 *
+			 * Otherwise 'up' points up to the header whose down
+			 * pointer points at this header.
+			 */

-	struct dns_slabheader *down;
-	/*%<
-	 * Points to the header for the next older version of
-	 * this rdataset.
-	 */
+			struct dns_slabheader *down;
+			/*%<
+			 * Points to the header for the next older version of
+			 * this rdataset.
+			 */
+		};
+	};

 	dns_db_t     *db;
 	dns_dbnode_t *node;
@@ -151,8 +151,8 @@ struct dns_validator {
 	uint8_t	       unsupported_digest;
 	dns_rdata_t    rdata;
 	bool	       resume;
-	uint32_t      *nvalidations;
-	uint32_t      *nfails;
+	isc_counter_t *nvalidations;
+	isc_counter_t *nfails;
 	isc_counter_t *qc;
 	isc_counter_t *gqc;

@@ -172,7 +172,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
 		     isc_loop_t *loop, isc_job_cb cb, void *arg,
-		     uint32_t *nvalidations, uint32_t *nfails,
+		     isc_counter_t *nvalidations, isc_counter_t *nfails,
 		     isc_counter_t *qc, isc_counter_t *gqc,
 		     dns_edectx_t *edectx, dns_validator_t **validatorp);
 /*%<
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file dns/zonekey.h */
-
-#include <stdbool.h>
-
-#include <dns/types.h>
-
-bool
-dns_zonekey_iszonekey(dns_rdata_t *keyrdata);
-/*%<
- *	Determines if the key record contained in the rdata is a zone key.
- *
- *	Requires:
- *		'keyrdata' is not NULL.
- */
@@ -460,10 +460,6 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
 */

 isc_result_t
-dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
-		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-		   dst_key_t **keyp);
-isc_result_t
 dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
 /*%<
@@ -189,13 +189,19 @@ dns_keymgr_settime_syncpublish(dst_key_t *key, dns_kasp_t *kasp, bool first) {
 		isc_stdtime_t zrrsig_present;
 		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
 		zrrsig_present = published + ttlsig +
-				 dns_kasp_zonepropagationdelay(kasp) +
-				 dns_kasp_publishsafety(kasp);
+				 dns_kasp_zonepropagationdelay(kasp);
 		if (zrrsig_present > syncpublish) {
 			syncpublish = zrrsig_present;
 		}
 	}
 	dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncpublish);
+
+	uint32_t lifetime = 0;
+	ret = dst_key_getnum(key, DST_NUM_LIFETIME, &lifetime);
+	if (ret == ISC_R_SUCCESS && lifetime > 0) {
+		dst_key_settime(key, DST_TIME_SYNCDELETE,
+				(syncpublish + lifetime));
+	}
 }

 /*
@@ -243,6 +249,17 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 		pub = now;
 	}

+	/*
+	 * To calculate phase out times ("Retired", "Removed", ...),
+	 * the key lifetime is required.
+	 */
+	uint32_t klifetime = 0;
+	ret = dst_key_getnum(key->key, DST_NUM_LIFETIME, &klifetime);
+	if (ret != ISC_R_SUCCESS) {
+		dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
+		klifetime = lifetime;
+	}
+
 	/*
 	 * Calculate prepublication time.
 	 */
@@ -272,13 +289,16 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 				dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp,
 								       true);
 				syncpub2 = pub + ttlsig +
-					   dns_kasp_publishsafety(kasp) +
 					   dns_kasp_zonepropagationdelay(kasp);
 			}

 			syncpub = ISC_MAX(syncpub1, syncpub2);
 			dst_key_settime(key->key, DST_TIME_SYNCPUBLISH,
 					syncpub);
+			if (klifetime > 0) {
+				dst_key_settime(key->key, DST_TIME_SYNCDELETE,
+						(syncpub + klifetime));
+			}
 		}
 	}

@@ -291,13 +311,6 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,

 	ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
 	if (ret != ISC_R_SUCCESS) {
-		uint32_t klifetime = 0;
-
-		ret = dst_key_getnum(key->key, DST_NUM_LIFETIME, &klifetime);
-		if (ret != ISC_R_SUCCESS) {
-			dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
-			klifetime = lifetime;
-		}
 		if (klifetime == 0) {
 			/*
 			 * No inactive time and no lifetime,
@@ -398,7 +411,7 @@ keymgr_key_update_lifetime(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 	/* Initialize lifetime. */
 	if (r != ISC_R_SUCCESS) {
 		dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
-		return;
+		l = lifetime - 1;
 	}
 	/* Skip keys that are still hidden or already retiring. */
 	if (g != OMNIPRESENT) {
@@ -420,6 +433,7 @@ keymgr_key_update_lifetime(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 		} else {
 			dst_key_unsettime(key->key, DST_TIME_INACTIVE);
 			dst_key_unsettime(key->key, DST_TIME_DELETE);
+			dst_key_unsettime(key->key, DST_TIME_SYNCDELETE);
 		}
 	}
 }
@@ -1286,6 +1300,7 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 	isc_result_t ret;
 	isc_stdtime_t lastchange, dstime, nexttime = now;
 	dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
+	uint32_t dsstate;

 	/*
 	 * No need to wait if we move things into an uncertain state.
@@ -1355,15 +1370,12 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 			 * records.  This translates to:
 			 *
 			 *     Dsgn + zone-propagation-delay + max-zone-ttl.
-			 *
-			 * We will also add the retire-safety interval.
 			 */
 			nexttime = lastchange + ttlsig +
-				   dns_kasp_zonepropagationdelay(kasp) +
-				   dns_kasp_retiresafety(kasp);
+				   dns_kasp_zonepropagationdelay(kasp);
 			/*
-			 * Only add the sign delay Dsgn if there is an actual
-			 * predecessor or successor key.
+			 * Only add the sign delay Dsgn and retire-safety if
+			 * there is an actual predecessor or successor key.
 			 */
 			uint32_t tag;
 			ret = dst_key_getnum(key->key, DST_NUM_PREDECESSOR,
@@ -1373,7 +1385,8 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 						     DST_NUM_SUCCESSOR, &tag);
 			}
 			if (ret == ISC_R_SUCCESS) {
-				nexttime += dns_kasp_signdelay(kasp);
+				nexttime += dns_kasp_signdelay(kasp) +
+					    dns_kasp_retiresafety(kasp);
 			}
 			break;
 		default:
@@ -1399,35 +1412,36 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 		 * This translates to:
 		 *
 		 *      parent-propagation-delay + parent-ds-ttl.
-		 *
-		 * We will also add the retire-safety interval.
 		 */
 		case OMNIPRESENT:
-			/* Make sure DS has been seen in the parent. */
-			ret = dst_key_gettime(key->key, DST_TIME_DSPUBLISH,
-					      &dstime);
-			if (ret != ISC_R_SUCCESS || dstime > now) {
-				/* Not yet, try again in an hour. */
-				nexttime = now + 3600;
-			} else {
-				nexttime =
-					dstime + dns_kasp_dsttl(kasp) +
-					dns_kasp_parentpropagationdelay(kasp) +
-					dns_kasp_retiresafety(kasp);
-			}
-			break;
 		case HIDDEN:
-			/* Make sure DS has been withdrawn from the parent. */
-			ret = dst_key_gettime(key->key, DST_TIME_DSDELETE,
-					      &dstime);
+			/* Make sure DS has been seen in/withdrawn from the
+			 * parent. */
+			dsstate = next_state == HIDDEN ? DST_TIME_DSDELETE
+						       : DST_TIME_DSPUBLISH;
+			ret = dst_key_gettime(key->key, dsstate, &dstime);
 			if (ret != ISC_R_SUCCESS || dstime > now) {
 				/* Not yet, try again in an hour. */
 				nexttime = now + 3600;
 			} else {
 				nexttime =
 					dstime + dns_kasp_dsttl(kasp) +
-					dns_kasp_parentpropagationdelay(kasp) +
-					dns_kasp_retiresafety(kasp);
+					dns_kasp_parentpropagationdelay(kasp);
+				/*
+				 * Only add the retire-safety if there is an
+				 * actual predecessor or successor key.
+				 */
+				uint32_t tag;
+				ret = dst_key_getnum(key->key,
+						     DST_NUM_PREDECESSOR, &tag);
+				if (ret != ISC_R_SUCCESS) {
+					ret = dst_key_getnum(key->key,
+							     DST_NUM_SUCCESSOR,
+							     &tag);
+				}
+				if (ret == ISC_R_SUCCESS) {
+					nexttime += dns_kasp_retiresafety(kasp);
+				}
 			}
 			break;
 		default:
@@ -1763,7 +1777,9 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 		if (prepub == 0 || prepub > now) {
 			/* No need to start rollover now. */
 			if (*nexttime == 0 || prepub < *nexttime) {
-				*nexttime = prepub;
+				if (prepub > 0) {
+					*nexttime = prepub;
+				}
 			}
 			return ISC_R_SUCCESS;
 		}
@@ -2022,6 +2038,20 @@ keymgr_purge_keyfile(dst_key_t *key, int type) {
 	}
 }

+static bool
+dst_key_doublematch(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
+	int matches = 0;
+
+	for (dns_kasp_key_t *kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
+	     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
+	{
+		if (dns_kasp_key_match(kkey, key)) {
+			matches++;
+		}
+	}
+	return matches > 1;
+}
+
 /*
 * Examine 'keys' and match 'kasp' policy.
 *
@@ -2161,6 +2191,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 					 * matches the kasp policy.
 					 */
 					if (!dst_key_is_unused(dkey->key) &&
+					    !dst_key_doublematch(dkey, kasp) &&
 					    (dst_key_goal(dkey->key) ==
 					     OMNIPRESENT) &&
 					    !keymgr_dep(dkey->key, keyring,
@@ -3105,7 +3105,7 @@ dns_message_checksig_async(dns_message_t *msg, dns_view_t *view,

 isc_result_t
 dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
-	isc_buffer_t b, msgb;
+	isc_buffer_t msgb;

 	REQUIRE(DNS_MESSAGE_VALID(msg));

@@ -3126,7 +3126,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 			return dns_tsig_verify(&msgb, msg, NULL, NULL);
 		}
 	} else {
-		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_t sigrdata = DNS_RDATA_INIT;
 		dns_rdata_sig_t sig;
 		dns_rdataset_t keyset;
 		isc_result_t result;
@@ -3134,7 +3134,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {

 		result = dns_rdataset_first(msg->sig0);
 		INSIST(result == ISC_R_SUCCESS);
-		dns_rdataset_current(msg->sig0, &rdata);
+		dns_rdataset_current(msg->sig0, &sigrdata);

 		/*
 		 * This can occur when the message is a dynamic update, since
@@ -3143,11 +3143,11 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 		 * looked for in the additional section, and the dynamic update
 		 * meta-records are in the prerequisite and update sections.
 		 */
-		if (rdata.length == 0) {
+		if (sigrdata.length == 0) {
 			return ISC_R_UNEXPECTEDEND;
 		}

-		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
 		if (result != ISC_R_SUCCESS) {
 			return result;
 		}
@@ -3191,26 +3191,32 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 		     message_checks < max_message_checks;
 		     key_checks++, result = dns_rdataset_next(&keyset))
 		{
+			dns_rdata_t keyrdata = DNS_RDATA_INIT;
+			dns_rdata_key_t ks;
 			dst_key_t *key = NULL;
+			isc_region_t r;

-			dns_rdata_reset(&rdata);
-			dns_rdataset_current(&keyset, &rdata);
-			isc_buffer_init(&b, rdata.data, rdata.length);
-			isc_buffer_add(&b, rdata.length);
+			dns_rdataset_current(&keyset, &keyrdata);
+			dns_rdata_tostruct(&keyrdata, &ks, NULL);

-			result = dst_key_fromdns(&sig.signer, rdata.rdclass, &b,
-						 view->mctx, &key);
+			if (sig.algorithm != ks.algorithm ||
+			    (ks.protocol != DNS_KEYPROTO_DNSSEC &&
+			     ks.protocol != DNS_KEYPROTO_ANY))
+			{
+				continue;
+			}
+
+			dns_rdata_toregion(&keyrdata, &r);
+			if (dst_region_computeid(&r) != sig.keyid) {
+				continue;
+			}
+
+			result = dns_dnssec_keyfromrdata(&sig.signer, &keyrdata,
+							 view->mctx, &key);
 			if (result != ISC_R_SUCCESS) {
 				continue;
 			}
-			if (dst_key_alg(key) != sig.algorithm ||
-			    dst_key_id(key) != sig.keyid ||
-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
-			{
-				dst_key_free(&key);
-				continue;
-			}
+
 			result = dns_dnssec_verifymessage(&msgb, msg, key);
 			dst_key_free(&key);
 			if (result == ISC_R_SUCCESS) {
@@ -43,6 +43,7 @@
 #include <dns/callbacks.h>
 #include <dns/db.h>
 #include <dns/dbiterator.h>
+#include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -58,7 +59,6 @@
 #include <dns/time.h>
 #include <dns/view.h>
 #include <dns/zone.h>
-#include <dns/zonekey.h>

 #include "db_p.h"
 #include "qpzone_p.h"
@@ -1143,25 +1143,17 @@ setsecure(dns_db_t *db, qpz_version_t *version, dns_dbnode_t *origin) {
 	bool hasnsec = false;
 	isc_result_t result;

+	version->secure = false;
+	version->havensec3 = false;
+
 	dns_rdataset_init(&keyset);
 	result = dns_db_findrdataset(db, origin, (dns_dbversion_t *)version,
 				     dns_rdatatype_dnskey, 0, 0, &keyset, NULL);
 	if (result == ISC_R_SUCCESS) {
-		result = dns_rdataset_first(&keyset);
-		while (result == ISC_R_SUCCESS) {
-			dns_rdata_t keyrdata = DNS_RDATA_INIT;
-			dns_rdataset_current(&keyset, &keyrdata);
-			if (dns_zonekey_iszonekey(&keyrdata)) {
-				haszonekey = true;
-				break;
-			}
-			result = dns_rdataset_next(&keyset);
-		}
+		haszonekey = dns_dnssec_haszonekey(&keyset);
 		dns_rdataset_disassociate(&keyset);
 	}
 	if (!haszonekey) {
-		version->secure = false;
-		version->havensec3 = false;
 		return;
 	}

@@ -1181,12 +1173,11 @@ setsecure(dns_db_t *db, qpz_version_t *version, dns_dbnode_t *origin) {
 	setnsec3parameters(db, version);

 	/*
-	 * Do we have a valid NSEC/NSEC3 chain?
+	 * If we don't have a valid NSEC/NSEC3 chain,
+	 * clear the secure flag.
 	 */
 	if (version->havensec3 || hasnsec) {
 		version->secure = true;
-	} else {
-		version->secure = false;
 	}
 }

@@ -471,8 +471,8 @@ struct fetchctx {
 	unsigned int depth;
 	char clientstr[ISC_SOCKADDR_FORMATSIZE];

-	uint32_t nvalidations;
-	uint32_t nfails;
+	isc_counter_t *nvalidations;
+	isc_counter_t *nfails;
 };

 #define FCTX_MAGIC	 ISC_MAGIC('F', '!', '!', '!')
@@ -973,8 +973,8 @@ valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,

 	result = dns_validator_create(
 		fctx->res->view, name, type, rdataset, sigrdataset, message,
-		valoptions, fctx->loop, validated, valarg, &fctx->nvalidations,
-		&fctx->nfails, fctx->qc, fctx->gqc, &fctx->edectx, &validator);
+		valoptions, fctx->loop, validated, valarg, fctx->nvalidations,
+		fctx->nfails, fctx->qc, fctx->gqc, &fctx->edectx, &validator);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	inc_stats(fctx->res, dns_resstatscounter_val);
 	ISC_LIST_APPEND(fctx->validators, validator, link);
@@ -4500,6 +4500,12 @@ fctx_destroy(fetchctx_t *fctx) {
 		isc_mem_put(fctx->mctx, sa, sizeof(*sa));
 	}

+	if (fctx->nfails != NULL) {
+		isc_counter_detach(&fctx->nfails);
+	}
+	if (fctx->nvalidations != NULL) {
+		isc_counter_detach(&fctx->nvalidations);
+	}
 	isc_counter_detach(&fctx->qc);
 	if (fctx->gqc != NULL) {
 		isc_counter_detach(&fctx->gqc);
@@ -4669,6 +4675,8 @@ fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
 	char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1];
 	isc_mem_t *mctx = isc_loop_getmctx(loop);
 	size_t p;
+	uint32_t nvalidations = atomic_load_relaxed(&res->maxvalidations);
+	uint32_t nfails = atomic_load_relaxed(&res->maxvalidationfails);

 	/*
 	 * Caller must be holding the lock for 'bucket'
@@ -4687,8 +4695,6 @@ fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
 		.fwdpolicy = dns_fwdpolicy_none,
 		.result = ISC_R_FAILURE,
 		.loop = loop,
-		.nvalidations = atomic_load_relaxed(&res->maxvalidations),
-		.nfails = atomic_load_relaxed(&res->maxvalidationfails),
 	};

 	isc_mem_attach(mctx, &fctx->mctx);
@@ -4710,6 +4716,14 @@ fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,

 	FCTXTRACE("create");

+	if (nfails > 0) {
+		isc_counter_create(mctx, nfails, &fctx->nfails);
+	}
+
+	if (nvalidations > 0) {
+		isc_counter_create(mctx, nvalidations, &fctx->nvalidations);
+	}
+
 	if (qc != NULL) {
 		isc_counter_attach(qc, &fctx->qc);
 		isc_log_write(DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER,
@@ -4942,6 +4956,12 @@ cleanup_nameservers:
 		dns_rdataset_disassociate(&fctx->nameservers);
 	}
 	isc_mem_free(fctx->mctx, fctx->info);
+	if (fctx->nfails != NULL) {
+		isc_counter_detach(&fctx->nfails);
+	}
+	if (fctx->nvalidations != NULL) {
+		isc_counter_detach(&fctx->nvalidations);
+	}
 	isc_counter_detach(&fctx->qc);
 	if (fctx->gqc != NULL) {
 		isc_counter_detach(&fctx->gqc);
@@ -7462,10 +7482,12 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {

 	QTRACE("response");

-	if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) {
-		inc_stats(fctx->res, dns_resstatscounter_responsev4);
-	} else {
-		inc_stats(fctx->res, dns_resstatscounter_responsev6);
+	if (eresult == ISC_R_SUCCESS) {
+		if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) {
+			inc_stats(fctx->res, dns_resstatscounter_responsev4);
+		} else {
+			inc_stats(fctx->res, dns_resstatscounter_responsev6);
+		}
 	}

 	rctx = isc_mem_get(fctx->mctx, sizeof(*rctx));
@@ -8047,6 +8069,9 @@ rctx_timedout(respctx_t *rctx) {
 		fctx->timeout = true;
 		fctx->timeouts++;

+		rctx->no_response = true;
+		rctx->finish = NULL;
+
 		now = isc_time_now();
 		/* netmgr timeouts are accurate to the millisecond */
 		if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) {
@@ -8057,8 +8082,6 @@ rctx_timedout(respctx_t *rctx) {
 		} else {
 			FCTXTRACE("query timed out; trying next server");
 			/* try next server */
-			rctx->no_response = true;
-			rctx->finish = NULL;
 			rctx->next_server = true;
 		}

@@ -1011,59 +1011,46 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 static isc_result_t
 select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
 	isc_result_t result;
-	dns_rdata_rrsig_t *siginfo = val->siginfo;
-	isc_buffer_t b;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dst_key_t *oldkey = val->key;
-	bool no_rdata = false;

-	if (oldkey == NULL) {
+	if (val->key == NULL) {
 		result = dns_rdataset_first(rdataset);
 	} else {
-		dst_key_free(&oldkey);
+		dst_key_free(&val->key);
 		val->key = NULL;
 		result = dns_rdataset_next(rdataset);
 	}
-	if (result != ISC_R_SUCCESS) {
-		goto done;
+	if (result == ISC_R_NOMORE) {
+		return ISC_R_NOTFOUND;
 	}

-	do {
+	for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(rdataset)) {
+		dns_rdata_rrsig_t *siginfo = val->siginfo;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_dnskey_t key;
+		isc_region_t r;
+
 		dns_rdataset_current(rdataset, &rdata);
+		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */

-		isc_buffer_init(&b, rdata.data, rdata.length);
-		isc_buffer_add(&b, rdata.length);
-		INSIST(val->key == NULL);
-		result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
-					    val->view->mctx, no_rdata,
-					    &val->key);
-		if (result == ISC_R_SUCCESS) {
-			if (siginfo->algorithm ==
-				    (dns_secalg_t)dst_key_alg(val->key) &&
-			    siginfo->keyid ==
-				    (dns_keytag_t)dst_key_id(val->key) &&
-			    (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
-				    0 &&
-			    dst_key_iszonekey(val->key))
-			{
-				if (no_rdata) {
-					/* Retry with full key */
-					dns_rdata_reset(&rdata);
-					dst_key_free(&val->key);
-					no_rdata = false;
-					continue;
-				}
-				/* This is the key we're looking for. */
-				goto done;
-			}
-			dst_key_free(&val->key);
+		if (key.algorithm != siginfo->algorithm ||
+		    (key.flags & DNS_KEYFLAG_REVOKE) != 0 ||
+		    !dns_dnssec_iszonekey(&key))
+		{
+			continue;
 		}
-		dns_rdata_reset(&rdata);
-		result = dns_rdataset_next(rdataset);
-		no_rdata = true;
-	} while (result == ISC_R_SUCCESS);

-done:
+		dns_rdata_toregion(&rdata, &r);
+		if (dst_region_computeid(&r) != siginfo->keyid) {
+			continue;
+		}
+
+		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+						 val->view->mctx, &val->key);
+		if (result == ISC_R_SUCCESS) {
+			/* found the key we wanted */
+			break;
+		}
+	}
 	if (result == ISC_R_NOMORE) {
 		result = ISC_R_NOTFOUND;
 	}
@@ -1245,7 +1232,10 @@ compute_keytag(dns_rdata_t *rdata) {

 static bool
 over_max_validations(dns_validator_t *val) {
-	if (val->nvalidations == NULL || (*val->nvalidations) > 0) {
+	if (val->nvalidations == NULL ||
+	    isc_counter_used(val->nvalidations) <
+		    isc_counter_getlimit(val->nvalidations))
+	{
 		return false;
 	}

@@ -1259,14 +1249,14 @@ consume_validation(dns_validator_t *val) {
 	if (val->nvalidations == NULL) {
 		return;
 	}
-	INSIST((*val->nvalidations) > 0);
-
-	(*val->nvalidations)--;
+	(void)isc_counter_increment(val->nvalidations);
 }

 static bool
 over_max_fails(dns_validator_t *val) {
-	if (val->nfails == NULL || (*val->nfails) > 0) {
+	if (val->nfails == NULL ||
+	    isc_counter_used(val->nfails) < isc_counter_getlimit(val->nfails))
+	{
 		return false;
 	}

@@ -1280,9 +1270,7 @@ consume_validation_fail(dns_validator_t *val) {
 	if (val->nfails == NULL) {
 		return;
 	}
-	INSIST((*val->nfails) > 0);
-
-	(*val->nfails)--;
+	(void)isc_counter_increment(val->nfails);
 }

 /*%
@@ -3392,7 +3380,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
 		     isc_loop_t *loop, isc_job_cb cb, void *arg,
-		     uint32_t *nvalidations, uint32_t *nfails,
+		     isc_counter_t *nvalidations, isc_counter_t *nfails,
 		     isc_counter_t *qc, isc_counter_t *gqc,
 		     dns_edectx_t *edectx, dns_validator_t **validatorp) {
 	isc_result_t result = ISC_R_FAILURE;
@@ -3424,8 +3412,6 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		.cb = cb,
 		.arg = arg,
 		.rdata = DNS_RDATA_INIT,
-		.nvalidations = nvalidations,
-		.nfails = nfails,
 		.edectx = edectx,
 	};

@@ -3435,6 +3421,14 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		dns_message_attach(message, &val->message);
 	}

+	if (nfails != NULL) {
+		isc_counter_attach(nfails, &val->nfails);
+	}
+
+	if (nvalidations != NULL) {
+		isc_counter_attach(nvalidations, &val->nvalidations);
+	}
+
 	if (qc != NULL) {
 		isc_counter_attach(qc, &val->qc);
 	}
@@ -3527,6 +3521,12 @@ destroy_validator(dns_validator_t *val) {
 	if (val->message != NULL) {
 		dns_message_detach(&val->message);
 	}
+	if (val->nfails != NULL) {
+		isc_counter_detach(&val->nfails);
+	}
+	if (val->nvalidations != NULL) {
+		isc_counter_detach(&val->nvalidations);
+	}
 	if (val->qc != NULL) {
 		isc_counter_detach(&val->qc);
 	}
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <dns/keyvalues.h>
-#include <dns/rdata.h>
-#include <dns/rdatastruct.h>
-#include <dns/types.h>
-#include <dns/zonekey.h>
-
-bool
-dns_zonekey_iszonekey(dns_rdata_t *keyrdata) {
-	isc_result_t result;
-	dns_rdata_dnskey_t key;
-	bool iszonekey = true;
-
-	REQUIRE(keyrdata != NULL);
-
-	result = dns_rdata_tostruct(keyrdata, &key, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return false;
-	}
-
-	if ((key.flags & DNS_KEYTYPE_NOAUTH) != 0) {
-		iszonekey = false;
-	}
-	if ((key.flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
-		iszonekey = false;
-	}
-	if (key.protocol != DNS_KEYPROTO_DNSSEC &&
-	    key.protocol != DNS_KEYPROTO_ANY)
-	{
-		iszonekey = false;
-	}
-
-	return iszonekey;
-}
@@ -26,6 +26,7 @@ libisc_la_HEADERS =			\
 	include/isc/file.h		\
 	include/isc/formatcheck.h	\
 	include/isc/fuzz.h		\
+	include/isc/fxhash.h		\
 	include/isc/getaddresses.h	\
 	include/isc/hash.h		\
 	include/isc/hashmap.h		\
@@ -131,18 +131,28 @@ isc__ascii_load8(const uint8_t *ptr) {
 * Compare `len` bytes at `a` and `b` for case-insensitive equality
 */
 static inline bool
-isc_ascii_lowerequal(const uint8_t *a, const uint8_t *b, unsigned int len) {
+isc_ascii_lowerequal(const uint8_t *restrict a, const uint8_t *restrict b,
+		     unsigned int len) {
 	uint64_t a8 = 0, b8 = 0;
-	while (len >= 8) {
-		a8 = isc_ascii_tolower8(isc__ascii_load8(a));
-		b8 = isc_ascii_tolower8(isc__ascii_load8(b));
-		if (a8 != b8) {
-			return false;
+	if (len >= 8) {
+		const uint8_t *a_tail = a + len - 8;
+		const uint8_t *b_tail = b + len - 8;
+		while (len >= 8) {
+			a8 = isc_ascii_tolower8(isc__ascii_load8(a));
+			b8 = isc_ascii_tolower8(isc__ascii_load8(b));
+			if (a8 != b8) {
+				return false;
+			}
+			len -= 8;
+			a += 8;
+			b += 8;
 		}
-		len -= 8;
-		a += 8;
-		b += 8;
+
+		a8 = isc_ascii_tolower8(isc__ascii_load8(a_tail));
+		b8 = isc_ascii_tolower8(isc__ascii_load8(b_tail));
+		return a8 == b8;
 	}
+
 	while (len-- > 0) {
 		if (isc_ascii_tolower(*a++) != isc_ascii_tolower(*b++)) {
 			return false;
@@ -0,0 +1,89 @@
+#pragma once
+
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the “Software”), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+/* The constant K from Rust's fxhash */
+#define K 0x9e3779b97f4a7c15ull
+
+static inline size_t
+rotate_left(size_t x, unsigned int n) {
+	return (x << n) | (x >> (sizeof(size_t) * 8 - n));
+}
+
+static inline size_t
+fx_add_to_hash(size_t hash, size_t i) {
+	return rotate_left(hash, 5) ^ i * K;
+}
+
+/*
+ * Beware: this implementation will use an approximate conversion to lowercase.
+ * This is ok as fxhash is already not hash-flooding resistant and we use it
+ * only for config parsing.
+ */
+static inline size_t
+fx_hash_bytes(size_t initial_hash, const uint8_t *restrict bytes, size_t len,
+	      bool case_sensitive) {
+	size_t hash = initial_hash;
+	size_t case_mask = case_sensitive
+				   ? -1ull
+				   : (0b11011111 * 0x0101010101010101ull);
+
+	while (len >= sizeof(size_t)) {
+		size_t value;
+		memmove(&value, bytes, sizeof(size_t));
+		hash = fx_add_to_hash(hash, value & case_mask);
+		bytes += sizeof(size_t);
+		len -= sizeof(size_t);
+	}
+
+	/* Will be ignored if sizeof(size_t) <= 4 */
+	if (len >= 4) {
+		uint32_t value;
+		memmove(&value, bytes, sizeof(uint32_t));
+		hash = fx_add_to_hash(hash, value & case_mask);
+		bytes += 4;
+		len -= 4;
+	}
+
+	/* Will be ignored if sizeof(size_t) <= 2 */
+	if (len >= 2) {
+		uint16_t value;
+		memmove(&value, bytes, sizeof(uint16_t));
+		hash = fx_add_to_hash(hash, value & case_mask);
+		bytes += 2;
+		len -= 2;
+	}
+
+	if (len >= 1) {
+		hash = fx_add_to_hash(hash, bytes[0] & case_mask);
+	}
+
+	return hash;
+}
@@ -16,6 +16,7 @@
 #include <stdbool.h>

 #include <isc/ascii.h>
+#include <isc/fxhash.h>
 #include <isc/hash.h>
 #include <isc/hashmap.h>
 #include <isc/magic.h>
@@ -31,9 +32,9 @@ typedef struct elt {
 	isc_symvalue_t value;
 } elt_t;

-/* 7 bits means 128 entries at creation, which matches the common use of
+/* 4 bits means 16 entries at creation, which matches the common use of
 * symtab */
-#define ISC_SYMTAB_INIT_HASH_BITS 7
+#define ISC_SYMTAB_INIT_HASH_BITS 4
 #define SYMTAB_MAGIC		  ISC_MAGIC('S', 'y', 'm', 'T')
 #define VALID_SYMTAB(st)	  ISC_MAGIC_VALID(st, SYMTAB_MAGIC)

@@ -122,7 +123,7 @@ elt__match(void *node, const void *key0, bool case_sensitive) {
 	if (case_sensitive) {
 		return memcmp(elt->key, key->key, key->size) == 0;
 	} else {
-		return isc_ascii_lowercmp(elt->key, key->key, key->size) == 0;
+		return isc_ascii_lowerequal(elt->key, key->key, key->size);
 	}
 }

@@ -136,14 +137,11 @@ elt_match_nocase(void *node, const void *key) {
 	return elt__match(node, key, false);
 }

-static uint32_t
-elt_hash(elt_t *elt, bool case_sensitive) {
-	isc_hash32_t hash;
-
-	isc_hash32_init(&hash);
-	isc_hash32_hash(&hash, elt->key, elt->size, case_sensitive);
-	isc_hash32_hash(&hash, &elt->type, sizeof(elt->type), false);
-	return isc_hash32_finalize(&hash);
+static inline uint32_t
+elt_hash(elt_t *restrict elt, bool case_sensitive) {
+	const uint8_t *ptr = elt->key;
+	size_t len = elt->size;
+	return fx_hash_bytes(0, ptr, len, case_sensitive);
 }

 isc_result_t
@@ -2420,25 +2420,33 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 	for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(keyrdataset))
 	{
 		dns_rdata_t rdata = DNS_RDATA_INIT;
-		isc_buffer_t b;
+		dns_rdata_dnskey_t key;
+		isc_region_t r;

 		dns_rdataset_current(keyrdataset, &rdata);
-		isc_buffer_init(&b, rdata.data, rdata.length);
-		isc_buffer_add(&b, rdata.length);
-		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-					 client->manager->mctx, keyp);
-		if (result != ISC_R_SUCCESS) {
+		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */
+
+		if (rrsig->algorithm != key.algorithm ||
+		    !dns_dnssec_iszonekey(&key))
+		{
 			continue;
 		}
-		if (rrsig->algorithm == (dns_secalg_t)dst_key_alg(*keyp) &&
-		    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
-		    dst_key_iszonekey(*keyp))
-		{
+
+		dns_rdata_toregion(&rdata, &r);
+		if (dst_region_computeid(&r) != rrsig->keyid) {
+			continue;
+		}
+
+		result = dns_dnssec_keyfromrdata(&rrsig->signer, &rdata,
+						 client->manager->mctx, keyp);
+		if (result == ISC_R_SUCCESS) {
 			secure = true;
 			break;
 		}
+
 		dst_key_free(keyp);
 	}
+
 	return secure;
 }
Author	SHA1	Message	Date
Ondřej Surý	366af278e6	fixup! WIP: Rewrite qpcache to use cds_lfht	2025-03-21 01:56:48 +01:00
Ondřej Surý	b508821601	WIP: Rewrite qpcache to use cds_lfht	2025-03-21 01:56:03 +01:00
Mark Andrews	49ecb158d4	fix: dev: Fix adbname reference Call `dns_adbname_ref` before calling `dns_resolver_createfetch` to ensure `adbname->name` remains stable for the life of the fetch. Closes #5239 Merge branch '5239-fix-adb-reference-counting' into 'main' See merge request isc-projects/bind9!10290	2025-03-21 00:26:25 +00:00
Mark Andrews	8e7229f641	Fix gaining adbname reference Call dns_adbname_ref before calling dns_resolver_createfetch to ensure adbname->name remains stable for the life of the fetch.	2025-03-20 23:25:29 +00:00
Evan Hunt	3415392d01	fix: dev: Optimize key ID check when searching for matching keys When searching through a DNSKEY or KEY rrset for the key matching a particular algorithm and ID, it's a waste of time to convert every key into a `dst_key` object; it's faster to compute the key ID from the rdata, then do the full key conversion after determining that we've found the right key. This optimization was already used in the validator, but it's been refactored for code clarity, and is now also used in query.c and message.c. Merge branch 'each-refactor-key-search' into 'main' See merge request isc-projects/bind9!10258	2025-03-20 18:25:05 +00:00
Evan Hunt	2e6107008d	optimize key ID check when searching for matching keys when searching a DNSKEY or KEY rrset for the key that matches a particular algorithm and ID, it's a waste of time to convert every key into a dst_key object; it's faster to compute the key ID by checksumming the region, and then only do the full key conversion once we know we've found the correct key. this optimization was already in use in the validator, but it's been refactored for code clarity, and is now also used in query.c and message.c.	2025-03-20 18:22:58 +00:00
Evan Hunt	341b962665	move dns_zonekey_iszonekey() to dns_dnssec module dns_zonekey_iszonekey() was the only function defined in the dns_zonekey module, and was only called from one place. it makes more sense to group this with dns_dnssec functions.	2025-03-20 18:22:58 +00:00
Alessio Podda	d3db9ccf53	chg: dev: Switch symtab to use fxhash hashing This merge request resolves some performance regressions introduced with the change from isc_symtab_t to isc_hashmap_t. The key improvements are: 1. Using a faster hash function than both isc_hashmap_t and isc_symtab_t. The previous implementation used SipHash, but the hashflood resistance properties of SipHash are unneeded for config parsing. 2. Shrinking the initial size of the isc_hashmap_t used inside isc_symtab_t. Symtab is mainly used for config parsing, and the when used that way it will have between 1 and 50 keys, but the previous implementation initialized a map with 128 slots. By initializing a smaller map, we speed up mallocs and optimize for the typical case of few config keys. 3. Slight optimization of the string matching in the hashmap, so that the tail is handled in a single load + comparison, instead of byte by byte. Of the three improvements, this is the least important. Merge branch 'alessio/fxhash-symtab' into 'main' See merge request isc-projects/bind9!10204	2025-03-20 13:00:12 +00:00
alessio	e1e10adc3a	Switch symtab to use fxhash hashing This merge request resolves some performance regressions introduced with the change from isc_symtab_t to isc_hashmap_t. The key improvements are: 1. Using a faster hash function than both isc_hashmap_t and isc_symtab_t. The previous implementation used SipHash, but the hashflood resistance properties of SipHash are unneeded for config parsing. 2. Shrinking the initial size of the isc_hashmap_t used inside isc_symtab_t. Symtab is mainly used for config parsing, and the when used that way it will have between 1 and ~50 keys, but the previous implementation initialized a map with 128 slots. By initializing a smaller map, we speed up mallocs and optimize for the typical case of few config keys. 3. Slight optimization of the string matching in the hashmap, so that the tail is handled in a single load + comparison, instead of byte by byte. Of the three improvements, this is the least important.	2025-03-20 11:26:09 +01:00
Matthijs Mekking	d2214cb704	fix: usr: Fix several small DNSSEC timing issues The following small issues related to `dnssec-policy` have been fixed: - In some cases the key manager inside BIND 9 could run every hour, while it could have run less often. - While `CDS` and `CDNSKEY` records will be removed correctly from the zone when the corresponding `DS` record needs to be updated, the expected timing metadata when this will happen was never set. - There were a couple of cases where the safety intervals are added inappropriately, delaying key rollovers longer than necessary. - If you have identical `keys` in your `dnssec-policy`, they may be retired inappropriately. Note that having keys with identical properties is discouraged in all cases. Closes #5242 Merge branch '5242-several-keymgr-issues' into 'main' See merge request isc-projects/bind9!10251	2025-03-20 10:13:22 +00:00
Matthijs Mekking	3e836a87e6	Update Retired and Removed if we update lifetime If we are updating the lifetime, and it was not set before, also set/update the Retired and Removed timing metadata.	2025-03-20 10:12:16 +00:00
Matthijs Mekking	b93cb2e80e	Fix a key generation issue in the tests The dnssec-keygen command for the ZSK generation for the zone multisigner-model2.kasp was wrong (no ZSK was generated in the setup script, but when 'named' is started, the missing ZSK was created anyway by 'dnssec-policy'.	2025-03-20 10:12:16 +00:00
Matthijs Mekking	6c6b8796d3	Fix keymgr bug wrt setting the next time Only set the next time the keymgr should run if the value is non zero. Otherwise we default back to one hour. This may happen if there is one or more key with an unlimited lifetime.	2025-03-20 10:12:16 +00:00
Matthijs Mekking	8c9d2eb2bf	keymgr: also set DeleteCDS when setting PublishCDS The keymgr never set the expected timing metadata when CDS/CDNSKEY records for the corresponding key will be removed from the zone. This is not troublesome, as key states dictate when this happens, but with the new pytest we use the timing metadata to determine if the CDS and/or CDNSKEY for the given key needs to be published.	2025-03-20 10:12:16 +00:00
Matthijs Mekking	63edc4435f	Fix wrong usage of safety intervals in keymgr There are a couple of cases where the safety intervals are added inappropriately: 1. When setting the PublishCDS/SyncPublish timing metadata, we don't need to add the publish-safety value if we are calculating the time when the zone is completely signed for the first time. This value is for when the DNSKEY has been published and we add a safety interval before considering the DNSKEY omnipresent. 2. The retire-safety value should only be added to ZSK rollovers if there is an actual rollover happening, similar to adding the sign delay. 3. The retire-safety value should only be added to KSK rollovers if there is an actual rollover happening. We consider the new DS omnipresent a bit later, so that we are forced to keep the old DS a bit longer.	2025-03-20 10:12:16 +00:00
Matthijs Mekking	ef671919d5	Fix a small keymgr bug While converting the kasp system test to pytest, I encountered a small bug in the keymgr code. We retire keys when there is more than one key matching a 'keys' line from the dnssec-policy. But if there are multiple identical 'keys' lines, as is the case for the test zone 'checkds-doubleksk.kasp', we retire one of the two keys that have the same properties. Fix this by checking if there are double matches. This is not fool proof because there may be many keys for a few identical 'keys' lines, but it is good enough for now. In practice it makes no sense to have a policy that dictates multiple keys with identical properties.	2025-03-20 10:12:16 +00:00
Mark Andrews	329a332708	fix: usr: Fix write after free in validator code Raw integer pointers were being used for the validator's nvalidations and nfails values but the memory holding them could be freed before they ceased to be used. Use reference counted counters instead. Closes #5239 Merge branch '5239-use-counter-for-nvalidations-and-nfailss' into 'main' See merge request isc-projects/bind9!10248	2025-03-20 01:30:11 +00:00
Mark Andrews	bfbaacc9a0	Use reference counted counters for nfail and nvalidations The fetch context that held these values could be freed while there were still active pointers to the memory. Using a reference counted pointer avoids this.	2025-03-20 09:12:49 +11:00
Andoni Duarte Pintado	8dba96d71e	Merge tag 'v9.21.6'	2025-03-19 17:36:14 +01:00
Michal Nowak	1d688e89b8	fix: test: Fix the log-report-channel zones check The check looks for logs that are not present, fails to make the possible failure visible, and fails to bump the check enumerator: I:checking that log-report-channel zones fail if '*._er/TXT' is missing (129) grep: test.out4.129: No such file or directory grep: test.out4.129: No such file or directory I:checking that raw zone with bad class is handled (129) The issue appeared in #3659. Merge branch 'mnowak/checkzone-test-fix' into 'main' See merge request isc-projects/bind9!10286	2025-03-19 08:00:42 +00:00
Michal Nowak	c2e60f9a5a	Fix the log-report-channel zones check The check looks for logs that are not present, fails to make the possible failure visible, and fails to bump the check enumerator: I:checking that log-report-channel zones fail if '*._er/TXT' is missing (129) grep: test.out4.129: No such file or directory grep: test.out4.129: No such file or directory I:checking that raw zone with bad class is handled (129)	2025-03-19 08:00:19 +00:00
Mark Andrews	ed727ee924	fix: test: Fix failing grep invocation on OpenBSD Lines starting with A or NSEC are expected but not matched with the OpenBSD grep. Extended regular expressions with direct use of parentheses and the pipe symbol is more appropriate. I:checking RRSIG query from cache (154) I:failed The issue appeared in #4805. Merge branch 'mnowak/openbsd-grep-fix' into 'main' See merge request isc-projects/bind9!10285	2025-03-19 00:04:39 +00:00
Michal NowakandMark Andrews	00584d6f29	Fix failing grep invocation on OpenBSD Lines starting with A or NSEC are expected but not matched with the OpenBSD grep. Extended regular expressions with direct use of parentheses and the pipe symbol is more appropriate. I:checking RRSIG query from cache (154) I:failed	2025-03-18 23:29:22 +00:00
Arаm Sаrgsyаn	d30b9eb46e	fix: usr: Fix resolver statistics counters for timed out responses When query responses timed out, the resolver could incorrectly increase the regular responses counters, even if no response was received. This has been fixed. Closes #5193 Merge branch '5193-resolver-statistics-counters-fix' into 'main' See merge request isc-projects/bind9!10227	2025-03-18 17:05:23 +00:00
Aram Sargsyan	0c7fa8d572	Test resolver statistics when responses time out Add a test to check that the timed out responses do not skew the normal responses statistics counters, and that they do update the timeouts counter.	2025-03-18 16:20:59 +00:00
Aram Sargsyan	830e548111	Fix the resolvers RTT-ranged responses statistics counters When a response times out the fctx_cancelquery() function incorrectly calculates it in the 'dns_resstatscounter_queryrtt5' counter (i.e. >=1600 ms). To avoid this, the rctx_timedout() function should make sure that 'rctx->finish' is NULL. And in order to adjust the RTT values for the timed out server, 'rctx->no_response' should be true. Update the rctx_timedout() function to make those changes.	2025-03-18 16:20:59 +00:00
Aram Sargsyan	12e7dfa397	Fix resolver responses statistics counter The resquery_response() function increases the response counter without checking if the response was successful. Increase the counter only when the result indicates success.	2025-03-18 16:20:59 +00:00
Andoni Duarte Pintado	21ca763bca	Update BIND version for release	2025-03-11 11:37:59 +01:00
Andoni Duarte	474b7a04f1	new: doc: Prepare documentation for BIND 9.21.6 Merge branch 'andoni/prepare-documentation-for-bind-9.21.6' into 'v9.21.6-release' See merge request isc-private/bind9!784	2025-03-11 10:10:19 +00:00
Andoni Duarte Pintado	5dfcedd52d	Tweak and reword relase notes	2025-03-11 10:46:21 +01:00
Andoni Duarte Pintado	7c308c2298	Prepare release notes for BIND 9.21.6	2025-03-11 10:46:21 +01:00
Andoni Duarte Pintado	f0b5f0cbce	Generate changelog for BIND 9.21.6	2025-03-11 10:46:21 +01:00