xxx tmp

This reverts commit 0e52562e4eea06a4c1764ece09bc1bffcae51d32.

.gitignore

@@ -27,35 +27,6 @@ gen.dSYM/
 .deps/
 .dirstamp
 .libs/
-unit/atf-src/atf-c++/atf-c++.pc
-unit/atf-src/atf-c/atf-c.pc
-unit/atf-src/atf-c/defs.h
-unit/atf-src/atf-c/detail/process_helpers
-unit/atf-src/atf-config/atf-config
-unit/atf-src/atf-report/atf-report
-unit/atf-src/atf-report/fail_helper
-unit/atf-src/atf-report/misc_helpers
-unit/atf-src/atf-report/pass_helper
-unit/atf-src/atf-run/atf-run
-unit/atf-src/atf-run/bad_metadata_helper
-unit/atf-src/atf-run/expect_helpers
-unit/atf-src/atf-run/misc_helpers
-unit/atf-src/atf-run/pass_helper
-unit/atf-src/atf-run/several_tcs_helper
-unit/atf-src/atf-run/zero_tcs_helper
-unit/atf-src/atf-sh/atf-check
-unit/atf-src/atf-sh/atf-sh
-unit/atf-src/atf-sh/misc_helpers
-unit/atf-src/atf-version/atf-version
-unit/atf-src/atf-version/revision.h
-unit/atf-src/atf-version/revision.h.stamp
-unit/atf-src/bconfig.h
-unit/atf-src/bootstrap/atconfig
-unit/atf-src/doc/atf.7
-unit/atf-src/stamp-h1
-unit/atf-src/test-programs/c_helpers
-unit/atf-src/test-programs/cpp_helpers
-unit/atf-src/test-programs/sh_helpers
 # ccc-analyzer store its results in .plist directories
 *.plist/
 *~

.gitlab-ci.yml

@@ -116,7 +116,7 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
 #    - ./autogen.sh
   script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
+    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
     - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
   artifacts:
     paths:
@@ -156,14 +156,13 @@ stages:
     - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
   artifacts:
     paths:
-    - atf.out
     - kyua.log
     - kyua.results
     - kyua_html/
     expire_in: '1 week'
     when: on_failure
 
-precheck:debian:sid:amd64:
+sid:amd64:precheck:
   <<: *debian_sid_amd64_image
   stage: precheck
   script:
@@ -183,11 +182,16 @@ precheck:debian:sid:amd64:
     expire_in: '1 week'
     when: on_failure
 
-docs:debian:sid:amd64:
+🐞:sid:amd64:precheck:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script: util/check-cocci
+
+docs:sid:amd64:
   <<: *debian_sid_amd64_image
   stage: test
   dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
   script:
     - make -C doc/misc docbook
     - make -C doc/arm Bv9ARM.html
@@ -196,7 +200,7 @@ docs:debian:sid:amd64:
     - doc/arm/
     expire_in: '1 month'
 
-push:docs:
+docs:push:
   <<: *debian_sid_amd64_image
   stage: push
   dependencies: []
@@ -206,15 +210,15 @@ push:docs:
     - master@isc-projects/bind9
     - /^v9_.*$/@isc-projects/bind9
 
-#build:debian:jessie:amd64:
+#jessie:amd64:build:
 #  <<: *debian_jessie_amd64_image
 #  <<: *build_job
 #
-#build:debian:jessie:i386:
+#build:jessie:i386:
 #  <<: *debian_jessie_i386_image
 #  <<: *build_job
 #
-#build:debian:stretch:amd64:
+#build:stretch:amd64:
 #  <<: *debian_stretch_amd64_image
 #  <<: *build_job
 #
@@ -230,7 +234,7 @@ push:docs:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job
 
-build:centos:centos6:amd64:
+centos6:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -238,7 +242,7 @@ build:centos:centos6:amd64:
   <<: *centos_centos6_amd64_image
   <<: *build_job
 
-build:centos:centos7:amd64:
+centos7:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -246,14 +250,14 @@ build:centos:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *build_job
 
-build:clang:debian:stretch:amd64:
+clang:stretch:amd64:build:
   variables:
     CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
   <<: *debian_stretch_amd64_image
   <<: *build_job
 
-build:debian:jessie:amd64:
+jessie:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -261,14 +265,14 @@ build:debian:jessie:amd64:
   <<: *debian_jessie_amd64_image
   <<: *build_job
 
-build:debian:stretch:amd64:
+stretch:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
   <<: *debian_stretch_amd64_image
   <<: *build_job
 
-build:debian:sid:amd64:
+sid:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -276,14 +280,23 @@ build:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *build_job
 
-build:clang:debian:stretch:i386:
+asan:sid:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+clang:stretch:i386:build:
   variables:
     CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
   <<: *debian_stretch_i386_image
   <<: *build_job
 
-build:debian:sid:i386:
+sid:i386:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -291,91 +304,103 @@ build:debian:sid:i386:
   <<: *debian_sid_i386_image
   <<: *build_job
 
-unittest:centos:centos6:amd64:
+unit:centos6:amd64:
   <<: *centos_centos6_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build
 
-unittest:centos:centos7:amd64:
+unit:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build
 
-unittest:debian:jessie:amd64:
+unit:jessie:amd64:
   <<: *debian_jessie_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:debian:jessie:amd64
+    - jessie:amd64:build
 
-unittest:debian:stretch:amd64:
+unit:stretch:amd64:
   <<: *debian_stretch_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:debian:stretch:amd64
+    - stretch:amd64:build
 
-unittest:debian:sid:amd64:
+unit:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
 
-unittest:clang:debian:stretch:amd64:
+unit:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - asan:sid:amd64:build
+
+unit:clang:stretch:amd64:
   <<: *debian_stretch_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:clang:debian:stretch:amd64
+    - clang:stretch:amd64:build
 
-unittest:debian:sid:i386:
+unit:sid:i386:
   <<: *debian_sid_i386_image
   <<: *unit_test_job
   dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build
 
-systemtest:centos:centos6:amd64:
+system:centos6:amd64:
   <<: *centos_centos6_amd64_image
   <<: *system_test_job
   dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build
 
-systemtest:centos:centos7:amd64:
+system:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *system_test_job
   dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build
 
-systemtest:debian:jessie:amd64:
+system:jessie:amd64:
   <<: *debian_jessie_amd64_image
   <<: *system_test_job
   dependencies:
-    - build:debian:jessie:amd64
+    - jessie:amd64:build
 
-systemtest:debian:stretch:amd64:
+system:stretch:amd64:
   <<: *debian_stretch_amd64_image
   <<: *system_test_job
   dependencies:
-    - build:debian:stretch:amd64
+    - stretch:amd64:build
 
-systemtest:debian:sid:amd64:
+system:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
 
-systemtest:debian:sid:i386:
+system:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - asan:sid:amd64:build
+
+system:sid:i386:
   <<: *debian_sid_i386_image
   <<: *system_test_job
   dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build
 
-install:debian:sid:amd64:
+install:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *install_test_job
   dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
 
-pkcs11:build:debian:sid:amd64:
+pkcs11:sid:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
@@ -383,14 +408,34 @@ pkcs11:build:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *build_job
 
-pkcs11:unittest:debian:sid:amd64:
+pkcs11:unit:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
-    - pkcs11:build:debian:sid:amd64
+    - pkcs11:sid:amd64:build
 
-pkcs11:systemtest:debian:sid:amd64:
+pkcs11:system:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
-    - pkcs11:build:debian:sid:amd64
+    - pkcs11:sid:amd64:build
+
+noassert:sid:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+noassert:unit:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - noassert:sid:amd64:build
+
+noassert:system:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - noassert:sid:amd64:build

.gitlab/issue_templates/release.md

@@ -1,19 +1,21 @@
 ## Release Checklist
 
- - [ ] (Manager) Check for the presence of a milestone for the release.
+ - [ ] (Manager) Check for the presence of a milestone for the release:
     - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
  - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
- - (SwEng) Prepare the sources for tarball generation.
+ - (SwEng) Prepare the sources for tarball generation:
+   - [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
    - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
    - [ ] Update API files for libraries with new version information.
    - [ ] Change software version and library versions in configure.in (new major release only).
-   - [ ] Ensure Kyua and ATF files are correct.
    - [ ] Rebuild configure using autoconf on docs.isc.org.
    - [ ] Update CHANGES.
    - [ ] Update CHANGES.SE (subscription branch only).
    - [ ] Update "version".
    - [ ] Update "readme.md".
-   - [ ] Ensure the release notes are correct for this release (content, formatting, etc.).
+   - Check the release notes are correct:
+     - [ ] Compare content with merge requests for the release.
+     - [ ] Check formatting.
    - [ ] Build documentation on docs.isc.org.
    - [ ] Commit changes and make sure the gitlab-ci tests are passing.
    - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
@@ -24,9 +26,19 @@
  - [ ] (QA) Request the signature on the tarballs.
  - [ ] (QA) Check signatures on tarballs.
  - [ ] (QA) Tell Support to handle notification of release.
- - [ ] (Support) Make tarballs and signatures available to download.
- - [ ] (Manager) Update [https://wiki.isc.org/bin/view/Main/BindReleaseDates](BIND release dates page) when public announcement has been made.
- - [ ] (Manager) Inform marketing of the release
+ - [ ] (Manager) Inform Marketing of the release
+ - [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
 
  - [ ] (SwEng) Update DEB and RPM packages
  - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
+
+## Support
+ - [ ] Make tarballs and signatures available to download.
+ - [ ] Write release email to bind9-announce.
+ - [ ] Write email to bind9-users (if a major release).
+ - [ ] Update tickets in case of waiting support customers.
+
+## Marketing
+ - [ ] Post short note to Twitter.
+ - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
+ - [ ] Write blog article (if a major release).

Atffile

@@ -1,5 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: lib

CHANGES

@@ -1,3 +1,64 @@
+5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
+
+5099.	[func]		Failed mutex and conditional creations are always
+			fatal. [GL #674]
+
+	--- 9.13.4 released ---
+
+5098.	[func]		Failed memory allocations are now fatal. [GL #674]
+
+5097.	[cleanup]	Remove embedded ATF unit testing framework
+			from BIND source distribution.  [GL !875]
+
+5096.	[func]		Use multiple event loops in socket code, and
+			make network threads CPU-affinitive.  This
+			significantly improves performance on large
+			systems. [GL #666]
+
+5095.	[test]		Converted all unit tests from ATF to CMocka;
+			removed the source code for the ATF libraries.
+			Build with "configure --with-cmocka" to enable
+			unit testing. [GL #620]
+
+5094.	[func]		Add 'dig -r' to disable reading of .digrc. [GL !970]
+
+5093.	[bug]		Log lame qname-minimization servers only if they're
+			really lame. [GL #671]
+
+5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
+			GSS-TSIG. [GL #558]
+
+5091.	[func]		Two new global and per-view options min-cache-ttl
+			and min-ncache-ttl [GL #613]
+
+5090.	[bug]		dig and mdig failed to properly preparse dash value
+			pairs when value was a seperate argument and started
+			with a dash. [GL #584]
+
+5089.	[bug]		Restore localhost fallback in dig and host which is
+			used when no nameserver addresses present in
+			/etc/resolv.conf are usable due to the requested
+			address family restrictions. [GL #433]
+
+5088.	[bug]		dig/host/nslookup could crash when interrupted close to
+			a query timeout. [GL #599]
+
+5087.	[test]		Check that result tables are complete. [GL #676]
+
+5086.	[func]		Log of RPZ now includes the QTYPE and QCLASS. [GL #623]
+
+5085.	[bug]		win32: Restore looking up nameservers, search list,
+			etc. [GL #186]
+
+5084.	[placeholder]
+
+5083.	[func]		Add autoconf macro AX_POSIX_SHELL, so we
+			can use POSIX-compatible shell features
+			in the scripts.
+
+5082.	[bug]		Fixed a race that could cause a crash in
+			dig/host/nslookup. [GL #650]
+
 5081.	[func]		Use per-worker queues in task manager, make task
 			runners CPU-affine. [GL #659]
 

Makefile.in

@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@
 
 VERSION=@BIND9_VERSION@
 
-SUBDIRS =	make unit lib fuzz bin doc
+SUBDIRS =	make lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h
 

PLATFORMS

@@ -59,3 +59,31 @@ These are platforms on which BIND is known not to build or run:
   * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
   * Platforms that don't support atomic operations (via compiler or
     library)
+  * Linux without NPTL (Native POSIX Thread Library)
+
+Platform quirks
+
+ARM
+
+If the compilation ends with following error:
+
+Error: selected processor does not support `yield' in ARM mode
+
+You will need to set -march compiler option to native, so the compiler
+recognizes yield assembler instruction. The proper way to set -march=
+native would be to put it into CFLAGS, e.g. run ./configure like this:
+CFLAGS="-march=native -Os -g" ./configure plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from
+Debian armhf documentation):
+
+  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
+    recommended build option is -march=armv7-a.
+
+  * FPU should be set at VFPv3-D16 as they represent the miminum
+    specification of the processors to support here, therefore the
+    recommended build option is -mfpu=vfpv3-d16.
+
+The configure command should look like this:
+
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure

README

@@ -104,6 +104,7 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:
 
+  * Socket and task code has been refactored to improve performance.
   * QNAME minimization, as described in RFC 7816, is now supported.
   * "Root key sentinel" support, enabling validating resolvers to indicate
     via a special query which trust anchors are configured for the root
@@ -289,8 +290,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
 
-Unit tests are implemented using Automated Testing Framework (ATF). To run
-them, use configure --with-atf, then run make test or make unit.
+Unit tests are implemented using the CMocka unit testing framework. To
+build them, use configure --with-cmocka. Execution of tests is done by the
+Kyua test execution engine; if the kyua command is available, then unit
+tests can be run via make test or make unit.
 
 Documentation
 

README.md

@@ -122,6 +122,7 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
+* Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate
   via a special query which trust anchors are configured for the root zone.
@@ -307,9 +308,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
 
-Unit tests are implemented using Automated Testing Framework (ATF).
-To run them, use `configure --with-atf`, then run `make test` or
-`make unit`.
+Unit tests are implemented using the CMocka unit testing framework.
+To build them, use `configure --with-cmocka`. Execution of tests is done
+by the Kyua test execution engine; if the `kyua` command is available,
+then unit tests can be run via `make test` or `make unit`.
 
 ### <a name="doc"/> Documentation
 

aclocal.m4

@@ -289,6 +289,7 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])

bin/check/named-checkconf.c

@@ -282,8 +282,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -300,8 +302,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -327,8 +331,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -345,8 +351,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -366,8 +374,10 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -383,8 +393,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -394,14 +406,16 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;

bin/check/named-checkzone.c

@@ -139,12 +139,14 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
 
-	if (PROGCMP("named-checkzone"))
+	if (PROGCMP("named-checkzone")) {
 		progmode = progmode_check;
-	else if (PROGCMP("named-compilezone"))
+	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {

bin/confgen/ddns-confgen.c

@@ -125,10 +125,12 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
 		quiet = true;
-	} else if (PROGCMP("ddns-confgen"))
+	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	isc_commandline_errprint = false;
 

bin/delv/delv.c

@@ -765,7 +765,14 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);
 
+
  cleanup:
+	if (bindkeys != NULL) {
+		cfg_obj_destroy(parser, &bindkeys);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
 	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
@@ -1167,6 +1174,8 @@ plus_option(char *option) {
  * options: "46a:b:c:d:himp:q:t:vx:";
  */
 static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";
+
 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
 	char opt, *value;
@@ -1224,6 +1233,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
@@ -1367,8 +1377,10 @@ preparse_args(int argc, char **argv) {
 	char *option;
 
 	for (argc--, argv++; argc > 0; argc--, argv++) {
-		if (argv[0][0] != '-')
+		if (argv[0][0] != '-') {
 			continue;
+		}
+
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
@@ -1391,6 +1403,27 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+
+		if (strlen(option) == 0U) {
+			continue;
+		}
+
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U)
+		{
+			/* Error or value in option. */
+			continue;
+		}
+
+		/* Dash value is next argument so we need to skip it. */
+		argc--;
+		argv++;
+
+		/* Handle missing argument */
+		if (argc == 0) {
+			break;
+		}
 	}
 }
 
@@ -1590,7 +1623,7 @@ main(int argc, char *argv[]) {
 		fatal("failed to create mctx");
 
 	CHECK(isc_appctx_create(mctx, &actx));
-	CHECK(isc_taskmgr_createinctx(mctx, actx, 1, 0, &taskmgr));
+	CHECK(isc_taskmgr_createinctx(mctx, actx, 1, &taskmgr));
 	CHECK(isc_socketmgr_createinctx(mctx, actx, &socketmgr));
 	CHECK(isc_timermgr_createinctx(mctx, actx, &timermgr));
 

bin/dig/dig.1

@@ -74,7 +74,9 @@ will perform an NS query for "\&." (the root)\&.
 It is possible to set per\-user defaults for
 \fBdig\fR
 via
-${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
+${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
+\fB\-r\fR
+option disables this feature, for scripts that need predictable behaviour\&.
 .PP
 The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
 \fB\-t\fR
@@ -174,11 +176,6 @@ reads a list of lookup requests to process from the given
 using the command\-line interface\&.
 .RE
 .PP
-\-i
-.RS 4
-Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
-.RE
-.PP
 \-k \fIkeyfile\fR
 .RS 4
 Sign queries using TSIG using a key read from the given file\&. Key files can be generated using
@@ -208,6 +205,12 @@ The domain name to query\&. This is useful to distinguish the
 from other arguments\&.
 .RE
 .PP
+\-r
+.RS 4
+Do not read options from
+${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
+.RE
+.PP
 \-t \fItype\fR
 .RS 4
 The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
@@ -246,9 +249,7 @@ arguments\&.
 \fBdig\fR
 automatically performs a lookup for a name like
 94\&.2\&.0\&.192\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the
-\fB\-i\fR
-option)\&.
+and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
 .RE
 .PP
 \-y \fI[hmac:]\fR\fIkeyname:secret\fR
@@ -468,12 +469,16 @@ option is enabled\&. If short form answers are requested, the default is not to
 .PP
 \fB+[no]idnin\fR
 .RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
+Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]idnout\fR
 .RS 4
-Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]ignore\fR
@@ -795,7 +800,10 @@ has been built with IDN (internationalized domain name) support, it can accept a
 appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
 \fI+noidnin\fR
 and
-\fI+noidnout\fR\&.
+\fI+noidnout\fR
+or define the
+\fBIDN_DISABLE\fR
+environment variable\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf

bin/dig/dig.c

@@ -66,7 +66,7 @@ static char hexcookie[81];
 
 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false;
+	ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;
 
 /*% opcode text */
@@ -157,6 +157,7 @@ help(void) {
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
+"                 -r                  (do not read ~/.digrc)\n"
 "                 -t type             (specify query type)\n"
 "                 -u                  (display times in usec instead of msec)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
@@ -1543,8 +1544,8 @@ plus_option(char *option, bool is_batchfile,
 /*%
  * #true returned if value was used
  */
-static const char *single_dash_opts = "46dhimnuv";
-static const char *dash_opts = "46bcdfhikmnptvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone,
@@ -1615,6 +1616,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case 'n':
 			/* deprecated */
 			break;
+		case 'r':
+			debug("digrc (late)");
+			digrc = false;
+			break;
 		case 'u':
 			(*lookup)->use_usec = true;
 			break;
@@ -1841,11 +1846,23 @@ preparse_args(int argc, char **argv) {
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'd':
+				/* For debugging early startup */
+				debugging = true;
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
+			case 'r':
+				/*
+				 * Must be done early, because ~/.digrc
+				 * is read before command line parsing
+				 */
+				debug("digrc (early)");
+				digrc = false;
+				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
@@ -1859,6 +1876,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }
 
@@ -1925,8 +1956,9 @@ parse_args(bool is_batchfile, bool config_only,
 		 */
 		INSIST(batchfp == NULL);
 		homedir = getenv("HOME");
-		if (homedir != NULL) {
+		if (homedir != NULL && digrc) {
 			unsigned int n;
+			debug("digrc (open)");
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
 			if (n < sizeof(rcfile)) {

bin/dig/dig.docbook

@@ -131,9 +131,10 @@
 
     <para>
       It is possible to set per-user defaults for <command>dig</command> via
-      <filename>${HOME}/.digrc</filename>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <filename>${HOME}/.digrc</filename>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <option>-r</option> option disables this feature, for
+      scripts that need predictable behaviour.
     </para>
 
     <para>
@@ -323,6 +324,16 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-r</term>
+	<listitem>
+	  <para>
+	    Do not read options from <filename>${HOME}/.digrc</filename>.
+	    This is useful for scripts that need predictable behaviour.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>

bin/dig/dig.html

@@ -106,9 +106,10 @@
 
     <p>
       It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <code class="option">-r</code> option disables this feature, for
+      scripts that need predictable behaviour.
     </p>
 
     <p>
@@ -227,14 +228,6 @@
 	    <span class="command"><strong>dig</strong></span> using the command-line interface.
 	  </p>
 	</dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-	  <p>
-	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
-	    domain, which is no longer in use. Obsolete bit string
-	    label queries (RFC 2874) are not attempted.
-	  </p>
-	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
 <dd>
 	  <p>
@@ -274,6 +267,13 @@
 	    the <em class="parameter"><code>name</code></em> from other arguments.
 	  </p>
 	</dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+	  <p>
+	    Do not read options from <code class="filename">${HOME}/.digrc</code>.
+	    This is useful for scripts that need predictable behaviour.
+	  </p>
+	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
@@ -324,8 +324,7 @@
 	    <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
 	    query type and class to PTR and IN respectively. IPv6
 	    addresses are looked up using nibble format under the
-	    IP6.ARPA domain (but see also the <code class="option">-i</code>
-	    option).
+	    IP6.ARPA domain.
 	  </p>
 	</dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
@@ -631,7 +630,13 @@
 	    <p>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to process IDN input.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process IDN input when standard output
+	      is a tty.  The IDN processing on input is disabled when
+	      dig output is redirected to files, pipes, and other
+	      non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -639,7 +644,13 @@
 	    <p>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to convert output.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process puny code on output when
+	      standard output is a tty.  The puny code processing on
+	      output is disabled when dig output is redirected to
+	      files, pipes, and other non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -1061,7 +1072,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
       reply from the server.
       If you'd like to turn off the IDN support for some reason, use
       parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em>.
+      <em class="parameter"><code>+noidnout</code></em> or define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+
     </p>
   </div>
 

bin/dig/dighost.c

@@ -1227,6 +1227,19 @@ create_search_list(irs_resconf_t *resconf) {
 	}
 }
 
+/*%
+ * Append 'addr' to the list of servers to be queried.  This function is only
+ * called when no server addresses are explicitly specified and either libirs
+ * returns an empty list of servers to use or none of the addresses returned by
+ * libirs are usable due to the specified address family restrictions.
+ */
+static void
+add_fallback_nameserver(const char *addr) {
+	dig_server_t *server = make_server(addr, addr);
+	ISC_LINK_INIT(server, link);
+	ISC_LIST_APPEND(server_list, server, link);
+}
+
 /*%
  * Setup the system as a whole, reading key information and resolv.conf
  * settings.
@@ -1272,6 +1285,16 @@ setup_system(bool ipv4only, bool ipv6only) {
 		get_server_list(resconf);
 	}
 
+	/* If we don't find a nameserver fall back to localhost */
+	if (ISC_LIST_EMPTY(server_list)) {
+		if (have_ipv6) {
+			add_fallback_nameserver("::1");
+		}
+		if (have_ipv4) {
+			add_fallback_nameserver("127.0.0.1");
+		}
+	}
+
 	irs_resconf_destroy(&resconf);
 
 #ifdef HAVE_SETLOCALE
@@ -1340,7 +1363,7 @@ setup_libs(void) {
 
 	isc_log_setdebuglevel(lctx, 0);
 
-	result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, 1, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);
@@ -1367,8 +1390,7 @@ setup_libs(void) {
 	isc_mempool_setfreemax(commctx, 6);
 	isc_mempool_setfillcount(commctx, 2);
 
-	result = isc_mutex_init(&lookup_lock);
-	check_result(result, "isc_mutex_init");
+	isc_mutex_init(&lookup_lock);
 }
 
 typedef struct dig_ednsoptname {
@@ -1519,17 +1541,21 @@ clear_query(dig_query_t *query) {
 
 	debug("clear_query(%p)", query);
 
-	if (query->timer != NULL)
+	if (query->timer != NULL) {
 		isc_timer_detach(&query->timer);
+	}
 	lookup = query->lookup;
 
-	if (lookup->current_query == query)
+	if (lookup->current_query == query) {
 		lookup->current_query = NULL;
+	}
 
-	if (ISC_LINK_LINKED(query, link))
+	if (ISC_LINK_LINKED(query, link)) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
-	if (ISC_LINK_LINKED(query, clink))
+	}
+	if (ISC_LINK_LINKED(query, clink)) {
 		ISC_LIST_UNLINK(lookup->connecting, query, clink);
+	}
 	INSIST(query->recvspace != NULL);
 
 	if (query->sock != NULL) {
@@ -1541,10 +1567,13 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->tmpsendspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	if (query->waiting_senddone)
+
+	if (query->waiting_senddone) {
 		query->pending_free = true;
-	else
+	} else {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}
 }
 
 /*%
@@ -2284,7 +2313,7 @@ setup_lookup(dig_lookup_t *lookup) {
 
 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
@@ -2341,6 +2370,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 
 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
@@ -2452,13 +2482,14 @@ setup_lookup(dig_lookup_t *lookup) {
 
 	for (serv = ISC_LIST_HEAD(lookup->my_server_list);
 	     serv != NULL;
-	     serv = ISC_LIST_NEXT(serv, link)) {
+	     serv = ISC_LIST_NEXT(serv, link))
+	{
 		query = isc_mem_allocate(mctx, sizeof(dig_query_t));
-		if (query == NULL)
+		if (query == NULL) {
 			fatal("memory allocation failure in %s:%d",
 			      __FILE__, __LINE__);
-		debug("create query %p linked to lookup %p",
-		       query, lookup);
+		}
+		debug("create query %p linked to lookup %p", query, lookup);
 		query->lookup = lookup;
 		query->timer = NULL;
 		query->waiting_connect = false;
@@ -2482,16 +2513,21 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->sock = NULL;
 		query->recvspace = isc_mempool_get(commctx);
 		query->tmpsendspace = isc_mempool_get(commctx);
-		if (query->recvspace == NULL)
+		if (query->recvspace == NULL) {
 			fatal("memory allocation failure");
+		}
 
 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
-		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace, COMMSIZE);
+		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace,
+				COMMSIZE);
 		query->sendbuf = lookup->renderbuf;
 
 		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);
+
+		query->magic = DIG_QUERY_MAGIC;
+
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}
 
@@ -2500,9 +2536,10 @@ setup_lookup(dig_lookup_t *lookup) {
 		extrabytes = 0;
 		dighost_printmessage(ISC_LIST_HEAD(lookup->q),
 				     lookup->sendmsg, true);
-		if (lookup->stats)
+		if (lookup->stats) {
 			printf(";; QUERY SIZE: %u\n\n",
 			       isc_buffer_usedlength(&lookup->renderbuf));
+		}
 	}
 	return (true);
 }
@@ -2528,20 +2565,26 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	INSIST(sendcount >= 0);
 
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	query->waiting_senddone = false;
 	l = query->lookup;
 
-	if (l->ns_search_only && !l->trace_root && !l->tcp_mode) {
+	if (!query->pending_free && l->ns_search_only &&
+	    !l->trace_root && !l->tcp_mode)
+	{
 		debug("sending next, since searching");
 		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
+		if (next != NULL) {
 			send_udp(next);
+		}
 	}
 
 	isc_event_free(&event);
 
-	if (query->pending_free)
+	if (query->pending_free) {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}
 
 	check_if_done();
 	UNLOCK_LOOKUP;
@@ -2559,6 +2602,7 @@ cancel_lookup(dig_lookup_t *lookup) {
 	debug("cancel_lookup()");
 	query = ISC_LIST_HEAD(lookup->q);
 	while (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		next = ISC_LIST_NEXT(query, link);
 		if (query->sock != NULL) {
 			isc_socket_cancel(query->sock, global_task,
@@ -2578,6 +2622,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 	dig_lookup_t *l;
 	unsigned int local_timeout;
 	isc_result_t result;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	debug("bringup_timer()");
 	/*
@@ -2642,6 +2687,7 @@ send_tcp_connect(dig_query_t *query) {
 	isc_result_t result;
 	dig_query_t *next;
 	dig_lookup_t *l;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	debug("send_tcp_connect(%p)", query);
 
@@ -2770,6 +2816,7 @@ send_udp(dig_query_t *query) {
 	dig_query_t *next;
 	isc_region_t r;
 	isc_socketevent_t *sevent;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	debug("send_udp(%p)", query);
 
@@ -2871,11 +2918,17 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 
 	LOCK_LOOKUP;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	l = query->lookup;
 	isc_event_free(&event);
 
 	INSIST(!free_now);
 
+	if (cancel_now) {
+		UNLOCK_LOOKUP;
+		return;
+	}
+
 	if ((query != NULL) && (query->lookup->current_query != NULL) &&
 	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
 	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
@@ -2957,6 +3010,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	recvcount--;
 	INSIST(recvcount >= 0);
@@ -3031,6 +3085,7 @@ launch_next_query(dig_query_t *query, bool include_question) {
 	isc_result_t result;
 	dig_lookup_t *l;
 	isc_region_t r;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	INSIST(!free_now);
 
@@ -3103,6 +3158,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = sevent->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 
 	INSIST(query->waiting_connect);
 
@@ -3994,6 +4050,7 @@ do_lookup(dig_lookup_t *lookup) {
 	lookup->pending = true;
 	query = ISC_LIST_HEAD(lookup->q);
 	if (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		if (lookup->tcp_mode)
 			send_tcp_connect(query);
 		else
@@ -4141,7 +4198,7 @@ destroy_libs(void) {
 	}
 
 	UNLOCK_LOOKUP;
-	DESTROYLOCK(&lookup_lock);
+	isc_mutex_destroy(&lookup_lock);
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 

bin/dig/host.1

@@ -112,11 +112,6 @@ Print debugging traces\&. Equivalent to the
 verbose option\&.
 .RE
 .PP
-\-i
-.RS 4
-Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
-.RE
-.PP
 \-l
 .RS 4
 List zone: The
@@ -257,7 +252,7 @@ If
 \fBhost\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBhost\fR
-appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
 \fBIDN_DISABLE\fR
 environment variable\&. The IDN support is disabled if the variable is set when
 \fBhost\fR

bin/dig/host.html

@@ -138,15 +138,6 @@
 	    Equivalent to the <code class="option">-v</code> verbose option.
 	  </p>
 	</dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-	  <p>
-	    Obsolete.
-	    Use the IP6.INT domain for reverse lookups of IPv6
-	    addresses as defined in RFC1886 and deprecated in RFC4159.
-	    The default is to use IP6.ARPA as specified in RFC3596.
-	  </p>
-	</dd>
 <dt><span class="term">-l</span></dt>
 <dd>
 	  <p>
@@ -311,7 +302,7 @@
       <span class="command"><strong>host</strong></span> appropriately converts character encoding of
       domain name before sending a request to DNS server or displaying a
       reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
       the <code class="envar">IDN_DISABLE</code> environment variable.
       The IDN support is disabled if the variable is set when
       <span class="command"><strong>host</strong></span> runs.

bin/dig/include/dig/dig.h

@@ -26,6 +26,7 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
+#include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/sockaddr.h>
@@ -81,6 +82,11 @@ typedef struct dig_server dig_server_t;
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;
 
+#define DIG_QUERY_MAGIC		ISC_MAGIC('D','i','g','q')
+
+#define DIG_VALID_QUERY(x)	ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)
+
+
 /*% The dig_lookup structure */
 struct dig_lookup {
 	bool
@@ -184,6 +190,7 @@ struct dig_lookup {
 
 /*% The dig_query structure */
 struct dig_query {
+	unsigned int magic;
 	dig_lookup_t *lookup;
 	bool waiting_connect,
 		pending_free,

bin/dig/nslookup.1

@@ -277,6 +277,17 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 \fBnslookup\fR
 returns with an exit status of 1 if any query failed, and 0 otherwise\&.
+.SH "IDN SUPPORT"
+.PP
+If
+\fBnslookup\fR
+has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
+\fBnslookup\fR
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
+\fBIDN_DISABLE\fR
+environment variable\&. The IDN support is disabled if the variable is set when
+\fBnslookup\fR
+runs or when the standard output is not a tty\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf

bin/dig/nslookup.html

@@ -362,14 +362,31 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.11"></a><h2>FILES</h2>
+<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
+
+    <p>
+      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
+      a tty.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.12"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/resolv.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.13"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)

bin/dnssec/dnssec-cds.c

@@ -163,8 +163,8 @@ verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	if (verbose < 3) {
 		vbprintf(level, "%s %s\n", msg, timestr);
 	} else {
-		vbprintf(level, "%s %s (%lld)\n",
-			 msg, timestr, (long long)time);
+		vbprintf(level, "%s %s (%" PRIu32 ")\n",
+			 msg, timestr, time);
 	}
 }
 

bin/dnssec/dnssec-keyfromlabel.8

@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -63,9 +63,9 @@ option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
 \fB\-3\fR
 is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR

bin/dnssec/dnssec-keyfromlabel.html

@@ -90,7 +90,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>
@@ -103,9 +103,9 @@
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
 	    along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    will be used instead.
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using

bin/dnssec/dnssec-keygen.8

@@ -62,13 +62,13 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 This parameter
 \fImust\fR

bin/dnssec/dnssec-keygen.html

@@ -100,7 +100,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>
@@ -109,9 +109,9 @@
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
 	    along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    will be used instead.
 	  </p>
 	  <p>
 	    This parameter <span class="emphasis"><em>must</em></span> be specified except

bin/dnssec/dnssec-signzone.c

@@ -533,8 +533,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		arraysize += dns_rdataset_count(&sigset);
 	wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
 	nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
-	if (wassignedby == NULL || nowsignedby == NULL)
-		fatal("out of memory");
 
 	for (i = 0; i < arraysize; i++)
 		wassignedby[i] = nowsignedby[i] = false;
@@ -3855,7 +3853,7 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
 
-	result = isc_taskmgr_create(mctx, ntasks, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, ntasks, &taskmgr);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to create task manager: %s",
 		      isc_result_totext(result));
@@ -3876,9 +3874,11 @@ main(int argc, char *argv[]) {
 			      isc_result_totext(result));
 	}
 
-	RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
-	if (printstats)
-		RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
+	isc_mutex_init(&namelock);
+
+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}
 
 	presign();
 	TIME_NOW(&sign_start);
@@ -3936,9 +3936,9 @@ main(int argc, char *argv[]) {
 		check_result(result, "dns_master_dumptostream3");
 	}
 
-	DESTROYLOCK(&namelock);
+	isc_mutex_destroy(&namelock);
 	if (printstats)
-		DESTROYLOCK(&statslock);
+		isc_mutex_destroy(&statslock);
 
 	if (!output_stdout) {
 		result = isc_stdio_close(outfp);

bin/named/config.c

@@ -174,6 +174,8 @@ options {\n\
 	max-recursion-queries 75;\n\
 	max-stale-ttl 604800; /* 1 week */\n\
 	message-compression yes;\n\
+	min-ncache-ttl 0; /* 0 hours */\n\
+	min-cache-ttl 0; /* 0 seconds */\n\
 #	min-roots <obsolete>;\n\
 	minimal-any false;\n\
 	minimal-responses no-auth-recursive;\n\
@@ -457,6 +459,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 		ztype = dns_zone_redirect;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (ztype);
 }
@@ -1029,6 +1032,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 	if (typep != NULL)

bin/named/logconf.c

@@ -157,6 +157,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		type = ISC_LOG_TOFILE;

bin/named/main.c

@@ -793,10 +793,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+		named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -806,7 +803,7 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 
-	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
+	result = isc_taskmgr_create(named_g_mctx, named_g_cpus,
 				    &named_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -824,7 +821,7 @@ create_managers(void) {
 	}
 
 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_cpus);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
@@ -1068,14 +1065,20 @@ setup(void) {
 	/*
 	 * Get the initial resource limits.
 	 */
-	(void)isc_resource_getlimit(isc_resource_stacksize,
-				    &named_g_initstacksize);
-	(void)isc_resource_getlimit(isc_resource_datasize,
-				    &named_g_initdatasize);
-	(void)isc_resource_getlimit(isc_resource_coresize,
-				    &named_g_initcoresize);
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+#ifndef WIN32
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize)
+		      == ISC_R_SUCCESS);
+#endif
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 
 	/*
 	 * System resources cannot effectively be tuned on some systems.
@@ -1083,8 +1086,9 @@ setup(void) {
 	 */
 	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 	if (old_openfiles != named_g_initopenfiles) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2018-10-23
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-10\-23" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,6 +199,7 @@ options {
 	    ] [ dscp \fIinteger\fR ];
 	alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
 	    * ) ] [ dscp \fIinteger\fR ];
+	answer\-cookie \fIboolean\fR;
 	attach\-cache \fIstring\fR;
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
@@ -264,8 +265,8 @@ options {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; \&.\&.\&. };
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; \&.\&.\&. };
 	dnstap\-identity ( \fIquoted_string\fR | none | hostname );
 	dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
 	    \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
@@ -343,6 +344,8 @@ options {
 	memstatistics \fIboolean\fR;
 	memstatistics\-file \fIquoted_string\fR;
 	message\-compression \fIboolean\fR;
+	min\-cache\-ttl \fIttlval\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -632,8 +635,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; \&.\&.\&. };
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; \&.\&.\&. };
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -914,10 +917,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
 		update\-policy ( local | { ( deny | grant ) \fIstring\fR (
-		    6to4\-self | external | krb5\-self | krb5\-subdomain |
-		    ms\-self | ms\-subdomain | name | self | selfsub |
-		    selfwild | subdomain | tcp\-self | wildcard | zonesub )
-		    [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+		    6to4\-self | external | krb5\-self | krb5\-selfsub |
+		    krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
+		    name | self | selfsub | selfwild | subdomain | tcp\-self
+		    | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
 		use\-alt\-transfer\-source \fIboolean\fR;
 		zero\-no\-soa\-ttl \fIboolean\fR;
 		zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1020,9 +1023,10 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	    stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
-	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
-	    | name | self | selfsub | selfwild | subdomain | tcp\-self |
-	    wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+	    external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
+	    | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
+	    | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
+	    \fIrrtypelist\fR; \&.\&.\&. };
 	use\-alt\-transfer\-source \fIboolean\fR;
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zone\-statistics ( full | terse | none | \fIboolean\fR );

bin/named/named.conf.docbook

@@ -337,6 +337,8 @@ options {
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;

bin/named/named.conf.html

@@ -180,6 +180,7 @@ options
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
 	    * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
+	answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	attach-cache <em class="replaceable"><code>string</code></em>;<br>
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
@@ -245,8 +246,8 @@ options
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    response ) ]; ... };<br>
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+	    ( query | response ) ]; ... };<br>
 	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
 	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
 	    <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
@@ -324,6 +325,8 @@ options
 	memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
 	memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -601,8 +604,8 @@ view
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    response ) ]; ... };<br>
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+	    ( query | response ) ]; ... };<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -883,10 +886,10 @@ view
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 		update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-		    6to4-self | external | krb5-self | krb5-subdomain |<br>
-		    ms-self | ms-subdomain | name | self | selfsub |<br>
-		    selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-		    [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+		    6to4-self | external | krb5-self | krb5-selfsub |<br>
+		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+		    name | self | selfsub | selfwild | subdomain | tcp-self<br>
+		    | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 		use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 		zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 		zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -986,9 +989,10 @@ zone
 	    stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-	    | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-	    wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+	    | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+	    <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 	use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>

bin/named/server.c

@@ -305,6 +305,13 @@ typedef struct catz_chgzone_event {
 	bool mod;
 } catz_chgzone_event_t;
 
+typedef struct {
+	unsigned int magic;
+#define DZARG_MAGIC		ISC_MAGIC('D', 'z', 'a', 'r')
+	isc_buffer_t **text;
+	isc_result_t result;
+} ns_dzarg_t;
+
 /*
  * These zones should not leak onto the Internet.
  */
@@ -1145,6 +1152,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	sa = *(cfg_obj_assockaddr(obj));
@@ -1166,6 +1174,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	if (result != ISC_R_SUCCESS)
 		return (ISC_R_SUCCESS);
@@ -1273,20 +1282,22 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	obj = cfg_tuple_get(ent, "ordering");
 	INSIST(cfg_obj_isstring(obj));
 	str = cfg_obj_asstring(obj);
-	if (!strcasecmp(str, "fixed"))
+	if (!strcasecmp(str, "fixed")) {
 #if DNS_RDATASET_FIXED
 		mode = DNS_RDATASETATTR_FIXEDORDER;
 #else
 		mode = DNS_RDATASETATTR_CYCLIC;
 #endif /* DNS_RDATASET_FIXED */
-	else if (!strcasecmp(str, "random"))
+	} else if (!strcasecmp(str, "random")) {
 		mode = DNS_RDATASETATTR_RANDOMIZE;
-	else if (!strcasecmp(str, "cyclic"))
+	} else if (!strcasecmp(str, "cyclic")) {
 		mode = DNS_RDATASETATTR_CYCLIC;
-	else if (!strcasecmp(str, "none"))
+	} else if (!strcasecmp(str, "none")) {
 		mode = DNS_RDATASETATTR_NONE;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/*
 	 * "*" should match everything including the root (BIND 8 compat).
@@ -1418,14 +1429,16 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	(void)cfg_map_get(cpeer, "transfer-format", &obj);
 	if (obj != NULL) {
 		str = cfg_obj_asstring(obj);
-		if (strcasecmp(str, "many-answers") == 0)
+		if (strcasecmp(str, "many-answers") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_many_answers));
-		else if (strcasecmp(str, "one-answer") == 0)
+		} else if (strcasecmp(str, "one-answer") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_one_answer));
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -2718,7 +2731,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	catz_chgzone_event_t *event;
 	isc_task_t *task;
 	isc_result_t result;
-	isc_taskaction_t action;
+	isc_taskaction_t action = NULL;
 
 	switch (type) {
 	case DNS_EVENT_CATZADDZONE:
@@ -3943,8 +3956,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		view->checknames = false;
 	} else if (strcasecmp(str, "ignore") == 0) {
 		view->checknames = false;
-	} else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	obj = NULL;
 	result = named_config_get(maps, "zero-no-soa-ttl-cache", &obj);
@@ -4109,8 +4124,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = named_config_get(maps, "max-ncache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	view->maxncachettl = cfg_obj_asuint32(obj);
-	if (view->maxncachettl > 7 * 24 * 3600)
-		view->maxncachettl = 7 * 24 * 3600;
+
+	obj = NULL;
+	result = named_config_get(maps, "min-cache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->mincachettl = cfg_obj_asuint32(obj);
+
+	obj = NULL;
+	result = named_config_get(maps, "min-ncache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->minncachettl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "synth-from-dnssec", &obj);
@@ -4356,14 +4379,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj2 = cfg_tuple_get(obj, "response");
 		if (!cfg_obj_isvoid(obj2)) {
 			const char *resp = cfg_obj_asstring(obj2);
-			isc_result_t r;
+			isc_result_t r = DNS_R_SERVFAIL;
 
-			if (strcasecmp(resp, "drop") == 0)
+			if (strcasecmp(resp, "drop") == 0) {
 				r = DNS_R_DROP;
-			else if (strcasecmp(resp, "fail") == 0)
+			} else if (strcasecmp(resp, "fail") == 0) {
 				r = DNS_R_SERVFAIL;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 
 			dns_resolver_setquotaresponse(view->resolver,
 						      dns_quotatype_server, r);
@@ -4709,20 +4734,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->minimalresponses = dns_minimal_noauth;
 		} else if (strcasecmp(str, "no-auth-recursive") == 0) {
 			view->minimalresponses = dns_minimal_noauthrec;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
 	result = named_config_get(maps, "transfer-format", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	str = cfg_obj_asstring(obj);
-	if (strcasecmp(str, "many-answers") == 0)
+	if (strcasecmp(str, "many-answers") == 0) {
 		view->transfer_format = dns_many_answers;
-	else if (strcasecmp(str, "one-answer") == 0)
+	} else if (strcasecmp(str, "one-answer") == 0) {
 		view->transfer_format = dns_one_answer;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	obj = NULL;
 	result = named_config_get(maps, "trust-anchor-telemetry", &obj);
@@ -5036,14 +5065,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj2 = cfg_tuple_get(obj, "response");
 	if (!cfg_obj_isvoid(obj2)) {
 		const char *resp = cfg_obj_asstring(obj2);
-		isc_result_t r;
+		isc_result_t r = DNS_R_SERVFAIL;
 
-		if (strcasecmp(resp, "drop") == 0)
+		if (strcasecmp(resp, "drop") == 0) {
 			r = DNS_R_DROP;
-		else if (strcasecmp(resp, "fail") == 0)
+		} else if (strcasecmp(resp, "fail") == 0) {
 			r = DNS_R_SERVFAIL;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 
 		dns_resolver_setquotaresponse(view->resolver,
 					      dns_quotatype_zone, r);
@@ -5059,10 +5090,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v4_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
 			view->v4_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -5075,10 +5108,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v6_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
 			view->v6_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	CHECK(configure_view_acl(vconfig, config, named_g_config,
@@ -5281,7 +5316,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *empty_dbtype[4] =
 				    { "_builtin", "empty", NULL, NULL };
 		int empty_dbtypec = 4;
-		dns_zonestat_level_t statlevel;
+		dns_zonestat_level_t statlevel = dns_zonestat_none;
 
 		name = dns_fixedname_initname(&fixed);
 
@@ -5319,14 +5354,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				statlevel = dns_zonestat_none;
 		} else {
 			const char *levelstr = cfg_obj_asstring(obj);
-			if (strcasecmp(levelstr, "full") == 0)
+			if (strcasecmp(levelstr, "full") == 0) {
 				statlevel = dns_zonestat_full;
-			else if (strcasecmp(levelstr, "terse") == 0)
+			} else if (strcasecmp(levelstr, "terse") == 0) {
 				statlevel = dns_zonestat_terse;
-			else if (strcasecmp(levelstr, "none") == 0)
+			} else if (strcasecmp(levelstr, "none") == 0) {
 				statlevel = dns_zonestat_none;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 
 		for (empty = empty_zones[empty_zone];
@@ -5686,16 +5723,18 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 				    "forwarding");
 		fwdpolicy = dns_fwdpolicy_none;
 	} else {
-		if (forwardtype == NULL)
+		if (forwardtype == NULL) {
 			fwdpolicy = dns_fwdpolicy_first;
-		else {
+		} else {
 			const char *forwardstr = cfg_obj_asstring(forwardtype);
-			if (strcasecmp(forwardstr, "first") == 0)
+			if (strcasecmp(forwardstr, "first") == 0) {
 				fwdpolicy = dns_fwdpolicy_first;
-			else if (strcasecmp(forwardstr, "only") == 0)
+			} else if (strcasecmp(forwardstr, "only") == 0) {
 				fwdpolicy = dns_fwdpolicy_only;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 	}
 
@@ -7577,11 +7616,11 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 		goto cleanup;
 	}
 
-	putstr(text, "zone ");
-	putmem(text, (const void *) zone_name, zone_name_len);
-	putstr(text, " ");
-	putmem(text, (const void *) zone_config, zone_config_len);
-	putstr(text, ";\n");
+	CHECK(putstr(text, "zone "));
+	CHECK(putmem(text, (const void *) zone_name, zone_name_len));
+	CHECK(putstr(text, " "));
+	CHECK(putmem(text, (const void *) zone_config, zone_config_len));
+	CHECK(putstr(text, ";\n"));
 
 	cfg_parser_reset(named_g_addparser);
 	result = cfg_parse_buffer3(named_g_addparser, *text, zone_name, 0,
@@ -8906,7 +8945,7 @@ load_configuration(const char *filename, named_server_t *server,
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
 		named_g_memstatistics =
-			(isc_mem_debugging & ISC_MEM_DEBUGRECORD);
+			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
 	}
 
 	obj = NULL;
@@ -9001,6 +9040,7 @@ load_configuration(const char *filename, named_server_t *server,
 		server->sctx->cookiealg = ns_cookiealg_sha256;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	obj = NULL;
@@ -9311,7 +9351,11 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * zones.
 		 */
 		isc_refcount_increment(&zl->refs);
-		CHECK(dns_view_asyncload(view, reconfig, view_loaded, zl));
+		result = dns_view_asyncload(view, reconfig, view_loaded, zl);
+		if (result != ISC_R_SUCCESS) {
+			isc_refcount_decrement(&zl->refs);
+			goto cleanup;
+		}
 	}
 
  cleanup:
@@ -9575,8 +9619,8 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				     &server->in_roothints),
 		   "setting up root hints");
 
-	CHECKFATAL(isc_mutex_init(&server->reload_event_lock),
-		   "initializing reload event lock");
+	isc_mutex_init(&server->reload_event_lock);
+
 	server->reload_event =
 		isc_event_allocate(named_g_mctx, server,
 				   NAMED_EVENT_RELOAD,
@@ -9920,7 +9964,7 @@ static void
 named_server_reload(isc_task_t *task, isc_event_t *event) {
 	named_server_t *server = (named_server_t *)event->ev_arg;
 
-	INSIST(task = server->task);
+	INSIST(task == server->task);
 	UNUSED(task);
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -10790,10 +10834,10 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	}
 	if (ptr != NULL) {
 		if (!found) {
-			putstr(text, "view '");
-			putstr(text, ptr);
-			putstr(text, "' not found");
-			putnull(text);
+			CHECK(putstr(text, "view '"));
+			CHECK(putstr(text, ptr));
+			CHECK(putstr(text, "' not found"));
+			CHECK(putnull(text));
 			result = ISC_R_NOTFOUND;
 			dumpdone(dctx, result);
 			return (result);
@@ -12081,9 +12125,15 @@ nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
 
 static void
 dumpzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **text = arg;
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;
 
-	putmem(text, buf, len);
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }
 
 static isc_result_t
@@ -12097,6 +12147,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	isc_buffer_t *text = NULL;
 	char namebuf[1024];
 	MDB_val key, data;
+	ns_dzarg_t dzarg;
 
 	view = dns_zone_getview(zone);
 
@@ -12148,7 +12199,21 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 			goto cleanup;
 		}
 
-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx,
+				      NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in nzd_save(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}
 
 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -12427,6 +12492,7 @@ migrate_nzf(dns_view_t *view) {
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
 	MDB_val key, data;
+	ns_dzarg_t dzarg;
 
 	/*
 	 * If NZF file doesn't exist, or NZD DB exists and already
@@ -12516,7 +12582,21 @@ migrate_nzf(dns_view_t *view) {
 		}
 
 		isc_buffer_clear(text);
-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx,
+				      NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in migrate_nzf(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}
 
 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -12586,7 +12666,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	const char *viewname = NULL;
 	dns_rdataclass_t rdclass;
 	dns_view_t *view = NULL;
-	const char *bn;
+	const char *bn = NULL;
 
 	REQUIRE(viewp != NULL && *viewp == NULL);
 	REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
@@ -12597,12 +12677,14 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
 	isc_buffer_add(&argbuf, strlen(command));
 
-	if (strncasecmp(command, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0) {
 		bn = "addzone";
-	else if (strncasecmp(command, "mod", 3) == 0)
+	} else if (strncasecmp(command, "mod", 3) == 0) {
 		bn = "modzone";
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/*
 	 * Convert the "addzone" or "modzone" to just "zone", for
@@ -13618,8 +13700,14 @@ find_name_in_list_from_map(const cfg_obj_t *config,
 
 static void
 emitzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **tpp = arg;
-	putmem(tpp, buf, len);
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;
+
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }
 
 /*
@@ -13641,6 +13729,7 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	cfg_obj_t *nzconfig = NULL;
 #endif /* HAVE_LMDB */
 	bool added, redirect;
+	ns_dzarg_t dzarg;
 
 	/* Parse parameters */
 	CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
@@ -13700,9 +13789,14 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	if (zconfig == NULL)
 		CHECK(ISC_R_NOTFOUND);
 
-	putstr(text, "zone ");
-	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, text);
-	putstr(text, ";");
+	CHECK(putstr(text, "zone "));
+	dzarg.magic = DZARG_MAGIC;
+	dzarg.text = text;
+	dzarg.result = ISC_R_SUCCESS;
+	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, &dzarg);
+	CHECK(dzarg.result);
+
+	CHECK(putstr(text, ";"));
 
 	result = ISC_R_SUCCESS;
 
@@ -14096,8 +14190,8 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 
 	/* Security */
 	secure = dns_db_issecure(db);
-	allow = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW);
-	maintain = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN);
+	allow = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW) != 0);
+	maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);
 
 	/* Master files */
 	file = dns_zone_getfile(mayberaw);
@@ -14338,7 +14432,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	}
 
 	for (;;) {
-		bool opts = true;
 
 		/* Check for options */
 		ptr = next_token(lex, text);
@@ -14346,16 +14439,14 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			return (ISC_R_UNEXPECTEDEND);
 		}
 
-		if (!opts) {
-			nametext = ptr;
-		} else if (strcmp(ptr, "--") == 0) {
-			opts = false;
+		if (strcmp(ptr, "--") == 0) {
+			break;
 		} else if (argcheck(ptr, "dump")) {
 			dump = true;
 		} else if (argcheck(ptr, "remove")) {
 			ntattl = 0;
 			ttlset = true;
-		} else if (opts && argcheck(ptr, "force")) {
+		} else if (argcheck(ptr, "force")) {
 			force = true;
 			continue;
 		} else if (argcheck(ptr, "lifetime")) {
@@ -14436,7 +14527,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		CHECK(ISC_R_FAILURE);
 	}
 
-	/* Get the NTA name. */
+	/* Get the NTA name if not found above. */
 	if (nametext == NULL) {
 		nametext = next_token(lex, text);
 	}
@@ -14798,7 +14889,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			snprintf(buf, sizeof(buf), "\n\talgorithm: %s", alg);
 			CHECK(putstr(text, buf));
 
-			revoked = (kd.flags & DNS_KEYFLAG_REVOKE);
+			revoked = ((kd.flags & DNS_KEYFLAG_REVOKE) != 0);
 			snprintf(buf, sizeof(buf), "\n\tflags:%s%s%s",
 				 revoked ? " REVOKE" : "",
 				 ((kd.flags & DNS_KEYFLAG_KSK) != 0)
@@ -14988,6 +15079,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		if (viewtxt != NULL) {

bin/named/statschannel.c

@@ -3226,7 +3226,7 @@ destroy_listener(void *arg) {
 	/* We don't have to acquire the lock here since it's already unlinked */
 	dns_acl_detach(&listener->acl);
 
-	DESTROYLOCK(&listener->lock);
+	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
@@ -3253,11 +3253,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	listener->mctx = NULL;
 	ISC_LINK_INIT(listener, link);
 
-	result = isc_mutex_init(&listener->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(server->mctx, listener, sizeof(*listener));
-		return (ISC_R_FAILURE);
-	}
+	isc_mutex_init(&listener->lock);
 
 	isc_mem_attach(server->mctx, &listener->mctx);
 
@@ -3352,7 +3348,7 @@ cleanup:
 	if (result != ISC_R_SUCCESS) {
 		if (listener->acl != NULL)
 			dns_acl_detach(&listener->acl);
-		DESTROYLOCK(&listener->lock);
+		isc_mutex_destroy(&listener->lock);
 		isc_mem_putanddetach(&listener->mctx, listener,
 				     sizeof(*listener));
 	}

bin/named/unix/dlz_dlopen_driver.c

@@ -252,9 +252,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	}
 
 	/* Initialize the lock */
-	result = isc_mutex_init(&cd->lock);
-	if (result != ISC_R_SUCCESS)
-		goto failed;
+	isc_mutex_init(&cd->lock);
 
 	/* Open the library */
 	dlopen_flags = RTLD_NOW|RTLD_GLOBAL;
@@ -364,15 +362,19 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);
-	if (cd->dl_path != NULL)
+	if (cd->dl_path != NULL) {
 		isc_mem_free(mctx, cd->dl_path);
-	if (cd->dlzname != NULL)
+	}
+	if (cd->dlzname != NULL) {
 		isc_mem_free(mctx, cd->dlzname);
-	if (dlopen_flags != 0)
-		(void) isc_mutex_destroy(&cd->lock);
+	}
+	if (dlopen_flags != 0) {
+		isc_mutex_destroy(&cd->lock);
+	}
 #ifdef HAVE_DLCLOSE
-	if (cd->dl_handle)
+	if (cd->dl_handle) {
 		dlclose(cd->dl_handle);
+	}
 #endif
 	isc_mem_put(mctx, cd, sizeof(*cd));
 	isc_mem_destroy(&mctx);
@@ -395,17 +397,20 @@ dlopen_dlz_destroy(void *driverarg, void *dbdata) {
 		MAYBE_UNLOCK(cd);
 	}
 
-	if (cd->dl_path)
+	if (cd->dl_path) {
 		isc_mem_free(cd->mctx, cd->dl_path);
-	if (cd->dlzname)
+	}
+	if (cd->dlzname) {
 		isc_mem_free(cd->mctx, cd->dlzname);
+	}
 
 #ifdef HAVE_DLCLOSE
-	if (cd->dl_handle)
+	if (cd->dl_handle) {
 		dlclose(cd->dl_handle);
+	}
 #endif
 
-	(void) isc_mutex_destroy(&cd->lock);
+	isc_mutex_destroy(&cd->lock);
 
 	mctx = cd->mctx;
 	isc_mem_put(mctx, cd, sizeof(*cd));

bin/named/win32/dlz_dlopen_driver.c

@@ -253,9 +253,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	triedload = true;
 
 	/* Initialize the lock */
-	result = isc_mutex_init(&cd->lock);
-	if (result != ISC_R_SUCCESS)
-		goto failed;
+	isc_mutex_init(&cd->lock);
 
 	/* Open the library */
 	cd->dl_handle = LoadLibraryA(cd->dl_path);
@@ -349,17 +347,21 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	return (ISC_R_SUCCESS);
 
 cleanup_lock:
-	DESTROYLOCK(&cd->lock);
+	isc_mutex_destroy(&cd->lock);
 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);
-	if (cd->dl_path)
+	if (cd->dl_path) {
 		isc_mem_free(mctx, cd->dl_path);
-	if (cd->dlzname)
+	}
+	if (cd->dlzname) {
 		isc_mem_free(mctx, cd->dlzname);
-	if (triedload)
-		(void) isc_mutex_destroy(&cd->lock);
-	if (cd->dl_handle)
+	}
+	if (triedload) {
+		isc_mutex_destroy(&cd->lock);
+	}
+	if (cd->dl_handle) {
 		FreeLibrary(cd->dl_handle);
+	}
 	isc_mem_put(mctx, cd, sizeof(*cd));
 	isc_mem_destroy(&mctx);
 	return (result);
@@ -390,7 +392,7 @@ dlopen_dlz_destroy(void *driverarg, void *dbdata) {
 	if (cd->dl_handle)
 		FreeLibrary(cd->dl_handle);
 
-	DESTROYLOCK(&cd->lock);
+	isc_mutex_destroy(&cd->lock);
 
 	mctx = cd->mctx;
 	isc_mem_put(mctx, cd, sizeof(*cd));

bin/named/zoneconf.c

@@ -125,7 +125,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		break;
 	    default:
 		INSIST(0);
-		return (ISC_R_FAILURE);
+		ISC_UNREACHABLE();
 	}
 
 	/* First check to see if ACL is defined within the zone */
@@ -231,12 +231,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		unsigned int i, n;
 
 		str = cfg_obj_asstring(mode);
-		if (strcasecmp(str, "grant") == 0)
+		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
-		else if (strcasecmp(str, "deny") == 0)
+		} else if (strcasecmp(str, "deny") == 0) {
 			grant = false;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 
 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -764,6 +766,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	result = named_checknames_get(maps, zone, objp);
 	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
@@ -903,7 +906,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
 	dns_stats_t *rcvquerystats;
-	dns_zonestat_level_t statlevel;
+	dns_zonestat_level_t statlevel = dns_zonestat_none;
 	int seconds;
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
 	isc_dscp_t dscp;
@@ -1027,14 +1030,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		const char *masterformatstr = cfg_obj_asstring(obj);
 
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -1050,12 +1055,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			return (ISC_R_FAILURE);
 		}
 
-		if (strcasecmp(masterstylestr, "full") == 0)
+		if (strcasecmp(masterstylestr, "full") == 0) {
 			masterstyle = &dns_master_style_full;
-		else if (strcasecmp(masterstylestr, "relative") == 0)
+		} else if (strcasecmp(masterstylestr, "relative") == 0) {
 			masterstyle = &dns_master_style_default;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -1141,16 +1148,18 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dialup = dns_dialuptype_no;
 	} else {
 		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0)
+		if (strcasecmp(dialupstr, "notify") == 0) {
 			dialup = dns_dialuptype_notify;
-		else if (strcasecmp(dialupstr, "notify-passive") == 0)
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
 			dialup = dns_dialuptype_notifypassive;
-		else if (strcasecmp(dialupstr, "refresh") == 0)
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
 			dialup = dns_dialuptype_refresh;
-		else if (strcasecmp(dialupstr, "passive") == 0)
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
 			dialup = dns_dialuptype_passive;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	if (raw != NULL)
 		dns_zone_setdialup(raw, dialup);
@@ -1166,14 +1175,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			statlevel = dns_zonestat_none;
 	} else {
 		const char *levelstr = cfg_obj_asstring(obj);
-		if (strcasecmp(levelstr, "full") == 0)
+		if (strcasecmp(levelstr, "full") == 0) {
 			statlevel = dns_zonestat_full;
-		else if (strcasecmp(levelstr, "terse") == 0)
+		} else if (strcasecmp(levelstr, "terse") == 0) {
 			statlevel = dns_zonestat_terse;
-		else if (strcasecmp(levelstr, "none") == 0)
+		} else if (strcasecmp(levelstr, "none") == 0) {
 			statlevel = dns_zonestat_none;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	dns_zone_setstatlevel(zone, statlevel);
 
@@ -1211,12 +1222,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				notifytype = dns_notifytype_no;
 		} else {
 			const char *notifystr = cfg_obj_asstring(obj);
-			if (strcasecmp(notifystr, "explicit") == 0)
+			if (strcasecmp(notifystr, "explicit") == 0) {
 				notifytype = dns_notifytype_explicit;
-			else if (strcasecmp(notifystr, "master-only") == 0)
+			} else if (strcasecmp(notifystr, "master-only") == 0) {
 				notifytype = dns_notifytype_masteronly;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 		notifytype = process_notifytype(notifytype, ztype, zname,
 						nodefault);
@@ -1374,8 +1387,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES,
 					   check);
@@ -1410,8 +1425,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
 
 		obj = NULL;
@@ -1562,14 +1579,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "allow") == 0)
+			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				allow = maint = true;
-			else if (strcasecmp(arg, "off") == 0)
+			} else if (strcasecmp(arg, "off") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
@@ -1622,8 +1641,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);
 
@@ -1637,8 +1658,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);
 
@@ -1674,8 +1697,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
 
@@ -1689,8 +1714,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
@@ -1706,13 +1733,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "no-resign") == 0)
+			if (strcasecmp(arg, "no-resign") == 0) {
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
 						   true);
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 
 		obj = NULL;

bin/nsupdate/nsupdate.c

@@ -144,8 +144,8 @@ static dns_fixedname_t fuserzone;
 static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
-static dns_name_t tmpzonename;
-static dns_name_t restart_master;
+static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
+static dns_name_t restart_master = DNS_NAME_INITEMPTY;
 static dns_tsig_keyring_t *gssring = NULL;
 static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
@@ -885,7 +885,7 @@ setup_system(void) {
 	result = isc_timermgr_create(gmctx, &timermgr);
 	check_result(result, "dns_timermgr_create");
 
-	result = isc_taskmgr_create(gmctx, 1, 0, &taskmgr);
+	result = isc_taskmgr_create(gmctx, 1, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);
@@ -2354,6 +2354,8 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_master, gmctx);
+		dns_name_init(&tmpzonename, 0);
+		dns_name_init(&restart_master, 0);
 	}
 	isc_event_free(&event);
 	done_update();
@@ -2769,6 +2771,8 @@ failed_gssrequest() {
 
 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_master, gmctx);
+	dns_name_init(&tmpzonename, NULL);
+	dns_name_init(&restart_master, NULL);
 
 	done_update();
 }
@@ -3178,6 +3182,12 @@ cleanup(void) {
 		isc_mem_free(gmctx, realm);
 		realm = NULL;
 	}
+	if (dns_name_dynamic(&tmpzonename)) {
+		dns_name_free(&tmpzonename, gmctx);
+	}
+	if (dns_name_dynamic(&restart_master)) {
+		dns_name_free(&restart_master, gmctx);
+	}
 #endif
 
 	if (sig0key != NULL)

bin/python/dnssec-keymgr.8

@@ -215,7 +215,7 @@ Specifies the directory in which keys should be stored\&.
 .PP
 \fBkey\-size\fR
 .RS 4
-Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
+Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
 .RE
 .PP
 \fBkeyttl\fR

bin/python/dnssec-keymgr.html

@@ -258,8 +258,7 @@
 	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
-	    configured, the default is 1024 bits for DSA keys and 2048 for
-	    RSA.
+	    configured, the default is 2048 bits for RSA keys.
 	  </p>
 	</dd>
 <dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>

bin/rndc/rndc.8

@@ -386,7 +386,7 @@ See also
 \fBrndc trace\fR\&.
 .RE
 .PP
-\fBnta \fR\fB[( \-d | \-f | \-r | \-l \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
+\fBnta \fR\fB[( \-class \fIclass\fR | \-dump | \-force | \-remove | \-lifetime \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
 .RS 4
 Sets a DNSSEC negative trust anchor (NTA) for
 \fBdomain\fR, with a lifetime of
@@ -418,7 +418,7 @@ option\&. TTL\-style suffixes can be used to specify the lifetime in seconds, mi
 to zero is equivalent to
 \fB\-remove\fR\&.
 .sp
-If
+If the
 \fB\-dump\fR
 is used, any other arguments are ignored, and a list of existing NTAs is printed (note that this may include NTAs that are expired but have not yet been cleaned up)\&.
 .sp
@@ -430,11 +430,18 @@ option in the Administrator Reference Manual for details)\&. If data can be vali
 \fB\-force\fR
 overrides this behavior and forces an NTA to persist for its entire lifetime, regardless of whether data could be validated if the NTA were not present\&.
 .sp
+The view class can be specified with
+\fB\-class\fR\&. The default is class
+\fBIN\fR, which is the only class for which DNSSEC is currently supported\&.
+.sp
 All of these options can be shortened, i\&.e\&., to
 \fB\-l\fR,
 \fB\-r\fR,
-\fB\-d\fR, and
-\fB\-f\fR\&.
+\fB\-d\fR,
+\fB\-f\fR, and
+\fB\-c\fR\&.
+.sp
+Unrecognized options are treated as errors\&. To reference a domain or view name that begins with a hyphen, use a double\-hyphen on the command line to indicate the end of options\&.
 .RE
 .PP
 \fBquerylog\fR [ on | off ]
@@ -695,13 +702,14 @@ in each view\&. The list both statically configured keys and dynamic TKEY\-negot
 .PP
 \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR
 .RS 4
-Enable, disable, or check the current status of DNSSEC validation\&. Note
+Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&. (Note that
 \fBdnssec\-enable\fR
-also needs to be set to
+must also be
 \fByes\fR
-or
-\fBauto\fR
-to be effective\&. It defaults to enabled\&.
+(the default value) for signatures to be returned along with validated data\&. If validation is enabled while
+\fBdnssec\-enable\fR
+is set to
+\fBno\fR, the server will validate internally, but will not supply clients with the necessary records to allow validity to be confirmed\&.)
 .RE
 .PP
 \fBzonestatus \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR

bin/rndc/rndc.c

@@ -934,7 +934,7 @@ main(int argc, char **argv) {
 
 	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
-	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0, &taskmgr));
+	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));
 
 	DO("create logging context", isc_log_create(rndc_mctx, &log, &logconfig));

bin/rndc/rndc.html

@@ -484,7 +484,7 @@
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>nta
-	[<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
+	    [<span class="optional">( -class <em class="replaceable"><code>class</code></em> | -dump | -force | -remove | -lifetime <em class="replaceable"><code>duration</code></em>)</span>]
 	<em class="replaceable"><code>domain</code></em>
 	[<span class="optional"><em class="replaceable"><code>view</code></em></span>]
 	</code></strong></span></dt>
@@ -532,7 +532,7 @@
 	    is equivalent to <code class="option">-remove</code>.
 	  </p>
 	  <p>
-	    If <code class="option">-dump</code> is used, any other arguments
+	    If the <code class="option">-dump</code> is used, any other arguments
 	    are ignored, and a list of existing NTAs is printed
 	    (note that this may include NTAs that are expired but
 	    have not yet been cleaned up).
@@ -549,10 +549,21 @@
 	    lifetime, regardless of whether data could be
 	    validated if the NTA were not present.
 	  </p>
+	  <p>
+	    The view class can be specified with <code class="option">-class</code>.
+	    The default is class <strong class="userinput"><code>IN</code></strong>, which is
+	    the only class for which DNSSEC is currently supported.
+	  </p>
 	  <p>
 	    All of these options can be shortened, i.e., to
 	    <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
-	    and <code class="option">-f</code>.
+	    <code class="option">-f</code>, and <code class="option">-c</code>.
+	  </p>
+	  <p>
+	    Unrecognized options are treated as errors. To reference
+	    a domain or view name that begins with a hyphen,
+	    use a double-hyphen on the command line to indicate the
+	    end of options.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional"> on | off </span>] </span></dt>
@@ -902,11 +913,14 @@
 <dd>
 	  <p>
 	    Enable, disable, or check the current status of
-	    DNSSEC validation.
-	    Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
-	    set to <strong class="userinput"><code>yes</code></strong> or
-	    <strong class="userinput"><code>auto</code></strong> to be effective.
-	    It defaults to enabled.
+	    DNSSEC validation.  By default, validation is enabled.
+	    (Note that <span class="command"><strong>dnssec-enable</strong></span> must also be
+	    <strong class="userinput"><code>yes</code></strong> (the default value) for signatures
+	    to be returned along with validated data. If validation is
+	    enabled while <span class="command"><strong>dnssec-enable</strong></span> is set to
+	    <strong class="userinput"><code>no</code></strong>, the server will validate internally,
+	    but will not supply clients with the necessary records to allow
+	    validity to be confirmed.)
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>

bin/tests/named.conf

@@ -46,6 +46,7 @@ options {
 	memstatistics-file "named.memstats";	// _PATH_MEMSTATS
 
 	max-cache-ttl 999;
+	min-cache-ttl 66;
 	auth-nxdomain yes;		// always set AA on NXDOMAIN.
 					// don't set this to 'no' unless
 					// you know what you're doing -- older
@@ -148,6 +149,7 @@ options {
 	min-refresh-time 777;
 
 	max-ncache-ttl 333;
+	min-ncache-ttl 22;
 	min-roots 15;
 	serial-queries 34;
 

bin/tests/optional/adb_test.c

@@ -146,7 +146,7 @@ create_managers(void) {
 	isc_result_t result;
 
 	taskmgr = NULL;
-	result = isc_taskmgr_create(mctx, 5, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, 5, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	timermgr = NULL;
@@ -290,8 +290,8 @@ main(int argc, char **argv) {
 
 	isc_stdtime_get(&now);
 
-	result = isc_mutex_init(&client_lock);
-	check_result(result, "isc_mutex_init(&client_lock)");
+	isc_mutex_init(&client_lock);
+
 	ISC_LIST_INIT(clients);
 
 	/*

bin/tests/optional/byaddr_test.c

@@ -114,7 +114,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr)
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, &taskmgr)
 		      == ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task)

bin/tests/optional/byname_test.c

@@ -228,7 +228,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task) ==

bin/tests/optional/db_test.c

@@ -359,7 +359,6 @@ main(int argc, char *argv[]) {
 	dbinfo *dbi;
 	dns_dbversion_t *version;
 	const dns_name_t *origin;
-	size_t memory_quota = 0;
 	dns_trust_t trust = 0;
 	unsigned int addopts;
 	isc_log_t *lctx = NULL;
@@ -411,10 +410,6 @@ main(int argc, char *argv[]) {
 		case 'P':
 			pause_every = atoi(isc_commandline_argument);
 			break;
-		case 'Q':
-			memory_quota = atoi(isc_commandline_argument);
-			isc_mem_setquota(mctx, memory_quota);
-			break;
 		case 't':
 			type = atoi(isc_commandline_argument);
 			break;

bin/tests/optional/gsstest.c

@@ -472,7 +472,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/optional/mempool_test.c

@@ -30,7 +30,7 @@ main(int argc, char *argv[]) {
 
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
-	RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS);
+	isc_mutex_init(&lock);
 
 	mctx = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
@@ -114,7 +114,7 @@ main(int argc, char *argv[]) {
 
 	isc_mem_destroy(&mctx);
 
-	DESTROYLOCK(&lock);
+	isc_mutex_destroy(&lock);
 
 	return (0);
 }

bin/tests/optional/ratelimiter_test.c

@@ -104,8 +104,7 @@ main(int argc, char *argv[]) {
 	isc_interval_set(&linterval, 1, 0);
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, 0, &taskmgr) ==
-		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, &taskmgr) == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &g_task) ==

bin/tests/optional/shutdown_test.c

@@ -183,7 +183,7 @@ main(int argc, char *argv[]) {
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 	mctx2 = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx2) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &task_manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, &task_manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timer_manager) ==
 		      ISC_R_SUCCESS);

bin/tests/optional/sig0_test.c

@@ -206,7 +206,7 @@ main(int argc, char *argv[]) {
 
 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);
 
-	RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS);
+	isc_mutex_init(&lock);
 
 	mctx = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
@@ -228,8 +228,7 @@ main(int argc, char *argv[]) {
 	dst_result_register();
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
-		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, &taskmgr) == ISC_R_SUCCESS);
 	task1 = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task1) == ISC_R_SUCCESS);
 
@@ -282,7 +281,7 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
 
-	DESTROYLOCK(&lock);
+	isc_mutex_destroy(&lock);
 
 	isc_app_finish();
 

bin/tests/optional/sock_test.c

@@ -297,7 +297,7 @@ main(int argc, char *argv[]) {
 	 * The task manager is independent (other than memory context)
 	 */
 	manager = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, &manager) ==
 		      ISC_R_SUCCESS);
 
 	/*

bin/tests/optional/task_test.c

@@ -81,7 +81,7 @@ main(int argc, char *argv[]) {
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, &manager) ==
 		      ISC_R_SUCCESS);
 
 	RUNTIME_CHECK(isc_task_create(manager, 0, &t1) == ISC_R_SUCCESS);

bin/tests/optional/timer_test.c

@@ -110,7 +110,7 @@ main(int argc, char *argv[]) {
 	printf("%u workers\n", workers);
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx1) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, &manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx1, &timgr) == ISC_R_SUCCESS);
 

bin/tests/optional/zone_test.c

@@ -284,7 +284,7 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

bin/tests/system/Makefile.in

@@ -69,7 +69,7 @@ PARALLEL = rpzrecurse serve-stale dnssec \
 	   rrchecker rrl rrsetorder rsabigexponent runtime \
 	   sfcache smartsign sortlist \
 	   spf staticstub statistics statschannel stub synthfromdnssec \
-	   tcp tools tsig tsiggss \
+	   tcp tools tsig tsiggss ttl \
 	   unknown upforwd verify views wildcard \
 	   xfer xferquota zero zonechecks
 

bin/tests/system/autosign/ns3/keygen.sh

@@ -15,8 +15,8 @@ SYSTEMTESTTOP=../..
 SYSTESTDIR=autosign
 
 dumpit () {
-	echo "D:${debug}: dumping ${1}"
-	cat "${1}" | sed 's/^/D:/'
+	echo_d "${debug}: dumping ${1}"
+	cat "${1}" | cat_d
 }
 
 setup () {

bin/tests/system/autosign/tests.sh

@@ -236,7 +236,7 @@ status=`expr $status + $ret`
 
 echo_i "checking for nsec3param signing record ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1 | sed 's/^/ns3 /' | cat_i
+$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
 grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi

bin/tests/system/cds/setup.sh

@@ -42,7 +42,8 @@ tac() {
 }
 
 convert() {
-	local key=$1 n=$2
+	key=$1
+	n=$2
 	$DSFROMKEY $key >DS.$n
 	grep ' 8 1 ' DS.$n >DS.$n-1
 	grep ' 8 2 ' DS.$n >DS.$n-2

bin/tests/system/cds/tests.sh

@@ -33,7 +33,7 @@ testcase() {
 	check_stdout
 	check_stderr
 	if [ "$expect" -ne "$result" ]; then
-                echo "D:exit status does not match $expect"
+                echo_d "exit status does not match $expect"
 		fail
 	fi
         unset name err out
@@ -45,19 +45,19 @@ check_stderr() {
 	else
 		[ -s err.$n ] || return 0
 	fi
-	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err.$n
+	echo_d "stderr did not match '$err'"
+	cat err.$n | cat_d
 	fail
 }
 
 check_stdout() {
 	cmp out.$n "${out:-empty}" >/dev/null && return
-	echo "D:stdout did not match '$out'"
+	echo_d "stdout did not match '$out'"
 	(	echo "wanted"
 		cat "$out"
 		echo "got"
 		cat out.$n
-	) | sed 's/^/D:/'
+	) | cat_d
 	fail
 }
 

bin/tests/system/checkconf/bad-maxncachettl-2.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view two {
+	max-ncache-ttl 604801;
+};

bin/tests/system/checkconf/bad-maxncachettl-3.conf

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view three {
+	max-ncache-ttl 4000000000;
+};
+view four {
+	max-ncache-ttl -1;
+};

bin/tests/system/checkconf/bad-maxncachettl-4.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view four {
+	max-ncache-ttl -1;
+};

bin/tests/system/checkconf/bad-mincachettl.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-cache-ttl 1x;
+};

bin/tests/system/checkconf/bad-minncachettl.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-ncache-ttl 1x;
+};

bin/tests/system/checkconf/good-maxncachettl.conf

@@ -16,7 +16,7 @@ view two {
 	max-ncache-ttl 86400;
 };
 view three {
-	max-ncache-ttl 4000000000;
+	max-ncache-ttl 604800;
 };
 view four {
 	max-ncache-ttl 3600s;

bin/tests/system/checkconf/good-mincachettl.conf

@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-cache-ttl 0;
+};
+view two {
+	min-cache-ttl 30;
+};
+view three {
+	min-cache-ttl 60;
+};
+view four {
+	min-cache-ttl 90s;
+};
+view five {
+	min-cache-ttl 1m;
+};

bin/tests/system/checkconf/good-minncachettl.conf

@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-ncache-ttl 0;
+};
+view two {
+	min-ncache-ttl 30;
+};
+view three {
+	min-ncache-ttl 60;
+};
+view four {
+	min-ncache-ttl 90s;
+};
+view five {
+	min-ncache-ttl 1m;
+};

bin/tests/system/conf.sh.in

@@ -15,10 +15,7 @@
 #
 
 # Find the top of the BIND9 tree.
-TOP=${SYSTEMTESTTOP:=.}/../../..
-
-# Make it absolute so that it continues to work after we cd.
-TOP=`cd $TOP && pwd`
+TOP=@abs_top_builddir@
 
 # Default algorithm for testing
 DEFAULT_ALGORITHM=ECDSAP256SHA256
@@ -105,7 +102,7 @@ PARALLELDIRS="acl additional addzone allow-query auth autosign \
 	rrchecker rrl rrsetorder rsabigexponent runtime \
 	serve-stale sfcache smartsign sortlist \
 	spf staticstub statistics statschannel stub synthfromdnssec \
-	tcp tools tsig tsiggss \
+	tcp tools tsig tsiggss ttl \
 	unknown upforwd verify views wildcard \
 	xfer xferquota zero zonechecks"
 
@@ -226,23 +223,36 @@ fi
 SYSTESTDIR="`basename $PWD`"
 
 echo_i() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
 echo_ic() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
     done
 }
 
 cat_i() {
-    while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
+echo_d() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+cat_d() {
+    while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+
 digcomp() {
     output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
     result=$?

bin/tests/system/conf.sh.win32

@@ -100,7 +100,7 @@ SEQUENTIALDIRS="acl additional addzone autosign builtin \
 	 reclimit redirect resolver rndc rpz rrchecker rrl \
 	 rrsetorder rsabigexponent runtime sfcache smartsign sortlist \
 	 spf staticstub statistics statschannel stub tcp tkey tsig \
-	 tsiggss unknown upforwd verify views wildcard xfer xferquota \
+	 tsiggss ttl unknown upforwd verify views wildcard xfer xferquota \
 	 zero zonechecks"
 
 # List of tests that use unique ports (other than 5300 and 9953). These
@@ -203,20 +203,20 @@ echoend () {
 SYSTESTDIR="`basename $PWD`"
 
 echo_i() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
 echo_ic() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
     done
 }
 
 cat_i() {
-    while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 

bin/tests/system/digdelv/tests.sh

@@ -495,6 +495,14 @@ if [ -x ${DIG} ] ; then
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
+  n=`expr $n + 1`
+  echo_i "check that dig -q -m works ($n)"
+  ret=0
+  $DIG $DIGOPTS @10.53.0.3 -q -m > dig.out.test$n 2>&1
+  grep '^;-m\..*IN.*A$' dig.out.test$n > /dev/null || ret=1
+  grep "Dump of all outstanding memory allocations" dig.out.test$n > /dev/null && ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
 else
   echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -694,6 +702,24 @@ if [ -x ${DELV} ] ; then
   grep "a.example." < delv.out.test$n > /dev/null || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
+
+  n=`expr $n + 1`
+  echo_i "checking delv H is ignored, and treated like IN ($n)"
+  ret=0
+  $DELV $DELVOPTS @10.53.0.3 -c CH -t a a.example > delv.out.test$n || ret=1
+  grep "a.example." < delv.out.test$n > /dev/null || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+
+  n=`expr $n + 1`
+  echo_i "check that delv -q -m works ($n)"
+  ret=0
+  $DELV $DELVOPTS @10.53.0.3 -q -m > delv.out.test$n 2>&1
+  grep '^; -m\..*[0-9]*.*IN.*ANY.*;' delv.out.test$n > /dev/null || ret=1
+  grep "^add " delv.out.test$n > /dev/null && ret=1
+  grep "^del " delv.out.test$n > /dev/null && ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
 else
   echo_i "$DELV is needed, so skipping these delv tests"
 fi

bin/tests/system/fetchlimit/tests.sh

@@ -157,7 +157,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 $RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
 
-echo_i "checking lame server clients are dropped at the soft limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0

bin/tests/system/pipelined/pipequeries.c

@@ -279,7 +279,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/qmin/tests.sh

@@ -234,6 +234,13 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 $RNDCCMD 10.53.0.7 flush
 
+n=`expr $n + 1`
+echo_i "information that minimization was unsuccessful for .ugly is logged ($n)"
+ret=0
+grep "success resolving 'icky.icky.icky.ptang.zoop.boing.ugly/A' after disabling qname minimization due to 'FORMERR'" ns7/named.run > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "query for .slow is properly minimized when qname-minimization is on ($n)"
 ret=0

bin/tests/system/rpz/dnsrps.c

@@ -82,10 +82,11 @@ main(int argc, char **argv) {
 			}
 #ifdef USE_DNSRPS
 			printf("%s\n", librpz->dnsrpzd_path);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'n':
 			if (!link_dnsrps(&emsg)) {
@@ -132,10 +133,11 @@ main(int argc, char **argv) {
 			librpz->rsp_detach(&rsp);
 			librpz->client_detach(&client);
 			printf("%u\n", serial);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'w':
 			seconds = strtod(optarg, &p);

bin/tests/system/rpzrecurse/tests.sh

@@ -413,15 +413,15 @@ for mode in native dnsrps; do
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 >> dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 >> dig.out.${t}
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && {
     echo_i " failed: unexpected rewrite message for policy zone log1 was logged"
     status=1
   }
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || {
     echo_i " failed: expected rewrite message for policy zone log2 was not logged"
     status=1
   }
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || {
     echo_i " failed: expected rewrite message for policy zone log3 was not logged"
     status=1
   }

bin/tests/system/runtime/tests.sh

@@ -24,28 +24,6 @@ grep "another named process" ns2/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if [ ! "$CYGWIN" ]; then
-    n=`expr $n + 1`
-    echo_i "verifying that named checks for conflicting listeners ($n)"
-    ret=0
-    (cd ns2; $NAMED -c named-alt1.conf -D ns2-extra-1 -X other.lock -m record,size,mctx -d 99 -g -U 4 >> named2.run 2>&1 & )
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-        grep "unable to listen on any configured interface" ns2/named2.run > /dev/null && break
-        sleep 1
-    done
-    grep "unable to listen on any configured interface" ns2/named2.run > /dev/null || ret=1
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-	grep "exiting (due to fatal error)" ns2/named2.run > /dev/null && break
-	sleep 1
-    done
-    pid=`cat ns2/named2.pid 2>/dev/null`
-    test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
 n=`expr $n + 1`
 echo_i "verifying that named checks for conflicting named processes ($n)"
 ret=0

bin/tests/system/tkey/keycreate.c

@@ -239,7 +239,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/tkey/keydelete.c

@@ -178,7 +178,7 @@ main(int argc, char **argv) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/ttl/clean.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+. ../conf.sh
+
+rm -f ./dig.out.*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./ns*/named.lock
+rm -f ./ns*/_default.nzf
+rm -f ./ns*/_default.nzd*
+rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/ttl/ns1/max-example.db

@@ -0,0 +1,9 @@
+max-example.	1209600	IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				1209600    ; minimum (2 weeks)
+				)
+max-example.	1209600	IN NS	ns.max-example.
+ns.max-example.	1209600	IN A	10.53.0.1

bin/tests/system/ttl/ns1/min-example.db

@@ -0,0 +1,9 @@
+min-example.	0	IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				0          ; minimum (0 seconds)
+				)
+min-example.	0	IN NS	ns.min-example.
+ns.min-example.	0	IN A	10.53.0.1

bin/tests/system/ttl/ns1/named.conf.in

@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	check-integrity no;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "min-example" {
+	type master;
+	file "min-example.db";
+};
+
+zone "max-example" {
+	type master;
+	file "max-example.db";
+};

bin/tests/system/ttl/ns2/hints.db

@@ -0,0 +1,2 @@
+. 60 IN NS ns.nil.
+ns.nil. 60 IN A 10.53.0.1

bin/tests/system/ttl/ns2/named.conf.in

@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	directory ".";
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	servfail-ttl 0;
+	max-recursion-depth 12;
+	recursion yes;
+	dnssec-validation no;
+	min-cache-ttl 60;
+	min-ncache-ttl 30;
+	max-cache-ttl 120;
+	max-ncache-ttl 60;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." { type hint; file "hints.db"; };

bin/tests/system/ttl/setup.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+. ../conf.sh
+
+$SHELL clean.sh
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/ttl/tests.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+. ../conf.sh
+
+dig_with_options() { "$DIG" +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${PORT}" "$@"; }
+
+status=0
+t=0
+
+echo_i "testing min-cache-ttl"
+t=$((t+1))
+dig_with_options IN SOA min-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 60 ] || status=$((status+1))
+
+echo_i "testing min-ncache-ttl"
+t=$((t+1))
+dig_with_options IN MX min-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 30 ] || status=$((status+1))
+
+echo_i "testing max-cache-ttl"
+t=$((t+1))
+dig_with_options IN SOA max-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 120 ] || status=$((status+1))
+
+echo_i "testing max-ncache-ttl"
+t=$((t+1))
+dig_with_options IN MX max-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 60 ] || status=$((status+1))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1

bin/tests/system/verify/zones/genzones.sh

@@ -13,8 +13,8 @@ SYSTEMTESTTOP=../..
 SYSTESTDIR=verify
 
 dumpit () {
-	echo "D:${debug}: dumping ${1}"
-	cat "${1}" | sed 's/^/D:/'
+	echo_d "${debug}: dumping ${1}"
+	cat "${1}" | cat_d
 }
 setup () {
 	echo_i "setting up $2 zone: $1"

bin/tools/mdig.1

@@ -247,10 +247,6 @@ option sets the query type to
 \fB\-x\fR
 option is supplied to indicate a reverse lookup with the "PTR" query type\&.
 .PP
-The
-\fB\-i\fR
-option sets the reverse domain for IPv6 addresses to IP6\&.INT\&.
-.PP
 Reverse lookups \(em mapping addresses to names \(em are simplified by the
 \fB\-x\fR
 option\&.
@@ -259,9 +255,7 @@ is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 addre
 \fBmdig\fR
 automatically performs a lookup for a query name like
 11\&.12\&.13\&.10\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. By default, IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&. To use the older RFC1886 method using the IP6\&.INT domain specify the
-\fB\-i\fR
-option\&.
+and sets the query type and class to PTR and IN respectively\&. By default, IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
 .PP
 The local query options are:
 .PP

bin/tools/mdig.c

@@ -1535,7 +1535,7 @@ plus_option(char *option, struct query *query, bool global)
  * #true returned if value was used
  */
 static const char *single_dash_opts = "46himv";
-/*static const char *dash_opts = "46bcfhiptvx";*/
+static const char *dash_opts = "46bcfhiptvx";
 static bool
 dash_option(const char *option, char *next, struct query *query,
 	    bool global, bool *setname)
@@ -1755,6 +1755,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }
 
@@ -1967,7 +1981,7 @@ main(int argc, char *argv[]) {
 		fatal("can't choose between IPv4 and IPv6");
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tools/mdig.html

@@ -357,11 +357,6 @@
       a reverse lookup with the "PTR" query type.
     </p>
 
-    <p>
-      The <code class="option">-i</code> option sets the reverse domain for
-      IPv6 addresses to IP6.INT.
-    </p>
-
     <p>
       Reverse lookups &#8212; mapping addresses to names &#8212; are
       simplified by the <code class="option">-x</code> option.
@@ -371,8 +366,7 @@
       query name like <code class="literal">11.12.13.10.in-addr.arpa</code> and
       sets the query type and class to PTR and IN respectively.
       By default, IPv6 addresses are looked up using nibble format
-      under the IP6.ARPA domain.  To use the older RFC1886 method
-      using the IP6.INT domain specify the <code class="option">-i</code> option.
+      under the IP6.ARPA domain.
     </p>
 
     <p>

cocci/.gitignore

@@ -0,0 +1 @@
+/*.patch

cocci/unreachable.spatch

@@ -0,0 +1,6 @@
+@@
+@@
+
+    INSIST(0);
++   ISC_UNREACHABLE();
+    ... when != ISC_UNREACHABLE();