win32/socket should use common isc_socket

Move socket type to common isc_socket structure; add isc_sockettype_tls
Windows fixes
2018-10-24 10:52:56 +00:00 · 2018-10-24 10:52:56 +00:00 · 2018-10-24 10:52:37 +00:00 · 2018-10-24 07:10:20 +00:00 · 2018-10-24 07:10:20 +00:00 · 2018-10-24 07:10:20 +00:00
237 changed files with 8804 additions and 8546 deletions
@@ -62,4 +62,3 @@ unit/atf-src/test-programs/sh_helpers
 .project
 .cproject
 .settings
-kyua.log
@@ -257,7 +257,6 @@ build:debian:jessie:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: --without-cmocka
  <<: *debian_jessie_amd64_image
  <<: *build_job

@@ -29,4 +29,3 @@
 - [ ] (Manager) Inform marketing of the release

 - [ ] (SwEng) Update DEB and RPM packages
- - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
@@ -1,106 +1,3 @@
-5081.	[func]		Use per-worker queues in task manager, make task
-			runners CPU-affine. [GL #659]
-
-5080.	[func]		Improvements to "rndc nta" user interface:
-			- catch and report invalid command line options
-			- when removing an NTA from all views, do not
-			  abort with an error if the NTA was not found
-			  in one of the views
-			- include the view name in "rndc nta -dump"
-			  output, for consistency with the add and remove
-			  actions
-			Thanks to Tony Finch. [GL !816]
-
-5079.	[func]		Disable IDN processing in dig and nslookup
-			when not on a tty. [GL #653]
-
-5078.	[cleanup]	Require python components to be explicitly disabled if
-			python is not available on unix platforms. [GL #601]
-
-5077.	[cleanup]	Remove ip6.int support (-i) from dig and mdig.
-			[GL !969]
-
-5076.	[bug]		"require-server-cookie" was not effective if
-			"rate-limit" was configured. [GL #617]
-
-5075.	[bug]		Refresh nameservers from cache when sending final
-			query in qname minimization. [GL #16]
-
-5074.	[cleanup]	Remove vector socket functions - isc_socket_recvv(),
-			isc_socket_sendtov(), isc_socket_sendtov2(),
-			isc_socket_sendv() - in order to simplify socket code.
-			[GL #645]
-
-5073.	[bug]		Destroy a task first when destroying rpzs and catzs.
-			[GL #84]
-
-5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
-			behavior for auto-reallocated buffers. [GL #644]
-
-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
-
-5070.	[bug]		Record types which support a empty rdata field were
-			not handling the empty rdata field case. [GL #638]
-
-5069.	[bug]		Fix a hang on in RPZ when named is shutdown during RPZ
-			zone update. [GL !907]
-
-5068.	[bug]		Fix a race in RPZ with min-update-interval set to 0.
-			[GL #643]
-
-5067.	[bug]		Don't minimize qname when sending the query
-			to a forwarder. [GL #361]
-
-5066.	[cleanup]	Allow unquoted strings to be used as a zone names
-			in response-policy statements. [GL #641]
-
-5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
-
-5064.	[test]		Initalize TZ environment variable before calling
-			dns_test_begin in dnstap_test. [GL #624]
-
-5063.	[test]		In statschannel test try a few times before failing
-			when checking if the compressed output is the same as
-			uncompressed. [GL !909]
-
-5062.	[func]		Use non-crypto-secure PRNG to generate nonces for
-			cookies. [GL !887]
-
-5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]
-
-5060.	[bug]		GID, UID and UINFO could not be loaded using unknown
-			record format. [GL #627]
-
-5059.	[bug]		Display a per-view list of zones in the web interface.
-			[GL #427]
-
-5058.	[func]		Replace old message digest and hmac APIs with more
-			generic isc_md and isc_hmac APIs, and convert their
-			respective tests to cmocka. [GL #305]
-
-5057.	[protocol]	Add support for ATMA. [GL #619]
-
-5056.	[placeholder]
-
-5055.	[func]		A default list of primary servers for the root zone is
-			now built into named, allowing the "masters" statement
-			to be omitted when configuring an IANA root zone
-			mirror. [GL #564]
-
-5054.	[func]		Attempts to use mirror zones with recursion disabled
-			are now considered a configuration error. [GL #564]
-
-5053.	[func]		The only valid zone-level NOTIFY settings for mirror
-			zones are now "notify no;" and "notify explicit;".
-			[GL #564]
-
-5052.	[func]		Mirror zones are now configured using "type mirror;"
-			rather than "mirror yes;". [GL #564]
-
-5051.	[doc]		Documentation incorrectly stated that the
-			"server-addresses" static-stub zone option accepts
-			custom port numbers. [GL #582]
-
 5050.	[bug]		The libirs version of getaddrinfo() was unable to parse
 			scoped IPv6 addresses present in /etc/resolv.conf.
 			[GL #187]
@@ -284,7 +181,7 @@
 5000.	[bug]		named_server_servestale() could leave the server in
 			exclusive mode if an error occured. [GL #441]

-4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
+4999.	[cleanup]	Remove custom printf implementaion in lib/isc/print.c.
 			[GL #261]

 4998.	[test]		Make resolver and cacheclean tests more civilized.
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-

-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.

 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)
+
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -55,7 +55,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl

 pkg_failed=no
-AC_MSG_CHECKING([for $1])
+AC_MSG_CHECKING([for $2])

 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])

 if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
        _PKG_SHORT_ERRORS_SUPPORTED
        if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
+        else
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
        fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
        ])
 elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
@@ -65,7 +65,7 @@ static char domainopt[DNS_NAME_MAXTEXT];
 static char hexcookie[81];

 static bool short_form = false, printcmd = true,
-	plusquest = false, pluscomm = false,
+	ip6_int = false, plusquest = false, pluscomm = false,
 	ipv4only = false, ipv6only = false;
 static uint32_t splitwidth = 0xffffffff;

@@ -153,6 +153,7 @@ help(void) {
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -c class            (specify query class)\n"
 "                 -f filename         (batch mode)\n"
+"                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
 "                 -k keyfile          (specify tsig key file)\n"
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
@@ -192,10 +193,8 @@ help(void) {
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
 "                 +[no]header-only    (Send query without a question section)\n"
 "                 +[no]identify       (ID responders in short answers)\n"
-#ifdef HAVE_LIBIDN2
-"                 +[no]idnin          (Parse IDN names [default=on on tty])\n"
-"                 +[no]idnout         (Convert IDN response [default=on on tty])\n"
-#endif
+"                 +[no]idnin          (Parse IDN names)\n"
+"                 +[no]idnout         (Convert IDN response)\n"
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
 "                 +[no]keepalive      (Request EDNS TCP keepalive)\n"
 "                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
@@ -263,9 +262,6 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		else
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
-		if (query->servssldigest != NULL) {
-			printf(";; DNSoTLS cert digest: %s\n", query->servssldigest);
-		}
 		time(&tnow);
 #if !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
@@ -923,18 +919,6 @@ plus_option(char *option, bool is_batchfile,
 		case 'o': /* domain ... but treat "do" as synonym for dnssec */
 			if (cmd[2] == '\0')
 				goto dnssec;
-			if (cmd[2] == 't') {
-				FULLCHECK("dot");
-				if (!is_batchfile) {
-					lookup->tcp_mode = true;
-					lookup->dot_mode = state;
-					lookup->dot_mode_set = true;
-					if (!explicit_port) {
-						port = 853;
-					}
-				}
-				break;
-			}
 			FULLCHECK("domain");
 			if (value == NULL)
 				goto need_value;
@@ -1622,7 +1606,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			exit(0);
 			break;
 		case 'i':
-			/* deprecated */
+			ip6_int = true;
 			break;
 		case 'm': /* memdebug */
 			/* memdebug is handled in preparse_args() */
@@ -1707,7 +1691,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS)
 			fatal("Couldn't parse port number");
-		explicit_port = true;
 		port = num;
 		return (value_from_next);
 	case 'q':
@@ -1804,12 +1787,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*lookup = clone_lookup(default_lookup, true);
 		*need_clone = true;
 		if (get_reverse(textname, sizeof(textname), value,
-				false) == ISC_R_SUCCESS) {
+				ip6_int, false) == ISC_R_SUCCESS) {
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
 			(*lookup)->trace_root = ((*lookup)->trace  ||
 						 (*lookup)->ns_search_only);
+			(*lookup)->ip6_int = ip6_int;
 			if (!(*lookup)->rdtypeset)
 				(*lookup)->rdtype = dns_rdatatype_ptr;
 			if (!(*lookup)->rdclassset)
@@ -271,6 +271,17 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-i</term>
+	<listitem>
+	  <para>
+	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
+	    domain, which is no longer in use. Obsolete bit string
+	    label queries (RFC 2874) are not attempted.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-k <replaceable class="parameter">keyfile</replaceable></term>
 	<listitem>
@@ -383,7 +394,8 @@
 	    <literal>94.2.0.192.in-addr.arpa</literal> and sets the
 	    query type and class to PTR and IN respectively. IPv6
 	    addresses are looked up using nibble format under the
-	    IP6.ARPA domain.
+	    IP6.ARPA domain (but see also the <option>-i</option>
+	    option).
 	  </para>
 	</listitem>
      </varlistentry>
@@ -777,13 +789,7 @@
 	    <para>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
-	    </para>
-	    <para>
-	      The default is to process IDN input when standard output
-	      is a tty.  The IDN processing on input is disabled when
-	      dig output is redirected to files, pipes, and other
-	      non-tty file descriptors.
+	      compile time.  The default is to process IDN input.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -794,13 +800,7 @@
 	    <para>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
-	    </para>
-	    <para>
-	      The default is to process puny code on output when
-	      standard output is a tty.  The puny code processing on
-	      output is disabled when dig output is redirected to
-	      files, pipes, and other non-tty file descriptors.
+	      compile time.  The default is to convert output.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -114,8 +114,7 @@ bool
 	showsearch = false,
 	is_dst_up = false,
 	keep_open = false,
-	verbose = false,
-	explicit_port = false;
+	verbose = false;
 in_port_t port = 53;
 unsigned int timeout = 0;
 unsigned int extrabytes;
@@ -313,7 +312,8 @@ reverse_octets(const char *in, char **p, char *end) {
 }

 isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict)
+get_reverse(char *reverse, size_t len, char *value, bool ip6_int,
+	    bool strict)
 {
 	int r;
 	isc_result_t result;
@@ -327,6 +327,8 @@ get_reverse(char *reverse, size_t len, char *value, bool strict)
 		dns_name_t *name;
 		unsigned int options = 0;

+		if (ip6_int)
+			options |= DNS_BYADDROPT_IPV6INT;
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
@@ -626,7 +628,7 @@ make_empty_lookup(void) {
 	looknew->ttlunits = false;
 	looknew->qr = false;
 #ifdef HAVE_LIBIDN2
-	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
+	looknew->idnin = (getenv("IDN_DISABLE") == NULL);
 	looknew->idnout = looknew->idnin;
 #else
 	looknew->idnin = false;
@@ -650,8 +652,7 @@ make_empty_lookup(void) {
 	looknew->nsfound = 0;
 	looknew->tcp_mode = false;
 	looknew->tcp_mode_set = false;
-	looknew->dot_mode = false;
-	looknew->dot_mode_set = false;
+	looknew->ip6_int = false;
 	looknew->comments = true;
 	looknew->stats = true;
 	looknew->section_question = true;
@@ -790,8 +791,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->ns_search_only = lookold->ns_search_only;
 	looknew->tcp_mode = lookold->tcp_mode;
 	looknew->tcp_mode_set = lookold->tcp_mode_set;
-	looknew->dot_mode = lookold->dot_mode;
-	looknew->dot_mode_set = lookold->dot_mode_set;
 	looknew->comments = lookold->comments;
 	looknew->stats = lookold->stats;
 	looknew->section_question = lookold->section_question;
@@ -1535,6 +1534,12 @@ clear_query(dig_query_t *query) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
 	if (ISC_LINK_LINKED(query, clink))
 		ISC_LIST_UNLINK(lookup->connecting, query, clink);
+	if (ISC_LINK_LINKED(&query->recvbuf, link))
+		ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf,
+				 link);
+	if (ISC_LINK_LINKED(&query->lengthbuf, link))
+		ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf,
+				 link);
 	INSIST(query->recvspace != NULL);

 	if (query->sock != NULL) {
@@ -1543,18 +1548,12 @@ clear_query(dig_query_t *query) {
 		debug("sockcount=%d", sockcount);
 	}
 	isc_mempool_put(commctx, query->recvspace);
-	isc_mempool_put(commctx, query->tmpsendspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	if (query->servssldigest != NULL) {
-		isc_mem_free(mctx, query->servssldigest);
-	}
-
-	if (query->waiting_senddone) {
+	if (query->waiting_senddone)
 		query->pending_free = true;
-	} else {
+	else
 		isc_mem_free(mctx, query);
-	}
 }

 /*%
@@ -2484,21 +2483,21 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->first_rr_serial = 0;
 		query->second_rr_serial = 0;
 		query->servname = serv->servername;
-		query->servssldigest = NULL;
 		query->userarg = serv->userarg;
 		query->rr_count = 0;
 		query->msg_count = 0;
 		query->byte_count = 0;
 		query->ixfr_axfr = false;
+		ISC_LIST_INIT(query->recvlist);
+		ISC_LIST_INIT(query->lengthlist);
 		query->sock = NULL;
 		query->recvspace = isc_mempool_get(commctx);
-		query->tmpsendspace = isc_mempool_get(commctx);
 		if (query->recvspace == NULL)
 			fatal("memory allocation failure");

 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
-		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace, COMMSIZE);
+		isc_buffer_init(&query->slbuf, query->slspace, 2);
 		query->sendbuf = lookup->renderbuf;

 		ISC_LINK_INIT(query, clink);
@@ -2524,6 +2523,8 @@ setup_lookup(dig_lookup_t *lookup) {
 */
 static void
 send_done(isc_task_t *_task, isc_event_t *event) {
+	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
+	isc_buffer_t *b = NULL;
 	dig_query_t *query, *next;
 	dig_lookup_t *l;

@@ -2538,6 +2539,13 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	debug("sendcount=%d", sendcount);
 	INSIST(sendcount >= 0);

+	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
+	      b != NULL;
+	      b = ISC_LIST_HEAD(sevent->bufferlist)) {
+		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+		isc_mem_free(mctx, b);
+	}
+
 	query = event->ev_arg;
 	query->waiting_senddone = false;
 	l = query->lookup;
@@ -2728,7 +2736,6 @@ send_tcp_connect(dig_query_t *query) {

 	result = isc_socket_create(socketmgr,
 				   isc_sockaddr_pf(&query->sockaddr),
-				   query->lookup->dot_mode ? isc_sockettype_tls :
 				   isc_sockettype_tcp, &query->sock);
 	check_result(result, "isc_socket_create");
 	sockcount++;
@@ -2770,6 +2777,17 @@ send_tcp_connect(dig_query_t *query) {
 	}
 }

+static isc_buffer_t *
+clone_buffer(isc_buffer_t *source) {
+	isc_buffer_t *buffer;
+	buffer = isc_mem_allocate(mctx, sizeof(*buffer));
+	if (buffer == NULL)
+		fatal("memory allocation failure in %s:%d",
+		      __FILE__, __LINE__);
+	*buffer = *source;
+	return (buffer);
+}
+
 /*%
 * Send a UDP packet to the remote nameserver, possible starting the
 * recv action as well.  Also make sure that the timer is running and
@@ -2779,9 +2797,8 @@ static void
 send_udp(dig_query_t *query) {
 	dig_lookup_t *l = NULL;
 	isc_result_t result;
+	isc_buffer_t *sendbuf;
 	dig_query_t *next;
-	isc_region_t r;
-	isc_socketevent_t *sevent;

 	debug("send_udp(%p)", query);

@@ -2842,27 +2859,29 @@ send_udp(dig_query_t *query) {
 		check_result(result, "isc_socket_bind");

 		query->recv_made = true;
-		isc_buffer_availableregion(&query->recvbuf, &r);
+		ISC_LINK_INIT(&query->recvbuf, link);
+		ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf,
+				 link);
 		debug("recving with lookup=%p, query=%p, sock=%p",
 		      query->lookup, query, query->sock);
-		result = isc_socket_recv(query->sock, &r, 1,
-					 global_task, recv_done, query);
-		check_result(result, "isc_socket_recv");
+		result = isc_socket_recvv(query->sock, &query->recvlist, 1,
+					  global_task, recv_done, query);
+		check_result(result, "isc_socket_recvv");
 		recvcount++;
 		debug("recvcount=%d", recvcount);
 	}
-	isc_buffer_usedregion(&query->sendbuf, &r);
+	ISC_LIST_INIT(query->sendlist);
+	sendbuf = clone_buffer(&query->sendbuf);
+	ISC_LIST_ENQUEUE(query->sendlist, sendbuf, link);
 	debug("sending a request");
 	TIME_NOW(&query->time_sent);
 	INSIST(query->sock != NULL);
 	query->waiting_senddone = true;
-	sevent = isc_socket_socketevent(mctx, query->sock,
-					ISC_SOCKEVENT_SENDDONE,
-					send_done, query);
-	result = isc_socket_sendto2(query->sock, &r,
-				    global_task, &query->sockaddr, NULL,
-				    sevent, ISC_SOCKFLAG_NORETRY);
-	check_result(result, "isc_socket_sendto2");
+	result = isc_socket_sendtov2(query->sock, &query->sendlist,
+				     global_task, send_done, query,
+				     &query->sockaddr, NULL,
+				     ISC_SOCKFLAG_NORETRY);
+	check_result(result, "isc_socket_sendtov");
 	sendcount++;
 }

@@ -2952,8 +2971,7 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 static void
 tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent;
-	isc_buffer_t b;
-	isc_region_t r;
+	isc_buffer_t *b = NULL;
 	isc_result_t result;
 	dig_query_t *query = NULL;
 	dig_lookup_t *l, *n;
@@ -2973,6 +2991,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	recvcount--;
 	INSIST(recvcount >= 0);

+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b ==  &query->lengthbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
 	if (sevent->result == ISC_R_CANCELED) {
 		isc_event_free(&event);
 		l = query->lookup;
@@ -3005,10 +3027,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
-	isc_buffer_init(&b, sevent->region.base, sevent->n);
-	isc_buffer_add(&b, sevent->n);
-	length = isc_buffer_getuint16(&b);
-
+	length = isc_buffer_getuint16(b);
 	if (length == 0) {
 		isc_event_free(&event);
 		launch_next_query(query, false);
@@ -3022,11 +3041,13 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	 */
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_init(&query->recvbuf, query->recvspace, length);
-	isc_buffer_availableregion(&query->recvbuf, &r);
+	ENSURE(ISC_LIST_EMPTY(query->recvlist));
+	ISC_LINK_INIT(&query->recvbuf, link);
+	ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
 	debug("recving with lookup=%p, query=%p", query->lookup, query);
-	result = isc_socket_recv(query->sock, &r, length, task,
-				 recv_done, query);
-	check_result(result, "isc_socket_recv");
+	result = isc_socket_recvv(query->sock, &query->recvlist, length, task,
+				  recv_done, query);
+	check_result(result, "isc_socket_recvv");
 	recvcount++;
 	debug("resubmitted recv request with length %d, recvcount=%d",
 	      length, recvcount);
@@ -3042,7 +3063,7 @@ static void
 launch_next_query(dig_query_t *query, bool include_question) {
 	isc_result_t result;
 	dig_lookup_t *l;
-	isc_region_t r;
+	isc_buffer_t *buffer;

 	INSIST(!free_now);

@@ -3061,28 +3082,35 @@ launch_next_query(dig_query_t *query, bool include_question) {
 		return;
 	}

+	isc_buffer_clear(&query->slbuf);
 	isc_buffer_clear(&query->lengthbuf);
-	isc_buffer_availableregion(&query->lengthbuf, &r);
-	result = isc_socket_recv(query->sock, &r, 0,
-				 global_task, tcp_length_done, query);
-	check_result(result, "isc_socket_recv");
+	isc_buffer_putuint16(&query->slbuf, (uint16_t) query->sendbuf.used);
+	ISC_LIST_INIT(query->sendlist);
+	ISC_LINK_INIT(&query->slbuf, link);
+	if (!query->first_soa_rcvd) {
+		buffer = clone_buffer(&query->slbuf);
+		ISC_LIST_ENQUEUE(query->sendlist, buffer, link);
+		if (include_question) {
+			buffer = clone_buffer(&query->sendbuf);
+			ISC_LIST_ENQUEUE(query->sendlist, buffer, link);
+		}
+	}
+
+	ISC_LINK_INIT(&query->lengthbuf, link);
+	ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);
+
+	result = isc_socket_recvv(query->sock, &query->lengthlist, 0,
+				  global_task, tcp_length_done, query);
+	check_result(result, "isc_socket_recvv");
 	recvcount++;
 	debug("recvcount=%d", recvcount);
 	if (!query->first_soa_rcvd) {
 		debug("sending a request in launch_next_query");
 		TIME_NOW(&query->time_sent);
 		query->waiting_senddone = true;
-		isc_buffer_clear(&query->tmpsendbuf);
-		isc_buffer_putuint16(&query->tmpsendbuf,
-				     isc_buffer_usedlength(&query->sendbuf));
-		if (include_question) {
-			isc_buffer_usedregion(&query->sendbuf, &r);
-			isc_buffer_copyregion(&query->tmpsendbuf, &r);
-		}
-		isc_buffer_usedregion(&query->tmpsendbuf, &r);
-		result = isc_socket_send(query->sock, &r,
-					 global_task, send_done, query);
-		check_result(result, "isc_socket_send");
+		result = isc_socket_sendv(query->sock, &query->sendlist,
+					  global_task, send_done, query);
+		check_result(result, "isc_socket_sendv");
 		sendcount++;
 		debug("sendcount=%d", sendcount);
 	}
@@ -3175,11 +3203,6 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 	exitcode = 0;
-	query->servssldigest = isc_mem_allocate(mctx, 4096);
-	if (isc_socket_getsslhexdigest(query->sock, query->servssldigest, 4096) != ISC_R_SUCCESS) {
-		isc_mem_free(mctx, query->servssldigest);
-		query->servssldigest = NULL;
-	}
 	if (keep_open) {
 		if (keep != NULL)
 			isc_socket_detach(&keep);
@@ -3437,9 +3460,8 @@ ednsvers(dns_rdataset_t *opt) {
 static void
 recv_done(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = NULL;
-	isc_region_t r;
 	dig_query_t *query = NULL;
-	isc_buffer_t b;
+	isc_buffer_t *b = NULL;
 	dns_message_t *msg = NULL;
 	isc_result_t result;
 	dig_lookup_t *n, *l;
@@ -3469,8 +3491,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
 	sevent = (isc_socketevent_t *)event;

-	isc_buffer_init(&b, sevent->region.base, sevent->n);
-	isc_buffer_add(&b, sevent->n);
+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b == &query->recvbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);

 	if ((l->tcp_mode) && (query->timer != NULL))
 		isc_timer_touch(query->timer);
@@ -3546,7 +3569,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	result = dns_message_peekheader(&b, &id, &msgflags);
+	result = dns_message_peekheader(b, &id, &msgflags);
 	if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
 		match = false;
 		if (l->tcp_mode) {
@@ -3615,7 +3638,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
 		parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
 	}
-	result = dns_message_parse(msg, &b, parseflags);
+	result = dns_message_parse(msg, b, parseflags);
 	if (result == DNS_R_RECOVERABLE) {
 		printf(";; Warning: Message parser reports malformed "
 		       "message packet.\n");
@@ -3623,7 +3646,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 	if (result != ISC_R_SUCCESS) {
 		printf(";; Got bad packet: %s\n", isc_result_totext(result));
-		hex_dump(&b);
+		hex_dump(b);
 		query->waiting_connect = false;
 		dns_message_destroy(&msg);
 		isc_event_free(&event);
@@ -3777,7 +3800,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}

 	if (tsigkey != NULL) {
-		result = dns_tsig_verify(&b, msg, NULL, NULL);
+		result = dns_tsig_verify(&query->recvbuf, msg, NULL, NULL);
 		if (result != ISC_R_SUCCESS) {
 			printf(";; Couldn't verify signature: %s\n",
 			       isc_result_totext(result));
@@ -3793,7 +3816,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		check_result(result,"dns_message_getquerytsig");
 	}

-	extrabytes = isc_buffer_remaininglength(&b);
+	extrabytes = isc_buffer_remaininglength(b);

 	debug("after parse");
 	if (l->doing_xfr && l->xfr_q == NULL) {
@@ -3840,8 +3863,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(query->lookup) || showsearch) {
 				dighost_printmessage(query, msg, true);
-				dighost_received(isc_buffer_usedlength(&b),
-						 &sevent->address, query);
+				dighost_received(b->used, &sevent->address,
+						 query);
 			}
 		} else if (!l->trace && !l->ns_search_only) {
 			dighost_printmessage(query, msg, true);
@@ -3908,8 +3931,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	} else {

 		if (msg->rcode == dns_rcode_noerror || l->origin == NULL) {
-			dighost_received(isc_buffer_usedlength(&b),
-					 &sevent->address, query);
+			dighost_received(b->used, &sevent->address, query);
 		}

 		if (!query->lookup->ns_search_only)
@@ -3933,10 +3955,10 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 udp_mismatch:
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
-	isc_buffer_availableregion(&query->recvbuf, &r);
-	result = isc_socket_recv(query->sock, &r, 1,
-				 global_task, recv_done, query);
-	check_result(result, "isc_socket_recv");
+	ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
+	result = isc_socket_recvv(query->sock, &query->recvlist, 1,
+				  global_task, recv_done, query);
+	check_result(result, "isc_socket_recvv");
 	recvcount++;
 	isc_event_free(&event);
 	UNLOCK_LOOKUP;
@@ -143,6 +143,7 @@ show_usage(void) {
 "       -c specifies query class for non-IN data\n"
 "       -C compares SOA records on authoritative nameservers\n"
 "       -d is equivalent to -v\n"
+"       -i IP6.INT reverse lookups\n"
 "       -l lists all hosts in a domain, using AXFR\n"
 "       -m set memory debugging flag (trace|record|usage)\n"
 "       -N changes the number of dots allowed before root lookup is done\n"
@@ -761,7 +762,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			default_lookups = false;
 			break;
 		case 'i':
-			/* deprecated */
+			lookup->ip6_int = true;
 			break;
 		case 'n':
 			/* deprecated */
@@ -840,8 +841,8 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 		check_ra = true;

 	lookup->pending = false;
-	if (get_reverse(store, sizeof(store), hostname, true)
-	    == ISC_R_SUCCESS) {
+	if (get_reverse(store, sizeof(store), hostname,
+			lookup->ip6_int, true) == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
 		lookup->rdtypeset = true;
@@ -179,6 +179,18 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-i</term>
+	<listitem>
+	  <para>
+	    Obsolete.
+	    Use the IP6.INT domain for reverse lookups of IPv6
+	    addresses as defined in RFC1886 and deprecated in RFC4159.
+	    The default is to use IP6.ARPA as specified in RFC3596.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-l</term>
 	<listitem>
@@ -101,10 +101,9 @@ struct dig_lookup {
 		zflag,
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
-		dot_mode,
-		dot_mode_set,
 		tcp_mode,
 		tcp_mode_set,
+		ip6_int,
 		comments,
 		stats,
 		section_question,
@@ -203,14 +202,16 @@ struct dig_query {
 	uint32_t rr_count;
 	bool ixfr_axfr;
 	char *servname;
-	char *servssldigest;
 	char *userarg;
+	isc_bufferlist_t sendlist,
+		recvlist,
+		lengthlist;
 	isc_buffer_t recvbuf,
 		lengthbuf,
-		tmpsendbuf,
-		sendbuf;
-	char *recvspace, *tmpsendspace,
-		lengthspace[4];
+		slbuf;
+	char *recvspace,
+		lengthspace[4],
+		slspace[4];
 	isc_socket_t *sock;
 	ISC_LINK(dig_query_t) link;
 	ISC_LINK(dig_query_t) clink;
@@ -218,6 +219,7 @@ struct dig_query {
 	isc_time_t time_sent;
 	isc_time_t time_recv;
 	uint64_t byte_count;
+	isc_buffer_t sendbuf;
 	isc_timer_t *timer;
 };

@@ -245,7 +247,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;

 extern bool check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch, explicit_port;
+	usesearch, showsearch;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -282,7 +284,8 @@ int
 getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);

 isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict);
+get_reverse(char *reverse, size_t len, char *value, bool ip6_int,
+	    bool strict);

 ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
@@ -772,7 +772,7 @@ addlookup(char *opt) {
 		rdclass = dns_rdataclass_in;
 	}
 	lookup = make_empty_lookup();
-	if (get_reverse(store, sizeof(store), opt, true)
+	if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, true)
 	    == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
@@ -923,6 +923,12 @@ flush_lookup_list(void) {
 						  ISC_SOCKCANCEL_ALL);
 				isc_socket_detach(&q->sock);
 			}
+			if (ISC_LINK_LINKED(&q->recvbuf, link))
+				ISC_LIST_DEQUEUE(q->recvlist, &q->recvbuf,
+						 link);
+			if (ISC_LINK_LINKED(&q->lengthbuf, link))
+				ISC_LIST_DEQUEUE(q->lengthlist, &q->lengthbuf,
+						 link);
 			isc_buffer_invalidate(&q->recvbuf);
 			isc_buffer_invalidate(&q->lengthbuf);
 			qp = q;
@@ -489,8 +489,7 @@ nslookup -query=hinfo  -timeout=10
      If you'd like to turn off the IDN support for some reason, define
      the <envar>IDN_DISABLE</envar> environment variable.
      The IDN support is disabled if the variable is set when
-      <command>nslookup</command> runs or when the standard output is not
-      a tty.
+      <command>nslookup</command> runs.
    </para>
  </refsection>

@@ -64,8 +64,8 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | RSASHA1 |\n"
-			"        NSEC3RSASHA1 |\n"
+			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
+			"        NSEC3DSA | NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
@@ -402,9 +402,13 @@ main(int argc, char **argv) {

 		if (use_nsec3) {
 			switch (alg) {
+			case DST_ALG_DSA:
+				alg = DST_ALG_NSEC3DSA;
+				break;
 			case DST_ALG_RSASHA1:
 				alg = DST_ALG_NSEC3RSASHA1;
 				break;
+			case DST_ALG_NSEC3DSA:
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    NSEC3RSASHA1, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>
@@ -119,9 +119,9 @@
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
 	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    will be used instead.
+	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
 	    As of BIND 9.12.0, this option is mandatory except when using
@@ -79,8 +79,8 @@ usage(void) {
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -K <directory>: write keys into directory\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
-				" |\n");
+	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
+				" | NSEC3DSA |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
@@ -92,6 +92,10 @@ usage(void) {
 	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        DH:\t\t[128..4096]\n");
+	fprintf(stderr, "        DSA:\t\t[512..1024] and divisible by 64\n");
+	fprintf(stderr, "        NSEC3DSA:\t[512..1024] and divisible "
+				"by 64\n");
+	fprintf(stderr, "        ECCGOST:\tignored\n");
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
@@ -157,6 +161,11 @@ usage(void) {
 	exit (-1);
 }

+static bool
+dsa_size_ok(int size) {
+	return (size >= 512 && size <= 1024 && size % 64 == 0);
+}
+
 static void
 progress(int p)
 {
@@ -533,12 +542,17 @@ main(int argc, char **argv) {

 		if (use_nsec3) {
 			switch (alg) {
+			case DST_ALG_DSA:
+				alg = DST_ALG_NSEC3DSA;
+				break;
 			case DST_ALG_RSASHA1:
 				alg = DST_ALG_NSEC3RSASHA1;
 				break;
+			case DST_ALG_NSEC3DSA:
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -584,6 +598,7 @@ main(int argc, char **argv) {
 							" to %d\n", size);
 				}
 				break;
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -713,6 +728,14 @@ main(int argc, char **argv) {
 		if (size != 0 && (size < 128 || size > 4096))
 			fatal("DH key size %d out of range", size);
 		break;
+	case DNS_KEYALG_DSA:
+	case DNS_KEYALG_NSEC3DSA:
+		if (size != 0 && !dsa_size_ok(size))
+			fatal("invalid DSS key size: %d", size);
+		break;
+	case DST_ALG_ECCGOST:
+		size = 256;
+		break;
 	case DST_ALG_ECDSA256:
 		size = 256;
 		break;
@@ -792,6 +815,9 @@ main(int argc, char **argv) {
 		param = generator;
 		break;

+	case DNS_KEYALG_DSA:
+	case DNS_KEYALG_NSEC3DSA:
+	case DST_ALG_ECCGOST:
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
@@ -123,7 +123,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    NSEC3RSASHA1, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>
@@ -132,9 +132,9 @@
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
 	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    will be used instead.
+	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
 	    This parameter <emphasis>must</emphasis> be specified except
@@ -40,7 +40,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -198,25 +198,6 @@
      background-color: #99ddff;
     }

-     table.zones {
-      border: 1px solid grey;
-      width: 500px;
-     }
-     table.zones th {
-      text-align: center;
-      border: 1px solid grey;
-     }
-     table.zones td {
-      text-align: center;
-      font-family: monospace;
-     }
-     table.zones td:nth-child(1) {
-      text-align: right;
-     }
-     table.zones td:nth-child(4) {
-      text-align: right;
-     }
-
     .totals {
      background-color: rgb(1,169,206);
      color: #ffffff;
@@ -724,35 +705,6 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:for-each select="views/view">
-	  <xsl:if test="zones/zone">
-            <h3>Zones for View <xsl:value-of select="@name"/></h3>
-            <table class="zones">
-              <tr>
-                <th>Name</th>
-                <th>Class</th>
-                <th>Type</th>
-                <th>Serial</th>
-              </tr>
-              <xsl:for-each select="zones/zone">
-                <tr>
-                  <td>
-                    <xsl:value-of select="@name"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="@rdataclass"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="type"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="serial"/>
-                  </td>
-                </tr>
-              </xsl:for-each>
-            </table>
-	  </xsl:if>
-        </xsl:for-each>
        <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
          <h2>Received QTYPES per view/zone</h2>
          <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
@@ -203,25 +203,6 @@ static char xslmsg[] =
 	" background-color: #99ddff;\n"
 	" }\n"
 	"\n"
-	" table.zones {\n"
-	" border: 1px solid grey;\n"
-	" width: 500px;\n"
-	" }\n"
-	" table.zones th {\n"
-	" text-align: center;\n"
-	" border: 1px solid grey;\n"
-	" }\n"
-	" table.zones td {\n"
-	" text-align: center;\n"
-	" font-family: monospace;\n"
-	" }\n"
-	" table.zones td:nth-child(1) {\n"
-	" text-align: right;\n"
-	" }\n"
-	" table.zones td:nth-child(4) {\n"
-	" text-align: right;\n"
-	" }\n"
-	"\n"
 	" .totals {\n"
 	" background-color: rgb(1,169,206);\n"
 	" color: #ffffff;\n"
@@ -729,35 +710,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:for-each select=\"views/view\">\n"
-	" <xsl:if test=\"zones/zone\">\n"
-	" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <table class=\"zones\">\n"
-	" <tr>\n"
-	" <th>Name</th>\n"
-	" <th>Class</th>\n"
-	" <th>Type</th>\n"
-	" <th>Serial</th>\n"
-	" </tr>\n"
-	" <xsl:for-each select=\"zones/zone\">\n"
-	" <tr>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@rdataclass\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"type\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"serial\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" </xsl:if>\n"
-	" </xsl:for-each>\n"
 	" <xsl:if test=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
 	" <h2>Received QTYPES per view/zone</h2>\n"
 	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
@@ -301,21 +301,6 @@ view \"_bind\" chaos {\n\
 MANAGED_KEYS

 "# END MANAGED KEYS\n\
-\n\
-masters " DEFAULT_IANA_ROOT_ZONE_MASTERS " {\n\
-	2001:500:84::b;		# b.root-servers.net\n\
-	2001:500:2f::f;		# f.root-servers.net\n\
-	2001:7fd::1;		# k.root-servers.net\n\
-	2620:0:2830:202::132;	# xfr.cjr.dns.icann.org\n\
-	2620:0:2d0:202::132;	# xfr.lax.dns.icann.org\n\
-	192.228.79.201;		# b.root-servers.net\n\
-	192.33.4.12;		# c.root-servers.net\n\
-	192.5.5.241;		# f.root-servers.net\n\
-	192.112.36.4;		# g.root-servers.net\n\
-	193.0.14.129;		# k.root-servers.net\n\
-	192.0.47.132;		# xfr.cjr.dns.icann.org\n\
-	192.0.32.132;		# xfr.lax.dns.icann.org\n\
-};\n\
 ";

 isc_result_t
@@ -447,8 +432,6 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 		   strcasecmp(str, "slave") == 0)
 	{
 		ztype = dns_zone_slave;
-	} else if (strcasecmp(str, "mirror") == 0) {
-		ztype = dns_zone_mirror;
 	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
 	} else if (strcasecmp(str, "static-stub") == 0) {
@@ -570,9 +553,9 @@ named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 	}
 }

-isc_result_t
-named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
-			   const cfg_obj_t **ret)
+static isc_result_t
+get_masters_def(const cfg_obj_t *cctx, const char *name,
+		const cfg_obj_t **ret)
 {
 	isc_result_t result;
 	const cfg_obj_t *masters = NULL;
@@ -714,8 +697,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					break;
 			if (j < l)
 				continue;
-			tresult = named_config_getmastersdef(config, listname,
-							     &list);
+			tresult = get_masters_def(config, listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
 				    "masters \"%s\" not found", listname);
@@ -22,8 +22,6 @@
 #include <dns/types.h>
 #include <dns/zone.h>

-#define DEFAULT_IANA_ROOT_ZONE_MASTERS "_default_iana_root_zone_masters"
-
 isc_result_t
 named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);

@@ -59,10 +57,6 @@ void
 named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 		    isc_dscp_t **dscpsp, uint32_t count);

-isc_result_t
-named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
-			   const cfg_obj_t **ret);
-
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			  isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
@@ -1332,6 +1332,9 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		named_main_earlyfatal("program name too long");

+	if (result != ISC_R_SUCCESS)
+		named_main_earlyfatal("failed to build internal symbol table");
+
 	isc_assertion_setcallback(assertion_failed);
 	isc_error_setfatal(library_fatal_error);
 	isc_error_setunexpected(library_unexpected_error);
@@ -884,6 +884,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-zone\-ttl ( unlimited | \fIttlval\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
+		mirror \fIboolean\fR;
 		multi\-master \fIboolean\fR;
 		notify ( explicit | master\-only | \fIboolean\fR );
 		notify\-delay \fIinteger\fR;
@@ -898,7 +899,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 		request\-expire \fIboolean\fR;
 		request\-ixfr \fIboolean\fR;
 		serial\-update\-method ( date | increment | unixtime );
-		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
+		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [
+		    port \fIinteger\fR ]; \&.\&.\&. };
 		server\-names { \fIstring\fR; \&.\&.\&. };
 		sig\-signing\-nodes \fIinteger\fR;
 		sig\-signing\-signatures \fIinteger\fR;
@@ -909,7 +911,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port (
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		try\-tcp\-refresh \fIboolean\fR;
-		type ( primary | master | secondary | slave | mirror |
+		type ( primary | master | secondary | slave |
 		    delegation\-only | forward | hint | redirect |
 		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
@@ -992,6 +994,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
+	mirror \fIboolean\fR;
 	multi\-master \fIboolean\fR;
 	notify ( explicit | master\-only | \fIboolean\fR );
 	notify\-delay \fIinteger\fR;
@@ -1004,7 +1007,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	request\-expire \fIboolean\fR;
 	request\-ixfr \fIboolean\fR;
 	serial\-update\-method ( date | increment | unixtime );
-	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
+	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port
+	    \fIinteger\fR ]; \&.\&.\&. };
 	server\-names { \fIstring\fR; \&.\&.\&. };
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
@@ -1015,9 +1019,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	try\-tcp\-refresh \fIboolean\fR;
-	type ( primary | master | secondary | slave | mirror |
-	    delegation\-only | forward | hint | redirect | static\-stub |
-	    stub );
+	type ( primary | master | secondary | slave | delegation\-only |
+	    forward | hint | redirect | static\-stub | stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
 	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-10-23</date>
+    <date>2018-09-04</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -341,6 +341,7 @@ options {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -672,6 +673,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -862,6 +864,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
+		mirror <replaceable>boolean</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
 		notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 		notify-delay <replaceable>integer</replaceable>;
@@ -876,7 +879,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		request-expire <replaceable>boolean</replaceable>;
 		request-ixfr <replaceable>boolean</replaceable>;
 		serial-update-method ( date | increment | unixtime );
-		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
+		    port <replaceable>integer</replaceable> ]; ... };
 		server-names { <replaceable>string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
@@ -887,7 +891,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port (
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		try-tcp-refresh <replaceable>boolean</replaceable>;
-		type ( primary | master | secondary | slave | mirror |
+		type ( primary | master | secondary | slave |
 		    delegation-only | forward | hint | redirect |
 		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
@@ -966,6 +970,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 	notify-delay <replaceable>integer</replaceable>;
@@ -978,7 +983,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-expire <replaceable>boolean</replaceable>;
 	request-ixfr <replaceable>boolean</replaceable>;
 	serial-update-method ( date | increment | unixtime );
-	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
+	    <replaceable>integer</replaceable> ]; ... };
 	server-names { <replaceable>string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
@@ -989,9 +995,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	try-tcp-refresh <replaceable>boolean</replaceable>;
-	type ( primary | master | secondary | slave | mirror |
-	    delegation-only | forward | hint | redirect | static-stub |
-	    stub );
+	type ( primary | master | secondary | slave | delegation-only |
+	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
 	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
@@ -853,6 +853,7 @@ view
 		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+		mirror <em class="replaceable"><code>boolean</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 		notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 		notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -867,7 +868,8 @@ view
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
-		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
+		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -878,7 +880,7 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( primary | master | secondary | slave | mirror |<br>
+		type ( primary | master | secondary | slave |<br>
 		    delegation-only | forward | hint | redirect |<br>
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
@@ -958,6 +960,7 @@ zone
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+	mirror <em class="replaceable"><code>boolean</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 	notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 	notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -970,7 +973,8 @@ zone
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
-	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -981,9 +985,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( primary | master | secondary | slave | mirror |<br>
-	    delegation-only | forward | hint | redirect | static-stub |<br>
-	    stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
@@ -30,7 +30,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/hmac.h>
+#include <isc/hmacsha.h>
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
@@ -41,6 +41,7 @@
 #include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
+#include <isc/sha2.h>
 #include <isc/socket.h>
 #include <isc/stat.h>
 #include <isc/stats.h>
@@ -6423,8 +6424,7 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 			goto clean;

 		result = ns_listenelt_create(mctx, isc_sockaddr_getport(addr),
-					     dscp, src_acl, NULL, NULL,
-					     &lelt);
+					     dscp, src_acl, &lelt);
 		if (result != ISC_R_SUCCESS)
 			goto clean;
 		ISC_LIST_APPEND(list->elts, lelt, link);
@@ -6978,9 +6978,6 @@ removed(dns_zone_t *zone, void *uap) {
 	case dns_zone_slave:
 		type = "slave";
 		break;
-	case dns_zone_mirror:
-		type = "mirror";
-		break;
 	case dns_zone_stub:
 		type = "stub";
 		break;
@@ -9011,7 +9008,6 @@ load_configuration(const char *filename, named_server_t *server,
 		bool first = true;
 		isc_buffer_t b;
 		unsigned int usedlength;
-		unsigned int expectedlength;

 		for (element = cfg_list_first(obj);
 		     element != NULL;
@@ -9057,26 +9053,21 @@ load_configuration(const char *filename, named_server_t *server,
 			usedlength = isc_buffer_usedlength(&b);
 			switch (server->sctx->cookiealg) {
 			case ns_cookiealg_aes:
-				expectedlength = ISC_AES128_KEYLENGTH;
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_AES128_KEYLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "AES cookie-secret must be "
 					       "128 bits");
 				}
 				break;
 			case ns_cookiealg_sha1:
-				expectedlength =
-					isc_md_type_get_size(ISC_MD_SHA1);
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_SHA1_DIGESTLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "SHA1 cookie-secret must be "
 					       "160 bits");
 				}
 				break;
 			case ns_cookiealg_sha256:
-				expectedlength =
-					isc_md_type_get_size(ISC_MD_SHA256);
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_SHA256_DIGESTLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "SHA256 cookie-secret must be "
 					       "256 bits");
@@ -10170,8 +10161,7 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	}
 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
-	    type == dns_zone_stub ||
+	if (type == dns_zone_slave || type == dns_zone_stub ||
 	    (type == dns_zone_redirect &&
 	     dns_zone_getredirecttype(zone) == dns_zone_slave))
 		dns_zone_forcereload(zone);
@@ -10203,9 +10193,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 			msg = "server reload successful";
 	} else {
 		type = dns_zone_gettype(zone);
-		if (type == dns_zone_slave || type == dns_zone_mirror ||
-		    type == dns_zone_stub)
-		{
+		if (type == dns_zone_slave || type == dns_zone_stub) {
 			dns_zone_refresh(zone);
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
@@ -10296,7 +10284,7 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result;
 	dns_zone_t *zone = NULL, *raw = NULL;
 	const char msg1[] = "zone refresh queued";
-	const char msg2[] = "not a slave, mirror, or stub zone";
+	const char msg2[] = "not a slave or stub zone";
 	dns_zonetype_t type;

 	result = zone_from_args(server, lex, NULL, &zone, NULL,
@@ -10314,9 +10302,7 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	}

 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
-	    type == dns_zone_stub)
-	{
+	if (type == dns_zone_slave || type == dns_zone_stub) {
 		dns_zone_refresh(zone);
 		dns_zone_detach(&zone);
 		(void) putstr(text, msg1);
@@ -10411,24 +10397,12 @@ ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			uint16_t family, ns_listenelt_t **target)
 {
 	isc_result_t result;
-	const cfg_obj_t *portobj, *dscpobj, *keyobj, *certobj;
-	const char *cert = NULL, *key=NULL;
+	const cfg_obj_t *portobj, *dscpobj;
 	in_port_t port;
 	isc_dscp_t dscp = -1;
 	ns_listenelt_t *delt = NULL;
 	REQUIRE(target != NULL && *target == NULL);

-	keyobj = cfg_tuple_get(listener, "key");
-	if (cfg_obj_isstring(keyobj)) {
-		key = cfg_obj_asstring(keyobj);
-	}
-
-	certobj = cfg_tuple_get(listener, "cert");
-	if (cfg_obj_isstring(certobj)) {
-		cert = cfg_obj_asstring(certobj);
-	}
-
-
 	portobj = cfg_tuple_get(listener, "port");
 	if (!cfg_obj_isuint32(portobj)) {
 		if (named_g_port != 0) {
@@ -10461,8 +10435,7 @@ ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}

-	printf("Cert %s key %s port %d\n", cert, key, port);
-	result = ns_listenelt_create(mctx, port, dscp, NULL, cert, key, &delt);
+	result = ns_listenelt_create(mctx, port, dscp, NULL, &delt);
 	if (result != ISC_R_SUCCESS)
 		return (result);

@@ -10890,7 +10863,7 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 				continue;
 			}
 			CHECK(putstr(text, "\n   Negative trust anchors:\n\n"));
-			CHECK(dns_ntatable_totext(ntatable, NULL, text));
+			CHECK(dns_ntatable_totext(ntatable, text));
 		}
 		if (ptr != NULL)
 			ptr = next_token(lex, text);
@@ -13521,7 +13494,6 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		TCHECK(putstr(text, zonename));
 		TCHECK(putstr(text, "' and associated files will be deleted."));
 	} else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
-		   dns_zone_gettype(mayberaw) == dns_zone_mirror ||
 		   dns_zone_gettype(mayberaw) == dns_zone_stub)
 	{
 		bool first;
@@ -14064,10 +14036,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 		type = "master";
 		break;
 	case dns_zone_slave:
-		type = "slave";
-		break;
-	case dns_zone_mirror:
-		type = "mirror";
+		type = dns_zone_ismirror(zone) ? "mirror" : "slave";
 		break;
 	case dns_zone_stub:
 		type = "stub";
@@ -14123,7 +14092,6 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,

 	/* Refresh/expire times */
 	if (zonetype == dns_zone_slave ||
-	    zonetype == dns_zone_mirror ||
 	    zonetype == dns_zone_stub ||
 	    zonetype == dns_zone_redirect)
 	{
@@ -14327,7 +14295,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result = ISC_R_SUCCESS;
 	char *ptr, *nametext = NULL, *viewname;
 	char namebuf[DNS_NAME_FORMATSIZE];
-	char viewbuf[DNS_NAME_FORMATSIZE];
 	isc_stdtime_t now, when;
 	isc_time_t t;
 	char tbuf[64];
@@ -14337,9 +14304,8 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	const dns_name_t *ntaname;
 	dns_name_t *fname;
 	dns_ttl_t ntattl;
-	bool ttlset = false, excl = false, viewfound = false;
+	bool ttlset = false, excl = false;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
-	bool first = true;

 	UNUSED(force);

@@ -14352,24 +14318,18 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	}

 	for (;;) {
-		bool opts = true;
-
 		/* Check for options */
 		ptr = next_token(lex, text);
 		if (ptr == NULL) {
 			return (ISC_R_UNEXPECTEDEND);
 		}

-		if (!opts) {
-			nametext = ptr;
-		} else if (strcmp(ptr, "--") == 0) {
-			opts = false;
-		} else if (argcheck(ptr, "dump")) {
+		if (argcheck(ptr, "dump")) {
 			dump = true;
 		} else if (argcheck(ptr, "remove")) {
 			ntattl = 0;
 			ttlset = true;
-		} else if (opts && argcheck(ptr, "force")) {
+		} else if (argcheck(ptr, "force")) {
 			force = true;
 			continue;
 		} else if (argcheck(ptr, "lifetime")) {
@@ -14409,9 +14369,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			tr.length = strlen(ptr);
 			CHECK(dns_rdataclass_fromtext(&rdclass, &tr));
 			continue;
-		} else if (ptr[0] == '-') {
-			msg = "Unknown option";
-			CHECK(DNS_R_SYNTAX);
 		} else {
 			nametext = ptr;
 		}
@@ -14434,8 +14391,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			if (result == ISC_R_NOTFOUND) {
 				continue;
 			}
-
-			CHECK(dns_ntatable_totext(ntatable, view->name, text));
+			CHECK(dns_ntatable_totext(ntatable, text));
 		}
 		CHECK(putnull(text));

@@ -14473,14 +14429,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,

 	/* Look for the view name. */
 	viewname = next_token(lex, text);
-	if (viewname != NULL) {
-		strlcpy(viewbuf, viewname, DNS_NAME_FORMATSIZE);
-		viewname = viewbuf;
-	}
-
-	if (next_token(lex, text) != NULL) {
-		CHECK(DNS_R_SYNTAX);
-	}

 	isc_stdtime_get(&now);

@@ -14491,10 +14439,11 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
+		static bool first = true;
+
 		if (viewname != NULL && strcmp(view->name, viewname) != 0) {
 			continue;
 		}
-		viewfound = true;

 		if (view->rdclass != rdclass && rdclass != dns_rdataclass_any) {
 			continue;
@@ -14550,37 +14499,22 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 				      "added NTA '%s' (%d sec) in view '%s'",
 				      namebuf, ntattl, view->name);
 		} else {
-			bool removed;
-
-			result = dns_ntatable_delete(ntatable, ntaname);
-			if (result == ISC_R_SUCCESS) {
-				removed = true;
-			} else if (result == ISC_R_NOTFOUND) {
-				removed = false;
-			} else {
-				goto cleanup;
-			}
+			CHECK(dns_ntatable_delete(ntatable, ntaname));

 			if (!first) {
 				CHECK(putstr(text, "\n"));
 			}
 			first = false;

-			CHECK(putstr(text, "Negative trust anchor "));
-			CHECK(putstr(text, removed ? "removed: "
-						   : "not found: "));
+			CHECK(putstr(text, "Negative trust anchor removed: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
 			CHECK(putstr(text, view->name));

-			if (removed) {
-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
-					      NAMED_LOGMODULE_SERVER,
-					      ISC_LOG_INFO,
-					      "removed NTA '%s' in view %s",
-					      namebuf, view->name);
-			}
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "removed NTA '%s' in view %s",
+				      namebuf, view->name);
 		}

 		result = dns_view_saventa(view);
@@ -14593,11 +14527,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		}
 	}

-	if (!viewfound) {
-		msg = "No such view";
-		CHECK(ISC_R_NOTFOUND);
-	}
-
 	CHECK(putnull(text));

 cleanup:
@@ -14605,7 +14534,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		(void) putstr(text, msg);
 		(void) putnull(text);
 	}
-
 	if (excl) {
 		isc_task_endexclusive(server->task);
 	}
@@ -94,7 +94,6 @@ user_zonetype( dns_zone_t *zone ) {
 		{ dns_zone_none, "none" },
 		{ dns_zone_master, "master" },
 		{ dns_zone_slave, "slave" },
-		{ dns_zone_mirror, "mirror" },
 		{ dns_zone_stub, "stub" },
 		{ dns_zone_staticstub, "static-stub" },
 		{ dns_zone_key, "key" },
@@ -755,13 +755,8 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 	isc_result_t result;

 	switch (ztype) {
-	case dns_zone_slave:
-	case dns_zone_mirror:
-		zone = "slave";
-		break;
-	case dns_zone_master:
-		zone = "master";
-		break;
+	case dns_zone_slave: zone = "slave"; break;
+	case dns_zone_master: zone = "master"; break;
 	default:
 		INSIST(0);
 	}
@@ -833,37 +828,6 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	return (view == myview);
 }

-/*%
- * For mirror zones, change "notify yes;" to "notify explicit;", informing the
- * user only if "notify" was explicitly configured rather than inherited from
- * default configuration.
- */
-static dns_notifytype_t
-process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
-		   const char *zname, const cfg_obj_t **maps)
-{
-	const cfg_obj_t *obj = NULL;
-
-	/*
-	 * Return the original setting if this is not a mirror zone or if the
-	 * zone is configured with something else than "notify yes;".
-	 */
-	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return (ntype);
-	}
-
-	/*
-	 * Only log a message if "notify" was set in the configuration
-	 * hierarchy supplied in 'maps'.
-	 */
-	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
-			    "'notify explicit;' will be used for mirror zone "
-			    "'%s'", zname);
-	}
-
-	return (dns_notifytype_explicit);
-}

 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
@@ -1018,7 +982,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		return (ISC_R_FAILURE);
 	}

-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror)
+	if (ztype == dns_zone_slave)
 		masterformat = dns_masterformat_raw;
 	else
 		masterformat = dns_masterformat_text;
@@ -1112,7 +1076,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	/*
 	 * Notify messages are processed by the raw zone if it exists.
 	 */
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror)
+	if (ztype == dns_zone_slave)
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
 					  allow_notify, ac, mayberaw,
 					  dns_zone_setnotifyacl,
@@ -1218,8 +1182,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			else
 				INSIST(0);
 		}
-		notifytype = process_notifytype(notifytype, ztype, zname,
-						nodefault);
 		if (raw != NULL)
 			dns_zone_setnotifytype(raw, dns_notifytype_no);
 		dns_zone_setnotifytype(zone, notifytype);
@@ -1575,7 +1537,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 	}

-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
+	if (ztype == dns_zone_slave) {
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
 					  allow_update_forwarding, ac,
 					  mayberaw, dns_zone_setforwardacl,
@@ -1733,38 +1695,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 * Configure slave functionality.
 	 */
 	switch (ztype) {
-	case dns_zone_mirror:
-		/*
-		 * Disable outgoing zone transfers for mirror zones unless they
-		 * are explicitly enabled by zone configuration.
-		 */
-		obj = NULL;
-		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
-		if (obj == NULL) {
-			dns_acl_t *none;
-			RETERR(dns_acl_none(mctx, &none));
-			dns_zone_setxfracl(zone, none);
-			dns_acl_detach(&none);
-		}
-		/* FALLTHROUGH */
 	case dns_zone_slave:
 	case dns_zone_stub:
 	case dns_zone_redirect:
 		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "masters", &obj);
-		/*
-		 * Use the built-in master server list if one was not
-		 * explicitly specified and this is a root zone mirror.
-		 */
-		if (obj == NULL && ztype == dns_zone_mirror &&
-		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
-		{
-			result = named_config_getmastersdef(named_g_config,
-						DEFAULT_IANA_ROOT_ZONE_MASTERS,
-						&obj);
-			RETERR(result);
-		}
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
@@ -1791,6 +1727,35 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

+		obj = NULL;
+		(void)cfg_map_get(zoptions, "mirror", &obj);
+		if (obj != NULL) {
+			bool mirror = cfg_obj_asboolean(obj);
+			dns_zone_setoption(mayberaw, DNS_ZONEOPT_MIRROR,
+					   mirror);
+			if (mirror) {
+				/*
+				 * Disable outgoing zone transfers unless they
+				 * are explicitly enabled by zone
+				 * configuration.
+				 */
+				obj = NULL;
+				(void)cfg_map_get(zoptions, "allow-transfer",
+						  &obj);
+				if (obj == NULL) {
+					dns_acl_t *none;
+					RETERR(dns_acl_none(mctx, &none));
+					dns_zone_setxfracl(zone, none);
+					dns_acl_detach(&none);
+				}
+				/*
+				 * Only allow "also-notify".
+				 */
+				notifytype = dns_notifytype_explicit;
+				dns_zone_setnotifytype(zone, notifytype);
+			}
+		}
+
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1930,7 +1895,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	const char *cfilename;
 	const char *zfilename;
 	dns_zone_t *raw = NULL;
-	bool has_raw;
+	bool has_raw, mirror;
 	dns_zonetype_t ztype;

 	zoptions = cfg_tuple_get(zconfig, "options");
@@ -1970,6 +1935,21 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 		return (false);
 	}

+	/*
+	 * Do not reuse a zone whose "mirror" setting was changed.
+	 */
+	obj = NULL;
+	mirror = false;
+	(void)cfg_map_get(zoptions, "mirror", &obj);
+	if (obj != NULL) {
+		mirror = cfg_obj_asboolean(obj);
+	}
+	if (dns_zone_ismirror(zone) != mirror) {
+		dns_zone_log(zone, ISC_LOG_DEBUG(1),
+			     "not reusable: mirror setting changed");
+		return (false);
+	}
+
 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
@@ -43,7 +43,7 @@
 * Create a key in the keystore of an HSM
 *
 * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts
+ * that converts the key into a DNSKEY RR and inserts 
 * it into a zone file.
 *
 * usage:
@@ -71,6 +71,7 @@

 #include <pk11/pk11.h>
 #include <pk11/result.h>
+#define WANT_DH_PRIMES
 #include <pk11/constants.h>
 #include <pkcs11/eddsa.h>

@@ -78,10 +79,12 @@
 static CK_BBOOL truevalue = TRUE;
 static CK_BBOOL falsevalue = FALSE;

-/* Key class: RSA, ECC, ECX, or unknown */
+/* Key class: RSA, ECC, ECX, DSA, DH, or unknown */
 typedef enum {
 	key_unknown,
 	key_rsa,
+	key_dsa,
+	key_dh,
 	key_ecc,
 	key_ecx
 } key_class_t;
@@ -149,6 +152,78 @@ static CK_ATTRIBUTE ecc_template[] = {
 	{CKA_ID, NULL_PTR, 0}
 };

+/*
+ * Public key template for DSA keys
+ */
+#define DSA_LABEL 0
+#define DSA_VERIFY 1
+#define DSA_TOKEN 2
+#define DSA_PRIVATE 3
+#define DSA_PRIME 4
+#define DSA_SUBPRIME 5
+#define DSA_BASE 6
+#define DSA_ID 7
+#define DSA_ATTRS 8
+static CK_ATTRIBUTE dsa_template[] = {
+	{CKA_LABEL, NULL_PTR, 0},
+	{CKA_VERIFY, &truevalue, sizeof(truevalue)},
+	{CKA_TOKEN, &truevalue, sizeof(truevalue)},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_SUBPRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+	{CKA_ID, NULL_PTR, 0}
+};
+#define DSA_PARAM_PRIME 0
+#define DSA_PARAM_SUBPRIME 1
+#define DSA_PARAM_BASE 2
+#define DSA_PARAM_ATTRS 3
+static CK_ATTRIBUTE dsa_param_template[] = {
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_SUBPRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+};
+#define DSA_DOMAIN_PRIMEBITS 0
+#define DSA_DOMAIN_PRIVATE 1
+#define DSA_DOMAIN_ATTRS 2
+static CK_ATTRIBUTE dsa_domain_template[] = {
+	{CKA_PRIME_BITS, NULL_PTR, 0},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+};
+
+/*
+ * Public key template for DH keys
+ */
+#define DH_LABEL 0
+#define DH_VERIFY 1
+#define DH_TOKEN 2
+#define DH_PRIVATE 3
+#define DH_PRIME 4
+#define DH_BASE 5
+#define DH_ID 6
+#define DH_ATTRS 7
+static CK_ATTRIBUTE dh_template[] = {
+	{CKA_LABEL, NULL_PTR, 0},
+	{CKA_VERIFY, &truevalue, sizeof(truevalue)},
+	{CKA_TOKEN, &truevalue, sizeof(truevalue)},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+	{CKA_ID, NULL_PTR, 0}
+};
+#define DH_PARAM_PRIME 0
+#define DH_PARAM_BASE 1
+#define DH_PARAM_ATTRS 2
+static CK_ATTRIBUTE dh_param_template[] = {
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+};
+#define DH_DOMAIN_PRIMEBITS 0
+#define DH_DOMAIN_ATTRS 1
+static CK_ATTRIBUTE dh_domain_template[] = {
+	{CKA_PRIME_BITS, NULL_PTR, 0},
+};
+
 /*
 * Convert from text to key class.  Accepts the names of DNSSEC
 * signing algorithms, so e.g., ECDSAP256SHA256 maps to ECC and
@@ -162,6 +237,11 @@ keyclass_fromtext(const char *name) {
 	if (strncasecmp(name, "rsa", 3) == 0 ||
 	    strncasecmp(name, "nsec3rsa", 8) == 0)
 		return (key_rsa);
+	else if (strncasecmp(name, "dsa", 3) == 0 ||
+		 strncasecmp(name, "nsec3dsa", 8) == 0)
+		return (key_dsa);
+	else if (strcasecmp(name, "dh") == 0)
+		return (key_dh);
 	else if (strncasecmp(name, "ecc", 3) == 0 ||
 		 strncasecmp(name, "ecdsa", 5) == 0)
 		return (key_ecc);
@@ -199,7 +279,7 @@ main(int argc, char *argv[]) {
 	pk11_context_t pctx;
 	int error = 0;
 	int c, errflg = 0;
-	int hide = 1, quiet = 0;
+	int hide = 1, special = 0, quiet = 0;
 	int idlen = 0, id_offset = 0;
 	unsigned int i;
 	unsigned long id = 0;
@@ -251,6 +331,9 @@ main(int argc, char *argv[]) {
 		case 'q':
 			quiet = 1;
 			break;
+		case 'S':
+			special = 1;
+			break;
 		case ':':
 			fprintf(stderr,
 				"Option -%c requires an operand\n",
@@ -277,6 +360,12 @@ main(int argc, char *argv[]) {
 		exit(2);
 	}

+	if (special != 0 && keyclass != key_dh) {
+		fprintf(stderr, "The -S option is only compatible "
+				"with Diffie-Hellman key generation\n");
+		exit(2);
+	}
+
 	switch (keyclass) {
 	case key_rsa:
 		op_type = OP_RSA;
@@ -372,10 +461,70 @@ main(int argc, char *argv[]) {

 #endif
 		break;
+	case key_dsa:
+		op_type = OP_DSA;
+		if (bits == 0)
+			usage();
+
+		dpmech.mechanism = CKM_DSA_PARAMETER_GEN;
+		dpmech.pParameter = NULL;
+		dpmech.ulParameterLen = 0;
+		mech.mechanism = CKM_DSA_KEY_PAIR_GEN;
+		mech.pParameter = NULL;
+		mech.ulParameterLen = 0;
+
+		public_template = dsa_template;
+		public_attrcnt = DSA_ATTRS;
+		id_offset = DSA_ID;
+
+		domain_template = dsa_domain_template;
+		domain_attrcnt = DSA_DOMAIN_ATTRS;
+		param_template = dsa_param_template;
+		param_attrcnt = DSA_PARAM_ATTRS;
+
+		domain_template[DSA_DOMAIN_PRIMEBITS].pValue = &bits;
+		domain_template[DSA_DOMAIN_PRIMEBITS].ulValueLen = sizeof(bits);
+		break;
+	case key_dh:
+		op_type = OP_DH;
+		if (special && bits == 0)
+			bits = 1024;
+		else if (special &&
+			 bits != 768 && bits != 1024 && bits != 1536)
+		{
+			fprintf(stderr, "When using the special prime (-S) "
+				"option, only key sizes of\n"
+				"768, 1024 or 1536 are supported.\n");
+			exit(2);
+		} else if (bits == 0)
+			usage();
+
+		dpmech.mechanism = CKM_DH_PKCS_PARAMETER_GEN;
+		dpmech.pParameter = NULL;
+		dpmech.ulParameterLen = 0;
+		mech.mechanism = CKM_DH_PKCS_KEY_PAIR_GEN;
+		mech.pParameter = NULL;
+		mech.ulParameterLen = 0;
+
+		/* Override CKA_SIGN attribute */
+		private_template[PRIVATE_DERIVE].type = CKA_DERIVE;
+
+		public_template = dh_template;
+		public_attrcnt = DH_ATTRS;
+		id_offset = DH_ID;
+
+		domain_template = dh_domain_template;
+		domain_attrcnt = DH_DOMAIN_ATTRS;
+		param_template = dh_param_template;
+		param_attrcnt = DH_PARAM_ATTRS;
+
+		domain_template[DH_DOMAIN_PRIMEBITS].pValue = &bits;
+		domain_template[DH_DOMAIN_PRIMEBITS].ulValueLen = sizeof(bits);
+		break;
 	case key_unknown:
 		usage();
 	}
-
+	
 	search_template[0].pValue = label;
 	search_template[0].ulValueLen = strlen((char *)label);
 	public_template[0].pValue = label;
@@ -433,7 +582,7 @@ main(int argc, char *argv[]) {
 	hSession = pctx.session;

 	/* check if a key with the same id already exists */
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1);
+	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1); 
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
 		error = 1;
@@ -460,6 +609,29 @@ main(int argc, char *argv[]) {
 	if (keyclass == key_rsa || keyclass == key_ecc || keyclass == key_ecx)
 		goto generate_keys;

+	/*
+	 * Special setup for Diffie-Hellman keys
+	 */
+	if (special != 0) {
+		public_template[DH_BASE].pValue = pk11_dh_bn2;
+		public_template[DH_BASE].ulValueLen = sizeof(pk11_dh_bn2);
+		if (bits == 768) {
+			public_template[DH_PRIME].pValue = pk11_dh_bn768;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn768);
+		} else if (bits == 1024) {
+			public_template[DH_PRIME].pValue = pk11_dh_bn1024;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn1024);
+		} else {
+			public_template[DH_PRIME].pValue = pk11_dh_bn1536;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn1536);
+		}
+		param_attrcnt = 0;
+		goto generate_keys;
+	}
+
 	/* Generate Domain parameters */
 	rv = pkcs_C_GenerateKey(hSession, &dpmech, domain_template,
 			   domain_attrcnt, &domainparams);
@@ -479,7 +651,7 @@ main(int argc, char *argv[]) {
 		fprintf(stderr,
 			"C_GetAttributeValue0: Error = 0x%.8lX\n", rv);
 		error = 1;
-		goto exit_search;
+		goto exit_domain;
 	}

 	/* Allocate space for parameter attributes */
@@ -492,22 +664,81 @@ main(int argc, char *argv[]) {
 		if (param_template[i].pValue == NULL) {
 			fprintf(stderr, "malloc failed\n");
 			error = 1;
-			goto exit_search;
+			goto exit_params;
 		}
 	}

+	rv = pkcs_C_GetAttributeValue(hSession, domainparams,
+				 dsa_param_template, DSA_PARAM_ATTRS);
+
+	if (rv != CKR_OK) {
+		fprintf(stderr,
+			"C_GetAttributeValue1: Error = 0x%.8lX\n", rv);
+		error = 1;
+		goto exit_params;
+	}
+
+	switch (keyclass) {
+	case key_dsa:
+		public_template[DSA_PRIME].pValue =
+			param_template[DSA_PARAM_PRIME].pValue;
+		public_template[DSA_PRIME].ulValueLen =
+			param_template[DSA_PARAM_PRIME].ulValueLen;
+		public_template[DSA_SUBPRIME].pValue =
+			param_template[DSA_PARAM_SUBPRIME].pValue;
+		public_template[DSA_SUBPRIME].ulValueLen =
+			param_template[DSA_PARAM_SUBPRIME].ulValueLen;
+		public_template[DSA_BASE].pValue =
+			param_template[DSA_PARAM_BASE].pValue;
+		public_template[DSA_BASE].ulValueLen =
+			param_template[DSA_PARAM_BASE].ulValueLen;
+		break;
+	case key_dh:
+		public_template[DH_PRIME].pValue =
+			param_template[DH_PARAM_PRIME].pValue;
+		public_template[DH_PRIME].ulValueLen =
+			param_template[DH_PARAM_PRIME].ulValueLen;
+		public_template[DH_BASE].pValue =
+			param_template[DH_PARAM_BASE].pValue;
+		public_template[DH_BASE].ulValueLen =
+			param_template[DH_PARAM_BASE].ulValueLen;
+	default:
+		break;
+	}
+
 generate_keys:
 	/* Generate Key pair for signing/verifying */
 	rv = pkcs_C_GenerateKeyPair(hSession, &mech,
 			       public_template, public_attrcnt,
 			       private_template, private_attrcnt,
 			       &publickey, &privatekey);
-
+	
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
 	 } else if (!quiet)
 		printf("Key pair generation complete.\n");
+	
+ exit_params:
+	/* Free parameter attributes */
+	if (keyclass == key_dsa || keyclass == key_dh) {
+		for (i = 0; i < param_attrcnt; i++) {
+			if (param_template[i].pValue != NULL) {
+				free(param_template[i].pValue);
+			}
+		}
+	}
+
+ exit_domain:
+	/* Destroy domain parameters */
+	if (keyclass == key_dsa || (keyclass == key_dh && !special)) {
+		rv = pkcs_C_DestroyObject(hSession, domainparams);
+		if (rv != CKR_OK) {
+			fprintf(stderr,
+				"C_DestroyObject: Error = 0x%.8lX\n", rv);
+			error = 1;
+		}
+	}

 exit_search:
 	rv = pkcs_C_FindObjectsFinal(hSession);
@@ -30,7 +30,7 @@ class dnskey:
              'Revoke', 'DSPublish', 'SyncPublish', 'SyncDelete')
    _OPTS = (None, '-P', '-A', '-I', '-D', '-R', None, '-Psync', '-Dsync')

-    _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', None, 'RSASHA1',
+    _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                 'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
                 'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
                 'ECDSAP384SHA384', 'ED25519', 'ED448')
@@ -650,12 +650,6 @@
 	    <option>-l</option>, <option>-r</option>, <option>-d</option>,
 	    <option>-f</option>, and <option>-c</option>.
 	  </para>
-	  <para>
-	    Unrecognized options are treated as errors. To reference
-	    a domain or view name that begins with a hyphen,
-	    use a double-hyphen on the command line to indicate the
-	    end of options.
-	  </para>
 	</listitem>
      </varlistentry>

@@ -115,8 +115,6 @@ main(int argc, char **argv) {
 				   strcmp(argv[1], "seconary") == 0)
 			{
 				zonetype = CFG_ZONE_SLAVE;
-			} else if (strcmp(argv[1], "mirror") == 0) {
-				zonetype = CFG_ZONE_MIRROR;
 			} else if (strcmp(argv[1], "stub") == 0) {
 				zonetype = CFG_ZONE_STUB;
 			} else if (strcmp(argv[1], "static-stub") == 0) {
@@ -0,0 +1 @@
+child.example. IN KEY 256 3 3 ALeiYGFXbil6PgHnkm5ZE67ygEVDvGT/gqZmLH7tGboofcPSfyhh1hpw dxZgJ26d/gynWMGVSYzaXfzsxpPoNeYn+qeevQoJOaxXXlfcy8Ik52Rm eW0J9mWlf9hsD7ShIhh1+0kRYGCOCaU25wIe3SLVkN3HgqiCBDYnBY0u nMkqRadiUnoEa3Tcvc9kJx9r9gDstR2A9A5sBhFLI/XQ0gViHHLVpQ4x hz+rTLb/xrBoAb5sQJT3xUjhhdNo9HuL6kwdLdSu//PCl1QnY9NpYPVV SKUo
@@ -0,0 +1,7 @@
+Private-key-format: v1.2
+Algorithm: 3 (DSA)
+Prime(p): vGT/gqZmLH7tGboofcPSfyhh1hpwdxZgJ26d/gynWMGVSYzaXfzsxpPoNeYn+qeevQoJOaxXXlfcy8Ik52RmeQ==
+Subprime(q): t6JgYVduKXo+AeeSblkTrvKARUM=
+Base(g): bQn2ZaV/2GwPtKEiGHX7SRFgYI4JpTbnAh7dItWQ3ceCqIIENicFjS6cySpFp2JSegRrdNy9z2QnH2v2AOy1HQ==
+Private_value(x): J1Ctez8+w1PTR56Hze3pGoe0Wag=
+Public_value(y): gPQObAYRSyP10NIFYhxy1aUOMYc/q0y2/8awaAG+bECU98VI4YXTaPR7i+pMHS3Urv/zwpdUJ2PTaWD1VUilKA==
@@ -1,5 +0,0 @@
-; This is a zone-signing key, keyid 33180, for child.example.
-; Created: 20181025104746 (Thu Oct 25 12:47:46 2018)
-; Publish: 20181025104746 (Thu Oct 25 12:47:46 2018)
-; Activate: 20181025104746 (Thu Oct 25 12:47:46 2018)
-child.example. IN DNSKEY 256 3 5 AwEAAb9eatC8ASzDnRApcZuxyBrvJRANRQjCXQ1FWK+8vEyXV5NIE9Km hKIV2wbq2tLBPfjNQz4BTJ9RmDINf1RayDlt6L+IQV1JCaDaMjd1zU3n SQK18Y7fMu0ww4AMKOnoVRbkIxa3zlA0chImXcfPE0q2AvKBYLzPfkPO cfplAuRkLcGUxdADCipNzCOakpcd5gfm9Sa2HlaXcw3gyI1WcE8=
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: v15q0LwBLMOdEClxm7HIGu8lEA1FCMJdDUVYr7y8TJdXk0gT0qaEohXbBura0sE9+M1DPgFMn1GYMg1/VFrIOW3ov4hBXUkJoNoyN3XNTedJArXxjt8y7TDDgAwo6ehVFuQjFrfOUDRyEiZdx88TSrYC8oFgvM9+Q85x+mUC5GQtwZTF0AMKKk3MI5qSlx3mB+b1JrYeVpdzDeDIjVZwTw==
-PublicExponent: AQAB
-PrivateExponent: WDsn9GU6BXGLENCK2MX3BLQN2oDDu24hiOTYJu5VwtpkPjuVKCIuNKzu9xmBGnqOIBBDWGsw8KOmEC247yOL/S53iRdBS8lI7yiqznc52RhlmrdPKXbNpVnPwil8wocw+oQYa7uvdPYxI2Yy3B/tRgUxlxSlc/LW/dr0BX2L7qr/aeOBeGSRUlCpc7tYU9a2RUaLpVxF6SlqicCpC91MAQ==
-Prime1: 466f+JL66Bl4qYnkj0s9+1N3pYmdcM9Ja1AN66X4VLslA9Cm1JEaC5V9HOptfcXUk0XYEVnKeKM2lIQnvcLG0yuQHIa+pGi7P8vgQfdaRUE=
-Prime2: 1yuUkTVRSbUWeUreEcHgeeBBJ61UshX7t07gnGgIr3artGdo2CVEb5//+2Mvj5bgjCQBvjBbmHNZrR0jKDRBTIGtqbBerOuhEN4AXdAEgY8=
-Exponent1: KzUXbJ/P973ltR7S/hKEV66WVRbRhvf/cdsGWULs5n+BXcD59/r1W19qF9OxJZ4mYjBt+ZT1pIEsuXB+7jcJbkelGJTFlwO9DTVOgJZFTkE=
-Exponent2: FTPsLertGbBIiKdB/sn2Dsx0Xy6LXAkihsu1AnSV9oRhIyPVhwcVGVLQ7Lq3YxThB648pbsqK3miapamcj3D+YAF1uTUT4Hgm0LlEll/OC0=
-Coefficient: Vulw9kmmjKc+wmOukLdzheoA2hNPDVtgiynfzHybyXdqvapCoK+ZVmNFzjO0M41ATcpvya3iX0bekMQqYnBhLURNZUIyqz2nGskOjV8I5Jg=
-Created: 20181025104746
-Publish: 20181025104746
-Activate: 20181025104746
@@ -49,6 +49,7 @@ XTARGETS =	adb_test@EXEEXT@ \
 		db_test@EXEEXT@ \
 		dst_test@EXEEXT@ \
 		gsstest@EXEEXT@ \
+		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
@@ -77,6 +78,7 @@ XSRCS =		adb_test.c \
 		byname_test.c \
 		db_test.c \
 		dst_test.c \
+		hash_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
@@ -165,6 +167,10 @@ name_test@EXEEXT@: name_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ name_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}

+hash_test@EXEEXT@: hash_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ hash_test.@O@ \
+		${ISCLIBS} ${LIBS}
+
 entropy_test@EXEEXT@: entropy_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ entropy_test.@O@ \
 		${ISCLIBS} ${LIBS}
@@ -254,9 +254,11 @@ main(void) {
 	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
 	if (result != ISC_R_SUCCESS)
 		return (1);
+	io(name, 23616, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 	io(name, 54622, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
 	   mctx);

+	io(name, 49667, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);

 	isc_buffer_constinit(&b, "dh.", 3);
@@ -268,6 +270,7 @@ main(void) {

 	generate(DST_ALG_RSAMD5, mctx);
 	generate(DST_ALG_DH, mctx);
+	generate(DST_ALG_DSA, mctx);
 	generate(DST_ALG_HMACMD5, mctx);

 	dst_lib_destroy();
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+#include <config.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/hmacmd5.h>
+#include <isc/hmacsha.h>
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/util.h>
+#include <isc/print.h>
+#include <isc/string.h>
+
+#include <pk11/site.h>
+
+static void
+print_digest(const char *s, const char *hash, unsigned char *d,
+	     unsigned int words)
+{
+	unsigned int i, j;
+
+	printf("hash (%s) %s:\n\t", hash, s);
+	for (i = 0; i < words; i++) {
+		printf(" ");
+		for (j = 0; j < 4; j++)
+			printf("%02x", d[i * 4 + j]);
+	}
+	printf("\n");
+}
+
+int
+main(int argc, char **argv) {
+	isc_sha1_t sha1;
+	isc_sha224_t sha224;
+	isc_md5_t md5;
+	isc_hmacmd5_t hmacmd5;
+	isc_hmacsha1_t hmacsha1;
+	isc_hmacsha224_t hmacsha224;
+	isc_hmacsha256_t hmacsha256;
+	isc_hmacsha384_t hmacsha384;
+	isc_hmacsha512_t hmacsha512;
+	unsigned char digest[ISC_SHA512_DIGESTLENGTH];
+	unsigned char buffer[1024];
+	const char *s;
+	unsigned char key[20];
+
+	UNUSED(argc);
+	UNUSED(argv);
+
+	s = "abc";
+	isc_sha1_init(&sha1);
+	memmove(buffer, s, strlen(s));
+	isc_sha1_update(&sha1, buffer, strlen(s));
+	isc_sha1_final(&sha1, digest);
+	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+	isc_sha1_init(&sha1);
+	memmove(buffer, s, strlen(s));
+	isc_sha1_update(&sha1, buffer, strlen(s));
+	isc_sha1_final(&sha1, digest);
+	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "abc";
+	isc_sha224_init(&sha224);
+	memmove(buffer, s, strlen(s));
+	isc_sha224_update(&sha224, buffer, strlen(s));
+	isc_sha224_final(digest, &sha224);
+	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+	isc_sha224_init(&sha224);
+	memmove(buffer, s, strlen(s));
+	isc_sha224_update(&sha224, buffer, strlen(s));
+	isc_sha224_final(digest, &sha224);
+	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "abc";
+	isc_md5_init(&md5);
+	memmove(buffer, s, strlen(s));
+	isc_md5_update(&md5, buffer, strlen(s));
+	isc_md5_final(&md5, digest);
+	print_digest(s, "md5", digest, 4);
+
+	/*
+	 * The 3 HMAC-MD5 examples from RFC2104
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 16);
+	isc_hmacmd5_init(&hmacmd5, key, 16);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacmd5_init(&hmacmd5, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 16);
+	isc_hmacmd5_init(&hmacmd5, key, 16);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	/*
+	 * The 3 HMAC-SHA1 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha1_init(&hmacsha1, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha1_init(&hmacsha1, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha1_init(&hmacsha1, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA224 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha224_init(&hmacsha224, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha224_init(&hmacsha224, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha224_init(&hmacsha224, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA256 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha256_init(&hmacsha256, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha256_init(&hmacsha256, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha256_init(&hmacsha256, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA384 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha384_init(&hmacsha384, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha384_init(&hmacsha384, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha384_init(&hmacsha384, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA512 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha512_init(&hmacsha512, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha512_init(&hmacsha512, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha512_init(&hmacsha512, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	return (0);
+}
@@ -255,7 +255,7 @@ main(int argc, char *argv[]) {
 	CHECK("dns_name_fromtext", result);

 	key = NULL;
-	result = dst_key_fromfile(name, 33180, DNS_KEYALG_RSASHA1,
+	result = dst_key_fromfile(name, 4017, DNS_KEYALG_DSA,
 				  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
 				  NULL, mctx, &key);
 	CHECK("dst_key_fromfile", result);
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	recursion yes;
-	allow-recursion { none; };
-};
-
-zone "." {
-	type mirror;
-	masters { 127.0.0.1; };
-};
@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "." {
-	type mirror;
-	notify yes;
-};
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "foo." {
-	type mirror;
-};
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	recursion no;
-};
-
-zone "." {
-	type mirror;
-};
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	notify yes;
-};
-
-zone "." {
-	type mirror;
-};
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "." {
-	type mirror;
-};
@@ -1,11 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@	3600	SOA	. . 0 0 0 0 0
-@	3600	NS	.
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.8;
-	notify-source 10.53.0.8;
-	transfer-source 10.53.0.8;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.8; };
-	listen-on-v6 { none; };
-	dnssec-validation yes;
-	rate-limit {};
-	require-server-cookie yes;
-};
-
-zone "example" {
-	type master;
-	file "example.db";
-};
@@ -20,4 +20,3 @@ copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
-copy_setports ns8/named.conf.in ns8/named.conf
@@ -169,17 +169,6 @@ if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "checking require-server-cookie yes with rate-limit ($n)"
-ret=0
-$DIG $DIGOPTS +qr +cookie +nobadcookie soa example @10.53.0.8 > dig.out.test$n
-grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
-grep BADCOOKIE dig.out.test$n > /dev/null || ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
-if [ $linecount != 2 ]; then ret=1; fi
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 #
 # Test shared cookie-secret support.
 #
@@ -57,28 +57,6 @@ while (<FILE1>) {
 		} else {
 			$entry{"$name ; $class.$type ; $value"} = $_;
 		}
-	} elsif (/^(\S+)\s+\S+\s+(\S+)\s+(\S+)\s*$/) {
-		$name = $1;
-		$class = $2;
-		$type = $3;
-		$value = "";
-		if ($lc) {
-			$name = lc($name);
-			$value = lc($value);
-		}
-		if ($type eq "SOA") {
-			$firstname = $name if ($firstname eq "");
-			if ($name eq $firstname) {
-				$name = "$name$count";
-				$count++;
-			}
-		}
-		if ($entry{"$name ; $class.$type ; $value"} ne "") {
-			$line = $entry{"$name ; $class.$type ; $value"};
-			print("Duplicate entry in $file1:\n> $_\n< $line\n");
-		} else {
-			$entry{"$name ; $class.$type ; $value"} = $_;
-		}
 	}
 }
 close(FILE1);
@@ -115,28 +93,6 @@ while (<FILE2>) {
 			$printed++;
 			$status = 1;
 		}
-	} elsif (/^(\S+)\s+\S+\s+(\S+)\s+(\S+)\s*$/) {
-		$name = $1;
-		$class = $2;
-		$type = $3;
-		$value = "";
-		if ($lc) {
-			$name = lc($name);
-			$value = lc($value);
-		}
-		if (($name eq $firstname) && ($type eq "SOA")) {
-			$count--;
-			$name = "$name$count";
-		}
-		if ($entry{"$name ; $class.$type ; $value"} ne "") {
-			$entry{"$name ; $class.$type ; $value"} = "";
-		} else {
-			print("Only in $file2 (missing from $file1):\n")
-			    if ($printed == 0);
-			print("> $_\n");
-			$printed++;
-			$status = 1;
-		}
 	}
 }
 close(FILE2);
@@ -1873,8 +1873,8 @@ $PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n._11
 lines=`grep " expiry " rndc.out.ns4.test$n._11 | wc -l`
 [ "$lines" -le 2 ] || ret=1
-grep "bogus.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null || ret=1
-grep "badds.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null && ret=1
+grep "bogus.example: expiry" rndc.out.ns4.test$n._11 > /dev/null || ret=1
+grep "badds.example: expiry" rndc.out.ns4.test$n._11 > /dev/null && ret=1
 $DIG $DIGOPTS b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.11 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.11 > /dev/null && ret=1
 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.12 || ret=1
@@ -1910,14 +1910,14 @@ ret=0
 echo_i "testing NTA removals ($n)"
 $RNDCCMD 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1
-grep "badds.example/_default: expiry" rndc.out.ns4.test$n.1 > /dev/null || ret=1
+grep "badds.example: expiry" rndc.out.ns4.test$n.1 > /dev/null || ret=1
 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null && ret=1
 grep "^a.badds.example." dig.out.ns4.test$n.1 > /dev/null || ret=1
 $RNDCCMD 10.53.0.4 nta -remove badds.example > rndc.out.ns4.test$n.2
 grep "Negative trust anchor removed: badds.example/_default" rndc.out.ns4.test$n.2 > /dev/null || ret=1
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.3
-grep "badds.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null && ret=1
+grep "badds.example: expiry" rndc.out.ns4.test$n.3 > /dev/null && ret=1
 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1928,7 +1928,7 @@ echo_i "remove non-existent NTA three times"
 $RNDCCMD 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.4 2>&1
 $RNDCCMD 10.53.0.4 nta -remove foo > rndc.out.ns4.test$n.5 2>&1
 $RNDCCMD 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.6 2>&1
-grep "not found" rndc.out.ns4.test$n.6 > /dev/null || ret=1
+grep "'nta' failed: not found" rndc.out.ns4.test$n.6 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 ret=0
@@ -2009,7 +2009,7 @@ sleep 4
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.3
 lines=`wc -l < rndc.out.ns4.test$n.3`
 [ "$lines" -eq 1 ] || ret=1
-grep "bogus.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null || ret=1
+grep "bogus.example: expiry" rndc.out.ns4.test$n.3 > /dev/null || ret=1
 $DIG $DIGOPTS b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1
@@ -27,7 +27,6 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	dnssec-validation yes;
-	qname-minimization disabled;
 };

 key rndc_key {
@@ -27,7 +27,6 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	dnssec-validation yes;
-	qname-minimization disabled;
 };

 key rndc_key {
@@ -28,7 +28,6 @@ options {
 	require-server-cookie no;
 	minimal-responses no;
 	dnssec-validation yes;
-	qname-minimization disabled;
 };

 server 10.53.0.1 { tcp-only yes; };
@@ -27,7 +27,6 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	dnssec-validation yes;
-	qname-minimization disabled;
 };

 server 10.53.0.1 { tcp-only yes; };
@@ -186,21 +186,14 @@ loc02			LOC 	60 09 00.000 N 24 39 00.000 E 10.00m 20.00m (
 ;nxt03			NXT	. 1
 ;nxt04			NXT	. 127

-; type 31
-eid01			EID	12 89 AB
-
-; type 32
-nimloc01		NIMLOC	12 89 AB
+; type 31 (EID - not implemented by BIND)
+; type 32 (NIMLOC - not implemented by BIND)

 ; type 33
-srv01			SRV	0 0 0 .
-srv02			SRV	65535 65535 65535  old-slow-box
+srv01			SRV 0 0 0 .
+srv02			SRV 65535 65535 65535  old-slow-box

-; type 34
-atma01			ATMA	+61200000000
-atma02			ATMA	+61.2.0000.0000
-atma03			ATMA	1234567890abcdef
-atma04			ATMA	f.e.d.c.b.a.0.9.8.7.6.5.4.3.2.1
+; type 34 (ATMA - not implemented by BIND)

 ; type 35
 naptr01			NAPTR   0 0 "" "" "" . 
@@ -236,7 +229,6 @@ sink02			SINK	8 0 2 l4ik

 ; type 42
 apl01			APL	!1:10.0.0.1/32 1:10.0.0.0/24
-apl02			APL

 ; type 43
 ds01			DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
@@ -374,14 +366,9 @@ csync02			CSYNC	0 0
 spf01			SPF	"v=spf1 -all"
 spf02			SPF	"v=spf1" " -all"

-; type 100 (UINFO - not implemented by BIND - unknown record format only)
-uinfo01			UINFO	\# 1 01
-
-; type 101 (UID - not implemented by BIND - unknown record format only)
-uid01			UID	\# 1 02
-
-; type 102 (GID - not implemented by BIND - unknown record format only)
-gid01			GID	\# 1 03
+; type 100 (UINFO - not implemented by BIND)
+; type 101 (UID - not implemented by BIND)
+; type 102 (GID - not implemented by BIND)

 ; type 103 (UNSPEC - XXXMUKS TODO - this has some weird encoding - see btoa_totext())

@@ -185,11 +185,11 @@ idna_enabled_test() {
    # Note that ASCII characters are converted to lower-case.

    text="Checking valid non-ASCII label"
-    idna_test "$text" ""                   "München" "M\195\188nchen."
+    idna_test "$text" ""                   "München" "münchen." 
    idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
    idna_test "$text" "+noidnin +idnout"   "München" "M\195\188nchen."
    idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
-    idna_test "$text" "+idnin   +idnout"   "München" "münchen."
+    idna_test "$text" "+idnin   +idnout"   "München" "münchen." 


    # Tests of transitional processing of a valid U-label
@@ -210,7 +210,7 @@ idna_enabled_test() {
    # for the valid U-label.

    text="Checking that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "faß.de" "fa\195\159.de."
+    idna_test "$text" ""                   "faß.de" "faß.de."
    idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
    idna_test "$text" "+noidnin +idnout"   "faß.de" "fa\195\159.de."
    idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
@@ -220,11 +220,11 @@ idna_enabled_test() {
    # onto the Greek sigma character ("σ") in IDNA2003.

    text="Second check that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+    idna_test "$text" ""                   "βόλος.com" "βόλος.com." 
    idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
    idna_test "$text" "+noidnin +idnout"   "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
    idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
-    idna_test "$text" "+idnin   +idnout"   "βόλος.com" "βόλος.com."
+    idna_test "$text" "+idnin   +idnout"   "βόλος.com" "βόλος.com." 



@@ -238,9 +238,9 @@ idna_enabled_test() {
    # The "+[no]idnin" flag has no effect in these cases.

    text="Checking valid A-label"
-    idna_test "$text" ""                   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
+    idna_test "$text" ""                   "xn--nxasmq6b.com" "βόλοσ.com." 
    idna_test "$text" "+noidnin +noidnout" "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-    idna_test "$text" "+noidnin +idnout"   "xn--nxasmq6b.com" "βόλοσ.com."
+    idna_test "$text" "+noidnin +idnout"   "xn--nxasmq6b.com" "βόλοσ.com." 
    idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
    idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."

@@ -259,7 +259,7 @@ idna_enabled_test() {
    # a shorter label is detected and rejected.

    text="Checking punycode label shorter than minimum valid length"
-    idna_test "$text" ""                   "xn--xx" "xn--xx."
+    idna_fail "$text" ""                   "xn--xx"
    idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
    idna_fail "$text" "+noidnin   +idnout" "xn--xx"
    idna_fail "$text" "+idnin   +noidnout" "xn--xx"
@@ -268,7 +268,7 @@ idna_enabled_test() {
    # Fake A-label - the string does not translate to anything.

    text="Checking fake A-label"
-    idna_test "$text" ""                   "xn--ahahah" "xn--ahahah."
+    idna_fail "$text" ""                   "xn--ahahah"
    idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
    idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
    idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
@@ -285,7 +285,7 @@ idna_enabled_test() {
    idna_fail "$text" "+idnin   +noidnout" "$label"
    idna_fail "$text" "+idnin     +idnout" "$label"

-
+    


    # Tests of a valid unicode string but an invalid U-label (input)
@@ -301,7 +301,7 @@ idna_enabled_test() {
    # The +[no]idnout options should not have any effect on the test.

    text="Checking invalid input U-label"
-    idna_test "$text" ""                   "√.com" "\226\136\154.com."
+    idna_fail "$text" ""                   "√.com"
    idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
    idna_test "$text" "+noidnin +idnout"   "√.com" "\226\136\154.com."
    idna_fail "$text" "+idnin   +noidnout" "√.com"
@@ -323,7 +323,7 @@ idna_enabled_test() {
    # The +[no]idnin options should not have any effect on the test.

    text="Checking invalid output U-label"
-    idna_test "$text" ""                   "xn--19g" "xn--19g."
+    idna_fail "$text" ""                   "xn--19g"
    idna_test "$text" "+noidnin +noidnout" "xn--19g" "xn--19g."
    idna_fail "$text" "+noidnin +idnout"   "xn--19g"
    idna_test "$text" "+idnin   +noidnout" "xn--19g" "xn--19g."
@@ -1,17 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
-
-This test checks whether zones configured with "type mirror;" behave as
-expected.
-
-ns1 is an authoritative-only server.  It only serves the root zone, which is
-mirrored by ns3.
-
-ns2 is an authoritative-only server.  It serves a number of zones, some of which
-are delegated to it by ns1 and used in recursive resolution tests aimed at ns3
-while others are only served so that ns3 has a primary server to mirror zones
-from during various tests of the mirror zone implementation.
-
-ns3 is a recursive resolver.  It has a number of mirror zones configured.  This
-is the only server whose behavior is being examined by this system test.
@@ -11,7 +11,6 @@ rm -f */*.conf
 rm -f */*.db
 rm -f */*.jnl
 rm -f */*.mirror
-rm -f */*.nzd*
 rm -f */*.prev
 rm -f */*.signed
 rm -f */K*
@@ -45,11 +45,6 @@ zone "initially-unavailable" {
 	allow-transfer { 10.53.0.254; };
 };

-zone "verify-addzone" {
-	type master;
-	file "verify-addzone.db.original.signed";
-};
-
 zone "verify-axfr" {
 	type master;
 	file "verify-axfr.db.signed";
@@ -36,7 +36,7 @@ ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' verify.db.in`
 UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
 UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`

-for variant in addzone axfr ixfr load reconfig untrusted; do
+for variant in axfr ixfr load reconfig untrusted; do
 	zone=verify-$variant
 	infile=verify.db.in
 	zonefile=verify-$variant.db
@@ -29,7 +29,6 @@ options {
 	recursion yes;
 	allow-query-cache { 10.53.0.1; };
 	trust-anchor-telemetry yes;
-	allow-new-zones yes;
 };

 zone "." {
@@ -38,54 +37,62 @@ zone "." {
 };

 zone "." {
-	type mirror;
+	type slave;
 	masters { 10.53.0.1; };
+	mirror yes;
 	file "root.db.mirror";
 };

 zone "initially-unavailable" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "initially-unavailable.db.mirror";
 	use-alt-transfer-source no;
 };

 zone "verify-axfr" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-axfr.db.mirror";
 };

 zone "verify-ixfr" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-ixfr.db.mirror";
 	masterfile-format text;
 };

 zone "verify-load" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-load.db.mirror";
 	masterfile-format text;
 };

 zone "verify-reconfig" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-reconfig.db.mirror";
 	masterfile-format text;
 };

 zone "verify-unsigned" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-unsigned.db.mirror";
 };

 zone "verify-untrusted" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-untrusted.db.mirror";
 };

@@ -21,4 +21,6 @@ copy_setports ns3/named.conf.in ns3/named.conf
 ( cd ns1 && $SHELL -e sign.sh )

 cat ns2/verify-axfr.db.bad.signed > ns2/verify-axfr.db.signed
+cat ns2/verify-ixfr.db.original.signed > ns2/verify-ixfr.db.signed
 cat ns2/verify-load.db.bad.signed > ns3/verify-load.db.mirror
+cat ns2/verify-untrusted.db.original.signed > ns2/verify-untrusted.db.signed
@@ -380,7 +380,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "checking that \"rndc reconfig\" properly handles a mirror -> slave zone type change ($n)"
+echo_i "checking that \"rndc reconfig\" properly handles a yes -> no \"mirror\" setting change ($n)"
 ret=0
 # Sanity check before we start.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n.1 2>&1 || ret=1
@@ -390,13 +390,13 @@ grep "flags:.* ad" dig.out.ns3.test$n.1 > /dev/null || ret=1
 # Reconfigure the zone so that it is no longer a mirror zone.
 # (NOTE: Keep the embedded newline in the sed function list below.)
 sed '/^zone "verify-reconfig" {$/,/^};$/ {
-	s/type mirror;/type slave;/
+	s/mirror yes;/mirror no;/
 }' ns3/named.conf > ns3/named.conf.modified
 mv ns3/named.conf.modified ns3/named.conf
 nextpart ns3/named.run > /dev/null
 $RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1
-# Zones whose type was changed should not be reusable, which means the tested
-# zone should have been reloaded from disk.
+# Zones whose "mirror" setting was changed should not be reusable, which means
+# the tested zone should have been reloaded from disk.
 wait_for_load verify-reconfig ${ORIGINAL_SERIAL} ns3/named.run
 # Ensure responses sourced from the reconfigured zone have AA=1 and AD=0.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n.2 2>&1 || ret=1
@@ -407,7 +407,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "checking that \"rndc reconfig\" properly handles a slave -> mirror zone type change ($n)"
+echo_i "checking that \"rndc reconfig\" properly handles a no -> yes \"mirror\" setting change ($n)"
 ret=0
 # Put an incorrectly signed version of the zone in the zone file used by ns3.
 nextpart ns3/named.run > /dev/null
@@ -415,7 +415,7 @@ cat ns2/verify-reconfig.db.bad.signed > ns3/verify-reconfig.db.mirror
 # Reconfigure the zone so that it is a mirror zone again.
 # (NOTE: Keep the embedded newline in the sed function list below.)
 sed '/^zone "verify-reconfig" {$/,/^};$/ {
-	s/type slave;/type mirror;/
+	s/mirror no;/mirror yes;/
 }' ns3/named.conf > ns3/named.conf.modified
 mv ns3/named.conf.modified ns3/named.conf
 $RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1
@@ -427,39 +427,6 @@ nextpart ns3/named.run | grep "No correct RSASHA256 signature for verify-reconfi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "checking that a mirror zone can be added using rndc ($n)"
-ret=0
-# Sanity check: the zone should not exist in the root zone.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n.1 2>&1 || ret=1
-grep "NXDOMAIN" dig.out.ns3.test$n.1 > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n.1 > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n.1 > /dev/null || ret=1
-# Mirror a zone which does not exist in the root zone.
-nextpart ns3/named.run > /dev/null
-$RNDCCMD 10.53.0.3 addzone verify-addzone '{ type mirror; masters { 10.53.0.2; }; };' > rndc.out.ns3.test$n 2>&1 || ret=1
-wait_for_transfer verify-addzone
-# Check whether the mirror zone was added and whether it behaves as expected.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n.2 2>&1 || ret=1
-grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "checking that a mirror zone can be deleted using rndc ($n)"
-ret=0
-# Remove the mirror zone added in the previous test.
-$RNDCCMD 10.53.0.3 delzone verify-addzone > rndc.out.ns3.test$n 2>&1 || ret=1
-# Check whether the mirror zone was removed.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n 2>&1 || ret=1
-grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
 ret=0
@@ -120,9 +120,6 @@ def create_response(msg):
        slow = True
        suffix = "slow."
        lqname = lqname[:-5]
-    elif lqname.endswith("fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
    else:
        r.set_rcode(REFUSED)
        return r
@@ -14,5 +14,5 @@ rm -f */named.memstats
 rm -f */named.run
 rm -f dig.out.*
 rm -f ns*/named.lock
-rm -f ans*/query.log*
+rm -f ans*/query.log
 rm -f query*.log
@@ -30,6 +30,3 @@ ns2.slow.		A	10.53.0.2

 ugly.			NS	ns2.ugly.
 ns2.ugly.		A	10.53.0.2
-
-fwd.			NS	ns2.fwd.
-ns2.fwd.		A	10.53.0.2
@@ -39,11 +39,3 @@ zone "." {
 	type hint;
 	file "../../common/root.hint";
 };
-
-zone "fwd." IN {
-	type forward;
-	forwarders {
-		10.53.0.2;
-	};
-	forward only;
-};
@@ -117,16 +117,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.6 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.good.
-ADDR a.bit.longer.ns.name.good.
-ADDR ns2.good.
-ADDR ns3.good.
-ADDR ns3.good.
-NS boing.good.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS good.
+NS boing.good.
 NS zoop.boing.good.
+ADDR ns3.good.
+ADDR ns3.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
@@ -150,9 +148,7 @@ $RNDCCMD 10.53.0.6 flush
 $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.6 > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR ns2.bad.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS bad.
 NS boing.bad.
 __EOF
@@ -169,16 +165,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.bad.
-ADDR a.bit.longer.ns.name.bad.
-ADDR icky.icky.icky.ptang.zoop.boing.bad.
-ADDR ns2.bad.
-ADDR ns3.bad.
-ADDR ns3.bad.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS bad.
 NS boing.bad.
+ADDR icky.icky.icky.ptang.zoop.boing.bad.
+ADDR ns3.bad.
+ADDR ns3.bad.
+ADDR a.bit.longer.ns.name.bad.
+ADDR a.bit.longer.ns.name.bad.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans3/query.log - > /dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans4/query.log - > /dev/null || ret=1
@@ -194,12 +188,10 @@ $RNDCCMD 10.53.0.6 flush
 $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.6 > dig.out.test$n
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR ns2.ugly.
-NS boing.ugly.
-NS boing.ugly.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS ugly.
+NS boing.ugly.
+NS boing.ugly.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -215,17 +207,15 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.ugly.
-ADDR a.bit.longer.ns.name.ugly.
-ADDR icky.icky.icky.ptang.zoop.boing.ugly.
-ADDR ns2.ugly.
-ADDR ns3.ugly.
-ADDR ns3.ugly.
-NS boing.ugly.
-NS boing.ugly.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS ugly.
+NS boing.ugly.
+NS boing.ugly.
+ADDR icky.icky.icky.ptang.zoop.boing.ugly.
+ADDR ns3.ugly.
+ADDR ns3.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+ADDR a.bit.longer.ns.name.ugly.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
@@ -243,16 +233,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.slow. @10.53.0.6 > dig.out.test$n
 sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.slow.
-ADDR a.bit.longer.ns.name.slow.
-ADDR ns2.slow.
-ADDR ns3.slow.
-ADDR ns3.slow.
-NS boing.slow.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS slow.
+NS boing.slow.
 NS zoop.boing.slow.
+ADDR ns3.slow.
+ADDR ns3.slow.
+ADDR a.bit.longer.ns.name.slow.
+ADDR a.bit.longer.ns.name.slow.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.slow.
@@ -277,8 +265,7 @@ $DIG $DIGOPTS -x 2001:4f8::1 @10.53.0.6 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. 1 IN PTR nee.com." dig.out.test$n > /dev/null || ret=1
 sleep 1
-grep -v ADDR ans2/query.log > ans2/query.log.trimmed
-cat << __EOF | diff ans2/query.log.trimmed - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS 1.0.0.2.ip6.arpa.
 NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
@@ -299,16 +286,14 @@ $DIG $DIGOPTS more.icky.icky.icky.ptang.zoop.boing.good. @10.53.0.6 > dig.out.te
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "more.icky.icky.icky.ptang.zoop.boing.good. 1 IN	A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.good.
-ADDR a.bit.longer.ns.name.good.
-ADDR ns2.good.
-ADDR ns3.good.
-ADDR ns3.good.
-NS boing.good.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS good.
+NS boing.good.
 NS zoop.boing.good.
+ADDR ns3.good.
+ADDR ns3.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
@@ -325,21 +310,5 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "qname minimization is disabled when forwarding ($n)"
-ret=0
-$CLEANQL
-$RNDCCMD 10.53.0.7 flush
-$DIG $DIGOPTS a.bit.longer.ns.name.fwd. @10.53.0.7 > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-grep "a.bit.longer.ns.name.fwd. 1	IN	A	10.53.0.4" dig.out.test$n >/dev/null || ret=1
-sleep 1
-cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.fwd.
-__EOF
-for ans in ans2; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -44,42 +44,39 @@ $SIG{TERM} = \&rmpid;

 sub handleUDP {
 	my ($buf) = @_;
-	my $request;
+	my $packet;

 	if ($Net::DNS::VERSION > 0.68) {
-		$request = new Net::DNS::Packet(\$buf, 0);
+		$packet = new Net::DNS::Packet(\$buf, 0);
 		$@ and die $@;
 	} else {
 		my $err;
-		($request, $err) = new Net::DNS::Packet(\$buf, 0);
+		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
 		$err and die $err;
 	}

-	my @questions = $request->question;
+	my @questions = $packet->question;
 	my $qname = $questions[0]->qname;
 	my $qtype = $questions[0]->qtype;
 	my $qclass = $questions[0]->qclass;
-	my $id = $request->header->id;
+	my $id = $packet->header->id;

-	my $response = new Net::DNS::Packet($qname, $qtype, $qclass);
-	$response->header->qr(1);
-	$response->header->aa(1);
-	$response->header->tc(0);
-	$response->header->id($id);
+	$packet->header->qr(1);
+	$packet->header->aa(1);
+	$packet->header->tc(0);

 	# Responses to queries for no-questions/NS and ns.no-questions/A are
 	# _not_ malformed or truncated.
 	if ($qname eq "no-questions" && $qtype eq "NS") {
-		$response->push("answer", new Net::DNS::RR($qname . " 300 NS ns.no-questions"));
-		$response->push("additional", new Net::DNS::RR("ns.no-questions. 300 A 10.53.0.8"));
-		return $response->data;
+		$packet->push("answer", new Net::DNS::RR($qname . " 300 NS ns.no-questions"));
+		$packet->push("additional", new Net::DNS::RR("ns.no-questions. 300 A 10.53.0.8"));
+		return $packet->data;
 	} elsif ($qname eq "ns.no-questions") {
-		$response->push("answer", new Net::DNS::RR($qname . " 300 A 10.53.0.8"))
-			if ($qtype eq "A");
-		return $response->data;
+		$packet->push("answer", new Net::DNS::RR($qname . " 300 A 10.53.0.8"));
+		return $packet->data;
 	} elsif ($qname =~ /\.formerr-to-all$/) {
-		$response->header->rcode("FORMERR");
-		return $response->data;
+		$packet->header->rcode("FORMERR");
+		return $packet->data;
 	}

 	# don't use Net::DNS to construct the header only reply as early
@@ -113,14 +110,14 @@ sub handleTCP {
 	my $id = $request->header->id;

 	my @results = ();
-	my $response = new Net::DNS::Packet($qname, $qtype, $qclass);
+	my $packet = new Net::DNS::Packet($qname, $qtype, $qclass);

-	$response->header->qr(1);
-	$response->header->aa(1);
-	$response->header->id($id);
+	$packet->header->qr(1);
+	$packet->header->aa(1);
+	$packet->header->id($id);

-	$response->push("answer", new Net::DNS::RR("$qname 300 A 1.2.3.4"));
-	push(@results, $response->data);
+	$packet->push("answer", new Net::DNS::RR("$qname 300 A 1.2.3.4"));
+	push(@results, $packet->data);

 	return \@results;
 }
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -83,7 +83,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -93,7 +92,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -103,7 +101,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -169,7 +166,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -179,7 +175,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -189,7 +184,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -253,7 +247,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -263,7 +256,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -273,7 +265,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -305,7 +296,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -315,7 +305,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -325,7 +314,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -383,17 +371,6 @@ grep "syntax error" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "flush cache, re-enable serve-stale and query again ($n)"
-ret=0
-$RNDCCMD 10.53.0.1 flushtree example > rndc.out.test$n.1 2>&1 || ret=1
-$RNDCCMD 10.53.0.1 serve-stale on > rndc.out.test$n.2 2>&1 || ret=1
-$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "enable responses from authoritative server ($n)"
 ret=0
@@ -409,7 +386,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -419,7 +395,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -429,7 +404,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -500,7 +474,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -510,7 +483,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -520,7 +492,6 @@ ret=0
 $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -197,28 +197,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

+ret=0
 echo_i "checking consistency between regular and compressed output ($n)"
-for i in 1 2 3 4 5; do
-	ret=0
-	if [ "$HAVEXMLSTATS" ];
-	then
-		URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
-	else
-		URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
-	fi
-	$CURL -D regular.headers $URL 2>/dev/null | \
-		sed -e "s#<current-time>.*</current-time>##g" > regular.out
-	$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
-		sed -e "s#<current-time>.*</current-time>##g" > compressed.out
-	diff regular.out compressed.out >/dev/null || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed on try $i, probably a timing issue, trying again"
-		sleep 1
-	else
-		break
-	fi
-done
-
+if [ "$HAVEXMLSTATS" ];
+then
+	URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
+else
+	URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
+fi
+$CURL -D regular.headers $URL 2>/dev/null | \
+	sed -e "s#<current-time>.*</current-time>##g" > regular.out
+$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
+	sed -e "s#<current-time>.*</current-time>##g" > compressed.out
+diff regular.out compressed.out >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

@@ -12,11 +12,6 @@ aaaa02.example.		3600	IN	AAAA	fd92:7065:b8e:ffff::5
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
 apl01.example.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.0/24
-apl02.example.		3600	IN	APL
-atma01.example.		3600	IN	ATMA	+61200000000
-atma02.example.		3600	IN	ATMA	+61200000000
-atma03.example.		3600	IN	ATMA	1234567890abcdef
-atma04.example.		3600	IN	ATMA	fedcba0987654321
 avc.example.		3600	IN	AVC	"foo:bar"
 caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
 caa02.example.		3600	IN	CAA	128 tbs "Unknown"
@@ -42,10 +37,8 @@ ds01.example.		3600	IN	NS	ns42.example.
 ds01.example.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
 ds02.example.		3600	IN	NS	ns43.example.
 ds02.example.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
-eid01.example.		3600	IN	EID	1289AB
 eui48.example.		3600	IN	EUI48	01-23-45-67-89-ab
 eui64.example.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
-gid01.example.		3600	IN	GID	\# 1 03
 gpos01.example.		3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
 gpos02.example.		3600	IN	GPOS	"" "" ""
 hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
@@ -85,7 +78,6 @@ mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
 naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
-nimloc01.example.	3600	IN	NIMLOC	1289AB
 ninfo01.example.	3600	IN	NINFO	"foo"
 ninfo02.example.	3600	IN	NINFO	"foo" "bar"
 ninfo03.example.	3600	IN	NINFO	"foo"
@@ -150,8 +142,6 @@ txt12.example.		3600	IN	TXT	"\"foo\""
 txt13.example.		3600	IN	TXT	"foo;"
 txt14.example.		3600	IN	TXT	"foo;"
 txt15.example.		3600	IN	TXT	"bar\\;"
-uid01.example.		3600	IN	UID	\# 1 02
-uinfo01.example.	3600	IN	UINFO	\# 1 01
 uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example.		3600	IN	URI	30 40 ""
@@ -12,11 +12,6 @@ aaaa02.example.		3600	IN	AAAA	fd92:7065:b8e:ffff::5
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
 apl01.example.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.1/24
-apl02.example.		3600	IN	APL
-atma01.example.		3600	IN	ATMA	+61200000000
-atma02.example.		3600	IN	ATMA	+61200000000
-atma03.example.		3600	IN	ATMA	1234567890abcdef
-atma04.example.		3600	IN	ATMA	fedcba0987654321
 avc.example.		3600	IN	AVC	"foo:bar"
 caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
 caa02.example.		3600	IN	CAA	128 tbs "Unknown"
@@ -42,10 +37,8 @@ ds01.example.		3600	IN	NS	ns42.example.
 ds01.example.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
 ds02.example.		3600	IN	NS	ns43.example.
 ds02.example.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
-eid01.example.		3600	IN	EID	1289AB
 eui48.example.		3600	IN	EUI48   01-23-45-67-89-ab
 eui64.example.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
-gid01.example.		3600	IN	GID	\# 1 03
 gpos01.example.		3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
 gpos02.example.		3600	IN	GPOS	"" "" ""
 hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
@@ -85,7 +78,6 @@ mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
 naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
-nimloc01.example.	3600	IN	NIMLOC	1289AB
 ninfo01.example.	3600	IN	NINFO	"foo"
 ninfo02.example.	3600	IN	NINFO	"foo" "bar"
 ninfo03.example.	3600	IN	NINFO	"foo"
@@ -150,8 +142,6 @@ txt12.example.		3600	IN	TXT	"\"foo\""
 txt13.example.		3600	IN	TXT	"foo;"
 txt14.example.		3600	IN	TXT	"foo;"
 txt15.example.		3600	IN	TXT	"bar\\;"
-uid01.example.		3600	IN	UID	\# 1 02
-uinfo01.example.	3600	IN	UINFO	\# 1 01
 uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example.		3600	IN	URI	30 40 ""
@@ -120,6 +120,7 @@ static char hexcookie[81];

 struct query {
 	char textname[MXNAME]; /*% Name we're going to be looking up */
+	bool ip6_int;
 	bool recurse;
 	bool have_aaonly;
 	bool have_adflag;
@@ -773,6 +774,7 @@ help(void) {
 " local opt       is one of:\n"
 "                 -c class            (specify query class)\n"
 "                 -t type             (specify query type)\n"
+"                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
 "                 +timeout=###        (Set query timeout) [UDP=5,TCP=10]\n"
 "                 +udptimeout=###     (Set timeout before UDP retry)\n"
@@ -993,7 +995,8 @@ reverse_octets(const char *in, char **p, char *end) {
 }

 static void
-get_reverse(char *reverse, size_t len, const char *value)
+get_reverse(char *reverse, size_t len, const char *value,
+	    bool ip6_int)
 {
 	int r;
 	isc_result_t result;
@@ -1007,6 +1010,8 @@ get_reverse(char *reverse, size_t len, const char *value)
 		dns_name_t *name;
 		unsigned int options = 0;

+		if (ip6_int)
+			options |= DNS_BYADDROPT_IPV6INT;
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, options, name);
 		CHECK("dns_byaddr_createptrname2", result);
@@ -1589,7 +1594,7 @@ dash_option(const char *option, char *next, struct query *query,
 			exit(0);
 			break;
 		case 'i':
-			/* deprecated */
+			query->ip6_int = true;
 			break;
 		case 'm':
 			/*
@@ -1669,7 +1674,7 @@ dash_option(const char *option, char *next, struct query *query,
 		query->rdtype = rdtype;
 		return (value_from_next);
 	case 'x':
-		get_reverse(textname, sizeof(textname), value);
+		get_reverse(textname, sizeof(textname), value, query->ip6_int);
 		strlcpy(query->textname, textname, sizeof(query->textname));
 		query->rdtype = dns_rdatatype_ptr;
 		query->rdclass = dns_rdataclass_in;
@@ -1783,6 +1788,7 @@ parse_args(bool is_batchfile, int argc, char **argv)

 	if (!is_batchfile) {
 		default_query.textname[0] = 0;
+		default_query.ip6_int = false;
 		default_query.recurse = true;
 		default_query.have_aaonly = false;
 		default_query.have_adflag = true; /*XXX*/
@@ -420,6 +420,11 @@
      a reverse lookup with the "PTR" query type.
    </para>

+    <para>
+      The <option>-i</option> option sets the reverse domain for
+      IPv6 addresses to IP6.INT.
+    </para>
+
    <para>
      Reverse lookups &mdash; mapping addresses to names &mdash; are
      simplified by the <option>-x</option> option.
@@ -429,7 +434,8 @@
      query name like <literal>11.12.13.10.in-addr.arpa</literal> and
      sets the query type and class to PTR and IN respectively.
      By default, IPv6 addresses are looked up using nibble format
-      under the IP6.ARPA domain.
+      under the IP6.ARPA domain.  To use the older RFC1886 method
+      using the IP6.INT domain specify the <option>-i</option> option.
    </para>

    <para>
@@ -69,18 +69,12 @@
 /* Define if clock_gettime is available. */
 #undef HAVE_CLOCK_GETTIME

-/* Use cmocka */
-#undef HAVE_CMOCKA
-
 /* Define to 1 if you have the <cmocka.h> header file. */
 #undef HAVE_CMOCKA_H

 /* Define to 1 if you have the `cpuset_setaffinty' function. */
 #undef HAVE_CPUSET_SETAFFINITY

-/* Define to 1 if you have the `CRYPTO_zalloc' function. */
-#undef HAVE_CRYPTO_ZALLOC
-
 /* Define to 1 if you have the <devpoll.h> header file. */
 #undef HAVE_DEVPOLL_H

@@ -102,6 +96,9 @@
 /* Define to 1 to enable dnstap support */
 #undef HAVE_DNSTAP

+/* Define to 1 if you have the `DSA_get0_pqg' function. */
+#undef HAVE_DSA_GET0_PQG
+
 /* Define to 1 if you have the `ECDSA_sign' function. */
 #undef HAVE_ECDSA_SIGN

@@ -132,21 +129,6 @@
 /* Define to 1 if you have the `EVP_aes_256_ecb' function. */
 #undef HAVE_EVP_AES_256_ECB

-/* Define to 1 if you have the `EVP_CIPHER_CTX_free' function. */
-#undef HAVE_EVP_CIPHER_CTX_FREE
-
-/* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
-#undef HAVE_EVP_CIPHER_CTX_NEW
-
-/* Define to 1 if you have the `EVP_MD_CTX_free' function. */
-#undef HAVE_EVP_MD_CTX_FREE
-
-/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
-#undef HAVE_EVP_MD_CTX_NEW
-
-/* Define to 1 if you have the `EVP_MD_CTX_reset' function. */
-#undef HAVE_EVP_MD_CTX_RESET
-
 /* Define to 1 if you have the `EVP_sha1' function. */
 #undef HAVE_EVP_SHA1

@@ -201,18 +183,6 @@
 /* Define to 1 if you have the <gssapi_krb5.h> header file. */
 #undef HAVE_GSSAPI_KRB5_H

-/* Define to 1 if you have the `HMAC_CTX_free' function. */
-#undef HAVE_HMAC_CTX_FREE
-
-/* Define to 1 if you have the `HMAC_CTX_get_md' function. */
-#undef HAVE_HMAC_CTX_GET_MD
-
-/* Define to 1 if you have the `HMAC_CTX_new' function. */
-#undef HAVE_HMAC_CTX_NEW
-
-/* Define to 1 if you have the `HMAC_CTX_reset' function. */
-#undef HAVE_HMAC_CTX_RESET
-
 /* Define to 1 if you have the <idn2.h> header file. */
 #undef HAVE_IDN2_H

@@ -111,6 +111,15 @@
 /* Define if you have h_errno */
 #define HAVE_H_ERRNO

+/* Define if you have RSA_generate_key(). */
+#define HAVE_RSA_GENERATE_KEY
+
+/* Define if you have DSA_generate_parameters(). */
+#define HAVE_DSA_GENERATE_PARAMETERS
+
+/* Define if you have DH_generate_parameters(). */
+#define HAVE_DH_GENERATE_PARAMETERS
+
 /* Define if you have getpassphrase in the C library. */
 #define HAVE_GETPASSPHRASE

@@ -271,6 +280,9 @@ typedef __int64 off_t;
 /* Define to enable "rrset-order fixed" syntax. */
@DNS_RDATASET_FIXED@

+/* Define if OpenSSL provides FIPS_mode() */
+@HAVE_FIPS_MODE@
+
 /* Define if OpenSSL includes Ed25519 support */
@HAVE_OPENSSL_ED25519@

@@ -280,6 +292,9 @@ typedef __int64 off_t;
 /* Define if your OpenSSL version supports DH functions. */
@HAVE_DH_GET0_KEY@

+/* Define if your OpenSSL version supports DSA functions. */
+@HAVE_DSA_GET0_PQG@
+
 /* Define if your OpenSSL version supports ECDSA functions. */
@HAVE_ECDSA_SIG_GET0@

@@ -844,7 +844,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1004,7 +1003,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1257,15 +1255,6 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1403,7 +1392,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1556,7 +1545,6 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -12152,7 +12140,7 @@ done
 if test "${with_python+set}" = set; then :
  withval=$with_python; use_python="$withval"
 else
-  use_python="yes"
+  use_python="unspec"
 fi


@@ -12186,9 +12174,9 @@ $as_echo_n "checking for python support... " >&6; }
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
 $as_echo "disabled" >&6; }
 		;;
-	yes|*)
+	unspec|yes|*)
 		case "$use_python" in
-		yes|'')
+		unspec|yes|'')
 			for p in $python
 			do
 				for ac_prog in $p
@@ -12290,16 +12278,30 @@ $as_echo "not found" >&6; }
 					unset PYTHON
 				fi
 			done
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
-$as_echo_n "checking for python support... " >&6; }
 			if test "X$PYTHON" != "X"
 			then
-				PYTHON_INSTALL_DIR="$use_python_install_dir"
-				PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+				case "$use_python_install_dir" in
+				unspec)
+					PYTHON_INSTALL_DIR=""
+					PYTHON_INSTALL_LIB=""
+					;;
+				*)
+					PYTHON_INSTALL_DIR="$use_python_install_dir"
+					PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
+					;;
+				esac
 			else
-				as_fn_error $? "no; python required for dnssec-keymgr" "$LINENO" 5
+				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
+$as_echo_n "checking for python support... " >&6; }
+				case "$use_python" in
+				unspec)
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
+$as_echo "disabled" >&6; }
+					;;
+				yes)
+					as_fn_error $? "missing python" "$LINENO" 5
+					;;
+				esac
 			fi
 			;;
 		*)
@@ -15284,6 +15286,77 @@ fi
 done


+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sigwait in -lc_r" >&5
+$as_echo_n "checking for sigwait in -lc_r... " >&6; }
+if ${ac_cv_lib_c_r_sigwait+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lc_r  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char sigwait ();
+int
+main ()
+{
+return sigwait ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_c_r_sigwait=yes
+else
+  ac_cv_lib_c_r_sigwait=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_c_r_sigwait" >&5
+$as_echo "$ac_cv_lib_c_r_sigwait" >&6; }
+if test "x$ac_cv_lib_c_r_sigwait" = xyes; then :
+  $as_echo "#define HAVE_SIGWAIT 1" >>confdefs.h
+
+fi
+
+		case $host in
+		*-freebsd5.[012]|*-freebsd5.[012].*);;
+		*-freebsd5.[3456789]|*-freebsd5.[3456789].*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		*-freebsd6.*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		$as_echo "#define HAVE_LINUXTHREADS 1" >>confdefs.h
+
+		;;
+esac
+
 # Look for functions relating to thread naming
 for ac_func in pthread_setname_np pthread_set_name_np
 do :
@@ -15407,8 +15480,8 @@ else
            # then use that information and don't search ssldirs

 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OPENSSL" >&5
-$as_echo_n "checking for OPENSSL... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for crypto" >&5
+$as_echo_n "checking for crypto... " >&6; }

 if test -n "$OPENSSL_CFLAGS"; then
    pkg_cv_OPENSSL_CFLAGS="$OPENSSL_CFLAGS"
@@ -15448,7 +15521,7 @@ fi


 if test $pkg_failed = yes; then
-   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }

 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -15466,7 +15539,7 @@ fi

 	ssldirs="$default_ssldirs"
 elif test $pkg_failed = untried; then
-     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	ssldirs="$default_ssldirs"
 else
@@ -15495,7 +15568,7 @@ $as_echo_n "checking for openssl/ssl.h in $ssldir... " >&6; }
 	    if test -f "$ssldir/include/openssl/ssl.h"; then :

 		    OPENSSL_INCLUDES="-I$ssldir/include"
-                    OPENSSL_LIBS="-L$ssldir/lib -lcrypto -lssl"
+                    OPENSSL_LIBS="-L$ssldir/lib -lcrypto"
                    found=true
                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
@@ -15599,58 +15672,6 @@ See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

-#
-# Check for functions added in OpenSSL or LibreSSL
-#
-
-for ac_func in CRYPTO_zalloc
-do :
-  ac_fn_c_check_func "$LINENO" "CRYPTO_zalloc" "ac_cv_func_CRYPTO_zalloc"
-if test "x$ac_cv_func_CRYPTO_zalloc" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_CRYPTO_ZALLOC 1
-_ACEOF
-
-fi
-done
-
-for ac_func in EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-for ac_func in EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-for ac_func in HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-
 #
 # Check for algorithm support in OpenSSL
 #
@@ -15822,7 +15843,7 @@ done
 #
 # Check for OpenSSL 1.1.x/LibreSSL functions
 #
-for ac_func in DH_get0_key ECDSA_SIG_get0 RSA_set0_key
+for ac_func in DH_get0_key ECDSA_SIG_get0 RSA_set0_key DSA_get0_pqg
 do :
  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -19420,8 +19441,8 @@ case $with_libidn2 in #(
  yes) :

 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBIDN2" >&5
-$as_echo_n "checking for LIBIDN2... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libidn2" >&5
+$as_echo_n "checking for libidn2... " >&6; }

 if test -n "$LIBIDN2_CFLAGS"; then
    pkg_cv_LIBIDN2_CFLAGS="$LIBIDN2_CFLAGS"
@@ -19461,7 +19482,7 @@ fi


 if test $pkg_failed = yes; then
-   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }

 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -19488,7 +19509,7 @@ Alternatively, you may set the environment variables LIBIDN2_CFLAGS
 and LIBIDN2_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -19628,19 +19649,19 @@ case $with_cmocka in #(
  yes) :

 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CMOCKA" >&5
-$as_echo_n "checking for CMOCKA... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for cmocka" >&5
+$as_echo_n "checking for cmocka... " >&6; }

 if test -n "$CMOCKA_CFLAGS"; then
    pkg_cv_CMOCKA_CFLAGS="$CMOCKA_CFLAGS"
 elif test -n "$PKG_CONFIG"; then
    if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka >= 1.0.0\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "cmocka >= 1.0.0") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "cmocka") 2>&5
  ac_status=$?
  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
  test $ac_status = 0; }; then
-  pkg_cv_CMOCKA_CFLAGS=`$PKG_CONFIG --cflags "cmocka >= 1.0.0" 2>/dev/null`
+  pkg_cv_CMOCKA_CFLAGS=`$PKG_CONFIG --cflags "cmocka" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
  pkg_failed=yes
@@ -19652,12 +19673,12 @@ if test -n "$CMOCKA_LIBS"; then
    pkg_cv_CMOCKA_LIBS="$CMOCKA_LIBS"
 elif test -n "$PKG_CONFIG"; then
    if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka >= 1.0.0\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "cmocka >= 1.0.0") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "cmocka") 2>&5
  ac_status=$?
  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
  test $ac_status = 0; }; then
-  pkg_cv_CMOCKA_LIBS=`$PKG_CONFIG --libs "cmocka >= 1.0.0" 2>/dev/null`
+  pkg_cv_CMOCKA_LIBS=`$PKG_CONFIG --libs "cmocka" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
  pkg_failed=yes
@@ -19669,7 +19690,7 @@ fi


 if test $pkg_failed = yes; then
-   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }

 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -19678,14 +19699,14 @@ else
        _pkg_short_errors_supported=no
 fi
        if test $_pkg_short_errors_supported = yes; then
-	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "cmocka >= 1.0.0" 2>&1`
+	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "cmocka" 2>&1`
        else
-	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "cmocka >= 1.0.0" 2>&1`
+	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "cmocka" 2>&1`
        fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$CMOCKA_PKG_ERRORS" >&5

-	as_fn_error $? "Package requirements (cmocka >= 1.0.0) were not met:
+	as_fn_error $? "Package requirements (cmocka) were not met:

 $CMOCKA_PKG_ERRORS

@@ -19696,7 +19717,7 @@ Alternatively, you may set the environment variables CMOCKA_CFLAGS
 and CMOCKA_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -19716,8 +19737,6 @@ else
        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }

-$as_echo "#define HAVE_CMOCKA 1" >>confdefs.h
-
 fi ;; #(
  *) :

@@ -19800,9 +19819,6 @@ if test "$ac_res" != no; then :
 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"

-$as_echo "#define HAVE_CMOCKA 1" >>confdefs.h
-
-
 else
  as_fn_error $? "cmocka unit testing framework not found in $with_cmocka path" "$LINENO" 5
 fi
@@ -19853,47 +19869,6 @@ rm -f core conftest.err conftest.$ac_objext \
 # AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])


-LDFLAGS=$save_LDFLAGS
-
-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for linker support for --wrap option" >&5
-$as_echo_n "checking for linker support for --wrap option... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdio.h>
-int
-main ()
-{
-__wrap_printf("success"); return (0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-
-$as_echo "#define LD_WRAP 1" >>confdefs.h
-
-     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-
-
 LDFLAGS=$save_LDFLAGS

 #
@@ -24004,7 +23979,7 @@ report() {
 	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
 	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_backtrace" && \
+    test "yes" = "$want_backtrace" && \
 	echo "    Print backtrace on crash (--enable-backtrace)"
    test "minimal" = "$want_symtable" && \
 	echo "    Use symbol table for backtrace, named only (--enable-symtable)"
@@ -24062,7 +24037,7 @@ report() {
 	echo "    Using PKCS#11 for Public-Key Cryptography (--without-native-pkcs11)"
    )

-    test "yes" = "$enable_backtrace" || \
+    test "yes" = "$want_backtrace" || \
 	echo "    Print backtrace on crash (--enable-backtrace)"
    test "yes" = "$want_querytrace" || \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
@@ -184,7 +184,7 @@ AC_SUBST(PERL)
 AC_ARG_WITH(python,
 	    AS_HELP_STRING([--with-python=PATH],
 			   [specify path to python interpreter]),
-    use_python="$withval", use_python="yes")
+    use_python="$withval", use_python="unspec")
 AC_ARG_WITH(python-install-dir,
 	    AS_HELP_STRING([--with-python-install-dir=PATH],
 			   [installation directory for Python modules]),
@@ -208,11 +208,11 @@ if (sys.version_info < (2,7)) or (sys.version_info < (3,2) and sys.version_info
 case "$use_python" in
 	no)
 		AC_MSG_CHECKING([for python support])
-		AC_MSG_RESULT([disabled])
+		AC_MSG_RESULT(disabled)
 		;;
-	yes|*)
+	unspec|yes|*)
 		case "$use_python" in
-		yes|'')
+		unspec|yes|'')
 			for p in $python
 			do
 				AC_PATH_PROGS(PYTHON, $p)
@@ -258,14 +258,28 @@ case "$use_python" in
 					unset PYTHON
 				fi
 			done
-			AC_MSG_CHECKING([for python support])
 			if test "X$PYTHON" != "X"
 			then
-				PYTHON_INSTALL_DIR="$use_python_install_dir"
-				PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
-				AC_MSG_RESULT([yes])
+				case "$use_python_install_dir" in
+				unspec)
+					PYTHON_INSTALL_DIR=""
+					PYTHON_INSTALL_LIB=""
+					;;
+				*)
+					PYTHON_INSTALL_DIR="$use_python_install_dir"
+					PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
+					;;
+				esac
 			else
-				AC_MSG_ERROR([no; python required for dnssec-keymgr])
+				AC_MSG_CHECKING([for python support])
+				case "$use_python" in
+				unspec)
+					AC_MSG_RESULT(disabled)
+					;;
+				yes)
+					AC_MSG_ERROR([missing python])
+					;;
+				esac
 			fi
 			;;
 		*)
@@ -705,6 +719,34 @@ AC_CHECK_HEADERS([sys/cpuset.h])
 AC_CHECK_HEADERS([sys/procset.h])
 AC_CHECK_FUNCS([pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity])

+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		AC_CHECK_LIB(c_r, sigwait, AC_DEFINE(HAVE_SIGWAIT),)
+		case $host in
+		*-freebsd5.[[012]]|*-freebsd5.[[012]].*);;
+		*-freebsd5.[[3456789]]|*-freebsd5.[[3456789]].*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		*-freebsd6.*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		AC_DEFINE(HAVE_LINUXTHREADS)
+		;;
+esac
+
 # Look for functions relating to thread naming
 AC_CHECK_FUNCS([pthread_setname_np pthread_set_name_np])
 AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
@@ -779,15 +821,6 @@ AC_COMPILE_IFELSE(
    [AC_MSG_RESULT([yes])],
    [AC_MSG_FAILURE([not found])])

-#
-# Check for functions added in OpenSSL or LibreSSL
-#
-
-AC_CHECK_FUNCS([CRYPTO_zalloc])
-AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
-AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])
-AC_CHECK_FUNCS([HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md])
-
 #
 # Check for algorithm support in OpenSSL
 #
@@ -847,7 +880,7 @@ AC_CHECK_FUNCS([EVP_aes_128_ecb EVP_aes_192_ecb EVP_aes_256_ecb], [:],
 #
 # Check for OpenSSL 1.1.x/LibreSSL functions
 #
-AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key])
+AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key DSA_get0_pqg])

 #
 # Check whether FIPS mode is available and whether we should enable it
@@ -2389,8 +2422,7 @@ AC_ARG_WITH([cmocka],

 AS_CASE([$with_cmocka],
 	[no],[:],
-	[yes],[PKG_CHECK_MODULES([CMOCKA], [cmocka >= 1.0.0],
-				 [AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])])],
+	[yes],[PKG_CHECK_MODULES([CMOCKA], [cmocka])],
 	[*],[
 	    save_CFLAGS="$CFLAGS"
 	    save_LIBS="$LIBS"
@@ -2408,7 +2440,6 @@ AS_CASE([$with_cmocka],
 			   [
 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"
-			       AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])
 			   ],
 			   [AC_MSG_ERROR([cmocka unit testing framework not found in $with_cmocka path])])
 	    ])
@@ -2437,28 +2468,6 @@ AC_SUBST([LD_WRAP_TESTS])

 LDFLAGS=$save_LDFLAGS

-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-AC_MSG_CHECKING([for linker support for --wrap option])
-AC_LINK_IFELSE(
-    [AC_LANG_PROGRAM([#include <stdio.h>], [__wrap_printf("success"); return (0);])],
-    [enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-     AC_DEFINE([LD_WRAP], [1], [define if the linker supports --wrap option])
-     AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no])])
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-AC_SUBST([LD_WRAP_TESTS])
-
-LDFLAGS=$save_LDFLAGS
-
 #
 # Check whether to build Automated Test Framework unit tests
 #
@@ -3215,7 +3224,7 @@ report() {
 	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
 	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_backtrace" && \
+    test "yes" = "$want_backtrace" && \
 	echo "    Print backtrace on crash (--enable-backtrace)"
    test "minimal" = "$want_symtable" && \
 	echo "    Use symbol table for backtrace, named only (--enable-symtable)"
@@ -3273,7 +3282,7 @@ report() {
 	echo "    Using PKCS#11 for Public-Key Cryptography (--without-native-pkcs11)"
    )

-    test "yes" = "$enable_backtrace" || \
+    test "yes" = "$want_backtrace" || \
 	echo "    Print backtrace on crash (--enable-backtrace)"
    test "yes" = "$want_querytrace" || \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
@@ -7317,8 +7317,8 @@ options {
 	      </listitem>
 	    </varlistentry>

-	    <varlistentry xml:id="allow_transfer">
-	      <term xml:id="allow_transfer_term"><command>allow-transfer</command></term>
+	    <varlistentry>
+	      <term><command>allow-transfer</command></term>
 	      <listitem>
 		<para>
 		  Specifies which hosts are allowed to
@@ -11410,7 +11410,6 @@ view "external" {

 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="master.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="slave.zoneopt.xml"/>
-<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mirror.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="hint.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stub.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="static-stub.zoneopt.xml"/>
@@ -11430,7 +11429,6 @@ view "external" {
 	      acceptable values include:
 	      <varname>master</varname> (or <varname>primary</varname>),
 	      <varname>slave</varname> (or <varname>secondary</varname>),
-	      <varname>mirror</varname>,
 	      <varname>delegation-only</varname>,
 	      <varname>forward</varname>,
 	      <varname>hint</varname>,
@@ -11567,97 +11565,6 @@ view "external" {
 		      </para>
 		    </entry>
 		  </row>
-		  <row rowsep="0">
-		    <entry colname="1">
-		      <para>
-			<varname>mirror</varname>
-		      </para>
-		    </entry>
-		    <entry colname="2">
-		      <para>
-		      </para>
-		      <para>
-			A mirror zone acts like a zone of type
-			<userinput>secondary</userinput> whose data is
-			subject to DNSSEC validation before being used
-			in answers.  Validation is performed during the
-			zone transfer process, and again when the zone
-			file is loaded from disk when
-			<command>named</command> is restarted.  If
-			validation fails, a retransfer of the zone is
-			scheduled; if the mirror zone had not previously
-			been loaded or if the previous version has
-			expired, traditional DNS recursion will be used
-			to look up the answers instead.
-		      </para>
-		      <para>
-			For validation to succeed, a key-signing key
-			(KSK) for the zone must be configured as a trust
-			anchor in <filename>named.conf</filename>: that
-			is, a key for the zone must either be specified
-			in <command>managed-keys</command> or
-			<command>trusted-keys</command>, or in the case
-			of the root zone,
-			<command>dnssec-validation</command> must be set
-			to <userinput>auto</userinput>.  Answers coming
-			from a mirror zone look almost exactly like
-			answers from a zone of type
-			<userinput>secondary</userinput>, with the
-			notable exceptions that the AA bit
-			("authoritative answer") is not set, and the AD
-			bit ("authenticated data") is.
-		      </para>
-		      <para>
-			Since mirror zones are intended to be used by
-			recursive resolvers, adding one to a view with
-			recursion disabled is considered to be a
-			configuration error.
-		      </para>
-		      <para>
-			When configuring NOTIFY for a mirror zone, only
-			<userinput>notify no;</userinput> and
-			<userinput>notify explicit;</userinput> can be
-			used.  Using any other
-			<userinput>notify</userinput> setting at the
-			zone level is a configuration error.  Using any
-			other <userinput>notify</userinput> setting at
-			the <userinput>options</userinput> or
-			<userinput>view</userinput> level will cause
-			that setting to be overridden with
-			<userinput>notify explicit;</userinput> for the
-			mirror zone in question.
-		      </para>
-		      <para>
-			Outgoing transfers of mirror zones are disabled
-			by default but may be enabled using
-			<xref endterm="allow_transfer_term" linkend="allow_transfer"/>.
-		      </para>
-		      <para>
-			While any zone may be configured with this type,
-			it is intended to be used to set up a fast local
-			copy of the root zone, similar to the one
-			described in RFC 7706.  Note, however, that
-			mirror zones are not supposed to augment the
-			example configuration provided by RFC 7706 but
-			rather to replace it altogether.
-		      </para>
-		      <para>
-			A default list of primary servers for the root
-			zone is built into <command>named</command> and
-			thus IANA root zone mirroring can be enabled
-			using the following configuration:
-		      </para>
-<programlisting>zone "." {
-	type mirror;
-};</programlisting>
-		      <para>
-			To make mirror zone contents persist between
-			<command>named</command> restarts, use the
-			<xref endterm="file_option_term" linkend="file_option"/>
-			option.
-		      </para>
-		    </entry>
-		  </row>
 		  <row rowsep="0">
 		    <entry colname="1">
 		      <para>
@@ -12160,20 +12067,19 @@ view "external" {
 		</listitem>
 	      </varlistentry>

-	      <varlistentry xml:id="file_option">
-		<term xml:id="file_option_term"><command>file</command></term>
+	      <varlistentry>
+		<term><command>file</command></term>
 		<listitem>
 		  <para>
 		    Set the zone's filename. In <command>master</command>,
 		    <command>hint</command>, and <command>redirect</command>
 		    zones which do not have <command>masters</command>
 		    defined, zone data is loaded from this file. In
-		    <command>slave</command>, <command>mirror</command>,
-		    <command>stub</command>, and <command>redirect</command>
-		    zones which do have <command>masters</command>
-		    defined, zone data is retrieved from another server
-		    and saved in this file.  This option is not
-		    applicable to other zone types.
+		    <command>slave</command>, <command>stub</command>, and
+		    <command>redirect</command> zones which do have
+		    <command>masters</command> defined, zone data is
+		    retrieved from another server and saved in this file.
+		    This option is not applicable to other zone types.
 		  </para>
 		</listitem>
 	      </varlistentry>
@@ -12618,6 +12524,68 @@ example.com. NS ns2.example.net.
 		</listitem>
 	      </varlistentry>

+	      <varlistentry>
+		<term><command>mirror</command></term>
+		<listitem>
+		  <para>
+		    If set to <userinput>yes</userinput>, this causes the
+		    zone to become a mirror zone.  A mirror zone is a
+		    <userinput>secondary</userinput> zone whose data
+		    is subject to DNSSEC validation before being
+		    used in answers.  The default is
+		    <userinput>no</userinput>.
+		  </para>
+		  <para>
+		    A mirror zone's contents are validated during the transfer
+		    process, and again when the zone file is loaded from disk
+		    when <command>named</command> is restarted.  If validation
+		    fails, a retransfer of the zone is scheduled; if the mirror
+		    zone had not previously been loaded or if the previous
+		    version has expired, traditional DNS recursion will be used
+		    to look up the answers instead.
+		  </para>
+		  <para>
+		    For validation to succeed, a key-signing key (KSK) for
+		    the zone must be configured as a trust anchor in
+		    <filename>named.conf</filename>:
+		    that is, a key for the zone must either be specified in
+		    <command>managed-keys</command> or
+		    <command>trusted-keys</command>, or in the case of
+		    the root zone, <command>dnssec-validation</command>
+		    must be set to <userinput>auto</userinput>.
+		    Answers coming from a mirror zone look almost exactly like
+		    answers from a normal slave zone, with the notable
+		    exceptions that the AA bit ("authoritative answer") is
+		    not set, and the AD bit ("authenticated data") is.
+		  </para>
+		  <para>
+		    Though this option can be used for other zones, it
+		    is intended to be used to set up a fast local copy of
+		    the root zone, as described in RFC 7706.
+		    This can be done by using the following configuration:
+		  </para>
+<programlisting>zone "." {
+	type slave;
+	mirror yes;
+	file "root.mirror";
+	masters {
+		192.228.79.201;       # b.root-servers.net
+		192.33.4.12;          # c.root-servers.net
+		192.5.5.241;          # f.root-servers.net
+		192.112.36.4;         # g.root-servers.net
+		193.0.14.129;         # k.root-servers.net
+		192.0.47.132;         # xfr.cjr.dns.icann.org
+		192.0.32.132;         # xfr.lax.dns.icann.org
+		2001:500:84::b;       # b.root-servers.net
+		2001:500:2f::f;       # f.root-servers.net
+		2001:7fd::1;          # k.root-servers.net
+		2620:0:2830:202::132; # xfr.cjr.dns.icann.org
+		2620:0:2d0:202::132;  # xfr.lax.dns.icann.org
+	};
+};</programlisting>
+		</listitem>
+	      </varlistentry>
+
 	      <varlistentry>
 		<term><command>multi-master</command></term>
 		<listitem>
@@ -2531,6 +2531,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>minimal-any</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>minimal-responses</strong></span> ( no-auth | no-auth-recursive | <em class="replaceable"><code>boolean</code></em> );
+	<span class="command"><strong>mirror</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>new-zones-directory</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
 	<span class="command"><strong>no-case-compress</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
@@ -5368,9 +5369,7 @@ options {
                  It is now ignored with some warning messages.
                </p>
              </dd>
-<dt>
-<a name="allow_transfer"></a><span class="term"><a name="allow_transfer_term"></a><span class="command"><strong>allow-transfer</strong></span></span>
-</dt>
+<dt><span class="term"><span class="command"><strong>allow-transfer</strong></span></span></dt>
 <dd>
                <p>
                  Specifies which hosts are allowed to
@@ -9399,6 +9398,7 @@ view "external" {
 	<span class="command"><strong>max-transfer-time-out</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>min-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
+	<span class="command"><strong>mirror</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>notify</strong></span> ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );
 	<span class="command"><strong>notify-delay</strong></span> <em class="replaceable"><code>integer</code></em>;
@@ -9421,50 +9421,6 @@ view "external" {
 };
 </pre>
 <pre class="programlisting">
-<span class="command"><strong>zone</strong></span> <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {
-	<span class="command"><strong>type</strong></span> mirror;
-	<span class="command"><strong>allow-notify</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-query</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-query-on</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-transfer</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-update-forwarding</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>also-notify</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key <em class="replaceable"><code>string</code></em> ]; ... };
-	<span class="command"><strong>alt-transfer-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>alt-transfer-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>check-names</strong></span> ( fail | warn | ignore );
-	<span class="command"><strong>database</strong></span> <em class="replaceable"><code>string</code></em>;
-	<span class="command"><strong>file</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
-	<span class="command"><strong>ixfr-from-differences</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>journal</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
-	<span class="command"><strong>masterfile-format</strong></span> ( map | raw | text );
-	<span class="command"><strong>masterfile-style</strong></span> ( full | relative );
-	<span class="command"><strong>masters</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key <em class="replaceable"><code>string</code></em> ]; ... };
-	<span class="command"><strong>max-journal-size</strong></span> ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );
-	<span class="command"><strong>max-records</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-idle-in</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-idle-out</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-time-in</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-time-out</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>min-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>notify</strong></span> ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );
-	<span class="command"><strong>notify-delay</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>notify-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>notify-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>request-expire</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>request-ixfr</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>transfer-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>transfer-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>try-tcp-refresh</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>use-alt-transfer-source</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>zero-no-soa-ttl</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
-};
-</pre>
-<pre class="programlisting">
 <span class="command"><strong>zone</strong></span> <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {
 	<span class="command"><strong>type</strong></span> hint;
 	<span class="command"><strong>check-names</strong></span> ( fail | warn | ignore );
@@ -9509,7 +9465,7 @@ view "external" {
 	<span class="command"><strong>forward</strong></span> ( first | only );
 	<span class="command"><strong>forwarders</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };
 	<span class="command"><strong>max-records</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>server-addresses</strong></span> { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };
+	<span class="command"><strong>server-addresses</strong></span> { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ]; ... };
 	<span class="command"><strong>server-names</strong></span> { <em class="replaceable"><code>string</code></em>; ... };
 	<span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
 };
@@ -9563,7 +9519,6 @@ view "external" {
              acceptable values include:
              <code class="varname">master</code> (or <code class="varname">primary</code>),
              <code class="varname">slave</code> (or <code class="varname">secondary</code>),
-              <code class="varname">mirror</code>,
              <code class="varname">delegation-only</code>,
              <code class="varname">forward</code>,
              <code class="varname">hint</code>,
@@ -9701,97 +9656,6 @@ view "external" {
                    </td>
 </tr>
 <tr>
-<td>
-                      <p>
-                        <code class="varname">mirror</code>
-                      </p>
-                    </td>
-<td>
-                      <p>
-                      </p>
-                      <p>
-                        A mirror zone acts like a zone of type
-                        <strong class="userinput"><code>secondary</code></strong> whose data is
-                        subject to DNSSEC validation before being used
-                        in answers.  Validation is performed during the
-                        zone transfer process, and again when the zone
-                        file is loaded from disk when
-                        <span class="command"><strong>named</strong></span> is restarted.  If
-                        validation fails, a retransfer of the zone is
-                        scheduled; if the mirror zone had not previously
-                        been loaded or if the previous version has
-                        expired, traditional DNS recursion will be used
-                        to look up the answers instead.
-                      </p>
-                      <p>
-                        For validation to succeed, a key-signing key
-                        (KSK) for the zone must be configured as a trust
-                        anchor in <code class="filename">named.conf</code>: that
-                        is, a key for the zone must either be specified
-                        in <span class="command"><strong>managed-keys</strong></span> or
-                        <span class="command"><strong>trusted-keys</strong></span>, or in the case
-                        of the root zone,
-                        <span class="command"><strong>dnssec-validation</strong></span> must be set
-                        to <strong class="userinput"><code>auto</code></strong>.  Answers coming
-                        from a mirror zone look almost exactly like
-                        answers from a zone of type
-                        <strong class="userinput"><code>secondary</code></strong>, with the
-                        notable exceptions that the AA bit
-                        ("authoritative answer") is not set, and the AD
-                        bit ("authenticated data") is.
-                      </p>
-                      <p>
-                        Since mirror zones are intended to be used by
-                        recursive resolvers, adding one to a view with
-                        recursion disabled is considered to be a
-                        configuration error.
-                      </p>
-                      <p>
-                        When configuring NOTIFY for a mirror zone, only
-                        <strong class="userinput"><code>notify no;</code></strong> and
-                        <strong class="userinput"><code>notify explicit;</code></strong> can be
-                        used.  Using any other
-                        <strong class="userinput"><code>notify</code></strong> setting at the
-                        zone level is a configuration error.  Using any
-                        other <strong class="userinput"><code>notify</code></strong> setting at
-                        the <strong class="userinput"><code>options</code></strong> or
-                        <strong class="userinput"><code>view</code></strong> level will cause
-                        that setting to be overridden with
-                        <strong class="userinput"><code>notify explicit;</code></strong> for the
-                        mirror zone in question.
-                      </p>
-                      <p>
-                        Outgoing transfers of mirror zones are disabled
-                        by default but may be enabled using
-                        <a class="xref" href="Bv9ARM.ch05.html#allow_transfer"><span class="command"><strong>allow-transfer</strong></span></a>.
-                      </p>
-                      <p>
-                        While any zone may be configured with this type,
-                        it is intended to be used to set up a fast local
-                        copy of the root zone, similar to the one
-                        described in RFC 7706.  Note, however, that
-                        mirror zones are not supposed to augment the
-                        example configuration provided by RFC 7706 but
-                        rather to replace it altogether.
-                      </p>
-                      <p>
-                        A default list of primary servers for the root
-                        zone is built into <span class="command"><strong>named</strong></span> and
-                        thus IANA root zone mirroring can be enabled
-                        using the following configuration:
-                      </p>
-<pre class="programlisting">zone "." {
-        type mirror;
-};</pre>
-                      <p>
-                        To make mirror zone contents persist between
-                        <span class="command"><strong>named</strong></span> restarts, use the
-                        <a class="xref" href="Bv9ARM.ch05.html#file_option"><span class="command"><strong>file</strong></span></a>
-                        option.
-                      </p>
-                    </td>
-</tr>
-<tr>
 <td>
                      <p>
                        <code class="varname">static-stub</code>
@@ -10229,21 +10093,18 @@ view "external" {
                    See caveats in <a class="xref" href="Bv9ARM.ch05.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
                  </p>
                </dd>
-<dt>
-<a name="file_option"></a><span class="term"><a name="file_option_term"></a><span class="command"><strong>file</strong></span></span>
-</dt>
+<dt><span class="term"><span class="command"><strong>file</strong></span></span></dt>
 <dd>
                  <p>
                    Set the zone's filename. In <span class="command"><strong>master</strong></span>,
                    <span class="command"><strong>hint</strong></span>, and <span class="command"><strong>redirect</strong></span>
                    zones which do not have <span class="command"><strong>masters</strong></span>
                    defined, zone data is loaded from this file. In
-                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>mirror</strong></span>,
-                    <span class="command"><strong>stub</strong></span>, and <span class="command"><strong>redirect</strong></span>
-                    zones which do have <span class="command"><strong>masters</strong></span>
-                    defined, zone data is retrieved from another server
-                    and saved in this file.  This option is not
-                    applicable to other zone types.
+                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>stub</strong></span>, and
+                    <span class="command"><strong>redirect</strong></span> zones which do have
+                    <span class="command"><strong>masters</strong></span> defined, zone data is
+                    retrieved from another server and saved in this file.
+                    This option is not applicable to other zone types.
                  </p>
                </dd>
 <dt><span class="term"><span class="command"><strong>forward</strong></span></span></dt>
@@ -10583,6 +10444,65 @@ example.com. NS ns2.example.net.
                    behavior is disabled by default.
                  </p>
                </dd>
+<dt><span class="term"><span class="command"><strong>mirror</strong></span></span></dt>
+<dd>
+                  <p>
+                    If set to <strong class="userinput"><code>yes</code></strong>, this causes the
+                    zone to become a mirror zone.  A mirror zone is a
+                    <strong class="userinput"><code>secondary</code></strong> zone whose data
+                    is subject to DNSSEC validation before being
+                    used in answers.  The default is
+                    <strong class="userinput"><code>no</code></strong>.
+                  </p>
+                  <p>
+                    A mirror zone's contents are validated during the transfer
+                    process, and again when the zone file is loaded from disk
+                    when <span class="command"><strong>named</strong></span> is restarted.  If validation
+                    fails, a retransfer of the zone is scheduled; if the mirror
+                    zone had not previously been loaded or if the previous
+                    version has expired, traditional DNS recursion will be used
+                    to look up the answers instead.
+                  </p>
+                  <p>
+                    For validation to succeed, a key-signing key (KSK) for
+                    the zone must be configured as a trust anchor in
+                    <code class="filename">named.conf</code>:
+                    that is, a key for the zone must either be specified in
+                    <span class="command"><strong>managed-keys</strong></span> or
+                    <span class="command"><strong>trusted-keys</strong></span>, or in the case of
+                    the root zone, <span class="command"><strong>dnssec-validation</strong></span>
+                    must be set to <strong class="userinput"><code>auto</code></strong>.
+                    Answers coming from a mirror zone look almost exactly like
+                    answers from a normal slave zone, with the notable
+                    exceptions that the AA bit ("authoritative answer") is
+                    not set, and the AD bit ("authenticated data") is.
+                  </p>
+                  <p>
+                    Though this option can be used for other zones, it
+                    is intended to be used to set up a fast local copy of
+                    the root zone, as described in RFC 7706.
+                    This can be done by using the following configuration:
+                  </p>
+<pre class="programlisting">zone "." {
+        type slave;
+        mirror yes;
+        file "root.mirror";
+        masters {
+                192.228.79.201;       # b.root-servers.net
+                192.33.4.12;          # c.root-servers.net
+                192.5.5.241;          # f.root-servers.net
+                192.112.36.4;         # g.root-servers.net
+                193.0.14.129;         # k.root-servers.net
+                192.0.47.132;         # xfr.cjr.dns.icann.org
+                192.0.32.132;         # xfr.lax.dns.icann.org
+                2001:500:84::b;       # b.root-servers.net
+                2001:500:2f::f;       # f.root-servers.net
+                2001:7fd::1;          # k.root-servers.net
+                2620:0:2830:202::132; # xfr.cjr.dns.icann.org
+                2620:0:2d0:202::132;  # xfr.lax.dns.icann.org
+        };
+};</pre>
+                </dd>
 <dt><span class="term"><span class="command"><strong>multi-master</strong></span></span></dt>
 <dd>
                  <p>
@@ -871,6 +871,7 @@ view
 		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+		mirror <em class="replaceable"><code>boolean</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 		notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 		notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -885,7 +886,8 @@ view
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
-		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
+		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -896,7 +898,7 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( primary | master | secondary | slave | mirror |<br>
+		type ( primary | master | secondary | slave |<br>
 		    delegation-only | forward | hint | redirect |<br>
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
@@ -976,6 +978,7 @@ zone
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+	mirror <em class="replaceable"><code>boolean</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 	notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 	notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -988,7 +991,8 @@ zone
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
-	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -999,9 +1003,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( primary | master | secondary | slave | mirror |<br>
-	    delegation-only | forward | hint | redirect | static-stub |<br>
-	    stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
@@ -1,56 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
-->
-
-<!-- Generated by doc/misc/docbook-zoneopt.pl -->
-<programlisting>
-<command>zone</command> <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
-	<command>type</command> mirror;
-	<command>allow-notify</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-query</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-query-on</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-transfer</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-update-forwarding</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>also-notify</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };
-	<command>alt-transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>alt-transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>check-names</command> ( fail | warn | ignore );
-	<command>database</command> <replaceable>string</replaceable>;
-	<command>file</command> <replaceable>quoted_string</replaceable>;
-	<command>ixfr-from-differences</command> <replaceable>boolean</replaceable>;
-	<command>journal</command> <replaceable>quoted_string</replaceable>;
-	<command>masterfile-format</command> ( map | raw | text );
-	<command>masterfile-style</command> ( full | relative );
-	<command>masters</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };
-	<command>max-journal-size</command> ( default | unlimited | <replaceable>sizeval</replaceable> );
-	<command>max-records</command> <replaceable>integer</replaceable>;
-	<command>max-refresh-time</command> <replaceable>integer</replaceable>;
-	<command>max-retry-time</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-idle-in</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-idle-out</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-time-in</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;
-	<command>min-refresh-time</command> <replaceable>integer</replaceable>;
-	<command>min-retry-time</command> <replaceable>integer</replaceable>;
-	<command>multi-master</command> <replaceable>boolean</replaceable>;
-	<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );
-	<command>notify-delay</command> <replaceable>integer</replaceable>;
-	<command>notify-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>notify-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>request-expire</command> <replaceable>boolean</replaceable>;
-	<command>request-ixfr</command> <replaceable>boolean</replaceable>;
-	<command>transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
-	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
-	<command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;
-	<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
-};
-</programlisting>
@@ -496,16 +496,6 @@
 	  <command>allow-query-cache</command> work. [GL #319]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  When compiled with IDN support, the <command>dig</command> and the
-	  <command>nslookup</command> commands now disable IDN processing when
-	  the standard output is not a tty (e.g. not used by human).  The command
-	  line options +idnin and +idnout need to be used to enable IDN
-	  processing when <command>dig</command> or <command>nslookup</command>
-	  is used from the shell scripts.
-	</para>
-      </listitem>
    </itemizedlist>
  </section>

@@ -547,13 +537,6 @@
 	  added. This has been fixed. [GL #105]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  The view name is now included in the output of
-	  <command>rndc nta -dump</command>, for consistency with
-	  other options. [GL !816]
-	</para>
-      </listitem>
      <listitem>
 	<para>
 	  <command>named</command> now rejects excessively large
@@ -180,6 +180,7 @@
 	<command>min-retry-time</command> <replaceable>integer</replaceable>;
 	<command>minimal-any</command> <replaceable>boolean</replaceable>;
 	<command>minimal-responses</command> ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	<command>mirror</command> <replaceable>boolean</replaceable>;
 	<command>multi-master</command> <replaceable>boolean</replaceable>;
 	<command>new-zones-directory</command> <replaceable>quoted_string</replaceable>;
 	<command>no-case-compress</command> { <replaceable>address_match_element</replaceable>; ... };
@@ -50,6 +50,7 @@
 	<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;
 	<command>min-refresh-time</command> <replaceable>integer</replaceable>;
 	<command>min-retry-time</command> <replaceable>integer</replaceable>;
+	<command>mirror</command> <replaceable>boolean</replaceable>;
 	<command>multi-master</command> <replaceable>boolean</replaceable>;
 	<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );
 	<command>notify-delay</command> <replaceable>integer</replaceable>;
@@ -18,7 +18,7 @@
 	<command>forward</command> ( first | only );
 	<command>forwarders</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
 	<command>max-records</command> <replaceable>integer</replaceable>;
-	<command>server-addresses</command> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+	<command>server-addresses</command> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ]; ... };
 	<command>server-names</command> { <replaceable>string</replaceable>; ... };
 	<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
 };
@@ -111,7 +111,6 @@ Types:
 		dns_zone_none = 0,
 		dns_zone_master,
 		dns_zone_slave,
-		dns_zone_mirror,
 		dns_zone_stub,
 		dns_zone_hint,
 		dns_zone_cache,
@@ -35,7 +35,6 @@ options: FORCE
 		${CFG_TEST} --named --grammar > $@.raw ; \
 		${CFG_TEST} --zonegrammar master > master.zoneopt ; \
 		${CFG_TEST} --zonegrammar slave > slave.zoneopt ; \
-		${CFG_TEST} --zonegrammar mirror > mirror.zoneopt ; \
 		${CFG_TEST} --zonegrammar forward > forward.zoneopt ; \
 		${CFG_TEST} --zonegrammar hint > hint.zoneopt ; \
 		${CFG_TEST} --zonegrammar stub > stub.zoneopt ; \
@@ -55,7 +54,6 @@ docbook: options
 	${PERL} docbook-options.pl options > ${top_srcdir}/bin/named/named.conf.docbook
 	${PERL} docbook-zoneopt.pl master.zoneopt > ${top_srcdir}/doc/arm/master.zoneopt.xml
 	${PERL} docbook-zoneopt.pl slave.zoneopt > ${top_srcdir}/doc/arm/slave.zoneopt.xml
-	${PERL} docbook-zoneopt.pl mirror.zoneopt > ${top_srcdir}/doc/arm/mirror.zoneopt.xml
 	${PERL} docbook-zoneopt.pl forward.zoneopt > ${top_srcdir}/doc/arm/forward.zoneopt.xml
 	${PERL} docbook-zoneopt.pl hint.zoneopt > ${top_srcdir}/doc/arm/hint.zoneopt.xml
 	${PERL} docbook-zoneopt.pl stub.zoneopt > ${top_srcdir}/doc/arm/stub.zoneopt.xml
@@ -1,42 +0,0 @@
-zone <string> [ <class> ] {
-	type mirror;
-	allow-notify { <address_match_element>; ... };
-	allow-query { <address_match_element>; ... };
-	allow-query-on { <address_match_element>; ... };
-	allow-transfer { <address_match_element>; ... };
-	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
-	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	check-names ( fail | warn | ignore );
-	database <string>;
-	file <quoted_string>;
-	ixfr-from-differences <boolean>;
-	journal <quoted_string>;
-	masterfile-format ( map | raw | text );
-	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
-	max-journal-size ( default | unlimited | <sizeval> );
-	max-records <integer>;
-	max-refresh-time <integer>;
-	max-retry-time <integer>;
-	max-transfer-idle-in <integer>;
-	max-transfer-idle-out <integer>;
-	max-transfer-time-in <integer>;
-	max-transfer-time-out <integer>;
-	min-refresh-time <integer>;
-	min-retry-time <integer>;
-	multi-master <boolean>;
-	notify ( explicit | master-only | <boolean> );
-	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	request-expire <boolean>;
-	request-ixfr <boolean>;
-	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	try-tcp-refresh <boolean>;
-	use-alt-transfer-source <boolean>;
-	zero-no-soa-ttl <boolean>;
-	zone-statistics ( full | terse | none | <boolean> );
-};
@@ -239,6 +239,7 @@ options {
        min-roots <integer>; // not implemented
        minimal-any <boolean>;
        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+        mirror <boolean>;
        multi-master <boolean>;
        multiple-cnames <boolean>; // obsolete
        named-xfer <quoted_string>; // obsolete
@@ -579,6 +580,7 @@ view <string> [ <class> ] {
        min-roots <integer>; // not implemented
        minimal-any <boolean>;
        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+        mirror <boolean>;
        multi-master <boolean>;
        new-zones-directory <quoted_string>;
        no-case-compress { <address_match_element>; ... };
@@ -784,6 +786,7 @@ view <string> [ <class> ] {
                max-zone-ttl ( unlimited | <ttlval> );
                min-refresh-time <integer>;
                min-retry-time <integer>;
+                mirror <boolean>;
                multi-master <boolean>;
                notify ( explicit | master-only | <boolean> );
                notify-delay <integer>;
@@ -800,7 +803,8 @@ view <string> [ <class> ] {
                request-expire <boolean>;
                request-ixfr <boolean>;
                serial-update-method ( date | increment | unixtime );
-                server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+                server-addresses { ( <ipv4_address> | <ipv6_address> ) [
+                    port <integer> ]; ... };
                server-names { <string>; ... };
                sig-signing-nodes <integer>;
                sig-signing-signatures <integer>;
@@ -811,7 +815,7 @@ view <string> [ <class> ] {
                transfer-source-v6 ( <ipv6_address> | * ) [ port (
                    <integer> | * ) ] [ dscp <integer> ];
                try-tcp-refresh <boolean>;
-                type ( primary | master | secondary | slave | mirror |
+                type ( primary | master | secondary | slave |
                    delegation-only | forward | hint | redirect |
                    static-stub | stub );
                update-check-ksk <boolean>;
@@ -889,6 +893,7 @@ zone <string> [ <class> ] {
        max-zone-ttl ( unlimited | <ttlval> );
        min-refresh-time <integer>;
        min-retry-time <integer>;
+        mirror <boolean>;
        multi-master <boolean>;
        notify ( explicit | master-only | <boolean> );
        notify-delay <integer>;
@@ -903,7 +908,8 @@ zone <string> [ <class> ] {
        request-expire <boolean>;
        request-ixfr <boolean>;
        serial-update-method ( date | increment | unixtime );
-        server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+        server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port
+            <integer> ]; ... };
        server-names { <string>; ... };
        sig-signing-nodes <integer>;
        sig-signing-signatures <integer>;
@@ -914,9 +920,8 @@ zone <string> [ <class> ] {
        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
            ] [ dscp <integer> ];
        try-tcp-refresh <boolean>;
-        type ( primary | master | secondary | slave | mirror |
-            delegation-only | forward | hint | redirect | static-stub |
-            stub );
+        type ( primary | master | secondary | slave | delegation-only |
+            forward | hint | redirect | static-stub | stub );
        update-check-ksk <boolean>;
        update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
            external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
@@ -37,6 +37,7 @@ zone <string> [ <class> ] {
 	max-transfer-time-out <integer>;
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
+	mirror <boolean>;
 	multi-master <boolean>;
 	notify ( explicit | master-only | <boolean> );
 	notify-delay <integer>;
@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	forward ( first | only );
 	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
 	max-records <integer>;
-	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+	server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
 	server-names { <string>; ... };
 	zone-statistics ( full | terse | none | <boolean> );
 };
@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/log.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -31,6 +30,8 @@
 #include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/symtab.h>
@@ -1914,114 +1915,6 @@ check_nonzero(const cfg_obj_t *options, isc_log_t *logctx) {
 	return (result);
 }

-/*%
- * Check whether NOTIFY configuration at the zone level is acceptable for a
- * mirror zone.  Return true if it is; return false otherwise.
- */
-static bool
-check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr,
-			 isc_log_t *logctx)
-{
-	bool notify_configuration_ok = true;
-	const cfg_obj_t *obj = NULL;
-
-	(void)cfg_map_get(zoptions, "notify", &obj);
-	if (obj == NULL) {
-		/*
-		 * "notify" not set at zone level.  This is fine.
-		 */
-		return (true);
-	}
-
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			/*
-			 * "notify yes;" set at zone level.  This is an error.
-			 */
-			notify_configuration_ok = false;
-		}
-	} else {
-		const char *notifystr = cfg_obj_asstring(obj);
-		if (strcasecmp(notifystr, "explicit") != 0) {
-			/*
-			 * Something else than "notify explicit;" set at zone
-			 * level.  This is an error.
-			 */
-			notify_configuration_ok = false;
-		}
-	}
-
-	if (!notify_configuration_ok) {
-		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
-			    "zone '%s': mirror zones can only be used with "
-			    "'notify no;' or 'notify explicit;'", znamestr);
-	}
-
-	return (notify_configuration_ok);
-}
-
-/*%
- * Try to determine whether recursion is available in a view without resorting
- * to extraordinary measures: just check the "recursion" and "allow-recursion"
- * settings.  The point is to prevent accidental mirror zone misuse rather than
- * to enforce some sort of policy.  Recursion is assumed to be allowed by
- * default if it is not explicitly disabled.
- */
-static bool
-check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
-		const cfg_obj_t *goptions, isc_log_t *logctx,
-		cfg_aclconfctx_t *actx, isc_mem_t *mctx)
-{
-	dns_acl_t *acl = NULL;
-	const cfg_obj_t *obj;
-	isc_result_t result;
-	bool retval = true;
-
-	/*
-	 * Check the "recursion" option first.
-	 */
-	obj = NULL;
-	result = ISC_R_NOTFOUND;
-	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "recursion", &obj);
-	}
-	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "recursion", &obj);
-	}
-	if (result == ISC_R_SUCCESS && !cfg_obj_asboolean(obj)) {
-		retval = false;
-		goto cleanup;
-	}
-
-	/*
-	 * If recursion is not disabled by the "recursion" option, check
-	 * whether it is disabled by the "allow-recursion" ACL.
-	 */
-	obj = NULL;
-	result = ISC_R_NOTFOUND;
-	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "allow-recursion", &obj);
-	}
-	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "allow-recursion", &obj);
-	}
-	if (result == ISC_R_SUCCESS) {
-		result = cfg_acl_fromconfig(obj, config, logctx, actx, mctx, 0,
-					    &acl);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		retval = !dns_acl_isnone(acl);
-	}
-
- cleanup:
-	if (acl != NULL) {
-		dns_acl_detach(&acl);
-	}
-
-	return (retval);
-}
-
 static isc_result_t
 check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	       const cfg_obj_t *config, isc_symtab_t *symtab,
@@ -2096,8 +1989,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			   strcasecmp(typestr, "secondary") == 0)
 		{
 			ztype = CFG_ZONE_SLAVE;
-		} else if (strcasecmp(typestr, "mirror") == 0) {
-			ztype = CFG_ZONE_MIRROR;
 		} else if (strcasecmp(typestr, "stub") == 0) {
 			ztype = CFG_ZONE_STUB;
 		} else if (strcasecmp(typestr, "static-stub") == 0) {
@@ -2209,7 +2100,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,

 		case CFG_ZONE_MASTER:
 		case CFG_ZONE_SLAVE:
-		case CFG_ZONE_MIRROR:
 		case CFG_ZONE_HINT:
 		case CFG_ZONE_STUB:
 		case CFG_ZONE_STATICSTUB:
@@ -2294,22 +2184,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}

 	/*
-	 * Only a limited subset of all possible "notify" settings can be used
-	 * at the zone level for mirror zones.
-	 */
-	if (ztype == CFG_ZONE_MIRROR &&
-	    !check_mirror_zone_notify(zoptions, znamestr, logctx))
-	{
-		result = ISC_R_FAILURE;
-	}
-
-	/*
-	 * Master, slave, and mirror zones may have an "also-notify" field, but
+	 * Master & slave zones may have an "also-notify" field, but
 	 * shouldn't if notify is disabled.
 	 */
-	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE ||
-	    ztype == CFG_ZONE_MIRROR)
-	{
+	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE) {
 		bool donotify = true;

 		obj = NULL;
@@ -2350,13 +2228,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}

 	/*
-	 * Slave, mirror, and stub zones must have a "masters" field, with one
-	 * exception: when mirroring the root zone, a default, built-in master
-	 * server list is used in the absence of one explicitly specified.
+	 * Slave & stub zones must have a "masters" field.
 	 */
-	if (ztype == CFG_ZONE_SLAVE || ztype == CFG_ZONE_STUB ||
-	    (ztype == CFG_ZONE_MIRROR && !dns_name_equal(zname, dns_rootname)))
-	{
+	if (ztype == CFG_ZONE_SLAVE || ztype == CFG_ZONE_STUB) {
 		obj = NULL;
 		if (cfg_map_get(zoptions, "masters", &obj) != ISC_R_SUCCESS) {
 			cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
@@ -2378,19 +2252,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 	}

-	/*
-	 * Configuring a mirror zone and disabling recursion at the same time
-	 * contradicts the purpose of the former.
-	 */
-	if (ztype == CFG_ZONE_MIRROR &&
-	    !check_recursion(config, voptions, goptions, logctx, actx, mctx))
-	{
-		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
-			    "zone '%s': mirror zones cannot be used if "
-			    "recursion is disabled", znamestr);
-		result = ISC_R_FAILURE;
-	}
-
 	/*
 	 * Master zones can't have both "allow-update" and "update-policy".
 	 */
@@ -2600,6 +2461,13 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			obj = cfg_listelt_value(element);
 			sa = *cfg_obj_assockaddr(obj);

+			if (isc_sockaddr_getport(&sa) != 0) {
+				result = ISC_R_FAILURE;
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "port is not configurable for "
+					    "static stub server-addresses");
+			}
+
 			isc_netaddr_fromsockaddr(&na, &sa);
 			if (isc_netaddr_getzone(&na) != 0) {
 				result = ISC_R_FAILURE;
@@ -2760,9 +2628,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			    znamestr);
 			result = tresult;
 		} else if (tresult == ISC_R_SUCCESS &&
-			   (ztype == CFG_ZONE_SLAVE ||
-			    ztype == CFG_ZONE_MIRROR || ddns))
-		{
+			   (ztype == CFG_ZONE_SLAVE || ddns)) {
 			tresult = fileexist(fileobj, files, true, logctx);
 			if (tresult != ISC_R_SUCCESS)
 				result = tresult;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Witold Kręcicki	24eddb7679	win32/socket should use common isc_socket	2018-10-24 10:52:56 +00:00
Witold Kręcicki	3d280f238e	Move socket type to common isc_socket structure; add isc_sockettype_tls	2018-10-24 10:52:56 +00:00
Witold Kręcicki	43e566937e	Windows fixes	2018-10-24 10:52:37 +00:00
Witold Kręcicki	d55304ea29	Fix fetchlimit test to allow softquota to be overruled; Remove 'verifying that named checks for conflicting listeners' test from runtime	2018-10-24 07:10:20 +00:00
Witold Kręcicki	dceabb547b	Cookies with non-crypto-secure random	2018-10-24 07:10:20 +00:00
Witold Kręcicki	258d8912d4	Use multiple worker queues in unix/socket.c	2018-10-24 07:10:20 +00:00
Witold Kręcicki	9b191a9a6b	use REUSEPORT only for NOLISTEN dispatchers	2018-10-24 07:10:20 +00:00
Witold Kręcicki	1e152250c1	Fixes	2018-10-24 07:10:20 +00:00
Witold Kręcicki	243da5c407	Fix for TCP	2018-10-24 07:10:20 +00:00
Witold Kręcicki	732c7eaf1f	Use isc_refcount_t in socket	2018-10-24 07:10:20 +00:00
Witold Krecicki	edb6f5c2a8	Fixes for Solaris	2018-10-24 07:10:20 +00:00
Witold Kręcicki	ba46797f42	Mangle fdlocks a bit	2018-10-24 07:10:20 +00:00
Witold Kręcicki	6d46fbb550	Fix a race in socket code	2018-10-24 07:10:20 +00:00
Witold Kręcicki	1c06e32a93	Set network threads affintiy	2018-10-24 07:10:20 +00:00
Witold Kręcicki	7b5abac4e9	Add runtime detection of SO_REUSEPORT, use it if available (instead of dup)	2018-10-24 07:10:20 +00:00
Witold Kręcicki	30c6d4befd	More udp dispatchers	2018-10-24 07:10:20 +00:00
Witold Kręcicki	48ea0a317c	Set quantum to 50	2018-10-24 07:10:20 +00:00
Witold Krecicki	bc4a4f7186	Multiple network threads with separate data structures (WiP)	2018-10-24 07:10:20 +00:00
Witold Kręcicki	5841bd1783	Do IO after event directly in the network thread, don't schedule it for worker	2018-10-24 07:10:20 +00:00
Witold Kręcicki	4b55fd0d8a	Remove fdwatch sockets	2018-10-24 07:10:20 +00:00
Witold Kręcicki	32ca49c437	Comment about taskmgr exclusive mode, fix a REQUIRE.	2018-10-24 07:06:57 +00:00
Witold Kręcicki	c85a6a533f	Allow slight over-quota in'checking lame server clients are dropped at the soft limit' test	2018-10-24 07:06:57 +00:00
Witold Kręcicki	d61bb36061	Saner exclusive task handling in taskmgr	2018-10-24 07:06:57 +00:00
Witold Kręcicki	56d48aa8a2	Formatting	2018-10-24 07:06:57 +00:00
Witold Kręcicki	32b9631d1a	Get rid of isc_taskmgr_setmode, we only use it to set privileged mode	2018-10-24 07:06:57 +00:00
Witold Kręcicki	0e1e295ddb	Make sure all priority tasks are done before entering normal execution	2018-10-24 07:06:57 +00:00
Witold Kręcicki	8fffa3760d	Post shutting down tasks always to manager 0	2018-10-24 07:06:57 +00:00
Witold Kręcicki	49eab869ba	Separate structure for each thread/queue; 2-phase-locking for exclusive tasks	2018-10-24 07:06:57 +00:00
Witold Kręcicki	18b5f9dd92	Always restart dispatchers on empty readyq	2018-10-24 07:06:57 +00:00
Witold Kręcicki	cfb23c73f7	Taskmgr shutdown fixes	2018-10-24 07:06:57 +00:00
Witold Kręcicki	87e4e442d7	Multiple worker queues	2018-10-24 07:06:57 +00:00
Witold Krecicki	8447d2e80e	isc_thread_setaffinity()	2018-10-24 07:06:57 +00:00
				`@@ -0,0 +1 @@`
				`child.example. IN KEY 256 3 3 ALeiYGFXbil6PgHnkm5ZE67ygEVDvGT/gqZmLH7tGboofcPSfyhh1hpw dxZgJ26d/gynWMGVSYzaXfzsxpPoNeYn+qeevQoJOaxXXlfcy8Ik52Rm eW0J9mWlf9hsD7ShIhh1+0kRYGCOCaU25wIe3SLVkN3HgqiCBDYnBY0u nMkqRadiUnoEa3Tcvc9kJx9r9gDstR2A9A5sBhFLI/XQ0gViHHLVpQ4x hz+rTLb/xrBoAb5sQJT3xUjhhdNo9HuL6kwdLdSu//PCl1QnY9NpYPVV SKUo`