Initial release checklist

configure could loop if --with-pic was specified

See merge request isc-projects/bind9!731

.gitlab-ci.yml

@@ -4,6 +4,7 @@ variables:
   DOCKER_DRIVER: overlay2
   CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
   CCACHE_DIR: "/ccache"
+  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
 stages:
   - precheck
@@ -114,20 +115,25 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
 #    - ./autogen.sh
   script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr $EXTRA_CONFIGURE
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
     - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
   artifacts:
     expire_in: '1 hour'
     untracked: true
 
+.install_test: &install_test_job
+  stage: test
+  before_script:
+    - mkdir $HOME/.local
+  script:
+    - make install
+
 .system_test: &system_test_job
   stage: test
   before_script:
     - rm -rf .ccache
     - bash -x bin/tests/system/ifconfig.sh up
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - bash -x util/prepare-softhsm2.sh
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -140,9 +146,7 @@ stages:
   stage: test
   before_script:
     - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - bash -x util/prepare-softhsm2.sh
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - make unit
   after_script:
@@ -165,6 +169,8 @@ precheck:debian:sid:amd64:
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
     - rm util/newcopyrights
+    - perl -w util/update_copyrights < util/copyrights
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
     - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
     - xmllint --noout --nonet --html `git ls-files '*.html'`
   artifacts:
@@ -214,12 +220,11 @@ build:centos:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *build_job
 
-build:clang:debian:sid:amd64:
+build:clang:debian:stretch:amd64:
   variables:
-    CC: clang-6.0
+    CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_stretch_amd64_image
-  <<: *debian_sid_amd64_image
   <<: *build_job
 
 build:debian:jessie:amd64:
@@ -244,12 +249,11 @@ build:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *build_job
 
-build:clang:debian:sid:i386:
+build:clang:debian:stretch:i386:
   variables:
-    CC: clang-6.0
+    CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_stretch_i386_image
-  <<: *debian_sid_i386_image
   <<: *build_job
 
 build:debian:sid:i386:
@@ -290,11 +294,11 @@ unittest:debian:sid:amd64:
   dependencies:
     - build:debian:sid:amd64
 
-unittest:clang:debian:sid:amd64:
+unittest:clang:debian:stretch:amd64:
-  <<: *debian_sid_amd64_image
+  <<: *debian_stretch_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:clang:debian:sid:amd64
+    - build:clang:debian:stretch:amd64
 
 unittest:debian:sid:i386:
   <<: *debian_sid_i386_image
@@ -338,6 +342,12 @@ systemtest:debian:sid:i386:
   dependencies:
     - build:debian:sid:i386
 
+install:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *install_test_job
+  dependencies:
+    - build:debian:sid:amd64
+
 pkcs11:build:debian:sid:amd64:
   variables:
     CC: gcc

.gitlab/issue_templates/.gitlab/issue_templates/release

@@ -0,0 +1,29 @@
+##Release Checklist
+
+ - [ ] Check for the presence of a milestone for the release
+    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist)
+ - [ ] Prepare the sources for tarball generation
+ - [ ] Change software version and library versions in configure.in
+ - [ ] Update CHANGES
+ - [ ] Ensure the release notes are correct for this release
+ - [ ] Ensure the metainformation is correct for this release
+ - [ ] Make sure the tests are passing
+ - [ ] Create a tag (name vX_Y_Z[-alphatag], content BIND X.Y.Z[-alphatag], signed with a developer's GPG key): git tag -u <DEVELOPER_KEYID> -a -s -m "BIND X.Y.Z" vX.Y.Z
+ - [ ] Push the changes and tag
+ - [ ] Create the tarball
+ - [ ] Create the Windows zips
+ - [ ] Ask QA to sanity check the tarball and zips
+ - [ ] Request the signature on the tarballs
+ - [ ] Make tarballs and signatures available to download
+ - [ ] Edit the release https://gitlab.isc.org/isc-projects/bind9/tags and the NEWS snippet + links to the tarballs
+ - [ ] Update DEB and RPM packages
+
+##Communication
+
+ - [ ] Inform support to upload to the web site (nice to give them a heads-up in advance)
+       Write release e-mail to bind9-announce, bind-users in case of a major release 
+ - [ ] Inform marketing to announce the release
+        Post short note to Twitter 
+        Update http://en.wikipedia.org/wiki/BIND (mktg)
+        Blog post if a major release
+

CHANGES

@@ -1,3 +1,66 @@
+5027.	[func]		Set SO_SNDBUF size on sockets. [GL #74]
+
+5026.	[bug]		rndc reconfig should not touch already loaded zones.
+			[GL #276]
+
+5025.	[cleanup]	Remove isc_keyboard family of functions. [GL #178]
+
+5024.	[func]		Replace custom assembly for atomic operations with
+			atomic support from the compiler. The code will now use
+			C11 stdatomic, or __atomic, or __sync builtins with GCC
+			or Clang compilers, and Interlocked functions with MSVC.
+			[GL #10]
+
+5023.	[cleanup]	Remove wrappers that try to fix broken or incomplete
+			implementations of IPv6, pthreads and other core
+			functionality required and used by BIND. [GL #192]
+
+5022.	[doc]		Update ms-self, ms-subdomain, krb5-self, and
+			krb5-subdomain documentation. [GL !708]
+
+5021.	[bug]		dig returned a non-zero exit code when it received a
+			reply over TCP after a retry. [GL #487]
+
+5020.	[func]		RNG uses thread-local storage instead of locks, if
+			supported by platform. [GL #496]
+
+5019.	[cleanup]	A message is now logged when ixfr-from-differences is
+			set at zone level for an inline-signed zone. [GL #470]
+
+5018.	[bug]		Fix incorrect sizeof arguments in lib/isc/pk11.c.
+			[GL !588]
+
+5017.	[bug]		lib/isc/pk11.c failed to unlink the session before
+			releasing the lock which is unsafe. [GL !589]
+
+5016.	[bug]		Named could assert with overlapping filter-aaaa and
+			dns64 acls. [GL #445]
+
+5015.	[bug]		Reloading all zones caused zone maintenance to cease
+			for inline-signed zones. [GL #435]
+
+5014.	[bug]		Signatures loaded from the journal for the signed
+			version of an inline-signed zone were not scheduled for
+			refresh. [GL #482]
+
+5013.	[bug]		A referral response with a non-empty ANSWER section was
+			inadvertently being treated as an error. [GL #390]
+
+5012.	[bug]		Fix lock order reversal in pk11_initialize. [GL !590]
+
+5011.	[func]		Remove support for unthreaded named. [GL #478]
+
+5010.	[func]		New "validate-except" option specifies a list of
+			domains beneath which DNSSEC validation should not
+			be performed. [GL #237]
+
+5009.	[bug]		Upon an OpenSSL failure, the first error in the OpenSSL
+			error queue was not logged. [GL #476]
+
+5008.	[bug]		"rndc signing -nsec3param ..." requests were silently
+			ignored for zones which were not yet loaded or
+			transferred. [GL #468]
+
 5007.	[cleanup]	Replace custom ISC boolean and integer data types
 			with C99 stdint.h and stdbool.h types. [GL #9]
 

Makefile.in

@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@
 
 VERSION=@BIND9_VERSION@
 
-SUBDIRS =	make unit lib bin doc
+SUBDIRS =	make unit lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h
 
@@ -90,6 +90,7 @@ force-test: test-force
 
 test-force:
 	status=0; \
+	(cd fuzz && ${MAKE} check) || status=1; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f ${top_builddir}/unit/unittest.sh && \
 		$(SHELL) ${top_builddir}/unit/unittest.sh) || status=1; \

README

@@ -114,6 +114,9 @@ of changes from BIND 9.12 and earlier releases. New features include:
     subject to DNSSEC validation and are not treated as authoritative data
     when answering. This makes it easier to configure a local copy of the
     root zone as described in RFC 7706.
+  * QNAME minimization is now supported
+  * The "validate-except" option allows configuration of domains below
+    which DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which

README.md

@@ -131,6 +131,9 @@ include:
   DNSSEC validation and are not treated as authoritative data when
   answering. This makes it easier to configure a local copy of the root
   zone as described in RFC 7706.
+* QNAME minimization is now supported
+* The "validate-except" option allows configuration of domains below which
+  DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
@@ -144,7 +147,7 @@ Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have been
 observed on many versions of Linux and UNIX, including RedHat, Fedora,
 Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
-Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
+Solaris, HP-UX, and OpenWRT.
 
 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires
@@ -268,10 +271,6 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
 configure command line.  By default, fixed rrset-order is disabled to
 reduce memory footprint.
 
-If your operating system has integrated support for IPv6, it will be used
-automatically.  If you have installed KAME IPv6 separately, use
-`--with-kame[=PATH]` to specify its location.
-
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
 `--prefix` option when running `configure`.

acconfig.h

@@ -17,9 +17,6 @@
  ***/
 @TOP@
 
-/** define on DEC OSF to enable 4.4BSD style sa_len support */
-#undef _SOCKADDR_LEN
-
 /** define if your system needs pthread_init() before using pthreads */
 #undef NEED_PTHREAD_INIT
 
@@ -29,9 +26,6 @@
 /** define if sigwait() is the UnixWare flavor */
 #undef HAVE_UNIXWARE_SIGWAIT
 
-/** define on Solaris to get sigwait() to work using pthreads semantics */
-#undef _POSIX_PTHREAD_SEMANTICS
-
 /** define if LinuxThreads is in use */
 #undef HAVE_LINUXTHREADS
 
@@ -53,62 +47,18 @@
 /** define if tzset() is available */
 #undef HAVE_TZSET
 
-/** define if struct addrinfo exists */
-#undef HAVE_ADDRINFO
-
-/** define if getaddrinfo() exists */
-#undef HAVE_GETADDRINFO
-
-/** define if gai_strerror() exists */
-#undef HAVE_GAISTRERROR
-
 /**
  * define if pthread_setconcurrency() should be called to tell the
  * OS how many threads we might want to run.
  */
 #undef CALL_PTHREAD_SETCONCURRENCY
 
-/** define if IPv6 is not disabled */
-#undef WANT_IPV6
-
 /** define if flockfile() is available */
 #undef HAVE_FLOCKFILE
 
 /** define if getc_unlocked() is available */
 #undef HAVE_GETCUNLOCKED
 
-/** Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */
-#undef SHUTUP_SPUTAUX
-#ifdef SHUTUP_SPUTAUX
-struct __sFILE;
-extern __inline int __sputaux(int _c, struct __sFILE *_p);
-#endif
-
-/** Shut up warnings about missing sigwait prototype on BSD/OS 4.0* */
-#undef SHUTUP_SIGWAIT
-#ifdef SHUTUP_SIGWAIT
-int sigwait(const unsigned int *set, int *sig);
-#endif
-
-/** Shut up warnings from gcc -Wcast-qual on BSD/OS 4.1. */
-#undef SHUTUP_STDARG_CAST
-#if defined(SHUTUP_STDARG_CAST) && defined(__GNUC__)
-#include <stdarg.h>		/** Grr.  Must be included *every time*. */
-/**
- * The silly continuation line is to keep configure from
- * commenting out the #undef.
- */
-
-#undef \
-	va_start
-#define	va_start(ap, last) \
-	do { \
-		union { const void *konst; long *var; } _u; \
-		_u.konst = &(last); \
-		ap = (va_list)(_u.var + __va_words(__typeof(last))); \
-	} while (0)
-#endif /** SHUTUP_STDARG_CAST && __GNUC__ */
-
 /** define if the system has a random number generating device */
 #undef PATH_RANDOMDEV
 

aclocal.m4

@@ -289,6 +289,7 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])

bin/check/check-tool.c

@@ -62,14 +62,6 @@
 #define CHECK_LOCAL 1
 #endif
 
-#ifdef HAVE_ADDRINFO
-#ifdef HAVE_GETADDRINFO
-#ifdef HAVE_GAISTRERROR
-#define USE_GETADDRINFO
-#endif
-#endif
-#endif
-
 #define CHECK(r) \
 	do { \
 		result = (r); \
@@ -177,7 +169,6 @@ static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
-#ifdef USE_GETADDRINFO
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct addrinfo hints, *ai, *cur;
@@ -373,14 +364,10 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	freeaddrinfo(ai);
 	return (answer);
-#else
-	return (true);
-#endif
 }
 
 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -459,14 +446,10 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
-#else
-	return (true);
-#endif
 }
 
 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -544,9 +527,6 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
-#else
-	return (true);
-#endif
 }
 
 isc_result_t
@@ -711,7 +691,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	if (dochecksrv)
 		dns_zone_setchecksrv(zone, checksrv);
 
-	CHECK(dns_zone_load(zone));
+	CHECK(dns_zone_load(zone, false));
 
 	/*
 	 * When loading map files we can't catch oversize TTLs during
@@ -791,4 +771,3 @@ DestroySockets(void) {
 	WSACleanup();
 }
 #endif
-

bin/check/win32/checkconf.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
   </ItemDefinitionGroup>

bin/check/win32/checkzone.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -105,7 +105,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <PostBuildEvent>

bin/confgen/ddns-confgen.c

@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>

bin/confgen/keygen.c

@@ -20,7 +20,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/result.h>
@@ -192,4 +191,3 @@ write_key_file(const char *keyfile, const char *user,
 		fatal("fclose(%s) failed\n", keyfile);
 	fprintf(stderr, "wrote key file \"%s\"\n", keyfile);
 }
-

bin/confgen/rndc-confgen.c

@@ -31,7 +31,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>

bin/confgen/win32/ddnsconfgen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -106,7 +106,7 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)

bin/confgen/win32/rndcconfgen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/delv/win32/delv.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/dig.c

@@ -263,7 +263,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
+#if !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
 #else
 		tmnow  = *localtime(&tnow);
@@ -1008,7 +1008,7 @@ plus_option(char *option, bool is_batchfile,
 						code = NULL;
 						if (value != NULL) {
 							code = strtok_r(value,
-								        ":",
+									":",
 									&last);
 						}
 						if (code == NULL) {

bin/dig/dighost.c

@@ -3202,6 +3202,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
+	exitcode = 0;
 	if (keep_open) {
 		if (keep != NULL)
 			isc_socket_detach(&keep);

bin/dig/host.c

@@ -29,7 +29,6 @@
 #include <isc/string.h>
 #include <isc/util.h>
 #include <isc/task.h>
-#include <isc/stdlib.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>

bin/dig/win32/dig.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/win32/host.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/win32/nslookup.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/dnssec-cds.c

@@ -62,7 +62,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-cds";

bin/dnssec/dnssec-dsfromkey.c

@@ -50,7 +50,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-dsfromkey";

bin/dnssec/dnssec-importkey.c

@@ -49,7 +49,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-importkey";

bin/dnssec/dnssec-signzone.c

@@ -49,7 +49,6 @@
 #include <isc/serial.h>
 #include <isc/safe.h>
 #include <isc/stdio.h>
-#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/time.h>
@@ -89,7 +88,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-signzone";

bin/dnssec/dnssec-verify.c

@@ -32,7 +32,6 @@
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
-#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>

bin/dnssec/dnssectool.c

@@ -410,7 +410,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	char filename[ISC_DIR_NAMEMAX];
+	char filename[NAME_MAX];
 	isc_buffer_t fileb;
 	isc_stdtime_t now;
 

bin/dnssec/win32/dsfromkey.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
 @IF PYTHON
     <PostBuildEvent>
@@ -113,7 +113,7 @@ set PYTHONPATH=.
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
 @IF PYTHON
     <PostBuildEvent>

bin/dnssec/win32/importkey.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/keyfromlabel.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/keygen.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/dnssec/win32/revoke.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/settime.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/dnssec/win32/signzone.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/verify.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/named/fuzz.c

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-#include "config.h"
+#include <config.h>
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -36,10 +36,6 @@
 #include <unistd.h>
 #include <pthread.h>
 
-#ifndef __AFL_LOOP
-#error To use American Fuzzy Lop you have to set CC to afl-clang-fast!!!
-#endif
-
 /*
  * We are using pthreads directly because we might be using it with
  * unthreaded version of BIND, where all thread functions are
@@ -61,7 +57,6 @@ fuzz_thread_client(void *arg) {
 	char *port;
 	struct sockaddr_in servaddr;
 	int sockfd;
-	int loop;
 	void *buf;
 
 	UNUSED(arg);
@@ -103,14 +98,18 @@ fuzz_thread_client(void *arg) {
 	 * Processing fuzzed packets 100,000 times before shutting down
 	 * the app.
 	 */
-	for (loop = 0; loop < 100000; loop++) {
+#ifdef __AFL_LOOP
+	for (int loop = 0; loop < 100000; loop++) {
+#else
+	{
+#endif
 		ssize_t length;
 		ssize_t sent;
 
 		length = read(0, buf, 65536);
 		if (length <= 0) {
 			usleep(1000000);
-			continue;
+			goto next;
 		}
 
 		/*
@@ -130,7 +129,7 @@ fuzz_thread_client(void *arg) {
 				return (NULL);
 			}
 			raise(SIGSTOP);
-			continue;
+			goto next;
 		}
 
 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);
@@ -151,6 +150,7 @@ fuzz_thread_client(void *arg) {
 			pthread_cond_wait(&cond, &mutex);
 
 		RUNTIME_CHECK(pthread_mutex_unlock(&mutex) == 0);
+	next: ;
 	}
 
 	free(buf);
@@ -586,6 +586,7 @@ fuzz_thread_resolver(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_app_shutdown();
 
+#ifdef __AFL_LOOP
 	/*
 	 * This is here just for the signature, that's how AFL detects
 	 * if it's a 'persistent mode' binary. It has to occur somewhere
@@ -594,6 +595,7 @@ fuzz_thread_resolver(void *arg) {
 	 * in persistent mode if it's present.
 	 */
 	__AFL_LOOP(0);
+#endif
 
 	return (NULL);
 }

bin/named/main.c

@@ -110,8 +110,8 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
 LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 
 static bool	want_stats = false;
-static char		program_name[ISC_DIR_NAMEMAX] = "named";
+static char		program_name[NAME_MAX] = "named";
-static char		absolute_conffile[ISC_DIR_PATHMAX];
+static char		absolute_conffile[PATH_MAX];
 static char		saved_command_line[512];
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -720,11 +720,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to zlib version: %s\n",
 			       zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 			printf("threads support is enabled\n");
-#else
-			printf("threads support is disabled\n");
-#endif
 			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
@@ -776,7 +772,6 @@ create_managers(void) {
 
 	INSIST(named_g_cpus_detected > 0);
 
-#ifdef ISC_PLATFORM_USETHREADS
 	if (named_g_cpus == 0)
 		named_g_cpus = named_g_cpus_detected;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -785,9 +780,6 @@ create_managers(void) {
 		      named_g_cpus_detected,
 		      named_g_cpus_detected == 1 ? "" : "s",
 		      named_g_cpus, named_g_cpus == 1 ? "" : "s");
-#else
-	named_g_cpus = 1;
-#endif
 #ifdef WIN32
 	named_g_udpdisp = 1;
 #else
@@ -800,12 +792,10 @@ create_managers(void) {
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
-#endif
 
 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
 				    &named_g_taskmgr);
@@ -917,12 +907,10 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */
 
-#ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
 	 */
 	named_g_cpus_detected = isc_os_ncpus();
-#endif
 
 	named_os_chroot(named_g_chrootdir);
 
@@ -1006,7 +994,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif
-#ifdef OPENSSL
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with OpenSSL version: %s",
@@ -1023,7 +1010,6 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#endif
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-05-29</date>
+    <date>2018-06-21</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -224,9 +224,9 @@ options {
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
+	    except-from { <replaceable>string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
+	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
-	    <replaceable>quoted_string</replaceable>; ... } ];
+	    } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	directory <replaceable>quoted_string</replaceable>;
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
@@ -257,14 +257,12 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    resolver ) [ ( query | response ) ]; ... };
+	    response ) ]; ... };
-	dnstap-identity ( <replaceable>quoted_string</replaceable> | none |
+	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
-	    hostname );
+	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
-	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [
+	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
-	    size ( unlimited | <replaceable>size</replaceable> ) ] [ versions (
+	    increment | timestamp ) ];
-	    unlimited | <replaceable>integer</replaceable> ) ] [ suffix ( increment
-	    | timestamp ) ];
 	dnstap-version ( <replaceable>quoted_string</replaceable> | none );
 	dscp <replaceable>integer</replaceable>;
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
@@ -362,7 +360,7 @@ options {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
+	qname-minimization ( strict | relaxed | disabled | off );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -413,7 +411,7 @@ options {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -463,6 +461,7 @@ options {
 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
 	v6-bias <replaceable>integer</replaceable>;
+	validate-except { <replaceable>string</replaceable>; ... };
 	version ( <replaceable>quoted_string</replaceable> | none );
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
@@ -574,9 +573,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
+	    except-from { <replaceable>string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
+	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
-	    <replaceable>quoted_string</replaceable>; ... } ];
+	    } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
 	    ... };
@@ -610,8 +609,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    resolver ) [ ( query | response ) ]; ... };
+	    response ) ]; ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -689,7 +688,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
+	qname-minimization ( strict | relaxed | disabled | off );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -735,7 +734,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -797,6 +796,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	update-check-ksk <replaceable>boolean</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	v6-bias <replaceable>integer</replaceable>;
+	validate-except { <replaceable>string</replaceable>; ... };
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
 	zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
@@ -878,7 +878,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		serial-update-method ( date | increment | unixtime );
 		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
 		    port <replaceable>integer</replaceable> ]; ... };
-		server-names { <replaceable>quoted_string</replaceable>; ... };
+		server-names { <replaceable>string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
 		sig-signing-type <replaceable>integer</replaceable>;
@@ -982,7 +982,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	serial-update-method ( date | increment | unixtime );
 	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
 	    <replaceable>integer</replaceable> ]; ... };
-	server-names { <replaceable>quoted_string</replaceable>; ... };
+	server-names { <replaceable>string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;

bin/named/server.c

@@ -2608,12 +2608,12 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	 * Load the zone from the master file.	If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "catz: dns_zone_loadnew() failed "
+			      "catz: dns_zone_load() failed "
 			      "with %s; reverting.",
 			      isc_result_totext(result));
 
@@ -3692,6 +3692,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
+	dns_ntatable_t *ntatable = NULL;
 	const char *qminmode = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
@@ -5348,8 +5349,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj), 0,
 					  NULL));
 		view->redirectzone = name;
-	} else
+	} else {
 		view->redirectzone = NULL;
+	}
+
+	/*
+	 * Exceptions to DNSSEC validation.
+	 */
+	obj = NULL;
+	result = named_config_get(maps, "validate-except", &obj);
+	if (result == ISC_R_SUCCESS) {
+		result = dns_view_getntatable(view, &ntatable);
+	}
+	if (result == ISC_R_SUCCESS) {
+		for (element = cfg_list_first(obj);
+		     element != NULL;
+		     element = cfg_list_next(element))
+		{
+			dns_fixedname_t fntaname;
+			dns_name_t *ntaname;
+
+			ntaname = dns_fixedname_initname(&fntaname);
+			obj = cfg_listelt_value(element);
+			CHECK(dns_name_fromstring(ntaname,
+						  cfg_obj_asstring(obj),
+						  0, NULL));
+			CHECK(dns_ntatable_add(ntatable, ntaname,
+					       true, 0, 0xffffffffU));
+		}
+	}
 
 #ifdef HAVE_DNSTAP
 	/*
@@ -5362,35 +5390,51 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = ISC_R_SUCCESS;
 
  cleanup:
-	if (clients != NULL)
+	if (ntatable != NULL) {
+		dns_ntatable_detach(&ntatable);
+	}
+	if (clients != NULL) {
 		dns_acl_detach(&clients);
-	if (mapped != NULL)
+	}
+	if (mapped != NULL) {
 		dns_acl_detach(&mapped);
-	if (excluded != NULL)
+	}
+	if (excluded != NULL) {
 		dns_acl_detach(&excluded);
-	if (ring != NULL)
+	}
+	if (ring != NULL) {
 		dns_tsigkeyring_detach(&ring);
-	if (zone != NULL)
+	}
+	if (zone != NULL) {
 		dns_zone_detach(&zone);
-	if (dispatch4 != NULL)
+	}
+	if (dispatch4 != NULL) {
 		dns_dispatch_detach(&dispatch4);
-	if (dispatch6 != NULL)
+	}
+	if (dispatch6 != NULL) {
 		dns_dispatch_detach(&dispatch6);
-	if (resstats != NULL)
+	}
+	if (resstats != NULL) {
 		isc_stats_detach(&resstats);
-	if (resquerystats != NULL)
+	}
+	if (resquerystats != NULL) {
 		dns_stats_detach(&resquerystats);
-	if (order != NULL)
+	}
+	if (order != NULL) {
 		dns_order_detach(&order);
-	if (cmctx != NULL)
+	}
+	if (cmctx != NULL) {
 		isc_mem_detach(&cmctx);
-	if (hmctx != NULL)
+	}
+	if (hmctx != NULL) {
 		isc_mem_detach(&hmctx);
-
+	}
-	if (cache != NULL)
+	if (cache != NULL) {
 		dns_cache_detach(&cache);
-	if (dctx != NULL)
+	}
+	if (dctx != NULL) {
 		dns_dyndb_destroyctx(&dctx);
+	}
 
 	return (result);
 }
@@ -5734,6 +5778,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	const cfg_obj_t *typeobj = NULL;
 	const cfg_obj_t *forwarders = NULL;
 	const cfg_obj_t *forwardtype = NULL;
+	const cfg_obj_t *ixfrfromdiffs = NULL;
 	const cfg_obj_t *only = NULL;
 	const cfg_obj_t *signing = NULL;
 	const cfg_obj_t *viewobj = NULL;
@@ -6087,6 +6132,15 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			dns_zone_setstats(raw, named_g_server->zonestats);
 			CHECK(dns_zone_link(zone, raw));
 		}
+		if (cfg_map_get(zoptions, "ixfr-from-differences",
+				&ixfrfromdiffs) == ISC_R_SUCCESS)
+		{
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "zone '%s': 'ixfr-from-differences' is "
+				      "ignored for inline-signed zones",
+				      zname);
+		}
 	}
 
 	/*
@@ -9089,7 +9143,6 @@ view_loaded(void *arg) {
 	ns_zoneload_t *zl = (ns_zoneload_t *) arg;
 	named_server_t *server = zl->server;
 	bool reconfig = zl->reconfig;
-	unsigned int refs;
 
 
 	/*
@@ -9100,35 +9153,34 @@ view_loaded(void *arg) {
 	 * We use the zoneload reference counter to let us
 	 * know when all views are finished.
 	 */
-	isc_refcount_decrement(&zl->refs, &refs);
+	if (isc_refcount_decrement(&zl->refs) == 1) {
-	if (refs != 0)
-		return (ISC_R_SUCCESS);
 
-	isc_refcount_destroy(&zl->refs);
+		isc_refcount_destroy(&zl->refs);
-	isc_mem_put(server->mctx, zl, sizeof (*zl));
+		isc_mem_put(server->mctx, zl, sizeof (*zl));
 
-	/*
+		/*
-	 * To maintain compatibility with log parsing tools that might
+		 * To maintain compatibility with log parsing tools that might
-	 * be looking for this string after "rndc reconfig", we keep it
+		 * be looking for this string after "rndc reconfig", we keep it
-	 * as it is
+		 * as it is
-	 */
+		 */
-	if (reconfig) {
+		if (reconfig) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "any newly configured zones are now loaded");
+		} else {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+				      "all zones loaded");
+		}
+
+		CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
+			   "forcing zone maintenance");
+
+		named_os_started();
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
-			      "any newly configured zones are now loaded");
-	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-			      "all zones loaded");
 	}
 
-	CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
-		   "forcing zone maintenance");
-
-	named_os_started();
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
-
 	return (ISC_R_SUCCESS);
 }
 
@@ -9137,7 +9189,6 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	isc_result_t result;
 	dns_view_t *view;
 	ns_zoneload_t *zl;
-	unsigned int refs = 0;
 
 	zl = isc_mem_get(server->mctx, sizeof (*zl));
 	if (zl == NULL)
@@ -9158,14 +9209,14 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (view->managed_keys != NULL) {
-			result = dns_zone_load(view->managed_keys);
+			result = dns_zone_load(view->managed_keys, false);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
 				goto cleanup;
 		}
 		if (view->redirect != NULL) {
-			result = dns_zone_load(view->redirect);
+			result = dns_zone_load(view->redirect, false);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
@@ -9176,13 +9227,12 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * 'dns_view_asyncload' calls view_loaded if there are no
 		 * zones.
 		 */
-		isc_refcount_increment(&zl->refs, NULL);
+		isc_refcount_increment(&zl->refs);
-		CHECK(dns_view_asyncload(view, view_loaded, zl));
+		CHECK(dns_view_asyncload(view, reconfig, view_loaded, zl));
 	}
 
  cleanup:
-	isc_refcount_decrement(&zl->refs, &refs);
+	if (isc_refcount_decrement(&zl->refs) == 1) {
-	if (refs == 0) {
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof (*zl));
 	} else if (init) {
@@ -10074,7 +10124,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
 		} else {
-			result = dns_zone_load(zone);
+			result = dns_zone_load(zone, false);
 			dns_zone_detach(&zone);
 			switch (result) {
 			case ISC_R_SUCCESS:
@@ -11208,7 +11258,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	}
 	CHECK(putstr(text, line));
 
-#ifdef ISC_PLATFORM_USETHREADS
 	snprintf(line, sizeof(line), "CPUs found: %u\n", named_g_cpus_detected);
 	CHECK(putstr(text, line));
 
@@ -11218,10 +11267,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	snprintf(line, sizeof(line), "UDP listeners per interface: %u\n",
 		 named_g_udpdisp);
 	CHECK(putstr(text, line));
-#else
-	snprintf(line, sizeof(line), "CPUs found: N/A (threads disabled)\n");
-	CHECK(putstr(text, line));
-#endif
 
 	snprintf(line, sizeof(line), "number of zones: %u (%u automatic)\n",
 		     zonecount, automatic);
@@ -12733,7 +12778,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	 * Load the zone from the master file.  If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 
@@ -12923,7 +12968,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}
 
 	/* Load the zone from the master file if it needs reloading. */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);
 
 	/*
 	 * Dynamic zones need no reloading, so we can pass this result.

bin/named/unix/os.c

@@ -23,8 +23,8 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <grp.h>
 #include <fcntl.h>
-#include <grp.h>		/* Required for initgroups() on IRIX. */
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -40,7 +40,7 @@
 #include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/result.h>
-#include <isc/strerror.h>
+#include <isc/strerr.h>
 #include <isc/string.h>
 
 #include <named/globals.h>
@@ -130,7 +130,7 @@ linux_setcaps(cap_t caps) {
 		return;
 	}
 	if (cap_set_proc(caps) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("cap_set_proc() failed: %s:"
 				      " please ensure that the capset kernel"
 				      " module is loaded.  see insmod(8)",
@@ -146,13 +146,13 @@ linux_setcaps(cap_t caps) {
 		if (err != -1 && curval) { \
 			err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				isc__strerror(errno, strbuf, sizeof(strbuf)); \
+				strerror_r(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 			\
 			err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				isc__strerror(errno, strbuf, sizeof(strbuf)); \
+				strerror_r(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 		} \
@@ -161,12 +161,12 @@ linux_setcaps(cap_t caps) {
 	do { \
 		caps = cap_init(); \
 		if (caps == NULL) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
+			strerror_r(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_init failed: %s", strbuf); \
 		} \
 		curcaps = cap_get_proc(); \
 		if (curcaps == NULL) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
+			strerror_r(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
 		} \
 	} while (0)
@@ -286,7 +286,7 @@ linux_keepcaps(void) {
 
 	if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
 		if (errno != EINVAL) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("prctl() failed: %s", strbuf);
 		}
 	} else {
@@ -331,13 +331,13 @@ named_os_daemonize(void) {
 	char strbuf[ISC_STRERRORSIZE];
 
 	if (pipe(dfd) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("pipe(): %s", strbuf);
 	}
 
 	pid = fork();
 	if (pid == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("fork(): %s", strbuf);
 	}
 	if (pid != 0) {
@@ -367,7 +367,7 @@ named_os_daemonize(void) {
 #endif
 
 	if (setsid() == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setsid(): %s", strbuf);
 	}
 
@@ -450,14 +450,14 @@ named_os_chroot(const char *root) {
 	if (root != NULL) {
 #ifdef HAVE_CHROOT
 		if (chroot(root) < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chroot(): %s", strbuf);
 		}
 #else
 		named_main_earlyfatal("chroot(): disabled");
 #endif
 		if (chdir("/") < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chdir(/): %s", strbuf);
 		}
 #ifdef HAVE_LIBSCF
@@ -484,7 +484,7 @@ named_os_inituserinfo(const char *username) {
 
 	if (getuid() == 0) {
 		if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("initgroups(): %s", strbuf);
 		}
 	}
@@ -514,12 +514,12 @@ named_os_changeuser(void) {
 #endif
 
 	if (setgid(runas_pw->pw_gid) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}
 
 	if (setuid(runas_pw->pw_uid) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
@@ -529,7 +529,7 @@ named_os_changeuser(void) {
 	 * call has disabled it.
 	 */
 	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
 					strbuf);
 	}
@@ -648,7 +648,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 
 		if (stat(filename, &sb) == -1) {
 			if (errno != ENOENT) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't stat '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -668,7 +668,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			mode |= S_IRGRP | S_IXGRP;		/* g=rx */
 			mode |= S_IROTH | S_IXOTH;		/* o=rx */
 			if (mkdir(filename, mode) == -1) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't mkdir '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -676,7 +676,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			if (runas_pw != NULL &&
 			    chown(filename, runas_pw->pw_uid,
 				  runas_pw->pw_gid) == -1) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't chown '%s': %s", filename,
 					  strbuf);
 			}
@@ -703,7 +703,7 @@ setperms(uid_t uid, gid_t gid) {
 #endif
 #if defined(HAVE_SETEGID)
 	if (getegid() != gid && setegid(gid) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"gid to %ld: %s",
 					(long)gid, strbuf);
@@ -711,7 +711,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESGID)
 	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
 		if (setresgid(-1, gid, -1) == -1) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"gid to %d: %s", gid, strbuf);
 		}
@@ -720,7 +720,7 @@ setperms(uid_t uid, gid_t gid) {
 
 #if defined(HAVE_SETEUID)
 	if (geteuid() != uid && seteuid(uid) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"uid to %ld: %s",
 					(long)uid, strbuf);
@@ -728,7 +728,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESUID)
 	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
 		if (setresuid(-1, uid, -1) == -1) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"uid to %d: %s", uid, strbuf);
 		}
@@ -747,7 +747,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	 */
 	f = strdup(filename);
 	if (f == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -799,7 +799,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	}
 
 	if (fd < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -807,7 +807,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 
 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 	}
@@ -835,7 +835,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 
 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -882,7 +882,7 @@ named_os_issingleton(const char *filename) {
 	 */
 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	} else {

bin/named/win32/named.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/named/win32/os.c

@@ -27,7 +27,6 @@
 
 #include <isc/print.h>
 #include <isc/result.h>
-#include <isc/strerror.h>
 #include <isc/string.h>
 #include <isc/ntpaths.h>
 #include <isc/util.h>
@@ -231,7 +230,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 	UNUSED(switch_user);
 	fd = safe_open(filename, mode, false);
 	if (fd < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -239,7 +238,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 
 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 		close(fd);
@@ -268,7 +267,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 
 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -312,7 +311,7 @@ named_os_issingleton(const char *filename) {
 
 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	}

bin/nsupdate/nsupdate.c

@@ -99,20 +99,6 @@
 #endif
 #endif
 
-#ifdef HAVE_ADDRINFO
-#ifdef HAVE_GETADDRINFO
-#ifdef HAVE_GAISTRERROR
-#define USE_GETADDRINFO
-#endif
-#endif
-#endif
-
-#ifndef USE_GETADDRINFO
-#ifndef ISC_PLATFORM_NONSTDHERRNO
-extern int h_errno;
-#endif
-#endif
-
 #define MAXCMD (128 * 1024)
 #define MAXWIRE (64 * 1024)
 #define PACKETSIZE ((64 * 1024) - 1)

bin/nsupdate/win32/nsupdate.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11destroy.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11keygen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11list.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11tokens.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/rndc/win32/rndc.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/optional/Makefile.in

@@ -20,6 +20,7 @@ CDEFINES =	@USE_GSSAPI@
 
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
+PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
 
 DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
@@ -51,7 +52,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
-		keyboard_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
 		lfsr_test@EXEEXT@ \
 		log_test@EXEEXT@ \
@@ -82,7 +82,6 @@ XSRCS =		adb_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
-		keyboard_test.c \
 		lex_test.c \
 		lfsr_test.c \
 		log_test.c \
@@ -106,7 +105,7 @@ XSRCS =		adb_test.c \
 
 # disable optimization for backtrace test to get the expected result
 BTTEST_CFLAGS =	${BACKTRACECFLAGS} ${EXT_CFLAGS} ${ALL_CPPFLAGS} -g \
-		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS}
+		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS} ${PTHREAD_CFLAGS}
 
 all_tests: ${XTARGETS}
 
@@ -240,10 +239,6 @@ inter_test@EXEEXT@: inter_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ inter_test.@O@ \
 		${ISCLIBS} ${LIBS}
 
-keyboard_test@EXEEXT@: keyboard_test.@O@ ${ISCDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ keyboard_test.@O@ \
-		${ISCLIBS} ${LIBS}
-
 sig0_test@EXEEXT@: sig0_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ sig0_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}

bin/tests/optional/keyboard_test.c

@@ -1,67 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <isc/keyboard.h>
-#include <isc/print.h>
-#include <isc/util.h>
-
-static void
-CHECK(const char *msg, isc_result_t result) {
-	if (result != ISC_R_SUCCESS) {
-		printf("FAILURE:  %s:  %s\n", msg, isc_result_totext(result));
-		exit(1);
-	}
-}
-
-int
-main(int argc, char **argv) {
-	isc_keyboard_t kbd;
-	unsigned char c;
-	isc_result_t res;
-	unsigned int count;
-
-	UNUSED(argc);
-	UNUSED(argv);
-
-	printf("Type Q to exit.\n");
-
-	res = isc_keyboard_open(&kbd);
-	CHECK("isc_keyboard_open()", res);
-
-	c = 'x';
-	count = 0;
-	while (res == ISC_R_SUCCESS && c != 'Q') {
-		res = isc_keyboard_getchar(&kbd, &c);
-		printf(".");
-		fflush(stdout);
-		count++;
-		if (count % 64 == 0)
-			printf("\r\n");
-	}
-	printf("\r\n");
-	if (res != ISC_R_SUCCESS) {
-		printf("FAILURE:  keyboard getchar failed:  %s\r\n",
-		       isc_result_totext(res));
-		goto errout;
-	}
-
- errout:
-	res = isc_keyboard_close(&kbd, 3);
-	CHECK("isc_keyboard_close()", res);
-
-	return (0);
-}

bin/tests/optional/rwlock_test.c

@@ -25,8 +25,6 @@
 #define sleep(x)	Sleep(1000 * x)
 #endif
 
-#ifdef ISC_PLATFORM_USETHREADS
-
 isc_rwlock_t lock;
 
 static isc_threadresult_t
@@ -130,15 +128,3 @@ main(int argc, char *argv[]) {
 
 	return (0);
 }
-
-#else
-
-int
-main(int argc, char *argv[]) {
-	UNUSED(argc);
-	UNUSED(argv);
-	fprintf(stderr, "This test requires threads.\n");
-	return(1);
-}
-
-#endif

bin/tests/optional/serial_test.c

@@ -12,11 +12,11 @@
 #include <config.h>
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <inttypes.h>
 
 #include <isc/print.h>
 #include <isc/serial.h>
-#include <isc/stdlib.h>
 
 int
 main() {

bin/tests/optional/zone_test.c

@@ -122,7 +122,7 @@ setup(const char *zonename, const char *filename, const char *classname) {
 	if (zonetype == dns_zone_slave)
 		dns_zone_setmasters(zone, &addr, 1);
 
-	result = dns_zone_load(zone);
+	result = dns_zone_load(zone, false);
 	ERRRET(result, "dns_zone_load");
 
 	result = dns_zonemgr_managezone(zonemgr, zone);

bin/tests/system/checkconf/good.conf

@@ -65,6 +65,9 @@ options {
 	max-cache-size 20000000000000;
 	nta-lifetime 604800;
 	nta-recheck 604800;
+	validate-except {
+		"corp";
+	};
 	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };

bin/tests/system/conf.sh.in

@@ -138,11 +138,7 @@ else
 	TESTSOCK6=false
 fi
 
-if grep "^#define WANT_IPV6 1" $TOP/config.h > /dev/null 2>&1 ; then
+TESTSOCK6="$TESTSOCK6"
-        TESTSOCK6="$TESTSOCK6"
-else
-        TESTSOCK6=false
-fi
 
 # Windows process management leave empty
 PSSUSPEND=

bin/tests/system/conf.sh.win32

@@ -107,7 +107,7 @@ PARALLELDIRS="allow_query catz rpzrecurse serve-stale"
 SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
 
 # missing: chain integrity
-# extra: dname ednscompliance forward 
+# extra: dname ednscompliance forward
 
 #Things that are different on Windows
 KILL="/bin/kill -f"
@@ -117,7 +117,7 @@ DOS2UNIX=dos2unix
 TP=
 
 # Configure is launched from native environment, but tests are run in Cygwin -
-# so any detection is unreliable. 
+# so any detection is unreliable.
 SHELL="/bin/bash -o igncr"
 CURL=/usr/bin/curl
 XMLLINT=/usr/bin/xmllint
@@ -135,11 +135,7 @@ else
 	TESTSOCK6=false
 fi
 
-if grep "^#define WANT_IPV6 1" $TOP/config.h > /dev/null 2>&1 ; then
+TESTSOCK6="$TESTSOCK6"
-        TESTSOCK6="$TESTSOCK6"
-else
-        TESTSOCK6=false
-fi
 
 #
 # PsSuspend is part of PSTools and can be downloaded from

bin/tests/system/dnssec/ns2/corp.db

@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 30	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				30       ; minimum (1 hour)
+				)
+			NS	ns2
+ns2			A	10.53.0.2
+
+www			A	10.0.0.1

bin/tests/system/dnssec/ns2/named.conf.in

@@ -158,4 +158,9 @@ zone "cdnskey-auto.secure" {
 	allow-update { any; };
 };
 
+zone "corp" {
+	type master;
+	file "corp.db";
+};
+
 include "trusted.conf";

bin/tests/system/dnssec/ns4/named1.conf.in

@@ -28,6 +28,8 @@ options {
 	nta-lifetime 12s;
 	nta-recheck 9s;
 
+	validate-except { corp; };
+
 	# Note: We only reference the bind.keys file here to confirm that it
 	# is *not* being used.  It contains the real root key, and we're
 	# using a local toy root zone for the tests, so it wouldn't work.
@@ -50,4 +52,9 @@ zone "." {
 	file "../../common/root.hint";
 };
 
+zone "corp" {
+	type static-stub;
+	server-addresses { 10.53.0.2; };
+};
+
 include "trusted.conf";

bin/tests/system/dnssec/tests.sh

@@ -1764,6 +1764,15 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "checking validate-except in an insecure local domain ($n)"
+ret=0
+$DIG $DIGOPTS ns www.corp @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "checking positive and negative validation with negative trust anchors ($n)"
 ret=0
 
@@ -2165,10 +2174,14 @@ fi
 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup"
 sleep 4
 
-# dump the NTA to a file
+# dump the NTA to a file (omit validate-except entries)
+echo_i "testing 'rndc nta'"
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null
+# "corp" is configured as a validate-except domain and thus should be
+# omitted. only "secure.example" should be in the dump at this point.
 lines=`wc -l < rndc.out.ns4.test$n.1`
 [ "$lines" -eq 1 ] || ret=1
+grep 'secure.example' rndc.out.ns4.test$n.1 > /dev/null || ret=1
 ts=`awk '{print $3" "$4}' < rndc.out.ns4.test$n.1`
 # rndc nta outputs localtime, so append the timezone
 ts_with_zone="$ts `date +%z`"

bin/tests/system/dnstap/ns1/named.conf.in

@@ -26,6 +26,7 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
+	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/dnstap/ns2/named.conf.in

@@ -26,6 +26,7 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
+	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/dnstap/ns3/named.conf.in

@@ -27,6 +27,7 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	minimal-responses no;
+	dnssec-validation yes;
 };
 
 server 10.53.0.1 { tcp-only yes; };

bin/tests/system/dnstap/ns4/named.conf.in

@@ -26,6 +26,7 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
+	dnssec-validation yes;
 };
 
 server 10.53.0.1 { tcp-only yes; };

bin/tests/system/dyndb/driver/db.c

@@ -72,7 +72,7 @@ attach(dns_db_t *source, dns_db_t **targetp) {
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	isc_refcount_increment(&sampledb->refs, NULL);
+	isc_refcount_increment(&sampledb->refs);
 	*targetp = source;
 }
 
@@ -87,15 +87,13 @@ free_sampledb(sampledb_t *sampledb) {
 
 static void
 detach(dns_db_t **dbp) {
+	REQUIRE(dbp != NULL && VALID_SAMPLEDB((sampledb_t *)(*dbp)));
 	sampledb_t *sampledb = (sampledb_t *)(*dbp);
-	unsigned int refs;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	isc_refcount_decrement(&sampledb->refs, &refs);
-	if (refs == 0)
-		free_sampledb(sampledb);
 	*dbp = NULL;
+
+	if (isc_refcount_decrement(&sampledb->refs) == 1) {
+		free_sampledb(sampledb);
+	}
 }
 
 /*
@@ -773,7 +771,7 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 
 	CHECK(dns_name_dupwithoffsets(origin, mctx, &sampledb->common.origin));
 
-	CHECK(isc_refcount_init(&sampledb->refs, 1));
+	isc_refcount_init(&sampledb->refs, 1);
 
 	/* Translate instance name to instance pointer. */
 	sampledb->inst = driverarg;

bin/tests/system/dyndb/driver/zone.c

@@ -151,7 +151,7 @@ load_zone(dns_zone_t *zone) {
 	bool zone_dynamic;
 	uint32_t serial;
 
-	result = dns_zone_load(zone);
+	result = dns_zone_load(zone, false);
 	if (result != ISC_R_SUCCESS && result != DNS_R_UPTODATE
 	    && result != DNS_R_DYNAMIC && result != DNS_R_CONTINUE)
 		goto cleanup;

bin/tests/system/filter-aaaa/ns5/hints

@@ -0,0 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 0 NS ns.rootservers.utld.
+ns.rootservers.utld. 0 A 10.53.0.1

bin/tests/system/filter-aaaa/ns5/named.conf.in

@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { fd92:7065:b8e:ffff::5; };
+	recursion yes;
+	dnssec-validation no;
+	notify yes;
+	dns64 64:ff9b::/96 {
+			    clients { any; };
+			    exclude { any; };
+			    mapped { any; };
+	};
+	filter-aaaa-on-v4 break-dnssec;
+	filter-aaaa { any; };
+	minimal-responses no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." { type hint; file "hints"; };

bin/tests/system/filter-aaaa/setup.sh

@@ -18,6 +18,7 @@ copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
 copy_setports ns4/named1.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
 
 (cd ns1 && $SHELL -e sign.sh)
 (cd ns4 && $SHELL -e sign.sh)

bin/tests/system/filter-aaaa/tests.sh

@@ -1374,5 +1374,17 @@ grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# We don't check for the AAAA record here as configuration in ns5 does
+# not make sense.  The AAAA record is wanted by filter-aaaa but discarded
+# by the dns64 configuration. We just want to ensure the server stays
+# running.
+n=`expr $n + 1`
+echo_i "checking filter-aaaa with dns64 ($n)"
+ret=0
+$DIG $DIGOPTS aaaa aaaa-only.unsigned @10.53.0.5 > dig.out.ns5.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/ifconfig.sh

@@ -38,15 +38,7 @@ EOF
 	exit 1
 fi
 
-# If running on hp-ux, don't even try to run config.guess.
+sys=`sh $config_guess`
-# It will try to create a temporary file in the current directory,
-# which fails when running as root with the current directory
-# on a NFS mounted disk.
-
-case `uname -a` in
-	*HP-UX*) sys=hpux ;;
-	*) sys=`sh $config_guess` ;;
-esac
 
 use_ip=
 case "$sys" in

bin/tests/system/inline/clean.sh

@@ -73,6 +73,10 @@ rm -f ns3/nsec3.db
 rm -f ns3/nsec3.db.jnl
 rm -f ns3/nsec3.db.signed
 rm -f ns3/nsec3.db.signed.jnl
+rm -f ns3/delayedkeys.db
+rm -f ns3/delayedkeys.db.jnl
+rm -f ns3/delayedkeys.db.signed
+rm -f ns3/delayedkeys.db.signed.jnl
 rm -f ns3/removedkeys-primary.db
 rm -f ns3/removedkeys-primary.db.jnl
 rm -f ns3/removedkeys-primary.db.signed

bin/tests/system/inline/ns2/bits.db.in

@@ -18,110 +18,3 @@ $TTL 300	; 5 minutes
 			NS	ns3
 ns2			A	10.53.0.2
 ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns2/named.conf.in

@@ -48,6 +48,7 @@ zone "retransfer3" {
 	type master;
 	file "retransfer3.db";
 	allow-update { any; };
+	allow-transfer { none; };	// changed dynamically by tests.sh
 	notify no;
 };
 

bin/tests/system/inline/ns3/master.db.in

@@ -16,112 +16,4 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
-ns2			A	10.53.0.2
 ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master2.db.in

@@ -16,113 +16,6 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
-ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
 e			A	10.0.0.5
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master3.db.in

@@ -16,114 +16,7 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
-ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
-a			A	10.0.0.1
-b			A	10.0.0.2
 c			A	10.0.0.3
-d			A	10.0.0.4
 e			A	10.0.0.5
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master4.db.in

@@ -16,114 +16,7 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
-ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
-a			A	10.0.0.1
-b			A	10.0.0.2
 c			A	10.0.0.3
-d			A	10.0.0.4
 e			A	10.0.0.5
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master5.db.in

@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042411 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5

bin/tests/system/inline/ns3/named.conf.in

@@ -58,6 +58,10 @@ zone "master" {
 	inline-signing yes;
 	auto-dnssec maintain;
 	file "master.db";
+	notify explicit;
+	also-notify {
+		10.53.0.3;
+	};
 };
 
 zone "dynamic" {
@@ -141,6 +145,13 @@ zone "nokeys" {
 	file "nokeys.bk";
 };
 
+zone "delayedkeys" {
+	type master;
+	inline-signing yes;
+	auto-dnssec maintain;
+	file "delayedkeys.db";
+};
+
 zone "removedkeys-primary" {
 	type master;
 	inline-signing yes;

bin/tests/system/inline/ns3/sign.sh

@@ -96,6 +96,14 @@ keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
 keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
+zone=delayedkeys
+rm -f K${zone}.+*+*.key
+rm -f K${zone}.+*+*.private
+keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+# Keys for the "delayedkeys" zone should not be initially accessible.
+mv K${zone}.+*+*.* ../
+
 zone=removedkeys-primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private

bin/tests/system/inline/ns4/noixfr.db.in

@@ -18,110 +18,3 @@ $TTL 300	; 5 minutes
 			NS	ns3
 ns4			A	10.53.0.4
 ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns.secure
-ns.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly 		NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3

bin/tests/system/inline/setup.sh

@@ -31,6 +31,7 @@ cp ns3/master.db.in ns3/updated.db
 cp ns3/master.db.in ns3/expired.db
 cp ns3/master.db.in ns3/nsec3.db
 cp ns3/master.db.in ns3/externalkey.db
+cp ns3/master.db.in ns3/delayedkeys.db
 cp ns3/master.db.in ns3/removedkeys-primary.db
 
 mkdir ns3/removedkeys

bin/tests/system/inline/tests.sh

@@ -27,22 +27,6 @@ do
 	sleep 1
 done
 
-# Loop until retransfer3 has been transferred.
-for i in 1 2 3 4 5 6 7 8 9 0
-do
-        ans=0
-        $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ans=1
-	[ $ans = 0 ] && break
-        sleep 1
-done
-
-for i in 1 2 3 4 5 6 7 8 9 0
-do
-	nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param retransfer3.`
-	test "$nsec3param" = "1 0 0 -" && break
-	sleep 1
-done
-
 n=`expr $n + 1`
 echo_i "checking that rrsigs are replaced with ksk only ($n)"
 ret=0
@@ -770,9 +754,48 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check 'rndc signing -nsec3param' requests are queued for zones which are not loaded ($n)"
+ret=0
+# The "retransfer3" zone is configured with "allow-transfer { none; };" on ns2,
+# which means it should not yet be available on ns3.
+$DIG $DIGOPTS @10.53.0.3 retransfer3 SOA > dig.out.ns3.pre.test$n
+grep "status: SERVFAIL" dig.out.ns3.pre.test$n > /dev/null || ret=1
+# Switch the zone to NSEC3.  An "NSEC3 -> NSEC -> NSEC3" sequence is used purely
+# to test that multiple queued "rndc signing -nsec3param" requests are handled
+# properly.
+$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 signing -nsec3param none retransfer3 > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
+# Reconfigure ns2 to allow outgoing transfers for the "retransfer3" zone.
+sed "s|\(allow-transfer { none; };.*\)|// \1|;" ns2/named.conf > ns2/named.conf.new
+mv ns2/named.conf.new ns2/named.conf
+$RNDCCMD 10.53.0.2 reconfig || ret=1
+# Request ns3 to retransfer the "retransfer3" zone.
+$RNDCCMD 10.53.0.3 retransfer retransfer3 || ret=1
+# Wait until ns3 finishes building the NSEC3 chain for "retransfer3".  There is
+# no need to immediately set ret=1 if building the NSEC3 chain is not finished
+# within the time limit because the query we will send shortly will detect any
+# problems anyway.
+for i in 0 1 2 3 4 5 6 7 8 9
+do
+	$RNDCCMD 10.53.0.3 signing -list retransfer3 > signing.out.test$n.$i 2>&1
+	keys_done=`grep "Done signing" signing.out.test$n.$i | wc -l`
+	nsec3_pending=`grep "NSEC3 chain" signing.out.test$n.$i | wc -l`
+	test $keys_done -eq 2 -a $nsec3_pending -eq 0 && break
+	sleep 1
+done
+# Check whether "retransfer3" uses NSEC3 as requested.
+$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
+grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ret=1
+grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "check rndc retransfer of a inline nsec3 slave retains nsec3 ($n)"
 ret=0
+$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	ans=0
@@ -877,6 +900,31 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)"
+ret=1
+# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so
+# that the master file modification time has no possibility of being equal to
+# the one stored during server startup.
+sleep 1
+nextpart ns3/named.run > /dev/null
+cp ns3/master5.db.in ns3/master.db
+$RNDCCMD 10.53.0.3 reload 2>&1 | sed 's/^/ns3 /' | cat_i
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+	if nextpart ns3/named.run | grep "zone master.*sending notifies" > /dev/null; then
+		ret=0
+		break
+	fi
+	sleep 1
+done
+# Sanity check: master file updates should be reflected in the signed zone,
+# i.e. SOA RNAME should no longer be set to "hostmaster".
+$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1
+grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "test add/del zone combinations ($n)"
 ret=0
@@ -1244,7 +1292,61 @@ grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# Check that the master file $2 for zone $1 does not contain RRSIG records
+# while the journal file for that zone does contain them.
+ensure_sigs_only_in_journal() {
+	origin="$1"
+	masterfile="$2"
+	$CHECKZONE -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null && ret=1
+	$CHECKZONE -j -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null || ret=1
+}
+
 n=`expr $n + 1`
+echo_i "checking that records added from a journal are scheduled to be resigned ($n)"
+ret=0
+# Signing keys for the "delayedkeys" zone are not yet accessible.  Thus, the
+# zone file for the signed version of the zone will contain no DNSSEC records.
+# Move keys into place now and load them, which will cause DNSSEC records to
+# only be present in the journal for the signed version of the zone.
+mv Kdelayedkeys* ns3/
+$RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
+# Wait until the zone is signed.
+ans=1
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+	$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
+	num=`grep "Done signing with" signing.out.test$n | wc -l`
+	if [ $num -eq 2 ]; then
+		ans=0
+		break
+	fi
+	sleep 1
+done
+if [ $ans != 0 ]; then ret=1; fi
+# Halt rather than stopping the server to prevent the master file from being
+# flushed upon shutdown since we specifically want to avoid it.
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} . ns3
+ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3
+# At this point, the raw zone journal will not have a source serial set.  Upon
+# server startup, receive_secure_serial() will rectify that, update SOA, resign
+# it, and schedule its future resign.  This will cause "rndc zonestatus" to
+# return delayedkeys/SOA as the next node to resign, so we restart the server
+# once again; with the raw zone journal now having a source serial set,
+# receive_secure_serial() should refrain from introducing any zone changes.
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} . ns3
+ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3
+# We can now test whether the secure zone journal was correctly processed:
+# unless the records contained in it were scheduled for resigning, no resigning
+# event will be scheduled at all since the secure zone master file contains no
+# DNSSEC records.
+$RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
+grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+n=`expr $n + 1`
+
 echo_i "check that zonestatus reports 'type: master' for a inline master zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 zonestatus master > rndc.out.ns3.test$n

bin/tests/system/mirror/ns3/named.conf.in

@@ -48,6 +48,7 @@ zone "initially-unavailable" {
 	masters { 10.53.0.2; };
 	mirror yes;
 	file "initially-unavailable.db.mirror";
+	use-alt-transfer-source no;
 };
 
 zone "verify-axfr" {

bin/tests/system/resolver/ans2/ans.pl

@@ -107,6 +107,10 @@ for (;;) {
 		# expected to be accepted regardless of the filter setting.
 		$packet->push("authority", new Net::DNS::RR("sub.example.org 300 NS ns.sub.example.org"));
 		$packet->push("additional", new Net::DNS::RR("ns.sub.example.org 300 A 10.53.0.3"));
+	} elsif ($qname =~ /glue-in-answer\.example\.org/) {
+		$packet->push("answer", new Net::DNS::RR("ns.glue-in-answer.example.org 300 A 10.53.0.3"));
+		$packet->push("authority", new Net::DNS::RR("glue-in-answer.example.org 300 NS ns.glue-in-answer.example.org"));
+		$packet->push("additional", new Net::DNS::RR("ns.glue-in-answer.example.org 300 A 10.53.0.3"));
 	} elsif ($qname =~ /\.broken/ || $qname =~ /^broken/) {
 		# Delegation to broken TLD.
 		$packet->push("authority", new Net::DNS::RR("broken 300 NS ns.broken"));

bin/tests/system/resolver/ans3/ans.pl

@@ -107,6 +107,8 @@ for (;;) {
 	} elsif ($qname eq "www.ok.sub.example.org") {
 		$packet->push("answer",
 			      new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
+	} elsif ($qname eq "foo.glue-in-answer.example.org") {
+		$packet->push("answer", new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
 	} else {
 		$packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4"));
 	}

bin/tests/system/resolver/tests.sh

@@ -247,6 +247,15 @@ if [ -x ${RESOLVE} ] ; then
     status=`expr $status + $ret`
 fi
 
+n=`expr $n + 1`
+echo_i "check that the resolver accepts a referral response with a non-empty ANSWER section ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
+grep "status: NOERROR" dig.ns1.out.${n} > /dev/null || ret=1
+grep "foo.glue-in-answer.example.org.*192.0.2.1" dig.ns1.out.${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "RT21594 regression test check setup ($n)"
 ret=0

bin/tests/system/rsabigexponent/bigkey.c

@@ -75,6 +75,8 @@ main(int argc, char **argv) {
 	UNUSED(argc);
 	UNUSED(argv);
 
+#if !USE_PKCS11
+
 	rsa = RSA_new();
 	e = BN_new();
 	pkey = EVP_PKEY_new();
@@ -149,6 +151,9 @@ main(int argc, char **argv) {
 	dns_name_destroy();
 	isc_mem_destroy(&mctx);
 	return (0);
+#else /* !USE_PKCS11 */
+	return (1);
+#endif /* !USE_PKC11 */
 }
 
 /*! \file */

bin/tests/system/rsabigexponent/prereq.sh

@@ -16,7 +16,7 @@ if $BIGKEY > /dev/null 2>&1
 then
     rm -f Kexample.*
 else
-    echo_i "This test requires cryptography" >&2
+    echo_i "This test requires OpenSSL cryptography provider" >&2
-    echo_i "configure with --with-openssl, or --with-pkcs11 and --enable-native-pkcs11" >&2
+    echo_i "configure with --with-openssl, and make sure you disable --with-pkcs11 and --enable-native-pkcs11" >&2
     exit 255
 fi

bin/tests/system/stop.pl

@@ -31,11 +31,12 @@ use Getopt::Long;
 #
 #   server          Name of the server directory.
 
-my $usage = "usage: $0 [--use-rndc [--port port]] test-directory [server-directory]";
+my $usage = "usage: $0 [--use-rndc [--halt] [--port port]] test-directory [server-directory]";
 
 my $use_rndc = 0;
+my $halt = 0;
 my $port = 9953;
-GetOptions('use-rndc' => \$use_rndc, 'port=i' => \$port) or die "$usage\n";
+GetOptions('use-rndc' => \$use_rndc, 'halt' => \$halt, 'port=i' => \$port) or die "$usage\n";
 
 my $errors = 0;
 
@@ -131,9 +132,10 @@ sub stop_rndc {
 
 	return unless ($server =~ /^ns(\d+)$/);
 	my $ip = "10.53.0.$1";
+	my $how = $halt ? "halt" : "stop";
 
 	# Ugly, but should work.
-	system("$ENV{RNDC} -c ../common/rndc.conf -s $ip -p $port stop | sed 's/^/I:$server /'");
+	system("$ENV{RNDC} -c ../common/rndc.conf -s $ip -p $port $how | sed 's/^/I:$server /'");
 	return;
 }
 

bin/tests/system/win32/bigkey.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/feature-test.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/gencheck.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/keycreate.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/keydelete.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/pipequeries.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>